Merge tag 'modsign-pkcs7-20150814' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into ra-next

James Morris committed 11 years ago

Commit f062bca2 parents 3e5f206 3ee550f11 files · +212 −198Browse files

Unified · Split

11 files

Documentation/module-signing.txt +9 −9
MAINTAINERS +9 −0
Makefile +4 −5
certs/Kconfig +42 −0
certs/Makefile +94 −0
certs/system_certificates.S +2 −2
certs/system_keyring.c +0 −0
crypto/Kconfig +1 −0
init/Kconfig +0 −39
kernel/Makefile +0 −143
scripts/Kbuild.include +51 −0

@@ -92,13 +92,13 @@ This has a number of options available: · 91 unmodified lines
92	92	(4) "File name or PKCS#11 URI of module signing key" (CONFIG_MODULE_SIG_KEY)
93	93
94	94	Setting this option to something other than its default of
95		− "signing_key.pem" will disable the autogeneration of signing keys and
96		− allow the kernel modules to be signed with a key of your choosing.
97		− The string provided should identify a file containing both a private
98		− key and its corresponding X.509 certificate in PEM form, or — on
99		− systems where the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI
100		− as defined by RFC7512. In the latter case, the PKCS#11 URI should
101		− reference both a certificate and a private key.
	95	+ "certs/signing_key.pem" will disable the autogeneration of signing keys
	96	+ and allow the kernel modules to be signed with a key of your choosing.
	97	+ The string provided should identify a file containing both a private key
	98	+ and its corresponding X.509 certificate in PEM form, or — on systems where
	99	+ the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI as defined by
	100	+ RFC7512. In the latter case, the PKCS#11 URI should reference both a
	101	+ certificate and a private key.
102	102
103	103	If the PEM file containing the private key is encrypted, or if the
104	104	PKCS#11 token requries a PIN, this can be provided at build time by
@@ -130,12 +130,12 @@ Under normal conditions, when CONFIG_MODULE_SIG_KEY is unchanged from its · 25 unmodified lines
130	130	default, the kernel build will automatically generate a new keypair using
131	131	openssl if one does not exist in the file:
132	132
133		− signing_key.pem
	133	+ certs/signing_key.pem
134	134
135	135	during the building of vmlinux (the public part of the key needs to be built
136	136	into vmlinux) using parameters in the:
137	137
138		− x509.genkey
	138	+ certs/x509.genkey
139	139
140	140	file (which is also generated if it does not already exist).
141	141

MAINTAINERS+9−0

@@ -2589,6 +2589,15 @@ S: Supported · 2588 unmodified lines
2589	2589	F: Documentation/filesystems/ceph.txt
2590	2590	F: fs/ceph/
2591	2591
	2592	+CERTIFICATE HANDLING:
	2593	+M: David Howells <dhowells@redhat.com>
	2594	+M: David Woodhouse <dwmw2@infradead.org>
	2595	+L: keyrings@linux-nfs.org
	2596	+S: Maintained
	2597	+F: Documentation/module-signing.txt
	2598	+F: certs/
	2599	+F: scripts/extract-cert.c
	2600	+
2592	2601	CERTIFIED WIRELESS USB (WUSB) SUBSYSTEM:
2593	2602	L: linux-usb@vger.kernel.org
2594	2603	S: Orphan

Makefile+4−5

@@ -870,10 +870,9 @@ INITRD_COMPRESS-$(CONFIG_RD_LZ4) := lz4 · 869 unmodified lines
870	870	# export INITRD_COMPRESS := $(INITRD_COMPRESS-y)
871	871
872	872	ifdef CONFIG_MODULE_SIG_ALL
873		−MODSECKEY = $(CONFIG_MODULE_SIG_KEY)
874		−MODPUBKEY = ./signing_key.x509
875		−export MODPUBKEY
876		−mod_sign_cmd = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODSECKEY) $(MODPUBKEY)
	873	+$(eval $(call config_filename,MODULE_SIG_KEY))
	874	+
	875	+mod_sign_cmd = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY) certs/signing_key.x509
877	876	else
878	877	mod_sign_cmd = true
879	878	endif
@@ -881,7 +880,7 @@ export mod_sign_cmd · 1 unmodified line
881	880
882	881
883	882	ifeq ($(KBUILD_EXTMOD),)
884		−core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
	883	+core-y += kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/
885	884
886	885	vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
887	886	$(core-y) $(core-m) $(drivers-y) $(drivers-m) \

