I use app-emulation/qemu-6.0.0 app-crypt/swtpm-0.5.2 for running a windows10 guest with an emulated TPM2.0. The guest uses /usr/share/edk2-ovmf/OVMF_CODE.fd with the emulated i440FX chipset. The emulated TPM is used to store the Bitlocker disc encryption keys. Suddenly, Bitlocker started asking for the key on every guest start. In the hardware Manager, I find the TPM driver unable to start with the message "A protocol error was detected between the driver and the device" After fiddling around a lot, I find that the root cause is sys-firmware/edk2-ovmf-202008. A downgrade to sys-firmware/edk2-ovmf-201905 resolved the issue. I do not expect this to be solved in sys-firmware/edk2-ovmf-202008, this bug report should be a hint for other users.
$ emerge --info Portage 3.0.20 (python 3.9.5-final-0, default/linux/amd64/17.1/desktop/plasma, gcc-11.1.0, glibc-2.33-r1, 5.12.2-gentoo-x86_64-int6 x86_64) ================================================================= System uname: Linux-5.12.2-gentoo-x86_64-int6-x86_64-Intel-R-_Core-TM-_i5-2520M_CPU_@_2.50GHz-with-glibc2.33 KiB Mem: 7874540 total, 3751004 free KiB Swap: 8388604 total, 6313980 free Timestamp of repository gentoo: Sat, 26 Jun 2021 07:30:01 +0000 Head commit of repository gentoo: 410d606a5db989fbf6cb541339a9a11fc8916d43 sh bash 5.1_p8 ld GNU ld (Gentoo 2.35.2 p1) 2.35.2 distcc 3.4 x86_64-pc-linux-gnu [disabled] app-shells/bash: 5.1_p8::gentoo dev-java/java-config: 2.3.1::gentoo dev-lang/perl: 5.34.0::gentoo dev-lang/python: 2.7.18_p11::gentoo, 3.8.10_p2::gentoo, 3.9.5_p2::gentoo, 3.10.0_beta3::gentoo dev-lang/rust: 1.52.1::gentoo dev-util/cmake: 3.20.4::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.7-r3::gentoo sys-apps/openrc: 0.43.3::gentoo sys-apps/sandbox: 2.24::gentoo sys-devel/autoconf: 2.13-r1::gentoo, 2.69-r5::gentoo sys-devel/automake: 1.16.3-r1::gentoo sys-devel/binutils: 2.35.2::gentoo sys-devel/gcc: 9.3.0-r2::gentoo, 10.2.0-r5::gentoo, 11.1.0-r1::gentoo sys-devel/gcc-config: 2.4::gentoo sys-devel/libtool: 2.4.6-r6::gentoo sys-devel/make: 4.3::gentoo sys-kernel/linux-headers: 5.12::gentoo (virtual/os-headers) sys-libs/glibc: 2.33-r1::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-jobs: 1 sync-rsync-verify-max-age: 24 sync-rsync-extra-opts: sync-rsync-verify-metamanifest: yes md-private location: /usr/local/portage masters: gentoo priority: 0 bitcoin location: /var/lib/layman/bitcoin masters: gentoo priority: 50 vdr-devel location: /var/lib/layman/vdr-devel masters: gentoo priority: 50 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -march=core2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/config /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php8.0/ext-active/ /etc/php/cgi-php8.0/ext-active/ /etc/php/cli-php8.0/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-O2 -march=core2 -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--keep-going --ask-enter-invalid --quiet-build=n --verbose-conflicts --jobs=2" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs clean-logs compress-build-logs compressdebug config-protect-if-modified distlocks ebuild-locks fakeroot fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="C" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LINGUAS="de" MAKEOPTS="-j4" PKGDIR="/usr/portage/packages" PORTAGE_BINHOST="http://bln9716cm.home:8778/" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" USE="X a52 aac aalib acl acpi activities alsa amd64 ao apache2 apng arping audiofile berkdb bluetooth branding bzip2 cairo cdda cdr cli clucene cron crypt css cups curl dbus declarative device-mapper dhcpcd dri dts dvb dvd dvdr ebook elogind embedded emboss enca encode exif extras ffmpeg flac fontconfig fortran gd gdbm gentoo-vm geolocation gif git glade gnutls gphoto2 gpm gstreamer gtk gui httpd hybrid-auth iconv icu id3tag ieee1394 ipv6 ithreads java javafx jpeg kde kerberos kipi kvm kwallet lame lcms lensfun libass libglvnd libkms libnotify libproxy libtirpc live lm_sensors logrotate lzo macvtap mad mikmod minizip mjpeg mmap mng mod modemmanager mp3 mp4 mpeg