tpm: Virtio tpm device

This CL adds a "tpm" Cargo cfg to crosvm which enables a TPM device
backed by libtpm2 simulator.

Tested by running the following inside cros_sdk:

    LIBRARY_PATH=~/src/minijail LD_LIBRARY_PATH=~/src/minijail \
        cargo run --release \
        --features tpm \
        -- \
        run \
        -r rootfs.ext4 \
        --seccomp-policy-dir seccomp/x86_64/ \
        -p init=/bin/bash \
        -p panic=-1 \
        --disable-sandbox \
        vmlinux.bin

with a Linux image built from CL:1387655.

The TPM self test completes successfully with the following output:

    https://paste.googleplex.com/5996075978588160?raw

Justin's TPM playground runs with the following trace output.

    https://paste.googleplex.com/4909751007707136?raw

Design doc: go/vtpm-for-glinux

TEST=ran TPM playground program inside crosvm
TEST=local kokoro
BUG=chromium:911799

Change-Id: I2feb24a3e38cba91f62c6d2cd1f378de4dd03ecf
Reviewed-on: https://chromium-review.googlesource.com/1387624
Commit-Ready: David Tolnay <dtolnay@chromium.org>
Tested-by: David Tolnay <dtolnay@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>

1 files changed, 34 insertions, 0 deletions

diff --git a/seccomp/x86_64/tpm_device.policy b/seccomp/x86_64/tpm_device.policy
new file mode 100644
index 0000000..0a44ecd
--- /dev/null
+++ b/seccomp/x86_64/tpm_device.policy
@@ -0,0 +1,34 @@
+# Copyright 2018 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+close: 1
+dup: 1
+dup2: 1
+exit_group: 1
+futex: 1
+# Disallow mmap with PROT_EXEC set.  The syntax here doesn't allow bit
+# negation, thus the manually negated mask constant.
+mmap: arg2 in 0xfffffffb
+mprotect: arg2 in 0xfffffffb
+# Allow MADV_DONTDUMP only.
+madvise: arg2 == 0x00000010
+munmap: 1
+read: 1
+recvfrom: 1
+sched_getaffinity: 1
+set_robust_list: 1
+sigaltstack: 1
+# Disallow clone's other than new threads.
+clone: arg0 & 0x00010000
+write: 1
+eventfd2: 1
+poll: 1
+ppoll: 1
+getpid: 1
+# Allow PR_SET_NAME only.
+prctl: arg0 == 15
+restart_syscall: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1