certs/Kconfig+42−0

@@ -0,0 +1,42 @@
	1	+menu "Certificates for signature checking"
	2	+
	3	+config MODULE_SIG_KEY
	4	+ string "File name or PKCS#11 URI of module signing key"
	5	+ default "certs/signing_key.pem"
	6	+ depends on MODULE_SIG
	7	+ help
	8	+ Provide the file name of a private key/certificate in PEM format,
	9	+ or a PKCS#11 URI according to RFC7512. The file should contain, or
	10	+ the URI should identify, both the certificate and its corresponding
	11	+ private key.
	12	+
	13	+ If this option is unchanged from its default "certs/signing_key.pem",
	14	+ then the kernel will automatically generate the private key and
	15	+ certificate as described in Documentation/module-signing.txt
	16	+
	17	+config SYSTEM_TRUSTED_KEYRING
	18	+ bool "Provide system-wide ring of trusted keys"
	19	+ depends on KEYS
	20	+ help
	21	+ Provide a system keyring to which trusted keys can be added. Keys in
	22	+ the keyring are considered to be trusted. Keys may be added at will
	23	+ by the kernel from compiled-in data and from hardware key stores, but
	24	+ userspace may only add extra keys if those keys can be verified by
	25	+ keys already in the keyring.
	26	+
	27	+ Keys in this keyring are used by module signature checking.
	28	+
	29	+config SYSTEM_TRUSTED_KEYS
	30	+ string "Additional X.509 keys for default system keyring"
	31	+ depends on SYSTEM_TRUSTED_KEYRING
	32	+ help
	33	+ If set, this option should be the filename of a PEM-formatted file
	34	+ containing trusted X.509 certificates to be included in the default
	35	+ system keyring. Any certificate used for module signing is implicitly
	36	+ also trusted.
	37	+
	38	+ NOTE: If you previously provided keys for the system keyring in the
	39	+ form of DER-encoded *.x509 files in the top-level build directory,
	40	+ those are no longer used. You will need to set this option instead.
	41	+
	42	+endmenu

certs/Makefile+94−0

@@ -0,0 +1,94 @@
	1	+#
	2	+# Makefile for the linux kernel signature checking certificates.
	3	+#
	4	+
	5	+obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o
	6	+
	7	+ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
	8	+
	9	+$(eval $(call config_filename,SYSTEM_TRUSTED_KEYS))
	10	+
	11	+# GCC doesn't include .incbin files in -MD generated dependencies (PR#66871)
	12	+$(obj)/system_certificates.o: $(obj)/x509_certificate_list
	13	+
	14	+# Cope with signing_key.x509 existing in $(srctree) not $(objtree)
	15	+AFLAGS_system_certificates.o := -I$(srctree)
	16	+
	17	+quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2))
	18	+ cmd_extract_certs = scripts/extract-cert $(2) $@ \|\| ( rm $@; exit 1)
	19	+
	20	+targets += x509_certificate_list
	21	+$(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE
	22	+ $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS))
	23	+endif
	24	+
	25	+clean-files := x509_certificate_list .x509.list
	26	+
	27	+ifeq ($(CONFIG_MODULE_SIG),y)
	28	+###############################################################################
	29	+#
	30	+# If module signing is requested, say by allyesconfig, but a key has not been
	31	+# supplied, then one will need to be generated to make sure the build does not
	32	+# fail and that the kernel may be used afterwards.
	33	+#
	34	+###############################################################################
	35	+ifndef CONFIG_MODULE_SIG_HASH
	36	+$(error Could not determine digest type to use from kernel config)
	37	+endif
	38	+
	39	+# We do it this way rather than having a boolean option for enabling an
	40	+# external private key, because 'make randconfig' might enable such a
	41	+# boolean option and we unfortunately can't make it depend on !RANDCONFIG.
	42	+ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
	43	+$(obj)/signing_key.pem: $(obj)/x509.genkey
	44	+ @echo "###"
	45	+ @echo "### Now generating an X.509 key pair to be used for signing modules."
	46	+ @echo "###"
	47	+ @echo "### If this takes a long time, you might wish to run rngd in the"
	48	+ @echo "### background to keep the supply of entropy topped up. It"
	49	+ @echo "### needs to be run as root, and uses a hardware random"
	50	+ @echo "### number generator if one is available."
	51	+ @echo "###"
	52	+ openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
	53	+ -batch -x509 -config $(obj)/x509.genkey \
	54	+ -outform PEM -out $(obj)/signing_key.pem \
	55	+ -keyout $(obj)/signing_key.pem 2>&1
	56	+ @echo "###"
	57	+ @echo "### Key pair generated."
	58	+ @echo "###"
	59	+
	60	+$(obj)/x509.genkey:
	61	+ @echo Generating X.509 key generation config
	62	+ @echo >$@ "[ req ]"
	63	+ @echo >>$@ "default_bits = 4096"
	64	+ @echo >>$@ "distinguished_name = req_distinguished_name"
	65	+ @echo >>$@ "prompt = no"
	66	+ @echo >>$@ "string_mask = utf8only"
	67	+ @echo >>$@ "x509_extensions = myexts"
	68	+ @echo >>$@
	69	+ @echo >>$@ "[ req_distinguished_name ]"
	70	+ @echo >>$@ "#O = Unspecified company"
	71	+ @echo >>$@ "CN = Build time autogenerated kernel key"
	72	+ @echo >>$@ "#emailAddress = unspecified.user@unspecified.company"
	73	+ @echo >>$@
	74	+ @echo >>$@ "[ myexts ]"
	75	+ @echo >>$@ "basicConstraints=critical,CA:FALSE"
	76	+ @echo >>$@ "keyUsage=digitalSignature"
	77	+ @echo >>$@ "subjectKeyIdentifier=hash"
	78	+ @echo >>$@ "authorityKeyIdentifier=keyid"
	79	+endif
	80	+
	81	+$(eval $(call config_filename,MODULE_SIG_KEY))
	82	+
	83	+# If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it
	84	+ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME)))
	85	+X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME)
	86	+endif
	87	+
	88	+# GCC PR#66871 again.
	89	+$(obj)/system_certificates.o: $(obj)/signing_key.x509
	90	+
	91	+targets += signing_key.x509
	92	+$(obj)/signing_key.x509: scripts/extract-cert $(X509_DEP) FORCE
	93	+ $(call if_changed,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY))
	94	+endif

certs/system_certificates.Srenamed from kernel/system_certificates.S+2−2

@@ -8,9 +8,9 @@ · 7 unmodified lines
8	8	VMLINUX_SYMBOL(system_certificate_list):
9	9	__cert_list_start:
10	10	#ifdef CONFIG_MODULE_SIG
11		− .incbin "signing_key.x509"
	11	+ .incbin "certs/signing_key.x509"
12	12	#endif
13		− .incbin "kernel/x509_certificate_list"
	13	+ .incbin "certs/x509_certificate_list"
14	14	__cert_list_end:
15	15
16	16	.align 8

certs/system_keyring.crenamed from kernel/system_keyring.c+0−0

File renamed without changes.

crypto/Kconfig+1−0

@@ -1601,5 +1601,6 @@ config CRYPTO_HASH_INFO · 1600 unmodified lines
1601	1601
1602	1602	source "drivers/crypto/Kconfig"
1603	1603	source crypto/asymmetric_keys/Kconfig
	1604	+source certs/Kconfig
1604	1605
1605	1606	endif # if CRYPTO

