Skip to content

Add IDK_S PTA #1026

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Sangho Lee (sangho2) wants to merge 15 commits into
base: main
Choose a base branch
from
Open

Add IDK_S PTA #1026

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
76e43d8
Add IDK_S PTA
Jul 13, 2026
194dce1
Bind TA digest into IDK endorsement
Jul 22, 2026
9396238
Add KeyIso claim structure
Aug 14, 2026
51b7afa
optional TaDigest
Aug 14, 2026
4443bb6
simplification
Aug 14, 2026
f857d05
Drop KeyIso claim structure in favor of flat endorsements
Sep 14, 2026
fa79640
Embed TA signing leaf certificate in IDK_S endorsements
Sep 14, 2026
0c2a669
add TA_DATA_LEN
Sep 14, 2026
019ad24
revise comments
Sep 14, 2026
6cac112
lazy TA digest calculation for TOCTOU robustness
Sep 14, 2026
a0f8f03
nits
Sep 14, 2026
6ba8049
add TA_DYNAMIC
Sep 14, 2026
0de7270
nits
Sep 14, 2026
82e4428
update claim wire format
Sep 21, 2026
349d5b0
add signature params and return report length
Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions litebox_runner_lvbs/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,7 +241,9 @@ pub fn init(is_bsp: bool) -> &'static Platform {
.get()
.expect("init must publish the platform before any core uses it");
if is_bsp {
let shim = litebox_shim_optee::OpteeShimBuilder::new(platform, session_manager()).build();
let shim = litebox_shim_optee::OpteeShimBuilder::new(platform, session_manager())
.with_ta_signing_cert(TA_SIGNING_CERT_DER)
.build();
register_embedded_tas(&shim);
}
platform
Expand Down Expand Up @@ -823,7 +825,9 @@ fn open_session_new_instance(
client_identity: Option<litebox_common_optee::TeeIdentity>,
ta_req_info: &litebox_shim_optee::msg_handler::TaRequestInfo<PAGE_SIZE>,
) -> Result<(), OpteeSmcReturnCode> {
let shim = litebox_shim_optee::OpteeShimBuilder::new(platform, session_manager()).build();
let shim = litebox_shim_optee::OpteeShimBuilder::new(platform, session_manager())
.with_ta_signing_cert(TA_SIGNING_CERT_DER)
.build();
if shim.get_ta_bin(&ta_uuid).is_none() {
msg_args.session = 0;
msg_args.ret = TeeResult::ItemNotFound;
Expand Down Expand Up @@ -1413,6 +1417,7 @@ fn write_rpc_args_to_normal_world(
const LDELF_BINARY: &[u8] = &[0u8; 0];
const TA_BINARY: &[u8] = &[0u8; 0];
const TA_BINARIES: &[&[u8]] = &[TA_BINARY];
const TA_SIGNING_CERT_DER: &[u8] = &[0u8; 0];

@thara-gopinath thara-gopinath Sep 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I think Angelina has a different way of sending the cert. But let us check in your PR and then Angelina can fix it up with her signing PR


/// Register a TA binary embedded in the runner image.
fn register_embedded_ta(
Expand Down
3 changes: 3 additions & 0 deletions litebox_shim_optee/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ zerocopy = { version = "0.8", default-features = false, features = ["derive"] }
zeroize = { version = "1.8", default-features = false, features = ["alloc"] }
p384 = { version = "0.13.1", default-features = false, features = ["arithmetic", "ecdsa"] }

[features]
idks-production = []

[lints]
workspace = true

Expand Down
Loading
Loading