Re: [PATCH 0/2] backend/tpm: Resolve issue with TPM 2 DA lockout

[Stefan Berger <stefanb@linux.ibm.com>]

On 5/27/22 15:31, Stefan Berger wrote:
> 
> 
> On 5/27/22 15:24, Marc-André Lureau wrote:
>> Hi
>>
>> On Fri, May 27, 2022 at 7:36 PM Stefan Berger <stefanb@linux.ibm.com> 
>> wrote:
>>>
>>> This series of patches resolves an issue with a TPM 2's dictionary 
>>> attack
>>> lockout logic being triggered upon well-timed VM resets. Normally, 
>>> the OS
>>> TPM driver sends a TPM2_Shutdown to the TPM 2 upon reboot and before 
>>> a VM
>>> is reset. However, the OS driver cannot do this when the user resets 
>>> a VM.
>>> In this case QEMU must send the command because otherwise several well-
>>> timed VM resets will trigger the TPM 2's dictionary attack (DA) logic 
>>> and
>>> it will then refuse to do certain key-related operations until the DA
>>> logic has timed out.
>>
>> How does real hardware deal with that situation? Shouldn't this
>> "shutdown"/reset logic be implemented on swtpm side instead, when
>> CMD_INIT is received? (when the VM is restarted)
> I don't know what real hardware can actually do when the machine is 
> reset, presumably via some reset line, or the power is removed. Probably 
> it has no way to react to this.
> 
> Typically the OS driver has to send the command and since it cannot do 
> this I would defer it to the TPM emulator reset handler code, so the 
> next layer down.

Also, when this is done in QEMU we don't need to do a data channel 
operation (run TPM2_Shutdown) from within the control channel (upon 
CMD_INIT) inside of swtpm. This way we can deal with it properly. The 
usage model for the TPM 2 prescribes that a TPM2_Shutdown must be sent 
before a shutdown or reset of the system, so let's let QEMU do it if the 
OS cannot do it.

> 
> 
> 
>>
>>>
>>> Regards,
>>>    Stefan
>>>
>>> Stefan Berger (2):
>>>    backends/tpm: Record the last command sent to the TPM
>>>    backends/tpm: Send TPM2_Shutdown upon VM reset
>>>
>>>   backends/tpm/tpm_emulator.c | 44 +++++++++++++++++++++++++++++++++++++
>>>   backends/tpm/tpm_int.h      |  3 +++
>>>   backends/tpm/tpm_util.c     |  9 ++++++++
>>>   backends/tpm/trace-events   |  1 +
>>>   include/sysemu/tpm_util.h   |  3 +++
>>>   5 files changed, 60 insertions(+)
>>>
>>> -- 
>>> 2.35.3
>>>
>>