qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] tpm: add backend for mssim


From: Stefan Berger
Subject: Re: [PATCH] tpm: add backend for mssim
Date: Mon, 12 Dec 2022 09:27:07 -0500
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.5.1



On 12/12/22 08:59, James Bottomley wrote:
On Mon, 2022-12-12 at 08:43 -0500, Stefan Berger wrote:


On 12/10/22 12:10, James Bottomley wrote:
The Microsoft Simulator (mssim) is the reference emulation platform
for the TCG TPM 2.0 specification.

https://github.com/Microsoft/ms-tpm-20-ref.git

It exports a fairly simple network socket baset protocol on two

baset -> based.

sockets, one for command (default 2321) and one for control
(default 2322).  This patch adds a simple backend that can speak
the mssim protocol over the network.  It also allows the host, and
two ports to be specified on the qemu command line.  The benefits
are twofold: firstly it gives us a backend that actually speaks a
standard TPM emulation protocol instead of the linux specific TPM
driver format of the current emulated TPM backend and secondly,
using the microsoft protocol, the end point of the emulator can be
anywhere on the network, facilitating the cloud use case where a
central TPM ervice can be used over a control network.

The implementation does basic control commands like power off/on,
but doesn't implement cancellation or startup.  The former because
cancellation is pretty much useless on a fast operating TPM
emulator and the latter because this emulator is designed to be
used with OVMF which itself does TPM startup and I wanted to
validate that.

How did you implement VM suspend/resume and snapshotting support?

TPM2 doesn't need to.  The mssim follows the reference model which


You mean TPM2 doesn't need to resume at the point where the VM resumes (I am 
not talking about ACPI resume but virsh save/restore) after for example a host 
reboot?
What does this have to do with the mssim reference model and TPM2_Shutdown 
protocol?

obeys the TPM2_Shutdown protocol, so the software does a power off with

TPM2_Shutdown(TPM_SU_STATE)

This allows poweroff to preserve the PCR state, provided the startup
does

TPM2_Startup(TPM_SU_STATE).

the edk2 SecurityPackage does this in OVMF on S3 Resume, so using this
backend allows us to check the OVMF startup for correctness.

Now getting QEMU to go through S3 suspend is another issue, but when it
does, the TPM should just work.

James




reply via email to

[Prev in Thread] Current Thread [Next in Thread]