From nobody Mon Apr 29 16:23:16 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=none dis=none) header.from=linux.ibm.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1635959097832291.5353272038993; Wed, 3 Nov 2021 10:04:57 -0700 (PDT) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-458-clmvcaeQMjiVu94p11iBAw-1; Wed, 03 Nov 2021 13:04:55 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 957EC10A8E00; Wed, 3 Nov 2021 17:04:48 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 92E7278B44; Wed, 3 Nov 2021 17:04:47 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id C866F4E9F5; Wed, 3 Nov 2021 17:04:43 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 1A3H4gSv021351 for ; Wed, 3 Nov 2021 13:04:43 -0400 Received: by smtp.corp.redhat.com (Postfix) id CDDE040CFD07; Wed, 3 Nov 2021 17:04:42 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast01.extmail.prod.ext.rdu2.redhat.com [10.11.55.17]) by smtp.corp.redhat.com (Postfix) with ESMTPS id C7D2840CFD10 for ; Wed, 3 Nov 2021 17:04:42 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id ABE0F899EC4 for ; Wed, 3 Nov 2021 17:04:42 +0000 (UTC) Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-424-Nk0eigrFMy-PMLllVuohpw-1; Wed, 03 Nov 2021 13:04:39 -0400 Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1A3GFgjx007477; Wed, 3 Nov 2021 17:04:38 GMT Received: from ppma05wdc.us.ibm.com (1b.90.2fa9.ip4.static.sl-reverse.com [169.47.144.27]) by mx0b-001b2d01.pphosted.com with ESMTP id 3c3vt9jk2m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Nov 2021 17:04:38 +0000 Received: from pps.filterd (ppma05wdc.us.ibm.com [127.0.0.1]) by ppma05wdc.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1A3H3Hcc022976; Wed, 3 Nov 2021 17:04:37 GMT Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by ppma05wdc.us.ibm.com with ESMTP id 3c0wpbwumy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Nov 2021 17:04:37 +0000 Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1A3H4avN38207994 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 Nov 2021 17:04:36 GMT Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 42B146E05D; Wed, 3 Nov 2021 17:04:36 +0000 (GMT) Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DB8716E056; Wed, 3 Nov 2021 17:04:35 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 3 Nov 2021 17:04:35 +0000 (GMT) X-MC-Unique: clmvcaeQMjiVu94p11iBAw-1 X-MC-Unique: Nk0eigrFMy-PMLllVuohpw-1 From: Stefan Berger To: libvir-list@redhat.com Subject: [PATCH v3 1/2] qemu: Move code to add encryption options for swtpm_setup into function Date: Wed, 3 Nov 2021 13:04:22 -0400 Message-Id: <20211103170423.2819802-2-stefanb@linux.ibm.com> In-Reply-To: <20211103170423.2819802-1-stefanb@linux.ibm.com> References: <20211103170423.2819802-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: h0u0lF-L8dA6lXrmdmtM_dsUY04_P4ls X-Proofpoint-GUID: h0u0lF-L8dA6lXrmdmtM_dsUY04_P4ls X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205, Aquarius:18.0.790, Hydra:6.0.425, FMLib:17.0.607.475 definitions=2021-11-03_05,2021-11-03_01,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 mlxscore=0 impostorscore=0 malwarescore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxlogscore=999 bulkscore=0 adultscore=0 phishscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111030093 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.84 on 10.11.54.1 X-loop: libvir-list@redhat.com Cc: marcandre.lureau@redhat.com, Stefan Berger , mprivozn@redhat.