[vfio-users] UEFI Windows and SWTPM

Tue Aug 3 16:27:32 UTC 2021

how do i install swtpm?
is it a package in my repo or do i need to compile the source code?
i dont use libvert, i run a qemu script to launch windows 10
how do i tell qemu that it needs to use it?
is it an additional switch on the command line?
thanks

On 8/3/21 2:20 AM, Brett Peckinpaugh wrote:
> I found my issue, it was mainly I was still using the i440fx and 
> needed to switch to q35.  Which required a bit more work, and as I had 
> to rebuild and reinstall windows I used the secure boot OVMF and with 
> that I should be if I decide to 100% windows 11 compliant.  You will 
> need to install swtpm and might have to correct some permissions based 
> on your install, and what user and it's permissions that are running 
> your qemu and libvirt.
>
> On Mon, Aug 2, 2021 at 9:39 PM Roger Lawhorn <rll at twc.com 
> <mailto:rll at twc.com>> wrote:
>
>     We are all facing a forced upgrade to windows 11 so we must answer
>     this question.
>     Thanks for asking it.
>     I am not familiar with TPM in virt machines so I decline to comment.
>
>     On 7/2/21 2:03 AM, Brett Peckinpaugh wrote:
>>     With Win 11 coming I figured I would spend a bit of time
>>     tinkering and see I could be ready if I decided it isn't the junk
>>     OS that every other windows OS is.  I run a guest with OVMF for
>>     UEFI and pass through a PCIE video card.  Everything works fine.
>>
>>     Challenge I am running into is I installed swtpm, then added a
>>     software TPM to my guest.  System boots and runs fine but the TPM
>>     fails to start in the Windows guest with a code of 10.  From
>>     Linux it all looks good.  Windows events just say generic failure
>>     messages.
>>
>>     To confuse me more, I have a server with a guest running windows
>>     that is just virtual.  Added the TPM and it shows up and is
>>     working on that guest.  Host is Manjaro flavor of Arch.
>>
>>     Linux logs for the TPM seems good.  Any ideas?  I tried to boot
>>     using a secure boot enabled version of OVMF and guest would not
>>     even start.
>>
>>     Starting vTPM manufacturing as root:root @ Thu 01 Jul 2021
>>     10:48:40 PM PDT
>>     Successfully created RSA 2048 EK with handle 0x81010001.
>>       Invoking /usr/share/swtpm/swtpm-localca --type ek --ek
>>     ac3b97418acfd724aed5d9dcc0f0e10a1a90b04ab21525115e7bb00009b9ea63525acc5ac367deef59d99620f129417f21e1419edaebd8b1f385a5b874b463d744c609b2f4c6fc00bfe5712bea7d7506e29ba8b4cb34e1b3c90d3f5a1805ba52628751aef659959d12a33d5238ec82bfa0b04ebab52bde403c9291f80a949de6303af04aa1a706ca4b054f45e94d4749b729ddf2b50849abaae1f681c3bb48ddfce1166fd804b9197d14af5fff9a52e48b0707916091516ed67c4c1e519b51478ecc25c89d9ad7a6f1e29e263b35cb54ca75ebe8bc2d7a82a3f262108abc75592467ccf5defe9e46f3706cc90ae67a4b38910e61a05ff62a9d3ec383bd352143
>>     --dir
>>     /var/lib/libvirt/swtpm/5e3c8d62-c0ef-41d7-9b7f-cddf618df88a/tpm2
>>     --logfile /var/log/swtpm/libvirt/qemu/Megaera-swtpm.log --vmid
>>     Megaera:5e3c8d62-c0ef-41d7-9b7f-cddf618df88a --tpm-spec-family
>>     2.0 --tpm-spec-level 0 --tpm-spec-revision 162 --tpm-manufacturer
>>     id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2
