Host TPM attestation alarm ESXi 7.0

[alexisdog]

I am trying to bring up a couple of ESXi 7.0 hosts with attestation and add them to a VCSA. Install is unremarkable, except the hosts keep failing attestation. I also keep getting the titled error in vCenter, after adding the hosts.

The summary on the TPM alert just says "Internal Error." The document that I found on "internal error" was this (https://vinfrastructure.it/2019/11/esxi-6-7-tpm-support-on-dell-emc-poweredge-server/ ) which points to "the TPM settings in the BIOS are not correct."

I checked the TPM in ESXi as best as I could figure, everything seems to come back clean (screen shot attached) except for these 2 lines, that seem funny, but do not generate any errors:

tpmDriver: Tpm2CheckInterface:615: TPM does not appear to be speaking the 2.0 protocol (interfaceType = 0xf).

tpmDriver: Tpm2CheckInterface:616: Continuing on best effort basis using the 2.0 protocol.

I never had this issue on 6.7 and have regenerated all keys in BIOS, I have added the VMWare key "vmware_sb2017.der" per KB 2148532 (https://kb.vmware.com/s/article/2148532)to my "Authorized Signatures" in the Secure Boot part of the BIOS (I also tried with standard settings), renewed certs on the hosts, and generated certs in VCSA (option 4),

I have also, disconnected and reconnected hosts multiple times and rebooted everything.

I really do not know what else to do, because according to the hosts, they seem to be passing and loading everything, but VCSA keeps telling me not.

Motherboard is Supermicro X11Dpi-NT. It is Supermicro's TPM 2.0 chip AOM-TPM-9670V-S (IFX).

I am attaching screen shots of the BIOS settings and CLI.

I am also seeing this warning, "Unable to provision Endorsement Key on TPM 2.0 device: No RSA Endorsement Key certificate found in TPM 2.0 device's non-volatile memory." and have no idea what this means or if it is related (I never saw this on 6.7).

Any ideas? Whatever I have tried so far, keeps coming back to the same result.

Any help would be appreciated.

[alexisdog]

I overwrote the hosts with ESXi 6.7 U3, and installed a VCSA 6.7 (last versions on both), and the same issue reproduced. Same errors and behavior, so my earlier comment on 6.7 is not valid. I have hosts passing attestation with 6.7, but they are an X10 chipset rather than X11 (Intel C622).

[alexisdog · Accepted solution]

The problem was resolved with an RMA to Supermicro for the TPM chips. The replacement TPM chips booted with no problem and passed attestation. I requested further information on the returned chips to understand exactly what the issue was. If I get more information, I will

post it here.

[Raudi]

I currently have a similar or the same problem...

From the vmkernel.log:
2021-10-29T19:41:04.933Z cpu16:2097621)Loading module tpmdriver ...
2021-10-29T19:41:04.933Z cpu16:2097621)Elf: 2060: module tpmdriver has license VMware
2021-10-29T19:41:04.935Z cpu16:2097621)Device: 211: Registered driver 'tpmdriver' from 3
2021-10-29T19:41:04.936Z cpu16:2097621)VMK_ACPI: 90: \_SB_.TPM_: numRes 0 phys_addr 0xfed40000 size 0x5000
2021-10-29T19:41:04.936Z cpu16:2097621)tpmDriver: Tpm2Init:1859: Activated locality 0
2021-10-29T19:41:04.936Z cpu16:2097621)tpmDriver: Tpm2CheckInterface:618: TPM does not appear to be speaking the 2.0 protocol (interfaceType = 0xf).
2021-10-29T19:41:04.936Z cpu16:2097621)tpmDriver: Tpm2CheckInterface:619: Continuing on best effort basis using the 2.0 protocol.
2021-10-29T19:41:04.956Z cpu31:2097553)Jumpstart plugin vmkeventd activated.
2021-10-29T19:41:05.012Z cpu16:2097621)tpmDriver: Tpm2Init:1881: Initialization of TPM 2 impl done.
2021-10-29T19:41:05.032Z cpu16:2097621)tpmDriver: Tpm2LogVendor:1828: Vendor ID: IFX
2021-10-29T19:41:05.075Z cpu16:2097621)tpmDriver: Tpm2ResMgr_Init:1532: TPM 2.0 Resource manager initialized.

