]> git.baikalelectronics.ru Git - kernel.git/commit
KEYS: trusted: allow use of TEE as backend without TCG_TPM support
authorAhmad Fatoum <a.fatoum@pengutronix.de>
Fri, 13 May 2022 14:56:59 +0000 (16:56 +0200)
committerJarkko Sakkinen <jarkko@kernel.org>
Mon, 23 May 2022 15:47:50 +0000 (18:47 +0300)
commit55bb2415e6bfa62f8986dc6b52ed8afbf513a392
treee0ca3b5afa5dc944c6115cd3f4a04f208c37e766
parent4da5aaea571b1ef4e3df30cf62ca72a89300a07c
KEYS: trusted: allow use of TEE as backend without TCG_TPM support

With recent rework, trusted keys are no longer limited to TPM as trust
source. The Kconfig symbol is unchanged however leading to a few issues:

  - TCG_TPM is required, even if only TEE is to be used
  - Enabling TCG_TPM, but excluding it from available trusted sources
    is not possible
  - TEE=m && TRUSTED_KEYS=y will lead to TEE support being silently
    dropped, which is not the best user experience

Remedy these issues by introducing two new boolean Kconfig symbols:
TRUSTED_KEYS_TPM and TRUSTED_KEYS_TEE with the appropriate
dependencies.

Any new code depending on the TPM trusted key backend in particular
or symbols exported by it will now need to explicitly state that it

  depends on TRUSTED_KEYS && TRUSTED_KEYS_TPM

The latter to ensure the dependency is built and the former to ensure
it's reachable for module builds. There are no such users yet.

Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Tested-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Tested-by: Andreas Rammhold <andreas@rammhold.de>
Tested-by: Tim Harvey <tharvey@gateworks.com>
Tested-by: Michael Walle <michael@walle.cc> # on ls1028a (non-E and E)
Tested-by: John Ernberg <john.ernberg@actia.se> # iMX8QXP
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
security/keys/Kconfig
security/keys/trusted-keys/Kconfig [new file with mode: 0644]
security/keys/trusted-keys/Makefile
security/keys/trusted-keys/trusted_core.c