From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Sumit Garg <sumit.garg@linaro.org>
Cc: linux-security-module@vger.kernel.org,
daniel.thompson@linaro.org, op-tee@lists.trustedfirmware.org,
corbet@lwn.net, jejb@linux.ibm.com, janne.karhunen@gmail.com,
linux-doc@vger.kernel.org, jmorris@namei.org,
zohar@linux.ibm.com, linux-kernel@vger.kernel.org,
dhowells@redhat.com, lhinds@redhat.com, keyrings@vger.kernel.org,
Josh Poimboeuf <jpoimboe@redhat.com>,
Markus.Wamser@mixed-mode.de, casey@schaufler-ca.com,
linux-integrity@vger.kernel.org, jens.wiklander@linaro.org,
linux-arm-kernel@lists.infradead.org, serge@hallyn.com
Subject: Re: [PATCH v7 1/4] KEYS: trusted: Add generic trusted keys framework
Date: Tue, 13 Oct 2020 01:43:04 +0000 [thread overview]
Message-ID: <20201013014304.GC41176@linux.intel.com> (raw)
In-Reply-To: <1602065268-26017-2-git-send-email-sumit.garg@linaro.org>
On Wed, Oct 07, 2020 at 03:37:45PM +0530, Sumit Garg wrote:
> Current trusted keys framework is tightly coupled to use TPM device as
> an underlying implementation which makes it difficult for implementations
> like Trusted Execution Environment (TEE) etc. to provide trusted keys
> support in case platform doesn't posses a TPM device.
>
> Add a generic trusted keys framework where underlying implementations
> can be easily plugged in. Create struct trusted_key_ops to achieve this,
> which contains necessary functions of a backend.
>
> Also, add a module parameter in order to select a particular trust source
> in case a platform support multiple trust sources.
>
> Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
This is exactly kind of place where I think static_call() should be
taken into use, which is a v5.10 feature [1]. For background and
context, I'd read [2].
The other thing that I see that does not make much else than additional
complexity, is trusted_tpm.ko. We can do with one trusted.ko.
I'd also *guess* that the static_call() mechanism does not work accross
module boundaries.
[1] https://lore.kernel.org/lkml/20201012155542.GA3557765@gmail.com/
[2] https://lwn.net/Articles/815908/
/Jarkko
WARNING: multiple messages have this Message-ID (diff)
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Sumit Garg <sumit.garg@linaro.org>
Cc: zohar@linux.ibm.com, jejb@linux.ibm.com, dhowells@redhat.com,
jens.wiklander@linaro.org, corbet@lwn.net, jmorris@namei.org,
serge@hallyn.com, casey@schaufler-ca.com,
janne.karhunen@gmail.com, daniel.thompson@linaro.org,
Markus.Wamser@mixed-mode.de, lhinds@redhat.com,
keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org, linux-doc@vger.kernel.org,
linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
op-tee@lists.trustedfirmware.org,
Josh Poimboeuf <jpoimboe@redhat.com>
Subject: Re: [PATCH v7 1/4] KEYS: trusted: Add generic trusted keys framework
Date: Tue, 13 Oct 2020 04:43:04 +0300 [thread overview]
Message-ID: <20201013014304.GC41176@linux.intel.com> (raw)
In-Reply-To: <1602065268-26017-2-git-send-email-sumit.garg@linaro.org>
On Wed, Oct 07, 2020 at 03:37:45PM +0530, Sumit Garg wrote:
> Current trusted keys framework is tightly coupled to use TPM device as
> an underlying implementation which makes it difficult for implementations
> like Trusted Execution Environment (TEE) etc. to provide trusted keys
> support in case platform doesn't posses a TPM device.
>
> Add a generic trusted keys framework where underlying implementations
> can be easily plugged in. Create struct trusted_key_ops to achieve this,
> which contains necessary functions of a backend.
>
> Also, add a module parameter in order to select a particular trust source
> in case a platform support multiple trust sources.
>
> Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
This is exactly kind of place where I think static_call() should be
taken into use, which is a v5.10 feature [1]. For background and
context, I'd read [2].
The other thing that I see that does not make much else than additional
complexity, is trusted_tpm.ko. We can do with one trusted.ko.
I'd also *guess* that the static_call() mechanism does not work accross
module boundaries.
[1] https://lore.kernel.org/lkml/20201012155542.GA3557765@gmail.com/
[2] https://lwn.net/Articles/815908/
/Jarkko
WARNING: multiple messages have this Message-ID (diff)
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Sumit Garg <sumit.garg@linaro.org>
Cc: linux-security-module@vger.kernel.org,
daniel.thompson@linaro.org, op-tee@lists.trustedfirmware.org,
corbet@lwn.net, jejb@linux.ibm.com, janne.karhunen@gmail.com,
linux-doc@vger.kernel.org, jmorris@namei.org,
zohar@linux.ibm.com, linux-kernel@vger.kernel.org,
dhowells@redhat.com, lhinds@redhat.com, keyrings@vger.kernel.org,
Josh Poimboeuf <jpoimboe@redhat.com>,
Markus.Wamser@mixed-mode.de, casey@schaufler-ca.com,
linux-integrity@vger.kernel.org, jens.wiklander@linaro.org,
linux-arm-kernel@lists.infradead.org, serge@hallyn.com
Subject: Re: [PATCH v7 1/4] KEYS: trusted: Add generic trusted keys framework
Date: Tue, 13 Oct 2020 04:43:04 +0300 [thread overview]
Message-ID: <20201013014304.GC41176@linux.intel.com> (raw)
In-Reply-To: <1602065268-26017-2-git-send-email-sumit.garg@linaro.org>
On Wed, Oct 07, 2020 at 03:37:45PM +0530, Sumit Garg wrote:
> Current trusted keys framework is tightly coupled to use TPM device as
> an underlying implementation which makes it difficult for implementations
> like Trusted Execution Environment (TEE) etc. to provide trusted keys
> support in case platform doesn't posses a TPM device.
