Page MenuHomeFreeBSD

bhyve: enable TPM2 passthrough
Needs ReviewPublic

Authored by c.koehne_beckhoff.com on Nov 12 2021, 2:43 PM.

Details

Reviewers
None
Group Reviewers
bhyve
Summary

Description:
Passes a TPM2 device to a VM guest. It maps the CRB of the TPM2 device into the guest and reports it address by ACPI tables.

How to use TPM2 passthrough:
Add -l tpm2,passthru to your bhyve cmd line.

bhyve -c 2 -m 4G -A -H -P -w \
  -s 0,hostbridge \
  -s 4,virtio-blk,/root/win/win10.img \
  -s 5,virtio-net,tap10 \
  -s 20,xhci,tablet \
  -s 29,fbuf,tcp=0.0.0.0:5900,wait \
  -s 31,lpc \
  -l com1,stdio \
  -l bootrom,/usr/local/share/uefi-firmware/BHYVE_CODE.fd \
  -l tpm2,passthru \
  win10

Tested Scenarios:

OS
UbuntuWorking
WindowsNot working

Tested with Intels fTPM device.

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

I understand this would probably be a thing for someone else to implement later. But allowing backing by https://github.com/stefanberger/swtpm would be a nice feature.

I understand this would probably be a thing for someone else to implement later. But allowing backing by https://github.com/stefanberger/swtpm would be a nice feature.

Thanks for that hint.
I'd like to implement a swtpm in the future. It will require some more work to do. Don't know when I'm able to do it.

This patch allows a guest direct access to the physical TPM. It doesn't emulate the TPM.