conf: Add support for choosing emulation of a TPM 2.0

This patch extends the TPM's device XML with TPM 2.0 support. This only works for the emulator type backend and looks as follows: <tpm model='tpm-tis'> <backend type='emulator' version='2.0'/> </tpm> The swtpm process now has --tpm2 as an additional parameter: system_u:system_r:svirt_t:s0:c597,c632 tss 18477 11.8 0.0 28364 3868 ? Rs 11:13 13:50 /usr/bin/swtpm socket --daemon --ctrl type=unixio,path=/var/run/libvirt/qemu/swtpm/testvm-swtpm.sock,mode=0660 --tpmstate dir=/var/lib/libvirt/swtpm/testvm/tpm2,mode=0640 --log file=/var/log/swtpm/libvirt/qemu/testvm-swtpm.log --tpm2 --pid file=/var/run/libvirt/qemu/swtpm/testvm-swtpm.pid The version of the TPM can be changed and the state of the TPM is preserved. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Reviewed-by: John Ferlan <jferlan@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com>
2024-12-22 13:45:38 +00:00 · 2018-04-04 14:40:17 -04:00 · 2018-04-04 14:40:17 -04:00 · 8737578d11
commit 8737578d11
parent 2fc665bb11
11 changed files with 242 additions and 12 deletions
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@ -7728,7 +7728,7 @@ qemu-kvm -net nic,model=? /dev/null
    <p>
      The TPM device enables a QEMU guest to have access to TPM
      functionality. The TPM device may either be a TPM 1.2 or
-      a TPM 2.
+      a TPM 2.0.
    </p>
    <p>
      The TPM passthrough device type provides access to the host's TPM
@ -7765,7 +7765,7 @@ qemu-kvm -net nic,model=? /dev/null
  ...
  &lt;devices&gt;
    &lt;tpm model='tpm-tis'&gt;
-      &lt;backend type='emulator'&gt;
+      &lt;backend type='emulator' version='2.0'&gt;
      &lt;/backend&gt;
    &lt;/tpm&gt;
  &lt;/devices&gt;
@ -7780,7 +7780,7 @@ qemu-kvm -net nic,model=? /dev/null
          <code>tpm-tis</code> will automatically be chosen.
          <span class="since">Since 4.4.0</span>, another available choice
          is the <code>tpm-crb</code>, which should only be used when the
-          backend device is a TPM 2.
+          backend device is a TPM 2.0.
        </p>
      </dd>
      <dt><code>backend</code></dt>
@ -7815,6 +7815,19 @@ qemu-kvm -net nic,model=? /dev/null
          </dd>
        </dl>
      </dd>
+      <dt><code>version</code></dt>
+      <dd>
+        <p>
+          The <code>version</code> attribute indicates the version
+          of the TPM. By default a TPM 1.2 is created. This attribute
+          only works with the <code>emulator</code> backend. The following
+          versions are supported:
+        </p>
+        <ul>
+          <li>'1.2' : creates a TPM 1.2</li>
+          <li>'2.0' : creates a TPM 2.0</li>
+        </ul>
+      </dd>
    </dl>

    <h4><a id="elementsNVRAM">NVRAM device</a></h4>
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@ -4144,6 +4144,18 @@
          </attribute>
        </group>
      </choice>
+      <choice>
+        <group>
+          <optional>
+            <attribute name="version">
+              <choice>
+                <value>1.2</value>
+                <value>2.0</value>
+              </choice>
+           </attribute>
+          </optional>
+        </group>
+      </choice>
    </element>
  </define>

--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@ -869,6 +869,11 @@ VIR_ENUM_IMPL(virDomainTPMBackend, VIR_DOMAIN_TPM_TYPE_LAST,
              "passthrough",
              "emulator")

+VIR_ENUM_IMPL(virDomainTPMVersion, VIR_DOMAIN_TPM_VERSION_LAST,
+              "default",
+              "1.2",
+              "2.0")
+
 VIR_ENUM_IMPL(virDomainIOMMUModel, VIR_DOMAIN_IOMMU_MODEL_LAST,
              "intel")

@ -12766,7 +12771,7 @@ virDomainSmartcardDefParseXML(virDomainXMLOptionPtr xmlopt,
 * or like this:
 *
 * <tpm model='tpm-tis'>
- *   <backend type='emulator'/>
+ *   <backend type='emulator' version='2'/>
 * </tpm>
 */
 static virDomainTPMDefPtr
@ -12779,6 +12784,7 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
    char *path = NULL;
    char *model = NULL;
    char *backend = NULL;
+    char *version = NULL;
    virDomainTPMDefPtr def;
    xmlNodePtr save = ctxt->node;
    xmlNodePtr *backends = NULL;
@ -12825,6 +12831,18 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
        goto error;
    }

