Re: [PATCH] tpm: add backend for mssim

[Stefan Berger]

On 12/12/22 10:28, James Bottomley wrote:
> On Mon, 2022-12-12 at 10:20 -0500, Stefan Berger wrote:
> > On 12/12/22 09:47, James Bottomley wrote:
> [...]
> > > I don't actually use virsh in my harness.  I'm mostly interested in
> > > the running the kernel TPM selftests against the reference model.
> > > But I anticipate it wouldn't currently work because I don't believe
> > > virsh triggers a S3 event which is why snapshot and migration
> > > doesn't always work with PCI passthrough.
> >
> > Then I think you should at least add a blocker to your model so that
> > suspend/resume/snapshotting/migration are all disabled because the
> > mssim reference implementation doesn't support permanent & volatile
> > state suspend/resume (and upgrading!) without significant work on it
> > as can be seen in libtpms.
>
> Actually, I would think adding support, if that's what people wanted,
> would be pretty simple.  Since the network end point is the identifier,
There's VM snapshotting as well where things are not as simple. Host reboot is 
a bit of a challenge when your TPM 2 emulator doesn't support permanent AND 
volatile state marshalling and unmarshalling. Upgrading the reference model has 
also been a challenge in the past where it couldn't read old state anymore when 
new pieces were added to the state. These were areas where efforts went into 
libtpms for example. This is not to say that everything is perfect with libtpms 
and swptm since they have thier own challenges but they have at least resolved 
some of the issues.

> the protocol would be not to power down the TPM on suspend/resume and
> simply to send TPM_STOP to close down the sockets gracefully.  Then the
> next connection picks up the state where the previous one left off.
>
> > Why would we support another model for the backend that provides no
> > advantages over what is there right now?
>
> The advantages were what was stated: ability to connect to the MS
> reference model directly and no dependence on the Linux VTPM_PROXY
> protocol.

We already have a working TPM 2 emulator that does support VM 
suspend/resume/snapshotting and migration. If you want to become maintainer of 
your backend model and everything associated with it, please add yourself to 
the MAINTAINERS list.

> James