- TF-A - lists.trustedfirmware.org

Re: [RFC] cert_create: only generate/save keys needed by requested certs

by Manish Badarkhe

Hi Vikrant, This makes sense to me. Today cert_create effectively treats the registered key set as global: even if only a subset of certificates is requested, it still walks the full key list for load/create/save, and -k can fail on filenames for keys that are not actually needed by the requested outputs. Your proposed approach seems like the right direction. At a high level, the tool should first derive the required key set from the certificates that were actually requested, then use that set consistently for validation, key load/create, and key save. That would make requesting only a subset of certificates work the way users would expect, without needing to provide or generate unrelated keys. One thing I would suggest is to make sure the filtering is applied consistently across all three places: * command-line validation * key load/create * key save If that is what your change does, then the approach looks good to me. Please upload it to Gerrit and it can go through the usual review process and CI validation. Thanks, Manish Badarkhe ________________________________ From: Vikrant Yadav <vikrantyadav4802(a)gmail.com> Sent: 29 September 2026 07:14 To: tf-a(a)lists.trustedfirmware.org <tf-a(a)lists.trustedfirmware.org> Cc: Sandrine Bailleux <Sandrine.Afsa(a)arm.com>; Manish Badarkhe <Manish.Badarkhe(a)arm.com> Subject: [RFC] cert_create: only generate/save keys needed by requested certs Hi all, I'd like to propose a small change to cert_create (tools/cert_create) and get your feedback before uploading to Gerrit. What it does today: When generating certificates, cert_create unconditionally generates all keys in the Chain of Trust (CoT), and with the -k option it requires filenames for every key - even when only a subset of certificates is requested. Why this is a problem: Keys that no requested certificate needs are still generated, and -k errors out on missing filenames for keys that are never used. Requesting a single certificate shouldn't require dealing with keys it doesn't depend on. Proposed fix: Add a "bool required" field to the key struct. For each requested certificate, mark as required the keys it depends on: - the certificate's own key - its issuer's signing key - keys referenced by its extensions The key generation and save loops then act only on keys marked required. Does this approach make sense? If so, I'll upload the change to Gerrit. Thanks, Vikrant

1 month, 1 week

1
0
0 0

Trusted Firmware-A LTS v2.8.47 Release Announcement

by svc_openci_enginfra＠arm.com

Hello, Trusted Firmware-A LTS version 2.8.47 is now available. This release contains the following patches: 516f5634b fix(qti): do not map secure regions [1] 296470531 fix(qti): disallow secure IO accesses from secure world callers [2] 44e050ce9 fix(qti): pull in access-control backend for mem_assign [3] 92de580f1 fix(qti): fix build without coreboot [4] 13a9e032d fix(qti): harden mem_assign parameter handling [5] 4285ff854 refactor(cpus): align AE variant core names [6] 29c5966c2 feat(cpus): add links to each core's TRM and SDEN [7] f7092d05b docs: add LTS Dependabot release step [8] 2b1cc89ac refactor(cpus): factor out Neoverse V3AE from the base Neoverse V3 file [9] 439cb5243 fix(fdt-wrappers): reject negative cell counts [10] [1] https://review.trustedfirmware.org/q/I070bb347039e467c1407cf6ceb832e43e7512… [2] https://review.trustedfirmware.org/q/I6dea64e110184f73868ac188fca2d755999d5… [3] https://review.trustedfirmware.org/q/Ia84fd78b62ea5e7e7e7b9fa85d6baf1ab04b5… [4] https://review.trustedfirmware.org/q/I3c00aace547385af6b49632e3acfd9a977306… [5] https://review.trustedfirmware.org/q/Ie9e5480891a82ba98919c8c7dbdd27819e246… [6] https://review.trustedfirmware.org/q/I999ed43421d083af148c3e92cef9d8ca5c635… [7] https://review.trustedfirmware.org/q/I6fe089876aa2d764a67733041751202e2bd3c… [8] https://review.trustedfirmware.org/q/I22cfbf65449e4b32d5ba2a39bbac89e0fd2ab… [9] https://review.trustedfirmware.org/q/Ic658273bd4502c28281a7963a8c862c26da64… [10] https://review.trustedfirmware.org/q/I67bf1e5773211df80d3b8ba71157a87d70ce2… Alternatively, Change Log is available in the documentation section: https://trustedfirmware-a.readthedocs.io/en/lts-v2.8.47/change-log.html Thanks, TF-A LTS team

1 month, 2 weeks

1
0
0 0

New Defects reported by Coverity Scan for ARM-software/arm-trusted-firmware

by scan-admin＠coverity.com

Hi, Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan. 2 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan. 6 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 506263: Control flow issues (DEADCODE) /include/services/pfdi.h: 127 in pack_vendor_id() _____________________________________________________________________________________________ *** CID 506263: Control flow issues (DEADCODE) /include/services/pfdi.h: 127 in pack_vendor_id() 121 uint32_t major = (uint32_t)((cfg >> PFDI_MAJOR_SHIFT) & UINT64_C(0xFF)); 122 uint32_t minor = (uint32_t)((cfg >> PFDI_MINOR_SHIFT) & UINT64_C(0xFF)); 123 124 if (((cfg & PFDI_UPPER_RESERVED_MASK) != UINT64_C(0)) || 125 ((cfg & PFDI_RESERVED_MASK) != UINT64_C(0)) || 126 (vendor != PFDI_VENDOR_ARM)) { >>> CID 506263: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "*version = 0UL;". 127 *version = 0ull; /* On error: Must be zero */ 128 } else { 129 uint64_t v = 0ull; 130 131 v |= ((uint64_t)vendor << 24); 132 v |= ((uint64_t)impl << 16); ** CID 267379: (PARSE_ERROR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rdv3/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/uniphier/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rpi3/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/tc/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/qemu/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/n1sdp/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/stm32mp1-mp13-sdmmc-tbbr/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/stm32mp1-mp13-sdmmc-tbbr-dec/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/stingray/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/synquacer/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rdn2/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/stm32mp1-sdmmc-tbbr/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/warp7/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rdaspen/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rd1ae/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () _____________________________________________________________________________________________ *** CID 267379: (PARSE_ERROR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rdv3/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/uniphier/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rpi3/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/tc/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/qemu/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/n1sdp/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/stm32mp1-mp13-sdmmc-tbbr/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/stm32mp1-mp13-sdmmc-tbbr-dec/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/stingray/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/synquacer/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rdn2/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/stm32mp1-sdmmc-tbbr/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/warp7/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rdaspen/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/build/rd1ae/debug/libmbedtls/CMakeFiles/CMakeTmp/CheckIncludeFile.c: 1 in () >>> CID 267379: (PARSE_ERROR) >>> cannot open source file "pthread.h" 1 #include <pthread.h> 2 3 #ifdef __CLASSIC_C__ 4 int main() 5 { 6 return 0; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/arm-software-arm-trusted-firmware?tab=ov…

1 month, 2 weeks

1
0
0 0

Trusted Firmware-A LTS v2.10.36 Release Announcement

by svc_openci_enginfra＠arm.com

Hello, Trusted Firmware-A LTS version 2.10.36 is now available. This release contains the following patches: 8c8522931 fix(mediatek): enable missing Cortex-A78 errata for MT8195 [1] 80d954cfc fix(mediatek): enable missing Cortex-A78 errata for MT8188 [2] eae6e49a9 fix(qti): do not map secure regions [3] f884efa8c fix(qti): disallow secure IO accesses from secure world callers [4] 4aa762a74 fix(qti): pull in access-control backend for mem_assign [5] 5fd5f37ad fix(qti): fix build without coreboot [6] b8594bd37 fix(qti): harden mem_assign parameter handling [7] 36870eb72 fix(xilinx): allow secure access to IPI channels [8] [1] https://review.trustedfirmware.org/q/Id2574c33a345c1c69f35b065ef210a32bd724… [2] https://review.trustedfirmware.org/q/I0f7b451220fbe832cd6735fde6f12fd6c095e… [3] https://review.trustedfirmware.org/q/I070bb347039e467c1407cf6ceb832e43e7512… [4] https://review.trustedfirmware.org/q/I6dea64e110184f73868ac188fca2d755999d5… [5] https://review.trustedfirmware.org/q/Ia84fd78b62ea5e7e7e7b9fa85d6baf1ab04b5… [6] https://review.trustedfirmware.org/q/I3c00aace547385af6b49632e3acfd9a977306… [7] https://review.trustedfirmware.org/q/Ie9e5480891a82ba98919c8c7dbdd27819e246… [8] https://review.trustedfirmware.org/q/I69681b689d57446c141c67eb143430d32f05c… Alternatively, Change Log is available in the documentation section: https://trustedfirmware-a.readthedocs.io/en/lts-v2.10.36/change-log.html Thanks, TF-A LTS team

