Closed kloczek closed 3 years ago
After switching to fedora binaries I have now some other effect
[root@barrel ~]# systemctl status --full --lines=50 tpm2-abrmd
● tpm2-abrmd.service - TPM2 Access Broker and Resource Management Daemon
Loaded: loaded (/usr/lib/systemd/system/tpm2-abrmd.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Tue 2021-08-03 01:10:11 BST; 5min ago
Process: 47269 ExecStart=/usr/sbin/tpm2-abrmd (code=exited, status=74)
Main PID: 47269 (code=exited, status=74)
CPU: 16ms
Aug 03 01:10:11 barrel systemd[1]: Starting TPM2 Access Broker and Resource Management Daemon...
Aug 03 01:10:11 barrel tpm2-abrmd[47269]: tcti_conf before: "(null)"
Aug 03 01:10:11 barrel tpm2-abrmd[47269]: tcti_conf after: "device:/dev/tpm0"
Aug 03 01:10:11 barrel tpm2-abrmd[47269]: ERROR:tcti:src/tss2-tcti/tcti-device.c:442:Tss2_Tcti_Device_Init() Failed to open specified TCTI device file /dev/tpm0: No such f>
Aug 03 01:10:11 barrel tpm2-abrmd[47269]: ERROR:tcti:src/tss2-tcti/tctildr-dl.c:154:tcti_from_file() Could not initialize TCTI file: device
Aug 03 01:10:11 barrel tpm2-abrmd[47269]: ERROR:tcti:src/tss2-tcti/tctildr.c:428:Tss2_TctiLdr_Initialize_Ex() Failed to instantiate TCTI
Aug 03 01:10:11 barrel tpm2-abrmd[47269]: init_thread_func: failed to create TCTI with conf "device:/dev/tpm0", got RC: 0xa000a
Aug 03 01:10:11 barrel tpm2-abrmd[47269]: g_bus_unown_name: assertion 'owner_id > 0' failed
Aug 03 01:10:11 barrel systemd[1]: tpm2-abrmd.service: Main process exited, code=exited, status=74/IOERR
Aug 03 01:10:11 barrel systemd[1]: tpm2-abrmd.service: Failed with result 'exit-code'.
Aug 03 01:10:11 barrel systemd[1]: Failed to start TPM2 Access Broker and Resource Management Daemon.
Aug 03 01:12:57 barrel systemd[1]: Dependency failed for TPM2 Access Broker and Resource Management Daemon.
Aug 03 01:12:57 barrel systemd[1]: tpm2-abrmd.service: Job tpm2-abrmd.service/start failed with result 'dependency'.
[root@barrel ~]# lsmod |grep tpm
tpm_vtpm_proxy 20480 0
You don't seem to have a hardware TPM 2 on your system... that's what this seems to show.
You don't seem to have a hardware TPM 2 on your system... that's what this seems to show.
That is true. Question still is: why suddenly everything around started crashing because of that? And/or: what I can do in this situation?
Could I ask a follow on question to this? I have things set up and working and I can create KVM VM’s with tpm’s but they aren’t enabled on boot. I see docs in the github for this on seaBIOS and compiling/enabling there and wanted to ask if that repo is set up to where I could check that out, build it, and use the resulting bin in my VM’s if that would be enabled by default? I want to script the VM create so that I don’t have to go into the bios menu and enable the TPM’s on each VM after it is created.
Thank you for your help.
From: Chris Lyons @.> Date: Wednesday, July 28, 2021 at 11:02 AM To: stefanberger/swtpm @.>, stefanberger/swtpm @.> Cc: Mention @.> Subject: Re: [stefanberger/swtpm] 0.6.0: test suite is failing (#454) Yes, its fixed now. Thanks.
From: Stefan Berger @.> Date: Wednesday, July 28, 2021 at 9:45 AM To: stefanberger/swtpm @.> Cc: Chris Lyons @.>, Mention @.> Subject: Re: [stefanberger/swtpm] 0.6.0: test suite is failing (#454)
@mephmanxhttps://github.com/mephmanx Is it fixed now? I have PR #507https://github.com/stefanberger/swtpm/pull/507 that I will also apply to stable-0.6 branch that should fix the issue entirely.
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/stefanberger/swtpm/issues/454#issuecomment-888321822, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AMNAQ2TNCI6WSMHQQTZE7M3T2ACYVANCNFSM46MYJJ3A.
This email has been scanned by Inbound Shield™.
Could I ask a follow on question to this? I have things set up and working and I can create KVM VM’s with tpm’s but they aren’t enabled on boot. I see docs in the github for this on seaBIOS and compiling/enabling there and wanted to ask if that repo is set up to where I could check that out, build it, and use the resulting bin in my VM’s if that would be enabled by default? I want to script the VM create so that I don’t have to go into the bios menu and enable the TPM’s on each VM after it is created.
What does that mean 'enabled on boot'? If you attach a TPM 1.2 or TPM 2 to a QEMU VM they are automatically enabled.
Whenever I try operations with the vtpm’s I get this error:
@. ~]# tpm_takeownership Enter owner password: Confirm password: Enter SRK password: Confirm password: Tspi_Context_Connect failed: 0x00003011 - layer=tsp, code=0011 (17), Communication failure @. ~]#
From: Stefan Berger @.> Date: Wednesday, August 11, 2021 at 1:43 PM To: stefanberger/swtpm @.> Cc: Chris Lyons @.>, Mention @.> Subject: Re: [stefanberger/swtpm] 0.6.0: test suite is failing (#454)
Could I ask a follow on question to this? I have things set up and working and I can create KVM VM’s with tpm’s but they aren’t enabled on boot. I see docs in the github for this on seaBIOS and compiling/enabling there and wanted to ask if that repo is set up to where I could check that out, build it, and use the resulting bin in my VM’s if that would be enabled by default? I want to script the VM create so that I don’t have to go into the bios menu and enable the TPM’s on each VM after it is created.
