fix(libvirtd): allow block device behind emulator TPM state

hypervisors/libvirtd/patches/0001-qemu-cgroup-allow-block-device-backing-emulator-TPM-state.patch

@@ -0,0 +1,25 @@
+From: Neil Levien <neil.levien@siderolabs.com>
+Subject: [PATCH 1/2] qemu: cgroup: allow block device backing emulator TPM state
+
+The emulator's <source type='file'> may be a block device. swtpm runs
+in the domain cgroup, but qemuSetupTPMCgroup only handled passthrough,
+so the first TPM command fails with EPERM.
+
+Signed-off-by: Neil Levien <neil.levien@siderolabs.com>
+---
+diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
+--- a/src/qemu/qemu_cgroup.c
++++ b/src/qemu/qemu_cgroup.c
+@@ -411,6 +411,12 @@
+     case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
+         return qemuSetupChrSourceCgroup(vm, dev->data.passthrough.source);
+     case VIR_DOMAIN_TPM_TYPE_EMULATOR:
++        /* swtpm runs in the domain cgroup; its state file may be a block device */
++        if (dev->data.emulator.source_type == VIR_DOMAIN_TPM_SOURCE_TYPE_FILE &&
++            dev->data.emulator.source_path)
++            return qemuCgroupAllowDevicePath(vm, dev->data.emulator.source_path,
++                                             VIR_CGROUP_DEVICE_RW, false);
++        break;
+     case VIR_DOMAIN_TPM_TYPE_EXTERNAL:
+     case VIR_DOMAIN_TPM_TYPE_LAST:
+         break;

hypervisors/libvirtd/patches/0002-qemu-tpm-don-t-unlink-block-device-backing-TPM-state.patch

@@ -0,0 +1,24 @@
+From: Neil Levien <neil.levien@siderolabs.com>
+Subject: [PATCH 2/2] qemu: tpm: don't unlink block device backing TPM state
+
+Removing the state unlinked the file source. For a block device that
+removes the node, not the state. Skip it, as for disks and nvram.
+
+Signed-off-by: Neil Levien <neil.levien@siderolabs.com>
+---
+diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c
+--- a/src/qemu/qemu_tpm.c
++++ b/src/qemu/qemu_tpm.c
+@@ -263,6 +263,12 @@
+
+     switch (tpm->data.emulator.source_type) {
+     case VIR_DOMAIN_TPM_SOURCE_TYPE_FILE: {
++        struct stat sb;
++
++        /* a block device holds the state; its node is not ours to remove */
++        if (stat(source_path, &sb) == 0 && S_ISBLK(sb.st_mode))
++            break;
++
+         if (unlink(source_path) && errno != ENOENT)
+             virReportSystemError(errno,
+                                  _("Cannot delete file '%1$s'"),

hypervisors/libvirtd/pkg.yaml

@@ -94,6 +94,8 @@ steps:
     prepare:
       - |
         tar -xf libvirt.tar.xz --strip-components=1
+        patch -p1 < /pkg/patches/0001-qemu-cgroup-allow-block-device-backing-emulator-TPM-state.patch
+        patch -p1 < /pkg/patches/0002-qemu-tpm-don-t-unlink-block-device-backing-TPM-state.patch
       - |
         export PATH=$PATH:/usr/local/bin