From fdd5757940ece58052eadbcfc253bfe8b65ea4f9 Mon Sep 17 00:00:00 2001 From: Neil Levien Date: Fri, 25 Sep 2026 20:16:46 +0000 Subject: [PATCH] fix(libvirtd): allow block device behind emulator TPM state libvirt documents as a file or block device, but never allows the device in the domain cgroup and unlinks it on cleanup. Carry the two upstream patches until they land. Signed-off-by: Neil Levien Signed-off-by: Andrey Smirnov --- ...ck-device-backing-emulator-TPM-state.patch | 25 +++++++++++++++++++ ...nlink-block-device-backing-TPM-state.patch | 24 ++++++++++++++++++ hypervisors/libvirtd/pkg.yaml | 3 +++ 3 files changed, 52 insertions(+) create mode 100644 hypervisors/libvirtd/patches/0001-qemu-cgroup-allow-block-device-backing-emulator-TPM-state.patch create mode 100644 hypervisors/libvirtd/patches/0002-qemu-tpm-don-t-unlink-block-device-backing-TPM-state.patch diff --git a/hypervisors/libvirtd/patches/0001-qemu-cgroup-allow-block-device-backing-emulator-TPM-state.patch b/hypervisors/libvirtd/patches/0001-qemu-cgroup-allow-block-device-backing-emulator-TPM-state.patch new file mode 100644 index 00000000..f2bad09e --- /dev/null +++ b/hypervisors/libvirtd/patches/0001-qemu-cgroup-allow-block-device-backing-emulator-TPM-state.patch @@ -0,0 +1,25 @@ +From: Neil Levien +Subject: [PATCH 1/2] qemu: cgroup: allow block device backing emulator TPM state + +The emulator's may be a block device. swtpm runs +in the domain cgroup, but qemuSetupTPMCgroup only handled passthrough, +so the first TPM command fails with EPERM. + +Signed-off-by: Neil Levien +--- +diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c +--- a/src/qemu/qemu_cgroup.c ++++ b/src/qemu/qemu_cgroup.c +@@ -411,6 +411,12 @@ + case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH: + return qemuSetupChrSourceCgroup(vm, dev->data.passthrough.source); + case VIR_DOMAIN_TPM_TYPE_EMULATOR: ++ /* swtpm runs in the domain cgroup; its state file may be a block device */ ++ if (dev->data.emulator.source_type == VIR_DOMAIN_TPM_SOURCE_TYPE_FILE && ++ dev->data.emulator.source_path) ++ return qemuCgroupAllowDevicePath(vm, dev->data.emulator.source_path, ++ VIR_CGROUP_DEVICE_RW, false); ++ break; + case VIR_DOMAIN_TPM_TYPE_EXTERNAL: + case VIR_DOMAIN_TPM_TYPE_LAST: + break; diff --git a/hypervisors/libvirtd/patches/0002-qemu-tpm-don-t-unlink-block-device-backing-TPM-state.patch b/hypervisors/libvirtd/patches/0002-qemu-tpm-don-t-unlink-block-device-backing-TPM-state.patch new file mode 100644 index 00000000..0e959e72 --- /dev/null +++ b/hypervisors/libvirtd/patches/0002-qemu-tpm-don-t-unlink-block-device-backing-TPM-state.patch @@ -0,0 +1,24 @@ +From: Neil Levien +Subject: [PATCH 2/2] qemu: tpm: don't unlink block device backing TPM state + +Removing the state unlinked the file source. For a block device that +removes the node, not the state. Skip it, as for disks and nvram. + +Signed-off-by: Neil Levien +--- +diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c +--- a/src/qemu/qemu_tpm.c ++++ b/src/qemu/qemu_tpm.c +@@ -263,6 +263,12 @@ + + switch (tpm->data.emulator.source_type) { + case VIR_DOMAIN_TPM_SOURCE_TYPE_FILE: { ++ struct stat sb; ++ ++ /* a block device holds the state; its node is not ours to remove */ ++ if (stat(source_path, &sb) == 0 && S_ISBLK(sb.st_mode)) ++ break; ++ + if (unlink(source_path) && errno != ENOENT) + virReportSystemError(errno, + _("Cannot delete file '%1$s'"), diff --git a/hypervisors/libvirtd/pkg.yaml b/hypervisors/libvirtd/pkg.yaml index 3009d7af..ea99e986 100644 --- a/hypervisors/libvirtd/pkg.yaml +++ b/hypervisors/libvirtd/pkg.yaml @@ -94,6 +94,9 @@ steps: prepare: - | tar -xf libvirt.tar.xz --strip-components=1 + - | + patch -p1 < /pkg/patches/0001-qemu-cgroup-allow-block-device-backing-emulator-TPM-state.patch + patch -p1 < /pkg/patches/0002-qemu-tpm-don-t-unlink-block-device-backing-TPM-state.patch - | export PATH=$PATH:/usr/local/bin