Re: [PATCH v3 13/14] tpm: Add support for choosing emulation of a TPM 2

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 05/04/2018 04:21 PM, Stefan Berger wrote:
> This patch extends the TPM's device XML with TPM 2 support. This only works
> for the emulator type backend and looks as follows:
> 
>     <tpm model='tpm-tis'>
>       <backend type='emulator' tpmversion='2'/>

Perhaps this would be better as just version='2' since you're in a <tpm
...> block?

>     </tpm>
> 
> The swtpm process now has --tpm2 as an additional parameter:
> 
> system_u:system_r:svirt_t:s0:c597,c632 tss 18477 11.8  0.0 28364  3868 ?        Rs   11:13  13:50 /usr/bin/swtpm socket --daemon --ctrl type=unixio,path=/var/run/libvirt/qemu/swtpm/testvm-swtpm.sock,mode=0660 --tpmstate dir=/var/lib/libvirt/swtpm/testvm/tpm2,mode=0640 --log file=/var/log/swtpm/libvirt/qemu/testvm-swtpm.log --tpm2 --pid file=/var/run/libvirt/qemu/swtpm/testvm-swtpm.pid
> 
> The version of the TPM can be changed and the state of the TPM is preserved.
> 
> Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>
> ---
>  docs/formatdomain.html.in                      | 17 +++++-
>  docs/schemas/domaincommon.rng                  | 12 ++++
>  src/conf/domain_conf.c                         | 21 ++++++-
>  src/conf/domain_conf.h                         |  6 ++
>  src/util/virtpm.c                              | 79 ++++++++++++++++++++++++--
>  tests/qemuxml2argvdata/tpm-emulator-tpm2.args  | 27 +++++++++
>  tests/qemuxml2argvdata/tpm-emulator-tpm2.xml   | 30 ++++++++++
>  tests/qemuxml2argvtest.c                       |  2 +
>  tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml | 34 +++++++++++
>  9 files changed, 221 insertions(+), 7 deletions(-)
>  create mode 100644 tests/qemuxml2argvdata/tpm-emulator-tpm2.args
>  create mode 100644 tests/qemuxml2argvdata/tpm-emulator-tpm2.xml
>  create mode 100644 tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml
> 

> diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
> index 2a8912f..08df78a 100644
> --- a/docs/formatdomain.html.in
> +++ b/docs/formatdomain.html.in
> @@ -7663,7 +7663,7 @@ qemu-kvm -net nic,model=? /dev/null
>    ...
>    &lt;devices&gt;
>      &lt;tpm model='tpm-tis'&gt;
> -      &lt;backend type='emulator'&gt;
> +      &lt;backend type='emulator' tpmversion='2'&gt;
>        &lt;/backend&gt;
>      &lt;/tpm&gt;
>    &lt;/devices&gt;
> @@ -7713,6 +7713,21 @@ qemu-kvm -net nic,model=? /dev/null
>            </dd>
>          </dl>
>        </dd>
> +      <dt><code>tpmversion</code></dt>
> +      <dd>
> +        <p>
> +          The <code>tpmversion</code> attribute indicates the version
> +          of the TPM. By default a TPM 1.2 is created. This attribute
> +          only works with the <code>emulator</code> backend. The following
> +          versions are supported:
> +        </p>
> +        <ul>
> +          <li>'1.2' : creates a TPM 1.2</li>
> +          <li>'2' :  creates a TPM 2</li>
> +        </ul>
> +        Note that once a certain version of a TPM has been created for
> +        a guest, the version must not be changed anymore.
> +      </dd>

I trust we check that somewhere ...

