Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vTPM: swtich from MS TPM to TCG TPM #514

Open
wants to merge 7 commits into
base: main
Choose a base branch
from

Commits on Nov 12, 2024

  1. Rename mstpm feature in vtpm

    This change is in preparation for the transition from MS TPM
    to TCG TPM.
    
    The feature is used to enable or disable the vTPM emulation in SVSM,
    so let's be generic.
    
    Signed-off-by: Stefano Garzarella <[email protected]>
    stefano-garzarella committed Nov 12, 2024
    Configuration menu
    Copy the full SHA
    d7bdcea View commit details
    Browse the repository at this point in the history

Commits on Nov 13, 2024

  1. Rename libmstpm in libtcgtpm

    This change is in preparation for the transition from MS TPM
    to TCG TPM.
    
    No code changes in this commit, just the library name, some folders,
    some comments, and some modules to be more consistent.
    Also let's refer to it as "TPM 2.0 Reference Implementation" instead
    of "MS TPM".
    
    Signed-off-by: Stefano Garzarella <[email protected]>
    stefano-garzarella committed Nov 13, 2024
    Configuration menu
    Copy the full SHA
    f5cf773 View commit details
    Browse the repository at this point in the history
  2. libtcgtpm: little hack to disable pthread check

    The pthread library is only required for the simulator, but we
    don't build it, so let's use this workaround to make the `cofigure`
    happy and avoid checks that the pthread is available.
    
    When the  TrustedComputingGroup/TPM#7 will be
    merged we can revert this commit and call `./configure --disable-pthread`.
    
    With this patch we can then avoid using our fork in Coconut and switch
    to using the upstream version directly (in the next commit).
    
    Signed-off-by: Stefano Garzarella <[email protected]>
    stefano-garzarella committed Nov 13, 2024
    Configuration menu
    Copy the full SHA
    af795a6 View commit details
    Browse the repository at this point in the history
  3. libtcgtpm: use the ms-tpm-20-ref upstream repo

    Now we can switch to the upstream repository.
    No change in functionality, since the MS TPM commit is e9fc7b8 ("Fix
    conflicting types for `ReadVarBytes`. (coconut-svsm#102)").
    The same in our fork except for the patch to disable pthread library
    check.
    
    Signed-off-by: Stefano Garzarella <[email protected]>
    stefano-garzarella committed Nov 13, 2024
    Configuration menu
    Copy the full SHA
    893864d View commit details
    Browse the repository at this point in the history
  4. libtcgtpm: use -j when building tpm libraries

    Let's speed up the compilation of the TPM libraries a bit.
    We already do that for openssl.
    
    Signed-off-by: Stefano Garzarella <[email protected]>
    stefano-garzarella committed Nov 13, 2024
    Configuration menu
    Copy the full SHA
    509f328 View commit details
    Browse the repository at this point in the history
  5. libtcgtpm: set -Wno-error=unused-variable in TPM CFLAGS

    The next commit switches to TCG TPM, but there is a problem when the
    `FILE_BACKED_NV` macro is set to `NO`. It produces the following compile
    error because a variable is not used:
    
        Platform/src/NVMem.c: In function ‘_plat__NVDisable’:
        Platform/src/NVMem.c:185:9: error: unused variable ‘delete’ [-Werror=unused-variable]
          185 |     int delete = ((intptr_t)platParameter != 0)
              |         ^~~~~~
        cc1: all warnings being treated as errors
        make[2]: *** [Makefile:2674: Platform/src/libplatform_a-NVMem.o] Error 1
    
    This commit can be reverted when the following PR will be merged:
    TrustedComputingGroup/TPM#7
    
    Signed-off-by: Stefano Garzarella <[email protected]>
    stefano-garzarella committed Nov 13, 2024
    Configuration menu
    Copy the full SHA
    5d2dca2 View commit details
    Browse the repository at this point in the history
  6. libtcgtpm: swtich from MS TPM to TCG TPM

    Let's switch to the official TPM 2.0 Reference Implementation
    hosted in https://github.com/TrustedComputingGroup/TPM.
    
    We now use the 1.83 version, commit 97c2783 ("Trusted Computing Group
    (TCG) TPM Specification 1.83 Release reference code. (coconut-svsm#262)").
    
    The main difference with the previous version is that `-DSIMULATION=NO`
    is no longer supported to disable the simulation code, but the use of
    `TpmConfiguration` is strongly recommended. This allows us to better
    configure our TPM.
    
    For now let's copy the upstream version of TpmConfiguration and disable
    some features to remove the simulation behaviour:
    
        $ diff -ru libtcgtpm/deps/tpm-20-ref/TPMCmd/TpmConfiguration libtcgtpm/deps/TpmConfiguration
        --- libtcgtpm/deps/tpm-20-ref/TPMCmd/TpmConfiguration/TpmConfiguration/TpmBuildSwitches.h	2024-11-12 15:16:57.087949276 +0100
        +++ libtcgtpm/deps/TpmConfiguration/TpmConfiguration/TpmBuildSwitches.h	2024-11-12 16:09:35.144106758 +0100
        @@ -49,12 +49,12 @@
         // macros will make sure that it is set correctly. A simulated TPM would include a
         // Virtual TPM. The interfaces for a Virtual TPM should be modified from the standard
         // ones in the Simulator project.
        -#define SIMULATION                  YES
        +#define SIMULATION                  NO
    
         // The CRYPTO_LIB_REPORTING switch allows the TPM to report its
         // crypto library implementation, e.g., at simulation startup.
        -#define CRYPTO_LIB_REPORTING        YES
        +#define CRYPTO_LIB_REPORTING        NO
    
         // If doing debug, can set the DRBG to print out the intermediate test values.
         // Before enabling this, make sure that the dbgDumpMemBlock() function
        @@ -92,7 +92,7 @@
         // g_forceFailureMode flag in the TPM library while leaving the rest of the TPM
         // behavior alone.  Useful for testing when the full set of options controlled by
         // SIMULATION may not be desired.
        -#define ALLOW_FORCE_FAILURE_MODE    YES
        +#define ALLOW_FORCE_FAILURE_MODE    NO
    
         ////////////////////////////////////////////////////////////////
         // Internal checks
    
    Fixes: coconut-svsm#440
    Suggested-by: James E.J. Bottomley <[email protected]>
    Signed-off-by: Stefano Garzarella <[email protected]>
    stefano-garzarella committed Nov 13, 2024
    Configuration menu
    Copy the full SHA
    49b6c26 View commit details
    Browse the repository at this point in the history