microvm: storageVM encryption support for all VMs

[hros-tii]

Description of Changes

This commit adds two methods to provide a TPM to a microvm:

1. passthrough of the host TPM or,
2. emulated TPM hosted in admin VM. The default configuration enables the passthrough for the system VMs and the emulation for app VMs.

MicroVMs have a new option: storagevm.encryption.enable. When this is set, the persistent storage is backed by a disk image instead of a virtiofs mapped directory. The disk image is encrypted inside the VM using the TPM device available to the VM (through one of the 2 methods) and decrypted when the VM boots.

The host option virtualization.storagevm-encryption.enable enables the encrypted storage for all the VMs.

Type of Change

• New Feature
• Bug Fix
• Improvement / Refactor

Checklist

• Clear summary in PR description
• Detailed and meaningful commit message(s)
• Commits are logically organized and squashed if appropriate
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• Author has run make-checks and it passes
• All automatic GitHub Action checks pass - see actions
• Author has added reviewers and removed PR draft status
• Tested on Lenovo X1 x86_64 Gen11

Testing Instructions

Applicable Targets

• Orin AGX aarch64
• Orin NX aarch64
• Lenovo X1 x86_64
• Dell Latitude x86_64
• System 76 x86_64

Installation Method

/!\ Before flashing, reset the TPM in the BIOS /!\

1. Press F1 on splash screen to open BIOS
2. Go to Security > Security Chip
3. Select Clear Security Chip

• Requires full re-installation
• Can be updated with nixos-rebuild ... switch
• Other:

Test Steps To Verify:

1. Build lenovo-x1-extras-debug target.
2. Build and flash on Lenovo X1 laptop
3. SSH into a system VM (ex: admin-vm)
4. The VM should have a TPM device:

[ghaf@admin-vm:~]$ ls /dev/tpm*
/dev/tpm0  /dev/tpmrm0

5. Run lsblk to verify that the guestStorage partition is encrypted:

[ghaf@admin-vm:~]$ lsblk
NAME     MAJ:MIN RM SIZE RO TYPE  MOUNTPOINTS
vda      253:0    0  10G  0 disk
└─vmdata 254:0    0  10G  0 crypt /etc/timezone.conf
                                  /etc/locale-givc.conf
                                  /guestStorage/var/lib/nixos/shadow
                                  /var/lib/nixos/shadow

6. SSH into an application VM (ex: chrome-vm)
7. Same verifications as step 4 and 5

[mbssrc]

Great work! For testing, we should include performance and boot-time tests

[milva-unikie]

Tested on lenovo-x1-extras-debug
(Reset the TPM in the BIOS before testing)

• All VMs (except ids-vm) have a TPM device.
• All VMs (except ids-vm & zathura-vm) have an encrypted guestStorage partition.
• Performance results seem to be okay. We don't do regular testing with the extras image so it is a bit difficult to compare. The extras image has a longer boot time than the lenovo-x1-carbon-gen11-debug image but that is also the case with the mainline extras image.