apache / apache/cloudstack

vTPM on KVM does not persist data (ACS 4.20.1.0, Ubuntu 24.04)

未关闭
#11,842 15 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
component:documentation
主要语言
Java
星标
3.1k
派生
1.4k
平均合并
6 天 19 小时
30 天内合并 PR
32

描述

>### problem

after a shutdown, the /var/lib/libvirt/swtpm/ which holds the tpm data is gone. When starting the vm again, the folder is re-created with empty tpm files.

I am using a similar tpm definition in manually configured kvm guests, if those vm are powered off the folder remains.

### versions

4.20.1.0
Ubuntu 24.04

### The steps to reproduce the bug

```
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:~# echo "Hello, TPM!" > datafile
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:~# tpm2_nvwrite -C o -i datafile 0x1500016
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:~# tpm2_nvread -C o 0x1500016
WARN: Reading full size of the NV index
Hello, TPM!
```

Instance power cycle, and tryi to read our value again from the tpm

```
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:~# tpm2_nvread -C o 0x1500016
WARN: Reading full size of the NV index
WARNING:esys:src/tss2-esys/api/Esys_NV_ReadPublic.c:309:Esys_NV_ReadPublic_Finish() Received TPM Error
ERROR:esys:src/tss2-esys/esys_tr.c:243:Esys_TR_FromTPMPublic_Finish() Error NV_ReadPublic ErrorCode (0x0000018b)
ERROR:esys:src/tss2-esys/esys_tr.c:398:Esys_TR_FromTPMPublic() Error TR FromTPMPublic ErrorCode (0x0000018b)
ERROR: Esys_TR_FromTPMPublic(0x18B) - tpm:handle(1):the handle is not correct for the use
ERROR: Unable to run tpm2_nvread
root@VM-647bf7bc-bdca-48fa-8329-8b7a103f9ab6:
```

### What to do about it?

_No response_

贡献指南

打开贡献指南

调研方向

首先在 Ubuntu 24.04 上复现 power-cycle 序列,并检查 VM 关闭时如何处理目录 /var/lib/libvirt/swtpm/。完成的标准是重启后 TPM NV 值仍然可读,并且该目录不会以空的 TPM 文件重新创建。

由索引模型根据 Issue 内容生成。

评估

技术栈
linux, ubuntu
领域
infrastructure, operating-systems, security
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
冷清
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。