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1635959098530100001 Content-Type: text/plain; charset="utf-8" Move the code that adds encryption options for the swtpm_setup command line into its own function. Signed-off-by: Stefan Berger --- src/qemu/qemu_tpm.c | 54 +++++++++++++++++++++++++++++++-------------- 1 file changed, 37 insertions(+), 17 deletions(-) diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 5a05273100..94a0d3a1f9 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -422,6 +422,41 @@ qemuTPMCreateConfigFiles(const char *swtpm_setup) } =20 =20 +/* + * Add encryption parameters to swtpm_setup command line. + * + * @cmd: virCommand to add options to + * @swtpm_setup: swtpm_setup tool path + * @secretuuid: The secret's uuid; may be NULL + */ +static int +qemuTPMVirCommandAddEncryption(virCommand *cmd, + const char *swtpm_setup, + const unsigned char *secretuuid) +{ + int pwdfile_fd; + + if (!secretuuid) + return 0; + + if (!virTPMSwtpmSetupCapsGet(VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PWDFIL= E_FD)) { + virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, + _("%s does not support passing a passphrase using a file " + "descriptor"), swtpm_setup); + return -1; + } + if ((pwdfile_fd =3D qemuTPMSetupEncryption(secretuuid, cmd)) < 0) + return -1; + + virCommandAddArg(cmd, "--pwdfile-fd"); + virCommandAddArgFormat(cmd, "%d", pwdfile_fd); + virCommandAddArgList(cmd, "--cipher", "aes-256-cbc", NULL); + virCommandPassFD(cmd, pwdfile_fd, VIR_COMMAND_PASS_FD_CLOSE_PARENT); + + return 0; +} + + /* * qemuTPMEmulatorRunSetup * @@ -495,23 +530,8 @@ qemuTPMEmulatorRunSetup(const char *storagepath, break; } =20 - if (secretuuid) { - if (!virTPMSwtpmSetupCapsGet( - VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PWDFILE_FD)) { - virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, - _("%s does not support passing a passphrase using a file " - "descriptor"), swtpm_setup); - return -1; - } - if ((pwdfile_fd =3D qemuTPMSetupEncryption(secretuuid, cmd)) < 0) - return -1; - - virCommandAddArg(cmd, "--pwdfile-fd"); - virCommandAddArgFormat(cmd, "%d", pwdfile_fd); - virCommandAddArgList(cmd, "--cipher", "aes-256-cbc", NULL); - virCommandPassFD(cmd, pwdfile_fd, VIR_COMMAND_PASS_FD_CLOSE_PARENT= ); - pwdfile_fd =3D -1; - } + if (qemuTPMVirCommandAddEncryption(cmd, swtpm_setup, secretuuid) < 0) + return -1; =20 if (!incomingMigration) { virCommandAddArgList(cmd, --=20 2.31.1 From nobody Mon Apr 29 16:23:16 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=none dis=none) header.from=linux.ibm.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1635959103209910.3159007802898; Wed, 3 Nov 2021 10:05:03 -0700 (PDT) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-320-vPcWh2j1PbSlJBSMJtBp6Q-1; Wed, 03 Nov 2021 13:04:58 -0400 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 0F5F81835AC8; Wed, 3 Nov 2021 17:04:53 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E05341045EAD; Wed, 3 Nov 2021 17:04:52 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 9C13B4EA2F; Wed, 3 Nov 2021 17:04:52 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 1A3H4owj021363 for ; Wed, 3 Nov 2021 13:04:50 -0400 Received: by smtp.corp.redhat.com (Postfix) id 7CE712026D5D; Wed, 3 Nov 2021 17:04:50 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast02.extmail.prod.ext.rdu2.redhat.com [10.11.55.18]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 76B962026D46 for ; Wed, 3 Nov 2021 17:04:46 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id E841A8011A5 for ; Wed, 3 Nov 2021 17:04:45 +0000 (UTC) Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-119-tN5oz9eENKmfD7RSVji-Kw-1; Wed, 03 Nov 2021 13:04:42 -0400 Received: from pps.filterd (m0098413.