feat(psa): add interface with RSE for retrieving entropy

Add the AP/RSS interface for reading the entropy. And update the
document for the API.

Change-Id: I61492d6b5d824a01ffeadc92f9d41ca841ba3367

feat(psa): add interface with RSE for retrieving entropy

Add the AP/RSS interface for reading the entropy. And update the
document for the API.

Change-Id: I61492d6b5d824a01ffeadc92f9d41ca841ba3367
Signed-off-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Icen Zeyada <Icen.Zeyada2@arm.com>

show more ...

fix(psa): guard Crypto APIs with CRYPTO_SUPPORT

When building Crypto APIs, it requires dependency on external headers,
e.g., Mbedtls headers. Without the CRYPTO_SUPPORT configuration,
external depe

fix(psa): guard Crypto APIs with CRYPTO_SUPPORT

When building Crypto APIs, it requires dependency on external headers,
e.g., Mbedtls headers. Without the CRYPTO_SUPPORT configuration,
external dependencies are not set up, building Crypto APIs will fail.

Guard Crypto APIs with the CRYPTO_SUPPORT configuration, to make sure
the code is built only for Crypto enabled case.

Change-Id: Iffe1220b0e6272586c46432b4f8d0512cb39b0b5
Signed-off-by: Leo Yan <leo.yan@arm.com>

show more ...

fix(arm): correct RSE_CRYPTO_EXPORT_PUBLIC_KEY_SID

The RSE_CRYPTO_EXPORT_PUBLIC_KEY_SID macro does not match the definition
in RSE. A paired macro, TFM_CRYPTO_EXPORT_PUBLIC_KEY, in the RSE's
header

fix(arm): correct RSE_CRYPTO_EXPORT_PUBLIC_KEY_SID

The RSE_CRYPTO_EXPORT_PUBLIC_KEY_SID macro does not match the definition
in RSE. A paired macro, TFM_CRYPTO_EXPORT_PUBLIC_KEY, in the RSE's
header (located in interface/include/tfm_crypto_defs.h) is defined as
0x206. This causes the TF-A test PLATFORM_TEST=rse-rotpk to fail.

Correct the definition of RSE_CRYPTO_EXPORT_PUBLIC_KEY_SID to make the
test pass.

Change-Id: I0bc24ed6dd23f2718e1edea5ec464545dab06983
Signed-off-by: Leo Yan <leo.yan@arm.com>

show more ...

feat(psa): introduce generic library for CCA attestation

Add a generic Arm CCA attestation library driver to interface with the
PSA delegated attestation partition APIs that use RSE to fetch the
pla

feat(psa): introduce generic library for CCA attestation

Add a generic Arm CCA attestation library driver to interface with the
PSA delegated attestation partition APIs that use RSE to fetch the
platform attestation token and Realm attestation key.

Signed-off-by: Rohit Mathew <rohit.mathew@arm.com>
Signed-off-by: Vivek Gautam <vivek.gautam@arm.com>
Change-Id: I882273e97567cc068f90d2ef089410f3a93c6b00

show more ...

refactor(psa): change all occurrences of RSS to RSE

Changes all occurrences of "RSS" and "rss" in the code and build files
to "RSE" and "rse".

Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id

refactor(psa): change all occurrences of RSS to RSE

Changes all occurrences of "RSS" and "rss" in the code and build files
to "RSE" and "rse".

Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: I606e2663fb3719edf6372d6ffa4f1982eef45994

show more ...

refactor(psa): rename all 'rss' files to 'rse'

Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: I379c471c541dda25d8ee9087fcf67e05b4204474

feat(dice): add cert_id argument to dpe_derive_context()

This custom argument is meant to simplify to group
components into certificates. Components with
the same cert_id contribute to the same cert

feat(dice): add cert_id argument to dpe_derive_context()

This custom argument is meant to simplify to group
components into certificates. Components with
the same cert_id contribute to the same certificate
regardless of the load order or the structure of the
derivation tree. This argument aims to flatten the tree
structure and make it easy to include branches or
subtrees in the main derivation line.

Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: I83c4abc399616063a5eb04792d603899f7513627

show more ...

feat(dice): add client API for DICE Protection Environment

RSS provides the DICE Protection Environment
service (DPE). It partially implements the
DPE specification from TCG.

As a DPE profile, it s

feat(dice): add client API for DICE Protection Environment

RSS provides the DICE Protection Environment
service (DPE). It partially implements the
DPE specification from TCG.

