[PATCH 0/4] bhyve: implement TPM support
Roman Bogorodskiy (4): bhyve: capabilities: use consistent function names bhyve: capabilities: probe TPM support bhyve: implement TPM support bhyve: domain: validate TPM devices src/bhyve/bhyve_capabilities.c | 29 +++++++- src/bhyve/bhyve_capabilities.h | 1 + src/bhyve/bhyve_command.c | 27 ++++++++ src/bhyve/bhyve_domain.c | 38 +++++++++- .../x86_64/bhyvexml2argv-tpm-comma-path.xml | 16 +++++ .../x86_64/bhyvexml2argv-tpm-crb.args | 12 ++++ .../x86_64/bhyvexml2argv-tpm-crb.ldargs | 4 ++ .../x86_64/bhyvexml2argv-tpm-crb.xml | 28 ++++++++ .../bhyvexml2argv-tpm-invalid-model.xml | 16 +++++ .../bhyvexml2argv-tpm-multiple-devices.xml | 21 ++++++ .../x86_64/bhyvexml2argv-tpm.args | 12 ++++ .../x86_64/bhyvexml2argv-tpm.ldargs | 4 ++ .../x86_64/bhyvexml2argv-tpm.xml | 28 ++++++++ tests/bhyvexml2argvtest.c | 10 ++- .../x86_64/bhyvexml2xmlout-tpm.xml | 41 +++++++++++ tests/bhyvexml2xmltest.c | 4 ++ tests/domaincapsdata/bhyve_tpm.x86_64.xml | 69 +++++++++++++++++++ tests/domaincapstest.c | 3 + 18 files changed, 359 insertions(+), 4 deletions(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-comma-path.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-invalid-model.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-multiple-devices.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-tpm.xml create mode 100644 tests/domaincapsdata/bhyve_tpm.x86_64.xml -- 2.55.0
Use more consistent camel case function names. No functional changes. Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com> --- src/bhyve/bhyve_capabilities.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index 85988a2ce8..b321633b23 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -315,7 +315,7 @@ bhyveProbeCapsFromSHelp(unsigned int *caps, char *binary) } static int -bhyveProbeCapsLPC_Bootrom(unsigned int *caps, char *binary) +bhyveProbeCapsLpcBootrom(unsigned int *caps, char *binary) { return bhyveProbeCapsDeviceHelper(caps, binary, "-l", @@ -373,7 +373,7 @@ virBhyveProbeCaps(unsigned int *caps) if ((ret = bhyveProbeCapsFromSHelp(caps, binary))) goto out; - if ((ret = bhyveProbeCapsLPC_Bootrom(caps, binary))) + if ((ret = bhyveProbeCapsLpcBootrom(caps, binary))) goto out; if ((ret = bhyveProbeCapsVNCPassword(caps, binary))) -- 2.55.0
Probe the bhyve binary to determine whether it supports TPM devices. Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com> --- src/bhyve/bhyve_capabilities.c | 15 +++++++++++++++ src/bhyve/bhyve_capabilities.h | 1 + 2 files changed, 16 insertions(+) diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index b321633b23..1fbee71205 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -357,6 +357,18 @@ bhyveProbeCapsRctl(unsigned int *caps) return; } + +static int +bhyveProbeCapsLpcTpm(unsigned int *caps, char *binary) +{ + return bhyveProbeCapsDeviceHelper(caps, binary, + "-l", + "tpm", + "bhyve: invalid lpc device configuration 'tpm'", + BHYVE_CAP_LPC_TPM); +} + + int virBhyveProbeCaps(unsigned int *caps) { @@ -381,6 +393,9 @@ virBhyveProbeCaps(unsigned int *caps) bhyveProbeCapsRctl(caps); + if ((ret = bhyveProbeCapsLpcTpm(caps, binary))) + goto out; + out: VIR_FREE(binary); return ret; diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index 0302b68e22..9b3163b9ef 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -58,6 +58,7 @@ typedef enum { BHYVE_CAP_ACPI = 1 << 12, BHYVE_CAP_NUMA = 1 << 13, BHYVE_CAP_RCTL = 1 << 14, + BHYVE_CAP_LPC_TPM = 1 << 15, } virBhyveCapsFlags; int virBhyveProbeGrubCaps(virBhyveGrubCapsFlags *caps); -- 2.55.0
On 10/8/26 19:20, Roman Bogorodskiy wrote:
Probe the bhyve binary to determine whether it supports TPM devices.
