Bug 2039246

The behavior of libvirt is so that it activates the PCR banks given in the XML every time the VM is cold-started. It leaves the PCR bank configuration alone if no XML is given. This way the user can change the active PCR banks using the firmware menu (UEFI or SeaBIOS or SLOF) and libvirt will leave it at that.

> Expected results:
> Maybe libvirt can detect difference between last configuration(<sha384/>) and current default setting(no <active_pcr_banks>), then call swtpm_setup to reconfigure pcrbank for once.

No, leave the user the possibility to reconfigure the PCR banks with the firmware and don't touch it from the libvirt level anymore. 

My suggestion: Do not fix.

@stefanb.com should libvirt then at least report what PCR banks are configured (assuming we are able to get that info from the host)? Alternatively, we might just document this behavior.

The current documentation states:

active_pcr_banks

    The active_pcr_banks node is used to define which of the PCR banks of a TPM 2.0 to activate. Valid names are for example sha1, sha256, sha384, and sha512. If this node is provided, the set of PCR banks are activated before every start of a VM and this step is logged in the swtpm's log. This attribute requires that swtpm_setup v0.7 or later is installed and may not have any effect otherwise. The selection of PCR banks only works with the emulator backend. since:Since 7.10.0


We can maybe add the following documentation clarifying what is happening if the XML node is not provided.


[...] If this node is provided, the set of PCR banks are activated before every start of a VM and this step is logged in the swtpm's log. >If this node is missing, the configuration of the PCR banks will not be modified.< This attribute requires ...

(In reply to Michal Privoznik from comment #2)
> @stefanb.com should libvirt then at least report what PCR banks are
> configured (assuming we are able to get that info from the host)?

It's not easy for libvirt to get to the current configuration information nor does swtpm or swtpm_setup support o retrieve the info other than users sending proper TPM commands to it. 
The user can figure these things out on the UEFI/SeaBIOS/SLOF TPM menu level because it's all displayed there. Under Linux one can figure it out using TSS tools or sysfs. I am not familiar with Windows.

Fixed upstream by

commit 7c1757279861759533e77425b4726f0a94448c37
Refs: v8.0.0-rc2-7-g7c17572798
Author:     Stefan Berger <stefanb.com>
AuthorDate: Wed Jan 12 10:49:52 2022 -0500
Commit:     Jiri Denemark <jdenemar>
CommitDate: Thu Jan 13 10:44:15 2022 +0100

    docs: tpm: Clarify omission or removal of active_pcr_banks node

    Add a sentence to the active_pcr_banks node documentation that clarifies
    that when the active_pcr_banks node is removed from the XML or when it
    is omitted that the set of active PCR banks is not changed anymore.

    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2039246
    Signed-off-by: Stefan Berger <stefanb.com>
    Reviewed-by: Jiri Denemark <jdenemar>

Pre-verify on:
v8.0.0-rc2-11-g55a248d354

# grep "If this node is removed"  /usr/share/doc/libvirt-docs/html/formatdomain.html -4
<dd><p>The <span class="docutils literal">active_pcr_banks</span> node is used to define which of the PCR banks
of a TPM 2.0 to activate. Valid names are for example sha1, sha256, sha384,
and sha512. If this node is provided, the set of PCR banks are activated
before every start of a VM and this step is logged in the swtpm's log.
If this node is removed or omitted then libvirt will not modify the
active PCR banks upon VM start but leave them at their last configuration.
This attribute requires that swtpm_setup v0.7 or later is installed
and may not have any effect otherwise. The selection of PCR banks only works
with the <span class="docutils literal">emulator</span> backend. since:<cite>Since 7.10.0</cite></p>

Verified with:
libvirt-docs-8.0.0-1.el9.x86_64

1.# grep "If this node is removed"  /usr/share/doc/libvirt-docs/html/formatdomain.html -4
<dd><p>The <span class="docutils literal">active_pcr_banks</span> node is used to define which of the PCR banks
of a TPM 2.0 to activate. Valid names are for example sha1, sha256, sha384,
and sha512. If this node is provided, the set of PCR banks are activated
before every start of a VM and this step is logged in the swtpm's log.
If this node is removed or omitted then libvirt will not modify the
active PCR banks upon VM start but leave them at their last configuration.
This attribute requires that swtpm_setup v0.7 or later is installed
and may not have any effect otherwise. The selection of PCR banks only works
with the <span class="docutils literal">emulator</span> backend. since:<cite>Since 7.10.0</cite></p>

2. Check last https://libvirt.org/formatdomain.html#tpm-device
active_pcr_banks
The active_pcr_banks node is used to define which of the PCR banks of a TPM 2.0 to activate. Valid names are for example sha1, sha256, sha384, and sha512. If this node is provided, the set of PCR banks are activated before every start of a VM and this step is logged in the swtpm's log. If this node is removed or omitted then libvirt will not modify the active PCR banks upon VM start but leave them at their last configuration. This attribute requires that swtpm_setup v0.7 or later is installed and may not have any effect otherwise. The selection of PCR banks only works with the emulator backend. since:Since 7.10.0

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: libvirt), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2390