1 month, 2 weeks

1
0
0 0

Trusted Firmware-A LTS v2.14.9 Release Announcement

by svc_openci_enginfra＠arm.com

Hello, Trusted Firmware-A LTS version 2.14.9 is now available. This release contains the following patches: f61b03e77 fix(mediatek): enable missing Cortex-A78 errata for MT8188 [1] fad1a2ff2 fix(mediatek): enable missing Cortex-A78 errata for MT8189 [2] 58c00cf35 fix(mediatek): enable missing Cortex-A78 errata for MT8195 [3] 634fea282 fix(xilinx): allow secure access to IPI channels [4] f5b7ee2f7 fix(qemu-sbsa): fix build break when SPM set to SPMD [5] b03408809 fix(qemu): produce manifest entry inside transfer list [6] d57a77131 fix(qemu): add TB_FW_CONFIG_SIZE and TOS_FW_CONFIG_SIZE defines [7] 9f68c3534 fix(rdaspen): correct PSCI power domain topology [8] [1] https://review.trustedfirmware.org/q/I0f7b451220fbe832cd6735fde6f12fd6c095e… [2] https://review.trustedfirmware.org/q/Ib517ed679ce82ec2e3c707e16e51193bf5c13… [3] https://review.trustedfirmware.org/q/Id2574c33a345c1c69f35b065ef210a32bd724… [4] https://review.trustedfirmware.org/q/I69681b689d57446c141c67eb143430d32f05c… [5] https://review.trustedfirmware.org/q/I3472f57f06e7cb12132d94cb52d36905ce697… [6] https://review.trustedfirmware.org/q/I95e17e4fd7e3ecfbae18568ec3bfe35d58739… [7] https://review.trustedfirmware.org/q/I1eda1402f99c748e79db198489ce2915aebe8… [8] https://review.trustedfirmware.org/q/Ib9a375a6e05c7876f9179047b5ae5b8a1047e… Alternatively, Change Log is available in the documentation section: https://trustedfirmware-a.readthedocs.io/en/lts-v2.14.9/change-log.html Thanks, TF-A LTS team

1 month, 2 weeks

1
0
0 0

New Defects reported by Coverity Scan for ARM-software/arm-trusted-firmware

by scan-admin＠coverity.com

Hi, Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan. 1 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 506142: Memory - corruptions (OVERRUN) _____________________________________________________________________________________________ *** CID 506142: Memory - corruptions (OVERRUN) /plat/rpi/rpi3/rpi3_bl1_mboot.c: 178 in bl1_plat_mboot_init() 172 tpm_alg_query_t alg_query[] = { 173 { .alg_id = TPM_ALG_SHA256 }, 174 { .alg_id = EVLOG_TPM_ALG_SHA384 }, 175 { .alg_id = EVLOG_TPM_ALG_SHA512 }, 176 { .alg_id = TPM_ALG_NULL }, 177 }; >>> CID 506142: Memory - corruptions (OVERRUN) >>> Overrunning array "alg_query" of 4 4-byte elements by passing it to a function which accesses it at element index 63 (byte offset 255). 178 rc = tpm_getcap_query_algs(&tpm_chip_data, alg_query); 179 if (rc < 0) { 180 ERROR("Failed to query TPM algs (%d).\n", rc); 181 panic(); 182 } 183 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/arm-software-arm-trusted-firmware?tab=ov…

