요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
=============================================
Virtual TPM Proxy Driver for Linux Containers
=============================================
| Authors:
| Stefan Berger <stefanb@linux.vnet.ibm.com>
This document describes the virtual Trusted Platform Module (vTPM)
proxy device driver for Linux containers.
Introduction
============
The goal of this work is to provide TPM functionality to each Linux
container. This allows programs to interact with a TPM in a container
the same way they interact with a TPM on the physical system. Each
container gets its own unique, emulated, software TPM.
Design
======
To make an emulated software TPM available to each container, the container
management stack needs to create a device pair consisting of a client TPM
character device ``/dev/tpmX`` (with X=0,1,2...) and a 'server side' file
descriptor. The former is moved into the container by creating a character
device with the appropriate major and minor numbers while the file descriptor
is passed to the TPM emulator. Software inside the container can then send
TPM commands using the character device and the emulator will receive the
commands via the file descriptor and use it for sending back responses.
To support this, the virtual TPM proxy driver provides a device ``/dev/vtpmx``
that is used to create device pairs using an ioctl. The ioctl takes as
an input flags for configuring the device. The flags for example indicate
whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator.
The result of the ioctl are the file descriptor for the 'server side'
as well as the major and minor numbers of the character device that was created.
Besides that the number of the TPM character device is returned. If for
example ``/dev/tpm10`` was created, the number (``dev_num``) 10 is returned.
Once the device has been created, the driver will immediately try to talk
to the TPM. All commands from the driver can be read from the file descriptor
returned by the ioctl. The commands should be responded to immediately.
UAPI
====
.. kernel-doc:: include/uapi/linux/vtpm_proxy.h
.. kernel-doc:: drivers/char/tpm/tpm_vtpm_proxy.c
:functions: vtpmx_ioc_new_dev
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
vTPM proxy 문서 개요
1-10Stefan Berger가 작성한 이 문서는 Linux container용 virtual Trusted Platform Module(vTPM) proxy device driver를 설명한다.
Container와 emulator를 kernel proxy가 연결한다.
=============================================
Virtual TPM Proxy Driver for Linux Containers
=============================================
| Authors:
| Stefan Berger <stefanb@linux.vnet.ibm.com>
This document describes the virtual Trusted Platform Module (vTPM)
proxy device driver for Linux containers.
Container별 독립 software TPM
11-18목표는 각 Linux container에 TPM 기능을 제공하는 것이다. Container 안의 program은 physical system의 TPM과 같은 방식으로 TPM을 사용하며, 각 container는 고유하게 emulation된 software TPM을 받는다.
각 container가 다른 emulated TPM instance와 client device를 사용한다.
Introduction
============
The goal of this work is to provide TPM functionality to each Linux
container. This allows programs to interact with a TPM in a container
the same way they interact with a TPM on the physical system. Each
container gets its own unique, emulated, software TPM.
Client device와 server fd 쌍
19-43Container management stack은 emulated software TPM을 제공하기 위해 client TPM character device `/dev/tpmX`와 server-side file descriptor로 구성된 device pair를 만든다. X는 0, 1, 2처럼 TPM device 번호다.
관리 stack은 적절한 major·minor 번호의 character device를 만들어 container 안으로 옮기고, server file descriptor는 TPM emulator에 전달한다. Container software가 character device로 TPM command를 보내면 emulator가 fd에서 command를 읽고 같은 fd로 response를 돌려보낸다.
Virtual TPM proxy driver는 `/dev/vtpmx`를 제공하며 ioctl로 device pair를 생성한다. 입력 flag는 emulator가 TPM 1.2 또는 TPM 2 기능을 지원하는지 같은 device 설정을 나타낸다.
Ioctl 결과는 server-side fd, 생성된 character device의 major·minor 번호, TPM device 번호 `dev_num`이다. 예를 들어 `/dev/tpm10`이면 `dev_num`은 10이다. Device 생성 직후 driver가 TPM과 통신을 시도하므로 emulator는 fd로 받은 command에 즉시 응답해야 한다.
Control device ioctl 결과를 container와 emulator 양쪽에 나누어 전달한다.
Device pair 생성 시 반환되는 식별자와 대상이다.
Design
======
To make an emulated software TPM available to each container, the container
management stack needs to create a device pair consisting of a client TPM
character device ``/dev/tpmX`` (with X=0,1,2...) and a 'server side' file
descriptor. The former is moved into the container by creating a character
device with the appropriate major and minor numbers while the file descriptor
is passed to the TPM emulator. Software inside the container can then send
TPM commands using the character device and the emulator will receive the
commands via the file descriptor and use it for sending back responses.
To support this, the virtual TPM proxy driver provides a device ``/dev/vtpmx``
that is used to create device pairs using an ioctl. The ioctl takes as
an input flags for configuring the device. The flags for example indicate
whether TPM 1.2 or TPM 2 functionality is supported by the TPM emulator.
The result of the ioctl are the file descriptor for the 'server side'
as well as the major and minor numbers of the character device that was created.
Besides that the number of the TPM character device is returned. If for
example ``/dev/tpm10`` was created, the number (``dev_num``) 10 is returned.
Once the device has been created, the driver will immediately try to talk
to the TPM. All commands from the driver can be read from the file descriptor
returned by the ioctl. The commands should be responded to immediately.
UAPI와 kernel-doc
44-50사용자 공간 API 정의는 `include/uapi/linux/vtpm_proxy.h`에서 kernel-doc으로 가져온다. Driver 구현 문서는 `drivers/char/tpm/tpm_vtpm_proxy.c`의 `vtpmx_ioc_new_dev` 함수를 참조한다.
Header와 구현 함수의 역할을 구분한다.
UAPI
====
.. kernel-doc:: include/uapi/linux/vtpm_proxy.h
.. kernel-doc:: drivers/char/tpm/tpm_vtpm_proxy.c
:functions: vtpmx_ioc_new_dev
요약·해설
tpm_vtpm_proxy.rst:1-50Linux container마다 /dev/tpmX와 server fd 쌍을 만들어 software TPM emulator에 연결하는 vTPM proxy UAPI를 설명합니다.