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1A3GpoVi020136; Wed, 3 Nov 2021 17:04:40 GMT Received: from ppma01dal.us.ibm.com (83.d6.3fa9.ip4.static.sl-reverse.com [169.63.214.131]) by mx0b-001b2d01.pphosted.com with ESMTP id 3c3xaqga71-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Nov 2021 17:04:40 +0000 Received: from pps.filterd (ppma01dal.us.ibm.com [127.0.0.1]) by ppma01dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 1A3H41oE030432; Wed, 3 Nov 2021 17:04:39 GMT Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by ppma01dal.us.ibm.com with ESMTP id 3c0wpd0qkd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 03 Nov 2021 17:04:39 +0000 Received: from b03ledav001.gho.boulder.ibm.com (b03ledav001.gho.boulder.ibm.com [9.17.130.232]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 1A3H4cll52887964 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 3 Nov 2021 17:04:38 GMT Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1081F6E05D; Wed, 3 Nov 2021 17:04:38 +0000 (GMT) Received: from b03ledav001.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AA0406E052; Wed, 3 Nov 2021 17:04:37 +0000 (GMT) Received: from sbct-2.pok.ibm.com (unknown [9.47.158.152]) by b03ledav001.gho.boulder.ibm.com (Postfix) with ESMTP; Wed, 3 Nov 2021 17:04:37 +0000 (GMT) X-MC-Unique: vPcWh2j1PbSlJBSMJtBp6Q-1 X-MC-Unique: tN5oz9eENKmfD7RSVji-Kw-1 From: Stefan Berger To: libvir-list@redhat.com Subject: [PATCH v3 2/2] qemu: tpm: Extend TPM domain XML with PCR banks to activate Date: Wed, 3 Nov 2021 13:04:23 -0400 Message-Id: <20211103170423.2819802-3-stefanb@linux.ibm.com> In-Reply-To: <20211103170423.2819802-1-stefanb@linux.ibm.com> References: <20211103170423.2819802-1-stefanb@linux.ibm.com> X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: mMUfCxOVV3xl3JLilmfVdebLbSrT_JnP X-Proofpoint-GUID: mMUfCxOVV3xl3JLilmfVdebLbSrT_JnP X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205, Aquarius:18.0.790, Hydra:6.0.425, FMLib:17.0.607.475 definitions=2021-11-03_05,2021-11-03_01,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 mlxlogscore=999 mlxscore=0 clxscore=1015 adultscore=0 phishscore=0 spamscore=0 suspectscore=0 lowpriorityscore=0 impostorscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111030093 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-loop: libvir-list@redhat.com Cc: marcandre.lureau@redhat.com, Stefan Berger , mprivozn@redhat.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1635959104477100001 Content-Type: text/plain; charset="utf-8" Extend the TPM backend XML with a node 'active_pcr_banks' that allows a user to specify the PCR banks to activate before starting a VM. Valid choices for PCR banks are sha1, sha256, sha384 and sha512. When the XML node is provided, the set of active PCR banks is 'enforced' by running swtpm_setup before every start of the VM. The activation requires that swtpm_setup v0.7 or later is installed and may not have any effect otherwise. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=3D2016599 Signed-off-by: Stefan Berger Reviewed-by: Michal Privoznik --- docs/formatdomain.rst | 12 +++ docs/schemas/domaincommon.rng | 30 ++++++ src/conf/domain_conf.c | 50 +++++++++- src/conf/domain_conf.h | 11 +++ src/libvirt_private.syms | 2 + src/qemu/qemu_tpm.c | 98 +++++++++++++++++++ src/util/virtpm.c | 1 + src/util/virtpm.h | 1 + tests/qemuxml2argvdata/tpm-emulator-tpm2.xml | 7 +- .../tpm-emulator-tpm2.x86_64-latest.xml | 7 +- 10 files changed, 215 insertions(+), 4 deletions(-) diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst index 0651975c88..eb8c973cf1 100644 --- a/docs/formatdomain.rst +++ b/docs/formatdomain.rst @@ -7539,6 +7539,9 @@ Example: usage of the TPM Emulator + + + @@ -7598,6 +7601,15 @@ Example: usage of the TPM Emulator This attribute only works with the ``emulator`` backend. The accepted v= alues are ``yes`` and ``no``. :since:`Since 7.0.0` =20 +``active_pcr_banks`` + The ``active_pcr_banks`` node is used to define which of the PCR banks + of a TPM 2.0 to activate. Valid names are for example sha1, sha256, sha= 384, + and sha512. If this node is provided, the set of PCR banks are activated + before every start of a VM and this step is logged in the swtpm's log. + This attribute requires that swtpm_setup v0.7 or later is installed + and may not have any effect otherwise. The selection of PCR banks only = works + with the ``emulator`` backend. since:`Since 7.10.0` + ``encryption`` The ``encryption`` element allows the state of a TPM emulator to be encrypted. The ``secret`` must reference a secret object that holds the diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index 67df13d90d..4fe3e04af5 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -5323,6 +5323,7 @@ emulator + @@ -5366,6 +5367,35 @@ =20 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 4644d18120..da0c64b460 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1258,6 +1258,14 @@ VIR_ENUM_IMPL(virDomainTPMVersion, "2.0", ); =20 +VIR_ENUM_IMPL(virDomainTPMPcrBank, + VIR_DOMAIN_TPM_PCR_BANK_LAST, + "sha1", + "sha256", + "sha384", + "sha512", +); + VIR_ENUM_IMPL(virDomainIOMMUModel, VIR_DOMAIN_IOMMU_MODEL_LAST, "intel", @@ -11735,6 +11743,10 @@ virDomainSmartcardDefParseXML(virDomainXMLOption *= xmlopt, * * * + * + * + * + * * * * @@ -11753,6 +11765,8 @@ virDomainTPMDefParseXML(virDomainXMLOption *xmlopt, virDomainTPMDef *def; VIR_XPATH_NODE_AUTORESTORE(ctxt) int nbackends; + int nnodes; + size_t i; g_autofree char *path =3D NULL; g_autofree char *model =3D NULL; g_autofree char *backend =3D NULL; @@ -11760,6 +11774,8 @@ virDomainTPMDefParseXML(virDomainXMLOption *xmlopt, g_autofree char *secretuuid =3D NULL; g_autofree char *persistent_state =3D NULL; g_autofree xmlNodePtr *backends =3D NULL; + g_autofree xmlNodePtr *nodes =3D NULL; + int bank; =20 def =3D g_new0(virDomainTPMDef, 1); =20 @@ -11841,6 +11857,19 @@ virDomainTPMDefParseXML(virDomainXMLOption *xmlopt, goto error; } } + if (def->version =3D=3D VIR_DOMAIN_TPM_VERSION_2_0) { + if ((nnodes =3D virXPathNodeSet("./backend/active_pcr_banks/*"= , ctxt, &nodes)) < 0) + break; + for (i =3D 0; i < nnodes; i++) { + if ((bank =3D virDomainTPMPcrBankTypeFromString((const cha= r *)nodes[i]->name)) < 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Unsupported PCR banks '%s'"), + nodes[i]->name); + goto error; + } + def->data.emulator.activePcrBanks |=3D (1 << bank); + } + } break; case VIR_DOMAIN_TPM_TYPE_LAST: goto error; @@ -25440,10 +25469,27 @@ virDomainTPMDefFormat(virBuffer *buf, virBufferAsprintf(buf, "\n", virUUIDFormat(def->data.emulator.secretuuid, uuidstr)); virBufferAdjustIndent(buf, -2); + } + if (def->data.emulator.activePcrBanks) { + size_t i; + virBufferAddLit(buf, ">\n"); + virBufferAdjustIndent(buf, 2); + virBufferAddLit(buf, "\n"); + virBufferAdjustIndent(buf, 2); + for (i =3D VIR_DOMAIN_TPM_PCR_BANK_SHA1; i < VIR_DOMAIN_TPM_PC= R_BANK_LAST; i++) { + if ((def->data.emulator.activePcrBanks & (1 << i))) + virBufferAsprintf(buf, "<%s/>\n", + virDomainTPMPcrBankTypeToString(i)); + } + virBufferAdjustIndent(buf, -2); + virBufferAddLit(buf, "\n"); + virBufferAdjustIndent(buf, -2); + } + if (def->data.emulator.hassecretuuid || + def->data.emulator.activePcrBanks) virBufferAddLit(buf, "\n"); - } else { + else virBufferAddLit(buf, "/>\n"); - } break; case VIR_DOMAIN_TPM_TYPE_LAST: break; diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index cb6d8975b8..ab9a7d66f8 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1363,6 +1363,15 @@ typedef enum { VIR_DOMAIN_TPM_VERSION_LAST } virDomainTPMVersion; =20 +typedef enum { + VIR_DOMAIN_TPM_PCR_BANK_SHA1, + VIR_DOMAIN_TPM_PCR_BANK_SHA256, + VIR_DOMAIN_TPM_PCR_BANK_SHA384, + VIR_DOMAIN_TPM_PCR_BANK_SHA512, + + VIR_DOMAIN_TPM_PCR_BANK_LAST +} virDomainPcrBank; + #define VIR_DOMAIN_TPM_DEFAULT_DEVICE "/dev/tpm0" =20 struct _virDomainTPMDef { @@ -1381,6 +1390,7 @@ struct _virDomainTPMDef { unsigned char secretuuid[VIR_UUID_BUFLEN]; bool hassecretuuid; bool persistent_state; + unsigned int activePcrBanks; } emulator; } data; }; @@ -3941,6 +3951,7 @@ VIR_ENUM_DECL(virDomainRNGBackend); VIR_ENUM_DECL(virDomainTPMModel); VIR_ENUM_DECL(virDomainTPMBackend); VIR_ENUM_DECL(virDomainTPMVersion); +VIR_ENUM_DECL(virDomainTPMPcrBank); VIR_ENUM_DECL(virDomainMemoryModel); VIR_ENUM_DECL(virDomainMemoryBackingModel); VIR_ENUM_DECL(virDomainMemorySource); diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 55ae7d5b6f..69ff1ca430 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -667,6 +667,8 @@ virDomainTPMBackendTypeToString; virDomainTPMDefFree; virDomainTPMModelTypeFromString; virDomainTPMModelTypeToString; +virDomainTPMPcrBankTypeFromString; +virDomainTPMPcrBankTypeToString; virDomainUSBDeviceDefForeach; virDomainVideoDefaultRAM; virDomainVideoDefClear; diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 94a0d3a1f9..b305313ad2 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -565,6 +565,96 @@ qemuTPMEmulatorRunSetup(const char *storagepath, } =20 =20 +static char * +qemuTPMPcrBankBitmapToStr(unsigned int pcrBanks) +{ + g_auto(virBuffer) buf =3D VIR_BUFFER_INITIALIZER; + const char *comma =3D ""; + size_t i; + + for (i =3D VIR_DOMAIN_TPM_PCR_BANK_SHA1; i < VIR_DOMAIN_TPM_PCR_BANK_L= AST; i++) { + if (pcrBanks & (1 << i)) { + virBufferAsprintf(&buf, "%s%s", + comma, virDomainTPMPcrBankTypeToString(i)); + comma =3D ","; + } + } + return virBufferContentAndReset(&buf); +} + + +/* + * qemuTPMEmulatorReconfigure + * + * + * @storagepath: path to the directory for TPM state + * @swtpm_user: The userid to switch to when setting up the TPM; + * typically this should be the uid of 'tss' or 'root' + * @swtpm_group: The group id to switch to + * @activePcrBanks: The string describing the active PCR banks + * @logfile: The file to write the log into; it must be writable + * for the user given by userid or 'tss' + * @tpmversion: The version of the TPM, either a TPM 1.2 or TPM 2 + * @secretuuid: The secret's UUID needed for state encryption + * + * Reconfigure the active PCR banks of a TPM 2. + */ +static int +qemuTPMEmulatorReconfigure(const char *storagepath, + uid_t swtpm_user, + gid_t swtpm_group, + unsigned int activePcrBanks, + const char *logfile, + const virDomainTPMVersion tpmversion, + const unsigned char *secretuuid) +{ + g_autoptr(virCommand) cmd =3D NULL; + int exitstatus; + g_autofree char *activePcrBanksStr; + g_autofree char *swtpm_setup =3D virTPMGetSwtpmSetup(); + VIR_AUTOCLOSE pwdfile_fd =3D -1; + + if (!swtpm_setup) + return -1; + + if (tpmversion !