diff --git a/src/conf/domain_audit.c b/src/conf/domain_audit.c
index 974df5a037..82cf6ab749 100644
--- a/src/conf/domain_audit.c
+++ b/src/conf/domain_audit.c
@@ -556,6 +556,17 @@ virDomainAuditTPM(virDomainObj *vm, virDomainTPMDef *tpm,
"virt=%s resrc=tpm-emulator reason=%s %s uuid=%s %s",
virt, reason, vmname, uuidstr, device);
break;
+ case VIR_DOMAIN_TPM_TYPE_EXTERNAL:
+ path = tpm->data.external.source->data.nix.path;
+ if (!(device = virAuditEncode("device", VIR_AUDIT_STR(path)))) {
+ VIR_WARN("OOM while encoding audit message");
+ goto cleanup;
+ }
+
+ VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success,
+ "virt=%s resrc=tpm-external reason=%s %s uuid=%s %s",
+ virt, reason, vmname, uuidstr, device);
+ break;
case VIR_DOMAIN_TPM_TYPE_LAST:
default:
break;
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index a180398b14..6c088ff295 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -1281,6 +1281,7 @@ VIR_ENUM_IMPL(virDomainTPMBackend,
VIR_DOMAIN_TPM_TYPE_LAST,
"passthrough",
"emulator",
+ "external",
);
VIR_ENUM_IMPL(virDomainTPMVersion,
@@ -3309,6 +3310,9 @@ void virDomainTPMDefFree(virDomainTPMDef *def)
g_free(def->data.emulator.logfile);
virBitmapFree(def->data.emulator.activePcrBanks);
break;
+ case VIR_DOMAIN_TPM_TYPE_EXTERNAL:
+ virObjectUnref(def->data.external.source);
+ break;
case VIR_DOMAIN_TPM_TYPE_LAST:
break;
}
@@ -10257,6 +10261,7 @@ virDomainTPMDefParseXML(virDomainXMLOption *xmlopt,
g_autofree char *persistent_state = NULL;
g_autofree xmlNodePtr *backends = NULL;
g_autofree xmlNodePtr *nodes = NULL;
+ g_autofree char *type = NULL;
int bank;
if (!(def = virDomainTPMDefNew(xmlopt)))
@@ -10344,6 +10349,28 @@ virDomainTPMDefParseXML(virDomainXMLOption *xmlopt,
virBitmapSetBitExpand(def->data.emulator.activePcrBanks, bank);
}
break;
+ case VIR_DOMAIN_TPM_TYPE_EXTERNAL:
+ if (!(type = virXPathString("string(./backend/source/@type)", ctxt))) {
+ virReportError(VIR_ERR_XML_ERROR, "%s",
+ _("missing external TPM backend type"));
+ goto error;
+ }
+
+ if (!(def->data.external.source = virDomainChrSourceDefNew(xmlopt)))
+ goto error;
+
+ def->data.external.source->type = virDomainChrTypeFromString(type);
+ if (def->data.external.source->type < 0) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("unknown backend type '%s' for external TPM"),
+ type);
+ goto error;
+ }
+
+ if (virDomainChrSourceDefParseXML(def->data.external.source,
+ backends[0], flags, NULL, ctxt) < 0)
+ goto error;
+ break;
case VIR_DOMAIN_TPM_TYPE_LAST:
goto error;
}
@@ -20443,6 +20470,7 @@ virDomainTPMDefCheckABIStability(virDomainTPMDef *src,
break;
case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
+ case VIR_DOMAIN_TPM_TYPE_EXTERNAL:
case VIR_DOMAIN_TPM_TYPE_LAST:
break;
}
@@ -24047,6 +24075,13 @@ virDomainTPMDefFormat(virBuffer *buf,
virXMLFormatElement(&backendChildBuf, "active_pcr_banks", NULL, &activePcrBanksBuf);
}
break;
+ case VIR_DOMAIN_TPM_TYPE_EXTERNAL:
+ if (def->data.external.source->type == VIR_DOMAIN_CHR_TYPE_UNIX) {
+ virBufferAddLit(&backendChildBuf, "\n",
+ def->data.external.source->data.nix.path);
+ }
+ break;
case VIR_DOMAIN_TPM_TYPE_LAST:
break;
}
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index c19dfc5470..1404c55053 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -1421,6 +1421,7 @@ typedef enum {
typedef enum {
VIR_DOMAIN_TPM_TYPE_PASSTHROUGH,
VIR_DOMAIN_TPM_TYPE_EMULATOR,
+ VIR_DOMAIN_TPM_TYPE_EXTERNAL,
VIR_DOMAIN_TPM_TYPE_LAST
} virDomainTPMBackendType;
@@ -1464,6 +1465,9 @@ struct _virDomainTPMDef {
bool persistent_state;
virBitmap *activePcrBanks;
} emulator;
+ struct {
+ virDomainChrSourceDef *source;
+ } external;
} data;
};
diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 95b8d9b419..2c63a0b343 100644
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -2727,6 +2727,24 @@ virDomainTPMDevValidate(const virDomainTPMDef *tpm)
break;
case VIR_DOMAIN_TPM_TYPE_PASSTHROUGH:
+ break;
+
+ case VIR_DOMAIN_TPM_TYPE_EXTERNAL:
+ if (tpm->data.external.source->type != VIR_DOMAIN_CHR_TYPE_UNIX) {
+ virReportError(VIR_ERR_XML_ERROR, "%s",
+ _("only source type 'unix' is supported for external TPM device"));
+ return -1;
+ }
+ if (tpm->data.external.source->data.nix.listen) {
+ virReportError(VIR_ERR_XML_ERROR, "%s",
+ _("only 'client' mode is supported for external TPM device"));
+ return -1;
+ }
+ if (tpm->data.external.source->data.nix.path == NULL) {
+ virReportError(VIR_ERR_XML_ERROR, "%s",
+ _("missing socket path for external TPM device"));
+ return -1;
+ }
case VIR_DOMAIN_TPM_TYPE_LAST:
break;
}
diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
index 8bc627d114..c588a48fd2 100644
--- a/src/conf/schemas/domaincommon.rng
+++ b/src/conf/schemas/domaincommon.rng
@@ -5583,6 +5583,12 @@
+
+
+ external
+
+