d2bcaacc | 16-Oct-2024 |
Stefan Berger <stefanb@linux.ibm.com> |
tpm_emulator: Read control channel response in 2 passes
Error responses from swtpm are typically only 4 bytes long with the exception of a few commands that return more bytes. Therefore, read the en
tpm_emulator: Read control channel response in 2 passes
Error responses from swtpm are typically only 4 bytes long with the exception of a few commands that return more bytes. Therefore, read the entire response in 2 steps and stop if the first few bytes indicate an error response with no subsequent bytes readable. Read the rest in a 2nd step, if needed. This avoids getting stuck while waiting for too many bytes in case of an error. The 'getting stuck' condition has not been observed in practice so far, though.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2615 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
show more ...
|
99bdcd2c | 12-Sep-2022 |
Stefan Berger <stefanb@linux.ibm.com> |
tpm_emulator: Have swtpm relock storage upon migration fall-back
Swtpm may release the lock once the last one of its state blobs has been migrated out. In case of VM migration failure QEMU now needs
tpm_emulator: Have swtpm relock storage upon migration fall-back
Swtpm may release the lock once the last one of its state blobs has been migrated out. In case of VM migration failure QEMU now needs to notify swtpm that it should again take the lock, which it can otherwise only do once it has received the first TPM command from the VM.
Only try to send the lock command if swtpm supports it. It will not have released the lock (and support shared storage setups) if it doesn't support the locking command since the functionality of releasing the lock upon state blob reception and the lock command were added to swtpm 'together'.
If QEMU sends the lock command and the storage has already been locked no error is reported.
If swtpm does not receive the lock command (from older version of QEMU), it will lock the storage once the first TPM command has been received. So sending the lock command is an optimization.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20220912174741.1542330-3-stefanb@linux.ibm.com
show more ...
|
efef4756 | 12-Sep-2022 |
Stefan Berger <stefanb@linux.ibm.com> |
tpm_emulator: Use latest tpm_ioctl.h from swtpm project
Use the latest tpm_ioctl.h from upstream swtpm project.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Marc-André Lureau <
tpm_emulator: Use latest tpm_ioctl.h from swtpm project
Use the latest tpm_ioctl.h from upstream swtpm project.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20220912174741.1542330-2-stefanb@linux.ibm.com
show more ...
|