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com> --- src/bhyve/bhyve_capabilities.c | 15 +++++++++++++++ src/bhyve/bhyve_capabilities.h | 1 + 2 files changed, 16 insertions(+)
diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index 0302b68e22..9b3163b9ef 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -58,6 +58,7 @@ typedef enum { BHYVE_CAP_ACPI = 1 << 12, BHYVE_CAP_NUMA = 1 << 13, BHYVE_CAP_RCTL = 1 << 14, + BHYVE_CAP_LPC_TPM = 1 << 15,
You'll need to rebase this and change this to 1 << 17. Or even better, turn this into a sequential enum (1, 2, 3, ... 17) and then use virBitmap to store capabilities ;-) Just like I suggested in one of my earlier reviews to something.
} virBhyveCapsFlags;
int virBhyveProbeGrubCaps(virBhyveGrubCapsFlags *caps);
Michal
Michal Prívozník wrote:
On 10/8/26 19:20, Roman Bogorodskiy wrote:
Probe the bhyve binary to determine whether it supports TPM devices.
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com> --- src/bhyve/bhyve_capabilities.c | 15 +++++++++++++++ src/bhyve/bhyve_capabilities.h | 1 + 2 files changed, 16 insertions(+)
diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index 0302b68e22..9b3163b9ef 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -58,6 +58,7 @@ typedef enum { BHYVE_CAP_ACPI = 1 << 12, BHYVE_CAP_NUMA = 1 << 13, BHYVE_CAP_RCTL = 1 << 14, + BHYVE_CAP_LPC_TPM = 1 << 15,
You'll need to rebase this and change this to 1 << 17.
Thanks, I'll do that.
Or even better, turn this into a sequential enum (1, 2, 3, ... 17) and then use virBitmap to store capabilities ;-) Just like I suggested in one of my earlier reviews to something.
Experimented with that, while it's a mostly mechanical change, it's quite broad, so I'll send it out separately rather than squashing it into this series.
} virBhyveCapsFlags;
int virBhyveProbeGrubCaps(virBhyveGrubCapsFlags *caps);
Michal
On 10/18/26 09:04, Roman Bogorodskiy wrote:
Michal Prívozník wrote:
On 10/8/26 19:20, Roman Bogorodskiy wrote:
Probe the bhyve binary to determine whether it supports TPM devices.
Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com> --- src/bhyve/bhyve_capabilities.c | 15 +++++++++++++++ src/bhyve/bhyve_capabilities.h | 1 + 2 files changed, 16 insertions(+)
diff --git a/src/bhyve/bhyve_capabilities.h b/src/bhyve/bhyve_capabilities.h index 0302b68e22..9b3163b9ef 100644 --- a/src/bhyve/bhyve_capabilities.h +++ b/src/bhyve/bhyve_capabilities.h @@ -58,6 +58,7 @@ typedef enum { BHYVE_CAP_ACPI = 1 << 12, BHYVE_CAP_NUMA = 1 << 13, BHYVE_CAP_RCTL = 1 << 14, + BHYVE_CAP_LPC_TPM = 1 << 15,
You'll need to rebase this and change this to 1 << 17.
Thanks, I'll do that.
Or even better, turn this into a sequential enum (1, 2, 3, ... 17) and then use virBitmap to store capabilities ;-) Just like I suggested in one of my earlier reviews to something.
