From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 4360F76511 for ; Thu, 15 Jul 2021 16:23:33 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 3D152246CC for ; Thu, 15 Jul 2021 16:23:33 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 4CA81246B4 for ; Thu, 15 Jul 2021 16:23:31 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 27260418D0 for ; Thu, 15 Jul 2021 16:23:31 +0200 (CEST) From: Stefan Reiter To: pve-devel@lists.proxmox.com Date: Thu, 15 Jul 2021 16:23:17 +0200 Message-Id: <20210715142319.1457131-1-s.reiter@proxmox.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.597 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [qemuserver.pm, imgur.com] Subject: [pve-devel] [RFC 0/2] Initial TPM support for VMs X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Jul 2021 14:23:33 -0000 Makes Windows 11 (test build) happy: https://i.imgur.com/kZ0Mpnr.jpeg Tested under Linux as well, works with (updated) OVMF and SeaBIOS, though SeaBIOS requires clearing via the BIOS setup screen and may not support all features it seems (e.g. Windows shows the TPM, but doesn't allow BitLocker, presumably because it requires UEFI). Requires swtpm and libtpms: https://github.com/stefanberger/swtpm (stable-0.6) https://github.com/stefanberger/libtpms (stable-0.8) Both repos allow debian builds, that's what I used for testing. Decided to send a WIP version before leaving on vacation, so you can take your time with feedback :) Design decision: 'swtpm' requires a *directory* per VM to store data, the files themselves are rather small (8.5kB for an initialized TPM 2.0 w/ BitLocker enabled). To allow for easier HA I went with a path in '/etc/pve/priv' for now, but that comes with it's own drawbacks. For example, a guest may write TPM state as often as they like, and Windows seems to do so every few seconds at random. (note: swtpm writes a temporary file and then uses atomic replace) Other ideas for this: * store in regular path, e.g. '/var/lib' - how to do HA? (note that live-migration works regardless, since the state is transferred via QEMU) * treat like efidisk and allow any storage - would be my favourite, but as said, swtpm requires a directory, not a single file... Missing feature/known issues: * backups and offline-snapshots don't include TPM data * migration may hickup, since destination and target are effectively "the same" * needs improved clearing logic, or potentially none at all (would be a benefit for the "efidisk-like" variant) edk2-firmware: Stefan Reiter (1): enable TPM and TPM2 support debian/rules | 4 ++++ 1 file changed, 4 insertions(+) qemu-server: Stefan Reiter (1): fix #3075: add TPM v1.2 and v2.0 support via swtpm PVE/QemuServer.pm | 134 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 133 insertions(+), 1 deletion(-) -- 2.30.2