From: "Vesa Jääskeläinen" <vesa.jaaskelainen@vaisala.com>
To: op-tee@lists.trustedfirmware.org,
Jens Wiklander <jens.wiklander@linaro.org>
Cc: "Rijo Thomas" <Rijo-john.Thomas@amd.com>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
"Dan Carpenter" <dan.carpenter@oracle.com>,
"Devaraj Rangasamy" <Devaraj.Rangasamy@amd.com>,
"Hongbo Yao" <yaohongbo@huawei.com>,
"Colin Ian King" <colin.king@canonical.com>,
linux-kernel@vger.kernel.org,
"Vesa Jääskeläinen" <vesa.jaaskelainen@vaisala.com>
Subject: [PATCH 0/3] tee: add support for session's client UUID generation
Date: Thu, 23 Apr 2020 18:16:58 +0300 [thread overview]
Message-ID: <20200423151701.111231-1-vesa.jaaskelainen@vaisala.com> (raw)
TEE Client API defines that from user space only information needed for
specified login operations is group identifier for group based logins.
REE kernel is expected to formulate trustworthy client UUID and pass that
to TEE environment. REE kernel is required to verify that provided group
identifier for group based logins matches calling processes group
memberships.
TEE specification only defines that the information passed from REE
environment to TEE environment is encoded into on UUID.
In order to guarantee trustworthiness of client UUID user space is not
allowed to freely pass client UUID.
Vesa Jääskeläinen (3):
tee: add support for session's client UUID generation
tee: optee: Add support for session login client UUID generation
[RFC] tee: add support for app id for client UUID generation
drivers/tee/Kconfig | 1 +
drivers/tee/optee/call.c | 6 +-
drivers/tee/tee_core.c | 188 +++++++++++++++++++++++++++++++++++++++
include/linux/tee_drv.h | 16 ++++
4 files changed, 210 insertions(+), 1 deletion(-)
--
2.17.1
Notes:
This patcheset has been designed so that it can be iteratively intergrated
meaning that the application ID (RFC patch) part can be left for later when
there is agreed solution for that.
TEE specification leaves Linux behavior undefined. It does not define any
UUID value for name space. UUID in here is randomly generated with uuidgen
tool.
I have also include amdtee people as this method probably should also be
applied in there.
Using op-tee@lists.trustedfirmware.org instead of tee-dev@lists.linaro.org as
latter is deprecated old list.
Original issue in OP-TEE OS tracker:
https://github.com/OP-TEE/optee_os/issues/3642
Related reviews and demonstration for the concept:
https://github.com/linaro-swg/linux/pull/74
https://github.com/OP-TEE/optee_client/pull/195
https://github.com/OP-TEE/optee_test/pull/406
next reply other threads:[~2020-04-23 15:24 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-23 15:16 Vesa Jääskeläinen [this message]
2020-04-23 15:16 ` [PATCH 1/3] tee: add support for session's client UUID generation Vesa Jääskeläinen
2020-04-23 17:35 ` Dan Carpenter
2020-04-25 6:16 ` Vesa Jääskeläinen
2020-04-25 9:24 ` Dan Carpenter
2020-04-23 15:17 ` [PATCH 2/3] tee: optee: Add support for session login " Vesa Jääskeläinen
2020-04-23 15:17 ` [PATCH 3/3] [RFC] tee: add support for app id for " Vesa Jääskeläinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200423151701.111231-1-vesa.jaaskelainen@vaisala.com \
--to=vesa.jaaskelainen@vaisala.com \
--cc=Devaraj.Rangasamy@amd.com \
--cc=Rijo-john.Thomas@amd.com \
--cc=colin.king@canonical.com \
--cc=dan.carpenter@oracle.com \
--cc=herbert@gondor.apana.org.au \
--cc=jens.wiklander@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=op-tee@lists.trustedfirmware.org \
--cc=yaohongbo@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).