1 month, 2 weeks

1
0
0 0

New Defects reported by Coverity Scan for ARM-software/arm-trusted-firmware

by scan-admin＠coverity.com

Hi, Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan. 5 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 506049: Insecure data handling (TAINTED_SCALAR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 568 in parse_pcrs_find() _____________________________________________________________________________________________ *** CID 506049: Insecure data handling (TAINTED_SCALAR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 568 in parse_pcrs_find() 562 if (ret != TPM_SUCCESS) { 563 return ret; 564 } 565 566 iter_read_u32_be(&iter, &count); 567 >>> CID 506049: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "count" as a loop boundary. 568 for (uint32_t i = 0U; i < count; i++) { 569 iter_read_u16_be(&iter, &hash_id); 570 iter_read_u8(&iter, &sizeof_select); 571 if (iter.error_state != TPM_SUCCESS) { 572 return iter.error_state; 573 } ** CID 506048: Memory - corruptions (OVERRUN) _____________________________________________________________________________________________ *** CID 506048: Memory - corruptions (OVERRUN) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 1071 in tpm_has_alg() 1065 } 1066 1067 item[0].alg_id = alg_id; 1068 item[0].enabled = false; 1069 item[1].alg_id = TPM_ALG_NULL; 1070 item[1].enabled = false; >>> CID 506048: Memory - corruptions (OVERRUN) >>> Overrunning array "item" of 2 4-byte elements by passing it to a function which accesses it at element index 63 (byte offset 255). 1071 ret = tpm_getcap_query_algs(chip, item); 1072 if (ret != TPM_SUCCESS) { 1073 return ret; 1074 } 1075 1076 *out_supported = item[0].enabled; ** CID 506047: Insecure data handling (TAINTED_SCALAR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 444 in parse_algs_find() _____________________________________________________________________________________________ *** CID 506047: Insecure data handling (TAINTED_SCALAR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 444 in parse_algs_find() 438 if (ret != TPM_SUCCESS) { 439 return ret; 440 } 441 442 iter_read_u32_be(&iter, &count); 443 >>> CID 506047: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "count" as a loop boundary. 444 for (uint32_t i = 0U; i < count; i++) { 445 iter_read_u16_be(&iter, &alg); 446 iter_read_u32_be(&iter, &props); 447 if (iter.error_state != TPM_SUCCESS) { 448 return iter.error_state; 449 } ** CID 506046: Insecure data handling (TAINTED_SCALAR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 386 in parse_algs() _____________________________________________________________________________________________ *** CID 506046: Insecure data handling (TAINTED_SCALAR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 386 in parse_algs() 380 if (ret != TPM_SUCCESS) { 381 return ret; 382 } 383 384 iter_read_u32_be(&iter, &count); 385 >>> CID 506046: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "count" as a loop boundary. 386 for (uint32_t i = 0U; i < count; i++) { 387 iter_read_u16_be(&iter, &alg); 388 iter_read_u32_be(&iter, &properties); 389 if (iter.error_state != TPM_SUCCESS) { 390 return iter.error_state; 391 } ** CID 506045: Insecure data handling (TAINTED_SCALAR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 498 in parse_pcrs() _____________________________________________________________________________________________ *** CID 506045: Insecure data handling (TAINTED_SCALAR) /home/buildslave/agent/workspace/tf-a-coverity/trusted-firmware-a/contrib/libtpm/src/tpm2_cmds.c: 498 in parse_pcrs() 492 if (ret != TPM_SUCCESS) { 493 return ret; 494 } 495 496 iter_read_u32_be(&iter, &count); 497 >>> CID 506045: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "count" as a loop boundary. 498 for (uint32_t i = 0U; i < count; i++) { 499 iter_read_u16_be(&iter, &hash); 500 iter_read_u8(&iter, &sizeof_select); 501 if (iter.error_state != TPM_SUCCESS) { 502 return iter.error_state; 503 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/arm-software-arm-trusted-firmware?tab=ov…

