fTPM: firmware TPM running in TEE
Subsystems (3)
v6 cover fTPM: firmware TPM running in TEE
Changes in v6:
- Address comments from Ilias Apalodimas
Sasha Levin (2):
fTPM: firmware TPM running in TEE
fTPM: add documentation for ftpm driver
Documentation/security/tpm/index.rst | 1 + Documentation/security/tpm/tpm_ftpm_tee.rst | 31 ++ drivers/char/tpm/Kconfig | 5 + drivers/char/tpm/Makefile | 1 + drivers/char/tpm/tpm_ftpm_tee.c | 356 ++++++++++++++++++++ drivers/char/tpm/tpm_ftpm_tee.h | 40 +++ 6 files changed, 434 insertions(+) create mode 100644 Documentation/security/tpm/tpm_ftpm_tee.rst create mode 100644 drivers/char/tpm/tpm_ftpm_tee.c create mode 100644 drivers/char/tpm/tpm_ftpm_tee.h
Signature · 1 line
2.20.1
PATCH v6 1/2 fTPM: firmware TPM running in TEE
This patch adds support for a software-only implementation of a TPM running in TEE.
There is extensive documentation of the design here:
https://www.microsoft.com/en-us/research/publication/ftpm-software-implementation-tpm-chip/ .
As well as reference code for the firmware available here:
https://github.com/Microsoft/ms-tpm-20-ref/tree/master/Samples/ARM32-FirmwareTPM
--- drivers/char/tpm/Kconfig | 5 + drivers/char/tpm/Makefile | 1 + drivers/char/tpm/tpm_ftpm_tee.c | 356 ++++++++++++++++++++++++++++++++ drivers/char/tpm/tpm_ftpm_tee.h | 40 ++++ 4 files changed, 402 insertions(+) create mode 100644 drivers/char/tpm/tpm_ftpm_tee.c create mode 100644 drivers/char/tpm/tpm_ftpm_tee.h
drivers/char/tpm/Kconfig +5 -0
@@ -164,6 +164,11 @@ config TCG_VTPM_PROXY /dev/vtpmX and a server-side file descriptor on which the vTPM can receive commands. +config TCG_FTPM_TEE + tristate "TEE based fTPM Interface" + depends on TEE && OPTEE + ---help--- + This driver proxies for fTPM running in TEE source "drivers/char/tpm/st33zp24/Kconfig" endif # TCG_TPM
drivers/char/tpm/Makefile +1 -0
@@ -33,3 +33,4 @@ obj-$(CONFIG_TCG_TIS_ST33ZP24) += st33zp24/ obj-$(CONFIG_TCG_XEN) += xen-tpmfront.o obj-$(CONFIG_TCG_CRB) += tpm_crb.o obj-$(CONFIG_TCG_VTPM_PROXY) += tpm_vtpm_proxy.o +obj-$(CONFIG_TCG_FTPM_TEE) += tpm_ftpm_tee.o
drivers/char/tpm/tpm_ftpm_tee.c new file +356 -0
356 lines not on this page · raw message
drivers/char/tpm/tpm_ftpm_tee.h new file +40 -0
@@ -0,0 +1,40 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* Copyright (C) Microsoft Corporation +*/ + +#ifndef __TPM_FTPM_TEE_H__ +#define __TPM_FTPM_TEE_H__ + +#include <linux/tee_drv.h> +#include <linux/tpm.h> +#include <linux/uuid.h> + +/* The TAFs ID implemented in this TA */ +#define FTPM_OPTEE_TA_SUBMIT_COMMAND (0) +#define FTPM_OPTEE_TA_EMULATE_PPI (1) + +/* max. buffer size supported by fTPM */ +#define MAX_COMMAND_SIZE 4096 +#define MAX_RESPONSE_SIZE 4096 + +/** +* struct ftpm_tee_private - fTPM's private data +* @chip: struct tpm_chip instance registered with tpm framework. +* @state: internal state +* @session: fTPM TA session identifier. +* @resp_len: cached response buffer length. +* @resp_buf: cached response buffer. +* @ctx: TEE context handler. +* @shm: Memory pool shared with fTPM TA in TEE. +*/ +struct ftpm_tee_private { +struct tpm_chip *chip; +u32 session; +size_t resp_len; +u8 resp_buf[MAX_RESPONSE_SIZE ]; +struct tee_context *ctx; +struct tee_shm *shm; +}; + +#endif /* __TPM_FTPM_TEE_H__ */
Signature · 1 line
2.20.1
Randy Dunlap
reviewerHi,
drivers/char/tpm/Kconfig config TCG_VTPM_PROXY · line 171
Quoted 13 lines · Sasha Levin
drivers/char/tpm/Kconfig +5
-0@@ -164,6 +164,11 @@ config TCG_VTPM_PROXY /dev/vtpmX and a server-side file descriptor on which the vTPM can receive commands. +config TCG_FTPM_TEE + tristate "TEE based fTPM Interface" + depends on TEE && OPTEE + ---help--- + This driver proxies for fTPM running in TEE
acronym overload. For the help text, I would at least s/fTPM/firmware TPM/. Also, end that sentence with a '.'.