>>     --configfile /etc/swtpm-localca.conf --optsfile
>>     /etc/swtpm-localca.options
>>     Successfully created EK certificate locally.
>>       Invoking /usr/share/swtpm/swtpm-localca --type platform --ek
>>     ac3b97418acfd724aed5d9dcc0f0e10a1a90b04ab21525115e7bb00009b9ea63525acc5ac367deef59d99620f129417f21e1419edaebd8b1f385a5b874b463d744c609b2f4c6fc00bfe5712bea7d7506e29ba8b4cb34e1b3c90d3f5a1805ba52628751aef659959d12a33d5238ec82bfa0b04ebab52bde403c9291f80a949de6303af04aa1a706ca4b054f45e94d4749b729ddf2b50849abaae1f681c3bb48ddfce1166fd804b9197d14af5fff9a52e48b0707916091516ed67c4c1e519b51478ecc25c89d9ad7a6f1e29e263b35cb54ca75ebe8bc2d7a82a3f262108abc75592467ccf5defe9e46f3706cc90ae67a4b38910e61a05ff62a9d3ec383bd352143
>>     --dir
>>     /var/lib/libvirt/swtpm/5e3c8d62-c0ef-41d7-9b7f-cddf618df88a/tpm2
>>     --logfile /var/log/swtpm/libvirt/qemu/Megaera-swtpm.log --vmid
>>     Megaera:5e3c8d62-c0ef-41d7-9b7f-cddf618df88a --tpm-spec-family
>>     2.0 --tpm-spec-level 0 --tpm-spec-revision 162 --tpm-manufacturer
>>     id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2
>>     --configfile /etc/swtpm-localca.conf --optsfile
>>     /etc/swtpm-localca.options
>>     Successfully created platform certificate locally.
>>     Successfully created NVRAM area 0x1c00002 for RSA 2048 EK
>>     certificate.
>>     Successfully created NVRAM area 0x1c08000 for platform certificate.
>>     Successfully created ECC EK with handle 0x81010016.
>>       Invoking /usr/share/swtpm/swtpm-localca --type ek --ek
>>     x=0ecc2c9a02316295724304fcdeb9802c6d2f2d5fa40c34717ea9ff64f4d5e969c79f6eaba9bf4f8e6c67416057542a7e,y=6d54604b00bbbc83f8e9d02983c3486514218c9eabf29dbfc692058506828b299cec8605be490173ebe1727719ff5c90,id=secp384r1
>>     --dir
>>     /var/lib/libvirt/swtpm/5e3c8d62-c0ef-41d7-9b7f-cddf618df88a/tpm2
>>     --logfile /var/log/swtpm/libvirt/qemu/Megaera-swtpm.log --vmid
>>     Megaera:5e3c8d62-c0ef-41d7-9b7f-cddf618df88a --tpm-spec-family
>>     2.0 --tpm-spec-level 0 --tpm-spec-revision 162 --tpm-manufacturer
>>     id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2
>>     --configfile /etc/swtpm-localca.conf --optsfile
>>     /etc/swtpm-localca.options
>>     Successfully created EK certificate locally.
>>     Successfully created NVRAM area 0x1c00016 for ECC EK certificate.
>>     Successfully activated PCR banks sha1,sha256 among
>>     sha1,sha256,sha384,sha512.
>>     Successfully authored TPM state.
>>     Ending vTPM manufacturing @ Thu 01 Jul 2021 10:48:40 PM PDT
>>
>>     _______________________________________________
>>     vfio-users mailing list
>>     vfio-users at redhat.com  <mailto:vfio-users at redhat.com>
>>     https://listman.redhat.com/mailman/listinfo/vfio-users  <https://listman.redhat.com/mailman/listinfo/vfio-users>
>
>     _______________________________________________
>     vfio-users mailing list
>     vfio-users at redhat.com <mailto:vfio-users at redhat.com>
>     https://listman.redhat.com/mailman/listinfo/vfio-users
>     <https://listman.redhat.com/mailman/listinfo/vfio-users>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/vfio-users/attachments/20210803/ba8c0d8e/attachment.htm>