Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Zhu, Bing" <bing.zhu@intel.com>
To:     Shyam Saini <shyamsaini@linux.microsoft.com>,
        "alex.bennee@linaro.org" <alex.bennee@linaro.org>
CC:     "code@tyhicks.com" <code@tyhicks.com>,
        "Matti.Moell@opensynergy.com" <Matti.Moell@opensynergy.com>,
        "arnd@linaro.org" <arnd@linaro.org>,
        "hmo@opensynergy.com" <hmo@opensynergy.com>,
        "ilias.apalodimas@linaro.org" <ilias.apalodimas@linaro.org>,
        "joakim.bech@linaro.org" <joakim.bech@linaro.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-mmc@vger.kernel.org" <linux-mmc@vger.kernel.org>,
        "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
        "maxim.uvarov@linaro.org" <maxim.uvarov@linaro.org>,
        "ruchika.gupta@linaro.org" <ruchika.gupta@linaro.org>,
        "Winkler, Tomas" <tomas.winkler@intel.com>,
        "ulf.hansson@linaro.org" <ulf.hansson@linaro.org>,
        "Huang, Yang" <yang.huang@intel.com>,
        "sumit.garg@linaro.org" <sumit.garg@linaro.org>,
        "jens.wiklander@linaro.org" <jens.wiklander@linaro.org>,
        "op-tee@lists.trustedfirmware.org" <op-tee@lists.trustedfirmware.org>
Subject: RE: [PATCH  v2 0/4] rpmb subsystem, uapi and virtio-rpmb driver
Thread-Topic: [PATCH  v2 0/4] rpmb subsystem, uapi and virtio-rpmb driver
Thread-Index: AQHZk/OXR3LF1Hi7pkCJXle1/5bkgq91H0hw
Date:   Thu, 1 Jun 2023 01:02:39 +0000
Message-ID: <SN7PR11MB6850DA4A185E3429B62531CD84499@SN7PR11MB6850.namprd11.prod.outlook.com>
References: <20220405093759.1126835-1-alex.bennee@linaro.org>
 <20230531191007.13460-1-shyamsaini@linux.microsoft.com>
In-Reply-To: <20230531191007.13460-1-shyamsaini@linux.microsoft.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?Windows-1252?Q?JBzANlImPn5ijNfiQATZ5S7CjBFjFNveNY15arzcv4ktxRcRUWM0Q/Vr?=
 =?Windows-1252?Q?CO7Z/zC1bpIBK+6+hHOvyCDnVXbAIHybl4dMe9SGgxnDLytmIGTyX9oB?=
 =?Windows-1252?Q?3lxPzf/XzXqSfOZNNLczldsIfWNWHHPH1YC2abGHqrBAw2V0LebTfZLJ?=
 =?Windows-1252?Q?c17+j+GsbLteI/rai9CFRwQU84/ahOBnuOrF2FPtw4mkJtYMHS5XfDX3?=
 =?Windows-1252?Q?JwaF0YnG3AfPT2Xx2omLDCUKwJrVjiOP1XdA4jyFNoDEAZ6a7Pb8GLdK?=
 =?Windows-1252?Q?zpm3CCzmV0qswHlK76F6Lbeqzk0epGJKanND0jKUEyZyZ5llHkEK7pUH?=
 =?Windows-1252?Q?uKmmQxMtS25oVO0VwIpEp/TNP/xZb3SeXK2bXZmoKGSiGPse4jfRy+l6?=
 =?Windows-1252?Q?7ZZ8S0gW/FXx5HuQMp8vOjdHBsCqPZDt6gqetX/CPEtSSoJfKN7Buuzj?=
 =?Windows-1252?Q?K262Z4FSXRZwpqeUfT5SE9dJGf8VZ952UnRaS5GBCWg/3kpJBsKztbN8?=
 =?Windows-1252?Q?7UjokExf5Dy0heKfOOicQbinYDgkhAw/Xrq7iAvtnaiphJdoVdK0BT3b?=
 =?Windows-1252?Q?czcUugLGZNK7xY1drM4pcerXhQnkqVtti0rpOMxA39JD0fnguCDHD2zI?=
 =?Windows-1252?Q?DPUHgovDQOCeWLJPLnQVvJ8tm/eUG4c7d7N3xn03JF4S5kyzNvYE1+Nj?=
 =?Windows-1252?Q?HvjJnsHHObOARq8LUt9XQnRRZCAL3ZfkBCMyOvNugyKg1HZoy/0YIBzz?=
 =?Windows-1252?Q?XnDt6N8h2RaOTeIewhEMtuP1xeKav6AOgnnX0C6xEV+VqYXVUzjo0QIH?=
 =?Windows-1252?Q?o9RwaLmwQ+LMWx7VSAxuJQvNpfadFUtTXfCT78njkbkC+VXGEv4AqOnH?=
 =?Windows-1252?Q?dh2K7t748k+JsMwjmKqdF9Sw6TYBxHl8/KnusqWIufuVY2fhPONtH+A8?=
 =?Windows-1252?Q?16avY94VjV3qKeVp/A9j1JwttAi3dkAuJrHlpYD+UrUYhSmlBO8R4zIn?=
 =?Windows-1252?Q?EPekrkpaBsfsqoHyoqjXxpyi83uX3+is/4lU0jQA5bqIdfJClmt44MAH?=
 =?Windows-1252?Q?aqryrNBUuVnRdKLb5F6HqyC45M6/Vk7HPG1lWksA0ZJFlcT92pJFzi0b?=
 =?Windows-1252?Q?V0Iu7F+IRFfNUGN+XbKv64vLli8R1LGIUWhKMOl54Q9FNrWNJKCrROSB?=
 =?Windows-1252?Q?ux8prAbk5nDbzOaWm1zWZZ/g50vttOjff6J/TuQGHEFvxnXDBagPAe8e?=
 =?Windows-1252?Q?fXJaRR94A5LGBE/PDXJNWxXeKEqVF09yTYQYfurB1w+ap1Ukr+eFsJ+2?=
 =?Windows-1252?Q?qYSk38oZPQoyPCt6zG5R7deKvXTjM/9O3RbRB7VIOuRyUEdUxfXcBMET?=
 =?Windows-1252?Q?Zs1jThpGotnAzPxytfFOh3O19f/smDmsvk3tZAiT0bDnO9g6YgnZ1UZ1?=
 =?Windows-1252?Q?ZZOl+95LMoH4ymez+i8lguhV2ohii+h/cNlXH6dRp5JMoQXahcothOav?=
 =?Windows-1252?Q?T/9I1oVxDhS9BgoSlIPzI6pai7r4S16J/XnJ7VOVZtRxnWjH/A/3OFvS?=
 =?Windows-1252?Q?cylKAlYyg7wv4UYzL0LfEat2kU3NU8Pfe0V36MYA+LQiz+0Uz1ZgnL7b?=
 =?Windows-1252?Q?hF60gjNJWK/LTJPUDvkeTXa9l2c9I6VaNzzQZ6dWlozke+isDoy8laEv?=
 =?Windows-1252?Q?ZuLYeAIxd9o=3D?=
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN7PR11MB6850.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a2f83758-78e0-4f6d-6e7b-08db623be554
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Jun 2023 01:02:39.2724
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: ZEtomgawvgQ++GZ+OU2lJuHTIGbXoqStc5bwH4lXiPrxc2PZ6jfsgqn7lr21RmkrTSIMSGM3Tv2mP9UgMW3EOw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR11MB6467
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