Quoted 3 lines
drivers/char/tpm/Kconfig +0
-0source "drivers/char/tpm/st33zp24/Kconfig" endif # TCG_TPM
Signature · 1 line
~Randy
PATCH v6 2/2 fTPM: add documentation for ftpm driver
In reply to Sasha LevinThis patch adds basic documentation to describe the new fTPM driver.
--- Documentation/security/tpm/index.rst | 1 + Documentation/security/tpm/tpm_ftpm_tee.rst | 31 +++++++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 Documentation/security/tpm/tpm_ftpm_tee.rst
Documentation/security/tpm/index.rst +1 -0
@@ -4,4 +4,5 @@ Trusted Platform Module documentation .. toctree:: + tpm_ftpm_tee tpm_vtpm_proxy
Documentation/security/tpm/tpm_ftpm_tee.rst new file +31 -0
@@ -0,0 +1,31 @@ +============================================= +Firmware TPM Driver +============================================= + +| Authors: +| Thirupathaiah Annapureddy <[email protected]> +| Sasha Levin <[email protected]> + +This document describes the firmware Trusted Platform Module (fTPM) +device driver. + +Introduction +============ + +This driver is a shim for a firmware implemented in ARM's TrustZone +environment. The driver allows programs to interact with the TPM in the same +way the would interact with a hardware TPM. + +Design +====== + +The driver acts as a thin layer that passes commands to and from a TPM +implemented in firmware. The driver itself doesn't contain much logic and is +used more like a dumb pipe between firmware and kernel/userspace. + +The firmware itself is based on the following paper: +https://www.microsoft.com/en-us/research/wp-content/uploads/2017/06/ftpm1.pdf + +When the driver is loaded it will expose ``/dev/tpmX`` character devices to +userspace which will enable userspace to communicate with the firmware tpm +through this device.
Signature · 1 line
2.20.1
Randy Dunlap
reviewerRe: [PATCH v6 2/2] fTPM: add documentation for ftpm driver
Quoted 30 lines · Sasha Levin
This patch adds basic documentation to describe the new fTPM driver.
Signed-off-by Sasha Levin <[email protected]>--- Documentation/security/tpm/index.rst | 1 + Documentation/security/tpm/tpm_ftpm_tee.rst | 31 +++++++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 Documentation/security/tpm/tpm_ftpm_tee.rstDocumentation/security/tpm/index.rst +1
-0@@ -4,4 +4,5 @@ Trusted Platform Module documentation .. toctree:: + tpm_ftpm_tee tpm_vtpm_proxyDocumentation/security/tpm/tpm_ftpm_tee.rst new file +5
-0@@ -0,0 +1,31 @@ +============================================= +Firmware TPM Driver +============================================= + +| Authors:
Documentation/security/tpm/tpm_ftpm_tee.rst line 15
Quoted 10 lines
Documentation/security/tpm/tpm_ftpm_tee.rst new file +10
-0+| Thirupathaiah Annapureddy <[email protected]> +| Sasha Levin <[email protected]> + +This document describes the firmware Trusted Platform Module (fTPM) +device driver. + +Introduction +============ + +This driver is a shim for a firmware implemented in ARM's TrustZone
for firmware
Documentation/security/tpm/tpm_ftpm_tee.rst line 17
Quoted 2 lines
Documentation/security/tpm/tpm_ftpm_tee.rst new file +2
-0+environment. The driver allows programs to interact with the TPM in the same +way the would interact with a hardware TPM.