Experimented with that, while it's a mostly mechanical change, it's quite broad, so I'll send it out separately rather than squashing it into this series.
Oh, I didn't mean to squash it into this. It is going to be large change, and as you say mostly mechanical. But it is semantically different change than this one, so it should be a separate commit. Michal
Implement support of the TPM devices for bhyve. Currently, only the "external" backend type is supported. Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com> --- src/bhyve/bhyve_capabilities.c | 10 +++ src/bhyve/bhyve_command.c | 27 ++++++++ src/bhyve/bhyve_domain.c | 3 + .../x86_64/bhyvexml2argv-tpm.args | 12 ++++ .../x86_64/bhyvexml2argv-tpm.ldargs | 4 ++ .../x86_64/bhyvexml2argv-tpm.xml | 28 ++++++++ tests/bhyvexml2argvtest.c | 6 +- tests/domaincapsdata/bhyve_tpm.x86_64.xml | 69 +++++++++++++++++++ tests/domaincapstest.c | 3 + 9 files changed, 161 insertions(+), 1 deletion(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml create mode 100644 tests/domaincapsdata/bhyve_tpm.x86_64.xml diff --git a/src/bhyve/bhyve_capabilities.c b/src/bhyve/bhyve_capabilities.c index 1fbee71205..d3565bea29 100644 --- a/src/bhyve/bhyve_capabilities.c +++ b/src/bhyve/bhyve_capabilities.c @@ -121,6 +121,16 @@ virBhyveDomainCapsFill(virDomainCaps *caps, VIR_DOMAIN_CAPS_ENUM_SET(caps->rng.backendModel, VIR_DOMAIN_RNG_BACKEND_RANDOM); } + if (bhyvecaps & BHYVE_CAP_LPC_TPM) { + caps->tpm.supported = VIR_TRISTATE_BOOL_YES; + caps->tpm.model.report = true; + caps->tpm.backendModel.report = true; + + VIR_DOMAIN_CAPS_ENUM_SET(caps->tpm.model, + VIR_DOMAIN_TPM_MODEL_CRB); + VIR_DOMAIN_CAPS_ENUM_SET(caps->tpm.backendModel, + VIR_DOMAIN_TPM_TYPE_EXTERNAL); + } caps->hostdev.supported = VIR_TRISTATE_BOOL_YES; caps->features[VIR_DOMAIN_CAPS_FEATURE_IOTHREADS] = VIR_TRISTATE_BOOL_NO; diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index f48d86d6f6..026ec40da8 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -263,7 +263,30 @@ bhyveBuildHostdevArgStr(const virDomainDef *def, subsys->u.pci.addr.slot, subsys->u.pci.addr.function); } + return 0; +} + +static int +bhyveBuildTPMArgStr(const virDomainDef *def G_GNUC_UNUSED, + virDomainTPMDef *tpm, + struct _bhyveConn *driver, + virCommand *cmd) +{ + if (!(bhyveDriverGetBhyveCaps(driver) & BHYVE_CAP_LPC_TPM)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Installed bhyve binary does not support TPM devices")); + return -1; + } + + if (tpm->type != VIR_DOMAIN_TPM_TYPE_EXTERNAL) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("TPM backend is not supported")); + return -1; + } + virCommandAddArg(cmd, "-l"); + virCommandAddArgFormat(cmd, "tpm,swtpm,%s", + tpm->data.external.source->data.nix.path); return 0; } @@ -1313,6 +1336,10 @@ virBhyveProcessBuildBhyveCmd(struct _bhyveConn *driver, virDomainDef *def, if (bhyveBuildRNGArgStr(def, def->rngs[i], cmd) < 0) return NULL; + for (i = 0; i < def->ntpms; i++) + if (bhyveBuildTPMArgStr(def, def->tpms[i], driver, cmd) < 0) + return NULL; + if (def->namespaceData) { bhyveDomainCmdlineDef *bhyvecmd; diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 1a19b3f888..93be75d52d 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -115,6 +115,9 @@ bhyveDomainDefNeedsISAController(virDomainDef *def) if (def->ngraphics && def->nvideos) return true; + if (def->ntpms) + return true; + return false; } diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args