How to use Windows 10 OEM license in libvirt VM (<smbios mode='host' /> does not work as Windows seems to verify UUID; apparmor/security configuration changes may be needed)

domain.xml

<domain type='kvm' xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'>
  <!-- ... -->
  <qemu:commandline>
    <qemu:arg value='-acpitable'/>
    <qemu:arg value='file=/some/path/slic.bin'/>
    <qemu:arg value='-acpitable'/>
    <qemu:arg value='file=/some/path/msdm.bin'/>
    <qemu:arg value='-smbios'/>
    <qemu:arg value='file=/some/path/smbios_type_0.bin'/>
    <qemu:arg value='-smbios'/>
    <qemu:arg value='file=/some/path/smbios_type_1.bin'/>
  </qemu:commandline>
</domain>

slic-dump

#!/bin/bash

set -e

cat /sys/firmware/acpi/tables/SLIC > slic.bin
cat /sys/firmware/acpi/tables/MSDM > msdm.bin
dmidecode -t 0 -u | grep $'^\t\t[^"]' | xargs -n1 | perl -lne 'printf "%c", hex($_)' > smbios_type_0.bin
dmidecode -t 1 -u | grep $'^\t\t[^"]' | xargs -n1 | perl -lne 'printf "%c", hex($_)' > smbios_type_1.bin

Thanks! It works, but for qemu I (ubuntu20.10) had to place the .bin-s into /usr/share/seabios/. (thx to http://egirland.blogspot.com/2018/12/get-rid-of-that-fng-permission-denied_7.html)

Yeah, that was likely caused by apparmor/selinux profile disallowing access to any directories outside of predefined ones...

I'm getting some errors when try to dump the smbios_type_1.bin table. My laptop is a Dell G5 5590.

dmidecode -t 1 -u | grep $'^\t\t[^"]' | xargs -n1 | perl -lne 'printf "%c", hex($_)' > smbios_type_1.bin
Wide character in printf at -e line 1, <> line 58.
Wide character in printf at -e line 1, <> line 64.

Is it really needed? Is any workaround?

The workaround would be to disalbe UTF-8 encoding for the printout: perl -lne 'use bytes; printf ...'.

However, I still get a qemu error that the smbios binary file format was invalid.

I worked around this by reading the smbios table entries from dmidecode -t 0 and dmidecode -t 1 and manually adding a <sysinfo type="smbios"> block with all the entries for <bios> and <system>. I also set the uuid of the whole VM to the one registered in the BIOS.

Afterwards automatic activation of Windows 10 worked like a charm without any other user intervention.

Thanks @bnavigator

In fact, adding the manual smbios worked. I added as qemu commands.

    <qemu:arg value="-smbios"/>
    <qemu:arg value="type=0,vendor='Dell Inc.',version='1.14.0',date='10/20/2020',release=1.14.0"/>
    <qemu:arg value="-smbios"/>
    <qemu:arg value="type=1,manufacturer='Dell Inc.',product='G5 5590',serial=xxxxxxxx,uuid=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx,sku=xxxxx,family=GSeries"/>

To avoid selinux issues on Fedora, place your .bin files into /usr/share/seabios/ and then run restorecon -R -v /usr/share/seabios/ .

Additionally, if you are entering these settings using Gnome Boxes, you might have to do so repeatedly due to a bug:
https://gitlab.gnome.org/GNOME/gnome-boxes/-/issues/737

The suggestion by @nimatrueway to query strings in /sys/firmware/acpi/tables/MSDM is an elegant and clean way to achieve this; works like a charm.

@sgnls sure - this all (seemingly) depends on a type of license granted to a specifc device. License from my Thinkad X260 did not activate when using just the key from MSDM, and I needed to expliclty forward the whole table + smbios system info like in the original snippet.

Indeed; I wasn't implying the solution would fit for all, but rather it was an efficient way to achieve the need (to that end, it worked for my use-case; Windows 10 Pro via QEMU/KVM on a Dell Latitude E7470).

Previously, I have also needed the 'long' effort; pretty sure TPM is going to contribute more to the behaviour than is typically appreciated.

Thanks to everyone for posting this info!
A question: I'm getting "can't open msdm.bin - permission denied" from virt-manager when I try to create a Windows 10 VM. What should the owner and permissions of msdm.bin and smbios_*.bin be for running virt-manager/qemu as an ordinary user?

Thanks to everyone for posting this info! A question: I'm getting "can't open msdm.bin - permission denied" from virt-manager when I try to create a Windows 10 VM. What should the owner and permissions of msdm.bin and smbios_*.bin be for running virt-manager/qemu as an ordinary user?

Obviously your user should have read access, however it's more likely that what's restricting your access is SELinux. See my answer for solution.