As a DPE profile, it supports the
Open Profile for DICE specification.
https://pigweed.googlesource.com/open-dice/+/refs/heads/main/docs/specification.md

In order to communicate with the service, commands
must be CBOR encoded.
The API implementation:
- Expose a C API to the upper layer,
- Do the CBOR encoding, decoding of the DPE
commands,
- Rely on the PSA framework to communicate
with the RSS through an MHU.

Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: I26a08f0c7cbffe07e725a7defbb6c60fd7735efe

show more ...

refactor(measured-boot): move metadata size macros to a common header

The max size macros of metadata elements are shared across
multiple measured boot backends: rss-measured-boot, dpe.

Increase th

refactor(measured-boot): move metadata size macros to a common header

The max size macros of metadata elements are shared across
multiple measured boot backends: rss-measured-boot, dpe.

Increase the SW_TYPE_MAX_SIZE to be able to accomodate
all macro.

Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: Ic9004a36ef1df96c70a4f7adf7bb86dc27dd307c

show more ...

fix(psa): fix static check failure

Address the coding style issue that arose from patch [1], which
was inadvertently overlooked during the CI check.

[1]: https://review.trustedfirmware.org/c/TF-A/t

fix(psa): fix static check failure

Address the coding style issue that arose from patch [1], which
was inadvertently overlooked during the CI check.

[1]: https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/26263

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I280766fddf0e9e366bb2376c52a6907093b0d958

show more ...

refactor(tc): update platform tests

Update the TC's platform test Makefile and related common definitions
to correspond to newer TF-M code (commit hash: 4ab7a20).

Change-Id: I6ef3effe194a780a0533f9

refactor(tc): update platform tests

Update the TC's platform test Makefile and related common definitions
to correspond to newer TF-M code (commit hash: 4ab7a20).

Change-Id: I6ef3effe194a780a0533f9c0c2eab9d0f4efc1fc
Signed-off-by: David Vincze <david.vincze@arm.com>

show more ...

feat(rss): add defines for 'type' range and use them in psa_call()

Update the 'type' parameter checking according to changes
on RSS's (TF-M) side: 40b09ba1 [1]

[1]: https://git.trustedfirmware.org/

feat(rss): add defines for 'type' range and use them in psa_call()

Update the 'type' parameter checking according to changes
on RSS's (TF-M) side: 40b09ba1 [1]

[1]: https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/commit/?id=40b09ba1e4a7a4f726f98700eab7e4e4d8e95dcf

Change-Id: I8487e8ab24aa2dd080b5bb8f2f5c7e8fc15cf211
Signed-off-by: David Vincze <david.vincze@arm.com>

show more ...

feat(psa): interface with RSS for retrieving ROTPK

Adding the AP/RSS interface for reading the ROTPK.

The read interface implements the psa_call:
psa_call(RSS_CRYPTO_HANDLE, PSA_IPC_CALL,

feat(psa): interface with RSS for retrieving ROTPK

Adding the AP/RSS interface for reading the ROTPK.

The read interface implements the psa_call:
psa_call(RSS_CRYPTO_HANDLE, PSA_IPC_CALL,
in_vec, IOVEC_LEN(in_vec),
out_vec, IOVEC_LEN(out_vec));

where the in_vec indicates which of the 3 ROTPKs we want,
and the out_vec stores the ROTPK value we get back from RSS.

Through this service, we will be able to read any of the 3
ROTPKs used on a CCA platform:
- ROTPK for CCA firmware (BL2, BL31, RMM).
- ROTPK for secure firmware.
- ROTPK for non-secure firmware.

Change-Id: I44c615588235cc797fdf38870b74b4c422be0a72
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>

show more ...

fix(measured-boot): don't strip last non-0 char

With the current implementation of stripping the last null
byte from a string, there was no way to get the TF-M measured
boot test suite to pass. It w

fix(measured-boot): don't strip last non-0 char

With the current implementation of stripping the last null
byte from a string, there was no way to get the TF-M measured
boot test suite to pass. It would expect the size of the string
passed into extend measurement to be unaffected by the call.

This fix should allow passing a string with the null char
pre-stripped, allowing the tests to exclude the null char in
their test data and not have the length decremented.

Further, This patch adds an early exit if either the version
or sw_type is larger than its buffer. Without this check,
it may be possible to pass a length one more than the maximum,
and if the last element is a null, the length will be truncated
to fit. This is instead suppsed to return an error.

Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
Change-Id: I98e1bb53345574d4645513009883c6e7b6612531

show more ...