feat: add TPM/TCG hashing helper to crypto module

Introduce crypto_mod_tcg_hash(), a helper that maps TPM/TCG algorithm
identifiers to the platform crypto backend. This ensures that Event Log
measur

feat: add TPM/TCG hashing helper to crypto module

Introduce crypto_mod_tcg_hash(), a helper that maps TPM/TCG algorithm
identifiers to the platform crypto backend. This ensures that Event Log
measurements use the same digest implementation as the platform PCR
backend regardless of whether hashing is performed in software,
hardware, or a discrete TPM. Update the measured boot design document,
expose the new API via public headers, and implement the helper in the
common crypto module.

Change-Id: Id4f7f1d0014ab42064c46819965417daef71555b
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(fwu): fwu NV ctr upgraded on trial run

The NV ctr value should not upgraded on trial run.
The NV ctr value upgrade is done in BL1 while the detection
of trial run happens in BL2, so the value is

fix(fwu): fwu NV ctr upgraded on trial run

The NV ctr value should not upgraded on trial run.
The NV ctr value upgrade is done in BL1 while the detection
of trial run happens in BL2, so the value is always upgraded.
Fix the problem by setting the upgrade of NV ctr value in BL2
if the NV ctr is shared among components.

Change-Id: Id681fce0482e3000eaef4f4a8f7d8c1023ccaf1a
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

feat(build): pass cflags to the linker when LTO is enabled

Usually, both compiling and linking happen by calling the top level
gcc/clang binary. Also, both compilers quite specifically tell us to
pa

feat(build): pass cflags to the linker when LTO is enabled

Usually, both compiling and linking happen by calling the top level
gcc/clang binary. Also, both compilers quite specifically tell us to
pass the same flags to the compilation and linking stages when we enable
LTO. This is crucial for things like the undefined behaviour sanitiser.
Anecdotally, in working on this, there have been a fair few errors that
the compiler has only been able to catch due to warning flags being
passed to the linker and building with LTO.

This patch puts the contents of TF_CFLAGS into TF_LDFLAGS when LTO is
enabled. This is easier said than done, however, as we support building
with clang and linking with gcc (or vice versa), so CFLAGS that are
discovered for one will not work for the other. This patch works around
this by splitting all flags into a per-compiler variable. Then CFLAGS
and LDFLAGS get the contents of the correct one.

Some notable side effects: CPPFLAGS and TF_CFLAGS_$(ARCH) become empty
and are removed, although expanding them is kept as platforms set them.
Some flags become duplicate and are removed form TF_LDFLAGS (eg -O1).

The errata (--fix) flags are kept as-is but moved to cpu-ops.mk for
consistency. This is because they currently don't work with LTO and will
be addressed in a later patch.

Finally, ERROR_DEPRECATED's flags are also identical on all compilers so
don't maintain a difference.

Change-Id: I3630729ee5f474c09d4722cd0ede6845e1725d95
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(mbedtls): update mbedtls to version 3.6.4

In order to successfully update mbedtls to version 3.6.4, the
redundant-decls warning must be disabled to accomodate a change in the
definition locatio

feat(mbedtls): update mbedtls to version 3.6.4

In order to successfully update mbedtls to version 3.6.4, the
redundant-decls warning must be disabled to accomodate a change in the
definition locations of some helper functions. This is currently an open
issue for mbedtls: https://github.com/Mbed-TLS/mbedtls/issues/10376

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I57c9c14aabe75a51c74dcf2a33faf59f95ce2386

show more ...

feat(auth): extend REGISTER_CRYPTO_LIB calls

Extend REGISTER_CRYPTO_LIB calls with NULL to allow for
the addition of the cryto_mod_finish() function.

Signed-off-by: Lauren Wehrmeister <lauren.wehrm

feat(auth): extend REGISTER_CRYPTO_LIB calls

Extend REGISTER_CRYPTO_LIB calls with NULL to allow for
the addition of the cryto_mod_finish() function.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: If41ed1be50e1d98b42b266c7905269f142bb67c7

show more ...

feat(auth): mbedtls psa key id mgmt

Currently the psa key is created and destroyed after each usage during
signature verification.

This redesign adds a key_cache to store the key ID, psa algorithm,

feat(auth): mbedtls psa key id mgmt

Currently the psa key is created and destroyed after each usage during
signature verification.

This redesign adds a key_cache to store the key ID, psa algorithm, and
key attributes associated with a particular pk_oid. This allows for the
psa key to be reused by each image that has the associated pk_oid.

The pk_oid of the image being authenticated is stored as the global
current_pk_oid variable, which is used during the psa crypto
verification stage to associate a key_cache entry with a particular
pk_oid.

Since the psa key is no longer destroyed after each usage, the psa keys
are therefore destroyed after all images have been loaded during each
boot phase in the new crypto_mod_finish() function that is registered
by the REGISTER_CRYPTO_LIB and enabled through the build option of
PSA_CRYTPO.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iba330bc659a76493bd958673424efcc621bab1c4

show more ...

feat(auth): add crypto_mod_finish() function

Adding crypto_mod_finish() function to be run at the end of crypto usage
to cleanup.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Chan

feat(auth): add crypto_mod_finish() function

Adding crypto_mod_finish() function to be run at the end of crypto usage
to cleanup.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Ib6d099ddaa278f293fe14b805070985522a85686

show more ...

feat(auth): add update of current_pk_oid in auth

Adding the set of current_pk_oid during the authentication process,
include the new file in auth makefile.

