From nobody Mon Apr 29 21:53:44 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1564173684; cv=none; d=zoho.com; s=zohoarc; b=i8os/EwCpbO6wdimaoMwSZ64Oa4nJUI0PXEeDXiEsQigSyQJTaCT8cLfv3+snFCATfVUB9tNIeFcP4AZHtvt0XrQwAaOebtgLnDmNILxWpQpIqeiryi4wj/aBKCIUrYhPc3xLxUey/mYxOOoevKYUj2zosCMniK+vMR1g05MK2U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1564173684; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To:ARC-Authentication-Results; bh=itROLzyM2fToigkyAeN5ra4mrLzmueBzslnXCRH4xJo=; b=JKfuE28iyD/VLd6r3hTWiH46CMnGR6+9u2bS5aG2KDA8BbichryTvF2UQJ7I3HeKfBKeQm42N0gAhTvdQbWlb01GfY0e72abXIm57ZkY1hY8C7tKfRnu7FpkP+oosvohoEytk2vX/Ko478UdCvQ9UTj1X7UFI7v9pQUBzFsRJeA= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1564173684501769.2037643618734; Fri, 26 Jul 2019 13:41:24 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B61592CD7E6; Fri, 26 Jul 2019 20:41:22 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 48A7F5DE6F; Fri, 26 Jul 2019 20:41:22 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 5A1F218045CE; Fri, 26 Jul 2019 20:41:21 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x6QKfKhj029252 for ; Fri, 26 Jul 2019 16:41:20 -0400 Received: by smtp.corp.redhat.com (Postfix) id 06CBE1001B07; Fri, 26 Jul 2019 20:41:20 +0000 (UTC) Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.40]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 1E4BF10027B8; Fri, 26 Jul 2019 20:41:15 +0000 (UTC) Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id DACF3308429D; Fri, 26 Jul 2019 20:41:13 +0000 (UTC) Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x6QKT1O2025592; Fri, 26 Jul 2019 16:41:13 -0400 Received: from ppma03wdc.us.ibm.com (ba.79.3fa9.ip4.static.sl-reverse.com [169.63.121.186]) by mx0b-001b2d01.pphosted.com with ESMTP id 2u06n2nqax-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 26 Jul 2019 16:41:13 -0400 Received: from pps.filterd (ppma03wdc.us.ibm.com [127.0.0.1]) by ppma03wdc.us.ibm.com (8.16.0.27/8.16.0.27) with SMTP id x6QKVtqA019655; Fri, 26 Jul 2019 20:41:12 GMT Received: from b01cxnp22034.gho.pok.ibm.com (b01cxnp22034.gho.pok.ibm.com [9.57.198.24]) by ppma03wdc.us.ibm.com with ESMTP id 2tymfds1hp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 26 Jul 2019 20:41:12 +0000 Received: from b01ledav005.gho.pok.ibm.com (b01ledav005.gho.pok.ibm.com [9.57.199.110]) by b01cxnp22034.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id x6QKfC1c42402254 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 26 Jul 2019 20:41:12 GMT Received: from b01ledav005.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 20EE0AE05F; Fri, 26 Jul 2019 20:41:12 +0000 (GMT) Received: from b01ledav005.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 07D8CAE05C; Fri, 26 Jul 2019 20:41:12 +0000 (GMT) Received: from sbct-4.pok.ibm.com (unknown [9.47.158.154]) by b01ledav005.gho.pok.ibm.com (Postfix) with ESMTP; Fri, 26 Jul 2019 20:41:11 +0000 (GMT) From: Stefan Berger To: libvir-list@redhat.com, berrange@redhat.com, elmarco@redhat.com Date: Fri, 26 Jul 2019 16:41:10 -0400 Message-Id: <20190726204110.21951-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-07-26_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1906280000 definitions=main-1907260234 X-Greylist: Sender passed SPF test, Sender IP whitelisted by DNSRBL, ACL 238 matched, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.40]); Fri, 26 Jul 2019 20:41:14 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.40]); Fri, 26 Jul 2019 20:41:14 +0000 (UTC) for IP:'148.163.158.5' DOMAIN:'mx0b-001b2d01.pphosted.com' HELO:'mx0a-001b2d01.pphosted.com' FROM:'stefanb@linux.ibm.com' RCPT:'' X-RedHat-Spam-Score: -0.7 (RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_PASS) 148.163.158.5 mx0b-001b2d01.pphosted.com 148.163.158.5 mx0b-001b2d01.pphosted.com X-Scanned-By: MIMEDefang 2.84 on 10.5.110.40 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: libvir-list@redhat.com Cc: Stefan Berger Subject: [libvirt] [PATCH] tpm: Run swtpm_setup with less parameters on incoming migration X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Fri, 26 Jul 2019 20:41:23 +0000 (UTC) Content-Type: text/plain; charset="utf-8" In case of an incoming migration we do not need to run swtpm_setup with all the parameters but only want to get the benefit of it creating a TPM state file for us that we can then label with an SELinux label. The actual state will be overwritten by the in- coming state. So we have to pass an indicator for incomingMigration all the way to the command line parameter generation for swtpm_setup. Signed-off-by: Stefan Berger Reviewed-by: Marc-Andr=C3=A9 Lureau --- src/qemu/qemu_extdevice.c | 5 ++-- src/qemu/qemu_extdevice.h | 3 ++- src/qemu/qemu_process.c | 2 +- src/qemu/qemu_tpm.c | 49 +++++++++++++++++++++++++-------------- src/qemu/qemu_tpm.h | 3 ++- 5 files changed, 40 insertions(+), 22 deletions(-) diff --git a/src/qemu/qemu_extdevice.c b/src/qemu/qemu_extdevice.c index e576bca165..af52466421 100644 --- a/src/qemu/qemu_extdevice.c +++ b/src/qemu/qemu_extdevice.c @@ -128,7 +128,8 @@ qemuExtDevicesCleanupHost(virQEMUDriverPtr driver, int qemuExtDevicesStart(virQEMUDriverPtr driver, virDomainObjPtr vm, - qemuDomainLogContextPtr logCtxt) + qemuDomainLogContextPtr logCtxt, + bool incomingMigration) { int ret =3D 0; =20 @@ -136,7 +137,7 @@ qemuExtDevicesStart(virQEMUDriverPtr driver, return -1; =20 if (vm->def->tpm) - ret =3D qemuExtTPMStart(driver, vm, logCtxt); + ret =3D qemuExtTPMStart(driver, vm, logCtxt, incomingMigration); =20 return ret; } diff --git a/src/qemu/qemu_extdevice.h b/src/qemu/qemu_extdevice.h index bbdb9a1cc2..5a53c79f38 100644 --- a/src/qemu/qemu_extdevice.h +++ b/src/qemu/qemu_extdevice.h @@ -40,7 +40,8 @@ void qemuExtDevicesCleanupHost(virQEMUDriverPtr driver, =20 int qemuExtDevicesStart(virQEMUDriverPtr driver, virDomainObjPtr vm, - qemuDomainLogContextPtr logCtxt) + qemuDomainLogContextPtr logCtxt, + bool incomingMigration) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_RETURN_CHECK; =20 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 75205bc121..fae18824ba 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -6774,7 +6774,7 @@ qemuProcessLaunch(virConnectPtr conn, if (qemuProcessGenID(vm, flags) < 0) goto cleanup; =20 - if (qemuExtDevicesStart(driver, vm, logCtxt) < 0) + if (qemuExtDevicesStart(driver, vm, logCtxt, incoming !=3D NULL) < 0) goto cleanup; =20 VIR_DEBUG("Building emulator command line"); diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 77ef601f74..4174aa4c62 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -453,6 +453,7 @@ qemuTPMSetupEncryption(const unsigned char *secretuuid, * for the user given by userid or 'tss' * @tpmversion: The version of the TPM, either a TPM 1.2 or TPM 2 * @encryption: pointer to virStorageEncryption holding secret + * @incomingMigration: whether we have an incoming migration * * Setup the external swtpm by creating endorsement key and * certificates for it. @@ -466,7 +467,8 @@ qemuTPMEmulatorRunSetup(const char *storagepath, gid_t swtpm_group, const char *logfile, const virDomainTPMVersion tpmversion, - const unsigned char *secretuuid) + const unsigned char *secretuuid, + bool incomingMigration) { virCommandPtr cmd =3D NULL; int exitstatus; @@ -525,16 +527,23 @@ qemuTPMEmulatorRunSetup(const char *storagepath, pwdfile_fd =3D -1; } =20 - virCommandAddArgList(cmd, - "--tpm-state", storagepath, - "--vmid", vmid, - "--logfile", logfile, - "--createek", - "--create-ek-cert", - "--create-platform-cert", - "--lock-nvram", - "--not-overwrite", - NULL); + if (!incomingMigration) { + virCommandAddArgList(cmd, + "--tpm-state", storagepath, + "--vmid", vmid, + "--logfile", logfile, + "--createek", + "--create-ek-cert", + "--create-platform-cert", + "--lock-nvram", + "--not-overwrite", + NULL); + } else { + virCommandAddArgList(cmd, + "--tpm-state", storagepath, + "--overwrite", + NULL); + } =20 virCommandClearCaps(cmd); =20 @@ -568,6 +577,7 @@ qemuTPMEmulatorRunSetup(const char *storagepath, * @swtpmStateDir: the directory where swtpm writes the pid file and creat= es the * Unix socket * @shortName: the short name of the VM + * @incomingMigration: whether we have an incoming migration * * Create the virCommand use for starting the emulator * Do some initializations on the way, such as creation of storage @@ -581,7 +591,8 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm, uid_t swtpm_user, gid_t swtpm_group, const char *swtpmStateDir, - const char *shortName) + const char *shortName, + bool incomingMigration) { virCommandPtr cmd =3D NULL; bool created =3D false; @@ -605,7 +616,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm, qemuTPMEmulatorRunSetup(tpm->data.emulator.storagepath, vmname, vm= uuid, privileged, swtpm_user, swtpm_group, tpm->data.emulator.logfile, tpm->version, - secretuuid) < 0) + secretuuid, incomingMigration) < 0) goto error; =20 unlink(tpm->data.emulator.source.data.nix.path); @@ -814,6 +825,7 @@ qemuExtTPMCleanupHost(virDomainDefPtr def) * @driver: QEMU driver * @vm: the domain object * @logCtxt: log context + * @incomingMigration: whether we have an incoming migration * * Start the external TPM Emulator: * - have the command line built @@ -822,7 +834,8 @@ qemuExtTPMCleanupHost(virDomainDefPtr def) static int qemuExtTPMStartEmulator(virQEMUDriverPtr driver, virDomainObjPtr vm, - qemuDomainLogContextPtr logCtxt) + qemuDomainLogContextPtr logCtxt, + bool incomingMigration) { int ret =3D -1; virCommandPtr cmd =3D NULL; @@ -846,7 +859,8 @@ qemuExtTPMStartEmulator(virQEMUDriverPtr driver, driver->privileged, cfg->swtpm_user, cfg->swtpm_group, - cfg->swtpmStateDir, shortName)= )) + cfg->swtpmStateDir, shortName, + incomingMigration))) goto cleanup; =20 if (qemuExtDeviceLogCommand(logCtxt, cmd, "TPM Emulator") < 0) @@ -903,14 +917,15 @@ qemuExtTPMStartEmulator(virQEMUDriverPtr driver, int qemuExtTPMStart(virQEMUDriverPtr driver, virDomainObjPtr vm, - qemuDomainLogContextPtr logCtxt) + qemuDomainLogContextPtr logCtxt, + bool incomingMigration) { int ret =3D 0; virDomainTPMDefPtr tpm =3D vm->def->tpm; =20 switch (tpm->type) { case VIR_DOMAIN_TPM_TYPE_EMULATOR: - ret =3D qemuExtTPMStartEmulator(driver, vm, logCtxt); + ret =3D qemuExtTPMStartEmulator(driver, vm, logCtxt, incomingMigra= tion); break; case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH: case VIR_DOMAIN_TPM_TYPE_LAST: diff --git a/src/qemu/qemu_tpm.h b/src/qemu/qemu_tpm.h index 74c9924d68..5f454d3580 100644 --- a/src/qemu/qemu_tpm.h +++ b/src/qemu/qemu_tpm.h @@ -37,7 +37,8 @@ void qemuExtTPMCleanupHost(virDomainDefPtr def) =20 int qemuExtTPMStart(virQEMUDriverPtr driver, virDomainObjPtr vm, - qemuDomainLogContextPtr logCtxt) + qemuDomainLogContextPtr logCtxt, + bool incomingMigration) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_RETURN_CHECK; =20 --=20 2.21.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list