diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 1f1fda9dd3c64ef64c0b9add80b76cbf62384734..8a20cdd012eb7cff0f14c13ae0d1ea9a77fbae40 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -7728,7 +7728,7 @@ qemu-kvm -net nic,model=? /dev/null
The TPM device enables a QEMU guest to have access to TPM
functionality. The TPM device may either be a TPM 1.2 or
- a TPM 2.
+ a TPM 2.0.
The TPM passthrough device type provides access to the host's TPM
@@ -7765,7 +7765,7 @@ qemu-kvm -net nic,model=? /dev/null
...
<devices>
<tpm model='tpm-tis'>
- <backend type='emulator'>
+ <backend type='emulator' version='2.0'>
</backend>
</tpm>
</devices>
@@ -7780,7 +7780,7 @@ qemu-kvm -net nic,model=? /dev/null
tpm-tis
will automatically be chosen.
Since 4.4.0 , another available choice
is the tpm-crb
, which should only be used when the
- backend device is a TPM 2.
+ backend device is a TPM 2.0.
backend
@@ -7815,6 +7815,19 @@ qemu-kvm -net nic,model=? /dev/null
+ version
+
+
+ The version
attribute indicates the version
+ of the TPM. By default a TPM 1.2 is created. This attribute
+ only works with the emulator
backend. The following
+ versions are supported:
+
+
+ '1.2' : creates a TPM 1.2
+ '2.0' : creates a TPM 2.0
+
+
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index 8ee6eebcf47ab51ea04073e6c6f847f633e79159..c5c8c575b8cda43b144db6166a579c730aa4d73f 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -4144,6 +4144,18 @@
+
+
+
+
+
+ 1.2
+ 2.0
+
+
+
+
+
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 4e3861d227364635823a06d5479b671376363bd6..371e48ca2460a43747fbcaf4a69ce9b35183c958 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -869,6 +869,11 @@ VIR_ENUM_IMPL(virDomainTPMBackend, VIR_DOMAIN_TPM_TYPE_LAST,
"passthrough",
"emulator")
+VIR_ENUM_IMPL(virDomainTPMVersion, VIR_DOMAIN_TPM_VERSION_LAST,
+ "default",
+ "1.2",
+ "2.0")
+
VIR_ENUM_IMPL(virDomainIOMMUModel, VIR_DOMAIN_IOMMU_MODEL_LAST,
"intel")
@@ -12766,7 +12771,7 @@ virDomainSmartcardDefParseXML(virDomainXMLOptionPtr xmlopt,
* or like this:
*
*
- *
+ *
*
*/
static virDomainTPMDefPtr
@@ -12779,6 +12784,7 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
char *path = NULL;
char *model = NULL;
char *backend = NULL;
+ char *version = NULL;
virDomainTPMDefPtr def;
xmlNodePtr save = ctxt->node;
xmlNodePtr *backends = NULL;
@@ -12825,6 +12831,18 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
goto error;
}
+ version = virXMLPropString(backends[0], "version");
+ if (!version) {
+ def->version = VIR_DOMAIN_TPM_VERSION_DEFAULT;
+ } else {
+ if ((def->version = virDomainTPMVersionTypeFromString(version)) < 0) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Unsupported TPM version '%s'"),
+ version);
+ goto error;
+ }
+ }
+
switch (def->type) {
case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
path = virXPathString("string(./backend/device/@path)", ctxt);
@@ -12849,6 +12867,7 @@ virDomainTPMDefParseXML(virDomainXMLOptionPtr xmlopt,
VIR_FREE(model);
VIR_FREE(backend);
VIR_FREE(backends);
+ VIR_FREE(version);
ctxt->node = save;
return def;
@@ -22083,6 +22102,12 @@ virDomainTPMDefCheckABIStability(virDomainTPMDefPtr src,
return false;
}
