···
+
${lib.optionalString cfg.tpm.enable ''
+
NIX_SWTPM_DIR=$(readlink -f "''${NIX_SWTPM_DIR:-${config.system.name}-swtpm}")
+
mkdir -p "$NIX_SWTPM_DIR"
+
${lib.getExe cfg.tpm.package} \
+
--tpmstate dir="$NIX_SWTPM_DIR" \
+
--ctrl type=unixio,path="$NIX_SWTPM_DIR"/socket \
+
"--tpm2" 1>"$NIX_SWTPM_DIR"/stdout 2>"$NIX_SWTPM_DIR"/stderr &
${lib.optionalString (cfg.emptyDiskImages != []) "idx=0"}
···
+
enable = mkEnableOption "a TPM device in the virtual machine with a driver, using swtpm.";
+
package = mkPackageOptionMD cfg.host.pkgs "swtpm" { };
+
deviceModel = mkOption {
+
"i686-linux" = "tpm-tis";
+
"x86_64-linux" = "tpm-tis";
+
"ppc64-linux" = "tpm-spapr";
+
"armv7-linux" = "tpm-tis-device";
+
"aarch64-linux" = "tpm-tis-device";
+
}.${pkgs.hostPlatform.system} or (throw "Unsupported system for TPM2 emulation in QEMU"));
+
Based on the guest platform Linux system:
+
- `tpm-tis` for (i686, x86_64)
+
- `tpm-spapr` for ppc64
+
- `tpm-tis-device` for (armv7, aarch64)
+
example = "tpm-tis-device";
+
description = lib.mdDoc "QEMU device model for the TPM, uses the appropriate default based on th guest platform system and the package passed.";
virtualisation.useDefaultFilesystems =
···
boot.initrd.availableKernelModules =
optional cfg.writableStore "overlay"
+
++ optional (cfg.qemu.diskInterface == "scsi") "sym53c8xx"
+
++ optional (cfg.tpm.enable) "tpm_tis";
virtualisation.additionalPaths = [ config.system.build.toplevel ];
···
+
(mkIf (cfg.tpm.enable) [
+
"-chardev socket,id=chrtpm,path=\"$NIX_SWTPM_DIR\"/socket"
+
"-tpmdev emulator,id=tpm_dev_0,chardev=chrtpm"
+
"-device ${cfg.tpm.deviceModel},tpmdev=tpm_dev_0"
pyrox.dev