Re: [Qemu-devel] Is is possible to virtualise or share the TPM?

[Stefan Berger <stefanb@linux.vnet.ibm.com>]

On 08/30/2012 10:21 AM, Jordi Cucurull Juan wrote:
> Dear Stefan,
>
> What does it mean that the patches with the VTPM functionality exist 
> but they are behind the regular ones? Does it mean that they are not 
> currently updated? That they have less priority?

It means that in my patch queue they are 'behind' the ones I posted over 
the last few months.

   Stefan


>
> Best regards,
> Jordi.
>
>
>
> On 08/29/2012 02:57 PM, Stefan Berger wrote:
>> On 08/23/2012 04:05 PM, Corey Bryant wrote:
>>>
>>>
>>> On 08/21/2012 06:31 AM, Jordi Cucurull Juan wrote:
>>>> Dear all,
>>>>
>>>> After applying the TPM patches to QEMU, I was wondering if it is
>>>> possible to simultaneously use the TPM in more than one virtual 
>>>> machine,
>>>> i.e. virtualisation of the TPM.
>>>>
>>>> According to the paper "Stefan Berger, Ramón Cáceres, Kenneth A.
>>>> Goldman, Ronald Perez, Reiner Sailer, Leendert van Doorn. vTPM:
>>>> Virtualizing the Trusted Platform Module" this seems to be possible in
>>>> Xen. Is not possible in QEMU?
>>>>
>>>> Thanks!
>>>> Jordi.
>>>>
>>>>
>>>
>>> I don't think the pass-through driver supports use by multiple VMs. 
>>> Stefan Berger should be able to answer better so I'm adding him to 
>>> the thread.
>>>
>>
>> The pass-through driver cannot provide access for multiple VMs to the 
>> single hardware TPM on the host. The usage model and the statefulness 
>> of the TPM (SRK password, owner password, keys) basically 
>> prevent/complicate this. The implementation for Xen was indep. of the 
>> Qemu code base today and there we used a software implementation of 
>> the TPM that provided a private TPm instance to each VM. I have 
>> patches for this for Qemu but due to an IRC chat in Sept. 2011 they 
>> are 'behind' the pass-through driver patches.
>>
>>    Stefan
>>
>
>