Re: [TF-A] [RFC] New feature in TF-A to load encrypted FIP payloads: address implementation concerns
Hi Sumit,
On 3/4/20 4:55 PM, Sumit Garg via TF-A wrote:
The last remaining item would be to address the MISRA violations that Coverity found, which I've copied & pasted for you on Gerrit in the top patch.
I have tried to address most of MISRA violations and updated the patch-set. But since I don't have access to Coverity tool you are using, so can you please check if there is any relevant MISRA violation that I missed?
Sure, I will re-run the tool in our internal CI and let you know the results.
Also, this feature is only used on QEMU right now and I am not aware of anyone trying to enable it for their platforms just yet. Thus there is a risk we might have overlooked some issues that we'll discover at that time.
Socionext being a silicon vendor is actively looking for this feature and I think they will build upon this feature to enable firmware encryption on their platforms to meet DRM robustness rules.
Interesting, thanks for sharing this information.
Furthermore, I know that you've done some testing of this feature on QEMU but this is not integrated into the CI loop right now. Thus, there is a risk that we might break it in the future and this will go unnoticed, unless you plan to test it regularly on your end.
Yeah we should plan to enable testing for this feature in CI loop.
For now, I've added in our internal CI a simple build test based on the build instructions you've provided in the patch set. This will at least make sure we do not break the build inadvertently in the future.
But as you say, going forward, we should plan for proper testing on QEMU. I am hoping we will soon be able to extend the OpenCI [1] and add this support there.
[1] https://lists.trustedfirmware.org/pipermail/tf-a/2020-February/000264.html
- Saying so in the (upcoming) change log.
I hope you can take care of this.
Actually this is something you have access to, it's a matter of adding a line in docs/change-log-upcoming.rst in the TF-A source tree.
Regards, Sandrine
On Mon, 9 Mar 2020 at 15:05, Sandrine Bailleux sandrine.bailleux@arm.com wrote:
Hi Sumit,
On 3/4/20 4:55 PM, Sumit Garg via TF-A wrote:
The last remaining item would be to address the MISRA violations that Coverity found, which I've copied & pasted for you on Gerrit in the top patch.
I have tried to address most of MISRA violations and updated the patch-set. But since I don't have access to Coverity tool you are using, so can you please check if there is any relevant MISRA violation that I missed?
Sure, I will re-run the tool in our internal CI and let you know the results.
As per your results reported in gerrit, relevant MISRA violations has been addressed.
Also, this feature is only used on QEMU right now and I am not aware of anyone trying to enable it for their platforms just yet. Thus there is a risk we might have overlooked some issues that we'll discover at that time.
Socionext being a silicon vendor is actively looking for this feature and I think they will build upon this feature to enable firmware encryption on their platforms to meet DRM robustness rules.
Interesting, thanks for sharing this information.
Furthermore, I know that you've done some testing of this feature on QEMU but this is not integrated into the CI loop right now. Thus, there is a risk that we might break it in the future and this will go unnoticed, unless you plan to test it regularly on your end.
Yeah we should plan to enable testing for this feature in CI loop.
For now, I've added in our internal CI a simple build test based on the build instructions you've provided in the patch set. This will at least make sure we do not break the build inadvertently in the future.
Thanks for the update.
But as you say, going forward, we should plan for proper testing on QEMU. I am hoping we will soon be able to extend the OpenCI [1] and add this support there.
Sounds good to me.
[1] https://lists.trustedfirmware.org/pipermail/tf-a/2020-February/000264.html
- Saying so in the (upcoming) change log.
I hope you can take care of this.
Actually this is something you have access to, it's a matter of adding a line in docs/change-log-upcoming.rst in the TF-A source tree.
Okay, let me update "docs/change-log-upcoming.rst" as well.
-Sumit
Regards, Sandrine
tf-a@lists.trustedfirmware.org
-
Sandrine Bailleux -
Sumit Garg