new file mode 100644 index 0000000000..9b3b639a94 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args @@ -0,0 +1,12 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 1:0,lpc \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +-l tpm,swtpm,/var/run/swtpm/tpm \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml new file mode 100644 index 0000000000..e927d2b378 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml @@ -0,0 +1,28 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <tpm> + <backend type='external'> + <source type='unix' mode='connect' path='/var/run/swtpm/tpm'/> + </backend> + </tpm> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index d00ceab825..58e6d11cec 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -202,7 +202,8 @@ mymain(void) BHYVE_CAP_FBUF | BHYVE_CAP_XHCI | \ BHYVE_CAP_CPUTOPOLOGY | BHYVE_CAP_SOUND_HDA | \ BHYVE_CAP_VNC_PASSWORD | BHYVE_CAP_VIRTIO_9P | \ - BHYVE_CAP_NVME | BHYVE_CAP_NUMA; + BHYVE_CAP_NVME | BHYVE_CAP_NUMA | \ + BHYVE_CAP_LPC_TPM; DO_TEST("base"); DO_TEST("bootorder"); @@ -309,6 +310,9 @@ mymain(void) DO_TEST("memtune"); DO_TEST_FAILURE("memtune-unsupported-params"); DO_TEST("sysinfo-smbios"); + DO_TEST("tpm"); + driver.bhyvecaps &= ~BHYVE_CAP_LPC_TPM; + DO_TEST_FAILURE("tpm"); /* Address allocation tests */ DO_TEST("addr-single-sata-disk"); diff --git a/tests/domaincapsdata/bhyve_tpm.x86_64.xml b/tests/domaincapsdata/bhyve_tpm.x86_64.xml new file mode 100644 index 0000000000..72ed457650 --- /dev/null +++ b/tests/domaincapsdata/bhyve_tpm.x86_64.xml @@ -0,0 +1,69 @@ +<domainCapabilities> + <path>/usr/sbin/bhyve</path> + <domain>bhyve</domain> + <arch>x86_64</arch> + <iothreads supported='no'/> + <os supported='yes'> + <loader supported='yes'> + <value>/foo/bar</value> + <value>/foo/baz</value> + <enum name='type'> + <value>pflash</value> + </enum> + <enum name='readonly'> + <value>yes</value> + </enum> + </loader> + </os> + <cpu> + <mode name='host-passthrough' supported='no'/> + <mode name='maximum' supported='no'/> + <mode name='host-model' supported='no'/> + <mode name='custom' supported='no'/> + </cpu> + <devices> + <disk supported='yes'> + <enum name='diskDevice'> + <value>disk</value> + <value>cdrom</value> + </enum> + <enum name='bus'> + <value>virtio</value> + <value>sata</value> + </enum> + <enum name='model'/> + </disk> + <graphics supported='yes'> + <enum name='type'> + <value>vnc</value> + </enum> + </graphics> + <video supported='yes'> + <enum name='modelType'> + <value>gop</value> + </enum> + </video> + <hostdev supported='yes'/> + <tpm supported='yes'> + <enum name='model'> + <value>tpm-crb</value> + </enum> + <enum name='backendModel'> + <value>external</value> + </enum> + </tpm> + <console supported='yes'> + <enum name='type'> + <value>tcp</value> + <value>nmdm</value> + </enum> + </console> + </devices> + <features> + <gic supported='no'/> + <vmcoreinfo supported='no'/> + <genid supported='no'/> + <sev supported='no'/> + <sgx supported='no'/> + </features> +</domainCapabilities> diff --git a/tests/domaincapstest.c b/tests/domaincapstest.c index ec2ac8cb36..b3e9ff7051 100644 --- a/tests/domaincapstest.c +++ b/tests/domaincapstest.c @@ -530,6 +530,9 @@ mymain(void) bhyve_caps |= BHYVE_CAP_FBUF; DO_TEST_BHYVE("fbuf", "/usr/sbin/bhyve", &bhyve_caps, VIR_DOMAIN_VIRT_BHYVE); + + bhyve_caps |= BHYVE_CAP_LPC_TPM; + DO_TEST_BHYVE("tpm", "/usr/sbin/bhyve", &bhyve_caps, VIR_DOMAIN_VIRT_BHYVE); #endif /* WITH_BHYVE */ return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; -- 2.55.0
