[libvirt] [PATCH] tpm: Run swtpm_setup with less parameters on incoming migration
Marc-André Lureau
marcandre.lureau at redhat.com
Sat Jul 27 05:27:17 UTC 2019
Hi
On Sat, Jul 27, 2019 at 12:41 AM Stefan Berger <stefanb at linux.ibm.com> wrote:
>
> In case of an incoming migration we do not need to run swtpm_setup
> with all the parameters but only want to get the benefit of it
> creating a TPM state file for us that we can then label with an
> SELinux label. The actual state will be overwritten by the in-
> coming state. So we have to pass an indicator for incomingMigration
> all the way to the command line parameter generation for swtpm_setup.
>
> Signed-off-by: Stefan Berger <stefanb at linux.ibm.com>
iirc, I needed to pass it down as well in my slirp-helper series.
Reviewed-by: Marc-André Lureau <marcandre.lureau at redhat.com>
> ---
> src/qemu/qemu_extdevice.c | 5 ++--
> src/qemu/qemu_extdevice.h | 3 ++-
> src/qemu/qemu_process.c | 2 +-
> src/qemu/qemu_tpm.c | 49 +++++++++++++++++++++++++--------------
> src/qemu/qemu_tpm.h | 3 ++-
> 5 files changed, 40 insertions(+), 22 deletions(-)
>
> diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c
> index e576bca165..af52466421 100644
> --- a/src/qemu/qemu_extdevice.c
> +++ b/src/qemu/qemu_extdevice.c
> @@ -128,7 +128,8 @@ qemuExtDevicesCleanupHost(virQEMUDriverPtr driver,
> int
> qemuExtDevicesStart(virQEMUDriverPtr driver,
> virDomainObjPtr vm,
> - qemuDomainLogContextPtr logCtxt)
> + qemuDomainLogContextPtr logCtxt,
> + bool incomingMigration)
> {
> int ret = 0;
>
> @@ -136,7 +137,7 @@ qemuExtDevicesStart(virQEMUDriverPtr driver,
> return -1;
>
> if (vm->def->tpm)
> - ret = qemuExtTPMStart(driver, vm, logCtxt);
> + ret = qemuExtTPMStart(driver, vm, logCtxt, incomingMigration);
>
> return ret;
> }
> diff --git a/src/qemu/qemu_extdevice.h b/src/qemu/qemu_extdevice.h
> index bbdb9a1cc2..5a53c79f38 100644
> --- a/src/qemu/qemu_extdevice.h
> +++ b/src/qemu/qemu_extdevice.h
> @@ -40,7 +40,8 @@ void qemuExtDevicesCleanupHost(virQEMUDriverPtr driver,
>
> int qemuExtDevicesStart(virQEMUDriverPtr driver,
> virDomainObjPtr vm,
> - qemuDomainLogContextPtr logCtxt)
> + qemuDomainLogContextPtr logCtxt,
> + bool incomingMigration)
> ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3)
> ATTRIBUTE_RETURN_CHECK;
>
> diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
> index 75205bc121..fae18824ba 100644
> --- a/src/qemu/qemu_process.c
> +++ b/src/qemu/qemu_process.c
> @@ -6774,7 +6774,7 @@ qemuProcessLaunch(virConnectPtr conn,
> if (qemuProcessGenID(vm, flags) < 0)
> goto cleanup;
>
> - if (qemuExtDevicesStart(driver, vm, logCtxt) < 0)
> + if (qemuExtDevicesStart(driver, vm, logCtxt, incoming != NULL) < 0)
> goto cleanup;
>
> VIR_DEBUG("Building emulator command line");
> diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c
> index 77ef601f74..4174aa4c62 100644
> --- a/src/qemu/qemu_tpm.c
> +++ b/src/qemu/qemu_tpm.c
> @@ -453,6 +453,7 @@ qemuTPMSetupEncryption(const unsigned char *secretuuid,
> * for the user given by userid or 'tss'
> * @tpmversion: The version of the TPM, either a TPM 1.2 or TPM 2
> * @encryption: pointer to virStorageEncryption holding secret
> + * @incomingMigration: whether we have an incoming migration
> *
> * Setup the external swtpm by creating endorsement key and
> * certificates for it.
