apache / apache/cloudstack

vTPM on KVM does not persist data (ACS 4.20.1.0, Ubuntu 24.04)

Open
#11,842 15 comments 0 reactions 0 assignees View on GitHub
component:documentation
Dominant language
Java
Stars
3.1k
Forks
1.4k
Avg merge
6d 19h
Merged PRs (30d)
32

Description

>### problem

after a shutdown, the /var/lib/libvirt/swtpm/ which holds the tpm data is gone. When starting the vm again, the folder is re-created with empty tpm files.

I am using a similar tpm definition in manually configured kvm guests, if those vm are powered off the folder remains.

### versions

4.20.1.0
Ubuntu 24.04

### The steps to reproduce the bug

```
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:~# echo "Hello, TPM!" > datafile
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:~# tpm2_nvwrite -C o -i datafile 0x1500016
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:~# tpm2_nvread -C o 0x1500016
WARN: Reading full size of the NV index
Hello, TPM!
```

Instance power cycle, and tryi to read our value again from the tpm

```
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:~# tpm2_nvread -C o 0x1500016
WARN: Reading full size of the NV index
WARNING:esys:src/tss2-esys/api/Esys_NV_ReadPublic.c:309:Esys_NV_ReadPublic_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/esys_tr.c:243:Esys_TR_FromTPMPublic_Finish() Error NV_ReadPublic ErrorCode (0x0000018b)
ERROR:esys:src/tss2-esys/esys_tr.c:398:Esys_TR_FromTPMPublic() Error TR FromTPMPublic ErrorCode (0x0000018b)
ERROR: Esys_TR_FromTPMPublic(0x18B) - tpm:handle(1):the handle is not correct for the use
ERROR: Unable to run tpm2_nvread
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:
```

### What to do about it?

_No response_

Contributor guide

Open the contributing guide

Research direction

Begin by reproducing the power-cycle sequence on Ubuntu 24.04 and inspect how the /var/lib/libvirt/swtpm/ directory is handled when the VM shuts down. Done means the TPM NV value remains readable after restart and the directory is not recreated with empty TPM files.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, ubuntu
Domain
infrastructure, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.