>      </dl>
>  
>      <h4><a id="elementsNVRAM">NVRAM device</a></h4>
> diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
> index c65a9a3..a452a13 100644
> --- a/docs/schemas/domaincommon.rng
> +++ b/docs/schemas/domaincommon.rng
> @@ -4143,6 +4143,18 @@
>            </attribute>
>          </group>
>        </choice>
> +      <choice>
> +        <group>
> +          <optional>
> +            <attribute name="tpmversion">
> +              <choice>
> +                <value>1.2</value>
> +                <value>2</value>
> +              </choice>
> +           </attribute>
> +          </optional>
> +        </group>
> +      </choice>
>      </element>
>    </define>
>  
> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
> index a42574a..c98d26a 100644
> --- a/src/conf/domain_conf.c
> +++ b/src/conf/domain_conf.c
> @@ -12609,7 +12609,7 @@ virDomainSmartcardDefParseXML(virDomainXMLOptionPtr xmlopt,
>   * or like this:
>   *
>   * <tpm model='tpm-tis'>
> - *   <backend type='emulator'/>
> + *   <backend type='emulator' tpmversion='2'/>
>   * </tpm>
>   */
>  static virDomainTPMDefPtr
> @@ -12622,6 +12622,7 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
>      char *path = NULL;
>      char *model = NULL;
>      char *backend = NULL;
> +    char *tpmversion = NULL;
>      virDomainTPMDefPtr def;
>      xmlNodePtr save = ctxt->node;
>      xmlNodePtr *backends = NULL;
> @@ -12668,6 +12669,20 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
>          goto error;
>      }
>  
> +    tpmversion = virXMLPropString(backends[0], "tpmversion");
> +    if (!tpmversion || STREQ(tpmversion, "1.2")) {
> +        def->tpmversion = VIR_DOMAIN_TPM_VERSION_1_2;
> +        /* only TIS available for emulator */
> +        if (def->type == VIR_DOMAIN_TPM_TYPE_EMULATOR)
> +            def->model = VIR_DOMAIN_TPM_MODEL_TIS;
> +    } else if (STREQ(tpmversion, "2")) {
> +        def->tpmversion = VIR_DOMAIN_TPM_VERSION_2;
> +    } else {
> +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
> +                       _("Unsupported TPM version '%s'"),
> +                       tpmversion);
> +    }
> +
>      switch (def->type) {
>      case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
>          path = virXPathString("string(./backend/device/@path)", ctxt);
> @@ -12692,6 +12707,7 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
>      VIR_FREE(model);
>      VIR_FREE(backend);
>      VIR_FREE(backends);
> +    VIR_FREE(tpmversion);
>      ctxt->node = save;
>      return def;
>  
> @@ -24849,6 +24865,9 @@ virDomainTPMDefFormat(virBufferPtr buf,
>      virBufferAsprintf(buf, "<backend type='%s'",
>                        virDomainTPMBackendTypeToString(def->type));
>  
> +    if (def->tpmversion == VIR_DOMAIN_TPM_VERSION_2)
> +        virBufferAddLit(buf, " tpmversion='2'");
> +
>      switch (def->type) {
>      case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
>          virBufferAddLit(buf, ">\n");
> diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
> index c304b08..826ff26 100644
> --- a/src/conf/domain_conf.h
> +++ b/src/conf/domain_conf.h
> @@ -1291,12 +1291,18 @@ typedef enum {
>      VIR_DOMAIN_TPM_TYPE_LAST
>  } virDomainTPMBackendType;
>  
> +typedef enum {
> +    VIR_DOMAIN_TPM_VERSION_1_2,

Maybe this should just be "TPM_VERSION_DEFAULT"

> +    VIR_DOMAIN_TPM_VERSION_2,
> +} virDomainTPMVersion;
> +
>  # define VIR_DOMAIN_TPM_DEFAULT_DEVICE "/dev/tpm0"
>  
>  struct _virDomainTPMDef {
>      virDomainTPMBackendType type;
>      virDomainDeviceInfo info;
>      virDomainTPMModel model;
> +    virDomainTPMVersion tpmversion;
>      union {
>          struct {
>              virDomainChrSourceDef source;
> diff --git a/src/util/virtpm.c b/src/util/virtpm.c
> index 76bbb21..0617326 100644
> --- a/src/util/virtpm.c
> +++ b/src/util/virtpm.c
> @@ -52,6 +52,8 @@ static char *swtpm_path;
>  static char *swtpm_setup;
>  static char *swtpm_ioctl;
>  
> +static bool swtpm_supports_tpm2;
> +
>  /**
>   * virTPMCreateCancelPath:
>   * @devpath: Path to the TPM device
> @@ -96,6 +98,38 @@ virTPMCreateCancelPath(const char *devpath)
>  }
>  

