Hi Pavel, On Thu, Dec 09, 2021 at 08:48:07PM +0100, Pavel Machek wrote: > Hi! > > > +config DICE > > + tristate "Open Profile for DICE driver" > > + depends on OF_RESERVED_MEM > > + help > > + This driver allows to ownership of a reserved memory region > > + containing DICE secrets and expose them to userspace via > > + a character device. > > + > > Explaining what DICE is (and what Open Profile is) would be useful. Sure, I'll expand the description. > I see it is for some kind of DRM? Why is in non-evil and why do we > want it in Linux? Best to think of this as an extension to verified boot where each boot stage signs the hashes of the software it loaded. The certificate is what's passed in this reserved memory region. It is used in the context of confidential computing for remote attestation, and it is very similar to the EFI-based approach from IBM for SEV: https://lore.kernel.org/all/20211007061838.1381129-1-dovmurik@xxxxxxxxxxxxx/ There's a link to the project's documentation in the cover letter with much more technical detail if you're interested. -David
