Add support for TEE based trusted keys where TEE provides the functionality
to seal and unseal trusted keys using hardware unique key. Also, this is
an alternative in case platform doesn't possess a TPM device.
This patch-set has been tested with OP-TEE based early TA which is already
merged in upstream [1].
[1] https://github.com/OP-TEE/optee_os/commit/f86ab8e7e0de869dfa25ca05a37ee070d…
Changes in v8:
1. Added static calls support instead of indirect calls.
2. Documented trusted keys source module parameter.
3. Refined patch #1 commit message discription.
4. Addressed misc. comments on patch #2.
5. Added myself as Trusted Keys co-maintainer instead.
6. Rebased to latest tpmdd master.
Changes in v7:
1. Added a trusted.source module parameter in order to enforce user's
choice in case a particular platform posses both TPM and TEE.
2. Refine commit description for patch #1.
Changes in v6:
1. Revert back to dynamic detection of trust source.
2. Drop author mention from trusted_core.c and trusted_tpm1.c files.
3. Rebased to latest tpmdd/master.
Changes in v5:
1. Drop dynamic detection of trust source and use compile time flags
instead.
2. Rename trusted_common.c -> trusted_core.c.
3. Rename callback: cleanup() -> exit().
4. Drop "tk" acronym.
5. Other misc. comments.
6. Added review tags for patch #3 and #4.
Changes in v4:
1. Pushed independent TEE features separately:
- Part of recent TEE PR: https://lkml.org/lkml/2020/5/4/1062
2. Updated trusted-encrypted doc with TEE as a new trust source.
3. Rebased onto latest tpmdd/master.
Changes in v3:
1. Update patch #2 to support registration of multiple kernel pages.
2. Incoporate dependency patch #4 in this patch-set:
https://patchwork.kernel.org/patch/11091435/
Changes in v2:
1. Add reviewed-by tags for patch #1 and #2.
2. Incorporate comments from Jens for patch #3.
3. Switch to use generic trusted keys framework.
Sumit Garg (4):
KEYS: trusted: Add generic trusted keys framework
KEYS: trusted: Introduce TEE based Trusted Keys
doc: trusted-encrypted: updates with TEE as a new trust source
MAINTAINERS: Add myself as Trusted Keys co-maintainer
Documentation/admin-guide/kernel-parameters.txt | 12 +
Documentation/security/keys/trusted-encrypted.rst | 203 +++++++++++--
MAINTAINERS | 2 +
include/keys/trusted-type.h | 47 +++
include/keys/trusted_tee.h | 55 ++++
include/keys/trusted_tpm.h | 17 +-
security/keys/trusted-keys/Makefile | 2 +
security/keys/trusted-keys/trusted_core.c | 354 ++++++++++++++++++++++
security/keys/trusted-keys/trusted_tee.c | 278 +++++++++++++++++
security/keys/trusted-keys/trusted_tpm1.c | 336 ++++----------------
10 files changed, 979 insertions(+), 327 deletions(-)
create mode 100644 include/keys/trusted_tee.h
create mode 100644 security/keys/trusted-keys/trusted_core.c
create mode 100644 security/keys/trusted-keys/trusted_tee.c
--
2.7.4
Hi Kris,
[CC op-tee(a)lists.trustedfirmware.org the newer ML for OP-TEE which is
now under the TrustedFirmware.org umbrella]
On 2/9/21 11:04 PM, Kris Kwiatkowski wrote:
> Hello,
>
> I've recently been involved in producing PoC, which utilizes OP-TEE
> to produce proof of a secret key possession. That is used during tunnel
> establishment by OpenVPN.
>
> In case someone finds it interesting, for example as kind of "real-world"
> use case of OP-TEE, then details are described here:
> https://www.amongbytes.com/post/20210112-optee-openssl-engine/
Thanks for sharing! It is a well-written article, quite interesting to
read IMO. I always like to see how OP-TEE is used in various scenarios.
As upstream project maintainers we hear about bug reports and we review
new contributions of course, but there is clearly a lot of activity
going on downstream that we don't know much about. Yet, a bit of context
certainly helps take the good decisions for the project going forward!
> and code is here:
> https://github.com/henrydcase/optee_eng
>
> The actual PoC used post-quantum schemes integrated into TEE OS and TF-A
> (secure boot). Those two points are not described really described for brevity
> (and probably there is low interest anyway).
>
> Kind regards,
> Kris
> _______________________________________________
> Tee-dev mailing list
> Tee-dev(a)lists.linaro.org
> https://lists.linaro.org/mailman/listinfo/tee-dev
Thanks,
--
Jerome
Hello arm-soc maintainers,
Please pull this fix eliminating a stack frame size warning and also
simplifying I2C access in the OP-TEE driver.