>
> Add a generic trusted keys framework where underlying implementations
> can be easily plugged in. Create struct trusted_key_ops to achieve this,
> which contains necessary functions of a backend.
>
> Also, add a module parameter in order to select a particular trust source
> in case a platform support multiple trust sources.
>
> Suggested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
This is exactly kind of place where I think static_call() should be
taken into use, which is a v5.10 feature [1]. For background and
context, I'd read [2].
The other thing that I see that does not make much else than additional
complexity, is trusted_tpm.ko. We can do with one trusted.ko.
I'd also *guess* that the static_call() mechanism does not work accross
module boundaries.
[1] https://lore.kernel.org/lkml/20201012155542.GA3557765@gmail.com/
[2] https://lwn.net/Articles/815908/
/Jarkko
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-10-13 1:43 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-07 10:07 [PATCH v7 0/4] Introduce TEE based Trusted Keys support Sumit Garg
2020-10-07 10:19 ` Sumit Garg
2020-10-07 10:07 ` Sumit Garg
2020-10-07 10:07 ` [PATCH v7 1/4] KEYS: trusted: Add generic trusted keys framework Sumit Garg
2020-10-07 10:19 ` Sumit Garg
2020-10-07 10:07 ` Sumit Garg
2020-10-13 1:43 ` Jarkko Sakkinen [this message]
2020-10-13 1:43 ` Jarkko Sakkinen
2020-10-13 1:43 ` Jarkko Sakkinen
2020-10-13 10:53 ` Sumit Garg
2020-10-13 10:53 ` Sumit Garg
2020-10-13 10:53 ` Sumit Garg
2020-10-13 11:59 ` Jarkko Sakkinen
2020-10-13 11:59 ` Jarkko Sakkinen
2020-10-13 11:59 ` Jarkko Sakkinen
2020-10-14 5:04 ` Sumit Garg
2020-10-14 5:16 ` Sumit Garg
2020-10-14 5:04 ` Sumit Garg
2020-10-21 3:21 ` Mimi Zohar
2020-10-21 3:21 ` Mimi Zohar
2020-10-21 5:46 ` Sumit Garg
2020-10-21 5:46 ` Sumit Garg
2020-10-21 12:25 ` Mimi Zohar
2020-10-21 12:25 ` Mimi Zohar
2020-10-22 11:40 ` Sumit Garg
2020-10-22 11:40 ` Sumit Garg
2020-10-07 10:07 ` [PATCH v7 2/4] KEYS: trusted: Introduce TEE based Trusted Keys Sumit Garg
2020-10-07 10:19 ` Sumit Garg
2020-10-07 10:07 ` Sumit Garg
2020-10-13 1:52 ` Jarkko Sakkinen
2020-10-13 1:52 ` Jarkko Sakkinen
2020-10-13 1:52 ` Jarkko Sakkinen
2020-10-13 11:01 ` Sumit Garg
2020-10-13 11:13 ` Sumit Garg
2020-10-13 11:01 ` Sumit Garg
2020-10-07 10:07 ` [PATCH v7 3/4] doc: trusted-encrypted: updates with TEE as a new trust source Sumit Garg
2020-10-07 10:19 ` Sumit Garg
2020-10-07 10:07 ` Sumit Garg
2020-10-07 10:07 ` [PATCH v7 4/4] MAINTAINERS: Add entry for TEE based Trusted Keys Sumit Garg
2020-10-07 10:19 ` Sumit Garg
2020-10-07 10:07 ` Sumit Garg
2020-10-13 2:21 ` Jarkko Sakkinen
2020-10-13 2:21 ` Jarkko Sakkinen
2020-10-13 2:21 ` Jarkko Sakkinen
2020-10-13 11:28 ` Sumit Garg
2020-10-13 11:40 ` Sumit Garg
2020-10-13 11:28 ` Sumit Garg
2020-10-13 13:40 ` Jarkko Sakkinen
2020-10-13 13:40 ` Jarkko Sakkinen
2020-10-13 13:40 ` Jarkko Sakkinen
2020-10-14 5:06 ` Sumit Garg
2020-10-14 5:18 ` Sumit Garg
2020-10-14 5:06 ` Sumit Garg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201013014304.GC41176@linux.intel.com \
--to=jarkko.sakkinen@linux.intel.com \
--cc=Markus.Wamser@mixed-mode.de \
--cc=casey@schaufler-ca.com \
--cc=corbet@lwn.net \
--cc=daniel.thompson@linaro.org \
--cc=dhowells@redhat.com \
--cc=janne.karhunen@gmail.com \
--cc=jejb@linux.ibm.com \
--cc=jens.wiklander@linaro.org \
--cc=jmorris@namei.org \
--cc=jpoimboe@redhat.com \
--cc=keyrings@vger.kernel.org \
--cc=lhinds@redhat.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=op-tee@lists.trustedfirmware.org \
--cc=serge@hallyn.com \
--cc=sumit.garg@linaro.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.