Does this also work for Windows 11?

I got this working on Windows 11 but simply using smbios XML labels in my VM config.

https://libvirt.org/formatdomain.html#smbios-system-information

Hello,

I want to share one thing that i found today :) Have activated some time ago one virtual mashine, but lost UUID for them. Today spend some time to activate my virtual pc after a long time and have checked system logs, why i cant to do that. And - bingo! Win activation service returns my previously UUID as SKU in error logs :D. Have changed VM UUID to them and all done!

Hello,

I want to share one thing that i found today :) Have activated some time ago one virtual mashine, but lost UUID for them. Today spend some time to activate my virtual pc after a long time and have checked system logs, why i cant to do that. And - bingo! Win activation service returns my previously UUID as SKU in error logs :D. Have changed VM UUID to them and all done!

I have the same error but when I replace the sku with my uuid it is still not working and complaining "We can't activate Windows on this device because the product key was already used on another device. If you think it wasn't used on another device, select Troubleshoot below: Error code: 0xC004C008" I am just using smbios in xml

@shaquibimdad you can simply wait for the old licence activation to expire on the old UUID and then activate with the new one.

Otherwise you'll need to preserve the UUID.

@juresaht2 like how much i have to wait for old licence to get detached from the uuid or is there any way to detach it manually?

@shaquibimdad you should probably look up the grace periods and stuff with microsoft, but I think it's about 180 days that an activation stays active until it has to be re-activated, so it would make sense that that is the amount of time the activation is bound to an UUID. If you don't want to wait 180 days, you can deactivate the licence on the old UUID. If this is not possible, see my answer above.

Hello,
I want to share one thing that i found today :) Have activated some time ago one virtual mashine, but lost UUID for them. Today spend some time to activate my virtual pc after a long time and have checked system logs, why i cant to do that. And - bingo! Win activation service returns my previously UUID as SKU in error logs :D. Have changed VM UUID to them and all done!

I have the same error but when I replace the sku with my uuid it is still not working and complaining "We can't activate Windows on this device because the product key was already used on another device. If you think it wasn't used on another device, select Troubleshoot below: Error code: 0xC004C008" I am just using smbios in xml

In my case worked, but - yes, in this case, i should delete all lines related to smbios and acpitable. otherwise does not work.

@shaquibimdad you should probably look up the grace periods and stuff with microsoft, but I think it's about 180 days that an activation stays active until it has to be re-activated, so it would make sense that that is the amount of time the activation is bound to an UUID. If you don't want to wait 180 days, you can deactivate the licence on the old UUID. If this is not possible, see my answer above.

well what i did was done a troubleshoot and then there was an option to login to your microsoft account and check where it was actually activated just selected that listed computer and it did activated my current vm with Original board uuid and smbios as sysinfo passed to the vm 😃

There is no SLIC file in /sys/firmware/acpi/tables/ directory, while I can confirm that my computer has an MS Windows license from OEM.

@sun-jiao it depends on the hardware how it is implemented. It is also probably different for different OS versions (depending what OS the OEM licence is for). Technically all that is required for OEM licence to work is a machine unique ID (which is then used to activate over the internet), but some computers also have a digital signature that can be verified by the Microsoft cert.

@sun-jiao it depends on the hardware how it is implemented. It is also probably different for different OS versions (depending what OS the OEM licence is for). Technically all that is required for OEM licence to work is a machine unique ID (which is then used to activate over the internet), but some computers also have a digital signature that can be verified by the Microsoft cert.

Thanks. I am wondering if it's possible to write a SLIC file manually based on the infos displayed in UEFI.

Thanks. I am wondering if it's possible to write a SLIC file manually based on the infos displayed in UEFI.

Why? If your licence is activated and the file does not exist then it is not used.

Thanks. I am wondering if it's possible to write a SLIC file manually based on the infos displayed in UEFI.

Why? If your licence is activated and the file does not exist then it is not used.

OK, I have understood now.

Note that this is a much better (and doesn't accidentally corrupt) way to generate the smbios extracts:

dmidecode -t 0 -u | awk '/^\t\t[0-9A-F][0-9A-F]( |$)/' | xxd -r -p > smbios_type_0.bin
dmidecode -t 1 -u | awk '/^\t\t[0-9A-F][0-9A-F]( |$)/' | xxd -r -p > smbios_type_1.bin

I expanded this to work with Proxmox - https://gist.github.com/xrobau/d98fe46c4677e46577ba2f20f35b783b

slic doesn't exist for me, do I just remove it or is there an alternative?

slic doesn't exist for me, do I just remove it or is there an alternative?

This is expected for newer windows versions. Just skip it and use what you have.