Re: vtpmmgr stubdom

["Manfred Haertel, DB3HM" <Manfred.Haertel@xxxxxxxxxxxx>]

James Dingwall schrieb:

> > Windows refers to the ACPI tables when recognizing TPM. So you have to
> > define a SSDT that defines a TPM 2.0 device and disables the TPM 1.2 device.
> >
> > KVM contains ASL code for this, but this code is incorrect and has probably
> > never worked since a patch for it was applied in 2013. The code before 2013
> > works though.
> >
> > In addition, a separate ACPI table with the name TPM2 is needed.
> >
> > And last but not least Windows requires TPM to be started by the "BIOS", so
> > you will need a TPM2 capable OVMF.
> Do you have any guides/references that we might find useful to get this
> working in our environment?  Building an ACPI table isn't something that
> I've ever had any experience doing.
I've uploaded a tarball tpm2_override.tar.gz to my Google drive:

https://drive.google.com/file/d/1mPL6Cc7eJt74zyztIIW9sSkjbU_5gxtA/view?usp=drive_link

It contains all the source files I used to build my tpm2_override.aml 
and a prebuilt tpm2_override.aml is also included. You can start the 
build process by executing the included make.sh .
You can use it simply by adding the following line to your xl.cfg for 
the Windows VM:
acpi_firmware = '/usr/local/tpm2/tpm2_override.aml'

(or whereever you store your tpm2_override.aml).

There isn't any guide for this that I know of. I found it out by myself 
by trial and error. But it runs without problems for more than two years 
now on two laptops.
Note that you also need a TPM2 capable OVMF binary, as Windows expects 
TPM to be started by UEFI. If your distribution does not contain a TPM2 
capable OVMF binary, you have to build it yourself.
And of course, you have to start and configure swtpm, but this works by 
using existing guides. You have to put the QEMU option to the 
device_model_override line in your xl.cfg .
And Windows requires also Secure Boot, and this requires persistent UEFI 
variables which Xen does not support out of the box. However you can use 
uefistored, actually written for XCP-NG, which compiles on every Linux 
distribution. But it requires a patched OVMF...
--
Manfred Härtel, DB3HM    mailto:Manfred.Haertel@xxxxxxxxxxxx
                         http://rz-home.de/mhaertel