From 7ac52a09dcecc369274495ece50a6d27e9346833 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Thu, 30 Jul 2026 13:12:58 -0500 Subject: [PATCH] fix: retry VM start without TPM when swtpm fails MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit VM creation would fail entirely if swtpm_setup failed at VM start time, even though TPM is only needed for Secure Boot enforcement and disk encryption during installation - not for live ISO boot testing. Now vm_create() retries without TPM if the initial start fails with TPM enabled. The VM is undefined, redefined with an empty TPM section, and started again. This makes boot testing resilient to swtpm breakage in environments where swtpm_setup can't initialize (permission issues, missing deps, nested VMs). 💘 Generated with Crush Assisted-by: GLM-4.7 via Crush --- run.sh | 54 ++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 36 insertions(+), 18 deletions(-) diff --git a/run.sh b/run.sh index 3a16ed8..8de0776 100755 --- a/run.sh +++ b/run.sh @@ -201,10 +201,10 @@ vm_create() { # Detect KVM acceleration; fall back to QEMU software emulation local domain_type="qemu" - local cpu_mode="qemu64" + local cpu_element="qemu64" if [[ -e /dev/kvm ]]; then domain_type="kvm" - cpu_mode="host-passthrough" + cpu_element="" log_info "KVM acceleration enabled" else log_warn "KVM not available (/dev/kvm missing) - using QEMU software emulation" @@ -218,7 +218,7 @@ vm_create() { -e "s|@VM_RAM@|${VM_RAM}|g" \ -e "s|@VM_CPUS@|${VM_CPUS}|g" \ -e "s|@DOMAIN_TYPE@|${domain_type}|g" \ - -e "s|@CPU_MODE@|${cpu_mode}|g" \ + -e "s|@CPU_ELEMENT@|${cpu_element}|g" \ -e "s|@SECURE_BOOT@|${secure_boot}|g" \ -e "s|@UEFI_CODE@|${uefi_code}|g" \ -e "s|@UEFI_VARS_TEMPLATE@|${uefi_vars}|g" \ @@ -239,23 +239,41 @@ vm_create() { # Start the VM log_info "Starting VM..." if ! virsh -c "$LIBVIRT_URI" start "$VM_NAME"; then - # Check if failure was due to swtpm permissions - if [[ -n "$tpm_section" && "$LIBVIRT_URI" == *"system"* ]]; then - local vm_uuid - vm_uuid=$(virsh -c "$LIBVIRT_URI" dominfo "$VM_NAME" 2>/dev/null | grep "UUID:" | awk '{print $2}') - local swtpm_vm_dir="/var/lib/libvirt/swtpm/${vm_uuid}" - if [[ -d "$swtpm_vm_dir" ]]; then - log_error "TPM initialization failed - swtpm permission issue" - log_error "Libvirt creates per-VM swtpm state dirs as root:root." - log_error "Permanent fix (run once with sudo):" - log_error " sudo bash ${SCRIPT_DIR}/scripts/fix-swtpm-permissions.sh" - log_error "Then retry: ./run.sh test:iso destroy && ./run.sh test:iso create" - # Undefine so user can retry after fixing - virsh -c "$LIBVIRT_URI" undefine "$VM_NAME" --nvram 2>/dev/null || true + # If TPM was enabled, retry without it (swtpm may be broken) + if [[ -n "$tpm_section" ]]; then + log_warn "VM start failed with TPM - retrying without TPM..." + log_warn "Live ISO boot testing does not require TPM." + virsh -c "$LIBVIRT_URI" undefine "$VM_NAME" --nvram 2>/dev/null || true + + # Regenerate XML without TPM section + sed -e "s|@VM_NAME@|${VM_NAME}|g" \ + -e "s|@VM_UUID@|${vm_uuid}|g" \ + -e "s|@VM_RAM@|${VM_RAM}|g" \ + -e "s|@VM_CPUS@|${VM_CPUS}|g" \ + -e "s|@DOMAIN_TYPE@|${domain_type}|g" \ + -e "s|@CPU_ELEMENT@|${cpu_element}|g" \ + -e "s|@SECURE_BOOT@|${secure_boot}|g" \ + -e "s|@UEFI_CODE@|${uefi_code}|g" \ + -e "s|@UEFI_VARS_TEMPLATE@|${uefi_vars}|g" \ + -e "s|@VM_DISK@|${vm_disk_path}|g" \ + -e "s|@ISO_PATH@|${vm_iso_path}|g" \ + -e "s|@TPM_SECTION@||g" \ + "$template" > "$vm_xml" + + if ! virsh -c "$LIBVIRT_URI" define "$vm_xml"; then + log_error "Failed to redefine VM without TPM" + cat "$vm_xml" + return 1 fi + + if ! virsh -c "$LIBVIRT_URI" start "$VM_NAME"; then + log_error "Failed to start VM (with and without TPM)" + return 1 + fi + else + log_error "Failed to start VM" + return 1 fi - log_error "Failed to start VM" - return 1 fi # Verify VM is running