mtp multilib musicbrainz mysql ncurses networkmanager nfsv3 nfsv4 nls nptl nptlonly nsplugin ntlm ntp ogg old-daemons openconnect openexr opengl openipmi openmp pam pango pcre pdf phonon plasma pm-utils png policykit ppds pulseaudio qemu qml qt5 rdp readline resolvconf rss samba sasl sdl seccomp semantic-desktop smartcard smi smp sndfile snmp spell spice split-usr sql sqlite ssl startup-notification stl svg symlink tcpd threads threadsafe thumbnail tiff truetype udev udisks unicode upower usb usbredir utils v4l v4l2 vaapi vcd vdpau vim-syntax vnc vorbis webkit widgets wifi wxwidgets x264 xattr xcb xcomposite xinerama xml xrandr xscreensaver xv xvid xvmc zlib" ABI_X86="64" ADA_TARGET="gnat_2018" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" CAMERAS="canon ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx mmx mmxext pclmul popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="synaptics libinput" KERNEL="linux" L10N="en de" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-3 php7-4" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_9" PYTHON_TARGETS="python3_9" QEMU_SOFTMMU_TARGETS="i386 x86_64 arm" QEMU_USER_TARGETS="i386 x86_64 arm" RUBY_TARGETS="ruby27 ruby30" SANE_BACKENDS="epson epson2" USERLAND="GNU" VIDEO_CARDS="intel i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, RUSTFLAGS
I encountered this yesterday. Thanks a lot for investigating further :-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=944a1bda9e2a0614e3a176588bb57477813e43dd commit 944a1bda9e2a0614e3a176588bb57477813e43dd Author: Matthias Maier <tamiko@gentoo.org> AuthorDate: 2021-06-26 22:16:40 +0000 Commit: Matthias Maier <tamiko@gentoo.org> CommitDate: 2021-06-26 22:23:52 +0000 sys-firmware/edk2-ovmf: version bump to 202105 Bug: https://bugs.gentoo.org/797703 Bug: https://bugs.gentoo.org/797232 Bug: https://bugs.gentoo.org/798777 Package-Manager: Portage-3.0.20, Repoman-3.0.3 Signed-off-by: Matthias Maier <tamiko@gentoo.org> sys-firmware/edk2-ovmf/Manifest | 3 + sys-firmware/edk2-ovmf/edk2-ovmf-202105.ebuild | 173 +++++++++++++++++++++++++ 2 files changed, 176 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7ece9892529e7690a1c763a4ab7f33046bc069ae commit 7ece9892529e7690a1c763a4ab7f33046bc069ae Author: Matthias Maier <tamiko@gentoo.org> AuthorDate: 2021-06-27 07:10:30 +0000 Commit: Matthias Maier <tamiko@gentoo.org> CommitDate: 2021-06-27 07:52:06 +0000 sys-firmware/edk2-ovmf: enable tpm2 support Bug: https://bugs.gentoo.org/798777 Package-Manager: Portage-3.0.20, Repoman-3.0.3 Signed-off-by: Matthias Maier <tamiko@gentoo.org> sys-firmware/edk2-ovmf/Manifest | 2 +- .../edk2-ovmf/{edk2-ovmf-202105.ebuild => edk2-ovmf-202105-r1.ebuild} | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-)
Martin, please have a look at edk2-ovmf-202105-r1. I have added tpm(2) support to both firmware variants that we are compiling (OVMF_CODE.fd and OVMF_CODE.secboot.fd). I do see a tpm2 device being properly initialized in a Windows 10 guest (no secure boot) and I do see properly initialized pcrs on my debian guest (with secure boot): debian ~ # tpm2_pcrread sha1: 0 : 0xA19B77C51B2453A1BF4ACEE0D0C1C590ECAD0106 1 : 0xF2DA102BBCF1628D0966D15C10022D9036A12244 2 : 0x3FC8BB293BD781F217222547B0888454F03C61CD 3 : 0xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236 4 : 0x1B2D01B0D0FB0DA318DB323D13C7F979681C43ED 5 : 0xD548A3414F5E957367D42314989077DCE3D6D0CE 6 : 0xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236 7 : 0x23D1011CFE1F70A2D240856B7942E5652D759D7C 8 : 0xF4B972B13D1E62AA10466B05BFBC3E0D7DC827EF 9 : 0xBD839DBE9EDEC908DBAF5CBBEE487137BEE377EF 10: 0x0000000000000000000000000000000000000000
(In reply to Matthias Maier from comment #5) > Martin, please have a look at edk2-ovmf-202105-r1. I have added tpm(2) > support to both firmware variants that we are compiling (OVMF_CODE.fd and > OVMF_CODE.secboot.fd). I do see a tpm2 device being properly initialized in > a Windows 10 guest (no secure boot) Hello Matthias, yes new OVMF version performs well! TPM 2.0 works without issues. Thanks!
