Speaker
Description
Arm's DRTM architecture (DEN 0113) defines a dynamic root of trust for measurement: a DCE-Preamble triggers a dynamic launch event, EL3 firmware (TF-A) measures a protected payload into a fresh chain of trust, and the dynamically launched measured environment (DLME) continues under a smaller TCB. Yet a working implementation exists only against the Base AEM FVP TF-A's plat_drtm hooks (SMMU-based DMA protection, the DRTM address map, and measurement) live solely under the fvp board, and the Neoverse reference-design platforms that model real server silicon ship no DRTM support at all.
This session looks at what it takes to move Arm DRTM off the reference model and make it useful to Linux: porting the plat_drtm platform layer onto the Neoverse reference-design ports; delivering the DCE-Preamble as a UEFI/EDK2 application rather than a bootloader patch; measuring into PCR 17/18 with a DRTM event log; and the kernel-side plumbing to consume and attest the launch. Drawing on 3mdeb's TrenchBoot work and years in the Arm DRTM ecosystem, we want to map the upstreaming path across TF-A, EDK2, and the kernel, and name the gaps and their owners.
Desired outcome: consensus on a minimal, reproducible Arm DRTM reference that the community can build on FVP-first, then real silicon, and a shared list of the upstream changes needed to get there.