[pve-devel] [RFC qemu-server 2/2] fix #3075: add TPM v1.2 and v2.0 support via swtpm

[Nick Chevsky]

Hi Stefan,

Thank you for your work on this; I've been testing it locally for a few
weeks and have since contributed improved Debian packaging and other fixes
upstream [3]. Please see my comment below the quoted code:

--- a/PVE/QemuServer.pm
> +++ b/PVE/QemuServer.pm
> ...
> +sub start_swtpm {
> ...
> +           my $setup_cmd = [
> +               "swtpm_setup",
> +               "--tpmstate",
> +               "$tmppath",
> +               "--createek",
> +               "--create-ek-cert",
> +               "--create-platform-cert",
> +               "--lock-nvram",
> +               "--config",
> +               "/etc/swtpm_setup.conf", # do not use XDG configs
> +               "--runas",
> +               "0", # force creation as root, error if not possible
>

Could you add --terminate to this argument array? That's the documented,
correct way of achieving the behavior we want (i.e. swtpm automatically
terminating along with QEMU). Currently this is already happening even
without --terminate, but that's a side effect of two bugs: one for which
I've already contributed a fix upstream [1], and another which will be
fixed once consumers (e.g. PVE, libvirt) start using --terminate (which
they should've been using all along) [2]. Adding --terminate is innocuous
and guarantees the current behavior will stay the same after the second bug
is fixed upstream.

[1]
https://github.com/stefanberger/swtpm/commit/6961ec4878b4a569ac53f6e6f77416b44f3f26d9
[2] https://github.com/stefanberger/swtpm/pull/509#issuecomment-890412478
[3] https://github.com/stefanberger/swtpm/pulls?q=author%3Anchevsky

Nick