What does that mean 'enabled on boot'? If you attach a TPM 1.2 or TPM 2 to a QEMU VM they are automatically enabled.
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/stefanberger/swtpm/issues/454#issuecomment-897022555, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AMNAQ2RVRJSLZMS7U25SJKLT4KZCXANCNFSM46MYJJ3A.
This email has been scanned by Inbound Shield™.
Whenever I try operations with the vtpm’s I get this error:
***@***.*** ~]# tpm_takeownership Enter owner password: Confirm password: Enter SRK password: Confirm password: Tspi_Context_Connect failed: 0x00003011 - layer=tsp, code=0011 (17), Communication failure ***@***.*** ~]#
So you want to use a TPM 1.2, right? If not you would need to pass --tpm2
to the swtpm command line .
For TPM 1.2 you have to make sure that tcsd
is installed and running. On Fedora this would be in the trousers package.
$ sudo dnf -y install trouser
$ ps aux | grep tcsd
stefanb 3016709 0.0 0.0 221400 856 pts/21 S+ 14:02 0:00 grep --color=auto tcsd
$ systemctl status tcsd
?? tcsd.service - TCG Core Services Daemon
Loaded: loaded (/usr/lib/systemd/system/tcsd.service; disabled; vendor preset: disabled)
Active: inactive (dead)
$ sudo systemctl enable tcsd
Created symlink /etc/systemd/system/multi-user.target.wants/tcsd.service ?? /usr/lib/systemd/system/tcsd.service.
$ sudo systemctl status tcsd
?? tcsd.service - TCG Core Services Daemon
Loaded: loaded (/usr/lib/systemd/system/tcsd.service; enabled; vendor preset: disabled)
Active: inactive (dead)
$ sudo systemctl start tcsd
$ ps aux | grep tcsd
tss 3016843 0.0 0.0 21816 380 ? Ss 14:03 0:00 /sbin/tcsd
stefanb 3016857 0.0 0.0 221400 860 pts/21 S+ 14:03 0:00 grep --color=auto tcsd
So, for example this VM create:
virt-install --hvm --virt-type=kvm --name=storage01 --memory=22000 --cpu=host-passthrough,cache.mode=passthrough --cpuset=auto --vcpus=vcpus=4,maxvcpus=4,sockets=1,cores=2,threads=2 --tpm emulator,model=tpm-tis,version=2.0 --memorybacking hugepages=yes --controller type=scsi,model=virtio-scsi --disk pool=Disk,size=300,bus=virtio,sparse=no --disk pool=Disk,size=300,bus=virtio,sparse=no --disk pool=SSD,size=175,bus=virtio,sparse=no --disk pool=SSD,size=175,bus=virtio,sparse=no --disk pool=SSD,size=175,bus=virtio,sparse=no --cdrom=/var/tmp/storage01-iso.iso --network type=bridge,source=amp-net,model=virtio --network type=bridge,source=loc-static,model=virtio --os-variant=centos8 --graphics=vnc --autostart
I need to add the –tpm2 argument to this?
From: Stefan Berger @.> Date: Wednesday, August 11, 2021 at 2:06 PM To: stefanberger/swtpm @.> Cc: Chris Lyons @.>, Mention @.> Subject: Re: [stefanberger/swtpm] 0.6.0: test suite is failing (#454)
Whenever I try operations with the vtpm’s I get this error:
@.*** ~]# tpm_takeownership
Enter owner password:
Confirm password:
Enter SRK password:
Confirm password: Tspi_Context_Connect failed: 0x00003011 - layer=tsp, code=0011 (17), Communication failure @.*** ~]#
So you want to use a TPM 1.2, right? If not you would need to pass --tpm2 to the swtpm command line . For TPM 1.2 you have to make sure that tcsd is installed and running. On Fedora this would be in the trousers package.
$ sudo dnf -y install trouser
$ ps aux | grep tcsd
stefanb 3016709 0.0 0.0 221400 856 pts/21 S+ 14:02 0:00 grep --color=auto tcsd
$ systemctl status tcsd
?? tcsd.service - TCG Core Services Daemon
Loaded: loaded (/usr/lib/systemd/system/tcsd.service; disabled; vendor preset: disabled)
Active: inactive (dead)
$ sudo systemctl enable tcsd
Created symlink /etc/systemd/system/multi-user.target.wants/tcsd.service ?? /usr/lib/systemd/system/tcsd.service.
$ sudo systemctl status tcsd
?? tcsd.service - TCG Core Services Daemon
Loaded: loaded (/usr/lib/systemd/system/tcsd.service; enabled; vendor preset: disabled)
Active: inactive (dead)
$ sudo systemctl start tcsd
$ ps aux | grep tcsd
tss 3016843 0.0 0.0 21816 380 ? Ss 14:03 0:00 /sbin/tcsd
stefanb 3016857 0.0 0.0 221400 860 pts/21 S+ 14:03 0:00 grep --color=auto tcsd
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/stefanberger/swtpm/issues/454#issuecomment-897038056, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AMNAQ2SQ46V3VKHKD6FK253T4K3ZRANCNFSM46MYJJ3A.
This email has been scanned by Inbound Shield™.
Since you are passing --tpm emulator,model=tpm-tis,version=2.0
you want to use a TPM 2. tpm_takeownership
is a TPM 1.2 tool, which will not work. Now you have to install the tpm2-tools package and read the documentation about these tools: https://www.mankier.com/package/tpm2-tools .
Source tree configured with:
Than build and check: