lkml.org 
[lkml]   [2023]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRE: [PATCH v2 0/4] rpmb subsystem, uapi and virtio-rpmb driver
    Hi Bing,

    Other than PCRs we also want to store Non volatile ftpm data (NVData),
    storing these in volatile DDR shared memory will be a spec violation.

    Best Regards,
    Shyam

    > As an alternative, Is it possible to change ftpm design not to depend on RPMB access at the earlier/boot stage? Because to my understanding, typically PCRs don't require persistent/NV storage (for example, before RPMB or tee-supplicant is ready, use TEE memory instead as temporary storage)
    >
    > Bing
    >
    > IPAS Security Brown Belt (https://www.credly.com/badges/69ea809f-3a96-4bc7-bb2f-442c1b17af26)
    > System Software Engineering
    > Software and Advanced Technology Group
    > Zizhu Science Park, Shanghai, China
    >
    > -----Original Message-----
    > From: Shyam Saini <shyamsaini@linux.microsoft.com>
    > Sent: Thursday, June 1, 2023 3:10 AM
    > To: alex.bennee@linaro.org
    > Cc: code@tyhicks.com; Matti.Moell@opensynergy.com; arnd@linaro.org; Zhu, Bing <bing.zhu@intel.com>; hmo@opensynergy.com; ilias.apalodimas@linaro.org; joakim.bech@linaro.org; linux-kernel@vger.kernel.org; linux-mmc@vger.kernel.org; linux-scsi@vger.kernel.org; maxim.uvarov@linaro.org; ruchika.gupta@linaro.org; Winkler, Tomas <tomas.winkler@intel.com>; ulf.hansson@linaro.org; Huang, Yang <yang.huang@intel.com>; sumit.garg@linaro.org; jens.wiklander@linaro.org; op-tee@lists.trustedfirmware.org
    > Subject: [PATCH v2 0/4] rpmb subsystem, uapi and virtio-rpmb driver
    >
    > Hi Alex,
    >
    > [ Resending, Sorry for the noise ]
    >
    > Are you still working on it or planning to resubmit it ?
    >
    > [1] The current optee tee kernel driver implementation doesn't work when IMA is used with optee implemented ftpm.
    >
    > The ftpm has dependency on tee-supplicant which comes once the user space is up and running and IMA attestation happens at boot time and it requires to extend ftpm PCRs.
    >
    > But IMA can't use PCRs if ftpm use secure emmc RPMB partition. As optee can only access RPMB via tee-supplicant(user space). So, there should be a fast path to allow optee os to access the RPMB parititon without waiting for user-space tee supplicant.
    >
    > To achieve this fast path linux optee driver and mmc driver needs some work and finally it will need RPMB driver which you posted.
    >
    > Please let me know what's your plan on this.
    >
    > [1] https://optee.readthedocs.io/en/latest/architecture/secure_storage.html
    >
    > Best Regards,
    > Shyam
    >

    \
     
     \ /
      Last update: 2023-06-13 18:49    [W:3.226 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site