vtpm: Manufacture the Microsoft TPM 2.0

Initialize the TPM values in preparation for the TPM's first use. This follows
the same steps that the Microsoft TPM Simulator uses to manufacture the TPM.

Signed-off-by: Claudio Carvalho <[email protected]>

INSTALL.md

@@ -112,9 +112,9 @@ COCONUT-SVSM code base. To build the OVMF binary for the guest, checkout
 this repository:
 
 ```
-$ git clone https://github.com/coconut-svsm/edk2.git
-$ cd edk2/
-$ git checkout svsm
+$ git clone https://github.com/svsm-vtpm/ovmf.git
+$ cd ovmf/
+$ git checkout coconut-svsm-vtpm
 $ git submodule init
 $ git submodule update
 ```
@@ -133,8 +133,8 @@ build the firmware:
 $ export PYTHON3_ENABLE=TRUE
 $ export PYTHON_COMMAND=python3
 $ make -j16 -C BaseTools/
-$ source ./edksetup.sh
-$ build -a X64 -b DEBUG -t GCC5 -D DEBUG_ON_SERIAL_PORT -D DEBUG_VERBOSE -p OvmfPkg/OvmfPkgX64.dsc
+$ source ./edksetup.sh --reconfig
+$ build -a X64 -b DEBUG -t GCC5 -D DEBUG_ON_SERIAL_PORT -D DEBUG_VERBOSE -DTPM2_ENABLE -p OvmfPkg/OvmfPkgX64.dsc
 ```
 
 This will build the OVMF code and variable binaries to use with QEMU.
@@ -157,15 +157,16 @@ Otherwise you need to build a new guest kernel. From within the guest
 image, do:
 
