kernel/vtpm: support persistent state and key storage

SVSM's vTPM could not receive external persistent state on init, nor
did it store the KBS key for future state encryption/decryption.

Update vtpm_init and TCG TPM backend to accept an optional state
buffer and store the KBS secret key in the TcgTpm struct. This stored
key will be used for future state decryption on startup.

Even though state is passed as a buffer to the vtpm_init() function, it
does not come in effect yet, because the tpm reference implementation
does not copy platParameter into s_NV buffer in _plat__NVEnable()
function.

Signed-off-by: Arun Menon <armenon@redhat.com>

Author: armenon-rh

kernel/src/svsm.rs

@@ -556,7 +556,7 @@ fn svsm_init(launch_info: &KernelLaunchInfo) {
     }
 
     #[cfg(all(feature = "vtpm", not(test)))]
-    vtpm_init().expect("vTPM failed to initialize");
+    vtpm_init(None, None).expect("vTPM failed to initialize");
 
     #[cfg(all(feature = "uefivars", not(test)))]
     uefi_mm_protocol_init().expect("uefi mm protocol failed to initialize");

kernel/src/vtpm/mod.rs

@@ -99,11 +99,13 @@ static VTPM: SpinLock<Vtpm> = SpinLock::new(Vtpm::new());
 
 /// Initialize the TPM by calling the init() implementation of the
 /// [`VtpmInterface`]
-pub fn vtpm_init() -> Result<(), SvsmReqError> {
+pub fn vtpm_init(state: Option<Vec<u8>>, key: Option<&[u8]>) -> Result<(), SvsmReqError> {
     let mut vtpm = VTPM.lock();
     if vtpm.is_powered_on() {
         return Ok(());
     }
+    vtpm.set_key(key);
+    vtpm.set_state(state);
     vtpm.init()?;
     Ok(())
 }

kernel/src/vtpm/tcgtpm/mod.rs

@@ -38,13 +38,17 @@ use crate::{
 pub struct TcgTpm {
     is_powered_on: bool,
     ekpub: Option<Vec<u8>>,
+    key: Option<Vec<u8>>,   // This is the kbs secret used to encrypt the state.
+    state: Option<Vec<u8>>, // Persistent state buffer.
 }
 
 impl TcgTpm {
     pub const fn new() -> TcgTpm {
         TcgTpm {
             is_powered_on: false,
             ekpub: None,
+            key: None,
+            state: None,
         }
     }
 
@@ -75,6 +79,20 @@ impl TcgTpm {
             }
         }
     }
+
+    pub fn set_key(&mut self, key: Option<&[u8]>) {
+        self.key = key.map(|k| k.to_vec());
+
+        if self.key.is_some() {
+            log::info!("vTPM: Attestation key has been set and stored.");
+        } else {
+            log::info!("vTPM: Attestation key is not available");
+        }
+    }
+
+    pub fn set_state(&mut self, state: Option<Vec<u8>>) {
+        self.state = state;
+    }
 }
 
 const TPM_CMDS_SUPPORTED: &[TpmPlatformCommand] = &[TpmPlatformCommand::SendCommand];
@@ -196,14 +214,28 @@ impl VtpmInterface for TcgTpm {
         // 5. Power it on indicating it requires startup. By default, OVMF will start
         //    and selftest it.
 
+        let (ptr, size) = match &mut self.state {
+            Some(buf) => (buf.as_mut_ptr() as *mut c_void, buf.len() as u32),
+            None => (VirtAddr::null().as_mut_ptr::<c_void>(), 0),
+        };
+
         // SAFETY: FFI call. Parameters and return values are checked.
-        let mut rc = unsafe { _plat__NVEnable(VirtAddr::null().as_mut_ptr::<c_void>(), 0) };
+        let mut rc = unsafe { _plat__NVEnable(ptr, size as usize) };
         if rc != 0 {
             log::error!("_plat__NVEnable failed rc={rc}");
             return Err(SvsmReqError::incomplete());
         }
 
         rc = self.manufacture(1)?;
+        if rc == 1 {
+            self.signal_poweron(false)?;
+            self.signal_nvon()?;
+            log::info!(
+                "VTPM: TPM 2.0 Reference Implementation successfully restored from persistent state"
+            );
+            return Ok(());
+        }
+
         if rc != 0 {
             // SAFETY: FFI call. Parameter checked, no return value.
             unsafe { _plat__NVDisable(core::ptr::without_provenance_mut::<c_void>(1), 0) };