Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vTPM state storage v0 #4730

Merged
merged 8 commits into from
Jun 17, 2022
Merged

vTPM state storage v0 #4730

merged 8 commits into from
Jun 17, 2022

Commits on Jun 17, 2022

  1. maintenance: post-merge fixes 

    Signed-off-by: Pau Ruiz Safont <pau.safont@citrix.com>
    @psafont
    psafont committed Jun 17, 2022
    Configuration menu
    Copy the full SHA
    7ee7e33 View commit details
    Browse the repository at this point in the history

  2. xapi-idl: move Uuidm type to separate module 

    Needs to be moved to a separate module to avoid cycles in the build
system, about to use this type from another module.

Signed-off-by: Edwin Török <edvin.torok@citrix.com>
    @edwintorok @psafont
    edwintorok authored and psafont committed Jun 17, 2022
    Configuration menu
    Copy the full SHA
    4ff283a View commit details
    Browse the repository at this point in the history

  3. xapi-idl: add sexp converter to Uuidm type 

    Signed-off-by: Edwin Török <edvin.torok@citrix.com>
    @edwintorok @psafont
    edwintorok authored and psafont committed Jun 17, 2022
    Configuration menu
    Copy the full SHA
    3833d10 View commit details
    Browse the repository at this point in the history

  4. vTPM: plumb through Uuid 

    Xenopsd needs to know not just whether a VM has a vTPM or not, but also
its UUID (in case a XAPI DB storage backend is used).

For now only 1 vTPM/VM is supported, as before.

Signed-off-by: Edwin Török <edvin.torok@citrix.com>
    @edwintorok @psafont
    edwintorok authored and psafont committed Jun 17, 2022
    Configuration menu
    Copy the full SHA
    a8dec3a View commit details
    Browse the repository at this point in the history

  5. varstore-guard: add filtering for vTPM.{set,get}_contents API 

    Signed-off-by: Edwin Török <edvin.torok@citrix.com>
    @edwintorok @psafont
    edwintorok authored and psafont committed Jun 17, 2022
    Configuration menu
    Copy the full SHA
    4e5597e View commit details
    Browse the repository at this point in the history

  6. vTPM: add minimal support for saving/restoring state through the XAPI DB 

    On VM start read the vTPM state from the XAPI DB and write it out to a
file that is passed as argument to `swtpm-wrapper`.
On VM stop read the vTPM state from the filesystem and save it back into
the XAPI DB.

Note: any updated to vTPM state inbetween start/stop are lost if the
host running the VM crashes for now. To be addressed by other storage backends.

Signed-off-by: Edwin Török <edvin.torok@citrix.com>
    @edwintorok @psafont
    edwintorok authored and psafont committed Jun 17, 2022
    Configuration menu
    Copy the full SHA
    875da36 View commit details
    Browse the repository at this point in the history

  7. vTPM: add minimal migration support 

    Write a new swtpm record (similar to varstore record) into the migration
stream that contains the latest vTPM state (from the filesystem).
When vTPM start is called on the other end there will be 2 sources of
vTPM state: the migration state and the xapi DB. The data from the
migration state is restored first and takes precedence: there is a check
to guard against EEXIST when starting the vTPM: if it already exists
then we must've been just migrated and we leave the state alone.

This assumes that state would be stored in the filesystem (through
either the file:// or dir:// backends of swtpm, currently the only 2
existing ones).
If other backends are implemented in the future then we would need to
retrieve the latest vTPM state via another mechanism.

TBC: would qemu attempt to restore the device state as well? But we need
to start swtpm with *some* state during migration...

Signed-off-by: Edwin Török <edvin.torok@citrix.com>
    @edwintorok @psafont
    edwintorok authored and psafont committed Jun 17, 2022
    Configuration menu
    Copy the full SHA
    43baa4a View commit details
    Browse the repository at this point in the history

  8. vTPM: do not hardcode swtpm-wrapper path 

    Signed-off-by: Edwin Török <edvin.torok@citrix.com>
    @edwintorok @psafont
    edwintorok authored and psafont committed Jun 17, 2022
    Configuration menu
    Copy the full SHA
    cca5ac7 View commit details
    Browse the repository at this point in the history