swtpm

swtpm_cert is a specialized tool used to create Endorsement Key (EK) and platform certificates for a TPM.

Key characteristics:

• It operates using only the public key parameters of the EK.
• It does not require the certificate request to be self-signed.

swtpm_setup is a tool designed to simulate the manufacturing process of a Trusted Platform Module (TPM). It allows users to prepare the initial state of a TPM by performing the following sequence of operations:

1. EK Creation: Instructing the TPM to create an Endorsement Key (EK).
2. Certificate Generation: Creating the EK and platform certificates.
3. NVRAM Provisioning: Saving these certificates into the TPM's Non-Volatile RAM (NVRAM) before the TPM is used for the first time.

This ensures the TPM starts in a pre-provisioned state suitable for subsequent use in simulated environments.

SWTPM is a package of TPM (Trusted Platform Module) emulators that interface with libtpms. It allows for the creation of emulated TPMs accessible through various front-end interfaces.

Supported interfaces include:

• Socket interfaces: TCP/IP and Unix sockets.
• Linux CUSE interface: Enables the creation of multiple native /dev/vtpm* devices.

The swtpm_ioctl tool is used to send out-of-band control commands to the CUSE TPM (swtpm_cuse). This allows for management and control operations that are handled outside the standard TPM command interface.

For detailed command usage and available ioctls, refer to the manual page: man swtpm_ioctl.

Beyond the core emulators, the SWTPM package includes several specialized tools for TPM lifecycle management and simulation:

• TPM Usage: Tools to interact with and use the emulated TPM.
• Certificate Management: Tools for creating certificates for a TPM.
• Manufacturing Simulation: Tools to simulate the manufacturing process, such as creating an Endorsement Key (EK) and platform certificates.

For detailed instructions on specific tools, refer to the individual README files located in the src/ directory of the repository.

The swtpm command-line tool simulates a TPM (Trusted Platform Module). To start the emulator, you must specify a TPM interface type as the first argument. The available interfaces depend on how the binary was compiled.

Interface Types

• socket: The standard interface type.
• chardev: Character device interface (available if WITH_CHARDEV is enabled).
• cuse: CUSE (Character device in Userspace) interface (available if WITH_CUSE is enabled).

Basic Usage

# Start using the socket interface
swtpm socket [options]

# Start using the chardev interface (if supported)
swtpm chardev [options]

# Start using the cuse interface (if supported)
swtpm cuse [options]

To see the specific options available for a chosen interface, use the --help flag after the interface type (e.g., swtpm socket --help).

For detailed command-line options, usage instructions, and technical specifications of swtpm_bios, consult the local manual page.

man swtpm_bios

If the project is compiled with HAVE_SWTPM_CUSE_MAIN defined, you can use swtpm_cuse_main. This entry point allows running swtpm using the CUSE (Character device in USERspace) framework, enabling the TPM to appear as a character device in the filesystem.

#ifdef HAVE_SWTPM_CUSE_MAIN
int swtpm_cuse_main(int argc, char **argv, const char *prgname, const char *iface);
#endif

The server abstraction manages the underlying file descriptor and connection parameters (such as Unix socket paths) for the TPM server interface. It supports different transport modes like TCP, Unix sockets, or CUSE via the file descriptor and flags provided during initialization.

To use the server interface, you typically initialize it with server_new, interact with its file descriptor using server_get_fd, and ensure resources are released with server_free.

// Initialize a new server instance
struct server *s = server_new(fd, flags, "/tmp/swtpm.sock");

if (s != NULL) {
    int current_fd = server_get_fd(s);
    // ... use the server ...
    
    // Clean up resources and close the connection
    server_free(s);
}

The swtpm_main function serves as the primary entry point for the standard swtpm command-line tool. It initializes and executes the TPM simulation logic based on the provided command-line arguments.

int swtpm_main(int argc, char **argv, const char *prgname, const char *iface);