From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:39530) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R4BdM-0004zL-M0 for qemu-devel@nongnu.org; Thu, 15 Sep 2011 09:05:41 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1R4BdK-0001NX-96 for qemu-devel@nongnu.org; Thu, 15 Sep 2011 09:05:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:30222) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R4BdK-0001NJ-0p for qemu-devel@nongnu.org; Thu, 15 Sep 2011 09:05:38 -0400 Date: Thu, 15 Sep 2011 14:05:14 +0100 From: "Daniel P. Berrange" Message-ID: <20110915130514.GQ29309@redhat.com> References: <4E70DEE8.8090908@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <4E70DEE8.8090908@linux.vnet.ibm.com> Subject: Re: [Qemu-devel] Design of the blobstore Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Berger Cc: Markus Armbruster , Anthony Liguori , QEMU Developers , "Michael S. Tsirkin" On Wed, Sep 14, 2011 at 01:05:44PM -0400, Stefan Berger wrote: > Hello! > > Over the last few days primarily Michael Tsirkin and I have > discussed the design of the 'blobstore' via IRC (#virtualization). > The intention of the blobstore is to provide storage to persist > blobs that devices create. Along with these blobs possibly some > metadata should be storable in this blobstore. > > An initial client for the blobstore would be the TPM emulation. > The TPM's persistent state needs to be stored once it changes so it > can be restored at any point in time later on, i.e., after a cold > reboot of the VM. In effect the blobstore simulates the NVRAM of a > device where it would typically store such persistent data onto. While I can see the appeal of a general 'blobstore' for NVRAM tunables related to device, wrt the TPM emulation, should we be considering use of something like the PKCS#11 standard for storing/retrieving crypto data for the TPM ? https://secure.wikimedia.org/wikipedia/en/wiki/PKCS11 This is a industry standard for interfacing to cryptographic storage mechanisms, widely supported by all SSL libraries & more or less all programming languages. IIUC it lets the application avoid hardcoding a specification storage backend impl, so it can be made to work with anything from local files, to smartcards, to HSMs, to remote network services. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|