Repository navigation
ephemeral: Add a TPM 2.0 emulated by swtpm - #411
Conversation
own helper. Signed-off-by: Peter Siegel <psiegel2000@icloud.com>
|
Just for some more context on how this can be used for some e2e verified boot testing:
The idea is that this emulates how you might set up a bare-metal device where the installer and the booted system post-install see the same TPM. |
|
|
||
| /// Wait until the process `name` creates `socket_path`. Fails if | ||
| /// `process` exits first or `timeout` passes. | ||
| async fn wait_for_socket( |
There was a problem hiding this comment.
For virtiofsd at least we should have always been using --fd to avoid any polling at all.
Something to improve in a followup
|
|
||
| Mount disk file as virtio-blk device at /dev/disk/by-id/virtio-<name> | ||
|
|
||
| **--tpm** |
There was a problem hiding this comment.
While this is the conservative default, I would argue to turn this on by default on supported architectures in the future
There was a problem hiding this comment.
Yeah it'll depend on swtpm being installed on the host but that should be easy to check.
--tpm attaches a TPM 2.0 emulated by swtpm, whose state is discarded with the container. Signed-off-by: Peter Siegel <psiegel2000@icloud.com> Assisted-by: AI
5272a71 to
da1f2ad
Compare
There was a problem hiding this comment.
🟡 Changes recommended
swtpm can inherit pipe writers and cause shutdown hangs, while premature validation rejects virtiofs configurations before their socket directories are created.
2 open issues
What changed in this PR
Adds opt-in, ephemeral TPM 2.0 support to container-backed VMs using swtpm alongside QEMU.
Changes:
- Adds
--tpmand architecture-specific QEMU TPM devices. - Manages swtpm startup and reuses socket-readiness handling for virtiofsd.
- Documents the option and adds an integration test checking
/dev/tpmrm0.
| File | Description |
|---|---|
| docs/src/man/bcvk-ephemeral-test-basic.md | Documents --tpm for basic tests. |
| docs/src/man/bcvk-ephemeral-run.md | Documents --tpm for ephemeral runs. |
| docs/src/man/bcvk-ephemeral-run-ssh.md | Documents --tpm for SSH runs. |
| crates/kit/src/varlink_ipc.rs | Keeps TPM disabled for Varlink-created VMs. |
| crates/kit/src/to_disk.rs | Keeps TPM disabled for disk installation. |
| crates/kit/src/run_ephemeral.rs | Adds the CLI option and TPM configuration. |
| crates/integration-tests/src/tests/run_ephemeral_ssh.rs | Tests TPM device availability in the guest. |
| crates/bcvk-qemu/src/qemu.rs | Adds swtpm management, TPM devices, and shared readiness checks. |
| crates/bcvk-qemu/src/lib.rs | Exports TpmConfig. |
Review effort: Balanced
| let mut cmd = tokio::process::Command::from(cmd); | ||
| cmd.kill_on_drop(true); | ||
| debug!("{cmd:?}"); | ||
| let child = cmd.spawn().context("Failed to spawn swtpm")?; |
There was a problem hiding this comment.
Hmm we should definitely not be opening fds without O_CLOEXEC that sounds like a bug if so
| impl RunningQemu { | ||
| /// Spawn QEMU with the given configuration. | ||
| pub async fn spawn(mut config: QemuConfig) -> Result<Self> { | ||
| config.validate()?; |
Allow adding a TPM 2.0 to ephemeral bcvk VMs, emulated by swtpm:
--tpmattaches an ephemeral TPM. Its state is discarded with the container.swtpm runs inside the container from the host's
/usr, just like virtiofsd. QEMU attaches it as atpm-tisdevice (tpm-tis-deviceon aarch64). This is the same tpm modelbcvk libvirt runuses.Added
test_run_ephemeral_tpmwhich checks if the emulated TPM shows up under/dev/tpmrm0.Assisted-by: AI