[pve-devel] [RFC 0/2] Initial TPM support for VMs

[Stefan Reiter]

Makes Windows 11 (test build) happy: https://i.imgur.com/kZ0Mpnr.jpeg

Tested under Linux as well, works with (updated) OVMF and SeaBIOS, though
SeaBIOS requires clearing via the BIOS setup screen and may not support all
features it seems (e.g. Windows shows the TPM, but doesn't allow BitLocker,
presumably because it requires UEFI).

Requires swtpm and libtpms:
https://github.com/stefanberger/swtpm (stable-0.6)
https://github.com/stefanberger/libtpms (stable-0.8)
Both repos allow debian builds, that's what I used for testing.

Decided to send a WIP version before leaving on vacation, so you can take your
time with feedback :)

Design decision: 'swtpm' requires a *directory* per VM to store data, the files
themselves are rather small (8.5kB for an initialized TPM 2.0 w/ BitLocker
enabled). To allow for easier HA I went with a path in '/etc/pve/priv' for now,
but that comes with it's own drawbacks. For example, a guest may write TPM state
as often as they like, and Windows seems to do so every few seconds at random.
(note: swtpm writes a temporary file and then uses atomic replace)

Other ideas for this:
* store in regular path, e.g. '/var/lib' - how to do HA? (note that
  live-migration works regardless, since the state is transferred via QEMU)
* treat like efidisk and allow any storage - would be my favourite, but as said,
  swtpm requires a directory, not a single file...

Missing feature/known issues:
* backups and offline-snapshots don't include TPM data
* migration may hickup, since destination and target are effectively "the same"
* needs improved clearing logic, or potentially none at all (would be a benefit
  for the "efidisk-like" variant)


edk2-firmware: Stefan Reiter (1):
  enable TPM and TPM2 support

 debian/rules | 4 ++++
 1 file changed, 4 insertions(+)

qemu-server: Stefan Reiter (1):
  fix #3075: add TPM v1.2 and v2.0 support via swtpm

 PVE/QemuServer.pm | 134 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 133 insertions(+), 1 deletion(-)

-- 
2.30.2