From: Mattijs Korpershoek <mkorpershoek@kernel.org>
To: Igor Opaniuk <igor.opaniuk@gmail.com>, u-boot@lists.u-boot-project.org
Cc: Tom Rini <trini@konsulko.com>,
Mattijs Korpershoek <mkorpershoek@kernel.org>,
Peter Robinson <pbrobinson@gmail.com>,
Quentin Schulz <quentin.schulz@cherry.de>,
Johan Jonker <jbx6244@gmail.com>,
Igor Opaniuk <igor.opaniuk@gmail.com>
Subject: Re: [PATCH 2/4] avb: add OP-TEE root key digest provider
Date: Mon, 10 Aug 2026 11:43:23 +0200 [thread overview]
Message-ID: <87ik5i2tvo.fsf@kernel.org> (raw)
In-Reply-To: <20260727-avb-root-key-pluggable-v1-2-7e27b2b92cc0@gmail.com>
Hi Igor,
Thank you for the patch.
On Mon, Jul 27, 2026 at 19:14, Igor Opaniuk <igor.opaniuk@gmail.com> wrote:
> When a device already runs OP-TEE, its root-of-trust key should live in the
> same secure, RPMB-backed storage that already holds the AVB rollback
> indexes and lock state, so it is provisioned per device and protected by
> the secure world -- not shipped inside the bootloader image.
>
> Let AVB fetch the trusted digest from the OP-TEE AVB TA. It reuses the
> existing persistent-value interface, so no change to the TA is required,
> and a missing value fails closed.
>
> Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
> ---
next prev parent reply other threads:[~2026-08-10 9:43 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-27 17:14 [PATCH 0/4] avb: make the AVB root key source pluggable Igor Opaniuk
2026-07-27 17:14 ` [PATCH 1/4] " Igor Opaniuk
2026-08-10 9:41 ` Mattijs Korpershoek
2026-07-27 17:14 ` [PATCH 2/4] avb: add OP-TEE root key digest provider Igor Opaniuk
2026-08-10 9:43 ` Mattijs Korpershoek [this message]
2026-07-27 17:14 ` [PATCH 3/4] avb: add board-specific root key provider Igor Opaniuk
2026-08-10 9:44 ` Mattijs Korpershoek
2026-07-27 17:14 ` [PATCH 4/4] doc: android: document the AVB root key source Igor Opaniuk
2026-08-10 9:46 ` Mattijs Korpershoek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ik5i2tvo.fsf@kernel.org \
--to=mkorpershoek@kernel.org \
--cc=igor.opaniuk@gmail.com \
--cc=jbx6244@gmail.com \
--cc=pbrobinson@gmail.com \
--cc=quentin.schulz@cherry.de \
--cc=trini@konsulko.com \
--cc=u-boot@lists.u-boot-project.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.