[PATCH 15/17] PM: hibernate: Sign and verify images with a kernel-generated TPM key

[Matthew Garrett <matthewg@nvidia.com>]

Add CONFIG_HIBERNATION_TPM_SIGNATURE, a hibernation image signing
backend that uses a TPM signing key created by the kernel.

When an image header is built, a fresh kernel signing key is created
with tpm2_kernel_key_create(), and its provenance, the AK-signed audit
session showing that the key was created while only the kernel could
use the TPM, is stored in the image header. Once the whole image has
been hashed, the digest is signed with the key, and the key is
destroyed. The key cannot be recreated, and as it is created under the
null hierarchy it does not survive a TPM reset, so it can sign nothing
else once the system has been powered off.

When an image is loaded, the provenance is checked with
tpm2_kernel_key_verify() as soon as the header has been read, which
yields the public key that the kernel created. The image is restored
only if its signature verifies with that key. Images that are unsigned,
modified, or signed with any other key are rejected, and the system
boots normally.

As PCR 5 can only distinguish the kernel's audit session if firmware
extends it when ExitBootServices() is called, verification requires that
we successully extend PCR 5 during the EFI stub and that the firmware
then extends it when ExitBootServices is called. Hibernation is
unavailable when the option is enabled but there is no TPM 2.0 or the
firmware does not extend PCR 5.

Signed-off-by: Matthew Garrett <matthewg@nvidia.com>
---
 kernel/power/Kconfig         |  18 +++
 kernel/power/Makefile        |   1 +
 kernel/power/hibernate.c     |   4 +-
 kernel/power/hibernate_tpm.c | 227 +++++++++++++++++++++++++++++++++++
 kernel/power/power.h         |   7 +-
 kernel/power/snapshot.c      |  11 +-
 6 files changed, 265 insertions(+), 3 deletions(-)
 create mode 100644 kernel/power/hibernate_tpm.c

diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 846f0f91dbc0..2ff9f807ab5a 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -116,6 +116,24 @@ config HIBERNATION_DEF_COMP
 	help
 	  Default compressor to be used for hibernation.
 
+config HIBERNATION_TPM_SIGNATURE
+	bool "Sign hibernation images with a kernel-generated TPM key"
+	depends on HIBERNATION && KERNEL_TPM_SECURITY && TCG_TPM2_KERNEL_KEY
+	help
+	  Sign every hibernation image with a TPM key created by the kernel
+	  while the image is written, and refuse to restore images that are
+	  unsigned, modified, or signed by a key that cannot be shown to have
+	  been created by the kernel. This detects images that have been
+	  tampered with or written by something other than the kernel, such
+	  as userspace.
+
+	  The TPM must be a TPM 2.0 whose owner and endorsement hierarchies
+	  have empty auth values, and the firmware must extend PCR 5 when
+	  ExitBootServices() is called. If these requirements are not met,
+	  hibernation is unavailable.
+
+	  If unsure, say N.
+
 config PM_STD_PARTITION
 	string "Default resume partition"
 	depends on HIBERNATION
diff --git a/kernel/power/Makefile b/kernel/power/Makefile
index 773e2789412b..25a4ab12552e 100644
--- a/kernel/power/Makefile
+++ b/kernel/power/Makefile
@@ -16,6 +16,7 @@ obj-$(CONFIG_SUSPEND)		+= suspend.o
 obj-$(CONFIG_PM_TEST_SUSPEND)	+= suspend_test.o
 obj-$(CONFIG_HIBERNATION)	+= hibernate.o snapshot.o swap.o
 obj-$(CONFIG_HIBERNATION_SNAPSHOT_DEV) += user.o
+obj-$(CONFIG_HIBERNATION_TPM_SIGNATURE) += hibernate_tpm.o
 obj-$(CONFIG_PM_AUTOSLEEP)	+= autosleep.o
 obj-$(CONFIG_PM_WAKELOCKS)	+= wakelock.o
 
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 1efc2bd3a387..256790aeca86 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -110,7 +110,9 @@ bool hibernation_available(void)
 {
 	return nohibernate == 0 &&
 		!security_locked_down(LOCKDOWN_HIBERNATION) &&
-		!secretmem_active() && !cxl_mem_active();
+		!secretmem_active() && !cxl_mem_active() &&
+		(!IS_ENABLED(CONFIG_HIBERNATION_TPM_SIGNATURE) ||
+		 hibernate_tpm_available());
 }
 
