qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
To: "Daniel P. Berrange" <berrange@redhat.com>
Cc: "Stefan Berger" <stefanb@linux.vnet.ibm.com>,
	"Amarnath Valluri" <amarnath.valluri@intel.com>,
	"Patrick Ohly" <patrick.ohly@intel.com>,
	"Marc-André Lureau" <marcandre.lureau@gmail.com>,
	qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] [PATCH v3 8/8] tpm: Added support for TPM emulator
Date: Wed, 3 May 2017 12:17:00 +0100	[thread overview]
Message-ID: <20170503111659.GA2077@work-vm> (raw)
In-Reply-To: <20170503084136.GC4121@redhat.com>

* Daniel P. Berrange (berrange@redhat.com) wrote:
> On Tue, May 02, 2017 at 03:35:48PM -0400, Stefan Berger wrote:
> > On 05/02/2017 02:50 PM, Marc-André Lureau wrote:
> > > Hi
> > > 
> > > On Tue, May 2, 2017 at 10:25 PM Patrick Ohly <patrick.ohly@intel.com
> > > <mailto:patrick.ohly@intel.com>> wrote:
> > > 
> > >     On Tue, 2017-05-02 at 13:19 -0400, Stefan Berger wrote:
> > >     > On 05/02/2017 01:09 PM, Marc-André Lureau wrote:
> > >     > > On Tue, May 2, 2017 at 8:59 PM Stefan Berger
> > >     <stefanb@linux.vnet.ibm.com <mailto:stefanb@linux.vnet.ibm.com>>
> > >     > > wrote:
> > >     > >
> > >     > >> And who is going to implement that qemu-swtpm? Obviously this
> > >     discussion
> > >     > >> doesn't contribute to progress if nobody is doing that in the
> > >     end.
> > >     > >>
> > >     > > The same persons who try to push for that emulated TPM code.
> > >     The easiest
> > >     > > approach would be to copy/adapt the swtpm code in qemu, if the
> > >     licence is
> > >     > > compatible. I can help with that if there is a consensus it's
> > >     a better
> > >     > > approach.
> > >     >
> > >     >
> > >     > It's a matter of time and at least I don't have time for that.
> > > 
> > >     Neither do I, and nor (I believe) does Amarnath. The approach with
> > >     using
> > >     the existing swtpm project seemed attractive to us exactly because it
> > >     avoids having to write and maintain more than just the glue code
> > >     between
> > >     the two projects.
> > > 
> > > 
> > > The main argument is not about having more or less code in qemu to
> > > maintain, but yes this is a concern (although giving up that maintenance
> > > to a seperate project with mostly Stefan-alone isn't a much better
> > > alternative). btw, is the project actually used by something else than
> > > qemu? (I am not talking about developpers/testing). If not, then it
> > > makes sense to make it part of qemu.
> > 
> > The intention would be to use it for RunC as well (plus higher layers
> > afterwards): https://github.com/opencontainers/runc/pull/1082
> > 
> > > 
> > > But it's mostly a technical reason, to avoid having to rely on a foreign
> > > protocol and project with all the compatibility constrains.
> > 
> > I understand. Ideally swtpm-0.1 would be equivalent to 1.0 with all features
> > available and no further protocol extensions necessary. In practice that may
> > look different.
> > 
> > > 
> > > In the end, we may decide to start with a separate project, and change
> > > it in the future if it's problematic (that would break some cases, such
> > > as being able to freely switch the helper). Tbh, I am not so happy with
> > > the code quality of swtpm, and I haven't looked closely at libtpms.
> > > Having a qemu-swtpm as part of qemu would probably help improve it too,
> > > and bring a few more developers for maintainance...
> > 
> > libtpms combines a few source codes with some glue around it. The coding
> > style is different for TPM 1.2 and TPM 2 code for example and the code bases
> > are in the 10s of thousands of line. In the case of TPM 2 it 'lives from'
> > TCG code drops and thus there is no reformatting of source code etc.
> > 
> > If someone wants to get started on qemu-swtpm that's certainly cool but over
> > the years it's just been quite difficult to find developers for it to share
> > the burden. All that said, someone should state whether this series is a go
> > or no-go because of the external project it requires.
> 
> I think it is *good* that it uses the external swtpm project and do not
> want to see it reimplemented inside QEMU, particularly with the interest
> for swtpm to be used in container contexts via RunC. Such common infrastructure
> for both containers & QEMU will be important given the increasing convergance
> of technology across containers & VMs.

