Comment 29 for bug 1903864

Revision history for this message
Ian Johnson (anonymouse67) wrote :

Hi folks, I think the new version of the qemu package in Groovy at least has regressed an important aspect for us in testing Ubuntu Core 20 VM's with swtpm. We use the swtpm-mvo snap in conjunction with qemu and OVMF to run Ubuntu Core 20 VM's, and after upgrading to qemu 1:5.0-5ubuntu9.6, I can no longer run UC20 VM's using the swtpm-mvo snap we use on the snapd team.

I see this:

```
$ kvm \
     -smp 8 \
     -m 8192 \
     -machine q35 \
     -cpu host \
     -global ICH9-LPC.disable_s3=1 \
     -netdev user,id=mynet0,hostfwd=tcp::8022-:22 \
     -device virtio-net-pci,netdev=mynet0 \
      -drive file=/usr/share/OVMF/OVMF_CODE.secboot.fd,if=pflash,format=raw,unit=0,readonly=on \
      -drive file="$SCRIPT_DIR/OVMF_VARS.ms.fd",if=pflash,format=raw,unit=1 \
     -chardev socket,id=chrtpm,path="/var/snap/swtpm-mvo/current/swtpm-sock" -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 \
     -drive file=uc20.img,if=none,format=raw,id=disk1 -device virtio-blk-pci,drive=disk1,bootindex=1 \
     -serial mon:stdio
qemu-system-x86_64: -tpmdev emulator,id=tpm0,chardev=chrtpm: tpm-emulator: Failed to send CMD_SET_DATAFD: Success
qemu-system-x86_64: -device tpm-tis,tpmdev=tpm0: Property 'tpm-tis.tpmdev' can't find value 'tpm0'
$
```

whereas before this worked and we could use the TPM. You can reproduce this by installing the swtpm-mvo snap:

```
$ snap install swtpm-mvo --edge
```

and then using the ubuntu core 20 released image from cdimage: http://cdimage.ubuntu.com/ubuntu-core/20/stable/current/

Note that you have to make a copy of the OVMF_VARS.ms.fd from /usr/share/OVMF/OVMF_VARS.ms.fd (which is from the ovmf package), and then when you are able to boot a VM with the command line enable secure boot via the OVMF EFI setup. At that point with the above command line you should be able to boot UC20 with full disk encryption enabled using the swtpm.