init/Kconfig+0−39

@@ -1740,31 +1740,6 @@ config MMAP_ALLOW_UNINITIALIZED · 1739 unmodified lines
1740	1740
1741	1741	See Documentation/nommu-mmap.txt for more information.
1742	1742
1743		−config SYSTEM_TRUSTED_KEYRING
1744		− bool "Provide system-wide ring of trusted keys"
1745		− depends on KEYS
1746		− help
1747		− Provide a system keyring to which trusted keys can be added. Keys in
1748		− the keyring are considered to be trusted. Keys may be added at will
1749		− by the kernel from compiled-in data and from hardware key stores, but
1750		− userspace may only add extra keys if those keys can be verified by
1751		− keys already in the keyring.
1752		−
1753		− Keys in this keyring are used by module signature checking.
1754		−
1755		−config SYSTEM_TRUSTED_KEYS
1756		− string "Additional X.509 keys for default system keyring"
1757		− depends on SYSTEM_TRUSTED_KEYRING
1758		− help
1759		− If set, this option should be the filename of a PEM-formatted file
1760		− containing trusted X.509 certificates to be included in the default
1761		− system keyring. Any certificate used for module signing is implicitly
1762		− also trusted.
1763		−
1764		− NOTE: If you previously provided keys for the system keyring in the
1765		− form of DER-encoded *.x509 files in the top-level build directory,
1766		− those are no longer used. You will need to set this option instead.
1767		−
1768	1743	config SYSTEM_DATA_VERIFICATION
1769	1744	def_bool n
1770	1745	select SYSTEM_TRUSTED_KEYRING
@@ -1965,20 +1940,6 @@ config MODULE_SIG_HASH · 194 unmodified lines
1965	1940	default "sha384" if MODULE_SIG_SHA384
1966	1941	default "sha512" if MODULE_SIG_SHA512
1967	1942
1968		−config MODULE_SIG_KEY
1969		− string "File name or PKCS#11 URI of module signing key"
1970		− default "signing_key.pem"
1971		− depends on MODULE_SIG
1972		− help
1973		− Provide the file name of a private key/certificate in PEM format,
1974		− or a PKCS#11 URI according to RFC7512. The file should contain, or
1975		− the URI should identify, both the certificate and its corresponding
1976		− private key.
1977		−
1978		− If this option is unchanged from its default "signing_key.pem",
1979		− then the kernel will automatically generate the private key and
1980		− certificate as described in Documentation/module-signing.txt
1981		−
1982	1943	config MODULE_COMPRESS
1983	1944	bool "Compress modules on installation"
1984	1945	depends on MODULES