I agree; there aren't that many people who understand the details of TPMs,
reimplementing one in QEMU isn't something you'd want to do.

Dave

> Regards,
> Daniel
> -- 
> |: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org         -o-            https://fstop138.berrange.com :|
> |: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|
> 
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK

  reply	other threads:[~2017-05-03 11:17 UTC|newest]

Thread overview: 44+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-05-02 11:52 [Qemu-devel] [PATCH v3 0/8] Provide support for the software TPM emulator Amarnath Valluri
2017-05-02 11:52 ` [Qemu-devel] [PATCH v3 1/8] tpm-backend: Remove unneeded member variable from backend class Amarnath Valluri
2017-05-02 11:59   ` Marc-André Lureau
2017-05-02 11:52 ` [Qemu-devel] [PATCH v3 2/8] tpm-backend: Move thread handling inside TPMBackend Amarnath Valluri
2017-05-02 12:10   ` Marc-André Lureau
2017-05-02 11:52 ` [Qemu-devel] [PATCH v3 3/8] tpm-backend: Initialize and free data members in it's own methods Amarnath Valluri
2017-05-02 12:17   ` Marc-André Lureau
2017-05-02 11:52 ` [Qemu-devel] [PATCH v3 4/8] tpm-backend: Made few interface methods optional Amarnath Valluri
2017-05-02 12:29   ` Marc-André Lureau
2017-05-04  8:39     ` Amarnath Valluri
2017-05-04 11:06     ` [Qemu-devel] [PATCH v4 " Amarnath Valluri
2017-05-02 11:52 ` [Qemu-devel] [PATCH v3 5/8] tmp backend: Add new api to read backend TpmInfo Amarnath Valluri
2017-05-02 13:35   ` Eric Blake
2017-05-04  9:05     ` Amarnath Valluri
2017-05-04 11:17     ` [Qemu-devel] [PATCH v4 " Amarnath Valluri
2017-05-02 11:52 ` [Qemu-devel] [PATCH v3 6/8] tpm-backend: Move realloc_buffer() implementation to base class Amarnath Valluri
2017-05-02 15:54   ` Marc-André Lureau
2017-05-04  9:25     ` Amarnath Valluri
2017-05-04  9:32       ` Marc-André Lureau
2017-05-04 11:31         ` [Qemu-devel] [PATCH v4 6/8] tpm-backend: Move realloc_buffer() implementation to tpm-tis model Amarnath Valluri
2017-05-06 12:27           ` Marc-André Lureau
2017-05-02 11:52 ` [Qemu-devel] [PATCH v3 7/8] tpm-passthrough: move reusable code to utils Amarnath Valluri
2017-05-02 15:54   ` Marc-André Lureau
2017-05-02 11:52 ` [Qemu-devel] [PATCH v3 8/8] tpm: Added support for TPM emulator Amarnath Valluri
2017-05-02 16:05   ` Marc-André Lureau
2017-05-02 16:32     ` Stefan Berger
2017-05-02 16:58     ` Stefan Berger
2017-05-02 17:09       ` Marc-André Lureau
2017-05-02 17:19         ` Stefan Berger
2017-05-02 18:25           ` Patrick Ohly
2017-05-02 18:50             ` Marc-André Lureau
2017-05-02 19:35               ` Stefan Berger
2017-05-03  8:41                 ` Daniel P. Berrange
2017-05-03 11:17                   ` Dr. David Alan Gilbert [this message]
2017-05-03 11:24                     ` Marc-André Lureau
2017-05-03 11:29                       ` Daniel P. Berrange
2017-05-03 11:37                         ` Marc-André Lureau
2017-05-03 14:42                         ` Stefan Berger
2017-05-04  9:44                           ` Patrick Ohly
2017-05-04 11:08                             ` Stefan Berger
2017-05-02 12:25 ` [Qemu-devel] [PATCH v3 0/8] Provide support for the software " no-reply
2017-05-04 11:35   ` [Qemu-devel] [PATCH v4 8/8] tpm: Added support for " Amarnath Valluri
2017-05-04 12:28 ` [Qemu-devel] [PATCH v3 0/8] Provide support for the software " Stefan Berger
2017-05-05  6:52   ` Amarnath Valluri

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170503111659.GA2077@work-vm \
    --to=dgilbert@redhat.com \
    --cc=amarnath.valluri@intel.com \
    --cc=berrange@redhat.com \
    --cc=marcandre.lureau@gmail.com \
    --cc=patrick.ohly@intel.com \
    --cc=qemu-devel@nongnu.org \
    --cc=stefanb@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).