给 PVE 添加 TPM

本文最后更新于:2021年7月26日 晚上

依赖

编译

以 root 用户登陆 PVE 的 shell

libtpms 和 swtpm 部分参考自 azhuge233’s

libtpms

1
2
3
4
5
6
7
8
apt -y install automake autoconf libtool gcc build-essential libssl-dev dh-exec pkg-config dh-autoreconf gawk
git clone https://github.com/stefanberger/libtpms.git
pushd libtpms
./autogen.sh --with-openssl
make dist
dpkg-buildpackage -us -uc -j$(nproc)
popd
dpkg -i libtpms0_*_amd64.deb libtpms-dev_*_amd64.deb

swtpm

1
2
3
4
5
6
apt -y install  libfuse-dev libglib2.0-dev libgmp-dev expect libtasn1-dev socat tpm-tools python3-twisted gnutls-dev gnutls-bin  libjson-glib-dev python3-setuptools softhsm2 libseccomp-dev
git clone https://github.com/stefanberger/swtpm.git
pushd swtpm
dpkg-buildpackage -us -uc -j$(nproc)
popd
dpkg -i ./swtpm*.deb

systemd 服务

1
2
3
4
5
6
7
8
9
10
11
12
cat > /etc/systemd/system/swtpm@.service <<-EOF
[Unit]
Description=swtpm server for %i
[Service]
Type=simple
ExecStartPre=mkdir -p /var/lib/qemu-swtpm/swtpm-%i
ExecStartPre=-swtpm_setup --tpmstate /var/lib/qemu-swtpm/swtpm-%i --tpm2 --create-ek-cert --create-platform-cert
ExecStart=swtpm socket --tpm2 --tpmstate dir=/var/lib/qemu-swtpm/swtpm-%i --ctrl type=unixio,path=/var/run/swtpm-%i.sock --log level=20
Restart=always
[Install]
WantedBy=multi-user.target
EOF

注意:建议 socket 文件不要放在 /var/run/qemu-server/ 底下,而是直接放在 /var/run/

例子:systemctl enable --now swtpm@101.service 对应的就是 /var/run/swtpm-101.sock, 之所以会这么设计服务是因为只能一个虚拟机对应一个 swtpm 服务(建议与客户机ID对应

pve-edk2-firmware

成品包:pve-edk2-firmware/releases

自编译:

1
2
3
4
5
6
apt install -y bc debhelper gcc-aarch64-linux-gnu iasl nasm python3 python3-distutils uuid-dev
git clone https://github.com/love4taylor/pve-edk2-firmware.git
pushd pve-edk2-firmware
make
dpkg -i ./pve-edk2-firmware_*.deb
popd

客户机配置

vim /etc/pve/qemu-server/客户机ID.conf

在文件顶部加上

1
2
3
args: -chardev socket,id=chrtpm,path=/var/run/swtpm-%i.sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0

%i 为之前启动服务时@和.service之间的字符

效果

UEFI设置内的TPM菜单

Windows11安全处理器详细信息


本博客所有文章除特别声明外,均采用 CC BY-SA 4.0 协议 ,转载请注明出处!