Add TPM device validation: - Accept only the external TPM backend supported by bhyve. - Accept only one TPM device as bhyve does not support more than one. - Do not accept UNIX socket paths with commas as commas are used to delimit options in bhyve. - Accept only the CRB model as it's the only one supported by bhyve. Also, explicitly set model to CRB when it's not specified. Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com> --- src/bhyve/bhyve_domain.c | 35 +++++++++++++++- .../x86_64/bhyvexml2argv-tpm-comma-path.xml | 16 ++++++++ .../x86_64/bhyvexml2argv-tpm-crb.args | 12 ++++++ .../x86_64/bhyvexml2argv-tpm-crb.ldargs | 4 ++ .../x86_64/bhyvexml2argv-tpm-crb.xml | 28 +++++++++++++ .../bhyvexml2argv-tpm-invalid-model.xml | 16 ++++++++ .../bhyvexml2argv-tpm-multiple-devices.xml | 21 ++++++++++ tests/bhyvexml2argvtest.c | 4 ++ .../x86_64/bhyvexml2xmlout-tpm.xml | 41 +++++++++++++++++++ tests/bhyvexml2xmltest.c | 4 ++ 10 files changed, 180 insertions(+), 1 deletion(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-comma-path.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-invalid-model.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-multiple-devices.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-tpm.xml diff --git a/src/bhyve/bhyve_domain.c b/src/bhyve/bhyve_domain.c index 93be75d52d..e0004e6dab 100644 --- a/src/bhyve/bhyve_domain.c +++ b/src/bhyve/bhyve_domain.c @@ -311,6 +311,11 @@ bhyveDomainDeviceDefPostParse(virDomainDeviceDef *dev, dev->data.video->type = VIR_DOMAIN_VIDEO_TYPE_GOP; } + if (dev->type == VIR_DOMAIN_DEVICE_TPM && + dev->data.tpm->model == VIR_DOMAIN_TPM_MODEL_DEFAULT) { + dev->data.tpm->model = VIR_DOMAIN_TPM_MODEL_CRB; + } + if (dev->type == VIR_DOMAIN_DEVICE_CHR && dev->data.chr->source->type == VIR_DOMAIN_CHR_TYPE_NMDM) { virDomainChrDef *chr = dev->data.chr; @@ -521,11 +526,33 @@ bhyveDomainDeviceDefValidate(const virDomainDeviceDef *dev, case VIR_DOMAIN_DEVICE_SHMEM: case VIR_DOMAIN_DEVICE_SMARTCARD: case VIR_DOMAIN_DEVICE_SOUND: - case VIR_DOMAIN_DEVICE_TPM: case VIR_DOMAIN_DEVICE_VIDEO: case VIR_DOMAIN_DEVICE_VSOCK: case VIR_DOMAIN_DEVICE_WATCHDOG: break; + + case VIR_DOMAIN_DEVICE_TPM: + if (dev->data.tpm->type != VIR_DOMAIN_TPM_TYPE_EXTERNAL) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Only 'external' TPM device backend is supported")); + return -1; + } + + if (dev->data.tpm->model != VIR_DOMAIN_TPM_MODEL_DEFAULT && + dev->data.tpm->model != VIR_DOMAIN_TPM_MODEL_CRB) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("TPM model '%1$s' is not supported by bhyve"), + virDomainTPMModelTypeToString(dev->data.tpm->model)); + return -1; + } + + if (virStringHasChars(dev->data.tpm->data.external.source->data.nix.path, + ",")) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("Commas (',') are not allowed in UNIX socket paths")); + return -1; + } + break; } return 0; @@ -600,6 +627,12 @@ bhyveDomainDefValidate(const virDomainDef *def, } } + if (def->ntpms > 1) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("bhyve only supports a single TPM device")); + return -1; + } + if (def->nhostdevs && !def->mem.locked) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("using passthrough devices requires locking guest memory")); diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-comma-path.