Received: by 2002:a05:6358:e9c4:b0:b2:91dc:71ab with SMTP id hc4csp994927rwb; Thu, 4 Aug 2022 15:11:08 -0700 (PDT) X-Google-Smtp-Source: AA6agR4R/rHLyH/LLzVNz2J73GOIFJGpM7SyaaxeVoXT2EyzIQew2adVUI0t7YigZRfp22TgmwoA X-Received: by 2002:a05:6402:42c3:b0:43d:682f:c0ca with SMTP id i3-20020a05640242c300b0043d682fc0camr3964108edc.334.1659651068265; Thu, 04 Aug 2022 15:11:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1659651068; cv=none; d=google.com; s=arc-20160816; b=lOqqZGjeNadbu3HUUruTyrmxPX6p2IgYApC7/AcPXzDTDQivfSRDwrrZHxnQCA1Jnc Hmbsw9k8qTOgMrO7f4COdrWGJK+SqSKHoo5vHo0F1zFlIVnjwtlrkJYfCYthZC2BZhCF b4sgJYOXvSVtgxf/hdoau2GIRy377KzV6IC9JpVruCG+tcN4M/kUeIQY5KerS6n4M1aP fIV1NVkw6jFzUShQMhkiIN2+fqwGfsoP0ETBLmGXNIWGX1V2zhax2ibYcZLWfJJXi724 /2kwERpdOfm5MQpZF1SwGI4BlWiYp4Z8GLpDaEVxMPxvMoJx8WyrEgkuzwhLpiMV1BXG 17Ng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:dkim-signature; bh=A3KaqbTDvr6yI86EPzA1l0NOPWv07KWx997g85QsDx4=; b=ZzCI7cFyaCb3+wfYQg8ExY9YuWQxn5r5hYdqKh6pzOqMc+FTiutg/49E+vahuQoFdW GlKinwQfOJbbB8LQh5/54QEmEuGL9yVvDHhLJ0vR4N3DyIA3AH9A9MOPX4twHmsoj031 xisWffzHt4bYqDTuFd0w69Nm6GRpQ1uCPt4lqFEVw+t/zgrO6Z3jmdsRRNXPDuCbGiVH rA5kzjZF7xRIxuFC9krCIb+VqyCqTwY3Lzlh3NNjEOoWcb2GvIIk040w/XCzoFvtswbQ URp2QJ4tFm4tsBtxQihx2ylUXW/v0WQte1NK2fI7G7WHBftSCd4npD9MF0jKw1sgjxvM FSIw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=V06sSFt2; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k14-20020a508ace000000b0043bd2a5278csi2309859edk.493.2022.08.04.15.10.42; Thu, 04 Aug 2022 15:11:08 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=V06sSFt2; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236195AbiHDWDR (ORCPT + 99 others); Thu, 4 Aug 2022 18:03:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39016 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231321AbiHDWDP (ORCPT ); Thu, 4 Aug 2022 18:03:15 -0400 Received: from mail-oi1-x236.google.com (mail-oi1-x236.google.com [IPv6:2607:f8b0:4864:20::236]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F129BDEBA for ; Thu, 4 Aug 2022 15:03:14 -0700 (PDT) Received: by mail-oi1-x236.google.com with SMTP id h188so841556oia.13 for ; Thu, 04 Aug 2022 15:03:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc; bh=A3KaqbTDvr6yI86EPzA1l0NOPWv07KWx997g85QsDx4=; b=V06sSFt2ksPjM8k6wnSbaG2QkPaVwvcAPAKnSzq34sTv9ksxh2OqhTuqg8SpivF9Y0 BeAYJPw9WS7SWCrlAS2ZuZhlUV0Va814LRQgaD8u4FmAed6qJn5lA7YVe7jiuQtzViV2 U2pdwnl+QBpBXtgGdP1BnbBo3Ok4S5SQTNkLc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc; bh=A3KaqbTDvr6yI86EPzA1l0NOPWv07KWx997g85QsDx4=; b=nQtWSEBD9LYuGnsRmcxMmYHua/57BDyb/DzIjHNEPXlLkaufUqrUp0dHXpLRFgrhTz ftzetZzafcC1LTWW3gjeqtp/CSe9dIgG9sDMBfb+ri10H/gVgzU9vGRy0NZ7/KPp4FA8 8K+FnYFnGZPiLR1ZgIwFaKcFhtK9VHe90R6xoxGSoMQ2eABisXWFooMnNYn3iYhpfuA7 Eojjp9Gr8Wr9N6IFn86uUNdtjJNYyOHy7LrVcxNxee54nGT94NeLAp0RQfOSLJ9fPMKg qpuvrvlQ5CrZeDRjS7csXfkY87m2H0Y2iMJOOmkmtSqb8Po+ny2jNSGwlNHmfTcdAsad 7Bdw== X-Gm-Message-State: ACgBeo3+/KGstFtp8yUi/DB3n8Up3X9+5Bmts3Kxt2GNgrU5PXSRL+jU Ef6X6IonQNW8k4lMyBwXk+we1jHu5WZaRw== X-Received: by 2002:aca:2217:0:b0:33a:e056:dc76 with SMTP id