vtpm/svsm: Wire TPM-rooted persistence boot mode

Wires the seal/unseal lifecycle into kernel init using the previously
added components:

  * Adds VtpmBootMode (Provision/Recover) and vtpm_init_sealed<T>
    in vtpm/mod.rs. Provision manufactures the vTPM, extracts the
    serialized internal state, AES-256-GCMs it, TPM2_Seals the 60-byte
    key bundle and returns a SealedBlob ready for storage. Recover
    reverses the operation: unpack -> TPM2_Unseal -> AES decrypt ->
    inject_serialized_state -> light power-on.

  * Replaces the previous `static mut SEALED_BLOB_BUF: [u8; 4096]`
    scaffolding in svsm.rs with a `&dyn SealedBlobStore` wired through
    StaticBufStore. Whether the blob comes from a static buffer (test),
    an IGVM variable (production), or a vsock-backed host helper is now
    a backend selection rather than a code change.

Entropy comes from RDSEED inside the CVM; key material is zeroized
after the sealing step via volatile writes.

The boot integration is intentionally kept narrow so that a future
user-mode vTPM placement (per the upstream "Move vTPM to user-mode"
plan) can reuse the same persistence trait by selecting a different
SealedBlobStore impl.

Signed-off-by: Goodleon-Y <goodleon3@126.com>

Author: Goodleon-Y

kernel/src/svsm.rs

@@ -72,8 +72,14 @@ use svsm::utils::ScopedMut;
 use svsm::utils::round_to_pages;
 #[cfg(all(feature = "virtio-drivers", any(feature = "block", feature = "vsock")))]
 use svsm::virtio::probe_mmio_slots;
+#[cfg(all(feature = "vtpm", not(feature = "vsock"), not(test)))]
+use svsm::vtpm::MockTransport;
+#[cfg(all(feature = "vtpm", feature = "vsock", not(test)))]
+use svsm::vtpm::VsockTransport;
 #[cfg(all(feature = "vtpm", not(test)))]
-use svsm::vtpm::vtpm_init;
+use svsm::vtpm::{SealedBlobStore, StaticBufStore, VtpmBootMode, vtpm_init_sealed};
+#[cfg(all(feature = "vtpm", feature = "vsock", not(test)))]
+use svsm::vtpm::{VSOCK_HOST_CID, VSOCK_TPM_PORT};
 
 use alloc::string::String;
 use release::COCONUT_VERSION;
@@ -553,7 +559,47 @@ fn svsm_init(launch_info: &KernelLaunchInfo) {
     }
 
     #[cfg(all(feature = "vtpm", not(test)))]
-    vtpm_init().expect("vTPM failed to initialize");
+    {
+        // SealedBlob persistence is driven through the `SealedBlobStore`
+        // trait so that the same code path can target any backend
+        // (warm-reboot static buffer for dev/test, IGVM variable, the
+        // upcoming SVSM block layer, KBS-stateful vTPM service, ...).
+        // The default in this tree is the static buffer backend, which
+        // survives warm reboots within a single CVM lifetime.
+        static SEALED_BLOB_STORE: StaticBufStore = StaticBufStore::new();
+        let store: &dyn SealedBlobStore = &SEALED_BLOB_STORE;
+
+        let blob_opt = store.load().expect("SealedBlobStore::load failed");
+        let (boot_mode, blob_slice) = match blob_opt.as_deref() {
+            Some(b) => (VtpmBootMode::Recover, Some(b)),
+            None => (VtpmBootMode::Provision, None),
+        };
+
+        let vm_id: [u8; 16] = [0u8; 16]; // TODO: derive from IGVM guest_context
+
+        #[cfg(feature = "vsock")]
+        let transport = VsockTransport::new(VSOCK_HOST_CID, VSOCK_TPM_PORT);
+        #[cfg(not(feature = "vsock"))]
+        let transport = {
+            log::warn!("VTPM: no VSOCK, using MockTransport (debug only)");
+            MockTransport::new()
+        };
+
+        let maybe_blob = vtpm_init_sealed(transport, boot_mode, vm_id, blob_slice)
+            .expect("vTPM sealed init failed");
+
+        if let Some(blob_bytes) = maybe_blob {
+            store
+                .save(&blob_bytes)
+                .expect("SealedBlobStore::save failed");
+            log::info!(
+                "VTPM: SealedBlob ({} bytes) stored for next boot",
+                blob_bytes.len()
+            );
+        }
+
+        log::info!("VTPM: sealed init complete (mode={boot_mode:?})");
+    }
 
     virt_log_usage();
 

kernel/src/vtpm/mod.rs

@@ -105,6 +105,20 @@ pub trait VtpmInterface: TcgTpmSimulatorInterface {
     fn get_ekpub(&mut self) -> Result<Vec<u8>, SvsmReqError>;
 }
 
+/// vTPM boot mode driving the persistence cycle.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum VtpmBootMode {
+    /// First boot: manufacture vTPM, extract internal state, seal to the
+    /// external TPM, return the sealed blob for host-side storage.
+    Provision,
+    /// Subsequent boot: unseal the sealed blob, inject state, light power-on.
+    Recover,
+}
+
+/// VSOCK addressing for the host-side TPM endpoint.
+pub const VSOCK_HOST_CID: u32 = 2;
+pub const VSOCK_TPM_PORT: u32 = 9999;
+
 static VTPM: SpinLock<Vtpm> = SpinLock::new(Vtpm::new());
 
 /// Initialize the TPM by calling the init() implementation of the
@@ -118,6 +132,180 @@ pub fn vtpm_init() -> Result<(), SvsmReqError> {
     Ok(())
 }
 
+/// vTPM initialization with seal/unseal integration.
+///
+/// Provision mode: manufacture vTPM, extract internal state, AES-256-GCM
+/// encrypt, TPM2_Seal the key bundle, return the packed SealedBlob bytes.
+/// Recover mode: unpack the SealedBlob, TPM2_Unseal the key bundle, AES
+/// decrypt, inject internal state, perform a light power-on.
+pub fn vtpm_init_sealed<T: TpmTransport>(
+    transport: T,
+    mode: VtpmBootMode,
+    vm_id: [u8; 16],
+    sealed_blob_data: Option<&[u8]>,
+) -> Result<Option<Vec<u8>>, SvsmReqError> {
+    let mut vtpm = VTPM.lock();
+    if vtpm.is_powered_on() {
+        return Ok(None);
+    }
+
+    let mut proxy = TpmProxy::new(transport);
+
+    match mode {
+        VtpmBootMode::Provision => {
+            vtpm.init()?;
+            log::info!("VTPM: manufactured (Provision mode)");
+
+            // Bulk-serialize the TPM internal state (seeds, PCR save area,
+            // auth values, counters) into an opaque byte buffer. This is
+            // round-tripped via inject_serialized_state() on Recover.
+            let serialized = state::extract_serialized_state()?;
+            log::info!(
+                "VTPM: internal state extracted ({} bytes)",
+                serialized.len()
+            );
+
+            let vtpm_state = VtpmState {
+                ek_priv: Vec::new(),
+                ek_pub: vtpm.get_ekpub()?,
+                srk_priv: Vec::new(),
+                srk_pub: Vec::new(),
+                owner_auth: [0u8; 32],
+                endorsement_auth: [0u8; 32],
+                lockout_auth: [0u8; 32],
+                nv_data: Vec::new(),
+                nv_counter: 0,
+                platform_auth: [0u8; 32],
+                extra: serialized,
+            };
+
+            let (aes_key, nonce) = platform_entropy()?;
+            let blob = sealed::seal_state(&mut proxy, &vtpm_state, vm_id, &aes_key, &nonce)
+                .map_err(|_| SvsmReqError::invalid_request())?;
+            zeroize_key_material(&aes_key, &nonce);
+
+            log::info!(
+                "VTPM: state sealed to TPM (counter={}, enc_size={})",
+                blob.counter,
+                blob.encrypted_data.len()
+            );
+
+            proxy.flush_primary();
+            Ok(Some(blob.pack()))
+        }
+
+        VtpmBootMode::Recover => {
+            let blob_data = sealed_blob_data.ok_or_else(|| {
+                log::error!("VTPM: Recover mode requires sealed_blob_data");
+                SvsmReqError::invalid_request()
+            })?;
+
+            let blob = SealedBlob::unpack(blob_data).map_err(|_| {
+                log::error!("VTPM: failed to unpack SealedBlob");
+                SvsmReqError::invalid_request()
+            })?;
+
+            log::info!("VTPM: SealedBlob loaded (counter={})", blob.counter);
+
+            let vtpm_state = sealed::unseal_state(&mut proxy, &blob).map_err(|_| {
+                log::error!("VTPM: unseal_state failed");
