From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50622) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLuyQ-0005xC-1o for qemu-devel@nongnu.org; Wed, 20 Jan 2016 10:47:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aLuyM-0006n7-Iz for qemu-devel@nongnu.org; Wed, 20 Jan 2016 10:47:05 -0500 Received: from mx1.redhat.com ([209.132.183.28]:41848) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aLuyM-0006n2-BA for qemu-devel@nongnu.org; Wed, 20 Jan 2016 10:47:02 -0500 Date: Wed, 20 Jan 2016 15:46:57 +0000 From: "Daniel P. Berrange" Message-ID: <20160120154657.GF13215@redhat.com> References: <1451921002-8263-1-git-send-email-stefanb@us.ibm.com> <1451921002-8263-2-git-send-email-stefanb@us.ibm.com> <20160120150041.GC13215@redhat.com> <201601201532.u0KFW2q2019737@d03av03.boulder.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <201601201532.u0KFW2q2019737@d03av03.boulder.ibm.com> Subject: Re: [Qemu-devel] [PATCH v5 1/4] Provide support for the CUSE TPM Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Berger Cc: mst@redhat.com, Stefan Berger , qemu-devel@nongnu.org, jb613w@att.com, quan.xu@intel.com, silviu.vlasceanu@gmail.com, hagen.lauer@huawei.com On Wed, Jan 20, 2016 at 10:31:56AM -0500, Stefan Berger wrote: > "Daniel P. Berrange" wrote on 01/20/2016 10:00:41 > AM: > > > Subject: Re: [Qemu-devel] [PATCH v5 1/4] Provide support for the CUSE > TPM > > > > On Mon, Jan 04, 2016 at 10:23:19AM -0500, Stefan Berger wrote: > > > From: Stefan Berger > > > > > > Rather than integrating TPM functionality into QEMU directly > > > using the TPM emulation of libtpms, we now integrate an external > > > emulated TPM device. This device is expected to implement a Linux > > > CUSE interface (CUSE = character device in userspace). > > > > > > QEMU talks to the CUSE TPM using much functionality of the > > > passthrough driver. For example, the TPM commands and responses > > > are sent to the CUSE TPM using the read()/write() interface. > > > However, some out-of-band control needs to be done using the CUSE > > > TPM's ioctls. The CUSE TPM currently defines and implements 15 > > > different ioctls for controlling certain life-cycle aspects of > > > the emulated TPM. The ioctls can be regarded as a replacement for > > > direct function calls to a TPM emulator if the TPM were to be > > > directly integrated into QEMU. > > > > > > One of the ioctls allows to get a bitmask of supported capabilities. > > > Each returned bit indicates which capabilities have been implemented. > > > An include file defining the various ioctls is added to QEMU. > > > > > > The CUSE TPM and associated tools can be found here: > > > > > > https://github.com/stefanberger/swtpm > > > > > > (please use the latest version) > > > > > > To use the external CUSE TPM, the CUSE TPM should be started as > follows: > > > > > > # terminate previously started CUSE TPM > > > /usr/bin/swtpm_ioctl -s /dev/vtpm-test > > > > > > # start CUSE TPM > > > /usr/bin/swtpm_cuse -n vtpm-test > > > > IIUC, there needs to be one swtpm_cuse process running per QEMU > > TPM device ? This makes my wonder why we need this separate > > Correct. See reason in answer to previous email. > > > process at all - it would make sense if there was a single > > swtpm_cuse shared across all QEMU's, but if there's one per > > QEMU device, it feels like it'd be much simpler to just have > > the functionality linked in QEMU. That avoids the problem > > I tried having it linked in QEMU before. It was basically rejected. I remember an impl you did many years(?) ago now, but don't recall the results of the discussion. Can you elaborate on why it was rejected as an approach ? It just doesn't make much sense to me to have to create an external daemon, a CUSE device and comms protocol, simply to be able to read/write a plain file containing the TPM state. Its massive over engineering IMHO and adding way more complexity and thus scope for failure Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|