Re: question on vTPM interface in coconut-svsm

[James Bottomley <jejb@linux.ibm.com>]

On Thu, 2024-03-28 at 14:41 +0100, Jeremi Piotrowski wrote:
> On 28/03/2024 13:33, James Bottomley wrote:
> > On Thu, 2024-03-28 at 13:22 +0100, Jeremi Piotrowski wrote:
> > [...]
> > > Azure ships the configuration described above for SEV-SNP (and
> > > TDX).
> > > The TPM is implemented in an "SVSM"(paravisor), exposed through
> > > TPM
> > > CRB MMIO. The kernel has a callback informing ioremap which MMIO
> > > addresses should be considered shared/private [1]. This is the
> > > Hyper-
> > > v implementation of that callback: [2].
> > > 
> > > So it can work if you detect it like this:
> > > 
> > > if (SEV_SNP_GUEST && SVSM_PRESENT && SVSM_PROVIDES_VTPM)
> > >    // vtpm should be mapped private
> > 
> > Well, yes, it's pretty much identical to the detection mechanism
> > used
> > to activate the platform TPM driver:
> > 
> > https://lore.kernel.org/all/83bcfc398d885f9e42d5aae42359fe02ab12d306.camel@linux.ibm.com/
> > 
> > The SVSM_PROVIDES_VTPM is actually a dynamic probe to find the vTPM
> > protocol inside the SVSM.
> > 
> > So what's the mechanism hyper-v uses to start a CRB command?
> > 
> > James
> > 
> 
> Do you mean start method? The VTPM uses ACPI_TPM2_COMMAND_BUFFER, the
> guest sees a TPM2 ACPI table, maps the control address as private and
> then the tpm_crb driver just works.

Not without help.  The usual method of starting a CRB command is to
write the command buffer and length into the CRB registers and then set
the start bit (a real CRB device monitors the control area).  Since
they're all in the same page, you can emulate what a real device does
by unmapping this area in the guest kernel and getting the SVSM to
intercept the writes, in which case you see a lot to fix up and quite a
number of VMEXITs per command, or you can ignore this region and use
some type of ASL start mechanism instead, which means only one VMEXIT.
What does hyper-v do?

James