Re: SVSM vTPM specification

[James Bottomley <jejb@linux.ibm.com>]

On Wed, 2022-10-12 at 18:33 +0100, Dr. David Alan Gilbert wrote:
> * Tom Lendacky (thomas.lendacky@amd.com) wrote:
[...]
> > For the TPM, is it enough to emulate the TPM device register space?
> > Rather than using a PCI BAR or an ACPI memory resource address,
> > could the vTPM driver replicate the TPM register space in ordinary
> > memory for the SVSM to process? Should this memory come from the
> > SVSM or from the guest?

To emulate an existing TPM device, you'd also have to emulate its
discovery mechanism (traditionally ACPI for the CRB TPM).  If you don't
do that you might as well invent a completely new mechanism that suits
the SVSM but requires a new driver.

> > Or is there a better, more efficient method that can be used to
> > perform TPM operations? What would that look like?
> 
> Can we make this look as close to the TPM CRB as possible; from
> discussions with others it looks clear something extra is needed; but
> I don't see the reason to be too inventive.

It is theoretically possible to emulate a CRB TPM with just a single
communication page and an ACPI entry (the Linux CRB driver is ACPI only
at this time and responds to the "MSFT0101" ACPI entry).

The CRB device responds to a very compact MMIO region (0x30 bytes long)
described in the CRB spec:

https://trustedcomputinggroup.org/resource/tpm-2-0-mobile-command-response-buffer-interface-specification/

In theory we could use a page that keeps trapping to the SVSM for this,
but the problem is that the CRB driver polls a register in the MMIO
region to check command completion, so even a single TPM command is
going to generate a huge number of such traps.  So while it's
theoretically possible to generate a SVSM emulation of the CRB device,
it would likely be too expensive in terms of traps, particularly if
we're using the SVSM vTPM for runtime measurements like IMA.

If we're going to do a new driver, I think basing it off the CRB spec
would be fine (the spec envisages command request/response being via
areas outside the MMIO region) and we could simply do a new driver that
plumbs directly into the nine operations in the tpm_class_ops structure

James