From nobody Mon Feb 9 19:32:12 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) client-ip=170.10.129.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1666607360; cv=none; d=zohomail.com; s=zohoarc; b=lo1nSfp3lGPT+8obCIjywk2HDd5r0vYRZYBqbf8KEhZpeNi2pyB+2Kh+MZzOinTdEy9S8G78yEuDA++W6momiWPalI2pWpuq0NMMkXTfdaa1iONhn5+vpg5PS+QhUkLXwZ6Ox9HVo7fMMYPbV4mO0TFc81ku7jMhu8WG8gU4rwk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1666607360; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=gHXaPNrHpTDf54TQiSQFx1IXiuPO4xspQ612yM2owDU=; b=bWCUcj8FWqsd5+OWHxhemeuPO0TzNnTZPIVcUSLkTx1JN3p5T9YfWyZknVMWcQWwJ4fruMGpeQK3CLo2igQRpgorhvrpzDhHc+v9QlWnWcRSf0V2S0PqowoNz4B46Jyu1y+krgs/xzLSkFq0b4mT0Q06Vwb2bCC3mUhepT+6A/g= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail header.from= (p=none dis=none) Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.zohomail.com with SMTPS id 1666607360856789.5083696977073; Mon, 24 Oct 2022 03:29:20 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-31-nZ9Z5mgON1-AAW-nkYxO5w-1; Mon, 24 Oct 2022 06:29:12 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 0787E3C10148; Mon, 24 Oct 2022 10:29:10 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id E50CA2166B2A; Mon, 24 Oct 2022 10:29:09 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id BF954194658F; Mon, 24 Oct 2022 10:29:09 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id B8A311946594 for ; Mon, 24 Oct 2022 10:29:07 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 8E4DE40C2143; Mon, 24 Oct 2022 10:29:07 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast03.extmail.prod.ext.rdu2.redhat.com [10.11.55.19]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 8684540C2064 for ; Mon, 24 Oct 2022 10:29:07 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 681EA80253A for ; Mon, 24 Oct 2022 10:29:07 +0000 (UTC) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-553-a0X2ea1vPKCkry34y1p-vg-1; Mon, 24 Oct 2022 06:29:02 -0400 Received: from pps.filterd (m0098410.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 29OAMhZN004764; Mon, 24 Oct 2022 10:29:00 GMT Received: from ppma03dal.us.ibm.com (b.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.11]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3kdrwb83uw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Oct 2022 10:29:00 +0000 Received: from pps.filterd (ppma03dal.us.ibm.com [127.0.0.1]) by ppma03dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 29OAJtDx004186; Mon, 24 Oct 2022 10:28:59 GMT Received: from b03cxnp08027.gho.boulder.ibm.com (b03cxnp08027.gho.boulder.ibm.com [9.17.130.19]) by ppma03dal.us.ibm.com with ESMTP id 3kc85a5shr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 24 Oct 2022 10:28:59 +0000 Received: from smtpav06.dal12v.mail.ibm.com ([9.208.128.130]) by b03cxnp08027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 29OASuVk36700474 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 24 Oct 2022 10:28:56 GMT Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 29B9A58055; Mon, 24 Oct 2022 10:28:58 +0000 (GMT) Received: from smtpav06.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D4FB858043; Mon, 24 Oct 2022 10:28:57 +0000 (GMT) Received: from sbct-3.pok.ibm.com (unknown [9.47.158.153]) by smtpav06.dal12v.mail.ibm.com (Postfix) with ESMTP; Mon, 24 Oct 2022 10:28:57 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1666607359; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=gHXaPNrHpTDf54TQiSQFx1IXiuPO4xspQ612yM2owDU=; b=PcACK6KNaj2eAa51AmdJAPj1jL0RAKC6jbB78NpSF7biW+p7pw3t62B2B7b9m/GZW6BnP+ p+peUYF73859IxOkpovy5WeU7XQ/+EkKvSdgmVS7FcVzDUfpe0TTZseQmrcbkiGWUJuLif Oh4En8ELDBTiZEoZLjKX/xx+lXu+sYo= X-MC-Unique: nZ9Z5mgON1-AAW-nkYxO5w-1 X-Original-To: libvir-list@listman.corp.redhat.com X-MC-Unique: a0X2ea1vPKCkry34y1p-vg-1 From: Stefan Berger To: libvir-list@redhat.com Subject: [PATCH v4 5/7] qemu: tpm: Pass --migration option to swtpm if supported and needed Date: Mon, 24 Oct 2022 06:28:46 -0400 Message-Id: <20221024102848.619941-6-stefanb@linux.ibm.com> In-Reply-To: <20221024102848.619941-1-stefanb@linux.ibm.com> References: <20221024102848.619941-1-stefanb@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: dB6vBlLAM_i3YSdcq8OhEWISzjQjy3Cx X-Proofpoint-ORIG-GUID: dB6vBlLAM_i3YSdcq8OhEWISzjQjy3Cx X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1 definitions=2022-10-24_02,2022-10-21_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 bulkscore=0 priorityscore=1501 clxscore=1015 mlxscore=0 spamscore=0 lowpriorityscore=0 mlxlogscore=919 phishscore=0 suspectscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000 definitions=main-2210240063 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 3.1 on 10.11.54.1 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: mprivozn@redhat.com, Stefan Berger Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.6 