 ```
-$ git clone https://github.com/coconut-svsm/linux
+$ git clone https://github.com/svsm-vtpm/linux
 $ cd linux
-$ git checkout svsm-guest
+$ git checkout coconut-svsm-vtpm-guest-v3
 ```
 
 Build a kernel from that branch and install it in the guest image. For
 the guest kernel configuration you can follow the same steps as for the
-host kernel. Best results are achieved by re-using the kernel
-configuration from the distribution like for the host kernel.
+host kernel, just make sure that `TCG_PLATFORM` is enabled. Best results are
+achieved by re-using the kernel configuration from the distribution like for
+the host kernel.
 
 Building the COCONUT-SVSM
 -------------------------

src/lib.rs

@@ -30,6 +30,7 @@ pub mod svsm_paging;
 pub mod task;
 pub mod types;
 pub mod utils;
+#[cfg(any(not(test), rust_analyzer))]
 pub mod vtpm;
 
 #[test]

src/svsm.rs

@@ -460,6 +460,11 @@ pub extern "C" fn svsm_main() {
         panic!("Failed to validate flash memory: {:#?}", e);
     }
 
+    #[cfg(any(not(test), rust_analyzer))]
+    if let Err(e) = svsm::vtpm::mssim::mssim_vtpm_init() {
+        log::error!("vTPM failed to initialize - {:?}", e);
+    }
+
     prepare_fw_launch(&fw_meta).expect("Failed to setup guest VMSA");
 
     virt_log_usage();

src/vtpm/mod.rs

@@ -6,5 +6,9 @@
 
 /// C bindings
 pub mod bindings;
+/// MS Simulator functions
+pub mod mssim;
+/// MS TPM2 functions
+pub mod mstpm;
 /// Wrappers called in C
 pub mod wrapper;

src/vtpm/mssim.rs

@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+//
+// Copyright (C) 2023 IBM
+//
+// Authors: Claudio Carvalho <[email protected]>
+
+// This crate implements the MS TPM Simulator interface defined in
+// libvtpm/ms-tpm-20-ref/TPMCmd/Simulator/include/TpmTcpProtocol.h
+//
+// The same interface is also implemented in ms-tpm-20-ref/TPMCmd/Simulator/; we don't use it
+// because we are not compiling the TPM Simulator (-DSIMULATION=NO), as it brings in more
+// dependencies on libc and a higher memory footprint.
+
+use core::ffi::c_void;
+
+use crate::address::VirtAddr;
+use crate::protocols::errors::SvsmReqError;
+use crate::vtpm::bindings::{
+    _plat__NVDisable, _plat__NVEnable, _plat__SetNvAvail, _plat__Signal_PowerOn,
+    _plat__Signal_Reset,
+};
+use crate::vtpm::mstpm::{mstpm_manufacture, mstpm_teardown};
+
+static mut VTPM_IS_POWERED_ON: bool = false;
+
+/// Initialize the vTPM
+pub fn mssim_vtpm_init() -> Result<(), SvsmReqError> {
+    // Manufacture the MS TPM following the same steps done in the Simulator:
+    //
+    // 1. Manufacture it for the first time
+    // 2. Make sure it does not fail if it is re-manufactured
+    // 3. Teardown to indicate it needs to be manufactured
+    // 4. Manufacture it for the first time
+    // 5. Power it on indicating it requires startup. By default, OVMF will start
+    //    and selftest it.
+
+    unsafe { _plat__NVEnable(VirtAddr::null().as_mut_ptr::<c_void>()) };
+
+    let mut rc = mstpm_manufacture(1)?;
+    if rc != 0 {
+        unsafe { _plat__NVDisable(1) };
+        return Err(SvsmReqError::incomplete());
+    }
+
+    rc = mstpm_manufacture(0)?;
+    if rc != 1 {
+        return Err(SvsmReqError::incomplete());
+    }
+
+    mstpm_teardown()?;
+    rc = mstpm_manufacture(1)?;
+    if rc != 0 {
+        return Err(SvsmReqError::incomplete());
+    }
+
+    mssim_signal_poweron(false)?;
+    mssim_signal_nvon()?;
+
+    log::info!("vTPM manufactured");
+
+    Ok(())
+}
+
+/// Power on the vTPM, which also triggers a reset
+///
+/// @only_reset:  If enabled, it will only reset the vTPM;
+///               however, the vtPM has to be powered on previously.
+///               Otherwise, it will fail.
+pub fn mssim_signal_poweron(only_reset: bool) -> Result<(), SvsmReqError> {
+    unsafe {
+        if VTPM_IS_POWERED_ON && !only_reset {
+            return Ok(());
+        }
+        if only_reset && !VTPM_IS_POWERED_ON {
+            return Err(SvsmReqError::invalid_request());
+        }
+        if !only_reset {
+            _plat__Signal_PowerOn();
+        }
+
+        // It calls TPM_init() within to indicate that a TPM2_Startup is required.
+        _plat__Signal_Reset();
+
+        VTPM_IS_POWERED_ON = true;
+    }
+
+    Ok(())
+}
+
+pub fn mssim_signal_nvon() -> Result<(), SvsmReqError> {
+    unsafe {
+        if !VTPM_IS_POWERED_ON {
+            return Err(SvsmReqError::invalid_request());
+        }
+        _plat__SetNvAvail();
+    }
+    Ok(())
+}

src/vtpm/mstpm.rs

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: MIT OR Apache-2.0
+//
+// Copyright (C) 2023 IBM
+//
+// Authors: Claudio Carvalho <[email protected]>
+
+// This crate make calls to the Microsoft libtpm.a built from ms-tpm-20-ref/TPMCmd/tpm.
+// The libtpm implements the commands defined in the "TCG TPM 2.0 - Part 3" specification.
+
+use crate::protocols::errors::SvsmReqError;
+use crate::vtpm::bindings::{TPM_Manufacture, TPM_TearDown};
+
+/// Prepare the TPM for re-manufacture.
+pub fn mstpm_teardown() -> Result<(), SvsmReqError> {
+    unsafe {
+        match TPM_TearDown() {
+            0 => Ok(()),
+            rc => {
+                log::error!("TPM_Teardown failed rc={}", rc);
+                Err(SvsmReqError::incomplete())
+            }
+        }
+    }
+}
+
+/// Initialize the TPM values in preparation for the TPM's first use.
+/// This function will fail if previously called. The TPM can be re-manufactured
+/// by calling mstpm_teardown() first and then calling this function again.
+pub fn mstpm_manufacture(first_time: i32) -> Result<i32, SvsmReqError> {
+    unsafe {
+        // Return Type: int
+        //      -1          failure
+        //      0           success
+        //      1           manufacturing process previously performed
+        match TPM_Manufacture(first_time) {
+            // TPM manufactured successfully
+            0 => Ok(0),
+            // TPM already manufactured
+            1 => Ok(1),
+            // TPM failed to manufacture
+            rc => {
+                log::error!("TPM_Manufacture failed rc={}", rc);
+                Err(SvsmReqError::incomplete())
+            }
+        }
+    }
+}