qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] Is is possible to virtualise or share the TPM?


From: Stefan Berger
Subject: Re: [Qemu-devel] Is is possible to virtualise or share the TPM?
Date: Thu, 30 Aug 2012 12:17:25 -0400
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120605 Thunderbird/13.0

On 08/30/2012 11:40 AM, Jordi Cucurull Juan wrote:
Do you refer to the patches that add TPM support to the SeaBIOS?

Sorry for the confusion. What I meant is that the patches adding support for a private vTPM for each QEMU VM are 'behind' those adding support for the passthrough device model. There are SeaBIOS patches as well adding support for TPM, but those are different.

If this is the case, this is just a completely virtual TPM without any link with the TPM of the physical machine, right?

The SeaBIOS patches don't do that. They just add TPM BIOS support for TPM initialization, ACPI tables etc. To add a completely virtual TPM to QEMU a completely different device model is necessary than the one I have recently posted.

   Stefan


Jordi.


On 08/30/2012 04:50 PM, Stefan Berger wrote:
On 08/30/2012 10:21 AM, Jordi Cucurull Juan wrote:
Dear Stefan,

What does it mean that the patches with the VTPM functionality exist but they are behind the regular ones? Does it mean that they are not currently updated? That they have less priority?

It means that in my patch queue they are 'behind' the ones I posted over the last few months.

  Stefan



Best regards,
Jordi.



On 08/29/2012 02:57 PM, Stefan Berger wrote:
On 08/23/2012 04:05 PM, Corey Bryant wrote:


On 08/21/2012 06:31 AM, Jordi Cucurull Juan wrote:
Dear all,

After applying the TPM patches to QEMU, I was wondering if it is
possible to simultaneously use the TPM in more than one virtual machine,
i.e. virtualisation of the TPM.

According to the paper "Stefan Berger, Ramón Cáceres, Kenneth A.
Goldman, Ronald Perez, Reiner Sailer, Leendert van Doorn. vTPM:
Virtualizing the Trusted Platform Module" this seems to be possible in
Xen. Is not possible in QEMU?

Thanks!
Jordi.



I don't think the pass-through driver supports use by multiple VMs. Stefan Berger should be able to answer better so I'm adding him to the thread.


The pass-through driver cannot provide access for multiple VMs to the single hardware TPM on the host. The usage model and the statefulness of the TPM (SRK password, owner password, keys) basically prevent/complicate this. The implementation for Xen was indep. of the Qemu code base today and there we used a software implementation of the TPM that provided a private TPm instance to each VM. I have patches for this for Qemu but due to an IRC chat in Sept. 2011 they are 'behind' the pass-through driver patches.

   Stefan














reply via email to

[Prev in Thread] Current Thread [Next in Thread]