+    version = virXMLPropString(backends[0], "version");
+    if (!version) {
+        def->version = VIR_DOMAIN_TPM_VERSION_DEFAULT;
+    } else {
+        if ((def->version = virDomainTPMVersionTypeFromString(version)) < 0) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                           _("Unsupported TPM version '%s'"),
+                           version);
+            goto error;
+        }
+    }
+
    switch (def->type) {
    case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
        path = virXPathString("string(./backend/device/@path)", ctxt);
@ -12849,6 +12867,7 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
    VIR_FREE(model);
    VIR_FREE(backend);
    VIR_FREE(backends);
+    VIR_FREE(version);
    ctxt->node = save;
    return def;

@ -22083,6 +22102,12 @@ virDomainTPMDefCheckABIStability(virDomainTPMDefPtr src,
        return false;
    }

+    if (src->version != dst->version) {
+        virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                       _("Target TPM version doesn't match source"));
+        return false;
+    }
+
    return virDomainDeviceInfoCheckABIStability(&src->info, &dst->info);
 }

@ -25249,7 +25274,8 @@ virDomainTPMDefFormat(virBufferPtr buf,
        virBufferAddLit(buf, "</backend>\n");
        break;
    case VIR_DOMAIN_TPM_TYPE_EMULATOR:
-        virBufferAddLit(buf, "/>\n");
+        virBufferAsprintf(buf, " version='%s'/>\n",
+                          virDomainTPMVersionTypeToString(def->version));
        break;
    case VIR_DOMAIN_TPM_TYPE_LAST:
        break;
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@ -1296,12 +1296,21 @@ typedef enum {
    VIR_DOMAIN_TPM_TYPE_LAST
 } virDomainTPMBackendType;

+typedef enum {
+    VIR_DOMAIN_TPM_VERSION_DEFAULT,
+    VIR_DOMAIN_TPM_VERSION_1_2,
+    VIR_DOMAIN_TPM_VERSION_2_0,
+
+    VIR_DOMAIN_TPM_VERSION_LAST
+} virDomainTPMVersion;
+
 # define VIR_DOMAIN_TPM_DEFAULT_DEVICE "/dev/tpm0"

 struct _virDomainTPMDef {
    virDomainTPMBackendType type;
    virDomainDeviceInfo info;
    virDomainTPMModel model;
+    virDomainTPMVersion version;
    union {
        struct {
            virDomainChrSourceDef source;
@ -3398,6 +3407,7 @@ VIR_ENUM_DECL(virDomainRNGModel)
 VIR_ENUM_DECL(virDomainRNGBackend)
 VIR_ENUM_DECL(virDomainTPMModel)
 VIR_ENUM_DECL(virDomainTPMBackend)
+VIR_ENUM_DECL(virDomainTPMVersion)
 VIR_ENUM_DECL(virDomainMemoryModel)
 VIR_ENUM_DECL(virDomainMemoryBackingModel)
 VIR_ENUM_DECL(virDomainMemorySource)
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@ -5394,7 +5394,34 @@ qemuDomainDeviceDefValidateVsock(const virDomainVsockDef *vsock ATTRIBUTE_UNUSED
                         "with this QEMU binary"));
        return -1;
    }
+    return 0;
+}

+
+static int
+qemuDomainDeviceDefValidateTPM(virDomainTPMDef *tpm,
+                               const virDomainDef *def ATTRIBUTE_UNUSED)
+{
+    /* TPM 1.2 and 2 are not compatible, so we choose a specific version here */
+    if (tpm->version == VIR_DOMAIN_TPM_VERSION_DEFAULT)
+        tpm->version = VIR_DOMAIN_TPM_VERSION_1_2;
+
+    switch (tpm->version) {
+    case VIR_DOMAIN_TPM_VERSION_1_2:
+        /* only TIS available for emulator */
+        if (tpm->type == VIR_DOMAIN_TPM_TYPE_EMULATOR &&
+            tpm->model != VIR_DOMAIN_TPM_MODEL_TIS) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                           _("Unsupported interface %s for TPM 1.2"),
+                           virDomainTPMModelTypeToString(tpm->model));
+            return -1;
+        }
+        break;
+    case VIR_DOMAIN_TPM_VERSION_2_0:
+    case VIR_DOMAIN_TPM_VERSION_DEFAULT:
+    case VIR_DOMAIN_TPM_VERSION_LAST:
+        break;
+    }
    return 0;
 }

@ -5462,6 +5489,10 @@ qemuDomainDeviceDefValidate(const virDomainDeviceDef *dev,
        ret = qemuDomainDeviceDefValidateVsock(dev->data.vsock, qemuCaps);
        break;

