On Thu, 13 Jun 2019 at 22:10, Casey Schaufler <casey@xxxxxxxxxxxxxxxx> wrote: > > On 6/13/2019 3:30 AM, Sumit Garg wrote: > > Add support for TEE based trusted keys where TEE provides the functionality > > to seal and unseal trusted keys using hardware unique key. Also, this is > > an alternative in case platform doesn't possess a TPM device. > > > > This series also adds some TEE features like: > > Please expand the acronym TEE on first use. That will > help people who don't work with it on a daily basis > understand what you're going on about. > Sure will take care of this. BTW, its Trusted Execution Environment (TEE). -Sumit > > > > Patch #1, #2 enables support for registered kernel shared memory with TEE. > > > > Patch #3 enables support for private kernel login method required for > > cases like trusted keys where we don't wan't user-space to directly access > > TEE service to retrieve trusted key contents. > > > > Rest of the patches from #4 to #7 adds support for TEE based trusted keys. > > > > This patch-set has been tested with OP-TEE based pseudo TA which can be > > found here [1]. > > > > Looking forward to your valuable feedback/suggestions. > > > > [1] https://github.com/OP-TEE/optee_os/pull/3082 > > > > Sumit Garg (7): > > tee: optee: allow kernel pages to register as shm > > tee: enable support to register kernel memory > > tee: add private login method for kernel clients > > KEYS: trusted: Introduce TEE based Trusted Keys > > KEYS: encrypted: Allow TEE based trusted master keys > > doc: keys: Document usage of TEE based Trusted Keys > > MAINTAINERS: Add entry for TEE based Trusted Keys > > > > Documentation/security/keys/tee-trusted.rst | 93 +++++ > > MAINTAINERS | 9 + > > drivers/tee/optee/call.c | 7 + > > drivers/tee/tee_core.c | 6 + > > drivers/tee/tee_shm.c | 16 +- > > include/keys/tee_trusted.h | 84 ++++ > > include/keys/trusted-type.h | 1 + > > include/linux/tee_drv.h | 1 + > > include/uapi/linux/tee.h | 2 + > > security/keys/Kconfig | 3 + > > security/keys/Makefile | 3 + > > security/keys/encrypted-keys/masterkey_trusted.c | 10 +- > > security/keys/tee_trusted.c | 506 +++++++++++++++++++++++ > > 13 files changed, 737 insertions(+), 4 deletions(-) > > create mode 100644 Documentation/security/keys/tee-trusted.rst > > create mode 100644 include/keys/tee_trusted.h > > create mode 100644 security/keys/tee_trusted.c > >
