Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

App provisioning framework #367

Merged
merged 34 commits into from
Nov 5, 2024
Merged

App provisioning framework #367

merged 34 commits into from
Nov 5, 2024

Commits on Nov 5, 2024

  1. Update submodules 

    Update submodules after merging:
* islet-project/assets#12
* islet-project/assets#13

Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    5572461 View commit details
    Browse the repository at this point in the history

  2. Add handling of realm metadata and sealing key derivation 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    38eb65b View commit details
    Browse the repository at this point in the history

  3. Use allocated pages instead of exported arrays in rsi driver 

    There is no need to modify the realm Linux kernel and export
static arrays to use them as granules passed via RSI to RMM.

Instead just use page allocation mechanism.

The previous issue with the static buffers in rsi.ko was been
related to improper usage of virt_to_phys() function,
which doesn't work, because the static buffer belongs to
the modules memory range. In that case virt_to_phys()
returns improper physical address that doesn't belong to the
RAM range.

To make it work with static buffers, one could use:

phys_addr_t granule = page_to_phys(vmalloc_to_page(rsi_page_buf));

Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    bd89daa View commit details
    Browse the repository at this point in the history

  4. Don't allow to assign realm metadata multiple times 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    a8e2ef4 View commit details
    Browse the repository at this point in the history

  5. Implement handling of RSI_ISLET_REALM_METADATA in the rsi driver 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    f0895f8 View commit details
    Browse the repository at this point in the history

  6. Apply cosmetic changes to rsi driver 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    be6cadb View commit details
    Browse the repository at this point in the history

  7. Fix handling of realm metadata RSI in TF-RMM 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    af4cf6f View commit details
    Browse the repository at this point in the history

  8. Apply fixes in TF-RMM 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    4a2531b View commit details
    Browse the repository at this point in the history

  9. Fix RIM calculation code to be complaint with EAC5 spec 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    baecef2 View commit details
    Browse the repository at this point in the history

  10. Fix macro definition name in TF-RMM 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    3defeca View commit details
    Browse the repository at this point in the history

  11. Fix destruction of realm when metadata is not privided 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    465f3ac View commit details
    Browse the repository at this point in the history

  12. hes: Implement derivation of VHUK_A and VHUK_M 

    Signed-off-by: Zofia Abramowska <z.abramowska@samsung.com>
    @zos @L0czek
    zos authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    206a855 View commit details
    Browse the repository at this point in the history

  13. Get VHUKS from TF-A using vendor SMC RMM calls 

    Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
    @Havner @L0czek
    Havner authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    ac17945 View commit details
    Browse the repository at this point in the history

  14. Implement RSI sealing key call with HKDF key generation 

    tf-a-rss: Enable fetching VHUK from HES

Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
    @Havner @L0czek
    Havner authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    34c1877 View commit details
    Browse the repository at this point in the history

  15. Implement metadata handling 

    - RMI call
- verification and validation
- use in the sealing-key process

Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
    @Havner @L0czek
    Havner authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    1fea9ad View commit details
    Browse the repository at this point in the history

  16. Add app-provisioning readme 

    Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
    @Havner @L0czek
    Havner authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    17a343a View commit details
    Browse the repository at this point in the history

  17. Add description on how to extract the RIM using the rim-measurer-tool 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    b26e4a1 View commit details
    Browse the repository at this point in the history

  18. Add a high level description to README 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    9edfba8 View commit details
    Browse the repository at this point in the history

  19. Change Info to Debug and rework static assertions 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    f1ba298 View commit details
    Browse the repository at this point in the history

  20. Put metadata on heap using Box 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    144cfe5 View commit details
    Browse the repository at this point in the history

  21. Change log level to debug 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    08a007e View commit details
    Browse the repository at this point in the history

  22. Fix CI 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    b18bfbf View commit details
    Browse the repository at this point in the history

  23. Fix clippy 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    d4ab2cd View commit details
    Browse the repository at this point in the history

  24. Fix the name of the network interface in the app-provisioning manual 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    e8ed466 View commit details
    Browse the repository at this point in the history

  25. Add a note on how to build an OCI image in case of using older Docker… 

    … versions

Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    c35f8b4 View commit details
    Browse the repository at this point in the history

  26. Fix CI 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    206a4d3 View commit details
    Browse the repository at this point in the history

  27. Add a missing check for RD in State::New in SET_METADATA 

    Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
    @Havner @L0czek
    Havner authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    94771ed View commit details
    Browse the repository at this point in the history

  28. Unify ip address setup 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    eb15734 View commit details
    Browse the repository at this point in the history

  29. Apply fixes accordind to the review (submodules, comments) 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    7d844ab View commit details
    Browse the repository at this point in the history

  30. Update the submodule reference to eac5/kvmtool-rim-measurer 

    Also, update the README.md file for app provisioning
to point this submodule.

Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    b92ae61 View commit details
    Browse the repository at this point in the history

  31. Implement sealing/unsealing operations using the sealing keys 

    Use the symmetric sealing key that is derived by Islet RMM.
Utilize AES-256-GCM for the encryption of sealed data.

Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    0695976 View commit details
    Browse the repository at this point in the history

  32. Update readme acording to comments 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    81a1e62 View commit details
    Browse the repository at this point in the history

  33. Let the tf-rmm submodule point to the original repo 

    Signed-off-by: Piotr Sawicki <p.sawicki2@samsung.com>
    @p-sawicki2 @L0czek
    p-sawicki2 authored and L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    e6efed1 View commit details
    Browse the repository at this point in the history

  34. Change info to debug in sealing.rs 

    Signed-off-by: Michał Szaknis <m.szaknis@samsung.com>
    @L0czek
    L0czek committed Nov 5, 2024
    Configuration menu
    Copy the full SHA
    d5e6332 View commit details
    Browse the repository at this point in the history