Skip to content

Commit 34ae415

Browse files
author
gitlab
committed
Merge branch 'zsv-ldap-2@@2' into 'feature-zsv-5.0.0-vm-support-vtpm-and-secuceboot'
<feature>[kvm]: support TPM key provider restore from snapshot group See merge request zstackio/zstack!9481
2 parents 9729c52 + 32bb845 commit 34ae415

4 files changed

Lines changed: 75 additions & 17 deletions

File tree

‎compute/src/main/java/org/zstack/compute/vm/devices/DummyTpmEncryptedResourceKeyBackend.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,21 @@ public String findKeyProviderUuidByTpm(String tpmUuid) {
2323
return null;
2424
}
2525

26+
@Override
27+
public String findKeyProviderUuidByName(String providerName) {
28+
return null;
29+
}
30+
2631
@Override
2732
public String findKeyProviderNameByTpm(String tpmUuid) {
2833
return null;
2934
}
3035

36+
@Override
37+
public String defaultKeyProviderUuid() {
38+
return null;
39+
}
40+
3141
@Override
3242
public void cloneEncryptedResourceKey(CloneEncryptedResourceKeyContext context, Completion completion) {
3343
// do nothing

‎compute/src/main/java/org/zstack/compute/vm/devices/TpmEncryptedResourceKeyBackend.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,21 @@ public interface TpmEncryptedResourceKeyBackend {
2525
*/
2626
String findKeyProviderUuidByTpm(String tpmUuid);
2727

28+
/**
29+
* maybe null (when crypto module is not installed)
30+
*/
31+
String findKeyProviderUuidByName(String providerName);
32+
2833
/**
2934
* maybe null (when crypto module is not installed)
3035
*/
3136
String findKeyProviderNameByTpm(String tpmUuid);
3237

38+
/**
39+
* maybe null (when crypto module is not installed)
40+
*/
41+
String defaultKeyProviderUuid();
42+
3343
static class CloneEncryptedResourceKeyContext {
3444
public String srcTpmUuid;
3545
public String dstTpmUuid;

‎plugin/kvm/src/main/java/org/zstack/kvm/efi/KvmSecureBootExtensions.java‎

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package org.zstack.kvm.efi;
22

3+
import org.apache.commons.lang.StringUtils;
34
import org.springframework.beans.factory.annotation.Autowired;
45
import org.zstack.compute.vm.VmGlobalConfig;
56
import org.zstack.compute.vm.VmSystemTags;
@@ -272,6 +273,7 @@ public static class PrepareHostFileContext {
272273
public String hostUuid;
273274
public String vmUuid;
274275
public VmHostFileType type;
276+
public String backupUuid;
275277
public String syncReason;
276278

277279
public String path;
@@ -281,8 +283,10 @@ public static class PrepareHostFileContext {
281283
private VmHostFileVO vmHostFile;
282284
private VmHostBackupFileVO vmBackupFileVO;
283285

284-
// property: VmHostFileVO (read success) > VmHostFileVO (read fail) > VmHostBackupFileVO
285-
// Note: read VmHostBackupFileVO only if VmHostFileVO is not exist
286+
// property: VmHostBackupFileVO (when "backupUuid" is set)
287+
// > VmHostFileVO (read success)
288+
// > VmHostFileVO (read fail)
289+
// > VmHostBackupFileVO (vmInstanceUuid matched) <- read this only if VmHostFileVO is not exist
286290
}
287291

288292
@SuppressWarnings("rawtypes")
@@ -292,6 +296,11 @@ public void prepareHostFileOnHost(PrepareHostFileContext context, Completion com
292296
chain.then(new NoRollbackFlow() {
293297
String __name__ = "read-vm-host-file-from-origin-host";
294298

299+
@Override
300+
public boolean skip(Map data) {
301+
return StringUtils.isNotBlank(context.backupUuid);
302+
}
303+
295304
@Override
296305
public void run(FlowTrigger trigger, Map data) {
297306
VmHostFileVO vmHostFile = Q.New(VmHostFileVO.class)
@@ -347,12 +356,23 @@ public boolean skip(Map data) {
347356

348357
@Override
349358
public void run(FlowTrigger trigger, Map data) {
350-
context.vmBackupFileVO = Q.New(VmHostBackupFileVO.class)
351-
.eq(VmHostBackupFileVO_.type, context.type)
352-
.eq(VmHostBackupFileVO_.resourceUuid, context.vmUuid)
353-
.orderByDesc(VmHostBackupFileVO_.lastOpDate)
354-
.limit(1)
355-
.find();
359+
if (context.backupUuid == null) {
360+
context.vmBackupFileVO = Q.New(VmHostBackupFileVO.class)
361+
.eq(VmHostBackupFileVO_.type, context.type)
362+
.eq(VmHostBackupFileVO_.resourceUuid, context.vmUuid)
363+
.orderByDesc(VmHostBackupFileVO_.lastOpDate)
364+
.limit(1)
365+
.find();
366+
} else {
367+
context.vmBackupFileVO = Q.New(VmHostBackupFileVO.class)
368+
.eq(VmHostBackupFileVO_.uuid, context.backupUuid)
369+
.find();
370+
if (context.vmBackupFileVO == null) {
371+
trigger.fail(operr("cannot find matched vm-host backup file[backupUuid:%s]",
372+
context.backupUuid));
373+
return;
374+
}
375+
}
356376
if (context.vmBackupFileVO != null) {
357377
logger.debug(String.format("use %s[type=%s] VM-host backup file for VM[uuid=%s]",
358378
context.vmBackupFileVO.getUuid(), context.type, context.vmUuid));