+ if (src->version != dst->version) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("Target TPM version doesn't match source"));
+ return false;
+ }
+
return virDomainDeviceInfoCheckABIStability(&src->info, &dst->info);
}
@@ -25249,7 +25274,8 @@ virDomainTPMDefFormat(virBufferPtr buf,
virBufferAddLit(buf, "\n");
break;
case VIR_DOMAIN_TPM_TYPE_EMULATOR:
- virBufferAddLit(buf, "/>\n");
+ virBufferAsprintf(buf, " version='%s'/>\n",
+ virDomainTPMVersionTypeToString(def->version));
break;
case VIR_DOMAIN_TPM_TYPE_LAST:
break;
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index 066d8bbb442916f7e0ed86b9d86cfc2267962f49..5f8960d90b123584d60104ecd4bb9a53b9090c5c 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -1296,12 +1296,21 @@ typedef enum {
VIR_DOMAIN_TPM_TYPE_LAST
} virDomainTPMBackendType;
+typedef enum {
+ VIR_DOMAIN_TPM_VERSION_DEFAULT,
+ VIR_DOMAIN_TPM_VERSION_1_2,
+ VIR_DOMAIN_TPM_VERSION_2_0,
+
+ VIR_DOMAIN_TPM_VERSION_LAST
+} virDomainTPMVersion;
+
# define VIR_DOMAIN_TPM_DEFAULT_DEVICE "/dev/tpm0"
struct _virDomainTPMDef {
virDomainTPMBackendType type;
virDomainDeviceInfo info;
virDomainTPMModel model;
+ virDomainTPMVersion version;
union {
struct {
virDomainChrSourceDef source;
@@ -3398,6 +3407,7 @@ VIR_ENUM_DECL(virDomainRNGModel)
VIR_ENUM_DECL(virDomainRNGBackend)
VIR_ENUM_DECL(virDomainTPMModel)
VIR_ENUM_DECL(virDomainTPMBackend)
+VIR_ENUM_DECL(virDomainTPMVersion)
VIR_ENUM_DECL(virDomainMemoryModel)
VIR_ENUM_DECL(virDomainMemoryBackingModel)
VIR_ENUM_DECL(virDomainMemorySource)
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 96726cec1223ac677fba294d869cd193dd5396d2..c5237e4d418da6a2763ff34587cf8db2caa20118 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -5394,7 +5394,34 @@ qemuDomainDeviceDefValidateVsock(const virDomainVsockDef *vsock ATTRIBUTE_UNUSED
"with this QEMU binary"));
return -1;
}
+ return 0;
+}
+
+static int
+qemuDomainDeviceDefValidateTPM(virDomainTPMDef *tpm,
+ const virDomainDef *def ATTRIBUTE_UNUSED)
+{
+ /* TPM 1.2 and 2 are not compatible, so we choose a specific version here */
+ if (tpm->version == VIR_DOMAIN_TPM_VERSION_DEFAULT)
+ tpm->version = VIR_DOMAIN_TPM_VERSION_1_2;
+
+ switch (tpm->version) {
+ case VIR_DOMAIN_TPM_VERSION_1_2:
+ /* only TIS available for emulator */
+ if (tpm->type == VIR_DOMAIN_TPM_TYPE_EMULATOR &&
+ tpm->model != VIR_DOMAIN_TPM_MODEL_TIS) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Unsupported interface %s for TPM 1.2"),
+ virDomainTPMModelTypeToString(tpm->model));
+ return -1;
+ }
+ break;
+ case VIR_DOMAIN_TPM_VERSION_2_0:
+ case VIR_DOMAIN_TPM_VERSION_DEFAULT:
+ case VIR_DOMAIN_TPM_VERSION_LAST:
+ break;
+ }
return 0;
}
@@ -5462,6 +5489,10 @@ qemuDomainDeviceDefValidate(const virDomainDeviceDef *dev,
ret = qemuDomainDeviceDefValidateVsock(dev->data.vsock, qemuCaps);
break;
+ case VIR_DOMAIN_DEVICE_TPM:
+ ret = qemuDomainDeviceDefValidateTPM(dev->data.tpm, def);
+ break;
+
case VIR_DOMAIN_DEVICE_LEASE:
case VIR_DOMAIN_DEVICE_FS:
case VIR_DOMAIN_DEVICE_INPUT:
@@ -5471,7 +5502,6 @@ qemuDomainDeviceDefValidate(const virDomainDeviceDef *dev,
case VIR_DOMAIN_DEVICE_MEMBALLOON:
case VIR_DOMAIN_DEVICE_NVRAM:
case VIR_DOMAIN_DEVICE_SHMEM:
- case VIR_DOMAIN_DEVICE_TPM:
case VIR_DOMAIN_DEVICE_PANIC:
case VIR_DOMAIN_DEVICE_IOMMU:
