From d90a05b68faf38eb3b67664ed2a7bbd263d19f2e Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 23 Feb 2024 17:22:34 +0100
Subject: [PATCH 1/3] vmspawn: drop "const" from string we free

I am a bit surprised this compiled at all...
---
 src/vmspawn/vmspawn.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c
index f67c6a51bc..9d8c063e98 100644
--- a/src/vmspawn/vmspawn.c
+++ b/src/vmspawn/vmspawn.c
@@ -639,7 +639,12 @@ static int cmdline_add_vsock(char ***cmdline, int vsock_fd) {
         return 0;
 }
 
-static int start_tpm(sd_bus *bus, const char *scope, const char *tpm, const char **ret_state_tempdir) {
+static int start_tpm(
+                sd_bus *bus,
+                const char *scope,
+                const char *swtpm,
+                char **ret_state_tempdir) {
+
         _cleanup_(rm_rf_physical_and_freep) char *state_dir = NULL;
         _cleanup_free_ char *scope_prefix = NULL;
         _cleanup_(socket_service_pair_done) SocketServicePair ssp = {
@@ -649,7 +654,7 @@ static int start_tpm(sd_bus *bus, const char *scope, const char *tpm, const char
 
         assert(bus);
         assert(scope);
-        assert(tpm);
+        assert(swtpm);
         assert(ret_state_tempdir);
 
         r = unit_name_to_prefix(scope, &scope_prefix);
@@ -674,7 +679,7 @@ static int start_tpm(sd_bus *bus, const char *scope, const char *tpm, const char
         if (!ssp.listen_address)
                 return log_oom();
 
-        ssp.exec_start = strv_new(tpm, "socket", "--tpm2", "--tpmstate");
+        ssp.exec_start = strv_new(swtpm, "socket", "--tpm2", "--tpmstate");
         if (!ssp.exec_start)
                 return log_oom();
 
@@ -691,7 +696,6 @@ static int start_tpm(sd_bus *bus, const char *scope, const char *tpm, const char
                 return r;
 
         *ret_state_tempdir = TAKE_PTR(state_dir);
-
         return 0;
 }
 
@@ -1457,7 +1461,7 @@ static int run_virtual_machine(int kvm_device_fd, int vhost_device_fd) {
                 }
         }
 
-        _cleanup_free_ const char *tpm_state_tempdir = NULL;
+        _cleanup_free_ char *tpm_state_tempdir = NULL;
         if (swtpm) {
                 _cleanup_free_ char *escaped_state_dir = NULL;
 

From 519bad6c2c23d3c2dc9558878becb485f3ae9057 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 23 Feb 2024 17:23:06 +0100
Subject: [PATCH 2/3] vmspawn: disable all PCR banks but SHA256

By default swtpm runs with four banks: SHA1, SHA256, SHA384, SHA512.
This means all data that is part of the boot will be hashed four times,
which slows everything down.

Let's restrict things to SHA256 only, which is the one that really
matters. SHA1 is no up to today's standards anyway, and noone really
consumes the other two, hence no point in enabling this.

To disable the banks we need to call swtpm_setup with --pcr-banks. Do
so.
---
 src/vmspawn/vmspawn-scope.c | 9 +++++++++
 src/vmspawn/vmspawn-scope.h | 1 +
 src/vmspawn/vmspawn.c       | 9 +++++++++
 3 files changed, 19 insertions(+)

diff --git a/src/vmspawn/vmspawn-scope.c b/src/vmspawn/vmspawn-scope.c
index 676dee0592..ff986b09d6 100644
--- a/src/vmspawn/vmspawn-scope.c
+++ b/src/vmspawn/vmspawn-scope.c
@@ -175,6 +175,9 @@ static int message_add_commands(sd_bus_message *m, const char *exec_type, char *
 }
 
 void socket_service_pair_done(SocketServicePair *p) {
+        assert(p);
+
+        p->exec_start_pre = strv_free(p->exec_start_pre);
         p->exec_start = strv_free(p->exec_start);
         p->exec_stop_post = strv_free(p->exec_stop_post);
         p->unit_name_prefix = mfree(p->unit_name_prefix);
@@ -268,6 +271,12 @@ int start_socket_service_pair(sd_bus *bus, const char *scope, SocketServicePair
                         return bus_log_create_error(r);
         }
 
+        if (p->exec_start_pre) {
+                r = message_add_commands(m, "ExecStartPre", &p->exec_start_pre, 1);
+                if (r < 0)
+                        return r;
+        }
+
         r = message_add_commands(m, "ExecStart", &p->exec_start, 1);
         if (r < 0)
                 return r;
diff --git a/src/vmspawn/vmspawn-scope.h b/src/vmspawn/vmspawn-scope.h
index b807c3b203..74c75117f0 100644
--- a/src/vmspawn/vmspawn-scope.h
+++ b/src/vmspawn/vmspawn-scope.h
@@ -8,6 +8,7 @@
 #include "macro.h"
 
 typedef struct SocketServicePair {
+        char **exec_start_pre;
         char **exec_start;
         char **exec_stop_post;
         char *unit_name_prefix;
diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c
index 9d8c063e98..a07136ed2f 100644
--- a/src/vmspawn/vmspawn.c
+++ b/src/vmspawn/vmspawn.c
@@ -679,6 +679,15 @@ static int start_tpm(
         if (!ssp.listen_address)
                 return log_oom();
 
+        _cleanup_free_ char *swtpm_setup = NULL;
+        r = find_executable("swtpm_setup", &swtpm_setup);
+        if (r < 0)
+                return log_error_errno(r, "Failed to find swtpm_setup binary: %m");
+
+        ssp.exec_start_pre = strv_new(swtpm_setup, "--tpm-state", state_dir, "--tpm2", "--pcr-banks", "sha256");
+        if (!ssp.exec_start_pre)
+                return log_oom();
+
         ssp.exec_start = strv_new(swtpm, "socket", "--tpm2", "--tpmstate");
         if (!ssp.exec_start)
                 return log_oom();

From a9791a4192d014f7be47cb626e9257a021dd2fb2 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 23 Feb 2024 17:25:38 +0100
Subject: [PATCH 3/3] update TODO

---
 TODO | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/TODO b/TODO
index 91a4422621..c9f5a8537c 100644
--- a/TODO
+++ b/TODO
@@ -130,10 +130,6 @@ Deprecations and removals:
 
 Features:
 
-* vmspawn: to speed up boot let's disable all PCR banks in swtpm except for
-  SHA256. Probably means running swtpm_setup --state-dir … --tpm2 --pcr-banks
-  sha256.
-
 * in os-release define a field that can be initialized at build time from
   SOURCE_DATE_EPOCH (maybe even under that name?). Would then be used to
   initialize the timestamp logic of ConditionNeedsUpdate=.