specification: Make IDE key ownership model clearer #107
Conversation
|
cc @ ozkoyuncu |
| device and the RP. | ||
| * The TSM configures the RP PCIe IDE extended capability. | ||
| * For each physical device from which a TDI is bound to a TVM, the TSM that | ||
| manages this TVM also generates, owns and distributes the IDE stream keys to |
There was a problem hiding this comment.
Do we support one TSM manages the TVM, and another TSM managers the device SPDM? Or do we mandate only one TSM must manage both TVM and the corresponding device SPDM?
Also, one device must be managed by one specific TSM right? Or do we allow 2 TSM manage one device?
I think we should clarify the topology for multiple TSMs.
(Also, the relationship with IOMMU instance - maybe in #82)
There was a problem hiding this comment.
IMO since the TSM owns the binding between the device context setup in the IOMMU and the physical SPDM session between the device - I think its required for security that the single TSM does both.
Mutually distrusting supervisor domains with different TSMs are granted resources directly from the hosting domain and are not expected to be in the TCB of another domain by default. Such models may be created but those are achieved via attestation.
sameo
force-pushed
the
topic/multiple-tsms
branch
from
7629ee5 to
d49d889
Compare
| generate, own and distribute the IDE stream keys to both the physical device | ||
| and the RP. | ||
| * A TSM must not bind a TVM that it manages with a TDI from a physical device | ||
| for which it does own the IDE keys. In other words, TDIs can only be bound to |
There was a problem hiding this comment.
Did you mean “does not own”?
this sentence reads weird
There was a problem hiding this comment.
Yes, I meant does not own. Does that read better now?
sameo
force-pushed
the
topic/multiple-tsms
branch
from
d49d889 to
4ad094d
Compare
| * The TSM that establishes the SPDM connection with a physical device must | ||
| generate, own and distribute the IDE stream keys to both the physical device | ||
| and the RP. | ||
| * A TDI must not be bound to a TVM if the TSM managing the TVM does not owns the |
There was a problem hiding this comment.
ah, thanks. Fixed now.
Fixes riscv-non-isa#83 Signed-off-by: Samuel Ortiz <[email protected]>
sameo
force-pushed
the
topic/multiple-tsms
branch
from
4ad094d to
53ed5c2
Compare
Fixes #83