OSDN Git Service

KEYS: trusted: allow use of TEE as backend without TCG_TPM support
authorAhmad Fatoum <a.fatoum@pengutronix.de>
Fri, 13 May 2022 14:56:59 +0000 (16:56 +0200)
committerJarkko Sakkinen <jarkko@kernel.org>
Mon, 23 May 2022 15:47:50 +0000 (18:47 +0300)
commitbe07858fbf8115fc74528292c2ee8775fe49116f
treee0ca3b5afa5dc944c6115cd3f4a04f208c37e766
parentaf402ee3c045b0cbd10b7e66d2431304ac9e69bb
KEYS: trusted: allow use of TEE as backend without TCG_TPM support

With recent rework, trusted keys are no longer limited to TPM as trust
source. The Kconfig symbol is unchanged however leading to a few issues:

  - TCG_TPM is required, even if only TEE is to be used
  - Enabling TCG_TPM, but excluding it from available trusted sources
    is not possible
  - TEE=m && TRUSTED_KEYS=y will lead to TEE support being silently
    dropped, which is not the best user experience

Remedy these issues by introducing two new boolean Kconfig symbols:
TRUSTED_KEYS_TPM and TRUSTED_KEYS_TEE with the appropriate
dependencies.

Any new code depending on the TPM trusted key backend in particular
or symbols exported by it will now need to explicitly state that it

  depends on TRUSTED_KEYS && TRUSTED_KEYS_TPM

The latter to ensure the dependency is built and the former to ensure
it's reachable for module builds. There are no such users yet.

Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Tested-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Tested-by: Andreas Rammhold <andreas@rammhold.de>
Tested-by: Tim Harvey <tharvey@gateworks.com>
Tested-by: Michael Walle <michael@walle.cc> # on ls1028a (non-E and E)
Tested-by: John Ernberg <john.ernberg@actia.se> # iMX8QXP
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
security/keys/Kconfig
security/keys/trusted-keys/Kconfig [new file with mode: 0644]
security/keys/trusted-keys/Makefile
security/keys/trusted-keys/trusted_core.c