From: David Brazdil <dbrazdil@google.com>
To: Pavel Machek <pavel@ucw.cz>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Rob Herring <robh+dt@kernel.org>,
Jonathan Corbet <corbet@lwn.net>,
Derek Kiernan <derek.kiernan@xilinx.com>,
Dragan Cvetic <dragan.cvetic@xilinx.com>,
Arnd Bergmann <arnd@arndb.de>,
Hans de Goede <hdegoede@redhat.com>,
devicetree@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-doc@vger.kernel.org, Andrew Scull <ascull@google.com>,
Will Deacon <will@kernel.org>
Subject: Re: DRM? Re: [PATCH v2 2/2] misc: dice: Add driver to forward secrets to userspace
Date: Fri, 10 Dec 2021 12:20:50 +0000 [thread overview]
Message-ID: <YbNGIimUI7Cagvwe@google.com> (raw)
In-Reply-To: <20211209194807.GB28088@duo.ucw.cz>
Hi Pavel,
On Thu, Dec 09, 2021 at 08:48:07PM +0100, Pavel Machek wrote:
> Hi!
>
> > +config DICE
> > + tristate "Open Profile for DICE driver"
> > + depends on OF_RESERVED_MEM
> > + help
> > + This driver allows to ownership of a reserved memory region
> > + containing DICE secrets and expose them to userspace via
> > + a character device.
> > +
>
> Explaining what DICE is (and what Open Profile is) would be useful.
Sure, I'll expand the description.
> I see it is for some kind of DRM? Why is in non-evil and why do we
> want it in Linux?
Best to think of this as an extension to verified boot where each boot
stage signs the hashes of the software it loaded. The certificate is
what's passed in this reserved memory region. It is used in the context
of confidential computing for remote attestation, and it is very similar
to the EFI-based approach from IBM for SEV:
https://lore.kernel.org/all/20211007061838.1381129-1-dovmurik@linux.ibm.com/
There's a link to the project's documentation in the cover letter with
much more technical detail if you're interested.
-David
prev parent reply other threads:[~2021-12-10 12:21 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-09 15:11 [PATCH v2 0/2] Driver for Open Profile for DICE David Brazdil
2021-12-09 15:11 ` [PATCH v2 1/2] dt-bindings: firmware: Add " David Brazdil
2021-12-09 15:11 ` [PATCH v2 2/2] misc: dice: Add driver to forward secrets to userspace David Brazdil
2021-12-09 15:31 ` Greg Kroah-Hartman
2021-12-09 19:38 ` Pavel Machek
2021-12-09 20:31 ` Greg Kroah-Hartman
2021-12-10 11:16 ` David Brazdil
2021-12-10 14:39 ` Greg Kroah-Hartman
2021-12-10 15:48 ` David Brazdil
2021-12-10 16:01 ` Greg Kroah-Hartman
2021-12-09 19:48 ` DRM? " Pavel Machek
2021-12-10 12:20 ` David Brazdil [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YbNGIimUI7Cagvwe@google.com \
--to=dbrazdil@google.com \
--cc=arnd@arndb.de \
--cc=ascull@google.com \
--cc=corbet@lwn.net \
--cc=derek.kiernan@xilinx.com \
--cc=devicetree@vger.kernel.org \
--cc=dragan.cvetic@xilinx.com \
--cc=gregkh@linuxfoundation.org \
--cc=hdegoede@redhat.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pavel@ucw.cz \
--cc=robh+dt@kernel.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).