Secure Write Protection and writing authenticated device configuration to RPMB about optee_os HOT 3 OPEN

If this is something you intend to do during the production phase of the device, have you tried https://docs.kernel.org/driver-api/mmc/mmc-tools.html?

If it's done after manufacturing outside of the factory then I believe it must be done by OP-TEE since the RPMB key mustn't be known by anyone after this phase.

from optee_os.

Hi, thanks for reply.

I need to be able to enable/disable write protection on the devices in the field since it will be part of the remote update process. Therefore I need to apply this configuration using OP-TEE. Required message types(defined in JEDEC) for secure write protection is not supported by OP-TEE. Need guidance on how to be able to set secure write protection configuration using OP-TEE.

from optee_os.

I assume you will use a Pseudo TA and some authentication scheme to trigger this. What's missing after that is:

1. updates in core/tee/tee_rpmb_fs.c with API and code for the needed messages
2. The ABI shared with the normal world may need to be updated
3. code updates in tee-supplicant (or RPMB/MMC subsystem https://lore.kernel.org/lkml/[email protected]/ depending on the progress)

from optee_os.