libvirt: swtpm_ioctl is required for vTPM support

Bug #2052761 reported by Takashi Kajinami
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
In Progress
Undecided
Takashi Kajinami

Bug Description

Description
===========
Libvirt uses swtpm_ioctl to shutdown the swtpm process at VM termination, because QEMU does not send shutdown command.
However the binary is not included in the required binaries (swtpm and swtpm_setup, at the time of writing) checked by libvirt driver. So users can use vTPM support without binaries, which leaves swtpm processes kept running.

Steps to reproduce
==================
* Deploy nova-compute with vTPM support
* Move swtpm_ioctl from PATH
* Restart nova-compute

Expected result
===============
nova-compute fails to start because swtpm_ioctl is missing

Actual result
=============
nova-compute starts without error and reports TPM traits.

Environment
===========
This issue was initially found in master, but would be present in stable branches.

Logs & Configs
==============
N/A

Changed in nova:
assignee: nobody → Takashi Kajinami (kajinamit)
description: updated
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/nova/+/908546

Changed in nova:
status: New → In Progress
description: updated
Revision history for this message
Takashi Kajinami (kajinamit) wrote :

The relevant commit in libvirt is https://github.com/libvirt/libvirt/commit/69122bc2f1a4f33a019e4e939bb12687a0f527d3 .

Currently libvirt reports availability of emulated vTPM only when swtpm_ioctl exists, but the logic in nova is not aligned with it.

Revision history for this message
Takashi Kajinami (kajinamit) wrote :

Ignore my previous comment...

Usage of swtpm_ioctl was addedx when support for external TPM, run by swtpm, was added in https://github.com/libvirt/libvirt/commit/2a606b863ebdc0a74e87c453bb9b76278a72d13b .

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.