mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-25 01:34:11 +03:00
8737578d11
This patch extends the TPM's device XML with TPM 2.0 support. This only works
for the emulator type backend and looks as follows:
<tpm model='tpm-tis'>
<backend type='emulator' version='2.0'/>
</tpm>
The swtpm process now has --tpm2 as an additional parameter:
system_u:system_r:svirt_t:s0:c597,c632 tss 18477 11.8 0.0 28364 3868 ? Rs 11:13 13:50 /usr/bin/swtpm socket --daemon --ctrl type=unixio,path=/var/run/libvirt/qemu/swtpm/testvm-swtpm.sock,mode=0660 --tpmstate dir=/var/lib/libvirt/swtpm/testvm/tpm2,mode=0640 --log file=/var/log/swtpm/libvirt/qemu/testvm-swtpm.log --tpm2 --pid file=/var/run/libvirt/qemu/swtpm/testvm-swtpm.pid
The version of the TPM can be changed and the state of the TPM is preserved.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
33 lines
991 B
Plaintext
33 lines
991 B
Plaintext
LC_ALL=C \
|
|
PATH=/bin \
|
|
HOME=/home/test \
|
|
USER=test \
|
|
LOGNAME=test \
|
|
QEMU_AUDIO_DRV=none \
|
|
/usr/bin/qemu-system-x86_64 \
|
|
-name guest=TPM-VM,debug-threads=on \
|
|
-S \
|
|
-object secret,id=masterKey0,format=raw,\
|
|
file=/tmp/lib/domain--1-TPM-VM/master-key.aes \
|
|
-machine pc-i440fx-2.12,accel=tcg,usb=off,dump-guest-core=off \
|
|
-m 2048 \
|
|
-realtime mlock=off \
|
|
-smp 1,sockets=1,cores=1,threads=1 \
|
|
-uuid 11d7cd22-da89-3094-6212-079a48a309a1 \
|
|
-display none \
|
|
-no-user-config \
|
|
-nodefaults \
|
|
-chardev socket,id=charmonitor,fd=1729,server,nowait \
|
|
-mon chardev=charmonitor,id=monitor,mode=control \
|
|
-rtc base=utc \
|
|
-no-shutdown \
|
|
-boot menu=on,strict=on \
|
|
-device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
|
|
-tpmdev emulator,id=tpm-tpm0,chardev=chrtpm \
|
|
-chardev socket,id=chrtpm,path=/dev/test \
|
|
-device tpm-tis,tpmdev=tpm-tpm0,id=tpm0 \
|
|
-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2 \
|
|
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\
|
|
resourcecontrol=deny \
|
|
-msg timestamp=on
|