From: Markus Armbruster <armbru@redhat.com>
To: James Bottomley <jejb@linux.ibm.com>
Cc: qemu-devel@nongnu.org,
"Daniel P . Berrangé" <berrange@redhat.com>,
"Stefan Berger" <stefanb@linux.ibm.com>
Subject: Re: [PATCH v6 2/2] tpm: add backend for mssim
Date: Mon, 25 Sep 2023 14:25:36 +0200 [thread overview]
Message-ID: <87il7y5tj3.fsf@pond.sub.org> (raw)
In-Reply-To: <eaf68b96049efd85f1a42dee4f6c1fdd2f45716f.camel@linux.ibm.com> (James Bottomley's message of "Mon, 25 Sep 2023 08:15:50 -0400")
James Bottomley <jejb@linux.ibm.com> writes:
> On Fri, 2023-09-22 at 08:00 +0200, Markus Armbruster wrote:
>> Found this cleaning out old mail, sorry for missing it until now!
>>
>> I think we owe James a quick decision wether we're willing to take
>> the
>> feature. Stefan, thoughts?
>>
>> James Bottomley <jejb@linux.ibm.com> writes:
>>
>> > From: James Bottomley <James.Bottomley@HansenPartnership.com>
>> >
>> > The Microsoft Simulator (mssim) is the reference emulation platform
>> > for the TCG TPM 2.0 specification.
>> >
>> > https://github.com/Microsoft/ms-tpm-20-ref.git
>> >
>> > It exports a fairly simple network socket based protocol on two
>> > sockets, one for command (default 2321) and one for control
>> > (default
>> > 2322). This patch adds a simple backend that can speak the mssim
>> > protocol over the network. It also allows the two sockets to be
>> > specified on the command line. The benefits are twofold: firstly
>> > it
>> > gives us a backend that actually speaks a standard TPM emulation
>> > protocol instead of the linux specific TPM driver format of the
>> > current emulated TPM backend and secondly, using the microsoft
>> > protocol, the end point of the emulator can be anywhere on the
>> > network, facilitating the cloud use case where a central TPM
>> > service
>> > can be used over a control network.
>> >
>> > The implementation does basic control commands like power off/on,
>> > but
>> > doesn't implement cancellation or startup. The former because
>> > cancellation is pretty much useless on a fast operating TPM
>> > emulator
>> > and the latter because this emulator is designed to be used with
>> > OVMF
>> > which itself does TPM startup and I wanted to validate that.
>> >
>> > To run this, simply download an emulator based on the MS
>> > specification
>> > (package ibmswtpm2 on openSUSE) and run it, then add these two
>> > lines
>> > to the qemu command and it will use the emulator.
>> >
>> > -tpmdev mssim,id=tpm0 \
>> > -device tpm-crb,tpmdev=tpm0 \
>> >
>> > to use a remote emulator replace the first line with
>> >
>> > -tpmdev
>> > "{'type':'mssim','id':'tpm0','command':{'type':inet,'host':'remote'
>> > ,'port':'2321'}}"
>> >
>> > tpm-tis also works as the backend.
>> >
>> > Signed-off-by: James Bottomley <jejb@linux.ibm.com>
>>
>> [...]
>>
>> > diff --git a/docs/specs/tpm.rst b/docs/specs/tpm.rst
>> > index 535912a92b..1398735956 100644
>> > --- a/docs/specs/tpm.rst
>> > +++ b/docs/specs/tpm.rst
>> > @@ -270,6 +270,38 @@ available as a module (assuming a TPM 2 is
>> > passed through):
>> > /sys/devices/LNXSYSTEM:00/LNXSYBUS:00/MSFT0101:00/tpm/tpm0/pcr-
>> > sha256/9
>> > ...
>> >
>> > +The QEMU TPM Microsoft Simulator Device
>> > +---------------------------------------
>> > +
>> > +The TCG provides a reference implementation for TPM 2.0 written by
>>
>>
>> Suggest to copy the cover letter's nice introductory paragraph here:
>>
>> The Microsoft Simulator (mssim) is the reference emulation platform
>> for the TCG TPM 2.0 specification.
>>
>> It provides a reference implementation for TPM 2.0 written by
>
> Sure, that's easy.
>
>> > +Microsoft (See `ms-tpm-20-ref`_ on github). The reference
>> > implementation
>> > +starts a network server and listens for TPM commands on port 2321
>> > and
>> > +TPM Platform control commands on port 2322, although these can be
>> > +altered. The QEMU mssim TPM backend talks to this
>> > implementation. By
>> > +default it connects to the default ports on localhost:
>> > +
>> > +.. code-block:: console
>> > +
>> > + qemu-system-x86_64 <qemu-options> \
>> > + -tpmdev mssim,id=tpm0 \
>> > + -device tpm-crb,tpmdev=tpm0
>> > +
>> > +
>> > +Although it can also communicate with a remote host, which must be
>> > +specified as a SocketAddress via json on the command line for each
>> > of
>>
>> Is the "via JSON" part in "must be specified ... on the command line"
>> correct? I'd expect to be able to use dotted keys as well, like
>>
>> -tpmdev
>> type=mssim,id=tpm0,command.type=inet,command.host=remote,command.port
>> =2321',control.type=inet,control.host=remote,control.port=2322
>
> Yes, I've verified that the dot notation works as well. However, I
> thought QEMU was calling all stuff like this JSON notation? If not,
> what do you usually call it? "json or dot notation"?
Our terminology is a bit fuzzy there. We commonly say "dotted keys"
(although that's just the part left of the = strictly speaking) or
"key=value,...".
>> Aside: I do recommend management applications stick to JSON.
[...]
prev parent reply other threads:[~2023-09-25 12:26 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-09 16:15 [PATCH v6 0/2] tpm: add mssim backend James Bottomley
2023-01-09 16:15 ` [PATCH v6 1/2] tpm: convert tpmdev options processing to new visitor format James Bottomley
2023-09-26 15:20 ` Stefan Berger
2023-09-26 17:43 ` Stefan Berger
2023-01-09 16:15 ` [PATCH v6 2/2] tpm: add backend for mssim James Bottomley
2023-09-22 6:00 ` Markus Armbruster
2023-09-22 12:41 ` Stefan Berger
2023-09-22 13:02 ` Daniel P. Berrangé
2023-09-22 13:27 ` Stefan Berger
2023-09-25 12:12 ` James Bottomley
2023-09-25 12:15 ` James Bottomley
2023-09-25 12:25 ` Markus Armbruster [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87il7y5tj3.fsf@pond.sub.org \
--to=armbru@redhat.com \
--cc=berrange@redhat.com \
--cc=jejb@linux.ibm.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanb@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).