=3D VIR_DOMAIN_TPM_VERSION_2_0 || + (activePcrBanksStr =3D qemuTPMPcrBankBitmapToStr(activePcrBanks)) = =3D=3D NULL || + !virTPMSwtpmSetupCapsGet(VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_RECONF= IGURE_PCR_BANKS)) + return 0; + + cmd =3D virCommandNew(swtpm_setup); + if (!cmd) + return -1; + + virCommandSetUID(cmd, swtpm_user); + virCommandSetGID(cmd, swtpm_group); + + virCommandAddArgList(cmd, "--tpm2", NULL); + + if (qemuTPMVirCommandAddEncryption(cmd, swtpm_setup, secretuuid) < 0) + return -1; + + virCommandAddArgList(cmd, + "--tpm-state", storagepath, + "--logfile", logfile, + "--pcr-banks", activePcrBanksStr, + "--reconfigure", + NULL); + + virCommandClearCaps(cmd); + + if (virCommandRun(cmd, &exitstatus) < 0 || exitstatus !=3D 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not run '%s --reconfigure'. exitstatus: %d= ; " + "Check error log '%s' for details."), + swtpm_setup, exitstatus, logfile); + return -1; + } + + return 0; +} + + /* * qemuTPMEmulatorBuildCommand: * @@ -619,6 +709,14 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, secretuuid, incomingMigration) < 0) goto error; =20 + if (!incomingMigration && + qemuTPMEmulatorReconfigure(tpm->data.emulator.storagepath, + swtpm_user, swtpm_group, + tpm->data.emulator.activePcrBanks, + tpm->data.emulator.logfile, tpm->versio= n, + secretuuid) < 0) + goto error; + unlink(tpm->data.emulator.source.data.nix.path); =20 cmd =3D virCommandNew(swtpm); diff --git a/src/util/virtpm.c b/src/util/virtpm.c index 40d9272e66..7fa870b803 100644 --- a/src/util/virtpm.c +++ b/src/util/virtpm.c @@ -47,6 +47,7 @@ VIR_ENUM_IMPL(virTPMSwtpmSetupFeature, "cmdarg-pwdfile-fd", "cmdarg-create-config-files", "tpm12-not-need-root", + "cmdarg-reconfigure-pcr-banks", ); =20 /** diff --git a/src/util/virtpm.h b/src/util/virtpm.h index b75eb84f31..defea6c106 100644 --- a/src/util/virtpm.h +++ b/src/util/virtpm.h @@ -40,6 +40,7 @@ typedef enum { VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_PWDFILE_FD, VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_CREATE_CONFIG_FILES, VIR_TPM_SWTPM_SETUP_FEATURE_TPM12_NOT_NEED_ROOT, + VIR_TPM_SWTPM_SETUP_FEATURE_CMDARG_RECONFIGURE_PCR_BANKS, =20 VIR_TPM_SWTPM_SETUP_FEATURE_LAST } virTPMSwtpmSetupFeature; diff --git a/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml b/tests/qemuxml2a= rgvdata/tpm-emulator-tpm2.xml index 3e2f485ee7..68db8b9232 100644 --- a/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml +++ b/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml @@ -23,7 +23,12 @@ - + + + + + + diff --git a/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.x86_64-latest.xml b= /tests/qemuxml2xmloutdata/tpm-emulator-tpm2.x86_64-latest.xml index fe4e1aba19..edab6db123 100644 --- a/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.x86_64-latest.xml +++ b/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.x86_64-latest.xml @@ -28,7 +28,12 @@ - + + + + + +