Page MenuHomeFreeBSD
Differential D32961

bhyve: enable TPM2 passthrough
ClosedPublic
Actions

Authored by corvink on Nov 12 2021, 2:43 PM.
Tags
Referenced Files
Unknown Object (File)
Fri, Nov 28, 5:08 AM
Unknown Object (File)
Wed, Nov 26, 11:00 PM
Unknown Object (File)
Tue, Nov 25, 5:11 AM
Unknown Object (File)
Tue, Nov 18, 3:35 AM
Unknown Object (File)
Tue, Nov 18, 2:08 AM
Unknown Object (File)
Mon, Nov 17, 6:18 PM
Unknown Object (File)
Sun, Nov 16, 11:32 AM
Unknown Object (File)
Thu, Nov 13, 1:45 AM
View All Files
Subscribers
bcran
crest_freebsd_rlwinm.de
darkfiberiru_gmail.com
emaste
guest-patmaddox
imp
jhb
View All 11 Subscribers

Details

Reviewers
jhb
markj
Group Reviewers
bhyve
Commits
rG67c26eb2a57c: bhyve: add cmdline option for TPM emulation
Summary

Description:
Add cmdline option for TPM emulation

How to use TPM2 passthrough:
Add -l tpm2,passthru,/dev/tpmX to your bhyve cmd line.

bhyve -c 2 -m 4G -A -H -P -w \
  -s 0,hostbridge \
  -s 4,virtio-blk,/root/win/win10.img \
  -s 5,virtio-net,tap10 \
  -s 20,xhci,tablet \
  -s 29,fbuf,tcp=0.0.0.0:5900,wait \
  -s 31,lpc \
  -l com1,stdio \
  -l bootrom,/usr/local/share/uefi-firmware/BHYVE_CODE.fd \
  -l tpm2,passthru,/dev/tpm0 \
  win10

Tested Scenarios:

OS
UbuntuWorking
WindowsWorking

Tested with Intels fTPM device.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

corvink created this revision.Nov 12 2021, 2:43 PM
Herald added subscribers: bcran, rgrimes, imp. · View Herald TranscriptNov 12 2021, 2:43 PM
corvink requested review of this revision.Nov 12 2021, 2:43 PM
darkfiberiru_gmail.com added a subscriber: darkfiberiru_gmail.com.Nov 12 2021, 3:10 PM

I understand this would probably be a thing for someone else to implement later. But allowing backing by https://github.com/stefanberger/swtpm would be a nice feature.

corvink added a comment.Nov 12 2021, 6:49 PM
In D32961#744093, @darkfiberiru_gmail.com wrote:

I understand this would probably be a thing for someone else to implement later. But allowing backing by https://github.com/stefanberger/swtpm would be a nice feature.

Thanks for that hint.
I'd like to implement a swtpm in the future. It will require some more work to do. Don't know when I'm able to do it.

This patch allows a guest direct access to the physical TPM. It doesn't emulate the TPM.

corvink edited the summary of this revision. (Show Details)Nov 12 2021, 6:50 PM
corvink mentioned this in D33011: bhyve: add ioctl to query infos about special memory regions.Nov 16 2021, 1:39 PM
crest_freebsd_rlwinm.de added a subscriber: crest_freebsd_rlwinm.de.Jun 30 2022, 4:57 PM
corvink planned changes to this revision.Sep 6 2022, 7:39 AM
corvink mentioned this in D33161: bhyve: add ioctl to modify the second level address translation.
corvink mentioned this in D33188: bhyve: add ioctl to get acpi resources of an acpi device.
corvink mentioned this in D39979: bhyve: add config option to load ACPI tables into memory.May 8 2023, 6:37 AM
emaste added a subscriber: emaste.May 19 2023, 5:36 PM
corvink updated this revision to Diff 122930.Jun 7 2023, 12:08 PM
corvink edited the summary of this revision. (Show Details)
  • split into multiple commits
corvink added a parent revision: D40462: bhyve: add qemu ppi emulation for tpm devices.Jun 7 2023, 12:09 PM
Harbormaster completed remote builds in B51955: Diff 122930.Jun 7 2023, 12:09 PM
markj added a subscriber: markj.Jun 23 2023, 3:08 PM
markj added inline comments.
usr.sbin/bhyve/bhyve.8
556
usr.sbin/bhyve/bhyve_config.5
143

This is typically /dev/tpm0?

