From 0f256a0a7adf5741e4a061f59a08cd01c14dc526 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Mon, 20 Jul 2026 00:16:52 +0100 Subject: [PATCH] kernel: modules: package OP-TEE and fTPM modules Add kmod packages to support accessing the fTPM (in-firmware TPM) which can be implemented in the boot firmware of most modern platforms. - kmod-optee: Open Portable Trusted Execution Environment - kmod-optee-rng: OP-TEE random number generator client - kmod-rtc-optee: OP-TEE real-time clock client - kmod-scmi-transport-optee: SCMI OP-TEE transport - kmod-tee: Generic Trusted Execution Environment - kmod-tee-stmm-efi: EFI variable service Trusted Application - kmod-tpm-ftpm-tee: Microsoft fTPM Trusted Application Using the TPM 2.0 can be useful for various security applications, such as encrypting on-disk credentials. OP-TEE itself alone is also useful as it can provide a PKCS#11 token for authentication (eg. to connect to a VPN) and significantly lower the risk of leaking secrets used for authentication. Also, on some platforms RNG and RTC can only be accessed via OP-TEE, and some ARM SystemReady platforms require EFI variables to be access via a TA. Signed-off-by: Daniel Golle --- package/kernel/linux/modules/other.mk | 104 ++++++++++++++++++++++++ package/kernel/linux/modules/rtc.mk | 19 +++++ target/linux/generic/config-6.12 | 1 + target/linux/generic/config-6.18 | 1 + target/linux/qualcommbe/config-6.18 | 1 + target/linux/stm32/stm32mp1/config-6.18 | 1 + 6 files changed, 127 insertions(+) diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk index e8f62d3172..ad7ac9a0b7 100644 --- a/package/kernel/linux/modules/other.mk +++ b/package/kernel/linux/modules/other.mk @@ -935,6 +935,93 @@ endef $(eval $(call KernelPackage,echo)) +define KernelPackage/tee + SUBMENU:=$(OTHER_MENU) + TITLE:=Trusted Execution Environment (TEE) support + DEPENDS:=+kmod-dma-buf + KCONFIG:=CONFIG_TEE + FILES:=$(LINUX_DIR)/drivers/tee/tee.ko + AUTOLOAD:=$(call AutoLoad,20,tee,1) +endef + +define KernelPackage/tee/description + Generic Trusted Execution Environment subsystem, the interface used to + communicate with a trusted OS running in a secure environment. +endef + +$(eval $(call KernelPackage,tee)) + + +define KernelPackage/optee + SUBMENU:=$(OTHER_MENU) + TITLE:=OP-TEE driver + DEPENDS:=+kmod-i2c-core +kmod-tee + KCONFIG:= \ + CONFIG_OPTEE \ + CONFIG_OPTEE_INSECURE_LOAD_IMAGE=n + FILES:=$(LINUX_DIR)/drivers/tee/optee/optee.ko + AUTOLOAD:=$(call AutoLoad,21,optee,1) +endef + +define KernelPackage/optee/description + Driver for OP-TEE, the Open Portable Trusted Execution Environment running + in the Arm secure world, reached over the SMCCC or FF-A transport. +endef + +$(eval $(call KernelPackage,optee)) + + +define KernelPackage/optee-rng + SUBMENU:=$(OTHER_MENU) + TITLE:=OP-TEE based Random Number Generator + DEPENDS:=+kmod-optee +kmod-random-core + KCONFIG:=CONFIG_HW_RANDOM_OPTEE + FILES:=$(LINUX_DIR)/drivers/char/hw_random/optee-rng.ko + AUTOLOAD:=$(call AutoLoad,22,optee-rng,1) +endef + +define KernelPackage/optee-rng/description + Exposes the random number generator provided by OP-TEE through the kernel + hwrng interface. +endef + +$(eval $(call KernelPackage,optee-rng)) + + +define KernelPackage/scmi-transport-optee + SUBMENU:=$(OTHER_MENU) + TITLE:=SCMI transport based on OP-TEE service + DEPENDS:=@(TARGET_rockchip||TARGET_stm32) +kmod-optee + KCONFIG:=CONFIG_ARM_SCMI_TRANSPORT_OPTEE + FILES:=$(LINUX_DIR)/drivers/firmware/arm_scmi/transports/scmi_transport_optee.ko + AUTOLOAD:=$(call AutoProbe,scmi_transport_optee) +endef + +define KernelPackage/scmi-transport-optee/description + Arm SCMI transport using an OP-TEE service to communicate with the + platform firmware implementing the SCMI server. +endef + +$(eval $(call KernelPackage,scmi-transport-optee)) + + +define KernelPackage/tee-stmm-efi + SUBMENU:=$(OTHER_MENU) + TITLE:=TEE based EFI runtime variable service + DEPENDS:=@TARGET_armsr +kmod-optee + KCONFIG:=CONFIG_TEE_STMM_EFI + FILES:=$(LINUX_DIR)/drivers/firmware/efi/stmm/tee_stmm_efi.ko + AUTOLOAD:=$(call AutoProbe,tee_stmm_efi) +endef + +define KernelPackage/tee-stmm-efi/description + Provides EFI runtime variable services through the StandAloneMM Trusted + Application running in OP-TEE. +endef + +$(eval $(call KernelPackage,tee-stmm-efi)) + + define KernelPackage/keys-encrypted SUBMENU:=$(OTHER_MENU) TITLE:=encrypted keys on kernel keyring @@ -991,6 +1078,23 @@ endef $(eval $(call KernelPackage,tpm)) +define KernelPackage/tpm-ftpm-tee + SUBMENU:=$(OTHER_MENU) + TITLE:=TEE based firmware TPM (fTPM) + DEPENDS:=+kmod-tpm +kmod-optee + KCONFIG:=CONFIG_TCG_FTPM_TEE + FILES:=$(LINUX_DIR)/drivers/char/tpm/tpm_ftpm_tee.ko + AUTOLOAD:=$(call AutoLoad,30,tpm_ftpm_tee,1) +endef + +define KernelPackage/tpm-ftpm-tee/description + Driver for a firmware TPM (fTPM) running as a Trusted Application inside a + TEE such as OP-TEE. It presents the fTPM to Linux as a TPM 2.0 device, + bound over the TEE client bus or a microsoft,ftpm device tree node. +endef + +$(eval $(call KernelPackage,tpm-ftpm-tee)) + define KernelPackage/tpm-tis SUBMENU:=$(OTHER_MENU) TITLE:=TPM TIS 1.2 Interface / TPM 2.0 FIFO Interface diff --git a/package/kernel/linux/modules/rtc.mk b/package/kernel/linux/modules/rtc.mk index 1613f26e4f..7530bd2f1b 100644 --- a/package/kernel/linux/modules/rtc.mk +++ b/package/kernel/linux/modules/rtc.mk @@ -134,6 +134,25 @@ endef $(eval $(call KernelPackage,rtc-mv)) +define KernelPackage/rtc-optee + SUBMENU:=$(RTC_MENU) + TITLE:=OP-TEE based RTC support + DEFAULT:=m if ALL_KMODS && RTC_SUPPORT + DEPENDS:=+kmod-optee + KCONFIG:=CONFIG_RTC_DRV_OPTEE \ + CONFIG_RTC_CLASS=y + FILES:=$(LINUX_DIR)/drivers/rtc/rtc-optee.ko + AUTOLOAD:=$(call AutoProbe,rtc-optee) +endef + +define KernelPackage/rtc-optee/description + Kernel module for the RTC service exposed by the OP-TEE Trusted + Execution Environment. +endef + +$(eval $(call KernelPackage,rtc-optee)) + + define KernelPackage/rtc-pcf8563 SUBMENU:=$(RTC_MENU) TITLE:=Philips PCF8563/Epson RTC8564 RTC support diff --git a/target/linux/generic/config-6.12 b/target/linux/generic/config-6.12 index ca96112d1b..6c1d9e5207 100644 --- a/target/linux/generic/config-6.12 +++ b/target/linux/generic/config-6.12 @@ -6661,6 +6661,7 @@ CONFIG_TCP_CONG_CUBIC=y # CONFIG_TCS3414 is not set # CONFIG_TCS3472 is not set # CONFIG_TEE is not set +# CONFIG_TEE_BNXT_FW is not set # CONFIG_TEGRA_AHB is not set # CONFIG_TEGRA_HOST1X is not set # CONFIG_TEHUTI is not set diff --git a/target/linux/generic/config-6.18 b/target/linux/generic/config-6.18 index 3e1a57f9c7..2141bc0d07 100644 --- a/target/linux/generic/config-6.18 +++ b/target/linux/generic/config-6.18 @@ -7030,6 +7030,7 @@ CONFIG_TCP_CONG_CUBIC=y # CONFIG_TCS3414 is not set # CONFIG_TCS3472 is not set # CONFIG_TEE is not set +# CONFIG_TEE_BNXT_FW is not set # CONFIG_TEGRA_AHB is not set # CONFIG_TEGRA_HOST1X is not set # CONFIG_TEHUTI is not set diff --git a/target/linux/qualcommbe/config-6.18 b/target/linux/qualcommbe/config-6.18 index 2da62a67bf..9476b17629 100644 --- a/target/linux/qualcommbe/config-6.18 +++ b/target/linux/qualcommbe/config-6.18 @@ -416,6 +416,7 @@ CONFIG_QCA807X_PHY=y CONFIG_QCA808X_PHY=y # CONFIG_QCM_DISPCC_2290 is not set # CONFIG_QCM_GCC_2290 is not set +# CONFIG_QCOMTEE is not set # CONFIG_QCOM_A53PLL is not set # CONFIG_QCOM_AOSS_QMP is not set CONFIG_QCOM_APCS_IPC=y diff --git a/target/linux/stm32/stm32mp1/config-6.18 b/target/linux/stm32/stm32mp1/config-6.18 index 77e9f495ff..c1bc6ac943 100644 --- a/target/linux/stm32/stm32mp1/config-6.18 +++ b/target/linux/stm32/stm32mp1/config-6.18 @@ -455,6 +455,7 @@ CONFIG_SQUASHFS_FILE_CACHE=y CONFIG_SQUASHFS_LZO=y CONFIG_SQUASHFS_ZLIB=y CONFIG_STM32MP_EXTI=y +# CONFIG_STM32_DBG_BUS is not set CONFIG_STM32_DMA=y # CONFIG_STM32_DMA3 is not set CONFIG_STM32_DMAMUX=y