Implement support of the TPM devices for bhyve. Currently, only the "external" backend type is supported. Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com> --- src/bhyve/bhyve_capabilities.c | 10 +++ src/bhyve/bhyve_command.c | 27 ++++++++ src/bhyve/bhyve_domain.c | 3 + .../x86_64/bhyvexml2argv-tpm.args | 12 ++++ .../x86_64/bhyvexml2argv-tpm.ldargs | 4 ++ .../x86_64/bhyvexml2argv-tpm.xml | 28 ++++++++ tests/bhyvexml2argvtest.c | 6 +- tests/domaincapsdata/bhyve_tpm.x86_64.xml | 69 +++++++++++++++++++ tests/domaincapstest.c | 3 + 9 files changed, 161 insertions(+), 1 deletion(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml create mode 100644 tests/domaincapsdata/bhyve_tpm.x86_64.xml diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index 1fbee71205..d3565bea29 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -121,6 +121,16 @@ virBhyveDomainCapsFill(virDomainCaps *caps, VIR_DOMAIN_CAPS_ENUM_SET(caps->rng.backendModel, VIR_DOMAIN_RNG_BACKEND_RANDOM); } + if (bhyvecaps & BHYVE_CAP_LPC_TPM) { + caps->tpm.supported = VIR_TRISTATE_BOOL_YES; + caps->tpm.model.report = true; + caps->tpm.backendModel.report = true; + + VIR_DOMAIN_CAPS_ENUM_SET(caps->tpm.model, + VIR_DOMAIN_TPM_MODEL_CRB); + VIR_DOMAIN_CAPS_ENUM_SET(caps->tpm.backendModel, + VIR_DOMAIN_TPM_TYPE_EXTERNAL); + } caps->hostdev.supported = VIR_TRISTATE_BOOL_YES; caps->features[VIR_DOMAIN_CAPS_FEATURE_IOTHREADS] = VIR_TRISTATE_BOOL_NO; diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index f48d86d6f6..026ec40da8 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -263,7 +263,30 @@ bhyveBuildHostdevArgStr(const virDomainDef *def, subsys->u.pci.addr.slot, subsys->u.pci.addr.function); } + return 0; +} + +static int +bhyveBuildTPMArgStr(const virDomainDef *def G_GNUC_UNUSED, + virDomainTPMDef *tpm, + struct _bhyveConn *driver, + virCommand *cmd) +{ + if (!(bhyveDriverGetBhyveCaps(driver) & BHYVE_CAP_LPC_TPM)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Installed bhyve binary does not support TPM devices")); + return -1; + } + + if (tpm->type != VIR_DOMAIN_TPM_TYPE_EXTERNAL) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("TPM backend is not supported")); + return -1; + } + virCommandAddArg(cmd, "-l"); + virCommandAddArgFormat(cmd, "tpm,swtpm,%s", + tpm->data.external.source->data.nix.path); return 0; } @@ -1313,6 +1336,10 @@ virBhyveProcessBuildBhyveCmd(struct _bhyveConn *driver, virDomainDef *def, if (bhyveBuildRNGArgStr(def, def->rngs[i], cmd) < 0) return NULL; + for (i = 0; i < def->ntpms; i++) + if (bhyveBuildTPMArgStr(def, def->tpms[i], driver, cmd) < 0) + return NULL; + if (def->namespaceData) { bhyveDomainCmdlineDef *bhyvecmd; diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 1a19b3f888..93be75d52d 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -115,6 +115,9 @@ bhyveDomainDefNeedsISAController(virDomainDef *def) if (def->ngraphics && def->nvideos) return true; + if (def->ntpms) + return true; + return false; } diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args new file mode 100644 index 0000000000..9b3b639a94 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args @@ -0,0 +1,12 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 1:0,lpc \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +-l tpm,swtpm,/var/run/swtpm/tpm \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml new file mode 100644 index 0000000000..e927d2b378 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml @@ -0,0 +1,28 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <tpm> + <backend type='external'> + <source type='unix' mode='connect' path='/var/run/swtpm/tpm'/> + </backend> + </tpm> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index d00ceab825..58e6d11cec 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -202,7 +202,8 @@ mymain(void) BHYVE_CAP_FBUF | BHYVE_CAP_XHCI | \ BHYVE_CAP_CPUTOPOLOGY | BHYVE_CAP_SOUND_HDA | \ BHYVE_CAP_VNC_PASSWORD | BHYVE_CAP_VIRTIO_9P | \ - BHYVE_CAP_NVME | BHYVE_CAP_NUMA; + BHYVE_CAP_NVME | BHYVE_CAP_NUMA | \ + BHYVE_CAP_LPC_TPM; DO_TEST("base"); DO_TEST("bootorder"); @@ -309,6 +310,9 @@ mymain(void) DO_TEST("memtune"); DO_TEST_FAILURE("memtune-unsupported-params"); DO_TEST("sysinfo-smbios"); + DO_TEST("tpm"); + driver.bhyvecaps &= ~BHYVE_CAP_LPC_TPM; + DO_TEST_FAILURE("tpm"); /* Address allocation tests */ DO_TEST("addr-single-sata-disk"); diff --git a/tests/domaincapsdata/bhyve_tpm.x86_64.xml b/tests/domaincapsdata/bhyve_tpm.x86_64.xml new file mode 100644 index 0000000000..72ed457650 --- /dev/null +++ b/tests/domaincapsdata/bhyve_tpm.x86_64.xml @@ -0,0 +1,69 @@ +<domainCapabilities> + <path>/usr/sbin/bhyve</path> + <domain>bhyve</domain> + <arch>x86_64</arch> + <iothreads supported='no'/> + <os supported='yes'> + <loader supported='yes'> + <value>/foo/bar</value> + <value>/foo/baz</value> + <enum name='type'> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='no'/> + <mode name='maximum' supported='no'/> + <mode name='host-model' supported='no'/> + <mode name='custom' supported='no'/> + </cpu> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + </enum> + <enum name='bus'> + <value>virtio</value> + <value>sata</value> + </enum> + <enum name='model'/> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>vnc</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>gop</value> + </enum> + </video> + <hostdev supported='yes'/> + <tpm supported='yes'> + <enum name='model'> + <value>tpm-crb</value> + </enum> + <enum name='backendModel'> + <value>external</value> + </enum> + </tpm> + <console supported='yes'> + <enum name='type'> + <value>tcp</value> + <value>nmdm</value> + </enum> + </console> + </devices> + <features> + <gic supported='no'/> + <vmcoreinfo supported='no'/> + <genid supported='no'/> + <sev supported='no'/> + <sgx supported='no'/> + </features> +</domainCapabilities> diff --git a/tests/domaincapstest.c b/tests/domaincapstest.c index ec2ac8cb36..b3e9ff7051 100644 --- a/tests/domaincapstest.c +++ b/tests/domaincapstest.c @@ -530,6 +530,9 @@ mymain(void) bhyve_caps |= BHYVE_CAP_FBUF; DO_TEST_BHYVE("fbuf", "/usr/sbin/bhyve", &bhyve_caps, VIR_DOMAIN_VIRT_BHYVE); + + bhyve_caps |= BHYVE_CAP_LPC_TPM; + DO_TEST_BHYVE("tpm", "/usr/sbin/bhyve", &bhyve_caps, VIR_DOMAIN_VIRT_BHYVE); #endif /* WITH_BHYVE */ return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; -- 2.55.0