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-comma-path.xml new file mode 100644 index 0000000000..a12466d743 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-comma-path.xml @@ -0,0 +1,16 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <tpm> + <backend type='external'> + <source type='unix' mode='connect' path='/var/run/swtpm/tpm,0'/> + </backend> + </tpm> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.args new file mode 100644 index 0000000000..9b3b639a94 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.args @@ -0,0 +1,12 @@ +bhyve \ +-c 1 \ +-m 214 \ +-u \ +-H \ +-P \ +-s 0:0,hostbridge \ +-s 1:0,lpc \ +-s 2:0,ahci,hd:/tmp/freebsd.img \ +-s 3:0,virtio-net,faketapdev,mac=52:54:00:b9:94:02 \ +-l tpm,swtpm,/var/run/swtpm/tpm \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.ldargs b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.ldargs new file mode 100644 index 0000000000..5905f4b3e6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.ldargs @@ -0,0 +1,4 @@ +bhyveload \ +-m 214 \ +-d /tmp/freebsd.img \ +bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.xml new file mode 100644 index 0000000000..76f690a6d6 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.xml @@ -0,0 +1,28 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <model type='virtio'/> + <source bridge="virbr0"/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <tpm model='tpm-crb'> + <backend type='external'> + <source type='unix' mode='connect' path='/var/run/swtpm/tpm'/> + </backend> + </tpm> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-invalid-model.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-invalid-model.xml new file mode 100644 index 0000000000..634aa4d9f1 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-invalid-model.xml @@ -0,0 +1,16 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <tpm model='tpm-tis'> + <backend type='external'> + <source type='unix' mode='connect' path='/var/run/swtpm/tpm'/> + </backend> + </tpm> + </devices> +</domain> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-multiple-devices.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-multiple-devices.xml new file mode 100644 index 0000000000..4a7160b695 --- /dev/null +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-multiple-devices.xml @@ -0,0 +1,21 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory>219136</memory> + <vcpu>1</vcpu> + <os> + <type>hvm</type> + </os> + <devices> + <tpm> + <backend type='external'> + <source type='unix' mode='connect' path='/var/run/swtpm/tpm0'/> + </backend> + </tpm> + <tpm> + <backend type='external'> + <source type='unix' mode='connect' path='/var/run/swtpm/tpm1'/> + </backend> + </tpm> + </devices> +</domain> diff --git a/tests/bhyvexml2argvtest.c b/tests/bhyvexml2argvtest.c index 58e6d11cec..679467fe72 100644 --- a/tests/bhyvexml2argvtest.c +++ b/tests/bhyvexml2argvtest.c @@ -311,6 +311,10 @@ mymain(void) DO_TEST_FAILURE("memtune-unsupported-params"); DO_TEST("sysinfo-smbios"); DO_TEST("tpm"); + DO_TEST("tpm-crb"); + DO_TEST_FAILURE("tpm-comma-path"); + DO_TEST_FAILURE("tpm-invalid-model"); + DO_TEST_FAILURE("tpm-multiple-devices"); driver.bhyvecaps &= ~BHYVE_CAP_LPC_TPM; DO_TEST_FAILURE("tpm"); diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-tpm.