Thanks,
Jens
The following changes since commit e71ba9452f0b5b2e8dc8aa5445198cd9214a6a62:
Linux 5.11-rc2 (2021-01-03 15:55:30 -0800)
are available in the Git repository at:
git://git.linaro.org/people/jens.wiklander/linux-tee.git tags/optee-simplify-i2c-access_for-v5.12
for you to fetch changes up to 67bc809752796acb2641ca343cad5b45eef31d7c:
optee: simplify i2c access (2021-02-08 13:42:31 +0100)
----------------------------------------------------------------
Simplify i2c acess in OP-TEE driver
----------------------------------------------------------------
Arnd Bergmann (1):
optee: simplify i2c access
drivers/tee/optee/rpc.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
Hello arm-soc maintainers,
Please pull these patches fixing some comment typos and also a larger
patch syncing some internal OP-TEE driver headers with OP-TEE OS.
Thanks,
Jens
The following changes since commit e71ba9452f0b5b2e8dc8aa5445198cd9214a6a62:
Linux 5.11-rc2 (2021-01-03 15:55:30 -0800)
are available in the Git repository at:
git://git.linaro.org:/people/jens.wiklander/linux-tee.git tags/tee-housekeeping-for-v5.12
for you to fetch changes up to 617d8e8b347edcee6da38df0aeb671fc9c9ba19c:
optee: sync OP-TEE headers (2021-02-02 14:50:41 +0100)
----------------------------------------------------------------
TEE subsystem housekeeping
- Fixes some comment typos in header files
- Updates to use flexible-array member instead of zero-length array
- Syncs internal OP-TEE headers with the ones from OP-TEE OS
----------------------------------------------------------------
Bjorn Helgaas (1):
tee: optee: fix 'physical' typos
Elvira Khabirova (1):
tee: fix some comment typos in header files
Jens Wiklander (1):
optee: sync OP-TEE headers
Tian Tao (1):
drivers: optee: use flexible-array member instead of zero-length array
drivers/tee/optee/optee_msg.h | 158 +++-----------------------------------
drivers/tee/optee/optee_rpc_cmd.h | 103 +++++++++++++++++++++++++
drivers/tee/optee/optee_smc.h | 72 +++++++++++------
drivers/tee/optee/rpc.c | 39 +++++-----
include/linux/tee_drv.h | 2 +-
include/uapi/linux/tee.h | 2 +-
6 files changed, 183 insertions(+), 193 deletions(-)
create mode 100644 drivers/tee/optee/optee_rpc_cmd.h
Hello arm-soc maintainers,
Please pull this small fix removing an unnecessary call to need_resched()
before cond_resched() while the OP-TEE driver is handing a RPC.
Thanks,
Jens
The following changes since commit e71ba9452f0b5b2e8dc8aa5445198cd9214a6a62:
Linux 5.11-rc2 (2021-01-03 15:55:30 -0800)
are available in the Git repository at:
git://git.linaro.org:/people/jens.wiklander/linux-tee.git tags/optee-fix-cond-resched-call-for-v5.12
for you to fetch changes up to 958567600517fd15b7f35ca1a8be0104f0eb0686:
tee: optee: remove need_resched() before cond_resched() (2021-02-03 08:11:11 +0100)
----------------------------------------------------------------
Remove unnecessary need_resched() before cond_resched()
----------------------------------------------------------------
Jens Wiklander (1):
tee: optee: remove need_resched() before cond_resched()
Rouven Czerwinski (1):
tee: optee: replace might_sleep with cond_resched
drivers/tee/optee/call.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
struct tee_param: revc -> recv.
TEE_IOC_SUPPL_SEND: typo introduced by copy-pasting, replace invalid
description with description from the according argument struct.
Signed-off-by: Elvira Khabirova <e.khabirova(a)omprussia.ru>
---
include/linux/tee_drv.h | 2 +-
include/uapi/linux/tee.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h
index d074302989dd..61557bc0e29f 100644
--- a/include/linux/tee_drv.h
+++ b/include/linux/tee_drv.h
@@ -85,7 +85,7 @@ struct tee_param {
* @close_session: close a session
* @invoke_func: invoke a trusted function
* @cancel_req: request cancel of an ongoing invoke or open
- * @supp_revc: called for supplicant to get a command
+ * @supp_recv: called for supplicant to get a command
* @supp_send: called for supplicant to send a response
* @shm_register: register shared memory buffer in TEE
* @shm_unregister: unregister shared memory buffer in TEE
diff --git a/include/uapi/linux/tee.h b/include/uapi/linux/tee.h
index b619f37ee03e..7546be5ed4f8 100644
--- a/include/uapi/linux/tee.h
+++ b/include/uapi/linux/tee.h
@@ -342,7 +342,7 @@ struct tee_iocl_supp_send_arg {
};
/**
- * TEE_IOC_SUPPL_SEND - Receive a request for a supplicant function
+ * TEE_IOC_SUPPL_SEND - Send a response to a received request
*
* Takes a struct tee_ioctl_buf_data which contains a struct
* tee_iocl_supp_send_arg followed by any array of struct tee_param
--
2.28.0