Page MenuHomeFreeBSD
Differential D59322

bhyve: reinitialise swtpm's TPM at startup
Needs ReviewPublic
Actions

Authored by quentin.thebault_defenso.fr on Wed, Sep 2, 1:47 PM.
Tags
None
Referenced Files
F170719811: D59322.diff
Sun, Sep 6, 5:11 AM
F170716460: D59322.diff
Sun, Sep 6, 4:42 AM
F170631892: D59322.id.diff
Sat, Sep 5, 5:46 PM
F170625263: D59322.id185622.diff
Sat, Sep 5, 5:02 PM
Unknown Object (File)
Fri, Sep 4, 6:58 PM
Unknown Object (File)
Fri, Sep 4, 5:52 PM
Unknown Object (File)
Fri, Sep 4, 4:42 PM
Unknown Object (File)
Fri, Sep 4, 5:59 AM
View All 13 Files
Subscribers
bcran
imp
kevans
rgrimes
ziaee

Details

Reviewers
corvink
Group Reviewers
bhyve
Summary

bhyve does not currently reinitialise swtpm on startup, which results in
PCRs being carried over across reboots. This means that any guest VM
implementing measured boot controls, such as Windows with BitLocker and
Secure Boot enabled, will consider the system compromised and refuse to
start or ask for a recovery key.

swtpm has a control channel that allows us to send commands for that
purpose: CMD_INIT shuts the TPM down and starts it again. When swptpm
has been configured with flags startup-clear, it clears the PCRs, like a
cold boot on real hardware.

Connect a second socket when the new ctrl_path option is set and send
CMD_INIT there. Without the option nothing changes.

MFC after: 2 weeks
Sponsored by: Defenso

Signed-off-by: Quentin Thébault <quentin.thebault@defenso.fr>

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 76405
Build 73288: arc lint + arc unit

Event Timeline

quentin.thebault_defenso.fr created this revision.Wed, Sep 2, 1:47 PM
Herald added a reviewer: bhyve. · View Herald TranscriptWed, Sep 2, 1:47 PM
Herald added subscribers: ziaee, bcran, rgrimes, imp. · View Herald Transcript
quentin.thebault_defenso.fr requested review of this revision.Wed, Sep 2, 1:47 PM
Harbormaster completed remote builds in B76405: Diff 185622.Wed, Sep 2, 1:47 PM
kevans added a subscriber: kevans.Wed, Sep 2, 5:59 PM
kevans added inline comments.
usr.sbin/bhyve/bhyve.8
853

New sentence must begin on a new line

usr.sbin/bhyve/tpm_emul_swtpm.c
38

This doesn't seem to need __packed, 2x uint32_t lines up nicely to avoid padding.

56

It's maybee worth checking for truncation here so that you can provide a better error than 'unable to conect'

66

I guess this will get optimized away anyways, but here and below: 0 is the same in every byte order, no?

72

Not so sure about EFAULT here? That seems like it might be misleading- maybe better to just preserve errno befofre warnx and return that?

quentin.thebault_defenso.fr marked 3 inline comments as done.Thu, Sep 3, 9:24 AM
quentin.thebault_defenso.fr added inline comments.
usr.sbin/bhyve/tpm_emul_swtpm.c
72

That is how those errors are processed in the existing
tpm_swtpm_execute_cmd function a bit below. Should I correct both?

quentin.thebault_defenso.fr updated this revision to Diff 185701.Thu, Sep 3, 2:19 PM

Remove unnecessary bits and improve error management for strlcpy and send/recv functions (incl. on existing code for harmonization).

Harbormaster completed remote builds in B76425: Diff 185701.Thu, Sep 3, 2:19 PM
quentin.thebault_defenso.fr marked 2 inline comments as done.Thu, Sep 3, 2:20 PM

Revision Contents
Changeset List

PathSize
usr.sbin/
bhyve/
23 lines
75 lines

Diff 185622

View Options

usr.sbin/bhyve/bhyve.8

Loading...
View Options

usr.sbin/bhyve/tpm_emul_swtpm.c

Loading...