Bug 1197104

I am executing VMs with TPM2 virtualized using swtpm with ovmf with secure boot. Once booted I do not see the event log in securityfs, and /sys/kernel/security/tpm0 is missing.

There is some component in the virtualization stack, or in the kernel, that is breaking the measure boot log in VMs. I tested:

- Use different versions of swtpm with --tpm2 option (from 6.0.0 to git). With logs activated, I will expect to see communication from the UEFI firmware inside the VM doing measurements and PCR expansions, but the log that I see I think do not represent this information. The command used is some variations for:

rm -fr tpm; mkdir tpm
swtpm socket --tpmstate dir=tpm \
  --ctrl type=unixio,path=tpm/swtpm-sock \
  --log level=20 --tpm2 &


- Use different OVMF firmwares. I am using the one deployed with Tumbleweed, and some OVMF packages from Fedora, with and without secure boot.

- Use different QEMU. I tested 6.1.1, 6.2.0 and git, using the expected cli. Always variations of:

qemu-system-x86_64\
 -enable-kvm \
 -smp 1 \
 -m 2048 \
 -machine q35 \
 -cpu host \
 -global ICH9-LPC.disable_s3=1 \
 -net nic,model=virtio \
 -net user,hostfwd=tcp::8022-:22,hostfwd=tcp::8090-:80  \
 -drive file=/usr/share/qemu/ovmf-x86_64-opensuse-code.bin,if=pflash,format=raw,unit=0,readonly=on \
 -drive file=./ovmf-x86_64-ms-vars-tw.bin,if=pflash,format=raw,unit=1 \
 -chardev socket,id=chrtpm,path=./tpm/swtpm-sock \
 -tpmdev emulator,id=tpm0,chardev=chrtpm \
 -device tpm-tis,tpmdev=tpm0 \
 -boot menu=on \
 -hda hda.qcow2

Some of the variations are changing the device from tpm-tis to tpm-cbr, or pointing to different versions of QEMU or OVMF.

- Using different distributions in the VM, including ubuntu 21, ubuntu core, and tumbleweed.

In all the cases the /sys/kernel/security/tpm0 directory is missing, and I can see the PCR (tpm2_pcrread) register, mostly at 0x00.

The only fixed point that still remains is that the two machines that I used (my desktop and a remote server) have the same kernel version (5.16.11-1-default #1 SMP PREEMPT Thu Feb 24 05:07:05 UTC 2022 (90630c5) x86_64 x86_64 x86_64 GNU/Linux), but I do not see how this can be relevant (the TPM used is emulated without root). A check in /var/log/audit or journalctl do not shows anything related.