2 blank lines

>  /*
> + * virTPMCheckForTPM2Support
> + *
> + * Check whether swtpm_setup supports TPM 2
> + */
> +static void
> +virTPMCheckForTPM2Support(void)
> +{
> +    virCommandPtr cmd;
> +    char *help = NULL;
> +
> +    if (!swtpm_setup)
> +        return;
> +
> +    cmd = virCommandNew(swtpm_setup);
> +    if (!cmd)
> +        return;
> +
> +    virCommandAddArg(cmd, "--help");
> +    virCommandSetOutputBuffer(cmd, &help);
> +
> +    if (virCommandRun(cmd, NULL) < 0)
> +        goto cleanup;
> +
> +    if (strstr(help, "--tpm2"))
> +        swtpm_supports_tpm2 = true;
> +
> + cleanup:
> +    virCommandFree(cmd);
> +    VIR_FREE(help);
> +}
> +
> +/*
>   * virTPMEmulatorInit
>   *
>   * Initialize the Emulator functions by searching for necessary
> @@ -134,6 +168,7 @@ virTPMEmulatorInit(void)
>              VIR_FREE(swtpm_setup);
>              return -1;
>          }
> +        virTPMCheckForTPM2Support();
>      }
>  
>      if (!swtpm_ioctl) {
> @@ -160,16 +195,28 @@ virTPMEmulatorInit(void)
>   *
>   * @swtpmStorageDir: directory for swtpm persistent state
>   * @vmname: The name of the VM for which to create the storage
> + * @tpmversion: version of the TPM
>   *
>   * Create the swtpm's storage path
>   */
>  static char *
>  virTPMCreateEmulatorStoragePath(const char *swtpmStorageDir,
> -                                const char *vmname)
> +                                const char *vmname,
> +                                virDomainTPMVersion tpmversion)
>  {
>      char *path = NULL;
> +    const char *dir = "";
> +
> +    switch (tpmversion) {
> +    case VIR_DOMAIN_TPM_VERSION_1_2:
> +        dir = "tpm1.2";
> +        break;
> +    case VIR_DOMAIN_TPM_VERSION_2:
> +        dir = "tpm2";
> +        break;
> +    }
>  
> -    ignore_value(virAsprintf(&path, "%s/%s/tpm1.2", swtpmStorageDir, vmname));
> +    ignore_value(virAsprintf(&path, "%s/%s/%s", swtpmStorageDir, vmname, dir));
>  
>      return path;
>  }
> @@ -321,7 +368,8 @@ int virTPMEmulatorInitPaths(virDomainTPMDefPtr tpm,
>  
>      VIR_FREE(tpm->data.emulator.storagepath);
>      if (!(tpm->data.emulator.storagepath =
> -            virTPMCreateEmulatorStoragePath(swtpmStorageDir, uuidstr)))
> +            virTPMCreateEmulatorStoragePath(swtpmStorageDir, uuidstr,
> +                                            tpm->tpmversion)))
>          return -1;
>  
>      return 0;
> @@ -415,6 +463,7 @@ int virTPMEmulatorPrepareHost(virDomainTPMDefPtr tpm,
>   * @swtpm_group: The group id to switch to
>   * @logfile: The file to write the log into; it must be writable
>   *           for the user given by userid or 'tss'
> + * @tpmversion: The version of the TPM, either a TPM 1.2 or TPM 2
>   *
>   * Setup the external swtpm by creating endorsement key and
>   * certificates for it.
> @@ -423,7 +472,8 @@ static int
>  virTPMEmulatorRunSetup(const char *storagepath, const char *vmname,
>                         const unsigned char *vmuuid, bool privileged,
>                         uid_t swtpm_user, gid_t swtpm_group,
> -                       const char *logfile)
> +                       const char *logfile,
> +                       const virDomainTPMVersion tpmversion)
>  {
>      virCommandPtr cmd = NULL;
>      int exitstatus;
> @@ -452,6 +502,17 @@ virTPMEmulatorRunSetup(const char *storagepath, const char *vmname,
>      virCommandSetUID(cmd, swtpm_user);
>      virCommandSetGID(cmd, swtpm_group);
>  
> +    switch (tpmversion) {
> +    case VIR_DOMAIN_TPM_VERSION_1_2:
> +        break;
> +    case VIR_DOMAIN_TPM_VERSION_2:
> +        virCommandAddArgList(cmd, "--tpm2", NULL);
> +        if (!swtpm_supports_tpm2) {
> +            goto cleanup;
> +        }

