Methods And Apparatus For Creating An Isolated Partition For A Virtual Trusted Platform Module

Abstract

A data processing system isolates a virtual trusted platform module (vTPM) manager in the processing system from other management software in the processing system. In one example process, the processing system launches a virtual machine monitor (VMM) that includes a memory-mapped input/output (MMIO) trap. The processing system also launches a vTPM manager in a first virtual machine (VM). In addition, the processing system launches a second VM to contain virtual machine management programs other than the vTPM manager and the MMIO trap. Other embodiments are described and claimed.

1 . A method comprising:
 launching a service operating system (OS) in a service virtual machine (VM) in a processing system;   launching a user OS in a guest VM in the processing system;   instantiating a first virtual trusted platform module (vTPM) for use by the service OS of the service VM; and   instantiating a second vTPM for use by the user OS of the guest VM, wherein the first and second vTPMs are instantiated by creation of software TPMs (sTPMs) in a partition of the processing system.   
     
     
         2 . The method of  claim 1 , wherein the partition comprises a VM including a vTPM manager. 
     
     
         3 . The method of  claim 2 , further comprising providing a TPM driver and a TPM device model in the partition. 
     
     
         4 . The method of  claim 3 , further comprising providing a second TPM driver in the guest VM, and configuring the second TPM driver to point to an address associated with a first one of the sTPMs. 
     
     
         5 . The method of  claim 4 , further comprising configuring the TPM driver to point to an address associated with a hardware TPM in the processing system. 
     
     
         6 . The method of  claim 4 , further comprising accessing the second vTPM through the second TPM driver via a user application. 
     
     
         7 . The method of  claim 2 , further comprising launching a virtual machine monitor (VMM) in the processing system, the VMM to include a memory-mapped input/output (MMIO) trap, launching the vTPM manager in the VM, and launching a second VM to contain virtual machine management programs other than the vTPM manager and the MMIO trap. 
     
     
         8 . The method of  claim 7 , further comprising:
 intercepting, at the MMIO trap in the VMM, information from the second TPM driver for the guest OS; and   in response to intercepting the information from the second TPM driver at the MMIO trap, communicating between the VMM and the vTPM manager.   
     
     
         9 . The method of  claim 3 , further comprising:
 using the TPM driver to communicate with a hardware TPM in the processing system; and   using a para-virtualized TPM driver for the service OS to communicate with the first vTPM.   
     
     
         10 . The method of  claim 9 , further comprising intercepting an operation of the service OS involving the first vTPM, and using the vTPM manager to process the operation of the service OS involving the first vTPM. 
     
     
         11 . A processing system comprising:
 a processor to execute instructions;   a trusted platform module (TPM); and   a non-transitory storage including instructions which, when executed by the processor, cause the processing system to performing operations comprising:
 launching a service operating system (OS) in a service virtual machine (VM); 
 launching a user OS in a guest VM; 
 instantiating a first virtual trusted platform module (vTPM) for use by the service OS of the service VM; and 
 instantiating a second vTPM for use by the user OS of the guest VM, 
   wherein the first and second vTPMs are instantiated by creation of software TPMs (sTPMs) in a partition of the processing system.   
     
     
         12 . The processing system of  claim 11 , wherein the partition comprises a VM including a vTPM manager. 
     
     
         13 . The processing system of  claim 12 , wherein the partition comprises a TPM driver and a TPM device model. 
     
     
         14 . The processing system of  claim 13 , further comprising a second TPM driver in the guest VM, the second TPM driver to point to an address associated with a first one of the sTPMs. 
     
     
         15 . The processing system of  claim 14 , wherein the TPM driver is to point to an address associated with the TPM. 
     
     
         16 . An article comprising a machine-accessible storage medium including instructions that when executed cause a system to:
 launch a service operating system (OS) in a service virtual machine (VM);   launch a user OS in a guest VM;   instantiate a first virtual trusted platform module (vTPM) for use by the service OS of the service VM; and   instantiate a second vTPM for use by the user OS of the guest VM, wherein the first and second vTPMs are instantiated by creation of software TPMs (sTPMs) in a partition of the system.   
     
     
         17 . The article of  claim 16 , wherein the partition comprises a VM including a vTPM manager. 
     
     
         18 . The article of  claim 17 , further comprising instructions that when executed enable the system to provide a TPM driver and a TPM device model in the partition. 
     
     
         19 . The article of  claim 18 , further comprising instructions that when executed enable the system to provide a second TPM driver in the guest VM, and configure the second TPM driver to point to an address associated with a first one of the sTPMs. 
     
     
         20 . The article of  claim 19 , further comprising instructions that when executed enable the system to configure the TPM driver to point to an address associated with a hardware TPM in the system.