b23-20020aca2217000000b0033ae056dc76mr1696058oic.128.1659650594266; Thu, 04 Aug 2022 15:03:14 -0700 (PDT) Received: from mail-oa1-f46.google.com (mail-oa1-f46.google.com. [209.85.160.46]) by smtp.gmail.com with ESMTPSA id 6-20020a9d0686000000b0061c7ec80898sm349711otx.23.2022.08.04.15.03.14 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 04 Aug 2022 15:03:14 -0700 (PDT) Received: by mail-oa1-f46.google.com with SMTP id 586e51a60fabf-10cf9f5b500so1081884fac.2 for ; Thu, 04 Aug 2022 15:03:14 -0700 (PDT) X-Received: by 2002:a05:6870:b4a1:b0:10e:50b8:50aa with SMTP id y33-20020a056870b4a100b0010e50b850aamr1952047oap.174.1659650171298; Thu, 04 Aug 2022 14:56:11 -0700 (PDT) MIME-Version: 1.0 References: <20220504232102.469959-1-evgreen@chromium.org> <20220506160807.GA1060@bug> In-Reply-To: From: Evan Green Date: Thu, 4 Aug 2022 14:55:35 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH 00/10] Encrypted Hibernation To: Jarkko Sakkinen Cc: Matthew Garrett , "Rafael J. Wysocki" , Pavel Machek , LKML , Daniil Lunev , zohar@linux.ibm.com, "James E.J. Bottomley" , linux-integrity@vger.kernel.org, Jonathan Corbet , "Rafael J. Wysocki" , Gwendal Grignou , Linux PM , David Howells , Hao Wu , James Morris , Jason Gunthorpe , Len Brown , Peter Huewe , "Serge E. Hallyn" , axelj , keyrings@vger.kernel.org, "open list:DOCUMENTATION" , linux-security-module@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Aug 3, 2022 at 5:59 PM Jarkko Sakkinen wrote: > > On Tue, Aug 02, 2022 at 11:36:43AM -0700, Matthew Garrett wrote: > > On Mon, Aug 1, 2022 at 3:33 PM Evan Green wrote: > > > > > One more bump here, as we'd really love to get encrypted hibernation > > > to a form upstream would accept if at all possible. We were > > > considering landing this in our Chrome OS tree for now, then coming > > > back in a couple months with a "we've been baking this ourselves and > > > it's going so great, oooh yeah". I'm not sure if upstream would find > > > that compelling or not. But in any case, some guidance towards making > > > this more upstream friendly would be well appreciated. > > > > > > One thing I realized in attempting to pick this myself is that the > > > trusted key blob format has moved to ASN.1. So I should really move > > > the creation ticket to the new ASN.1 format (if I can figure out the > > > right OID for that piece), which would allow me to drop a lot of the > > > ugly stuff in tpm2_unpack_blob(). Maybe if I get no other comments > > > I'll work on that and resend. > > > > I've been revamping my TPM-backed verified hibernation implementation > > based on this work, so I'd definitely be enthusiastic about it being > > mergeable. > > BTW, is it tested with QEMU + swtpm? For myself, so far I've been testing on a recent Intel Chromebook. The H1 (aka cr50) security chip on modern chromebooks implements a subset [1] of TPM2.0, and is exposed through the standard TPM APIs in the kernel. I can make sure to test on Qemu as well, is there anything in particular I should look out for? -Evan [1] https://chromium-review.googlesource.com/c/chromiumos/third_party/tpm2/+/3373466 > > BR, Jarkko