| adfad2cd | 08-Jan-2024 |
Etienne Carriere <etienne.carriere@foss.st.com> |
ta: pkcs11: fix block size to compute AES key check value
Fix AES block size in compute_check_value_with_ecb(). It is 16 bytes,
not the AES key size. By the way allocate cipher block in the stack
in
ta: pkcs11: fix block size to compute AES key check value
Fix AES block size in compute_check_value_with_ecb(). It is 16 bytes,
not the AES key size. By the way allocate cipher block in the stack
instead of in the heap since the block is quite small.
Fixes: bcac2127a7f1 ("ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 1a442a9f | 07-Sep-2023 |
Arnaud Pouliquen <arnaud.pouliquen@foss.st.com> |
ta: remoteproc: add support for resource table
The resource table is a specific table declared in the remote processor
firmware and that is parsed by the main processor to discover resources
and con
ta: remoteproc: add support for resource table
The resource table is a specific table declared in the remote processor
firmware and that is parsed by the main processor to discover resources
and configure inter-processors communication.
The resource table is requested by the non-secure context.
The remoteproc TA retrieves it from the firmware ELF file.
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| 56a69fb4 | 15-May-2023 |
Arnaud Pouliquen <arnaud.pouliquen@foss.st.com> |
ta: remoteproc: add support for start and stop command
Implement command TA_RPROC_FW_CMD_START_FW and TA_RPROC_FW_CMD_STOP_FW
in remoteproc TA. The TA relay the request to the platform specific PTA
ta: remoteproc: add support for start and stop command
Implement command TA_RPROC_FW_CMD_START_FW and TA_RPROC_FW_CMD_STOP_FW
in remoteproc TA. The TA relay the request to the platform specific PTA
that can act on the hardware.
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| fcf382e2 | 24-Mar-2023 |
Arnaud Pouliquen <arnaud.pouliquen@foss.st.com> |
ta: remoteproc: add remote processor Trusted Application
Add a generic TA for a remote processor firmware management.
This TA should be defined as early TA to allow remote processor
firmware managem
ta: remoteproc: add remote processor Trusted Application
Add a generic TA for a remote processor firmware management.
This TA should be defined as early TA to allow remote processor
firmware management in Linux kernel built-in driver and in boot stages.
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| 155cb3e8 | 23-Apr-2020 |
Arnaud Pouliquen <arnaud.pouliquen@foss.st.com> |
ta: remoteproc: add firmware ELF parser
Add a ELF parser that will used by the remoteproc generic TA.
It is in charge of parsing the ELF files to extract segments
to load in the remote processor mem
ta: remoteproc: add firmware ELF parser
Add a ELF parser that will used by the remoteproc generic TA.
It is in charge of parsing the ELF files to extract segments
to load in the remote processor memories.
It also offers an API to retrieve the resource table in the
image. This optional table is defined in a specific section
".resource_table" and is used by the Linux remoteproc driver to
discover services exposed by the remote processor.
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| bcac2127 | 24-Nov-2023 |
Marouene Boubakri <marouene.boubakri@nxp.com> |
ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE
Add PKCS11_CKA_CHECK_VALUE as an optional attribute of symmetric
key and certificate objects . As per the PKCS#11 specification, key
c
ta: pkcs11: pkcs11_attributes.c: support PKCS11_CKA_CHECK_VALUE
Add PKCS11_CKA_CHECK_VALUE as an optional attribute of symmetric
key and certificate objects . As per the PKCS#11 specification, key
check value attribute is optional therefore add pkcs11 TA configuration
switch CFG_PKCS11_TA_CHECK_VALUE_ATTRIBUTE to embed or not the support.
When supported, as per the spec, the attribute can be either the
legitimate value recomputed by the PKCS#11 token or a zero-sized value
called a no-value for when client does not want the attribute to set
in an object.
This change adds the support for the pcks11 TA commands related to
Cryptoki API functions C_GenerateKey(), C_CreateObject(), C_CopyObject(),
C_SetAttributeValue(), C_UnwrapKey() and C_DeriveKey(). TA command
related to C_FindOjects() support the attribute without any change.
Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 2eba68d2 | 28-Sep-2023 |
Etienne Carriere <etienne.carriere@foss.st.com> |
ta: pkcs11: prevent user ID verification when user PIN is not set
Fix User PIN verification in ACL mode (protected authentication) so
that it always returns PKCS11_CKR_USER_PIN_NOT_INITIALIZED when
ta: pkcs11: prevent user ID verification when user PIN is not set
Fix User PIN verification in ACL mode (protected authentication) so
that it always returns PKCS11_CKR_USER_PIN_NOT_INITIALIZED when User
PIN has not been initialized yet by the Security Officer. Before this
change, this was tested only in the standard PIN path, not for the
authenticated TEE identity mode (CFG_PKCS11_TA_AUTH_TEE_IDENTITY=y).
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| d75c42ff | 31-Oct-2023 |
Loic Poulain <loic.poulain@linaro.org> |
ta: pkcs11: Improve PIN counter handling robustness
Make sure PIN check attempt is saved persistently before continuing with
the actual PIN verification, improving counter and flags coherency in
cas
ta: pkcs11: Improve PIN counter handling robustness
Make sure PIN check attempt is saved persistently before continuing with
the actual PIN verification, improving counter and flags coherency in
case of subsequent failure with persistent saving.
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| 2ae2cfb2 | 09-Nov-2023 |
Sumit Garg <sumit.garg@linaro.org> |
TA dev kit: Export ftrace_format.py
Commit 5c2c0fb31efb ("ftrace: change implementation to use binary circular
buffer") added script ftrace_format.py which is required to analyze ftrace
logs. So exp
TA dev kit: Export ftrace_format.py
Commit 5c2c0fb31efb ("ftrace: change implementation to use binary circular
buffer") added script ftrace_format.py which is required to analyze ftrace
logs. So export it as part of TA dev kit as well.
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
show more ...
|
| 4bdddf20 | 31-May-2023 |
Jens Wiklander <jens.wiklander@linaro.org> |
ta: relax location of ta_head
TAs where required to have the ta_head as at the load address of the TA
prior to this patch. This makes the linker script slightly more
complicated and also confuses GD
ta: relax location of ta_head
TAs where required to have the ta_head as at the load address of the TA
prior to this patch. This makes the linker script slightly more
complicated and also confuses GDB so that an offset must be applied to
the load address of the TA when using GDB for debugging. So allow that
ta_head symbol to reside anywhere in the ELF binary and also add ta_head
to the .dynsym section to make sure that tools and ldelf can find the
symbol.
This change requires prior updates to tools and ldelf.
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 7f2daddf | 31-May-2023 |
Jens Wiklander <jens.wiklander@linaro.org> |
ta/link.mk: always generate TA dyn_list
Always generate the file holding the list of dynamic symbols a TA should
provide. This is needed if CFG_FTRACE_SUPPORT should be changed between
two compilati
ta/link.mk: always generate TA dyn_list
Always generate the file holding the list of dynamic symbols a TA should
provide. This is needed if CFG_FTRACE_SUPPORT should be changed between
two compilations. Use the make macro mv-if-changed() to only update the
used file if it will be changed.
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 5831e426 | 31-May-2023 |
Jens Wiklander <jens.wiklander@linaro.org> |
Move mv-if-changed() into mk/macros.mk
Moves the make macro mv-if-changed() into mk/macros.mk to allow use of
it in the TA devkit.
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed
Move mv-if-changed() into mk/macros.mk
Moves the make macro mv-if-changed() into mk/macros.mk to allow use of
it in the TA devkit.