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1666607361601100001 Content-Type: text/plain; charset="utf-8"; x-default="true" Pass the --migration option to swtpm if swptm supports it (starting with v0.8) and if the TPM's state is written on shared storage. If this is the case apply the 'release-lock-outgoing' parameter with this option and apply the 'incoming' parameter for incoming migration so that swtpm releases the file lock on the source side when the state is migrated and locks the file on the destination side when the state is received. If a started swtpm instance is running with the necessary options of migrating with share storage then remember this with a flag in the virDomainTPMPrivateDef. Report an error if swtpm does not support the --migration option and an incoming migration across shared storage is requested. Signed-off-by: Stefan Berger --- src/qemu/qemu_migration.c | 10 ++++++++ src/qemu/qemu_tpm.c | 48 +++++++++++++++++++++++++++++++++++++-- src/qemu/qemu_tpm.h | 3 +++ 3 files changed, 59 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 16bf7ac178..2aa0b6e89e 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -2786,6 +2786,7 @@ qemuMigrationSrcBegin(virConnectPtr conn, g_autofree char *xml =3D NULL; char *ret =3D NULL; virDomainAsyncJob asyncJob; + int rc; =20 if (cfg->migrateTLSForce && !(flags & VIR_MIGRATE_TUNNELLED) && @@ -2795,6 +2796,15 @@ qemuMigrationSrcBegin(virConnectPtr conn, goto cleanup; } =20 + rc =3D qemuTPMHasSharedStorage(driver, vm->def); + if (rc < 0) + goto cleanup; + if (rc =3D=3D 1 && !qemuTPMCanMigrateSharedStorage(vm->def)) { + virReportError(VIR_ERR_NO_SUPPORT, "%s", + _("the running swtpm does not support migration wit= h shared storage")); + goto cleanup; + } + if (flags & VIR_MIGRATE_POSTCOPY_RESUME) { ret =3D qemuMigrationSrcBeginResumePhase(conn, driver, vm, xmlin, cookieout, cookieoutlen, fl= ags); diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c index 79d7a0e671..cffa77cfa3 100644 --- a/src/qemu/qemu_tpm.c +++ b/src/qemu/qemu_tpm.c @@ -557,6 +557,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, int migpwdfile_fd =3D -1; const unsigned char *secretuuid =3D NULL; bool create_storage =3D true; + bool on_shared_storage; =20 if (!swtpm) return NULL; @@ -564,8 +565,8 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, /* Do not create storage and run swtpm_setup on incoming migration over * shared storage */ - if (incomingMigration && - virFileIsSharedFS(tpm->data.emulator.storagepath) =3D=3D 1) + on_shared_storage =3D virFileIsSharedFS(tpm->data.emulator.storagepath= ) =3D=3D 1; + if (incomingMigration && on_shared_storage) create_storage =3D false; =20 if (create_storage && @@ -643,6 +644,30 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDef *tpm, virCommandAddArgFormat(cmd, "pwdfd=3D%d,mode=3Daes-256-cbc", migpw= dfile_fd); } =20 + /* If swtpm supports it and the TPM state is stored on shared storage, + * start swtpm with --migration release-lock-outgoing so it can migrate + * across shared storage if needed. + */ + QEMU_DOMAIN_TPM_PRIVATE(tpm)->swtpm.can_migrate_shared_storage =3D fal= se; + if (on_shared_storage && + virTPMSwtpmCapsGet(VIR_TPM_SWTPM_FEATURE_CMDARG_MIGRATION)) { + + virCommandAddArg(cmd, "--migration"); + virCommandAddArgFormat(cmd, "release-lock-outgoing%s", + incomingMigration ? ",incoming": ""); + QEMU_DOMAIN_TPM_PRIVATE(tpm)->swtpm.can_migrate_shared_storage =3D= true; + } else { + /* Report an error if there's an incoming migration across shared + * storage and swtpm does not support the --migration option. + */ + if (incomingMigration && on_shared_storage) { + virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, + _("%s (on destination side) does not support the --migrati= on option needed for migration with shared storage"), + swtpm); + goto error; + } + } + return g_steal_pointer(&cmd); =20 error: @@ -991,6 +1016,25 @@ qemuTPMHasSharedStorage(virQEMUDriver *driver, } =20 =20 +bool +qemuTPMCanMigrateSharedStorage(virDomainDef *def) +{ + size_t i; + + for (i =3D 0; i < def->ntpms; i++) { + virDomainTPMDef *tpm =3D def->tpms[i]; + switch (tpm->type) { + case VIR_DOMAIN_TPM_TYPE_EMULATOR: + return QEMU_DOMAIN_TPM_PRIVATE(tpm)-> + swtpm.can_migrate_shared_storag= e; + case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH: + case VIR_DOMAIN_TPM_TYPE_LAST: + } + } + return true; +} + + /* --------------------- * Module entry points * --------------------- diff --git a/src/qemu/qemu_tpm.h b/src/qemu/qemu_tpm.h index 531d93846b..e6e32a0c4a 100644 --- a/src/qemu/qemu_tpm.h +++ b/src/qemu/qemu_tpm.h @@ -61,3 +61,6 @@ int qemuTPMHasSharedStorage(virQEMUDriver *driver, virDomainDef *def) ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) G_GNUC_WARN_UNUSED_RESULT; + +bool qemuTPMCanMigrateSharedStorage(virDomainDef *def) + ATTRIBUTE_NONNULL(1); --=20 2.37.3