linux-kernel - RE: [PATCH v7 1/2] fTPM: firmware TPM running in TEE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 4 Jul 2019 06:28:21 +0000
From:   Thirupathaiah Annapureddy <thiruan@...rosoft.com>
To:     Ilias Apalodimas <ilias.apalodimas@...aro.org>
CC:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        Sasha Levin <sashal@...nel.org>,
        "peterhuewe@....de" <peterhuewe@....de>,
        "jgg@...pe.ca" <jgg@...pe.ca>, "corbet@....net" <corbet@....net>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        Microsoft Linux Kernel List <linux-kernel@...rosoft.com>,
        "Bryan Kelly (CSI)" <bryankel@...rosoft.com>,
        "tee-dev@...ts.linaro.org" <tee-dev@...ts.linaro.org>,
        "sumit.garg@...aro.org" <sumit.garg@...aro.org>,
        "rdunlap@...radead.org" <rdunlap@...radead.org>,
        Joakim Bech <joakim.bech@...aro.org>
Subject: RE: [PATCH v7 1/2] fTPM: firmware TPM running in TEE

Hi Ilias,

> -----Original Message-----
> From: Ilias Apalodimas <ilias.apalodimas@...aro.org>
> Sent: Wednesday, July 3, 2019 1:12 AM
> To: Thirupathaiah Annapureddy <thiruan@...rosoft.com>
> Cc: Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>; Sasha Levin
> <sashal@...nel.org>; peterhuewe@....de; jgg@...pe.ca; corbet@....net; linux-
> kernel@...r.kernel.org; linux-doc@...r.kernel.org; linux-
> integrity@...r.kernel.org; Microsoft Linux Kernel List <linux-
> kernel@...rosoft.com>; Bryan Kelly (CSI) <bryankel@...rosoft.com>; tee-
> dev@...ts.linaro.org; sumit.garg@...aro.org; rdunlap@...radead.org; Joakim Bech
> <joakim.bech@...aro.org>
> Subject: Re: [PATCH v7 1/2] fTPM: firmware TPM running in TEE
> 
> Hi Thirupathaiah,
> 
> (+Joakim)
> 
> On Wed, 3 Jul 2019 at 09:58, Ilias Apalodimas
> <ilias.apalodimas@...aro.org> wrote:
> >
> > Hi Thirupathaiah,
> > >
> > > First of all, Thanks a lot for trying to test the driver.
> > >
> > np
> >
> > [...]
> > > > I managed to do some quick testing in QEMU.
> > > > Everything works fine when i build this as a module (using IBM's TPM 2.0
> > > > TSS)
> > > >
> > > > - As module
> > > > # insmod /lib/modules/5.2.0-rc1/kernel/drivers/char/tpm/tpm_ftpm_tee.ko
> > > > # getrandom -by 8
> > > > randomBytes length 8
> > > > 23 b9 3d c3 90 13 d9 6b
> > > >
> > > > - Built-in
> > > > # dmesg | grep optee
> > > > ftpm-tee firmware:optee: ftpm_tee_probe:tee_client_open_session failed,
> > > > err=ffff0008
> > > This (0xffff0008) translates to TEE_ERROR_ITEM_NOT_FOUND.
> > >
> > > Where is fTPM TA located in the your test setup?
> > > Is it stitched into TEE binary as an EARLY_TA or
> > > Is it expected to be loaded during run-time with the help of user mode OP-
> TEE supplicant?
> > >
> > > My guess is that you are trying to load fTPM TA through user mode OP-TEE
> supplicant.
> > > Can you confirm?
> > I tried both
> >
> 
> Ok apparently there was a failure with my built-in binary which i
> didn't notice. I did a full rebuilt and checked the elf this time :)
> 
> Built as an earlyTA my error now is:
> ftpm-tee firmware:optee: ftpm_tee_probe:tee_client_open_session
> failed, err=ffff3024 (translates to TEE_ERROR_TARGET_DEAD)
> Since you tested it on real hardware i guess you tried both
> module/built-in. Which TEE version are you using?

I am glad that the first issue (TEE_ERROR_ITEM_NOT_FOUND) is resolved after stitching
fTPM TA as an EARLY_TA. 

Regarding TEE_ERROR_TARGET_DEAD error, may I know which HW platform you are using to test? 
What is the preboot environment (UEFI or U-boot)? 
Where is the secure storage in that HW platform? 
I could think of two classes of secure storage. 
1. UFS/eMMC RPMB : If Supplicant in U-boot/UEFI initializes the 
fTPM TA NV Storage, there should be no issue. 
If fTPM TA NV storage is not initialized in pre-boot environment and you are using
built-in fTPM Linux driver, you can run into this issue as TA will try to initialize
NV store and fail. 

2. other storage devices like QSPI accessible to only secure mode after
EBS/ReadyToBoot mile posts during boot. In this case, there should be no issue at all
as there is no dependency on non-secure side services provided by supplicant. 

If you let me know the HW platform details, I am happy to work with you to enable/integrate
fTPM TA on that HW platform. 


Best Regards,
Thiru