Re: [Qemu-devel] [PATCH v5 0/4] Extend TPM support with a QEMU-external TPM

["Daniel P. Berrange" <berrange@redhat.com>]

On Wed, Jan 20, 2016 at 10:23:50AM -0500, Stefan Berger wrote:
> "Daniel P. Berrange" <berrange@redhat.com> wrote on 01/20/2016 09:58:39 
> AM:
> 
> 
> > Subject: Re: [Qemu-devel] [PATCH v5 0/4] Extend TPM support with a 
> > QEMU-external TPM
> > 
> > On Mon, Jan 04, 2016 at 10:23:18AM -0500, Stefan Berger wrote:
> > > The following series of patches extends TPM support with an
> > > external TPM that offers a Linux CUSE (character device in userspace)
> > > interface. This TPM lets each VM access its own private vTPM.
> > 
> > What is the backing store for this vTPM ? Are the vTPMs all
> > multiplexed onto the host's physical TPM or is there something
> > else going on ?
> 
> The vTPM writes its state into a plain file. In case the user started the 
> vTPM, the user gets to choose the directory. In case of libvirt, libvirt 
> sets up the directory and starts the vTPM with the directory as a 
> parameter. The expectation for VMs (also containers) is that each VM can 
> use the full set of TPM commands with the vTPM and due to how the TPM 
> works, it cannot use the hardware TPM for that. SeaBIOS has been extended 
> with TPM 1.2 support and initializes the vTPM in the same way it would 
> initialize a hardware TPM.

So if its using a plain file, then when snapshotting VMs we have to
do full copies of the file and keep them all around in sync with
the disk snapshots. By not having this functionality in QEMU we don't
immediately have a way to use qcow2 for the vTPM file backing store
to deal with snapshot management. The vTPM needs around snapshotting
feel fairly similar to the NVRAM needs, so it would be desiralbe to
have a ability to do a consistent thing for both.

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|