they
Documentation/security/tpm/tpm_ftpm_tee.rst line 30
Quoted 13 lines
Documentation/security/tpm/tpm_ftpm_tee.rst new file +13
-0+ +Design +====== + +The driver acts as a thin layer that passes commands to and from a TPM +implemented in firmware. The driver itself doesn't contain much logic and is +used more like a dumb pipe between firmware and kernel/userspace. + +The firmware itself is based on the following paper: +https://www.microsoft.com/en-us/research/wp-content/uploads/2017/06/ftpm1.pdf + +When the driver is loaded it will expose ``/dev/tpmX`` character devices to +userspace which will enable userspace to communicate with the firmware tpm
TPM
Documentation/security/tpm/tpm_ftpm_tee.rst line 31
Quoted 2 lines
Documentation/security/tpm/tpm_ftpm_tee.rst new file +1
-0+through this device.
Oh, that's the same comments that I made on 2019-06-18:
https://marc.info/?l=linux-integrity&m=156087157019368&w=2
Signature · 1 line
~Randy
Re: [PATCH v6 2/2] fTPM: add documentation for ftpm driver
Quoted 65 lines · Randy Dunlap
Quoted 30 lines · Sasha Levin
This patch adds basic documentation to describe the new fTPM driver.
Signed-off-by Sasha Levin <[email protected]>--- Documentation/security/tpm/index.rst | 1 + Documentation/security/tpm/tpm_ftpm_tee.rst | 31 +++++++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 Documentation/security/tpm/tpm_ftpm_tee.rstDocumentation/security/tpm/index.rst +1
-0@@ -4,4 +4,5 @@ Trusted Platform Module documentation .. toctree:: + tpm_ftpm_tee tpm_vtpm_proxyDocumentation/security/tpm/tpm_ftpm_tee.rst new file +5
-0@@ -0,0 +1,31 @@ +============================================= +Firmware TPM Driver +============================================= + +| Authors:Documentation/security/tpm/tpm_ftpm_tee.rst line 15
Quoted 10 lines
Documentation/security/tpm/tpm_ftpm_tee.rst new file +10
-0+| Thirupathaiah Annapureddy <[email protected]> +| Sasha Levin <[email protected]> + +This document describes the firmware Trusted Platform Module (fTPM) +device driver. + +Introduction +============ + +This driver is a shim for a firmware implemented in ARM's TrustZonefor firmware
Documentation/security/tpm/tpm_ftpm_tee.rst line 17
Quoted 2 lines
Documentation/security/tpm/tpm_ftpm_tee.rst new file +2
-0+environment. The driver allows programs to interact with the TPM in the same +way the would interact with a hardware TPM.they
Documentation/security/tpm/tpm_ftpm_tee.rst line 30
Quoted 13 lines
Documentation/security/tpm/tpm_ftpm_tee.rst new file +13
-0+ +Design +====== + +The driver acts as a thin layer that passes commands to and from a TPM +implemented in firmware. The driver itself doesn't contain much logic and is +used more like a dumb pipe between firmware and kernel/userspace. + +The firmware itself is based on the following paper: +https://www.microsoft.com/en-us/research/wp-content/uploads/2017/06/ftpm1.pdf + +When the driver is loaded it will expose ``/dev/tpmX`` character devices to +userspace which will enable userspace to communicate with the firmware tpmTPM
Quoted 5 lines
Documentation/security/tpm/tpm_ftpm_tee.rst line 31
Quoted 2 lines
Documentation/security/tpm/tpm_ftpm_tee.rst new file +1
-0+through this device.Oh, that's the same comments that I made on 2019-06-18:
https://marc.info/?l=linux-integrity&m=156087157019368&w=2
Appologies Randy, I've missed it. I'll send a new ver in a moment. Thanks!
--
Thanks,
Sasha