Skip to content

Add support for setting up platform root key for LVBS#772

Open
sangho2 wants to merge 6 commits intomainfrom
sanghle/prk
Open

Add support for setting up platform root key for LVBS#772
sangho2 wants to merge 6 commits intomainfrom
sanghle/prk

Conversation

@sangho2
Copy link
Copy Markdown
Contributor

@sangho2 sangho2 commented Apr 14, 2026

This PR adds support for setting up the Platform Root Key for the LVBS platform, which can be used to derive other keys like per-TA keys.

@sangho2 sangho2 marked this pull request as ready for review April 14, 2026 21:58
@sangho2 sangho2 force-pushed the sanghle/prk branch 2 times, most recently from 0d156f1 to 0fb51d4 Compare April 15, 2026 17:04
@sangho2 sangho2 requested a review from jaybosamiya-ms April 15, 2026 17:06
@sangho2
Copy link
Copy Markdown
Contributor Author

sangho2 commented Apr 15, 2026

@jaybosamiya-ms I've added PlatformRootKeyProvider to litebox, which is based on the discussion we had in the past.

@sangho2
Copy link
Copy Markdown
Contributor Author

sangho2 commented Apr 15, 2026

@tgopinath-microsoft This PR introduces a VTL function/call for setting a platform root key (mshv_vsm_set_platform_root_key). The function (and overall PR) is straightforward, but it requires your or your team's input because it defines a new ABI.

@sangho2
Copy link
Copy Markdown
Contributor Author

sangho2 commented Apr 15, 2026

Once this PR is merged, I'll rebase #643 .

@jaybosamiya-ms
Copy link
Copy Markdown
Member

Thanks @sangho2! For visibility, Sangho and I discussed this PR offline, and I've instead introduced #781 as the alternate interface to consider, which balances both the OP-TEE requirements as well as more distrustful platforms.

@sangho2 sangho2 added the must-not-merge:blocked-on-other-changes Other changes/PRs to be handled first. Label not needed for non-main changes. label Apr 16, 2026
@sangho2 sangho2 changed the title Add support for platform root key Add support for setting up platform root key Apr 16, 2026
@sangho2 sangho2 changed the title Add support for setting up platform root key Add support for setting up platform root key for LVBS Apr 16, 2026
@sangho2 sangho2 marked this pull request as draft April 16, 2026 23:39
@sangho2 sangho2 force-pushed the sanghle/prk branch 2 times, most recently from c96a162 to 8527327 Compare April 17, 2026 02:01
@sangho2 sangho2 removed the must-not-merge:blocked-on-other-changes Other changes/PRs to be handled first. Label not needed for non-main changes. label Apr 17, 2026
@sangho2 sangho2 removed the request for review from jaybosamiya-ms April 17, 2026 02:06
@sangho2 sangho2 marked this pull request as ready for review April 17, 2026 02:07
Comment thread litebox_platform_lvbs/src/mshv/vsm.rs Outdated
/// This function assumes that the caller stores the key data in a single or
/// contiguous physical memory page(s). If the caller cannot ensure this,
/// we should make this function use `HekiPage`.
fn mshv_vsm_set_platform_root_key(key_pa: u64, key_size: u64) -> Result<i64, VsmError> {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think we will have the key size to be something other than 8 bytes ? If no, may be just need the key_pa and we do not need the size argument ? If you think we should extend the root key to be more than 8 bytes, then maybe we can have a an array of 8 bytes for key_pa and then specify the size in key_size

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the key should be at least 32 bytes (16 bytes might be okay but a bit weak)? If this something about we don't need to support various key size options, I think it is okay to only support a 32-byte root key.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I somehow mistook key_pa as key. ok then let us just support a 32 byte key and do away with the size

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds good. I'll revise the function signature.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

revised.

@github-actions
Copy link
Copy Markdown

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details
--- failure enum_variant_added: enum variant added on exhaustive enum ---

Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.47.0/src/lints/enum_variant_added.ron

Failed in:
  variant VsmFunction:SetPlatformRootKey in /home/runner/work/litebox/litebox/litebox_platform_lvbs/src/mshv/mod.rs:158

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants