Messages in this thread | | | Date | Tue, 13 Jun 2023 09:47:43 -0700 (PDT) | From | Shyam Saini <> | Subject | RE: [PATCH v2 0/4] rpmb subsystem, uapi and virtio-rpmb driver |
| |
Hi Bing,
Other than PCRs we also want to store Non volatile ftpm data (NVData), storing these in volatile DDR shared memory will be a spec violation.
Best Regards, Shyam
> As an alternative, Is it possible to change ftpm design not to depend on RPMB access at the earlier/boot stage? Because to my understanding, typically PCRs don't require persistent/NV storage (for example, before RPMB or tee-supplicant is ready, use TEE memory instead as temporary storage) > > Bing > > IPAS Security Brown Belt (https://www.credly.com/badges/69ea809f-3a96-4bc7-bb2f-442c1b17af26) > System Software Engineering > Software and Advanced Technology Group > Zizhu Science Park, Shanghai, China > > -----Original Message----- > From: Shyam Saini <shyamsaini@linux.microsoft.com> > Sent: Thursday, June 1, 2023 3:10 AM > To: alex.bennee@linaro.org > Cc: code@tyhicks.com; Matti.Moell@opensynergy.com; arnd@linaro.org; Zhu, Bing <bing.zhu@intel.com>; hmo@opensynergy.com; ilias.apalodimas@linaro.org; joakim.bech@linaro.org; linux-kernel@vger.kernel.org; linux-mmc@vger.kernel.org; linux-scsi@vger.kernel.org; maxim.uvarov@linaro.org; ruchika.gupta@linaro.org; Winkler, Tomas <tomas.winkler@intel.com>; ulf.hansson@linaro.org; Huang, Yang <yang.huang@intel.com>; sumit.garg@linaro.org; jens.wiklander@linaro.org; op-tee@lists.trustedfirmware.org > Subject: [PATCH v2 0/4] rpmb subsystem, uapi and virtio-rpmb driver > > Hi Alex, > > [ Resending, Sorry for the noise ] > > Are you still working on it or planning to resubmit it ? > > [1] The current optee tee kernel driver implementation doesn't work when IMA is used with optee implemented ftpm. > > The ftpm has dependency on tee-supplicant which comes once the user space is up and running and IMA attestation happens at boot time and it requires to extend ftpm PCRs. > > But IMA can't use PCRs if ftpm use secure emmc RPMB partition. As optee can only access RPMB via tee-supplicant(user space). So, there should be a fast path to allow optee os to access the RPMB parititon without waiting for user-space tee supplicant. > > To achieve this fast path linux optee driver and mmc driver needs some work and finally it will need RPMB driver which you posted. > > Please let me know what's your plan on this. > > [1] https://optee.readthedocs.io/en/latest/architecture/secure_storage.html > > Best Regards, > Shyam >
| |