kernel: modules: package OP-TEE and fTPM modules

Add kmod packages to support accessing the fTPM (in-firmware TPM) which
can be implemented in the boot firmware of most modern platforms.

 - kmod-optee: Open Portable Trusted Execution Environment
 - kmod-optee-rng: OP-TEE random number generator client
 - kmod-rtc-optee: OP-TEE real-time clock client
 - kmod-scmi-transport-optee: SCMI OP-TEE transport
 - kmod-tee: Generic Trusted Execution Environment
 - kmod-tee-stmm-efi: EFI variable service Trusted Application
 - kmod-tpm-ftpm-tee: Microsoft fTPM Trusted Application

Using the TPM 2.0 can be useful for various security applications,
such as encrypting on-disk credentials. OP-TEE itself alone is also
useful as it can provide a PKCS#11 token for authentication (eg. to
connect to a VPN) and significantly lower the risk of leaking secrets
used for authentication. Also, on some platforms RNG and RTC can only be
accessed via OP-TEE, and some ARM SystemReady platforms require EFI
variables to be access via a TA.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk
index e8f62d3172b3a10bb08b11c76faed128ee08d064..ad7ac9a0b7d9f63a9f6c006b0a3febe48bed0016 100644 (file)
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@@ -935,6 +935,93 @@ endef
 $(eval $(call KernelPackage,echo))
 
 
+define KernelPackage/tee
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Trusted Execution Environment (TEE) support
+  DEPENDS:=+kmod-dma-buf
+  KCONFIG:=CONFIG_TEE
+  FILES:=$(LINUX_DIR)/drivers/tee/tee.ko
+  AUTOLOAD:=$(call AutoLoad,20,tee,1)
+endef
+
+define KernelPackage/tee/description
+  Generic Trusted Execution Environment subsystem, the interface used to
+  communicate with a trusted OS running in a secure environment.
+endef
+
+$(eval $(call KernelPackage,tee))
+
+
+define KernelPackage/optee
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=OP-TEE driver
+  DEPENDS:=+kmod-i2c-core +kmod-tee
+  KCONFIG:= \
+       CONFIG_OPTEE \
+       CONFIG_OPTEE_INSECURE_LOAD_IMAGE=n
+  FILES:=$(LINUX_DIR)/drivers/tee/optee/optee.ko
+  AUTOLOAD:=$(call AutoLoad,21,optee,1)
+endef
+
+define KernelPackage/optee/description
+  Driver for OP-TEE, the Open Portable Trusted Execution Environment running
+  in the Arm secure world, reached over the SMCCC or FF-A transport.
+endef
+
+$(eval $(call KernelPackage,optee))
+
+
+define KernelPackage/optee-rng
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=OP-TEE based Random Number Generator
+  DEPENDS:=+kmod-optee +kmod-random-core
+  KCONFIG:=CONFIG_HW_RANDOM_OPTEE
+  FILES:=$(LINUX_DIR)/drivers/char/hw_random/optee-rng.ko
+  AUTOLOAD:=$(call AutoLoad,22,optee-rng,1)
+endef
+
+define KernelPackage/optee-rng/description
+  Exposes the random number generator provided by OP-TEE through the kernel
+  hwrng interface.
+endef
+
+$(eval $(call KernelPackage,optee-rng))
+
+
+define KernelPackage/scmi-transport-optee
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=SCMI transport based on OP-TEE service
+  DEPENDS:=@(TARGET_rockchip||TARGET_stm32) +kmod-optee
+  KCONFIG:=CONFIG_ARM_SCMI_TRANSPORT_OPTEE
+  FILES:=$(LINUX_DIR)/drivers/firmware/arm_scmi/transports/scmi_transport_optee.ko
+  AUTOLOAD:=$(call AutoProbe,scmi_transport_optee)
+endef
+
+define KernelPackage/scmi-transport-optee/description
+  Arm SCMI transport using an OP-TEE service to communicate with the
+  platform firmware implementing the SCMI server.
+endef
+
+$(eval $(call KernelPackage,scmi-transport-optee))
+
+
+define KernelPackage/tee-stmm-efi
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=TEE based EFI runtime variable service
+  DEPENDS:=@TARGET_armsr +kmod-optee
+  KCONFIG:=CONFIG_TEE_STMM_EFI
+  FILES:=$(LINUX_DIR)/drivers/firmware/efi/stmm/tee_stmm_efi.ko
+  AUTOLOAD:=$(call AutoProbe,tee_stmm_efi)
+endef
+
+define KernelPackage/tee-stmm-efi/description
+  Provides EFI runtime variable services through the StandAloneMM Trusted
+  Application running in OP-TEE.
+endef
+
+$(eval $(call KernelPackage,tee-stmm-efi))
+
+
 define KernelPackage/keys-encrypted
   SUBMENU:=$(OTHER_MENU)
   TITLE:=encrypted keys on kernel keyring
@@ -991,6 +1078,23 @@ endef
 
 $(eval $(call KernelPackage,tpm))
 
+define KernelPackage/tpm-ftpm-tee
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=TEE based firmware TPM (fTPM)
+  DEPENDS:=+kmod-tpm +kmod-optee
+  KCONFIG:=CONFIG_TCG_FTPM_TEE
+  FILES:=$(LINUX_DIR)/drivers/char/tpm/tpm_ftpm_tee.ko
+  AUTOLOAD:=$(call AutoLoad,30,tpm_ftpm_tee,1)
+endef
+
+define KernelPackage/tpm-ftpm-tee/description
+  Driver for a firmware TPM (fTPM) running as a Trusted Application inside a
+  TEE such as OP-TEE. It presents the fTPM to Linux as a TPM 2.0 device,
+  bound over the TEE client bus or a microsoft,ftpm device tree node.
+endef
+
+$(eval $(call KernelPackage,tpm-ftpm-tee))
+
 define KernelPackage/tpm-tis
   SUBMENU:=$(OTHER_MENU)
   TITLE:=TPM TIS 1.2 Interface / TPM 2.0 FIFO Interface

diff --git a/package/kernel/linux/modules/rtc.mk b/package/kernel/linux/modules/rtc.mk
index 1613f26e4fc1002438120317ec0331704d24e122..7530bd2f1b30b8a27be3bcd0d915e8dcd51752f3 100644 (file)
--- a/package/kernel/linux/modules/rtc.mk
+++ b/package/kernel/linux/modules/rtc.mk
@@ -134,6 +134,25 @@ endef
 $(eval $(call KernelPackage,rtc-mv))
 
 
+define KernelPackage/rtc-optee
+  SUBMENU:=$(RTC_MENU)
+  TITLE:=OP-TEE based RTC support
+  DEFAULT:=m if ALL_KMODS && RTC_SUPPORT
+  DEPENDS:=+kmod-optee
+  KCONFIG:=CONFIG_RTC_DRV_OPTEE \
+       CONFIG_RTC_CLASS=y
+  FILES:=$(LINUX_DIR)/drivers/rtc/rtc-optee.ko
+  AUTOLOAD:=$(call AutoProbe,rtc-optee)
+endef
+
+define KernelPackage/rtc-optee/description
+ Kernel module for the RTC service exposed by the OP-TEE Trusted
+ Execution Environment.
+endef
+
+$(eval $(call KernelPackage,rtc-optee))
+
+
 define KernelPackage/rtc-pcf8563
   SUBMENU:=$(RTC_MENU)
   TITLE:=Philips PCF8563/Epson RTC8564 RTC support

diff --git a/target/linux/generic/config-6.12 b/target/linux/generic/config-6.12
index ca96112d1b1eaa67ea2d7021511e29b716e44f26..6c1d9e520734e97a56ff43492568e366346b1ff7 100644 (file)
--- a/target/linux/generic/config-6.12
+++ b/target/linux/generic/config-6.12
@@ -6661,6 +6661,7 @@ CONFIG_TCP_CONG_CUBIC=y
 # CONFIG_TCS3414 is not set
 # CONFIG_TCS3472 is not set
 # CONFIG_TEE is not set
+# CONFIG_TEE_BNXT_FW is not set
 # CONFIG_TEGRA_AHB is not set
 # CONFIG_TEGRA_HOST1X is not set
 # CONFIG_TEHUTI is not set

diff --git a/target/linux/generic/config-6.18 b/target/linux/generic/config-6.18
index 3e1a57f9c704ee3bd1337edd212d622abb60a5c1..2141bc0d07f4d20ad50c10f2adf6c42f358c5e54 100644 (file)
--- a/target/linux/generic/config-6.18
+++ b/target/linux/generic/config-6.18
@@ -7030,6 +7030,7 @@ CONFIG_TCP_CONG_CUBIC=y
 # CONFIG_TCS3414 is not set
 # CONFIG_TCS3472 is not set
 # CONFIG_TEE is not set
+# CONFIG_TEE_BNXT_FW is not set
 # CONFIG_TEGRA_AHB is not set
 # CONFIG_TEGRA_HOST1X is not set
 # CONFIG_TEHUTI is not set

diff --git a/target/linux/qualcommbe/config-6.18 b/target/linux/qualcommbe/config-6.18
index 2da62a67bf1405833977079cc182dadfb4b8b979..9476b17629646b24bf20314cd8b89ef2a1067ad2 100644 (file)
--- a/target/linux/qualcommbe/config-6.18
+++ b/target/linux/qualcommbe/config-6.18
@@ -416,6 +416,7 @@ CONFIG_QCA807X_PHY=y
 CONFIG_QCA808X_PHY=y
 # CONFIG_QCM_DISPCC_2290 is not set
 # CONFIG_QCM_GCC_2290 is not set
+# CONFIG_QCOMTEE is not set
 # CONFIG_QCOM_A53PLL is not set
 # CONFIG_QCOM_AOSS_QMP is not set
 CONFIG_QCOM_APCS_IPC=y

diff --git a/target/linux/stm32/stm32mp1/config-6.18 b/target/linux/stm32/stm32mp1/config-6.18
index 77e9f495ff7bf45e4cdb04d19b8eaf8ffc8b5e2f..c1bc6ac9434f0ce85ce727d081e89b374209d45c 100644 (file)
--- a/target/linux/stm32/stm32mp1/config-6.18
+++ b/target/linux/stm32/stm32mp1/config-6.18
@@ -455,6 +455,7 @@ CONFIG_SQUASHFS_FILE_CACHE=y
 CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_ZLIB=y
 CONFIG_STM32MP_EXTI=y
+# CONFIG_STM32_DBG_BUS is not set
 CONFIG_STM32_DMA=y
 # CONFIG_STM32_DMA3 is not set
 CONFIG_STM32_DMAMUX=y