+    case VIR_DOMAIN_DEVICE_TPM:
+        ret = qemuDomainDeviceDefValidateTPM(dev->data.tpm, def);
+        break;
+
    case VIR_DOMAIN_DEVICE_LEASE:
    case VIR_DOMAIN_DEVICE_FS:
    case VIR_DOMAIN_DEVICE_INPUT:
@ -5471,7 +5502,6 @@ qemuDomainDeviceDefValidate(const virDomainDeviceDef *dev,
    case VIR_DOMAIN_DEVICE_MEMBALLOON:
    case VIR_DOMAIN_DEVICE_NVRAM:
    case VIR_DOMAIN_DEVICE_SHMEM:
-    case VIR_DOMAIN_DEVICE_TPM:
    case VIR_DOMAIN_DEVICE_PANIC:
    case VIR_DOMAIN_DEVICE_IOMMU:
    case VIR_DOMAIN_DEVICE_NONE:
--- a/src/qemu/qemu_tpm.c
+++ b/src/qemu/qemu_tpm.c
@ -121,16 +121,32 @@ qemuTPMEmulatorInit(void)
 *
 * @swtpmStorageDir: directory for swtpm persistent state
 * @uuid: The UUID of the VM for which to create the storage
+ * @tpmversion: version of the TPM
 *
 * Create the swtpm's storage path
 */
 static char *
 qemuTPMCreateEmulatorStoragePath(const char *swtpmStorageDir,
-                                 const char *uuidstr)
+                                 const char *uuidstr,
+                                 virDomainTPMVersion tpmversion)
 {
    char *path = NULL;
+    const char *dir = "";

-    ignore_value(virAsprintf(&path, "%s/%s/tpm1.2", swtpmStorageDir, uuidstr));
+    switch (tpmversion) {
+    case VIR_DOMAIN_TPM_VERSION_1_2:
+        dir = "tpm1.2";
+        break;
+    case VIR_DOMAIN_TPM_VERSION_2_0:
+        dir = "tpm2";
+        break;
+    case VIR_DOMAIN_TPM_VERSION_DEFAULT:
+    case VIR_DOMAIN_TPM_VERSION_LAST:
+        return NULL;
+    }
+
+    ignore_value(virAsprintf(&path, "%s/%s/%s", swtpmStorageDir, uuidstr,
+                             dir));

    return path;
 }
@ -285,7 +301,8 @@ qemuTPMEmulatorInitPaths(virDomainTPMDefPtr tpm,

    if (!tpm->data.emulator.storagepath &&
        !(tpm->data.emulator.storagepath =
-            qemuTPMCreateEmulatorStoragePath(swtpmStorageDir, uuidstr)))
+            qemuTPMCreateEmulatorStoragePath(swtpmStorageDir, uuidstr,
+                                             tpm->version)))
        return -1;

    return 0;
@ -385,6 +402,7 @@ qemuTPMEmulatorPrepareHost(virDomainTPMDefPtr tpm,
 * @swtpm_group: The group id to switch to
 * @logfile: The file to write the log into; it must be writable
 *           for the user given by userid or 'tss'
+ * @tpmversion: The version of the TPM, either a TPM 1.2 or TPM 2
 *
 * Setup the external swtpm by creating endorsement key and
 * certificates for it.
@ -396,7 +414,8 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
                        bool privileged,
                        uid_t swtpm_user,
                        gid_t swtpm_group,
-                        const char *logfile)
+                        const char *logfile,
+                        const virDomainTPMVersion tpmversion)
 {
    virCommandPtr cmd = NULL;
    int exitstatus;
@ -421,6 +440,18 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
    virCommandSetUID(cmd, swtpm_user);
    virCommandSetGID(cmd, swtpm_group);

+    switch (tpmversion) {
+    case VIR_DOMAIN_TPM_VERSION_1_2:
+        break;
+    case VIR_DOMAIN_TPM_VERSION_2_0:
+        virCommandAddArgList(cmd, "--tpm2", NULL);
+        break;
+    case VIR_DOMAIN_TPM_VERSION_DEFAULT:
+    case VIR_DOMAIN_TPM_VERSION_LAST:
+        break;
+    }
+
+
    virCommandAddArgList(cmd,
                         "--tpm-state", storagepath,
                         "--vmid", vmid,
@ -484,7 +515,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm,
    if (created &&
        qemuTPMEmulatorRunSetup(tpm->data.emulator.storagepath, vmname, vmuuid,
                                privileged, swtpm_user, swtpm_group,
-                                tpm->data.emulator.logfile) < 0)
+                                tpm->data.emulator.logfile, tpm->version) < 0)
        goto error;

    unlink(tpm->data.emulator.source.data.nix.path);
@ -509,6 +540,17 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm,
    virCommandSetUID(cmd, swtpm_user);
    virCommandSetGID(cmd, swtpm_group);