kernel/Makefile+0−143

@@ -45,7 +45,6 @@ ifneq ($(CONFIG_SMP),y) · 44 unmodified lines
45	45	obj-y += up.o
46	46	endif
47	47	obj-$(CONFIG_UID16) += uid16.o
48		−obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o
49	48	obj-$(CONFIG_MODULES) += module.o
50	49	obj-$(CONFIG_MODULE_SIG) += module_signing.o
51	50	obj-$(CONFIG_KALLSYMS) += kallsyms.o
@@ -111,145 +110,3 @@ $(obj)/config_data.gz: $(KCONFIG_CONFIG) FORCE · 59 unmodified lines
111	110	targets += config_data.h
112	111	$(obj)/config_data.h: $(obj)/config_data.gz FORCE
113	112	$(call filechk,ikconfiggz)
114		−
115		−###############################################################################
116		−#
117		−# When a Kconfig string contains a filename, it is suitable for
118		−# passing to shell commands. It is surrounded by double-quotes, and
119		−# any double-quotes or backslashes within it are escaped by
120		−# backslashes.
121		−#
122		−# This is no use for dependencies or $(wildcard). We need to strip the
123		−# surrounding quotes and the escaping from quotes and backslashes, and
124		−# we do need to escape any spaces in the string. So, for example:
125		−#
126		−# Usage: $(eval $(call config_filename,FOO))
127		−#
128		−# Defines FOO_FILENAME based on the contents of the CONFIG_FOO option,
129		−# transformed as described above to be suitable for use within the
130		−# makefile.
131		−#
132		−# Also, if the filename is a relative filename and exists in the source
133		−# tree but not the build tree, define FOO_SRCPREFIX as $(srctree)/ to
134		−# be prefixed to both command invocation and dependencies.
135		−#
136		−# Note: We also print the filenames in the quiet_cmd_foo text, and
137		−# perhaps ought to have a version specially escaped for that purpose.
138		−# But it's only cosmetic, and $(patsubst "%",%,$(CONFIG_FOO)) is good
139		−# enough. It'll strip the quotes in the common case where there's no
140		−# space and it's a simple filename, and it'll retain the quotes when
141		−# there's a space. There are some esoteric cases in which it'll print
142		−# the wrong thing, but we don't really care. The actual dependencies
143		−# and commands do get it right, with various combinations of single
144		−# and double quotes, backslashes and spaces in the filenames.
145		−#
146		−###############################################################################
147		−#
148		−quote := $(firstword " ")
149		−space :=
150		−space +=
151		−space_escape := %%%SPACE%%%
152		−#
153		−define config_filename
154		−ifneq ($$(CONFIG_$(1)),"")
155		−$(1)_FILENAME := $$(subst \\,\,$$(subst \$$(quote),$$(quote),$$(subst $$(space_escape),\$$(space),$$(patsubst "%",%,$$(subst $$(space),$$(space_escape),$$(CONFIG_$(1)))))))
156		−ifneq ($$(patsubst /%,%,$$(firstword $$($(1)_FILENAME))),$$(firstword $$($(1)_FILENAME)))
157		−else
158		−ifeq ($$(wildcard $$($(1)_FILENAME)),)
159		−ifneq ($$(wildcard $$(srctree)/$$($(1)_FILENAME)),)
160		−$(1)_SRCPREFIX := $(srctree)/
161		−endif
162		−endif
163		−endif
164		−endif
165		−endef
166		−#
167		−###############################################################################
168		−
169		−ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
170		−
171		−$(eval $(call config_filename,SYSTEM_TRUSTED_KEYS))
172		−
173		−# GCC doesn't include .incbin files in -MD generated dependencies (PR#66871)
174		−$(obj)/system_certificates.o: $(obj)/x509_certificate_list
175		−
176		−# Cope with signing_key.x509 existing in $(srctree) not $(objtree)
177		−AFLAGS_system_certificates.o := -I$(srctree)
178		−
179		−quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2))
180		− cmd_extract_certs = scripts/extract-cert $(2) $@ \|\| ( rm $@; exit 1)
181		−
182		−targets += x509_certificate_list
183		−$(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE
184		− $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS))
185		−endif
186		−
187		−clean-files := x509_certificate_list .x509.list
188		−
189		−ifeq ($(CONFIG_MODULE_SIG),y)
190		−###############################################################################
191		−#
192		−# If module signing is requested, say by allyesconfig, but a key has not been
193		−# supplied, then one will need to be generated to make sure the build does not
194		−# fail and that the kernel may be used afterwards.
195		−#
196		−###############################################################################
197		−ifndef CONFIG_MODULE_SIG_HASH
198		−$(error Could not determine digest type to use from kernel config)
199		−endif
200		−
201		−# We do it this way rather than having a boolean option for enabling an
202		−# external private key, because 'make randconfig' might enable such a
203		−# boolean option and we unfortunately can't make it depend on !RANDCONFIG.
204		−ifeq ($(CONFIG_MODULE_SIG_KEY),"signing_key.pem")
205		−signing_key.pem: x509.genkey
206		− @echo "###"
207		− @echo "### Now generating an X.509 key pair to be used for signing modules."
208		− @echo "###"
209		− @echo "### If this takes a long time, you might wish to run rngd in the"
210		− @echo "### background to keep the supply of entropy topped up. It"
211		− @echo "### needs to be run as root, and uses a hardware random"
212		− @echo "### number generator if one is available."
213		− @echo "###"
214		− openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
215		− -batch -x509 -config x509.genkey \
216		− -outform PEM -out signing_key.pem \
217		− -keyout signing_key.pem 2>&1
218		− @echo "###"
219		− @echo "### Key pair generated."
220		− @echo "###"
221		−
222		−x509.genkey:
223		− @echo Generating X.509 key generation config
224		− @echo >x509.genkey "[ req ]"
225		− @echo >>x509.genkey "default_bits = 4096"
226		− @echo >>x509.genkey "distinguished_name = req_distinguished_name"
227		− @echo >>x509.genkey "prompt = no"
228		− @echo >>x509.genkey "string_mask = utf8only"
229		− @echo >>x509.genkey "x509_extensions = myexts"
230		− @echo >>x509.genkey
231		− @echo >>x509.genkey "[ req_distinguished_name ]"
232		− @echo >>x509.genkey "#O = Unspecified company"
233		− @echo >>x509.genkey "CN = Build time autogenerated kernel key"
234		− @echo >>x509.genkey "#emailAddress = unspecified.user@unspecified.company"
235		− @echo >>x509.genkey
236		− @echo >>x509.genkey "[ myexts ]"
237		− @echo >>x509.genkey "basicConstraints=critical,CA:FALSE"
238		− @echo >>x509.genkey "keyUsage=digitalSignature"
239		− @echo >>x509.genkey "subjectKeyIdentifier=hash"
240		− @echo >>x509.genkey "authorityKeyIdentifier=keyid"
241		−endif
242		−
243		−$(eval $(call config_filename,MODULE_SIG_KEY))
244		−
245		−# If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it
246		−ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME)))
247		−X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME)
248		−endif
249		−
250		−# GCC PR#66871 again.
251		−$(obj)/system_certificates.o: signing_key.x509
252		−
253		−signing_key.x509: scripts/extract-cert include/config/module/sig/key.h $(X509_DEP)
254		− $(call cmd,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY))
255		−endif