> @@ -466,7 +467,8 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
> gid_t swtpm_group,
> const char *logfile,
> const virDomainTPMVersion tpmversion,
> - const unsigned char *secretuuid)
> + const unsigned char *secretuuid,
> + bool incomingMigration)
> {
> virCommandPtr cmd = NULL;
> int exitstatus;
> @@ -525,16 +527,23 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
> pwdfile_fd = -1;
> }
>
> - virCommandAddArgList(cmd,
> - "--tpm-state", storagepath,
> - "--vmid", vmid,
> - "--logfile", logfile,
> - "--createek",
> - "--create-ek-cert",
> - "--create-platform-cert",
> - "--lock-nvram",
> - "--not-overwrite",
> - NULL);
> + if (!incomingMigration) {
> + virCommandAddArgList(cmd,
> + "--tpm-state", storagepath,
> + "--vmid", vmid,
> + "--logfile", logfile,
> + "--createek",
> + "--create-ek-cert",
> + "--create-platform-cert",
> + "--lock-nvram",
> + "--not-overwrite",
> + NULL);
> + } else {
> + virCommandAddArgList(cmd,
> + "--tpm-state", storagepath,
> + "--overwrite",
> + NULL);
> + }
>
> virCommandClearCaps(cmd);
>
> @@ -568,6 +577,7 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
> * @swtpmStateDir: the directory where swtpm writes the pid file and creates the
> * Unix socket
> * @shortName: the short name of the VM
> + * @incomingMigration: whether we have an incoming migration
> *
> * Create the virCommand use for starting the emulator
> * Do some initializations on the way, such as creation of storage
> @@ -581,7 +591,8 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm,
> uid_t swtpm_user,
> gid_t swtpm_group,
> const char *swtpmStateDir,
> - const char *shortName)
> + const char *shortName,
> + bool incomingMigration)
> {
> virCommandPtr cmd = NULL;
> bool created = false;
> @@ -605,7 +616,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm,
> qemuTPMEmulatorRunSetup(tpm->data.emulator.storagepath, vmname, vmuuid,
> privileged, swtpm_user, swtpm_group,
> tpm->data.emulator.logfile, tpm->version,
> - secretuuid) < 0)
> + secretuuid, incomingMigration) < 0)
> goto error;
>
> unlink(tpm->data.emulator.source.data.nix.path);
> @@ -814,6 +825,7 @@ qemuExtTPMCleanupHost(virDomainDefPtr def)
> * @driver: QEMU driver
> * @vm: the domain object
> * @logCtxt: log context
> + * @incomingMigration: whether we have an incoming migration
> *
> * Start the external TPM Emulator:
> * - have the command line built
> @@ -822,7 +834,8 @@ qemuExtTPMCleanupHost(virDomainDefPtr def)
> static int
> qemuExtTPMStartEmulator(virQEMUDriverPtr driver,
> virDomainObjPtr vm,
> - qemuDomainLogContextPtr logCtxt)
> + qemuDomainLogContextPtr logCtxt,
> + bool incomingMigration)
> {
> int ret = -1;
> virCommandPtr cmd = NULL;
> @@ -846,7 +859,8 @@ qemuExtTPMStartEmulator(virQEMUDriverPtr driver,
> driver->privileged,
> cfg->swtpm_user,
> cfg->swtpm_group,
> - cfg->swtpmStateDir, shortName)))
> + cfg->swtpmStateDir, shortName,
> + incomingMigration)))
> goto cleanup;
>
> if (qemuExtDeviceLogCommand(logCtxt, cmd, "TPM Emulator") < 0)
> @@ -903,14 +917,15 @@ qemuExtTPMStartEmulator(virQEMUDriverPtr driver,
> int
> qemuExtTPMStart(virQEMUDriverPtr driver,
> virDomainObjPtr vm,
> - qemuDomainLogContextPtr logCtxt)
> + qemuDomainLogContextPtr logCtxt,
> + bool incomingMigration)
> {
> int ret = 0;
> virDomainTPMDefPtr tpm = vm->def->tpm;
>
> switch (tpm->type) {
> case VIR_DOMAIN_TPM_TYPE_EMULATOR:
> - ret = qemuExtTPMStartEmulator(driver, vm, logCtxt);
> + ret = qemuExtTPMStartEmulator(driver, vm, logCtxt, incomingMigration);
> break;
> case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
> case VIR_DOMAIN_TPM_TYPE_LAST:
> diff --git a/src/qemu/qemu_tpm.h b/src/qemu/qemu_tpm.h
> index 74c9924d68..5f454d3580 100644
> --- a/src/qemu/qemu_tpm.h
> +++ b/src/qemu/qemu_tpm.h
> @@ -37,7 +37,8 @@ void qemuExtTPMCleanupHost(virDomainDefPtr def)
>
> int qemuExtTPMStart(virQEMUDriverPtr driver,
> virDomainObjPtr vm,
> - qemuDomainLogContextPtr logCtxt)
> + qemuDomainLogContextPtr logCtxt,
> + bool incomingMigration)
> ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3)
> ATTRIBUTE_RETURN_CHECK;
>
> --
> 2.21.0
>
More information about the libvir-list
mailing list