linux-kernel - Re: [PATCHv2 2/2] tpm_ftpm_tee: register driver on TEE bus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 May 2020 11:08:18 +0300
From:   Maxim Uvarov <maxim.uvarov@...aro.org>
To:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "tee-dev @ lists . linaro . org" <tee-dev@...ts.linaro.org>,
        peterhuewe@....de, Jason Gunthorpe <jgg@...pe.ca>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jens Wiklander <jens.wiklander@...aro.org>,
        linux-integrity@...r.kernel.org, Arnd Bergmann <arnd@...aro.org>,
        Sumit Garg <sumit.garg@...aro.org>
Subject: Re: [PATCHv2 2/2] tpm_ftpm_tee: register driver on TEE bus

On Wed, 27 May 2020 at 22:42, Jarkko Sakkinen
<jarkko.sakkinen@...ux.intel.com> wrote:
>
> On Mon, 2020-05-25 at 09:50 +0300, Maxim Uvarov wrote:
> > Jakko,
> > tee-supplicant application provides state machine over callbacks with
> > RPC messages.
> > https://github.com/OP-TEE/optee_client/blob/master/tee-supplicant/src/tee_supplicant.c#L614
> > It also allocates shm. Without running tee-supplicant
> > tee_client_open_session() will fail.
> > optee_open_session()->get_msg_arg()->tee_shm_alloc()->...
> > Optee team wanted to remove some dependencies from tee-supplicant with
> > moving code
> > to the kernel. But for now I think that should be out of the scope of
> > current patches due to
> > they fix driver initialization on tee bus without breaking current
> > functionality.
>
> So what is the role in high-level for tee-supplicant? Why does it
> exist? No time to dive into code unfortunately.
>

Original implementation for tee-supplicant does several things:
1. allocate shm
2. load ta from user space (fs file)
3. emulate rpmb
4. also there are some ftrace and socket functions which I did not use.

As I I understand, current implementation uses tee-supplicant and it's
library as
API from user land to Trusted OS.

Some docs can be found here:
https://optee.readthedocs.io/en/latest/architecture/index.html



> These kernel commits do not explain in simple terms enough how all
> of these entities connect with each other, if you don't have that
> understanding beforehand.
>

Yes, that is true. But I think it's something new and good docs will
be some time later.

> /Jarkko
>

Regards,
Maxim.