Comment 9 for bug 2012028

Revision history for this message
Christian Ehrhardt  (paelzer) wrote : Re: secure boot: TPM version '2.0' is not supported

In qmp-shell [1] kinetic and lunar both deliver the same.

$ qemu-system-x86_64 -S -qmp unix:./qmp-sock,server --monitor stdio -display none
$ ./qmp-shell ~/qmp-sock
(QEMU) query-tpm
{"return": []}
(QEMU) query-tpm-models
{"return": ["tpm-crb", "tpm-tis"]}
(QEMU) query-tpm-types
{"return": ["passthrough", "emulator"]}

That matches what we see in virsh domcapabilities.
The above is even the same on my laptop where the domcapabilities report versions.

At least everything else is stable and didn't change, but we actually want to know where tpmCaps.backendVersion is populated.
That is done in libvirt in virQEMUCapsFillDomainDeviceTPMCaps [2]
As usual after many indirections this is handled in

virTPMSwtpmSetupCapsGet(VIR_TPM_SWTPM_SETUP_FEATURE_TPM_1_2)
 -> virTPMBinaryGetCaps(VIR_TPM_BINARY_SWTPM_SETUP, cap
    -> virTPMGetCaps (fills a structure which is then checked)

This leads to the call I mentioned way above:

root@k:~# /usr/bin/swtpm_setup --print-capabilities
{ "type": "swtpm_setup", "features": [ "cmdarg-keyfile-fd", "cmdarg-pwdfile-fd", "tpm12-not-need-root", "tpm2-rsa-keysize-2048", "tpm2-rsa-keysize-3072" ] }

Here the same from my system which reports versions:

$ /usr/bin/swtpm_setup --print-capabilities
{ "type": "swtpm_setup", "features": [ "tpm-1.2", "tpm-2.0", "cmdarg-keyfile-fd", "cmdarg-pwdfile-fd", "tpm12-not-need-root", "cmdarg-write-ek-cert-files", "cmdarg-create-config-files", "cmdarg-reconfigure-pcr-banks", "tpm2-rsa-keysize-2048", "tpm2-rsa-keysize-3072" ], "version": "0.7.3" }

[1]: https://wiki.qemu.org/Documentation/QMP#qmp-shell_script
[2]: https://gitlab.com/libvirt/libvirt/-/blob/master/src/qemu/qemu_capabilities.c#L6544