147

Which versions are supported?

usr.sbin/bhyve/pci_lpc.c
271

Why do we hang the TPM device off of the LPC? arm64 won't have an LPC driver, but there's no reason to exclude TPM emulation/passthrough on arm64 AFAIK...

corvink updated this revision to Diff 124603.Jul 13 2023, 8:20 AM
  • improve man page
Harbormaster completed remote builds in B52613: Diff 124603.Jul 13 2023, 8:20 AM
corvink marked 3 inline comments as done.Jul 13 2023, 8:23 AM
corvink added inline comments.
usr.sbin/bhyve/pci_lpc.c
271

I just needed a place to add it. Afaik, some TPMs are attached to the LPC. Where would you like to add this option?

swills added a subscriber: swills.Jul 25 2023, 8:08 PM
guest-patmaddox added a subscriber: guest-patmaddox.Jul 29 2023, 5:29 AM
corvink added a subscriber: jhb.Aug 10 2023, 7:25 AM

@jhb @markj Any additional comments?

markj added inline comments.Aug 11 2023, 3:34 PM
usr.sbin/bhyve/bhyve_config.5
146

What are the valid types?

corvink updated this revision to Diff 125958.Aug 14 2023, 8:22 AM
  • mention supported tpm types in man page
corvink edited the summary of this revision. (Show Details)Aug 14 2023, 8:22 AM
corvink marked an inline comment as done.
corvink added inline comments.Aug 14 2023, 8:25 AM
usr.sbin/bhyve/pci_lpc.c
271

@jhb @markj Where should we hang off the TPM device?

jhb added a comment.Aug 14 2023, 8:21 PM

I think to address Mark's concern you would just need to have a tpm_init with the new code currently added to lpc_init. I would perhaps suggest that we need a init_devices function called from main that would call init_pci and then this new tpm_init. Eventually we might want to have a linker set or C++ constructors or something for device models to register init routines, but for now just adding a static call to tpm_init would be ok.

corvink updated this revision to Diff 126028.Aug 15 2023, 7:40 AM
corvink added reviewers: jhb, markj.
  • create a init_devices and init_tpm function
corvink marked an inline comment as done.Aug 15 2023, 7:55 AM
corvink edited the summary of this revision. (Show Details)Aug 15 2023, 9:33 AM
markj accepted this revision.Aug 16 2023, 8:35 PM
In D32961#944105, @jhb wrote:

I think to address Mark's concern you would just need to have a tpm_init with the new code currently added to lpc_init. I would perhaps suggest that we need a init_devices function called from main that would call init_pci and then this new tpm_init. Eventually we might want to have a linker set or C++ constructors or something for device models to register init routines, but for now just adding a static call to tpm_init would be ok.

The latest revision of the patch gets us part of the way there, but TPM config is still a subtree of the LPC config. I am not sure what the right solution is. For arm64 I have simply been extending the -o option, so one writes -o console=stdio -o bootrom=u-boot.bin, for example. Maybe we should start adopting that for amd64 as well, handling backward compatibility? In any case, I suppose this doesn't need to block the change.

usr.sbin/bhyve/bhyverun.c
1215

The opening brace should be on its own line.

1493

IMHO there is not much use in adding this function. The perror() call below does not tell you whether init_pci() or init_tpm() failed. I would just inline it.

If there is a particular reason init_pci() needs to be called first (I don't see one?), it should be documented in a comment.

This revision is now accepted and ready to land.Aug 16 2023, 8:35 PM
Closed by commit rG67c26eb2a57c: bhyve: add cmdline option for TPM emulation (authored by corvink). · Explain WhyAug 17 2023, 7:09 AM
This revision was automatically updated to reflect the committed changes.
corvink added a commit: rG67c26eb2a57c: bhyve: add cmdline option for TPM emulation.

Revision Contents
Changeset List

PathSize
usr.sbin/
bhyve/
39 lines
9 lines
18 lines
25 lines
2 lines
22 lines

Diff 126028

View Options

usr.sbin/bhyve/bhyve.8

Loading...
View Options

usr.sbin/bhyve/bhyve_config.5

Loading...
View Options

usr.sbin/bhyve/bhyverun.c

Loading...
View Options

usr.sbin/bhyve/pci_lpc.c

Loading...
View Options

usr.sbin/bhyve/tpm_device.h

Loading...
View Options

usr.sbin/bhyve/tpm_device.c

Loading...