From nobody Sat Oct 03 08:21:27 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hxdsN15hXz6tvtR for ; Sat, 03 Oct 2026 08:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hxdsN0fzTz4dcJ for ; Sat, 03 Oct 2026 08:21:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791015688; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UD+bswYSxJpRwtXM9BluNTIaZ8PbOD/2A6JCko8R8a8=; b=vG5+rAy3p4QLNozbMSwTvJJBYn33enWikZVk/qqUdsWFCop6GCPU3ZZyD93mXPLB6pBSRL iWOu1+LEANAwtVPNhh8yXZxsQYxkbIQFrrhSX6tHvsOJWErYCp/HkR0xVVH5oksQbPiTRJ fJVuNWkpk3Lfm303ATFEW4wPwGaq9zab/0JQLNxzcMd/WNfWPM/BAUl/kt/iwZea4wEjva ajlAHs1n2657gA88B2flkq2JiBjk0d2KKkr2uhoJIocTNhirJYpRHN26h8Z4pLXOV2CrJ4 NTSDkpAQiJuJk/uuYX9axX8pHh83UItM368NI87wTU5BlL+/+jykHDpzkItwxA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791015688; b=uLuRhcN3J37AmbRU3fc3DcVm8ur4/9tFL0vtgMyrmNf20gSWIB/dsDhDTGroUaFxxRNW4q n5MhzYZqomldDE22pruZKSu5ilJRwMcfFrkhNJeqNN0YD7e+Rio8y/B4r9H3CcAbTKsaq+ 9DNeH6Fn0oATN9VnX698c6JZU+21mQghH3EqDXGBMqYwDzbbsPg/UukSKmMvtkmKEmgESe ch87qBoOaaoEH01Wri8o0YzwVqjpH8D6xSkE8YLygybWnjrKupeDZYHAeCBLCF+NS7tPde spmePS26wI3GkjYGOMuJDoirSeqTSHO5RLUfW/Op+lCC548nRu59YnHLZV5Yyw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791015688; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=UD+bswYSxJpRwtXM9BluNTIaZ8PbOD/2A6JCko8R8a8=; b=Q0tnOIAuIA1TS+OWifK4B99pb3o7bJh01YrC8s3bDyIBpM+4Y9toCVXMRYWt0+2H1bgwBj IxO567ITgpa58hTeX/MZ7V5Mg0HOkQQSkmGHTn8v0pT8CUQIjrOGvHD9bJJHU7BIu1fLbe aEIlgAM/PyzsuPuhI5+zo5PVJqwSoWJCAF8cOvJr4mOs7K4P0BLN6aC/wp5zkyzfvcY84u mSOGwsDDRIj/nfwQNjkZ7yyKSqlxE0Z22gg0WGS0EH8b1ZBiaU8thrhUYAijPfXCGkXUQT 98Pe+cNZaF2awmSGxzACJn7SA0FUjr7vMJgBqUznrXH9oX3eZu4AbpeU5zoLig== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hxdsM6q60zwsS for ; Sat, 03 Oct 2026 08:21:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c107 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 03 Oct 2026 08:21:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Roman Bogorodskiy Subject: git: ff2efe65a89a - main - bhyve.8: add details on using TPM with UEFI List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: novel X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ff2efe65a89a943beec4dd4cc956f5e075a921be Auto-Submitted: auto-generated Date: Sat, 03 Oct 2026 08:21:27 +0000 Message-Id: <6ac0bb07.3c107.bfda2f2@gitrepo.freebsd.org> The branch main has been updated by novel: URL: https://cgit.FreeBSD.org/src/commit/?id=ff2efe65a89a943beec4dd4cc956f5e075a921be commit ff2efe65a89a943beec4dd4cc956f5e075a921be Author: Roman Bogorodskiy AuthorDate: 2026-09-30 17:56:18 +0000 Commit: Roman Bogorodskiy CommitDate: 2026-10-03 08:06:57 +0000 bhyve.8: add details on using TPM with UEFI Add a note that UEFI VMs using TPM devices should be configured to use a varfile. Some UEFI boot loaders, such as shim, update persistent boot variables and then reset the system when a TPM is present. Without a writable varfile, the VM may be reset repeatedly. Add a TPM device example to the examples list. While here, add a missing "\" to the "uefivm" example, and add ".Pp" before the vCPU pinning examples for consistency with other examples. PR: 287326 Reviewed by: michaelo, ziaee Sponsored by: The FreeBSD Foundation MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D60181 --- usr.sbin/bhyve/bhyve.8 | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/usr.sbin/bhyve/bhyve.8 b/usr.sbin/bhyve/bhyve.8 index 606d73ac6602..14d91e0711d1 100644 --- a/usr.sbin/bhyve/bhyve.8 +++ b/usr.sbin/bhyve/bhyve.8 @@ -26,7 +26,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd August 23, 2026 +.Dd October 3, 2026 .Dt BHYVE 8 .Os .Sh NAME @@ -831,6 +831,11 @@ The argument needs to point to a UNIX domain socket that a .Cm swtpm process is listening on. +The +.Cm swtpm +utility can be installed from the +.Pa sysutils/swtpm +port. .El .Pp The @@ -843,6 +848,10 @@ Defaults to .Cm 2.0 , which is the only version currently supported. .El +.Pp +When using a TPM with UEFI firmware, the boot ROM should be configured +with a writable +.Ar varfile . .Ss Boot ROM device backends .Sm off .Bl -bullet @@ -1357,7 +1366,7 @@ Be sure to create a per-guest copy of the template VARS file from bhyve -c 2 -m 4g -w -H \\ -s 0,hostbridge \\ -s 31,lpc -l com1,stdio \\ - -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI_CODE.fd,BHYVE_UEFI_VARS.fd + -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI_CODE.fd,BHYVE_UEFI_VARS.fd \\ uefivm .Ed .Pp @@ -1412,16 +1421,35 @@ bhyve -c 2 -w -H \\ -n id=0,size=4G,cpus=0-1,domain_policy=prefer:0 \\ numavm .Ed +.Pp To run a virtual machine with a single vCPU pinned to host CPU 12: .Bd -literal -offset indent bhyve -c 1 -s 0,hostbridge -s 1,lpc -s 2,virtio-blk,/my/image \\ -l com1,stdio -H -P -m 1G -p 0:12 vm1 .Ed +.Pp To run a virtual machine with 4 vCPUs pinned to host CPUs 12-15: .Bd -literal -offset indent bhyve -c 4 -s 0,hostbridge -s 1,lpc -s 2,virtio-blk,/my/image \\ -l com1,stdio -H -P -m 1G -p 0-3:12-15 vm1 .Ed +.Pp +Run a UEFI virtual machine with a TPM device connected to a running +.Cm swtpm +instance listening on +.Pa /var/run/swtpm/tpm . +The +.Pa tpmvm_VARS.fd +file must be a per-guest copy of the firmware VARS template, as described +in the UEFI example above: +.Bd -literal -offset indent +bhyve -c 2 -m 4g -w -H \\ + -s 0,hostbridge \\ + -s 31,lpc -l com1,stdio \\ + -l tpm,swtpm,/var/run/swtpm/tpm \\ + -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI_CODE.fd,tpmvm_VARS.fd \\ + tpmvm +.Ed .Sh SEE ALSO .Xr bhyve 4 , .Xr netgraph 4 ,