And from the hostd.log:
2021-10-29T19:41:29.231Z info hostd[2099349] [Originator@6876 sub=Hostsvc.HostTpmManager] Creating HostTPMManager...
2021-10-29T19:41:29.239Z info hostd[2099349] [Originator@6876 sub=Hostsvc.TechPreviewConfigProvider] No Tech Preview features found in: /etc/vmware/vsphereFeatures/techPreview.cfg
2021-10-29T19:41:29.239Z info hostd[2099349] [Originator@6876 sub=Hostsvc.TpmEventLogProvider] TpmEventLogProvider created
2021-10-29T19:41:29.270Z error hostd[2099349] [Originator@6876 sub=Libs] Tpm2Cmd: DictionaryAttackLockReset: (0x921) TPM_RC_LOCKOUT
2021-10-29T19:41:29.270Z info hostd[2099349] [Originator@6876 sub=Libs] Tpm2Cmd: Unable to reset the dictionary attack counter
2021-10-29T19:41:29.306Z info hostd[2099349] [Originator@6876 sub=Libs] Tpm2Cmd: Preprovisioned endorsement key not found at 0x81010001
2021-10-29T19:41:29.342Z error hostd[2099349] [Originator@6876 sub=Libs] Tpm2Cmd: NV_ReadPublic: (0x18b) Unknown
2021-10-29T19:41:29.342Z info hostd[2099349] [Originator@6876 sub=Libs] Tpm2Cmd: Vendor provided RSA endorsement key template is not present in NV memory. Using default template per TGC spec
2021-10-29T19:41:29.382Z error hostd[2099349] [Originator@6876 sub=Libs] Tpm2Cmd: NV_ReadPublic: (0x18b) Unknown
2021-10-29T19:41:29.399Z error hostd[2099349] [Originator@6876 sub=Libs] Tpm2Cmd: CreatePrimary: (0x9a2) Unknown
2021-10-29T19:41:29.399Z error hostd[2099349] [Originator@6876 sub=Hostsvc.Tpm20Provider] Unable to provision default rsa endorsement key.

Look tom me like this KB: TPM 2.0 device containing endorsement key certificate with public key (rsaesOaep) are not supported ...

But the resolution is no option...

So i contacted Supermicro too and got the Info that my firmware of the TPM (7.62) may be to old and the current one is 7.85. But they can't provide a firmware update, i must start a RMA for that...

[Raudi]

Today i got the new TPM's with the newer firmware.

They are working without problems!

Now from the hostd.log:
info hostd[2099457] [Originator@6876 sub=Hostsvc.HostTpmManager] Creating HostTPMManager...
info hostd[2099457] [Originator@6876 sub=Hostsvc.TechPreviewConfigProvider] No Tech Preview features found in: /etc/vmware/vsphereFeatures/techPreview.cfg
info hostd[2099457] [Originator@6876 sub=Hostsvc.TpmEventLogProvider] TpmEventLogProvider created
info hostd[2099457] [Originator@6876 sub=Libs] Tpm2Cmd: Preprovisioned endorsement key not found at 0x81010001
error hostd[2099457] [Originator@6876 sub=Libs] Tpm2Cmd: NV_ReadPublic: (0x18b) Unknown
info hostd[2099457] [Originator@6876 sub=Libs] Tpm2Cmd: Vendor provided RSA endorsement key template is not present in NV memory. Using default template per TGC spec
error hostd[2099457] [Originator@6876 sub=Libs] Tpm2Cmd: NV_ReadPublic: (0x18b) Unknown
info hostd[2099457] [Originator@6876 sub=Libs] Tpm2Cmd: Successfully provisioned endorsement key at: 0x81010001
info hostd[2099457] [Originator@6876 sub=Hostsvc] Plugin initialized