Merge pull request #135 from cclaudio/coconut-svsm-vtpm

Add support for vTPM and its runtime protocol

.github/workflows/rust.yml

@@ -28,6 +28,9 @@ jobs:
             override: true
             components: rustfmt, rust-src, clippy
 
+      - name: Install Microsoft TPM build dependencies
+        run: sudo apt install -y autoconf autoconf-archive pkg-config build-essential automake libssl-dev
+
       # ubuntu-latest does not have binutils 2.39, which we need for
       # ld to work, so build all the objects without performing the
       # final linking step.
@@ -91,6 +94,13 @@ jobs:
             override: true
             components: rustfmt
 
+      # The bindings.rs is auto-generated during make, but we are not
+      # building the code with nightly. So we initialize bindings.rs here
+      # for cargo-fmt in the next workflow, otherwise it will fail reporting
+      # that bindings.rs does not exist.
+      - name: Touch libmstpm bindings
+        run: echo "" > libmstpm/src/bindings.rs
+
       - name: Format doctests
         uses: actions-rs/cargo@v1
         with:

.gitmodules

@@ -0,0 +1,6 @@
+[submodule "libmstpm/deps/openssl"]
+	path = libmstpm/deps/openssl
+	url = https://github.com/openssl/openssl.git
+[submodule "libmstpm/deps/ms-tpm-20-ref"]
+	path = libmstpm/deps/ms-tpm-20-ref
+	url = https://github.com/microsoft/ms-tpm-20-ref.git

Cargo.toml

@@ -10,6 +10,8 @@ members = [
     "fuzz",
     # ELF loader
     "elf",
+    # Microsoft TPM library
+    "libmstpm",
 ]
 
 
@@ -20,6 +22,7 @@ cpuarch = { path = "cpuarch" }
 test = { path = "test" }
 svsm = { path = "kernel" }
 elf = { path = "elf" }
+libmstpm = { path = "libmstpm" }
 
 # crates.io
 aes-gcm = { version = "0.10.3", default-features = false }

Documentation/INSTALL.md

@@ -139,15 +139,16 @@ openSUSE you can do this by:
 $ sudo zypper si -d qemu-ovmf-x86_64
 ```
 
-Then go back to the EDK2 source directory and follow these steps to
-build the firmware:
+Then go back to the EDK2 source directory and follow the steps below to
+build the firmware. `-DTPM2_ENABLE` is required only if you want to use
+the SVSM vTPM.
 
 ```
 $ export PYTHON3_ENABLE=TRUE
 $ export PYTHON_COMMAND=python3
 $ make -j16 -C BaseTools/
-$ source ./edksetup.sh
-$ build -a X64 -b DEBUG -t GCC5 -D DEBUG_ON_SERIAL_PORT -D DEBUG_VERBOSE -p OvmfPkg/OvmfPkgX64.dsc
+$ source ./edksetup.sh --reconfig
+$ build -a X64 -b DEBUG -t GCC5 -D DEBUG_ON_SERIAL_PORT -D DEBUG_VERBOSE -DTPM2_ENABLE -p OvmfPkg/OvmfPkgX64.dsc
 ```
 
 This will build the OVMF binary that will be packaged into the IGVM file to use
@@ -180,6 +181,9 @@ the guest kernel configuration you can follow the same steps as for the
 host kernel. Best results are achieved by re-using the kernel
 configuration from the distribution like for the host kernel.
 
+The `CONFIG_TCG_PLATFORM` is required in the guest kernel if you want to
+use the SVSM vTPM.
+
 Building the COCONUT-SVSM
 -------------------------
 
@@ -189,11 +193,22 @@ Building the SVSM itself requires:
 - `x86_64-unknown-none` target toolchain installed (`rustup target add x86_64-unknown-none`)
 - `binutils` >= 2.39
 
+You may also need to install the Microsoft TPM build dependencies. On OpenSUSE
+you can do this by:
+
+```
+$ sudo zypper in system-user-mail make gcc curl patterns-devel-base-devel_basis \
+      glibc-devel-static git libclang13 autoconf autoconf-archive pkg-config \
+      automake libopenssl-devel perl
+```
+
 Then checkout the SVSM repository and build the SVSM binary:
 