syntax-check complained about the unnecessary { }

Kind of odd to do the AddList and then make the check, too.

> +        break;
> +    }
> +
>      virCommandAddArgList(cmd,
>                           "--tpm-state", storagepath,
>                           "--vmid", vmid,
> @@ -525,7 +586,7 @@ virTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm, const char *vmname,
>      if (created &&
>          virTPMEmulatorRunSetup(tpm->data.emulator.storagepath, vmname, vmuuid,
>                                 privileged, swtpm_user, swtpm_group,
> -                               tpm->data.emulator.logfile) < 0)
> +                               tpm->data.emulator.logfile, tpm->tpmversion) < 0)
>          goto error;
>  
>      unlink(tpm->data.emulator.source.data.nix.path);
> @@ -550,6 +611,14 @@ virTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm, const char *vmname,
>      virCommandSetUID(cmd, swtpm_user);
>      virCommandSetGID(cmd, swtpm_group);
>  
> +    switch (tpm->tpmversion) {
> +    case VIR_DOMAIN_TPM_VERSION_1_2:
> +        break;
> +    case VIR_DOMAIN_TPM_VERSION_2:
> +        virCommandAddArg(cmd, "--tpm2");
> +        break;
> +    }
> +
>      return cmd;
>  
>   error:
> diff --git a/tests/qemuxml2argvdata/tpm-emulator-tpm2.args b/tests/qemuxml2argvdata/tpm-emulator-tpm2.args
> new file mode 100644
> index 0000000..5970928
> --- /dev/null
> +++ b/tests/qemuxml2argvdata/tpm-emulator-tpm2.args
> @@ -0,0 +1,27 @@
> +LC_ALL=C \
> +PATH=/bin \
> +HOME=/home/test \
> +USER=test \
> +LOGNAME=test \
> +QEMU_AUDIO_DRV=none \
> +/usr/bin/qemu-system-x86_64 \
> +-name TPM-VM \
> +-S \
> +-machine pc-i440fx-2.12,accel=tcg,usb=off,dump-guest-core=off \
> +-m 2048 \
> +-smp 1,sockets=1,cores=1,threads=1 \
> +-uuid 11d7cd22-da89-3094-6212-079a48a309a1 \
> +-display none \
> +-no-user-config \
> +-nodefaults \
> +-chardev socket,id=charmonitor,\
> +path=/tmp/lib/domain--1-TPM-VM/monitor.sock,server,nowait \

path=/tmp/lib/domain--1-TPM-VM/monitor.sock, can be on the previous line
according to syntax-check

