From patchwork Thu Sep 17 13:46:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sumit Garg X-Patchwork-Id: 11782479 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3BA6B746 for ; Thu, 17 Sep 2020 13:49:02 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id F027821734 for ; Thu, 17 Sep 2020 13:49:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="OcO0uAP/"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="moaySg5d" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org F027821734 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:MIME-Version:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Owner; bh=6HMLA9DXqlII36yte3LYPnc0csbC8U9cB9eM9+Jctz0=; b=OcO0uAP/o2jc0CbiKRmmP+sC7b 4K8Gt3b2hBwYVahhbkjgOXKNPIGx+ZtiFtESMpTkS86OlEwUHMg4+HHgeaXUcueJlj1N9y15sfzv9 BL4+XRzQh1smBKbTH9bVx+aNdRPdDC9Hs3icx26zobg6p89uvR9QOrtlOeMxevH2dWU2lRxvwEKVU 3hgZFizO+9Rr1VIFOxlzZjzM2Krv4nFJuMiFizh+wTv8kh+p0jyyk/Uk2r3fDFNQN6cKjUUduKGFD CmCg4TVfap7cyPrVmYTWaubg/1Dn6XkK8VlerHfgFRB+XQkJ3foKLDiC4Cft8XMssyqH5nOTmwMEF dQ0qXqTQ==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kIuFk-0004u8-UI; Thu, 17 Sep 2020 13:47:12 +0000 Received: from mail-pf1-x443.google.com ([2607:f8b0:4864:20::443]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kIuFi-0004tU-A8 for linux-arm-kernel@lists.infradead.org; Thu, 17 Sep 2020 13:47:11 +0000 Received: by mail-pf1-x443.google.com with SMTP id d9so1253433pfd.3 for ; Thu, 17 Sep 2020 06:47:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=japyhlZJHqjvvY23WBswkoPhDdPOCw8vAFWR64JRMAo=; b=moaySg5dik4Lmk9RXXScA/9T274DPHQu5jVZ1/PZgJaWyJGy2IXTZeDsTOAmWRub7Q xTDMK2BkQ/z+NHQv06RZDa2oi6oALRQvwlBK1ZMpzu0Hjwa58wFxU0qYWhB4Mx3UKhYj XctS3mxqYaT46bZTcV6TAlP4tHHTz6YhhjEnROMaKgQdB2tdhuF+iigcIgdLlDtb1Mpx 1bmXzG/MmuKfrTLTPh0V/VGy5AHsDqhpD9xq8geIeAXbTSIF0AG3QTNVnCpZ/oDy2os5 T/hxpO4wSNhDTccMFo5L5LR8mP4OM8AcLrX0utHb6FG9YAlRrAYhQ8+8QR7wcarNCIhB vTYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=japyhlZJHqjvvY23WBswkoPhDdPOCw8vAFWR64JRMAo=; b=cW3CYVCe70CZjObMiK1LtOJC3rd5JCUGeg/Eb8eVCv+UERKvDyZP++nfdgNHAoH0VW yPlTKQvi0YbQKby89SENxTSuM3L/XgW9A3vGksOg45t2H3lD6vxp6Znv4f1/kIiksLmg 8IydQV6wws/1hwhRRgH9/F9nRUN0zjsKOhmZzYdQ3cglauYzygeUdGeYzNMiCrDRLIGj /uBl3xi5+iFgcTaFMm+JfDw3dCoWfE1G5MWEcCjNve4jPwJZmfDESgXSQlooxRhjDIV3 BsViDK30hede3J49W6Z5OATkz+nFEcUZLGVRDXnadQ1Xv09EjcTtdcS0UdG2U381yHwr Ef0g== X-Gm-Message-State: AOAM531nDgyMVEAGk3IFWa7g+IHqp0VrYE5UtKOmPzGWZTaB67yTAgKu jOAHOnk3ARfdud0JKU62XiTniQ== X-Google-Smtp-Source: ABdhPJwGkICdVHzr7bA01n7thT2TYn0FduI6F4TEUuQvhGZbu4J3IGB6KK7FOQEYljS4a7Z+xROv6w== X-Received: by 2002:a65:408b:: with SMTP id t11mr21151814pgp.199.1600350426605; Thu, 17 Sep 2020 06:47:06 -0700 (PDT) Received: from localhost.localdomain ([117.252.66.163]) by smtp.gmail.com with ESMTPSA id i73sm6821120pfe.67.2020.09.17.06.46.58 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 Sep 2020 06:47:05 -0700 (PDT) From: Sumit Garg To: jarkko.sakkinen@linux.intel.com, zohar@linux.ibm.com, jejb@linux.ibm.com Subject: [PATCH v6 0/4] Introduce TEE based Trusted Keys support Date: Thu, 17 Sep 2020 19:16:34 +0530 Message-Id: <1600350398-4813-1-git-send-email-sumit.garg@linaro.org> X-Mailer: git-send-email 2.7.