 /**
diff --git a/kernel/power/hibernate_tpm.c b/kernel/power/hibernate_tpm.c
new file mode 100644
index 000000000000..96f01c80f3cb
--- /dev/null
+++ b/kernel/power/hibernate_tpm.c
@@ -0,0 +1,227 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Sign hibernation images with a kernel-generated TPM key.
+ *
+ * When an image is created, the kernel creates a fresh TPM signing key,
+ * along with evidence signed by the kernel attestation key that the key
+ * was created by the kernel rather than by userspace (see
+ * drivers/char/tpm/tpm2-kernel-key.c).  The evidence is stored in the
+ * image header, and the key signs the digest of the whole image.  The key
+ * cannot be recreated and does not survive a TPM reset, so it can sign
+ * nothing else once the system has been powered off.
+ *
+ * On resume, the evidence is checked as soon as the image header has been
+ * read, which yields the public key that the kernel created, and the
+ * image is only restored if it was signed with that key.
+ */
+
+#define pr_fmt(fmt) "PM: hibernation: " fmt
+
+#include <linux/efi.h>
+#include <linux/init.h>
+#include <linux/tpm.h>
+
+#include "power.h"
+
+#define HIB_TPM_SIG_MAGIC	"LNXHSIG1"
+
+/* The signature page */
+struct hib_tpm_sig {
+	u8 magic[8];
+	u8 x[EC_PT_SZ];
+	u8 y[EC_PT_SZ];
+	u8 r[EC_PT_SZ];
+	u8 s[EC_PT_SZ];
+};
+
+static_assert(sizeof(struct hib_tpm_sig) <= HIB_SIG_TRAILER_SIZE);
+static_assert(sizeof(struct tpm2_key_provenance) <= HIB_SIG_HEADER_SIZE);
+
+/* The key used to sign the image being created */
+static struct tpm2_kernel_key hib_tpm_key;
+static bool hib_tpm_key_valid;
+
+/* The public key shown to have been created by the kernel, on restore */
+static u8 hib_tpm_x[EC_PT_SZ], hib_tpm_y[EC_PT_SZ];
+static bool hib_tpm_header_ok;
+
+static struct tpm_chip *hib_tpm_get_chip(void)
+{
+	struct tpm_chip *chip = tpm_default_chip();
+
+	if (!chip)
+		return NULL;
+
+	if (!(chip->flags & TPM_CHIP_FLAG_TPM2) || tpm_try_get_ops(chip)) {
+		put_device(&chip->dev);
+		return NULL;
+	}
+
+	return chip;
+}
+
+static void hib_tpm_put_chip(struct tpm_chip *chip)
+{
+	tpm_put_ops(chip);
+	put_device(&chip->dev);
+}
+
+/* TPM errors are positive; report them as a failure to use the TPM */
+static int hib_tpm_err(int rc)
+{
+	return rc > 0 ? -EIO : rc;
+}
+
+static void hib_tpm_end(void)
+{
+	struct tpm_chip *chip;
+
+	if (!hib_tpm_key_valid)
+		return;
+
+	chip = hib_tpm_get_chip();
+	if (chip) {
+		tpm2_kernel_key_destroy(chip, &hib_tpm_key);
+		hib_tpm_put_chip(chip);
+	}
+
+	memzero_explicit(&hib_tpm_key, sizeof(hib_tpm_key));
+	hib_tpm_key_valid = false;
+}
+
+static int hib_tpm_begin(void *data, size_t size)
+{
+	struct tpm2_key_provenance *prov = data;
+	struct tpm_chip *chip;
+	int rc;
+
+	/* the image may be read more than once */
+	hib_tpm_end();
+
+	chip = hib_tpm_get_chip();
+	if (!chip)
+		return -ENODEV;
+
+	rc = tpm2_kernel_key_create(chip, &hib_tpm_key, prov);
+	hib_tpm_put_chip(chip);
+	if (rc) {
+		pr_err("Failed to create image signing key: %d\n", rc);
+		return hib_tpm_err(rc);
+	}
+
+	hib_tpm_key_valid = true;
+	return 0;
+}
+
+static int hib_tpm_sign(const u8 *digest, void *trailer, size_t size)
+{
+	struct hib_tpm_sig *sig = trailer;
+	struct tpm_chip *chip;
+	int rc;
+
+	if (!hib_tpm_key_valid)
+		return -EINVAL;
+
+	chip = hib_tpm_get_chip();
+	if (!chip)
+		return -ENODEV;
+
+	memcpy(sig->magic, HIB_TPM_SIG_MAGIC, sizeof(sig->magic));
+	memcpy(sig->x, hib_tpm_key.x, sizeof(sig->x));
+	memcpy(sig->y, hib_tpm_key.y, sizeof(sig->y));
+	rc = tpm2_kernel_key_sign(chip, &hib_tpm_key, digest, sig->r, sig->s);
+
+	/* the key has done its job */
+	tpm2_kernel_key_destroy(chip, &hib_tpm_key);
+	hib_tpm_key_valid = false;
