All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28
@ 2022-05-18 13:13 emekcan.aras
  2022-05-18 13:13 ` [PATCH 1/3] " emekcan.aras
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: emekcan.aras @ 2022-05-18 13:13 UTC (permalink / raw)
  To: meta-arm, Ross.Burton; +Cc: nd, Emekcan Aras, Emekcan Aras

From: Emekcan Aras <Emekcan.Aras@arm.com>

This patchset upgrades the mbedtls to 2.28 and fixes issues in the
corstone1000 and TC due to the upgrade.

Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>

emeara01 (3):
  arm/trusted-firmware-a: upgrade mbedtls to 2.28
  arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC
    manifest
  arm-bsp/trusted-firmware-a: increase BL2 size for TC

 ...01-Fix-FF-A-version-in-SPMC-manifest.patch | 34 +++++++++
 ...01-plat-tc-Increase-maximum-BL2-size.patch |  4 +-
 .../trusted-firmware-a-corstone1000.inc       |  4 ++
 ...uild-deps-upgrade-to-mbed-TLS-2.28.0.patch | 72 +++++++++++++++++++
 .../trusted-firmware-a/trusted-firmware-a.inc |  4 +-
 .../trusted-firmware-a_2.6.bb                 |  6 +-
 6 files changed, 118 insertions(+), 6 deletions(-)
 create mode 100644 meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0001-Fix-FF-A-version-in-SPMC-manifest.patch
 create mode 100644 meta-arm/recipes-bsp/trusted-firmware-a/files/build-deps-upgrade-to-mbed-TLS-2.28.0.patch

-- 
2.25.1



^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH 1/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28
  2022-05-18 13:13 [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 emekcan.aras
@ 2022-05-18 13:13 ` emekcan.aras
  2022-05-18 13:13 ` [PATCH 2/3] arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC manifest emekcan.aras
                   ` (3 subsequent siblings)
  4 siblings, 0 replies; 6+ messages in thread
From: emekcan.aras @ 2022-05-18 13:13 UTC (permalink / raw)
  To: meta-arm, Ross.Burton; +Cc: nd, emeara01, Emekcan Aras

From: emeara01 <emekcan.aras@arm.com>

The latest TF-A version requires mbedtls v2.28. This
commit upgrades mbedtls to v2.28 for TF-A recipe.
An upstreamed patch included to the base recipe from TF-A master
that fixes the build issues beween TF-A 2.6 and Mbedtls 2.28.

Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
---
 ...uild-deps-upgrade-to-mbed-TLS-2.28.0.patch | 72 +++++++++++++++++++
 .../trusted-firmware-a/trusted-firmware-a.inc |  4 +-
 .../trusted-firmware-a_2.6.bb                 |  6 +-
 3 files changed, 78 insertions(+), 4 deletions(-)
 create mode 100644 meta-arm/recipes-bsp/trusted-firmware-a/files/build-deps-upgrade-to-mbed-TLS-2.28.0.patch

diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/files/build-deps-upgrade-to-mbed-TLS-2.28.0.patch b/meta-arm/recipes-bsp/trusted-firmware-a/files/build-deps-upgrade-to-mbed-TLS-2.28.0.patch
new file mode 100644
index 00000000..058423c6
--- /dev/null
+++ b/meta-arm/recipes-bsp/trusted-firmware-a/files/build-deps-upgrade-to-mbed-TLS-2.28.0.patch
@@ -0,0 +1,72 @@
+Upstream-Status: Backport
+Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
+
+From a93084be95634b66b917f1c8baf403067dc75c5d Mon Sep 17 00:00:00 2001
+From: Sandrine Bailleux <sandrine.bailleux@arm.com>
+Date: Thu, 21 Apr 2022 10:21:29 +0200
+Subject: [PATCH] build(deps): upgrade to mbed TLS 2.28.0
+
+Upgrade to the latest and greatest 2.x release of Mbed TLS library
+(i.e. v2.28.0) to take advantage of their bug fixes.
+
+Note that the Mbed TLS project published version 3.x some time
+ago. However, as this is a major release with API breakages, upgrading
+to 3.x might require some more involved changes in TF-A, which we are
+not ready to do. We shall upgrade to mbed TLS 3.x after the v2.7
+release of TF-A.
+
+Actually, the upgrade this time simply boils down to including the new
+source code module 'constant_time.c' into the firmware.
+
+To quote mbed TLS v2.28.0 release notes [1]:
+
+  The mbedcrypto library includes a new source code module
+  constant_time.c, containing various functions meant to resist timing
+  side channel attacks. This module does not have a separate
+  configuration option, and functions from this module will be
+  included in the build as required.
+
+As a matter of fact, if one is attempting to link TF-A against mbed
+TLS v2.28.0 without the present patch, one gets some linker errors
+due to missing symbols from this new module.
+
+Apart from this, none of the items listed in mbed TLS release
+notes [1] directly affect TF-A. Special note on the following one:
+
+  Fix a bug in mbedtls_gcm_starts() when the bit length of the iv
+  exceeds 2^32.
+
+In TF-A, we do use mbedtls_gcm_starts() when the firmware decryption
+feature is enabled with AES-GCM as the authenticated decryption
+algorithm (DECRYPTION_SUPPORT=aes_gcm). However, the iv_len variable
+which gets passed to mbedtls_gcm_starts() is an unsigned int, i.e. a
+32-bit value which by definition is always less than 2**32. Therefore,
+we are immune to this bug.
+
+With this upgrade, the size of BL1 and BL2 binaries does not appear to
+change on a standard sample test build (with trusted boot and measured
+boot enabled).
+
+[1] https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.0
+
+Change-Id: Icd5dbf527395e9e22c8fd6b77427188bd7237fd6
+Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
+---
+ drivers/auth/mbedtls/mbedtls_common.mk | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/auth/mbedtls/mbedtls_common.mk b/drivers/auth/mbedtls/mbedtls_common.mk
+index 0a4775d00..3eb41617f 100644
+--- a/drivers/auth/mbedtls/mbedtls_common.mk
++++ b/drivers/auth/mbedtls/mbedtls_common.mk
+@@ -48,6 +48,7 @@ LIBMBEDTLS_SRCS		:= $(addprefix ${MBEDTLS_DIR}/library/,	\
+ 					rsa_internal.c				\
+ 					x509.c 					\
+ 					x509_crt.c 				\
++					constant_time.c 			\
+ 					)
+ 
+ # The platform may define the variable 'TF_MBEDTLS_KEY_ALG' to select the key
+-- 
+2.25.1
+
diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
index 2e3b50c5..510a7d44 100644
--- a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
+++ b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
@@ -6,7 +6,9 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
 inherit deploy
 
 SRC_URI = "git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;protocol=https;name=tfa;branch=master \
-           file://ssl.patch"
+           file://ssl.patch \
+	    file://build-deps-upgrade-to-mbed-TLS-2.28.0.patch"
+
 UPSTREAM_CHECK_GITTAGREGEX = "^v(?P<pver>\d+(\.\d+)+)$"
 
 SRCREV_FORMAT = "tfa"
diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.6.bb b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.6.bb
index ec1bec95..89a92141 100644
--- a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.6.bb
+++ b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.6.bb
@@ -5,8 +5,8 @@ SRCREV_tfa = "a1f02f4f3daae7e21ee58b4c93ec3e46b8f28d15"
 
 LIC_FILES_CHKSUM += "file://docs/license.rst;md5=b2c740efedc159745b9b31f88ff03dde"
 
-# mbed TLS v2.26.0
-SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls;branch=master"
-SRCREV_mbedtls = "e483a77c85e1f9c1dd2eb1c5a8f552d2617fe400"
+# mbed TLS v2.28.0
+SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls;branch=mbedtls-2.28"
+SRCREV_mbedtls = "8b3f26a5ac38d4fdccbc5c5366229f3e01dafcc0"
 
 LIC_FILES_CHKSUM_MBEDTLS = "file://mbedtls/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH 2/3] arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC manifest
  2022-05-18 13:13 [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 emekcan.aras
  2022-05-18 13:13 ` [PATCH 1/3] " emekcan.aras
@ 2022-05-18 13:13 ` emekcan.aras
  2022-05-18 13:13 ` [PATCH 3/3] arm-bsp/trusted-firmware-a: increase BL2 size for TC emekcan.aras
                   ` (2 subsequent siblings)
  4 siblings, 0 replies; 6+ messages in thread
From: emekcan.aras @ 2022-05-18 13:13 UTC (permalink / raw)
  To: meta-arm, Ross.Burton; +Cc: nd, emeara01, Emekcan Aras

From: emeara01 <emekcan.aras@arm.com>

FF-A version is defined 1.1 in corstone1000_spmc_manifest.dts. However, SPMC
does not support FF-A version 1.1 at the moment. This commit fixes FF-A version
issue by defining 1.0 again.

Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
---
 ...01-Fix-FF-A-version-in-SPMC-manifest.patch | 34 +++++++++++++++++++
 .../trusted-firmware-a-corstone1000.inc       |  4 +++
 2 files changed, 38 insertions(+)
 create mode 100644 meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0001-Fix-FF-A-version-in-SPMC-manifest.patch

diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0001-Fix-FF-A-version-in-SPMC-manifest.patch b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0001-Fix-FF-A-version-in-SPMC-manifest.patch
new file mode 100644
index 00000000..016de8d3
--- /dev/null
+++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0001-Fix-FF-A-version-in-SPMC-manifest.patch
@@ -0,0 +1,34 @@
+Upstream-Status: Inappropriate
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From a31aee0988ef64724ec5866f10709f51f8cb3237 Mon Sep 17 00:00:00 2001
+From: emeara01 <emekcan.aras@arm.com>
+Date: Wed, 11 May 2022 14:37:06 +0100
+Subject: [PATCH] Fix FF-A version in SPMC manifest
+
+OPTEE does not support FF-A version 1.1 in SPMC at the moment.
+This commit corrects the FF-A version in corstone1000_spmc_manifest.dts.
+This patch will not be upstreamed and will be dropped once
+OPTEE version is updated for Corstone1000.
+
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+---
+ .../corstone1000/common/fdts/corstone1000_spmc_manifest.dts     | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plat/arm/board/corstone1000/common/fdts/corstone1000_spmc_manifest.dts b/plat/arm/board/corstone1000/common/fdts/corstone1000_spmc_manifest.dts
+index 8e49ab83f..5baa1b115 100644
+--- a/plat/arm/board/corstone1000/common/fdts/corstone1000_spmc_manifest.dts
++++ b/plat/arm/board/corstone1000/common/fdts/corstone1000_spmc_manifest.dts
+@@ -20,7 +20,7 @@
+ 	attribute {
+ 		spmc_id = <0x8000>;
+ 		maj_ver = <0x1>;
+-		min_ver = <0x1>;
++		min_ver = <0x0>;
+ 		exec_state = <0x0>;
+ 		load_address = <0x0 0x2002000>;
+ 		entrypoint = <0x0 0x2002000>;
+-- 
+2.17.1
+
diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc
index ac4a412c..bf5d2759 100644
--- a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc
+++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc
@@ -6,6 +6,10 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/files/corstone1000:"
 SRCREV_tfa = "cf89fd57ed3286d7842eef41cd72a3977eb6d317"
 PV = "2.6+git${SRCPV}"
 
+SRC_URI:append = " \ 
+	file://0001-Fix-FF-A-version-in-SPMC-manifest.patch \
+	"
+
 SRC_URI:remove = " \
      file://ssl.patch \
      "  
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH 3/3] arm-bsp/trusted-firmware-a: increase BL2 size for TC
  2022-05-18 13:13 [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 emekcan.aras
  2022-05-18 13:13 ` [PATCH 1/3] " emekcan.aras
  2022-05-18 13:13 ` [PATCH 2/3] arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC manifest emekcan.aras
@ 2022-05-18 13:13 ` emekcan.aras
  2022-05-18 20:30 ` [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 Jon Mason
  2022-05-23 17:02 ` Jon Mason
  4 siblings, 0 replies; 6+ messages in thread
From: emekcan.aras @ 2022-05-18 13:13 UTC (permalink / raw)
  To: meta-arm, Ross.Burton; +Cc: nd, emeara01, Emekcan Aras

From: emeara01 <emekcan.aras@arm.com>

The new mbedtls version (v2.28) increase the size of TF-A slightly.
This commit increases the size of BL2 for TC, so that TF-A with updated
mbedtls version can fit.

Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
---
 .../files/tc/0001-plat-tc-Increase-maximum-BL2-size.patch     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0001-plat-tc-Increase-maximum-BL2-size.patch b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0001-plat-tc-Increase-maximum-BL2-size.patch
index b6a5b4de..e9755efc 100644
--- a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0001-plat-tc-Increase-maximum-BL2-size.patch
+++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0001-plat-tc-Increase-maximum-BL2-size.patch
@@ -22,10 +22,10 @@ index ccabced9e..f45457b9f 100644
   */
  #if TRUSTED_BOARD_BOOT
 -# define PLAT_ARM_MAX_BL2_SIZE		0x20000
-+# define PLAT_ARM_MAX_BL2_SIZE		0x22000
++# define PLAT_ARM_MAX_BL2_SIZE		0x25000
  #else
 -# define PLAT_ARM_MAX_BL2_SIZE		0x14000
-+# define PLAT_ARM_MAX_BL2_SIZE		0x16000
++# define PLAT_ARM_MAX_BL2_SIZE		0x19000
  #endif
 
  /*
-- 
2.25.1



^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28
  2022-05-18 13:13 [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 emekcan.aras
                   ` (2 preceding siblings ...)
  2022-05-18 13:13 ` [PATCH 3/3] arm-bsp/trusted-firmware-a: increase BL2 size for TC emekcan.aras
@ 2022-05-18 20:30 ` Jon Mason
  2022-05-23 17:02 ` Jon Mason
  4 siblings, 0 replies; 6+ messages in thread
From: Jon Mason @ 2022-05-18 20:30 UTC (permalink / raw)
  To: meta-arm, emekcan.aras, Ross.Burton; +Cc: nd, Emekcan Aras

On Wed, 18 May 2022 14:13:53 +0100, emekcan.aras@arm.com wrote:
> This patchset upgrades the mbedtls to 2.28 and fixes issues in the
> corstone1000 and TC due to the upgrade.
> 
> Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
> 
> emeara01 (3):
>   arm/trusted-firmware-a: upgrade mbedtls to 2.28
>   arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC
>     manifest
>   arm-bsp/trusted-firmware-a: increase BL2 size for TC
> 
> [...]

Applied, thanks!

[1/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28
      commit: 36ccb480e9a5c3145ecd788f4a085369e066dd58
[2/3] arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC manifest
      commit: aa4d137309d8ac2e4a4a43e1d80f29e882ca0e0a
[3/3] arm-bsp/trusted-firmware-a: increase BL2 size for TC
      commit: c42e8bbf4e86ece9ca4c28898e37333374b95a09

Best regards,
-- 
Jon Mason <jon.mason@arm.com>


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28
  2022-05-18 13:13 [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 emekcan.aras
                   ` (3 preceding siblings ...)
  2022-05-18 20:30 ` [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 Jon Mason
@ 2022-05-23 17:02 ` Jon Mason
  4 siblings, 0 replies; 6+ messages in thread
From: Jon Mason @ 2022-05-23 17:02 UTC (permalink / raw)
  To: meta-arm, Ross.Burton, emekcan.aras; +Cc: Emekcan Aras, nd

On Wed, 18 May 2022 14:13:53 +0100, emekcan.aras@arm.com wrote:
> This patchset upgrades the mbedtls to 2.28 and fixes issues in the
> corstone1000 and TC due to the upgrade.
> 
> Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
> 
> emeara01 (3):
>   arm/trusted-firmware-a: upgrade mbedtls to 2.28
>   arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC
>     manifest
>   arm-bsp/trusted-firmware-a: increase BL2 size for TC
> 
> [...]

Applied, thanks!

[1/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28
      commit: 36ccb480e9a5c3145ecd788f4a085369e066dd58
[2/3] arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC manifest
      commit: aa4d137309d8ac2e4a4a43e1d80f29e882ca0e0a
[3/3] arm-bsp/trusted-firmware-a: increase BL2 size for TC
      commit: c42e8bbf4e86ece9ca4c28898e37333374b95a09

Best regards,
-- 
Jon Mason <jon.mason@arm.com>


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-05-23 17:03 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-18 13:13 [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 emekcan.aras
2022-05-18 13:13 ` [PATCH 1/3] " emekcan.aras
2022-05-18 13:13 ` [PATCH 2/3] arm-bsp/trusted-firmware-a: corstone1000: fix FF-A Version in SPMC manifest emekcan.aras
2022-05-18 13:13 ` [PATCH 3/3] arm-bsp/trusted-firmware-a: increase BL2 size for TC emekcan.aras
2022-05-18 20:30 ` [PATCH 0/3] arm/trusted-firmware-a: upgrade mbedtls to 2.28 Jon Mason
2022-05-23 17:02 ` Jon Mason

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.