case VIR_DOMAIN_DEVICE_NONE:
diff --git a/src/qemu/qemu_tpm.c b/src/qemu/qemu_tpm.c
index 6897bbf48213c61f9bf4ecfc1c15e5ba3717f38a..64ee9a81e4ce13b0d117cc6dfcbeb58c14a0e924 100644
--- a/src/qemu/qemu_tpm.c
+++ b/src/qemu/qemu_tpm.c
@@ -121,16 +121,32 @@ qemuTPMEmulatorInit(void)
*
* @swtpmStorageDir: directory for swtpm persistent state
* @uuid: The UUID of the VM for which to create the storage
+ * @tpmversion: version of the TPM
*
* Create the swtpm's storage path
*/
static char *
qemuTPMCreateEmulatorStoragePath(const char *swtpmStorageDir,
- const char *uuidstr)
+ const char *uuidstr,
+ virDomainTPMVersion tpmversion)
{
char *path = NULL;
+ const char *dir = "";
- ignore_value(virAsprintf(&path, "%s/%s/tpm1.2", swtpmStorageDir, uuidstr));
+ switch (tpmversion) {
+ case VIR_DOMAIN_TPM_VERSION_1_2:
+ dir = "tpm1.2";
+ break;
+ case VIR_DOMAIN_TPM_VERSION_2_0:
+ dir = "tpm2";
+ break;
+ case VIR_DOMAIN_TPM_VERSION_DEFAULT:
+ case VIR_DOMAIN_TPM_VERSION_LAST:
+ return NULL;
+ }
+
+ ignore_value(virAsprintf(&path, "%s/%s/%s", swtpmStorageDir, uuidstr,
+ dir));
return path;
}
@@ -285,7 +301,8 @@ qemuTPMEmulatorInitPaths(virDomainTPMDefPtr tpm,
if (!tpm->data.emulator.storagepath &&
!(tpm->data.emulator.storagepath =
- qemuTPMCreateEmulatorStoragePath(swtpmStorageDir, uuidstr)))
+ qemuTPMCreateEmulatorStoragePath(swtpmStorageDir, uuidstr,
+ tpm->version)))
return -1;
return 0;
@@ -385,6 +402,7 @@ qemuTPMEmulatorPrepareHost(virDomainTPMDefPtr tpm,
* @swtpm_group: The group id to switch to
* @logfile: The file to write the log into; it must be writable
* for the user given by userid or 'tss'
+ * @tpmversion: The version of the TPM, either a TPM 1.2 or TPM 2
*
* Setup the external swtpm by creating endorsement key and
* certificates for it.
@@ -396,7 +414,8 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
bool privileged,
uid_t swtpm_user,
gid_t swtpm_group,
- const char *logfile)
+ const char *logfile,
+ const virDomainTPMVersion tpmversion)
{
virCommandPtr cmd = NULL;
int exitstatus;
@@ -421,6 +440,18 @@ qemuTPMEmulatorRunSetup(const char *storagepath,
virCommandSetUID(cmd, swtpm_user);
virCommandSetGID(cmd, swtpm_group);
+ switch (tpmversion) {
+ case VIR_DOMAIN_TPM_VERSION_1_2:
+ break;
+ case VIR_DOMAIN_TPM_VERSION_2_0:
+ virCommandAddArgList(cmd, "--tpm2", NULL);
+ break;
+ case VIR_DOMAIN_TPM_VERSION_DEFAULT:
+ case VIR_DOMAIN_TPM_VERSION_LAST:
+ break;
+ }
+
+
virCommandAddArgList(cmd,
"--tpm-state", storagepath,
"--vmid", vmid,
@@ -484,7 +515,7 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm,
if (created &&
qemuTPMEmulatorRunSetup(tpm->data.emulator.storagepath, vmname, vmuuid,
privileged, swtpm_user, swtpm_group,
- tpm->data.emulator.logfile) < 0)
+ tpm->data.emulator.logfile, tpm->version) < 0)
goto error;
unlink(tpm->data.emulator.source.data.nix.path);
@@ -509,6 +540,17 @@ qemuTPMEmulatorBuildCommand(virDomainTPMDefPtr tpm,
virCommandSetUID(cmd, swtpm_user);
virCommandSetGID(cmd, swtpm_group);
+ switch (tpm->version) {
+ case VIR_DOMAIN_TPM_VERSION_1_2:
+ break;
+ case VIR_DOMAIN_TPM_VERSION_2_0:
+ virCommandAddArg(cmd, "--tpm2");
+ break;
+ case VIR_DOMAIN_TPM_VERSION_DEFAULT:
+ case VIR_DOMAIN_TPM_VERSION_LAST:
+ break;
+ }
+
return cmd;