> +-mon chardev=charmonitor,id=monitor,mode=control \
> +-rtc base=utc \
> +-no-shutdown \
> +-boot order=c,menu=on \
> +-usb \
> +-tpmdev emulator,id=tpm-tpm0,chardev=chrtpm \
> +-chardev socket,id=chrtpm,path=/dev/test \
> +-device tpm-tis,tpmdev=tpm-tpm0,id=tpm0 \
> +-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
> diff --git a/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml b/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml
> new file mode 100644
> index 0000000..a1f39ea
> --- /dev/null
> +++ b/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml
> @@ -0,0 +1,30 @@
> +<domain type='qemu'>
> +  <name>TPM-VM</name>
> +  <uuid>11d7cd22-da89-3094-6212-079a48a309a1</uuid>
> +  <memory unit='KiB'>2097152</memory>
> +  <currentMemory unit='KiB'>512288</currentMemory>
> +  <vcpu placement='static'>1</vcpu>
> +  <os>
> +    <type arch='x86_64' machine='pc-i440fx-2.12'>hvm</type>
> +    <boot dev='hd'/>
> +    <bootmenu enable='yes'/>
> +  </os>
> +  <features>
> +    <acpi/>
> +  </features>
> +  <clock offset='utc'/>
> +  <on_poweroff>destroy</on_poweroff>
> +  <on_reboot>restart</on_reboot>
> +  <on_crash>destroy</on_crash>
> +  <devices>
> +    <emulator>/usr/bin/qemu-system-x86_64</emulator>
> +    <controller type='usb' index='0'/>
> +    <controller type='pci' index='0' model='pci-root'/>
> +    <input type='mouse' bus='ps2'/>
> +    <input type='keyboard' bus='ps2'/>
> +    <tpm model='tpm-tis'>
> +      <backend type='emulator' tpmversion='2'/>
> +    </tpm>
> +    <memballoon model='virtio'/>
> +  </devices>
> +</domain>
> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
> index a80e3f2..9a0910e 100644
> --- a/tests/qemuxml2argvtest.c
> +++ b/tests/qemuxml2argvtest.c
> @@ -2004,6 +2004,8 @@ mymain(void)
>                          QEMU_CAPS_DEVICE_TPM_PASSTHROUGH, QEMU_CAPS_DEVICE_TPM_TIS);
>      DO_TEST("tpm-emulator",
>              QEMU_CAPS_DEVICE_TPM_EMULATOR, QEMU_CAPS_DEVICE_TPM_TIS);
> +    DO_TEST("tpm-emulator-tpm2",
> +            QEMU_CAPS_DEVICE_TPM_EMULATOR, QEMU_CAPS_DEVICE_TPM_TIS);

Another one where I wonder if DO_TEST_CAPS_LATEST should be used.

Beyond the XML syntax, things look reasonable.  I'll wait for the next
spin to see what happens.

John

>  
>  
>      DO_TEST_PARSE_ERROR("pci-domain-invalid", NONE);
> diff --git a/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml b/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml
> new file mode 100644
> index 0000000..012fbbf
> --- /dev/null
> +++ b/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml
> @@ -0,0 +1,34 @@
> +<domain type='qemu'>
> +  <name>TPM-VM</name>
> +  <uuid>11d7cd22-da89-3094-6212-079a48a309a1</uuid>
> +  <memory unit='KiB'>2097152</memory>
> +  <currentMemory unit='KiB'>512288</currentMemory>
> +  <vcpu placement='static'>1</vcpu>
> +  <os>
> +    <type arch='x86_64' machine='pc-i440fx-2.12'>hvm</type>
> +    <boot dev='hd'/>
> +    <bootmenu enable='yes'/>
> +  </os>
> +  <features>
> +    <acpi/>
> +  </features>
> +  <clock offset='utc'/>
> +  <on_poweroff>destroy</on_poweroff>
> +  <on_reboot>restart</on_reboot>
> +  <on_crash>destroy</on_crash>
> +  <devices>
> +    <emulator>/usr/bin/qemu-system-x86_64</emulator>
> +    <controller type='usb' index='0'>
> +      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
> +    </controller>
> +    <controller type='pci' index='0' model='pci-root'/>
> +    <input type='mouse' bus='ps2'/>
> +    <input type='keyboard' bus='ps2'/>
> +    <tpm model='tpm-tis'>
> +      <backend type='emulator' tpmversion='2'/>
> +    </tpm>
> +    <memballoon model='virtio'>
> +      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
> +    </memballoon>
> +  </devices>
> +</domain>
> 

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list



[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux