vtpm: Add runtime re-seal hook and NV-block persistence

Adds a runtime re-seal path that fires on a successful guest
TPM2_Shutdown (cmdCode 0x145, rc=0) and the supporting Tier-2
NV-block extraction needed to round-trip the simulator's persistent
state across a cold boot.

  * libtcgtpm: expose get_nv_blob() / apply_nv_blob() accessors so
    the in-process TPM Reference Implementation's 16 KiB NV image
    (STATE_NV_BACKUP_SIZE) can be captured at re-seal time and
    replayed on Recover. The bulk serialization wrapper grows a new
    tagged section (0x12) that carries the NV blob alongside the
    existing gp/gc/gr globals.

  * vtpm::reseal: new module hosting trigger_if_shutdown() and
    do_reseal(). The hook is invoked from TcgTpm::send_tpm_command
    *outside* the VTPM SpinLock — re-seal talks to the TPM endpoint
    through a separate TpmProxy<VsockTransport> and reads internal
    state through the libtcgtpm C FFI, so it never re-acquires VTPM.
    Re-seal failures are logged but never propagated to the guest;
    fail-closed enforcement remains on the next cold-boot unseal
    path (NV-counter check + AES-GCM tag verify).

  * vtpm::mod / svsm: wire the optional vtpm-persist feature so the
    TPM endpoint and host blob store can be reached over VSOCK
    during cold-boot Provision/Recover and runtime re-seal. The
    persistence path is opt-in and never silently falls back to
    ephemeral — an unreachable endpoint is a hard error so the
    security model that treats the physical TPM as a separate root
    of trust cannot be downgraded by a channel-only attacker.

  * cpu::apic / sev::snp_apic: convert the previously panicking
    icr_write() to a logged warning so a transient HV write error
    on the persistence path does not crash the boot CPU.

Signed-off-by: Goodleon-Y <goodleon3@126.com>

Author: Goodleon-Y

configs/qemu-target.json

@@ -14,7 +14,7 @@
     },
     "kernel": {
         "svsm": {
-            "features": "vtpm",
+            "features": "vtpm,virtio-drivers,vsock",
             "binary": false
         },
         "bldr": {

kernel/Cargo.toml

@@ -81,6 +81,26 @@ virtio-drivers = ["dep:virtio-drivers"]
 block = []
 vsock = []
 
+# Persistent vTPM via TPM-sealing of internal state to an off-CVM TPM
+# endpoint (research extension; mainline behaviour preserved when off).
+#
+# When OFF (default): the `vtpm` feature provides the standard ephemeral
+# vTPM that the mainline COCONUT-SVSM tree exposes — each cold boot
+# re-manufactures the simulator and produces a fresh EK/SRK/IAK.
+#
+# When ON: svsm.rs drives the Provision/Recover seal cycle through a
+# `VsockTransport`/`VsockHostStore` pair. The host helper (TPM endpoint
+# on a VSOCK port + blob store on two VSOCK ports) must be reachable;
+# unreachable endpoints are a fatal error, not a silent fallback,
+# because silent fallback would weaken the security model that treats
+# the physical TPM as a separate root of trust from the platform.
+#
+# Transport / store backends are currently fixed to VSOCK because that
+# is the only supported channel between an SEV-SNP CVM and a host-side
+# TPM endpoint; the `TpmTransport` and `SealedBlobStore` traits keep
+# the door open for future block-layer or KBS backends.
+vtpm-persist = ["vtpm", "vsock"]
+
 [dev-dependencies]
 sha2 = { workspace = true, features = ["force-soft"] }
 

kernel/src/cpu/x86/apic.rs

@@ -157,9 +157,9 @@ impl X86Apic {
     /// - `icr` - Value to write to the ICR register
     #[inline(always)]
     pub fn icr_write(&self, icr: u64) {
-        self.regs()
-            .icr_write(icr)
-            .expect("Failed to write APIC.ICR");
+        if let Err(e) = self.regs().icr_write(icr) {
+            log::warn!("Failed to write APIC.ICR: {e:?}");
+        }
     }
 
     /// Checks whether an IRQ vector is currently in service

kernel/src/sev/snp_apic.rs

@@ -65,15 +65,18 @@ impl ApicAccess for GHCBApicAccessor {
     }
 
     fn icr_write(&self, icr: u64) -> Result<(), SvsmError> {
-        // The #HV IPI can only be used if restricted injection is supported.
-        // Otherwise, the IPI must be sent via an X2APIC ICR write.
-        if self.use_restr_inj() {
-            current_ghcb().hv_ipi(icr)?;
-        } else {
-            self.apic_write(APIC_OFFSET_ICR, icr);
+        // HV_IPI (GHCB exit 0x0015) is a base SEV-ES protocol feature and
+        // does not require restricted injection. KVM rejects direct WRMSR to
+        // the x2APIC ICR MSR (0x830) via the GHCB MSR protocol (error 2),
+        // so HV_IPI is the only reliable path.
+        match current_ghcb().hv_ipi(icr) {
+            Ok(()) => Ok(()),
+            Err(_) => {
+                // Fallback: try direct MSR write if HV_IPI is unsupported
+                self.apic_write(APIC_OFFSET_ICR, icr);
+                Ok(())
+            }
         }
-
-        Ok(())
     }
 
