git: 5c8bb2bbcda6 - stable/15 - bhyve.8: add details on using TPM with UEFI

The branch stable/15 has been updated by novel:

URL: https://cgit.FreeBSD.org/src/commit/?id=5c8bb2bbcda6d9b724220acad3e71eeae56e57db

commit 5c8bb2bbcda6d9b724220acad3e71eeae56e57db
Author:     Roman Bogorodskiy <novel@FreeBSD.org>
AuthorDate: 2026-09-30 17:56:18 +0000
Commit:     Roman Bogorodskiy <novel@FreeBSD.org>
CommitDate: 2026-10-31 17:10:22 +0000

    bhyve.8: add details on using TPM with UEFI
    
    Add a note that UEFI VMs using TPM devices should be configured
    to use a varfile. Some UEFI boot loaders, such as shim, update
    persistent boot variables and then reset the system when a TPM is
    present. Without a writable varfile, the VM may be reset repeatedly.
    
    Add a TPM device example to the examples list.
    
    While here, add a missing "\" to the "uefivm" example, and add ".Pp"
    before the vCPU pinning examples for consistency with other examples.
    
    PR:             287326
    Reviewed by:    michaelo, ziaee
    Sponsored by:   The FreeBSD Foundation
    MFC after:      3 days
    Differential Revision:  https://reviews.freebsd.org/D60181
    
    (cherry picked from commit ff2efe65a89a943beec4dd4cc956f5e075a921be)
---
 usr.sbin/bhyve/bhyve.8 | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/usr.sbin/bhyve/bhyve.8 b/usr.sbin/bhyve/bhyve.8
index a92f31ee7c69..e5a9cf2a5d37 100644
--- a/usr.sbin/bhyve/bhyve.8
+++ b/usr.sbin/bhyve/bhyve.8
@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd June 5, 2026
+.Dd October 3, 2026
 .Dt BHYVE 8
 .Os
 .Sh NAME
@@ -738,6 +738,11 @@ The argument
 needs to point to a UNIX domain socket that a
 .Cm swtpm
 process is listening on.
+The
+.Cm swtpm
+utility can be installed from the
+.Pa sysutils/swtpm
+port.
 .El
 .Pp
 The
@@ -750,6 +755,10 @@ Defaults to
 .Cm 2.0 ,
 which is the only version currently supported.
 .El
+.Pp
+When using a TPM with UEFI firmware, the boot ROM should be configured
+with a writable
+.Ar varfile .
 .Ss Boot ROM device backends
 .Sm off
 .Bl -bullet
@@ -1264,7 +1273,7 @@ Be sure to create a per-guest copy of the template VARS file from
 bhyve -c 2 -m 4g -w -H \\
   -s 0,hostbridge \\
   -s 31,lpc -l com1,stdio \\
-  -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI_CODE.fd,BHYVE_UEFI_VARS.fd
+  -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI_CODE.fd,BHYVE_UEFI_VARS.fd \\
    uefivm
 .Ed
 .Pp
@@ -1319,16 +1328,35 @@ bhyve -c 2 -w -H \\
   -n id=0,size=4G,cpus=0-1,domain_policy=prefer:0 \\
    numavm
 .Ed
+.Pp
 To run a virtual machine with a single vCPU pinned to host CPU 12:
 .Bd -literal -offset indent
 bhyve -c 1 -s 0,hostbridge -s 1,lpc -s 2,virtio-blk,/my/image \\
   -l com1,stdio -H -P -m 1G -p 0:12 vm1
 .Ed
+.Pp
 To run a virtual machine with 4 vCPUs pinned to host CPUs 12-15:
 .Bd -literal -offset indent
 bhyve -c 4 -s 0,hostbridge -s 1,lpc -s 2,virtio-blk,/my/image \\
   -l com1,stdio -H -P -m 1G -p 0-3:12-15 vm1
 .Ed
+.Pp
+Run a UEFI virtual machine with a TPM device connected to a running
+.Cm swtpm
+instance listening on
+.Pa /var/run/swtpm/tpm .
+The
+.Pa tpmvm_VARS.fd
+file must be a per-guest copy of the firmware VARS template, as described
+in the UEFI example above:
+.Bd -literal -offset indent
+bhyve -c 2 -m 4g -w -H \\
+  -s 0,hostbridge \\
+  -s 31,lpc -l com1,stdio \\
+  -l tpm,swtpm,/var/run/swtpm/tpm \\
+  -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI_CODE.fd,tpmvm_VARS.fd \\
+   tpmvm
+.Ed
 .Sh SEE ALSO
 .Xr bhyve 4 ,
 .Xr netgraph 4 ,