scripts/Kbuild.include+51−0

@@ -303,3 +303,54 @@ why = \ · 302 unmodified lines
303	303
304	304	echo-why = $(call escsq, $(strip $(why)))
305	305	endif
	306	+
	307	+###############################################################################
	308	+#
	309	+# When a Kconfig string contains a filename, it is suitable for
	310	+# passing to shell commands. It is surrounded by double-quotes, and
	311	+# any double-quotes or backslashes within it are escaped by
	312	+# backslashes.
	313	+#
	314	+# This is no use for dependencies or $(wildcard). We need to strip the
	315	+# surrounding quotes and the escaping from quotes and backslashes, and
	316	+# we do need to escape any spaces in the string. So, for example:
	317	+#
	318	+# Usage: $(eval $(call config_filename,FOO))
	319	+#
	320	+# Defines FOO_FILENAME based on the contents of the CONFIG_FOO option,
	321	+# transformed as described above to be suitable for use within the
	322	+# makefile.
	323	+#
	324	+# Also, if the filename is a relative filename and exists in the source
	325	+# tree but not the build tree, define FOO_SRCPREFIX as $(srctree)/ to
	326	+# be prefixed to both command invocation and dependencies.
	327	+#
	328	+# Note: We also print the filenames in the quiet_cmd_foo text, and
	329	+# perhaps ought to have a version specially escaped for that purpose.
	330	+# But it's only cosmetic, and $(patsubst "%",%,$(CONFIG_FOO)) is good
	331	+# enough. It'll strip the quotes in the common case where there's no
	332	+# space and it's a simple filename, and it'll retain the quotes when
	333	+# there's a space. There are some esoteric cases in which it'll print
	334	+# the wrong thing, but we don't really care. The actual dependencies
	335	+# and commands do get it right, with various combinations of single
	336	+# and double quotes, backslashes and spaces in the filenames.
	337	+#
	338	+###############################################################################
	339	+#
	340	+space_escape := %%%SPACE%%%
	341	+#
	342	+define config_filename
	343	+ifneq ($$(CONFIG_$(1)),"")
	344	+$(1)_FILENAME := $$(subst \\,\,$$(subst \$$(quote),$$(quote),$$(subst $$(space_escape),\$$(space),$$(patsubst "%",%,$$(subst $$(space),$$(space_escape),$$(CONFIG_$(1)))))))
	345	+ifneq ($$(patsubst /%,%,$$(firstword $$($(1)_FILENAME))),$$(firstword $$($(1)_FILENAME)))
	346	+else
	347	+ifeq ($$(wildcard $$($(1)_FILENAME)),)
	348	+ifneq ($$(wildcard $$(srctree)/$$($(1)_FILENAME)),)
	349	+$(1)_SRCPREFIX := $(srctree)/
	350	+endif
	351	+endif
	352	+endif
	353	+endif
	354	+endef
	355	+#
	356	+###############################################################################