In the upcoming release of swtpm, 2 new options, backup and fsync will
be added to the directory backend [1] and [2]. This allows the user to
backup and fsync the state file and its parent directory. It lowers the
probability of TPM state file corruption in case of a power loss.
Although this has not been added to the stable swtpm release yet, Libvirt
will require some changes to incorporate these options in the XML config.
Following is the sample xml configuration snip to enable backup and
fsync:
<tpm model='tpm-crb'>
<backend type='emulator' version='2.0' backup='yes' fsync='yes'/>
</tpm>
Tested with swtpm commit #8ecf2c1 and libtpms commit #18e42c8d:
$ ps aux | grep swtpm
arun 33881 0.0 0.0 24080 10188 ? S 00:09 0:00
/usr/local/bin/swtpm socket --ctrl
type=unixio,path=/run/user/1000/libvirt/qemu/run/swtpm/5-guest-vm-swtpm.sock,mode=0600
--tpmstate
dir=/home/arun/.config/libvirt/qemu/swtpm/0a64239e-6311-4e53-8903-d1d49608a751/tpm2,mode=0600,lock,backup,fsync
--log file=/home/arun/.cache/libvirt/qemu/log/guest-vm-swtpm.log --terminate
--tpm2
$ ls -lrt
$HOME/.config/libvirt/qemu/swtpm/0a64239e-6311-4e53-8903-d1d49608a751/tpm2
total 16
-rw-------. 1 arun arun 6807 Sep 7 00:14 tpm2-00.permall.bak
-rw-------. 1 arun arun 6807 Sep 7 01:02 tpm2-00.permall
[1]
https://github.com/stefanberger/swtpm/commit/186f72a3a995fc68957ffc0b1438bb6e30d51ef0
[2]
https://github.com/stefanberger/swtpm/commit/795c1973c913da59925fa6c2d688c5ef51cb5b73
Arun Menon (4):
conf: Add backup and fsync optional swtpm attributes to RNG schema
conf: Parse and read the xml attributes for swtpm backup and fsync
qemu: tpm: Add backup and fsync options to the swtpm command
qemuxmlconftest: Add example for backup and fsync tpmstate options
docs/formatdomain.rst | 16 ++++++++++
src/conf/domain_conf.c | 31 +++++++++++++++++++
src/conf/domain_conf.h | 2 ++
src/conf/schemas/domaincommon.rng | 10 ++++++
src/qemu/qemu_tpm.c | 17 ++++++++--
src/util/virtpm.c | 2 ++
src/util/virtpm.h | 2 ++
.../tpm-emulator-tpm2-pstate.xml | 2 +-
8 files changed, 79 insertions(+), 3 deletions(-)
--
2.54.0