 ```
 $ git clone https://github.com/coconut-svsm/svsm
 $ cd svsm
+$ git submodule update --init
+$ cargo install bindgen-cli
 ```
 
 That checks out the SVSM which can be built by

Makefile

@@ -1,6 +1,9 @@
 FEATURES ?= "default"
 SVSM_ARGS = --features ${FEATURES}
 
+FEATURES_TEST ?= "default-test"
+SVSM_ARGS_TEST = --no-default-features --features ${FEATURES_TEST}
+
 ifdef RELEASE
 TARGET_PATH=release
 CARGO_ARGS += --release
@@ -73,7 +76,7 @@ bin/coconut-test-qemu.igvm: $(IGVMBUILDER)  $(IGVMMEASURE) bin/test-kernel.elf b
 	$(IGVMMEASURE) $@
 
 test:
-	cargo test ${CARGO_ARGS} --workspace --target=x86_64-unknown-linux-gnu
+	cargo test ${CARGO_ARGS} ${SVSM_ARGS_TEST} --workspace --target=x86_64-unknown-linux-gnu
 
 test-in-svsm: utils/cbit bin/coconut-test-qemu.igvm
 	./scripts/test-in-svsm.sh
@@ -144,5 +147,7 @@ clean:
 	rm -f ${STAGE1_OBJS} utils/gen_meta utils/print-meta
 	rm -rf bin
 
-.PHONY: test clean clippy bin/stage2.bin bin/svsm-kernel.elf bin/test-kernel.elf
+distclean: clean
+	$(MAKE) -C libmstpm $@
 
+.PHONY: test clean clippy bin/stage2.bin bin/svsm-kernel.elf bin/test-kernel.elf distclean

fuzz/fuzz_targets/page_alloc.rs

@@ -93,7 +93,7 @@ fuzz_target!(|inp: FuzzInput| {
                 }
             }
             Action::AllocateSlab => {
-                if let Ok(page) = allocate_slab_page() {
+                if let Ok(page) = allocate_slab_page(None) {
                     pages.push(page);
                 }
             }

kernel/Cargo.toml

@@ -30,14 +30,16 @@ igvm_defs = { workspace = true, features = ["unstable"] }
 intrusive-collections.workspace = true
 log = { workspace = true, features = ["max_level_info", "release_max_level_info"] }
 packit.workspace = true
-
+libmstpm = { workspace = true, optional = true }
 
 [target."x86_64-unknown-none".dev-dependencies]
 test.workspace = true
 
 [features]
-default = []
+default = ["mstpm"]
+default-test = []
 enable-gdb = ["dep:gdbstub", "dep:gdbstub_arch"]
+mstpm = ["dep:libmstpm"]
 
 [dev-dependencies]
 memoffset.workspace = true

kernel/build.rs

@@ -17,6 +17,12 @@ fn main() {
     println!("cargo:rustc-link-arg-bin=svsm=--no-relax");
     println!("cargo:rustc-link-arg-bin=svsm=-Tkernel/src/svsm.lds");
     println!("cargo:rustc-link-arg-bin=svsm=-no-pie");
+    if std::env::var("CARGO_FEATURE_MSTPM").is_ok()
+        && std::env::var("CARGO_FEATURE_DEFAULT_TEST").is_err()
+    {
+        println!("cargo:rustc-link-arg-bin=svsm=-Llibmstpm");
+        println!("cargo:rustc-link-arg-bin=svsm=-lmstpm");
+    }
 
     // Extra linker args for tests.
     println!("cargo:rerun-if-env-changed=LINK_TEST");

kernel/src/lib.rs

@@ -37,6 +37,8 @@ pub mod svsm_paging;
 pub mod task;
 pub mod types;
 pub mod utils;
+#[cfg(feature = "mstpm")]
+pub mod vtpm;
 
 #[test]
 fn test_nop() {}