+	hib_tpm_put_chip(chip);
+
+	if (rc) {
+		pr_err("Failed to sign image: %d\n", rc);
+		return hib_tpm_err(rc);
+	}
+
+	return 0;
+}
+
+static int hib_tpm_check_header(const void *data, size_t size)
+{
+	const struct tpm2_key_provenance *prov = data;
+	struct tpm_chip *chip;
+	int rc;
+
+	hib_tpm_header_ok = false;
+
+	/* PCR 5 can only distinguish the kernel if firmware extends it */
+	if (!kernel_tpm_security_available) {
+		pr_err("Cannot verify image: TPM security not available\n");
+		return -EKEYREJECTED;
+	}
+
+	chip = hib_tpm_get_chip();
+	if (!chip) {
+		pr_err("Cannot verify image: no TPM\n");
+		return -ENODEV;
+	}
+
+	rc = tpm2_kernel_key_verify(chip, prov, hib_tpm_x, hib_tpm_y);
+	hib_tpm_put_chip(chip);
+	if (rc) {
+		pr_err("Image signing key was not created by the kernel: %d\n",
+		       rc);
+		return rc > 0 ? -EKEYREJECTED : rc;
+	}
+
+	hib_tpm_header_ok = true;
+	return 0;
+}
+
+static int hib_tpm_verify(const u8 *digest, const void *trailer, size_t size)
+{
+	const struct hib_tpm_sig *sig = trailer;
+
+	if (!hib_tpm_header_ok)
+		return -EKEYREJECTED;
+
+	if (memcmp(sig->magic, HIB_TPM_SIG_MAGIC, sizeof(sig->magic)))
+		return -EKEYREJECTED;
+
+	/* the image must be signed with the key the kernel created */
+	if (memcmp(sig->x, hib_tpm_x, sizeof(hib_tpm_x)) ||
+	    memcmp(sig->y, hib_tpm_y, sizeof(hib_tpm_y)))
+		return -EKEYREJECTED;
+
+	return tpm2_kernel_key_verify_signature(hib_tpm_x, hib_tpm_y, digest,
+						sig->r, sig->s);
+}
+
+const struct hib_sig_ops hib_tpm_sig_ops = {
+	.begin		= hib_tpm_begin,
+	.sign		= hib_tpm_sign,
+	.end		= hib_tpm_end,
+	.check_header	= hib_tpm_check_header,
+	.verify		= hib_tpm_verify,
+};
+
+/**
+ * hibernate_tpm_available - Check whether images can be signed.
+ *
+ * Signing requires a TPM 2.0 and firmware that extends PCR 5 when
+ * ExitBootServices() is called.
+ */
+bool hibernate_tpm_available(void)
+{
+	struct tpm_chip *chip;
+	bool tpm2;
+
+	if (!kernel_tpm_security_available)
+		return false;
+
+	chip = tpm_default_chip();
+	if (!chip)
+		return false;
+
+	tpm2 = chip->flags & TPM_CHIP_FLAG_TPM2;
+	put_device(&chip->dev);
+	return tpm2;
+}
diff --git a/kernel/power/power.h b/kernel/power/power.h
index b4733d45e6cd..8115df3364a9 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -197,7 +197,12 @@ int snapshot_write_finalize(struct snapshot_handle *handle);
 extern int snapshot_image_loaded(struct snapshot_handle *handle);
 extern bool snapshot_image_signed(void);
 extern int snapshot_image_verify(void);
-extern void hibernate_set_sig_ops(const struct hib_sig_ops *ops);
+#ifdef CONFIG_HIBERNATION_TPM_SIGNATURE
+extern const struct hib_sig_ops hib_tpm_sig_ops;
+extern bool hibernate_tpm_available(void);
+#else
+static inline bool hibernate_tpm_available(void) { return false; }
+#endif
 
 extern bool hibernate_acquire(void);
 extern void hibernate_release(void);
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index bbf9de4b15ab..75276b73a913 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -174,7 +174,16 @@ static void *buffer;
  * of the image is signed, and the signature is stored in an extra page at
  * the end of the image.
  */
-static const struct hib_sig_ops *hib_sig;
+#ifdef CONFIG_HIBERNATION_TPM_SIGNATURE
+/*
+ * Fixed at build time rather than registered at runtime, so that signature
+ * enforcement cannot be avoided by preventing registration, for example
+ * with initcall_blacklist=.
+ */
+static const struct hib_sig_ops *const hib_sig = &hib_tpm_sig_ops;
+#else
+static const struct hib_sig_ops *const hib_sig;
+#endif
 static unsigned long nr_sig_pages;
 static struct sha256_ctx hib_sig_ctx;
 static u8 hib_sig_digest[SHA256_DIGEST_SIZE];
-- 
2.43.0