+    switch (tpm->version) {
+    case VIR_DOMAIN_TPM_VERSION_1_2:
+        break;
+    case VIR_DOMAIN_TPM_VERSION_2_0:
+        virCommandAddArg(cmd, "--tpm2");
+        break;
+    case VIR_DOMAIN_TPM_VERSION_DEFAULT:
+    case VIR_DOMAIN_TPM_VERSION_LAST:
+        break;
+    }
+
    return cmd;

 error:
--- a/tests/qemuxml2argvdata/tpm-emulator-tpm2.x86_64-latest.args
+++ b/tests/qemuxml2argvdata/tpm-emulator-tpm2.x86_64-latest.args
@ -0,0 +1,32 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/home/test \
+USER=test \
+LOGNAME=test \
+QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-x86_64 \
+-name guest=TPM-VM,debug-threads=on \
+-S \
+-object secret,id=masterKey0,format=raw,\
+file=/tmp/lib/domain--1-TPM-VM/master-key.aes \
+-machine pc-i440fx-2.12,accel=tcg,usb=off,dump-guest-core=off \
+-m 2048 \
+-realtime mlock=off \
+-smp 1,sockets=1,cores=1,threads=1 \
+-uuid 11d7cd22-da89-3094-6212-079a48a309a1 \
+-display none \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=charmonitor,fd=1729,server,nowait \
+-mon chardev=charmonitor,id=monitor,mode=control \
+-rtc base=utc \
+-no-shutdown \
+-boot menu=on,strict=on \
+-device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
+-tpmdev emulator,id=tpm-tpm0,chardev=chrtpm \
+-chardev socket,id=chrtpm,path=/dev/test \
+-device tpm-tis,tpmdev=tpm-tpm0,id=tpm0 \
+-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2 \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\
+resourcecontrol=deny \
+-msg timestamp=on
--- a/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml
+++ b/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml
@ -0,0 +1,30 @@
+<domain type='qemu'>
+  <name>TPM-VM</name>
+  <uuid>11d7cd22-da89-3094-6212-079a48a309a1</uuid>
+  <memory unit='KiB'>2097152</memory>
+  <currentMemory unit='KiB'>512288</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='x86_64' machine='pc-i440fx-2.12'>hvm</type>
+    <boot dev='hd'/>
+    <bootmenu enable='yes'/>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type='usb' index='0'/>
+    <controller type='pci' index='0' model='pci-root'/>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <tpm model='tpm-tis'>
+      <backend type='emulator' version='2.0'/>
+    </tpm>
+    <memballoon model='virtio'/>
+  </devices>
+</domain>
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@ -2039,6 +2039,7 @@ mymain(void)
    DO_TEST_PARSE_ERROR("tpm-no-backend-invalid",
                        QEMU_CAPS_DEVICE_TPM_PASSTHROUGH, QEMU_CAPS_DEVICE_TPM_TIS);
    DO_TEST_CAPS_LATEST("tpm-emulator");
+    DO_TEST_CAPS_LATEST("tpm-emulator-tpm2");

    DO_TEST_PARSE_ERROR("pci-domain-invalid", NONE);
    DO_TEST_PARSE_ERROR("pci-bus-invalid", NONE);
--- a/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml
+++ b/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml
@ -0,0 +1,34 @@
+<domain type='qemu'>
+  <name>TPM-VM</name>
+  <uuid>11d7cd22-da89-3094-6212-079a48a309a1</uuid>
+  <memory unit='KiB'>2097152</memory>
+  <currentMemory unit='KiB'>512288</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='x86_64' machine='pc-i440fx-2.12'>hvm</type>
+    <boot dev='hd'/>
+    <bootmenu enable='yes'/>
+  </os>
+  <features>
+    <acpi/>
+  </features>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <controller type='usb' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <tpm model='tpm-tis'>
+      <backend type='emulator' version='2.0'/>
+    </tpm>
+    <memballoon model='virtio'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>
+    </memballoon>
+  </devices>
+</domain>
--- a/tests/qemuxml2xmloutdata/tpm-emulator.xml
+++ b/tests/qemuxml2xmloutdata/tpm-emulator.xml
@ -25,7 +25,7 @@
    <input type='mouse' bus='ps2'/>
    <input type='keyboard' bus='ps2'/>
    <tpm model='tpm-tis'>
-      <backend type='emulator'/>
+      <backend type='emulator' version='1.2'/>
    </tpm>
    <memballoon model='virtio'>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>