From: "Jarkko Sakkinen" <jarkko@kernel.org>
To: "David Gstir" <david@sigma-star.at>
Cc: "Mimi Zohar" <zohar@linux.ibm.com>,
"James Bottomley" <jejb@linux.ibm.com>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
"David S. Miller" <davem@davemloft.net>,
"Shawn Guo" <shawnguo@kernel.org>,
"Jonathan Corbet" <corbet@lwn.net>,
"Sascha Hauer" <s.hauer@pengutronix.de>,
"kernel@pengutronix.de" <kernel@pengutronix.de>,
"Fabio Estevam" <festevam@gmail.com>,
"NXP Linux Team" <linux-imx@nxp.com>,
"Ahmad Fatoum" <a.fatoum@pengutronix.de>,
"sigma star Kernel Team" <upstream+dcp@sigma-star.at>,
"David Howells" <dhowells@redhat.com>,
"Li Yang" <leoyang.li@nxp.com>,
"Paul Moore" <paul@paul-moore.com>,
"James Morris" <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
"Paul E. McKenney" <paulmck@kernel.org>,
"Randy Dunlap" <rdunlap@infradead.org>,
"Catalin Marinas" <catalin.marinas@arm.com>,
"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>,
"Tejun Heo" <tj@kernel.org>,
"Steven Rostedt (Google)" <rostedt@goodmis.org>,
<linux-doc@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
"linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
<linux-arm-kernel@lists.infradead.org>,
<linuxppc-dev@lists.ozlabs.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"Richard Weinberger" <richard@nod.at>,
"David Oberhollenzer" <david.oberhollenzer@sigma-star.at>
Subject: Re: [PATCH v6 3/6] KEYS: trusted: Introduce NXP DCP-backed trusted keys
Date: Mon, 11 Mar 2024 22:07:19 +0200 [thread overview]
Message-ID: <CZR6X7KLX6NC.1BH2NHDTNL3C@kernel.org> (raw)
In-Reply-To: <655221B7-634C-4493-A781-CF014DFFC8BF@sigma-star.at>
On Fri Mar 8, 2024 at 9:17 AM EET, David Gstir wrote:
> Hi Jarkko,
>
> > On 07.03.2024, at 20:30, Jarkko Sakkinen <jarkko@kernel.org> wrote:
>
> [...]
>
> >> +
> >> +static int trusted_dcp_init(void)
> >> +{
> >> + int ret;
> >> +
> >> + if (use_otp_key)
> >> + pr_info("Using DCP OTP key\n");
> >> +
> >> + ret = test_for_zero_key();
> >> + if (ret) {
> >> + pr_err("Test for zero'ed keys failed: %i\n", ret);
> >
> > I'm not sure whether this should err or warn.
> >
> > What sort of situations can cause the test the fail (e.g.
> > adversary/interposer, bad configuration etc.).
>
> This occurs when the hardware is not in "secure mode". I.e. it’s a bad configuration issue.
> Once the board is properly configured, this will never trigger again.
> Do you think a warning is better for this then?
Bad configuration is not unexpected configuration so it cannot possibly
be an error situation as far as Linux is considered. So warning is
appropriate here I'd figure.
BR, Jarkko
next prev parent reply other threads:[~2024-03-11 20:07 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-07 15:38 [PATCH v5 0/6] DCP as trusted keys backend David Gstir
2024-03-07 15:38 ` [PATCH v6 1/6] crypto: mxs-dcp: Add support for hardware-bound keys David Gstir
2024-03-07 19:17 ` Jarkko Sakkinen
2024-03-07 15:38 ` [PATCH v6 2/6] KEYS: trusted: improve scalability of trust source config David Gstir
2024-03-07 19:18 ` Jarkko Sakkinen
2024-03-07 15:38 ` [PATCH v6 3/6] KEYS: trusted: Introduce NXP DCP-backed trusted keys David Gstir
2024-03-07 19:23 ` Jarkko Sakkinen
2024-03-07 19:30 ` Jarkko Sakkinen
2024-03-08 7:17 ` David Gstir
2024-03-11 20:07 ` Jarkko Sakkinen [this message]
2024-03-07 15:38 ` [PATCH v6 4/6] MAINTAINERS: add entry for DCP-based " David Gstir
2024-03-07 15:38 ` [PATCH v6 5/6] docs: document DCP-backed trusted keys kernel params David Gstir
2024-03-07 19:32 ` Jarkko Sakkinen
2024-03-07 15:38 ` [PATCH v6 6/6] docs: trusted-encrypted: add DCP as new trust source David Gstir
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CZR6X7KLX6NC.1BH2NHDTNL3C@kernel.org \
--to=jarkko@kernel.org \
--cc=a.fatoum@pengutronix.de \
--cc=catalin.marinas@arm.com \
--cc=corbet@lwn.net \
--cc=davem@davemloft.net \
--cc=david.oberhollenzer@sigma-star.at \
--cc=david@sigma-star.at \
--cc=dhowells@redhat.com \
--cc=festevam@gmail.com \
--cc=herbert@gondor.apana.org.au \
--cc=jejb@linux.ibm.com \
--cc=jmorris@namei.org \
--cc=kernel@pengutronix.de \
--cc=keyrings@vger.kernel.org \
--cc=leoyang.li@nxp.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-imx@nxp.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=paul@paul-moore.com \
--cc=paulmck@kernel.org \
--cc=rafael.j.wysocki@intel.com \
--cc=rdunlap@infradead.org \
--cc=richard@nod.at \
--cc=rostedt@goodmis.org \
--cc=s.hauer@pengutronix.de \
--cc=serge@hallyn.com \
--cc=shawnguo@kernel.org \
--cc=tj@kernel.org \
--cc=upstream+dcp@sigma-star.at \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).