As an alternative, Is it possible to change ftpm design not to depend on RP=
MB access at the earlier/boot stage? Because to my understanding, typically=
 PCRs don't require persistent/NV storage (for example, before RPMB or tee-=
supplicant is ready, use TEE memory instead as temporary storage)

Bing

IPAS Security Brown Belt (https://www.credly.com/badges/69ea809f-3a96-4bc7-=
bb2f-442c1b17af26)
System Software Engineering
Software and Advanced Technology Group
Zizhu Science Park, Shanghai, China

-----Original Message-----
From: Shyam Saini <shyamsaini@linux.microsoft.com>=20
Sent: Thursday, June 1, 2023 3:10 AM
To: alex.bennee@linaro.org
Cc: code@tyhicks.com; Matti.Moell@opensynergy.com; arnd@linaro.org; Zhu, Bi=
ng <bing.zhu@intel.com>; hmo@opensynergy.com; ilias.apalodimas@linaro.org; =
joakim.bech@linaro.org; linux-kernel@vger.kernel.org; linux-mmc@vger.kernel=
.org; linux-scsi@vger.kernel.org; maxim.uvarov@linaro.org; ruchika.gupta@li=
naro.org; Winkler, Tomas <tomas.winkler@intel.com>; ulf.hansson@linaro.org;=
 Huang, Yang <yang.huang@intel.com>; sumit.garg@linaro.org; jens.wiklander@=
linaro.org; op-tee@lists.trustedfirmware.org
Subject: [PATCH v2 0/4] rpmb subsystem, uapi and virtio-rpmb driver

Hi Alex,

[ Resending, Sorry for the noise ]
=20
Are you still working on it or planning to resubmit it ?

[1] The current optee tee kernel driver implementation doesn't work when IM=
A is used with optee implemented ftpm.

The ftpm has dependency on tee-supplicant which comes once the user space i=
s up and running and IMA attestation happens at boot time and it requires t=
o extend ftpm PCRs.=20

But IMA can't use PCRs if ftpm use secure emmc RPMB partition. As optee can=
 only access RPMB via tee-supplicant(user space). So, there should be a fas=
t path to allow optee os to access the RPMB parititon without waiting for u=
ser-space tee supplicant.

To achieve this fast path linux optee driver and mmc driver needs some work=
 and finally it will need RPMB driver which you posted.
=20
Please let me know what's your plan on this.
=20
[1] https://optee.readthedocs.io/en/latest/architecture/secure_storage.html

Best Regards,
Shyam