     fn eoi(&self) {

kernel/src/svsm.rs

@@ -72,16 +72,20 @@ use svsm::utils::ScopedMut;
 use svsm::utils::round_to_pages;
 #[cfg(all(feature = "virtio-drivers", any(feature = "block", feature = "vsock")))]
 use svsm::virtio::probe_mmio_slots;
-#[cfg(all(feature = "vtpm", not(feature = "vsock"), not(test)))]
+#[cfg(all(feature = "vtpm-persist", not(feature = "vsock"), not(test)))]
 use svsm::vtpm::MockTransport;
-#[cfg(all(feature = "vtpm", feature = "vsock", not(test)))]
+#[cfg(all(feature = "vtpm-persist", feature = "vsock", not(test)))]
 use svsm::vtpm::VsockTransport;
-#[cfg(all(feature = "vtpm", not(test)))]
-use svsm::vtpm::{SealedBlobStore, StaticBufStore, VtpmBootMode, vtpm_init_sealed};
-#[cfg(all(feature = "vtpm", feature = "vsock", not(test)))]
+#[cfg(all(feature = "vtpm", not(feature = "vtpm-persist"), not(test)))]
+use svsm::vtpm::vtpm_init;
+#[cfg(all(feature = "vtpm-persist", not(test)))]
+use svsm::vtpm::{SealedBlobStore, VsockHostStore, VtpmBootMode, vtpm_init_sealed};
+#[cfg(all(feature = "vtpm-persist", feature = "vsock", not(test)))]
 use svsm::vtpm::{VSOCK_HOST_CID, VSOCK_TPM_PORT};
 
 use alloc::string::String;
+#[cfg(all(feature = "vtpm-persist", not(test)))]
+use alloc::vec::Vec;
 use release::COCONUT_VERSION;
 
 #[cfg(feature = "attest")]
@@ -576,40 +580,56 @@ fn svsm_init(launch_info: &KernelLaunchInfo) {
         log::info!("attestation successful");
     }
 
-    #[cfg(all(feature = "vtpm", not(test)))]
+    // Mainline COCONUT-SVSM behaviour: ephemeral vTPM, no external
+    // dependencies, fresh seeds on every cold boot. This is the path
+    // upstream consumers get and the one preserved across the
+    // `vtpm-persist` feature being off.
+    #[cfg(all(feature = "vtpm", not(feature = "vtpm-persist"), not(test)))]
     {
-        // SealedBlob persistence is driven through the `SealedBlobStore`
-        // trait so that the same code path can target any backend
-        // (warm-reboot static buffer for dev/test, IGVM variable, the
-        // upcoming SVSM block layer, KBS-stateful vTPM service, ...).
-        // The default in this tree is the static buffer backend, which
-        // survives warm reboots within a single CVM lifetime.
-        static SEALED_BLOB_STORE: StaticBufStore = StaticBufStore::new();
-        let store: &dyn SealedBlobStore = &SEALED_BLOB_STORE;
-
-        let blob_opt = store.load().expect("SealedBlobStore::load failed");
+        vtpm_init().expect("vtpm_init failed");
+        log::info!("VTPM: ephemeral init complete");
+    }
+
+    // Persistent vTPM path — opt-in via the `vtpm-persist` feature.
+    // Drives the Provision/Recover seal cycle against an off-CVM TPM
+    // endpoint (transport) and host-side blob store, both currently
+    // reached over VSOCK. The host helper must be reachable: a
+    // missing/unreachable endpoint is a hard error, NOT a silent
+    // fallback to ephemeral — silently downgrading would void the
+    // security model the seal cycle promises, which treats the
+    // physical TPM as a separate root of trust (an attacker who can
+    // break the VSOCK channel would otherwise harvest a fresh vTPM
+    // identity by triggering the fallback).
+    #[cfg(all(feature = "vtpm-persist", not(test)))]
+    {
+        let store = VsockHostStore::new(
+            VSOCK_HOST_CID,
+            VsockHostStore::DEFAULT_LOAD_PORT,
+            VsockHostStore::DEFAULT_SAVE_PORT,
+        );
+
+        let blob_opt = store
+            .load()
+            .expect("VTPM: sealed-store load failed (host helper unreachable?)");
         let (boot_mode, blob_slice) = match blob_opt.as_deref() {
             Some(b) => (VtpmBootMode::Recover, Some(b)),
             None => (VtpmBootMode::Provision, None),
         };
 
         let vm_id: [u8; 16] = [0u8; 16]; // TODO: derive from IGVM guest_context
 
-        #[cfg(feature = "vsock")]
         let transport = VsockTransport::new(VSOCK_HOST_CID, VSOCK_TPM_PORT);
-        #[cfg(not(feature = "vsock"))]
-        let transport = {
-            log::warn!("VTPM: no VSOCK, using MockTransport (debug only)");
-            MockTransport::new()
-        };
 
-        let maybe_blob = vtpm_init_sealed(transport, boot_mode, vm_id, blob_slice)
-            .expect("vTPM sealed init failed");
+        // R1: vtpm_init_sealed now uses an out-param for the Vec<u8>; its
+        // return type is the register-passable `Result<(), SvsmReqError>`.
+        let mut maybe_blob: Option<Vec<u8>> = None;
+        vtpm_init_sealed(transport, boot_mode, vm_id, blob_slice, &mut maybe_blob)
+            .expect("VTPM: sealed init failed (host TPM endpoint unreachable?)");
 
         if let Some(blob_bytes) = maybe_blob {
             store
                 .save(&blob_bytes)
-                .expect("SealedBlobStore::save failed");
+                .expect("VTPM: sealed-store save failed");
             log::info!(
                 "VTPM: SealedBlob ({} bytes) stored for next boot",
                 blob_bytes.len()