|
From: | Stefan Berger |
Subject: | Re: [Qemu-devel] [PATCH 0/7] Provide support for the software TPM emulator |
Date: | Wed, 5 Apr 2017 11:04:07 -0400 |
User-agent: | Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 |
On 04/05/2017 03:09 AM, Amarnath Valluri wrote:
On 03.04.2017 20:07, Daniel P. Berrange wrote:Both spawning inside qemu and connecting to already running swtpm has its own pros, Hence we can make this spawning as backend configuration detail, So it looks like this:On Fri, Mar 31, 2017 at 04:10:09PM +0300, Amarnath Valluri wrote:Briefly, Theses set of patches introduces: - new TPM backend driver to support software TPM emulators(swtpm(1)).- and few supported fixes/enhancements/cleanup to existing tpm backend code.The similar idea was initiated earliar(2) by Stefan Berger(CCed) with slightly different approach, using CUSE. As swtpm has excellent support for unix domain sockets, hence this implementation uses unix domain sockets to communicate withswtpm.When Qemu is configured with 'emulator' tpm backend, it spawns 'swtpm' andcommunicates its via Unix domain sockets.I'm not convinced that having QEMU spawning swtpm itself is a desirable approach, as it means QEMU needs to have all the privileges that swtpm will need, so that swtpm can inherit them. At the very least I think we need to have a way to disable this spawning, so it can connect to a pre-existing swtpm process that's been spawned ahead of time. This will let us have stricter privilege separation.-tpmdev emulator,id=id,tpmstatedir=dir[,spawn=[on|off],data-path=path,ctrl-path=path,logfile=path,loglevel=number]Options details:tpmstatedir - Directory path, which swtpm should use for storing TPM state*spawn - should spawn new process, defaults to 'off' *path - swtpm binary path to spawn, ignored if spawn is off *data-path - Socket path to use/connect for data messages*ctrl-path - Socket path to use/connect for out-of-band control messages
FD passing would work?
*logfile - File path to use for swtpm logs*loglevel - log level number, defaults to 5 (ignored if no logfile provided)- If spawn is off, data-path and ctrl-path must be provided to qemu, where to connect already running swtpm - If spawn if on, both data-path and ctrl-path are optional. If not provided, qemu uses socket pairs to communicates with swptm, as it is doing now.Hope this satisfies all usecases, if everyone here happy with this i can submit the new patch with these changes.- Amarnath
[Prev in Thread] | Current Thread | [Next in Thread] |