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200917_094710_645966_5C6B9D93 X-CRM114-Status: GOOD ( 15.13 ) X-Spam-Score: -0.2 (/) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (-0.2 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2607:f8b0:4864:20:0:0:0:443 listed in] [list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-security-module@vger.kernel.org, daniel.thompson@linaro.org, Sumit Garg , op-tee@lists.trustedfirmware.org, corbet@lwn.net, janne.karhunen@gmail.com, linux-doc@vger.kernel.org, jmorris@namei.org, linux-kernel@vger.kernel.org, dhowells@redhat.com, lhinds@redhat.com, keyrings@vger.kernel.org, Markus.Wamser@mixed-mode.de, casey@schaufler-ca.com, linux-integrity@vger.kernel.org, jens.wiklander@linaro.org, linux-arm-kernel@lists.infradead.org, serge@hallyn.com MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org Add support for TEE based trusted keys where TEE provides the functionality to seal and unseal trusted keys using hardware unique key. Also, this is an alternative in case platform doesn't possess a TPM device. This patch-set has been tested with OP-TEE based early TA which is already merged in upstream [1]. [1] https://github.com/OP-TEE/optee_os/commit/f86ab8e7e0de869dfa25ca05a37ee070d7e5b86b Changes in v6: 1. Revert back to dynamic detection of trust source. 2. Drop author mention from trusted_core.c and trusted_tpm1.c files. 3. Rebased to latest tpmdd/master. Changes in v5: 1. Drop dynamic detection of trust source and use compile time flags instead. 2. Rename trusted_common.c -> trusted_core.c. 3. Rename callback: cleanup() -> exit(). 4. Drop "tk" acronym. 5. Other misc. comments. 6. Added review tags for patch #3 and #4. Changes in v4: 1. Pushed independent TEE features separately: - Part of recent TEE PR: https://lkml.org/lkml/2020/5/4/1062 2. Updated trusted-encrypted doc with TEE as a new trust source. 3. Rebased onto latest tpmdd/master. Changes in v3: 1. Update patch #2 to support registration of multiple kernel pages. 2. Incoporate dependency patch #4 in this patch-set: https://patchwork.kernel.org/patch/11091435/ Changes in v2: 1. Add reviewed-by tags for patch #1 and #2. 2. Incorporate comments from Jens for patch #3. 3. Switch to use generic trusted keys framework. Sumit Garg (4): KEYS: trusted: Add generic trusted keys framework KEYS: trusted: Introduce TEE based Trusted Keys doc: trusted-encrypted: updates with TEE as a new trust source MAINTAINERS: Add entry for TEE based Trusted Keys Documentation/security/keys/trusted-encrypted.rst | 203 ++++++++++--- MAINTAINERS | 8 + include/keys/trusted-type.h | 42 +++ include/keys/trusted_tee.h | 55 ++++ include/keys/trusted_tpm.h | 17 +- security/keys/trusted-keys/Makefile | 2 + security/keys/trusted-keys/trusted_core.c | 325 +++++++++++++++++++++ security/keys/trusted-keys/trusted_tee.c | 278 ++++++++++++++++++ security/keys/trusted-keys/trusted_tpm1.c | 336 ++++------------------ 9 files changed, 939 insertions(+), 327 deletions(-) create mode 100644 include/keys/trusted_tee.h create mode 100644 security/keys/trusted-keys/trusted_core.c create mode 100644 security/keys/trusted-keys/trusted_tee.c