Skip to content

Support cocoon-tpm's OpenSSL backend #1210

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
osteffenrh wants to merge 13 commits into
base: main
Choose a base branch
from
Open

Support cocoon-tpm's OpenSSL backend #1210

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
c80ca6b
kernel: utils: add static array backed object pool
osteffenrh Sep 16, 2026
ddbb60a
kernel: crypto: refactor RNG pool
osteffenrh Sep 14, 2026
0112fa5
workspace: Bump bindgen to 0.73.2
osteffenrh Oct 1, 2026
0fe11bf
workspace: Bump cocoon-tpm crates to latest version
osteffenrh Sep 16, 2026
d270492
kernel: print cocoon-tpm crypto backend name
osteffenrh Sep 4, 2026
1757f59
workspace: add libcrt from libtcgtpm as its own crate
osteffenrh Sep 16, 2026
e505031
libcrt: add missing visibility pop to match push in libcrt.h
osteffenrh Sep 18, 2026
eb1315a
libcrt: Auto-detect CC cross-build prefix
osteffenrh Sep 30, 2026
c2069d0
libtcgtpm: use libcrt from dedicated crate
osteffenrh Sep 16, 2026
4075e7a
workspace: add cocoon-tpm OpenSSL backend integration lib
osteffenrh Sep 4, 2026
cea1ad0
kernel: crypto: add RNG implementation using OpenSSL
osteffenrh Sep 15, 2026
3acfd20
libtcgtpm: use libcrypto from cocoon-tpm-ossl-bare-sys
osteffenrh Sep 16, 2026
79c1cd0
libtcgtpm: Move cross-compile detection into build.rs
osteffenrh Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions .gitmodules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,3 @@
[submodule "libtcgtpm/deps/openssl"]
path = libtcgtpm/deps/openssl
url = https://github.com/openssl/openssl.git
[submodule "libtcgtpm/deps/tpm-20-ref"]
path = libtcgtpm/deps/tpm-20-ref
url = https://github.com/TrustedComputingGroup/TPM.git
Expand Down
93 changes: 61 additions & 32 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 14 additions & 6 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ members = [
"fuzz",
# ELF loader
"elf",
# Minimal C runtime for freestanding environments
"libcrt",
# TPM 2.0 Reference Implementation library
"libtcgtpm",
# syscall interface definitions
Expand Down Expand Up @@ -60,6 +62,7 @@ svsm = { path = "kernel" }
elf = { path = "elf" }
verus_stub = { path = "verification/verus_stub" }
verus_macro_stub = { path = "verification/verus_macro_stub" }
libcrt = { path = "libcrt" }
libtcgtpm = { path = "libtcgtpm" }
libaproxy = { path = "libaproxy" }
syscall = { path = "syscall" }
Expand All @@ -74,15 +77,16 @@ aes-gcm = { version = "0.10.3", default-features = false }
aes-kw = { version = "0.3.1", default-features = false }
arbitrary = "1.3.0"
base64 = { version = "0.22.1", default-features = false }
bindgen = { version = "0.72.0", default-features = false }
bindgen = { version = "0.73.2", default-features = false }
bitfield-struct = "0.13.0"
bitflags = "2.6"
clap = { version = "4.4.14", default-features = false }
cocoon-tpm-crypto = { version = "0.1.4", default-features = false }
cocoon-tpm-storage = { version = "0.1.4", default-features = false }
cocoon-tpm-tpm2-interface = { version = "0.1.1", default-features = false }
cocoon-tpm-utils-async = { version = "0.1.3", default-features = false }
cocoon-tpm-utils-common = { version = "0.1.3", default-features = false }
cocoon-tpm-crypto = { version = "0.1.5", default-features = false }
cocoon-tpm-ossl-bare-sys = { version = "0.1.1" }
cocoon-tpm-storage = { version = "0.1.5", default-features = false }
cocoon-tpm-tpm2-interface = { version = "0.1.2", default-features = false }
cocoon-tpm-utils-async = { version = "0.1.4", default-features = false }
cocoon-tpm-utils-common = { version = "0.1.4", default-features = false }
concat-kdf = "0.1.0"
gdbstub = { version = "0.7.10", default-features = false }
gdbstub_arch = { version = "0.3.3" }
Expand Down Expand Up @@ -169,3 +173,7 @@ unnecessary_box_returns = "warn"

[workspace.metadata.scripts]
vfmt = "verusfmt `find ./ -name *.verus.rs`"

[patch.crates-io]
# cocoon-tpm OpenSSL backend integration lib for SVSM
cocoon-tpm-ossl-bare-sys-target-integration = { path = "./cocoon-tpm_ossl-bare-sys-target-integration/" }
12 changes: 10 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ XBUILD_ARGS += -f ${FEATURES}
endif

FEATURES_TEST ?= vtpm,block,uefivars,secureboot,enable-console-log,attest
# Doc tests link against the host libc, so exclude features that bring in
# bare-metal C libraries (vtpm → openssl → cocoon-tpm-ossl-bare-sys).
FEATURES_DOC_TEST ?= virtio-drivers,block,vsock,uefivars,secureboot,enable-console-log,attest
SVSM_ARGS_TEST += --no-default-features
ifneq ($(FEATURES_TEST),)
SVSM_ARGS_TEST += --features ${FEATURES_TEST}
Expand Down Expand Up @@ -118,12 +121,17 @@ bin/coconut-test-vanadium.igvm:
cargo xbuild $(XBUILD_ARGS_TEST) ./configs/test/vanadium-test-target.json

test:
cargo test ${CARGO_ARGS} ${SVSM_ARGS_TEST} --package svsm
cargo test ${CARGO_ARGS} ${SVSM_ARGS_TEST} --package svsm --lib
cargo test ${CARGO_ARGS} --no-default-features --features ${FEATURES_DOC_TEST} --package svsm --doc
cargo test ${CARGO_ARGS} --workspace --exclude svsm

miri:
MIRIFLAGS=-Zmiri-permissive-provenance \
cargo +nightly miri test ${CARGO_ARGS} ${SVSM_ARGS_TEST} --package svsm
cargo +nightly miri test ${CARGO_ARGS} ${SVSM_ARGS_TEST} --package svsm --lib
# Doc tests link against the host libc, so exclude features that bring in
# bare-metal C libraries (vtpm → openssl → cocoon-tpm-ossl-bare-sys).
MIRIFLAGS=-Zmiri-permissive-provenance \
cargo +nightly miri test ${CARGO_ARGS} --no-default-features --features ${FEATURES_DOC_TEST} --package svsm --doc
MIRIFLAGS=-Zmiri-permissive-provenance \
Comment thread
osteffenrh marked this conversation as resolved.
cargo +nightly miri test ${CARGO_ARGS} --workspace --exclude svsm

Expand Down
18 changes: 18 additions & 0 deletions cocoon-tpm_ossl-bare-sys-target-integration/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
[package]
name = "cocoon-tpm-ossl-bare-sys-target-integration"
Comment thread
osteffenrh marked this conversation as resolved.
version = "0.1.1"
edition = "2024"

license = "Apache-2.0"
description = "Cocoon TPM project - SVSM ossl-bare-sys integration helper"
homepage = "https://github.com/coconut-svsm/cocoon-tpm"
repository = "https://github.com/coconut-svsm/cocoon-tpm"
readme = "README.md"

links = "ossl-bare-sys-target-integration"

[lints]
workspace = true

[dependencies]
libcrt = { path = "../libcrt" }
Comment thread
osteffenrh marked this conversation as resolved.
Loading
Loading