+                SvsmReqError::invalid_request()
+            })?;
+
+            proxy.flush_primary();
+
+            // Inject the serialized internal state back into the TPM via the
+            // C-side bulk deserializer.
+            state::inject_serialized_state(&vtpm_state.extra).map_err(|_| {
+                log::error!("VTPM: inject_serialized_state failed");
+                SvsmReqError::invalid_request()
+            })?;
+
+            log::info!("VTPM: internal state injected");
+
+            vtpm.signal_poweron(false)?;
+            vtpm.signal_nvon()?;
+
+            log::info!(
+                "VTPM: state recovered from TPM seal (counter={})",
+                blob.counter
+            );
+
+            Ok(None)
+        }
+    }
+}
+
+/// Generate an AES-256 key and a GCM nonce from the platform entropy source
+/// (RDSEED).
+fn platform_entropy() -> Result<([u8; 32], [u8; 12]), SvsmReqError> {
+    let mut key = [0u8; 32];
+    let mut nonce = [0u8; 12];
+
+    // SAFETY: `_rdseed64_step` is a CPU intrinsic with no memory side-effects
+    // beyond the pointed-to u64; pointers come from properly aligned slices.
+    unsafe {
+        for i in 0..4 {
+            let mut retries = 0;
+            loop {
+                if core::arch::x86_64::_rdseed64_step(
+                    &mut *(key[i * 8..][..8].as_mut_ptr() as *mut u64),
+                ) == 1
+                {
+                    break;
+                }
+                retries += 1;
+                if retries > 100 {
+                    return Err(SvsmReqError::invalid_request());
+                }
+                core::arch::x86_64::_mm_pause();
+            }
+        }
+        let mut retries = 0;
+        loop {
+            if core::arch::x86_64::_rdseed64_step(&mut *(nonce[..8].as_mut_ptr() as *mut u64)) == 1
+            {
+                break;
+            }
+            retries += 1;
+            if retries > 100 {
+                return Err(SvsmReqError::invalid_request());
+            }
+            core::arch::x86_64::_mm_pause();
+        }
+        let mut retries = 0;
+        loop {
+            if core::arch::x86_64::_rdseed64_step(&mut *(nonce[8..].as_mut_ptr() as *mut u64)) == 1
+            {
+                break;
+            }
+            retries += 1;
+            if retries > 100 {
+                return Err(SvsmReqError::invalid_request());
+            }
+            core::arch::x86_64::_mm_pause();
+        }
+    }
+
+    Ok((key, nonce))
+}
+
+/// Zeroize key material in-place using volatile writes.
+fn zeroize_key_material(aes_key: &[u8; 32], nonce: &[u8; 12]) {
+    // SAFETY: volatile writes into stack-owned arrays whose lifetimes are
+    // still live; pointers are valid for `write_volatile` and within bounds.
+    unsafe {
+        let key_ptr = aes_key.as_ptr() as *mut u8;
+        for i in 0..32 {
+            key_ptr.add(i).write_volatile(0);
+        }
+        let nonce_ptr = nonce.as_ptr() as *mut u8;
+        for i in 0..12 {
+            nonce_ptr.add(i).write_volatile(0);
+        }
+    }
+}
+
 pub fn vtpm_get_locked<'a>() -> LockGuard<'a, Vtpm> {
     VTPM.lock()
 }
@@ -128,3 +316,13 @@ pub fn vtpm_get_manifest() -> Result<Vec<u8>, SvsmReqError> {
     let mut vtpm = VTPM.lock();
     vtpm.get_ekpub()
 }
+
+// Re-export sealed/proxy/state types for use by kernel init (svsm.rs)
+#[cfg(feature = "vsock")]
+pub use proxy::VsockTransport;
+pub use proxy::{MockTransport, TpmProxy, TpmTransport};
+pub use sealed::{SealedBlob, VtpmState};
+#[cfg(feature = "vsock")]
+pub use sealed_store::VsockHostStore;
+pub use sealed_store::{IgvmVarStore, SealedBlobStore, StaticBufStore};
+pub use state::VtpmInternalState;