firecracker-microvm / firecracker-microvm/firecracker

Trusted Platform Module Support

Open
#3,629 5 comments 3 reactions 0 assignees View on GitHub
Priority: Low Roadmap: New Request Status: Parked
Dominant language
Rust
Stars
36.7k
Forks
2.6k
Avg merge
3d 3h
Merged PRs (30d)
58

Description

We are working on integrating Trusted Platform Module device support for Firecracker as part of our master's thesis.
Our fork currently has working functionality for a TPM over virtio, to match the FC device model in comparison to implementing a hardware interface such as CRB or TIS.
One caveat with this is that there is no mainline Linux support for virtio-tpm. However Google have implemented a driver in their ChromeOS Linux fork [\[1\]](https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1480209/2).
They have also made efforts to merge it into Linux mainline, but the request was not accepted [\[2\]](https://marc.info/?l=linux-integrity&m=155080164713684&w=2). In our testing we have compiled the mainline linux kernel and only adding that specific driver which works fine.

As mentioned, the hypervisor changes are simple and fits the virtio architecture in the project well. In practice this can be used in conjunction with Linux IMA to have integrity-verified workloads in Firecracker.

Is there interest to try to get this merged into upstream? We are of course willing to work together to get the changes up to the quality of the rest of the project.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.