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 32b31808 | 06-Oct-2023 |
Jens Wiklander <jens.wiklander@linaro.org> |
Squashed commit upgrading to mbedtls-3.4.0
Squash merging branch import/mbedtls-3.4.0
8225713449d3 ("libmbedtls: fix unrecognized compiler option")
f03730842d7b ("core: ltc: configure internal MD5"
Squashed commit upgrading to mbedtls-3.4.0
Squash merging branch import/mbedtls-3.4.0
8225713449d3 ("libmbedtls: fix unrecognized compiler option")
f03730842d7b ("core: ltc: configure internal MD5")
2b0d0c50127c ("core: ltc: configure internal SHA-1 and SHA-224")
0e48a6e17630 ("libmedtls: core: update to mbedTLS 3.4.0 API")
049882b143af ("libutee: update to mbedTLS 3.4.0 API")
982307bf6169 ("core: LTC mpi_desc.c: update to mbedTLS 3.4.0 API")
33218e9eff7b ("ta: pkcs11: update to mbedTLS 3.4.0 API")
6956420cc064 ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
ad67ef0b43fd ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
7300f4d97bbf ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
cec89b62a86d ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
e7e048796c44 ("libmbedtls: add SM2 curve")
096beff2cd31 ("libmbedtls: mbedtls_mpi_exp_mod(): optimize mempool usage")
7108668efd3f ("libmbedtls: mbedtls_mpi_exp_mod(): reduce stack usage")
0ba4eb8d0572 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W")
3fd6ecf00382 ("libmbedtls: fix no CRT issue")
d5ea7e9e9aa7 ("libmbedtls: add interfaces in mbedtls for context memory operation")
2b0fb3f1fa3d ("libmedtls: mpi_miller_rabin: increase count limit")
2c3301ab99bb ("libmbedtls: add mbedtls_mpi_init_mempool()")
9a111f0da04b ("libmbedtls: make mbedtls_mpi_mont*() available")
804fe3a374f5 ("mbedtls: configure mbedtls to reach for config")
b28a41531427 ("mbedtls: remove default include/mbedtls/config.h")
dfafe507bbef ("Import mbedtls-3.4.0")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)
show more ...
|
| 7c243321 | 29-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: fix EC private key import
When importing EC private key also generate hidden EC public key for that.
This fixes EC private key import problem.
Signed-off-by: Vesa Jääskeläinen <vesa.ja
ta: pkcs11: fix EC private key import
When importing EC private key also generate hidden EC public key for that.
This fixes EC private key import problem.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| c9cf3320 | 27-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: add hidden EC point support
The PKCS#11 standard does not allow one to have CKA_EC_POINT for private
keys but TEE internal API requires one to be present when performing
private key oper
ta: pkcs11: add hidden EC point support
The PKCS#11 standard does not allow one to have CKA_EC_POINT for private
keys but TEE internal API requires one to be present when performing
private key operations. Instead of calculating it each time it is needed
store it as hidden attribute.
This fixes EC private key generation to function as specified in standard.
There is backwards support for existing keys that has been created
inadvertently with CKA_EC_POINT included.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 981966bc | 27-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: add OP-TEE hidden attribute extension
Attributes which has hidden OP-TEE vendor flag specified are not exported
to user space nor can be imported from user space.
Signed-off-by: Vesa Jä
ta: pkcs11: add OP-TEE hidden attribute extension
Attributes which has hidden OP-TEE vendor flag specified are not exported
to user space nor can be imported from user space.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
show more ...
|
| 58282936 | 27-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: specify OP-TEE's vendor specific attribute scheme
Add vendor allocation specification for OP-TEE specific attributes.
Specifies which bits of attribute identifier is for what purpose.
ta: pkcs11: specify OP-TEE's vendor specific attribute scheme
Add vendor allocation specification for OP-TEE specific attributes.
Specifies which bits of attribute identifier is for what purpose.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 6a7d7282 | 27-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: introduce PKCS11_CKF_ARRAY_ATTRIBUTE
Add own define for PKCS11_CKF_ARRAY_ATTRIBUTE to keep attribute defines
clear.
Adjust users to new define.
Value is same as CKF_ARRAY_ATTRIBUTE in
ta: pkcs11: introduce PKCS11_CKF_ARRAY_ATTRIBUTE
Add own define for PKCS11_CKF_ARRAY_ATTRIBUTE to keep attribute defines
clear.
Adjust users to new define.
Value is same as CKF_ARRAY_ATTRIBUTE in standard.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Tested-by: Ayoub Zaki <ayoub.zaki@embetrix.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 0f6acf3a | 17-Apr-2023 |
Arnaud Pouliquen <arnaud.pouliquen@foss.st.com> |
ta: export remoteproc signature script and default key
The remoteproc firmware signature script and its associated
default key must be exported in the dev kit in order to be
able to sign the remotep
ta: export remoteproc signature script and default key
The remoteproc firmware signature script and its associated
default key must be exported in the dev kit in order to be
able to sign the remoteproc firmware.
