add tss image

Signed-off-by: Avi Deitcher <avi@deitcher.net>

docs/trusted-computing.md

@@ -0,0 +1,59 @@
+# Trusted Computing
+
+LinuxKit has support for using [Trusted Computing](http://trustedcomputinggroup.org) Platform Modules (tpm) chips.
+
+Supporting tpm requires support at three levels:
+
+* Hardware
+* Kernel
+* Software - The Trusted Computing Software Stack (TSS)
+
+## Hardware
+You need to have a tpm chip installed in your computer to use tpm. Alternatively, you can use one of the virtual tpms implemented in software, provided that either:
+
+* your kernel supports it
+* your hardware virtualization platform supports it
+
+## Kernel
+As of [PR 2234](https://github.com/linuxkit/linuxkit/pull/2234), the in-tree linux kernel modules that support tpm are shipped with LinuxKit by default.
+
+The shipped modules support both tpm chip versions 1.2 and tpm 2.0.
+
+## Software
+The software stack (TSS) functions differently between tpm versions 1.2 and 2.0.
+
+### tss 1.2
+In tss 1.2, the character device `/dev/tpm0` is meant to be addresses only by a single process. All other clients are expected to communicate with this single client that handles multiplexing of requests and various other low-level functionality.
+
+The single client normally used is [TrouSerS](https://sourceforge.net/p/trousers/trousers/). It creates a daemon, `tcsd`, that communicates with the character device (and via the character device and the kernel module to the actual tpm).
+
+`tcsd` in turn listens on `localhost:30003` for tpm commands. All other clients are expected to communicate via tcp to `tcsd`.
+
+LinuxKit provides the `linuxkit/tss` image which includes:
+
+* `tcsd`
+* the various `tpm_*` tools
+
+To make a `tcsd` available to your LinuxKit image, just include it:
+
+```yml
+services:
+  - name: tss
+    image: linuxkit/tss:<hash>
+```
+
+For a full example, see [tpm.yml](../examples/tpm.yml)
+
+### tss 2.0
+In tss 2.0, the character device `/dev/tpmrm0` can be addressed by as many processes, in parallel, as desired. All of the multiplexing and low-level services are built into the kernel module.
+
+To use a tpm 2.0 device, you do **not** need any special tss container. You just need an container that:
+
+1. Bind-mounts `/dev` in
+2. Has your tools or libraries installed
+3. Talks directly to `/dev/tpmrm0`
+
+
+The image `linuxkit/tss` ships with the version 1.2 `tcsd` and the `tpm_*` tools for tpm version 1.2. The tools for tpm version 2.0 `tpm2_*` and its attendant libs are _not_ included in the image.
+
+We intend to release a tss 2.0 compatible image in the near future. In the meantime, nothing prevents you from using and compiling your own tss and including it in a LinuxKit image.