Method and apparatus for virtualization of a multi-context hardware trusted platform module (TPM)
In one embodiment, the present invention includes a method for receiving a request for a trusted platform module (TPM) operation from a virtual machine, determining whether the request is for a modification of a TPM version, and associating part of a multi-context hardware TPM with a virtual TPM (vTPM) to enable the modification. Other embodiments are described and claimed.
1. A method comprising:
receiving a request for a trusted platform module (TPM) operation from a first virtual machine in a virtual TPM (vTPM) manager;
determining whether the request is for a modification of a TPM version associated with the first virtual machine; and
if so, associating a portion of a multi-context hardware TPM associated with the first virtual machine with a virtual TPM (vTPM) associated with the first virtual machine to enable the modification of the TPM version.
2. The method of claim 1 , further comprising filtering a command received from a second virtual machine in the vTPM manager and forwarding the command to a selected service virtual machine for execution, wherein a context of the multi-context hardware TPM associated with the second virtual machine is not able to perform the command.
3. The method of claim 1 , further comprising accelerating a request from a second virtual machine by communicating at least a portion of the request to an associated context of the multi-context hardware TPM and to a virtual TPM associated with the second virtual machine.
4. The method of claim 1 , further comprising maintaining TPM state for a plurality of virtual machines in a chipset component, and loading a first TPM state associated with the first virtual machine into the multi-context hardware TPM, wherein the multi-context hardware TPM executes on a manageability engine of the chipset component.
5. The method of claim 4 , further comprising loading the first TPM state into the manageability engine using a virtualization engine of the chipset component if an instance identifier associated with the first TPM state matches an instance identifier obtained from a remote server.
6. The method of claim 3 , wherein accelerating the request comprises communicating the request portion to the multi-context hardware TPM using a TPM conduit of pass-through software executing between the multi-context hardware TPM and a virtual machine including the vTPM manager.
7. The method of claim 1 , further comprising instantiating a plurality of vTPM contexts using the vTPM manager, wherein each of the plurality of vTPM contexts is associated with one of a plurality of virtual machines, and wherein the plurality of vTPM contexts share a first context of the multi-context hardware TPM.
8. The method of claim 7 , wherein each of the plurality of vTPM contexts is associated with a user operating system, and further comprising instantiating a second plurality of vTPM contexts using the vTPM manager, wherein each of the second plurality of vTPM contexts is associated with one of a plurality of virtual machines of a service operating system, and wherein the second plurality of vTPM contexts share a second context of the multi-context hardware TPM.
9. An article comprising a non-transitory machine accessible medium including instructions that when executed cause a system to:
receive a request for a trusted platform module (TPM) operation from a first virtual machine in a virtual TPM (vTPM) manager;
accelerate the request by communication of at least a portion of the request to each of an associated context of a multi-context hardware TPM and to a virtual TPM (vTPM) associated with the first virtual machine, the communication to the multi-context hardware TPM via a TPM conduit of pass-through software executed between the multi-context hardware TPM and a second virtual machine including the vTPM manager.
10. The article of claim 9 , further comprising instructions that when executed enable the system to filter a command received from a third virtual machine in the vTPM manager and forward the command to a selected service virtual machine for execution, wherein a context of the multi-context hardware TPM associated with the third virtual machine is not able to perform the command.
11. The article of claim 9 , further comprising instructions that when executed enable the system to maintain TPM state for a plurality of virtual machines in a chipset component, load a first TPM state associated with the first virtual machine into a manageability engine of the chipset component using a virtualization engine of the chipset component, wherein the multi-context hardware TPM executes on the manageability engine.
12. The article of claim 9 , further comprising instructions that when executed enable the system to determine whether the request is for a modification of a TPM version associated with the first virtual machine, and if so, associate the associated context of the multi-context hardware TPM with the associated vTPM to enable the modification of the TPM version.
13. The article of claim 9 , further comprising instructions that when executed enable the system to instantiate a first plurality of vTPM contexts each associated with one of a plurality of virtual machines of a user operating system using the vTPM manager, and instantiate a second plurality of vTPM contexts each associated with one of a plurality of virtual machines of a service operating system using the vTPM manager, and wherein the first plurality of vTPM contexts share a first context of the multi-context hardware TPM and the second plurality of vTPM contexts share a second context of the multi-context hardware TPM.
14. A system comprising:
a processor to execute instructions;
a chipset coupled to the processor, the chipset including a multi-context hardware trusted platform module (TPM) including a first context and a second context, wherein a TPM manager is to instantiate a first plurality of virtual TPM (vTPM) contexts each associated with one of a plurality of user virtual machines to execute using the first context, and instantiate a second plurality of vTPM contexts each associated with one of a plurality of service virtual machines to execute using the second context; and
a dynamic random access memory (DRAM) coupled to the chipset.
15. The system of claim 14 , wherein the chipset includes a manageability engine (ME) and a virtualization engine (VE), wherein the multi-context hardware TPM is to execute on the ME and the VE is to load the first and second contexts into and out of the ME based on a comparison between a saved copy of a virtual machine (VM) identifier associated with the first and second contexts and a current VM identifier.