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 5071d7d1 | 30-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: on RSA public key import calculate CKA_MODULUS_BITS
When RSA public key is created with C_CreateObject() CKA_MODULUS_BITS is
not allowed to be specified.
The tooling like pkcs11-tool ex
ta: pkcs11: on RSA public key import calculate CKA_MODULUS_BITS
When RSA public key is created with C_CreateObject() CKA_MODULUS_BITS is
not allowed to be specified.
The tooling like pkcs11-tool expects that the value is there.
In specification it is not specified clearly that it needs to be
calculated but it is assumed to be in the RSA public key object.
Calculate the value and add it to the object during RSA public key import.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|
| 074c61af | 28-Jul-2023 |
Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com> |
ta: pkcs11: remove redundant comment about start and end date
PKCS#11 standard specifies that verification or usage of start and end
date for certificate objects is responsibility of the application
ta: pkcs11: remove redundant comment about start and end date
PKCS#11 standard specifies that verification or usage of start and end
date for certificate objects is responsibility of the application.
There is no other activity than storage needed for those.
Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
show more ...
|
| 175d68e9 | 20-Jun-2023 |
Alvin Chang <alvinga@andestech.com> |
ta: riscv: Add MCOUNT_SYM definition
With the -pg option, the compiler inserts a call to _mcount into every
function prologue. Add definition for MCOUNT_SYM so that the linker
creates the additional
ta: riscv: Add MCOUNT_SYM definition
With the -pg option, the compiler inserts a call to _mcount into every
function prologue. Add definition for MCOUNT_SYM so that the linker
creates the additional space for ftrace buffer.
Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>
show more ...
|
| 5d6b6c79 | 12-Jun-2023 |
Jose Quaresma <jose.quaresma@foundries.io> |
ta: pkcs11: Fix conflicting types due to enum/integer mismatch
This is an error with gcc13 [-Werror=enum-int-mismatch]
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Jose Qu
ta: pkcs11: Fix conflicting types due to enum/integer mismatch
This is an error with gcc13 [-Werror=enum-int-mismatch]
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
show more ...
|
| d1b003fe | 05-Jun-2023 |
Tadd Kao <tadd.kao@mediatek.com> |
mk: Support user static lib for aosp build
The aosp build environment don't allow writing to source folder, move
the $(libname).a in current folder to $(out-link-dir$(sm)). And since
static librarie
mk: Support user static lib for aosp build
The aosp build environment don't allow writing to source folder, move
the $(libname).a in current folder to $(out-link-dir$(sm)). And since
static libraries are not needed for runtime, set the LOCAL_MODULE_CLASS
to STATIC_LIBRARIES to avoid installing by aosp build.
Signed-off-by: Tadd Kao <tadd.kao@mediatek.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
show more ...
|
| 3c5443ad | 06-Jun-2023 |
Imre Kis <imre.kis@arm.com> |
ffa: remove ffa.h and smccc.h from host export list
commit 5489e94f0566 ("core: ffa: add boot info structs and defines")
causes the compiler error below in host applications.
ffa.h:196:41: error: i
ffa: remove ffa.h and smccc.h from host export list
commit 5489e94f0566 ("core: ffa: add boot info structs and defines")
causes the compiler error below in host applications.
ffa.h:196:41: error: implicit declaration of function ‘U’ [-Werror=implicit-function-declaration]
196 | #define FFA_BOOT_INFO_NAME_LEN U(16)
| ^
ffa.h:319:19: note: in expansion of macro ‘FFA_BOOT_INFO_NAME_LEN’
319 | char name[FFA_BOOT_INFO_NAME_LEN];
| ^~~~~~~~~~~~~~~~~~~~~~
ffa.h:319:14: error: variably modified ‘name’ at file scope
319 | char name[FFA_BOOT_INFO_NAME_LEN];
| ^~~~
ffa.h uses the U macro which is only part of OP-TEE's libc and not a
standard macro. This causes a compiler error when compiling a host
application and the libc is provided by the compiler. This makes ffa.h
not suitable for host export.
This patch resolves the issue by removing ffa.h from the host export
list to prevent external components to use it. TAs and client
applications have no use of this file.
Also remove smccc.h as it was only added to the list because it is a
dependency of ffa.h
Signed-off-by: Imre Kis <imre.kis@arm.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
show more ...
|