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-tpm.xml new file mode 100644 index 0000000000..2a75a723db --- /dev/null +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-tpm.xml @@ -0,0 +1,41 @@ +<domain type='bhyve'> + <name>bhyve</name> + <uuid>df3be7e7-a104-11e3-aeb0-50e5492bd3dc</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='file' type='raw'/> + <source file='/tmp/freebsd.img'/> + <target dev='hda' bus='sata'/> + <address type='drive' controller='0' bus='0' target='2' unit='0'/> + </disk> + <controller type='pci' index='0' model='pci-root'/> + <controller type='isa' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> + </controller> + <controller type='sata' index='0'> + <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> + </controller> + <interface type='bridge'> + <mac address='52:54:00:b9:94:02'/> + <source bridge='virbr0'/> + <model type='virtio'/> + <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> + </interface> + <tpm model='tpm-crb'> + <backend type='external'> + <source type='unix' mode='connect' path='/var/run/swtpm/tpm'/> + </backend> + </tpm> + </devices> +</domain> diff --git a/tests/bhyvexml2xmltest.c b/tests/bhyvexml2xmltest.c index 336278ce1c..be3459b200 100644 --- a/tests/bhyvexml2xmltest.c +++ b/tests/bhyvexml2xmltest.c @@ -155,6 +155,10 @@ mymain(void) DO_TEST_FAILURE("virtio-console-invalid-name"); DO_TEST_FAILURE("virtio-console-invalid-path"); DO_TEST_FAILURE("sata-disk-invalid-serial"); + DO_TEST_DIFFERENT("tpm"); + DO_TEST_FAILURE("tpm-comma-path"); + DO_TEST_FAILURE("tpm-invalid-model"); + DO_TEST_FAILURE("tpm-multiple-devices"); /* Address allocation tests */ DO_TEST_DIFFERENT("addr-single-sata-disk"); -- 2.55.0
On 10/8/26 19:20, Roman Bogorodskiy wrote:
Roman Bogorodskiy (4): bhyve: capabilities: use consistent function names bhyve: capabilities: probe TPM support bhyve: implement TPM support bhyve: domain: validate TPM devices
src/bhyve/bhyve_capabilities.c | 29 +++++++- src/bhyve/bhyve_capabilities.h | 1 + src/bhyve/bhyve_command.c | 27 ++++++++ src/bhyve/bhyve_domain.c | 38 +++++++++- .../x86_64/bhyvexml2argv-tpm-comma-path.xml | 16 +++++ .../x86_64/bhyvexml2argv-tpm-crb.args | 12 ++++ .../x86_64/bhyvexml2argv-tpm-crb.ldargs | 4 ++ .../x86_64/bhyvexml2argv-tpm-crb.xml | 28 ++++++++ .../bhyvexml2argv-tpm-invalid-model.xml | 16 +++++ .../bhyvexml2argv-tpm-multiple-devices.xml | 21 ++++++ .../x86_64/bhyvexml2argv-tpm.args | 12 ++++ .../x86_64/bhyvexml2argv-tpm.ldargs | 4 ++ .../x86_64/bhyvexml2argv-tpm.xml | 28 ++++++++ tests/bhyvexml2argvtest.c | 10 ++- .../x86_64/bhyvexml2xmlout-tpm.xml | 41 +++++++++++ tests/bhyvexml2xmltest.c | 4 ++ tests/domaincapsdata/bhyve_tpm.x86_64.xml | 69 +++++++++++++++++++ tests/domaincapstest.c | 3 + 18 files changed, 359 insertions(+), 4 deletions(-) create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-comma-path.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-crb.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-invalid-model.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm-multiple-devices.xml create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.args create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.ldargs create mode 100644 tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-tpm.xml create mode 100644 tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-tpm.xml create mode 100644 tests/domaincapsdata/bhyve_tpm.x86_64.xml
Reviewed-by: Michal Privoznik <mprivozn@redhat.com> Michal
participants (2)
-
Michal Prívozník -
Roman Bogorodskiy