error:
diff --git a/tests/qemuxml2argvdata/tpm-emulator-tpm2.x86_64-latest.args b/tests/qemuxml2argvdata/tpm-emulator-tpm2.x86_64-latest.args
new file mode 100644
index 0000000000000000000000000000000000000000..071f339b06c236d2dd72325b172eb0fe73c3b1fa
--- /dev/null
+++ b/tests/qemuxml2argvdata/tpm-emulator-tpm2.x86_64-latest.args
@@ -0,0 +1,32 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/home/test \
+USER=test \
+LOGNAME=test \
+QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-x86_64 \
+-name guest=TPM-VM,debug-threads=on \
+-S \
+-object secret,id=masterKey0,format=raw,\
+file=/tmp/lib/domain--1-TPM-VM/master-key.aes \
+-machine pc-i440fx-2.12,accel=tcg,usb=off,dump-guest-core=off \
+-m 2048 \
+-realtime mlock=off \
+-smp 1,sockets=1,cores=1,threads=1 \
+-uuid 11d7cd22-da89-3094-6212-079a48a309a1 \
+-display none \
+-no-user-config \
+-nodefaults \
+-chardev socket,id=charmonitor,fd=1729,server,nowait \
+-mon chardev=charmonitor,id=monitor,mode=control \
+-rtc base=utc \
+-no-shutdown \
+-boot menu=on,strict=on \
+-device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
+-tpmdev emulator,id=tpm-tpm0,chardev=chrtpm \
+-chardev socket,id=chrtpm,path=/dev/test \
+-device tpm-tis,tpmdev=tpm-tpm0,id=tpm0 \
+-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2 \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\
+resourcecontrol=deny \
+-msg timestamp=on
diff --git a/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml b/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml
new file mode 100644
index 0000000000000000000000000000000000000000..3e2f485ee76c190b1b0dbd6a24439068dca1f431
--- /dev/null
+++ b/tests/qemuxml2argvdata/tpm-emulator-tpm2.xml
@@ -0,0 +1,30 @@
+
+ TPM-VM
+ 11d7cd22-da89-3094-6212-079a48a309a1
+ 2097152
+ 512288
+ 1
+
+ hvm
+
+
+
+
+
+
+
+ destroy
+ restart
+ destroy
+
+ /usr/bin/qemu-system-x86_64
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index a1341d6280db78fd7897571757e93896409c9ca6..cd103b650627ffae282692fa56ca1a35a161a269 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -2039,6 +2039,7 @@ mymain(void)
DO_TEST_PARSE_ERROR("tpm-no-backend-invalid",
QEMU_CAPS_DEVICE_TPM_PASSTHROUGH, QEMU_CAPS_DEVICE_TPM_TIS);
DO_TEST_CAPS_LATEST("tpm-emulator");
+ DO_TEST_CAPS_LATEST("tpm-emulator-tpm2");
DO_TEST_PARSE_ERROR("pci-domain-invalid", NONE);
DO_TEST_PARSE_ERROR("pci-bus-invalid", NONE);
diff --git a/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml b/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml
new file mode 100644
index 0000000000000000000000000000000000000000..d30944c23d08338ad137c9d6c684a0be0f4bfcef
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/tpm-emulator-tpm2.xml
@@ -0,0 +1,34 @@
+
+ TPM-VM
+ 11d7cd22-da89-3094-6212-079a48a309a1
+ 2097152
+ 512288
+ 1
+
+ hvm
+
+
+
+
+
+
+
+ destroy
+ restart
+ destroy
+
+ /usr/bin/qemu-system-x86_64
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/qemuxml2xmloutdata/tpm-emulator.xml b/tests/qemuxml2xmloutdata/tpm-emulator.xml
index 1b66e8b08a51576e23139db336b2b56818b147bb..ec33402499ac64505acea3c4abcf8e7129b0634a 100644
--- a/tests/qemuxml2xmloutdata/tpm-emulator.xml
+++ b/tests/qemuxml2xmloutdata/tpm-emulator.xml
@@ -25,7 +25,7 @@
-
+