xtest: regression 41xx target Secure Key Services tests

[etienne-lms]

Introduce regression test 41xx for PKCS#11 and SKS TA testing.

edited: this P-R depends on RFCs OP-TEE/optee_os#2732 and OP-TEE/optee_client#138.

[etienne-lms]

comments addressed.
need to rebase...

[etienne-lms]

rebased.

[etienne-lms]

Updated according to recent changes (library renaming) in OP-TEE/optee_client#121.

[etienne-lms]

Rebase on latest master.
PKCS#11/SKS tests have moved to regression_42xx since regression_41xx are already assigned.

This P-R is still a first step for libsks to propose a PKCS#11 client API. This P-R introduces a regression test series. The sole test done here is calling the library initialization;

[jenswi-linaro]

Please don't reach outside of this git into some other git for internal .h files. Whatever .h files are needed should be installed somewhere where we can find them.

[etienne-lms]

ok. I will remove this line and CFLAGS += -I$(OPTEE_SKS_HEADERS) below.
The lib headers are already exported in $(OPTEE_CLIENT_EXPORT)/include.

[wamserma]

LGTM, but add a test for SKS_CMD_PING.

[jenswi-linaro]

Please replace the SKS acronym and Secure Key Services with pkcs11 since that's what it's about.
Add this as a separate suit in xtest, pkcs11 for instance.
+1 to a test for SKS_CMD_PING.

[etienne-lms]

With this latest update, pkcs11 TA tests are no more in the regression tests and the TA is no more default embedded within Qemu OP-TEE core.
To test the pkcs11 TA:

• [RFC] Secure key services: step1: TA basics and API optee_os#2732 + [RFC] libsks for Pkcs#11 services through OP-TEE SKS TA optee_client#138 + this P-R xtest: regression 41xx target Secure Key Services tests #281
• Build from make all CFG_PKCS11_TA=y CFG_IN_TREE_EARLY_TAS=pkcs11/fd02c9da-306c-48c7-a49c-bbd827ae86ee
• On target: xtest -t pkcs11
  Expected output trace:

######################################################
#
# pkcs11
#
######################################################
* pkcs11_1000 Initialize and close Cryptoki library
  pkcs11_1000 OK
+-----------------------------------------------------
Result of testsuite pkcs11:
pkcs11_1000 OK
+-----------------------------------------------------
5 subtests of which 0 failed
1 test case of which 0 failed
0 test cases were skipped
TEE test application done!

[etienne-lms]

For info, IBART fails because it needs libckteec from OP-TEE/optee_client#138:

 32693:  /home/optee/devel/reference/toolchains83_201903/aarch64/bin/../lib/gcc/aarch64-linux-gnu/8.3.0/../../../../aarch64-linux-gnu/bin/ld: cannot find -lckteec

[jbech-linaro]

For info, IBART fails because it needs libckteec from OP-TEE/optee_client#138:

Let me know if I need to update the build config in IBART ... add flags etc.

[jenswi-linaro]

Reviewed-by: Jens Wiklander <[email protected]>

[etienne-lms]

Let me know if I need to update the build config in IBART ... add flags etc.

Do you want IBART always run the pkcs11 tests ? now and in the future?

[etienne-lms]

For info, the pkcs11 TA gets pinged when client opens (initializes) the cryptoki library, i.e. from test pkcs11_1000 in the P-R.

[etienne-lms]

R-B tag applied.
Depends on OP-TEE/optee_os#2733 and OP-TEE/optee_client#138.

Maybe add the pkcs11 to IBART.
Need build with CFG_PKCS11_TA=y and embedding the TA image, i.e. adding TA to early TAs: CFG_IN_TREE_EARLY_TAS="avb/023f8f1a-292a-432b-8fc4-de8471358067 pkcs11/fd02c9da-306c-48c7-a49c-bbd827ae86ee".

[jbech-linaro]

Maybe add the pkcs11 to IBART.

Maybe? Give me a 'yes' or 'no' instead and I'll do what you think makes sense :)

[jforissier]

Maybe add the pkcs11 to IBART.

Maybe? Give me a 'yes' or 'no' instead and I'll do what you think makes sense :)

😄

I have just merged the optee_client and optee_os PRs, so we're good from a dependency point of view. And I agree it would be nice to have this checked by IBART.

Edit: I see IBART is failing with ...ld: cannot find -lckteec, perhaps it had started before I have merged the client PR, and needs to be restarted.

[etienne-lms]

@jbech-linaro, yes, add to IBART please.

[jbech-linaro]

@jbech-linaro, yes, add to IBART please.

That was clear! 😄

So, I'll add

make ... CFG_PKCS11_TA=y CFG_IN_TREE_EARLY_TAS="avb/023f8f1a-292a-432b-8fc4-de8471358067 pkcs11/fd02c9da-306c-48c7-a49c-bbd827ae86ee"

and we're good to go?

[etienne-lms]

Should be, yes.
You should see a trace pkcs11_1001 OK in xtest logs.

[etienne-lms]

thanks