‎plugin/kvm/src/main/java/org/zstack/kvm/tpm/SnapshotGroupRevertTpmHelper.java‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
import org.springframework.beans.factory.annotation.Autowired;
55
import org.springframework.beans.factory.annotation.Configurable;
66
import org.zstack.compute.vm.VmGlobalConfig;
7+
import org.zstack.compute.vm.devices.TpmEncryptedResourceKeyBackend;
78
import org.zstack.core.db.Q;
89
import org.zstack.header.storage.snapshot.group.VolumeSnapshotGroupVO;
910
import org.zstack.header.storage.snapshot.group.VolumeSnapshotGroupVO_;
@@ -15,6 +16,7 @@
1516
import org.zstack.header.vm.additions.VmHostFileType;
1617
import org.zstack.header.vm.devices.NvRamSpec;
1718
import org.zstack.header.vm.devices.VmDevicesSpec;
19+
import org.zstack.kvm.KVMSystemTags;
1820
import org.zstack.resourceconfig.ResourceConfigFacade;
1921
import org.zstack.utils.Utils;
2022
import org.zstack.utils.logging.CLogger;
@@ -26,7 +28,9 @@ public class SnapshotGroupRevertTpmHelper {
2628
private static final CLogger logger = Utils.getLogger(SnapshotGroupRevertTpmHelper.class);
2729

2830
@Autowired
29-
ResourceConfigFacade resourceConfigFacade;
31+
private ResourceConfigFacade resourceConfigFacade;
32+
@Autowired
33+
private TpmEncryptedResourceKeyBackend tpmKeyBackend;
3034

3135
public void setupFromApi(APICreateVmInstanceFromVolumeSnapshotGroupMsg apiMsg, CreateVmInstanceMsg cmsg) {
3236
String snapshotGroupUuid = apiMsg.getVolumeSnapshotGroupUuid();
@@ -87,17 +91,31 @@ public void setupFromApi(APICreateVmInstanceFromVolumeSnapshotGroupMsg apiMsg, C
8791
tpmSpec.setEnable(true);
8892

8993
if (resetTpm) {
90-
// resetTpm=true: reset secretUuid, generate a new one during VM creation
94+
// resetTpm=true: reset generate a new one during VM creation
9195
logger.debug(String.format("resetTpm is true for volume snapshot group[uuid:%s], " +
92-
"will reset secretUuid, tpmBackupFileUuid:%s", snapshotGroupUuid, tpmBackupFile.getUuid()));
96+
"will reset tpmBackupFileUuid:%s", snapshotGroupUuid, tpmBackupFile.getUuid()));
9397
} else {
9498
tpmSpec.setBackupFileUuid(tpmBackupFile.getUuid());
95-
// resetTpm=false: should reuse secretUuid + keyProviderUuid recorded in VolumeSnapshotGroup,
96-
// but the recording step is not yet implemented, leave them empty for now
97-
// TODO: retrieve secretUuid and keyProviderUuid from VolumeSnapshotGroup and set them here
98-
logger.warn(String.format("resetTpm is false for volume snapshot group[uuid:%s], " +
99-
"should restore secretUuid and keyProviderUuid but they are not yet recorded in snapshot group, " +
100-
"leaving empty. tpmBackupFileUuid:%s", snapshotGroupUuid, tpmBackupFile.getUuid()));
99+
}
100+
101+
String keyProviderName = KVMSystemTags.TPM_KEY_PROVIDER_NAME
102+
.getTokenByResourceUuid(tpmBackupFile.getUuid(), KVMSystemTags.TPM_KEY_PROVIDER_NAME_TOKEN);
103+
if (keyProviderName == null) {
104+
logger.warn(String.format(
105+
"failed to find keyProvider from snapshotGroup[uuid:%s] by tpmBackupFile[uuid:%s]",
106+
snapshotGroupUuid, tpmBackupFile.getUuid()));
107+
if (tpmSpec.getKeyProviderUuid() == null) {
108+
tpmSpec.setKeyProviderUuid(tpmKeyBackend.defaultKeyProviderUuid()); // maybe null
109+
}
110+
} else {
111+
String keyProviderUuid = tpmKeyBackend.findKeyProviderUuidByName(keyProviderName);
112+
if (keyProviderUuid == null) {
113+
logger.warn(String.format(
114+
"failed to resolve keyProvider[name:%s] from snapshotGroup[uuid:%s] by tpmBackupFile[uuid:%s], keep keyProviderUuid unset",
115+
keyProviderName, snapshotGroupUuid, tpmBackupFile.getUuid()));
116+
} else {
117+
tpmSpec.setKeyProviderUuid(keyProviderUuid);
118+
}
101119
}
102120
}
103121

0 commit comments

Comments
 (0)