Signed-off-by: Lauren Wehrmeister <lauren

feat(auth): add update of current_pk_oid in auth

Adding the set of current_pk_oid during the authentication process,
include the new file in auth makefile.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I3e05b8607060b424e34642d23e4960d2ef0f71f0

show more ...

feat(auth): add util file for current pk_oid

Adding new auth util file for the current_pk_oid and get and set
functions.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I9

feat(auth): add util file for current pk_oid

Adding new auth util file for the current_pk_oid and get and set
functions.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I91220f94d469c86f2e18570e13f1419125447288

show more ...

feat(auth): introducing auth.mk

Introducing authentication specific makefile auth.mk to include common
auth source files.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I

feat(auth): introducing auth.mk

Introducing authentication specific makefile auth.mk to include common
auth source files.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Ifb07c48861fe415d82cb7390c3a5f6e60ba699d9

show more ...

fix(tbbr): remove tbbr_cot_bl1_r64.c

The only platform to use this is fvp_r. As this platform is now gone, so
is the need for this file. Remove it

Change-Id: If65f1c5f525283e19c8421cfa31498480370b9

fix(tbbr): remove tbbr_cot_bl1_r64.c

The only platform to use this is fvp_r. As this platform is now gone, so
is the need for this file. Remove it

Change-Id: If65f1c5f525283e19c8421cfa31498480370b933
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(mbedtls): rename default mbedtls confs

Change the name of these confs to be version agnostic,
we will later use these configs to enforce the mbedtls
minimum version

Change-Id: I1f665c24718

refactor(mbedtls): rename default mbedtls confs

Change the name of these confs to be version agnostic,
we will later use these configs to enforce the mbedtls
minimum version

Change-Id: I1f665c2471877ecc833270c511749ff845046f10
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

fix(mbedtls): fix error return code for calc_hash

Make this function return values from crypto_ret_value.
The previous method of returning the mbedtls error code
on failure meant that the authentica

fix(mbedtls): fix error return code for calc_hash

Make this function return values from crypto_ret_value.
The previous method of returning the mbedtls error code
on failure meant that the authentication module couldn't
correctly parse failures from this function.

Change-Id: I9fe6eba1fc79e8f81004f8cd202781aea907e963
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

fix(psa): fix P-384 PSA key signature verification

The buffer size allocated for the raw ECDSA signatures
was too small for P-384 signatures. This led to mbedtls
aborting the generation of the raw s

fix(psa): fix P-384 PSA key signature verification

The buffer size allocated for the raw ECDSA signatures
was too small for P-384 signatures. This led to mbedtls
aborting the generation of the raw sig.

Fix this by increasing the buffer size to the required
value.

Change-Id: I06a9cfe1f4cb2603c5fbe945714e90460c24edb8
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

Merge changes from topic "update-mbedtls-to-3.6.1" into integration

* changes:
refactor(mbedtls): remove hack in LIBMBEDTLS_CFLAGS
docs(prerequisites): update MbedTLS version to 3.6.1

refactor(mbedtls): use PSA API for auth_decrypt

This new version uses the multipart PSA AEAD API;
the authentication tag is verified via
a call to psa_aead_verify.

Change-Id: If4b7e6258223ae6fead17

refactor(mbedtls): use PSA API for auth_decrypt

This new version uses the multipart PSA AEAD API;
the authentication tag is verified via
a call to psa_aead_verify.

Change-Id: If4b7e6258223ae6fead1794d3e8d0004f0f387b3
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

refactor(mbedtls): remove hack in LIBMBEDTLS_CFLAGS

MbedTLS 3.6.1 fixed the issue which previously
produced this warning, so this hack is no longer
necessary.

Change-Id: I934adefbf2fed16e16b9d98bc8

refactor(mbedtls): remove hack in LIBMBEDTLS_CFLAGS

MbedTLS 3.6.1 fixed the issue which previously
produced this warning, so this hack is no longer
necessary.

Change-Id: I934adefbf2fed16e16b9d98bc8674125b70b08fc
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

chore(mbedtls): remove hash configs

After the upgrade to mbedtls 3.6.0, some of these configuation limitations
are no longer present.

Size chages:
build config | executable | Delta
-------------|--

chore(mbedtls): remove hash configs

After the upgrade to mbedtls 3.6.0, some of these configuation limitations
are no longer present.

Size chages:
build config | executable | Delta
-------------|------------|-------
tbb ecdsa | bl1 | -176
-------------|------------|-------
tbb rsa | bl1 | -192
| bl2 | -4096
-------------|------------|-------
drtm | romlib | -576
-------------|------------|-------
spm | romlib | -576
-------------|------------|-------
mb384 | romlib | -1016

Change-Id: I019bc59adc93cf95f6f28ace9579e7bf1e785b62
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

feat(arm): remove the bl2 static c file

There is no need for the bl2 static c file for
CCA and Duaroot CoT, remove them from the repo

Change-Id: I251d085034dae0f6b3c6cefdbb129a9e1dd0530b
Signed-off

feat(arm): remove the bl2 static c file

There is no need for the bl2 static c file for
CCA and Duaroot CoT, remove them from the repo

Change-Id: I251d085034dae0f6b3c6cefdbb129a9e1dd0530b
Signed-off-by: Xialin Liu <Xialin.Liu@ARM.com>

show more ...