1 month, 3 weeks

1
0
0 0

Trusted Firmware-A LTS v2.14.8 Release Announcement

by svc_openci_enginfra＠arm.com

Hello, Trusted Firmware-A LTS version 2.14.8 is now available. This release contains the following patches: 23a043ecf refactor(cpus): align AE variant core names [1] 06e6a11cd feat(cpus): add links to each core's TRM and SDEN [2] e808effb2 fix(cpus): use #ifdef for IMAGE_BL flags [3] d88a86de0 refactor(cpus): factor out Neoverse V3AE from the base Neoverse V3 file [4] b1636c347 fix(rdaspen): enable A720AE erratum 3456103 [5] 9bf7047a4 feat(psci): add hierarchical power state consistency check [6] 71d0777fd fix(psci): validate last_at_pwrlvl bounds before use [7] 35bb2bf98 fix(arm): validate last_at_pwrlvl before forwarding it [8] e5d084678 fix(fdt-wrappers): reject negative cell counts [9] dc4d9feab fix(el3-spmc): harden composite MRD validation [10] ffd31a2bc fix(rk3568): implement CPU core suspend/resume power domain hooks [11] d502f6dd9 chore(deps): add LTS-v2.14 Dependabot configuration [12] 68d99c69b docs: add LTS Dependabot release step [13] [1] https://review.trustedfirmware.org/q/I999ed43421d083af148c3e92cef9d8ca5c635… [2] https://review.trustedfirmware.org/q/I6fe089876aa2d764a67733041751202e2bd3c… [3] https://review.trustedfirmware.org/q/I5a4e2acdd007ba56039b992bde77d2a940030… [4] https://review.trustedfirmware.org/q/Ic658273bd4502c28281a7963a8c862c26da64… [5] https://review.trustedfirmware.org/q/Ia3f25dd8943a99563b95695f5f505a297997f… [6] https://review.trustedfirmware.org/q/Iee25103004bd424fb498e6b23b0f88b2abcc7… [7] https://review.trustedfirmware.org/q/I0d7b679ced6d17274dfcc5d57f50e8021bdba… [8] https://review.trustedfirmware.org/q/I0a0dbc9e60713796b99bc4b9d11b403671c0e… [9] https://review.trustedfirmware.org/q/I67bf1e5773211df80d3b8ba71157a87d70ce2… [10] https://review.trustedfirmware.org/q/I207d2fe57766bee83a7c4c8b51f259b08934b… [11] https://review.trustedfirmware.org/q/Icc20759ef18900a0702bc2345ad768a2dd63b… [12] https://review.trustedfirmware.org/q/I68fe77580b13c9bb2f1e04cea79ebba01c9f6… [13] https://review.trustedfirmware.org/q/I22cfbf65449e4b32d5ba2a39bbac89e0fd2ab… Alternatively, Change Log is available in the documentation section: https://trustedfirmware-a.readthedocs.io/en/lts-v2.14.8/change-log.html Thanks, TF-A LTS team

1 month, 3 weeks

1
0
0 0

Trusted Firmware-A LTS v2.10.35 Release Announcement

by svc_openci_enginfra＠arm.com

Hello, Trusted Firmware-A LTS version 2.10.35 is now available. This release contains the following patches: 48ae48d0c fix(intel): update fcs crypto init code to check for mode [1] 6e6cc3ec2 fix(imx8m): don't reconfigure default region0 [2] f60721cab fix(xilinx): enforce volatile call status vars [3] 5b1aa78b6 fix(tools): change data type to size_t for doimage [4] 0958da979 build(deps): bump the npm_and_yarn group across 1 directory with 5 updates [5] 81eab6d80 refactor(cpus): align AE variant core names [6] 6f951de87 feat(cpus): add links to each core's TRM and SDEN [7] 2fe5d6a71 fix(cpus): use #ifdef for IMAGE_BL flags [8] d4cfb4dc5 refactor(cpus): factor out Neoverse V3AE from the base Neoverse V3 file [9] 289e785d9 fix(psci): modify variable conflicting with external function [10] 511450d3c fix(psci): add missing curly braces [11] cc5495c5d feat(psci): add hierarchical power state consistency check [12] cd8294878 fix(psci): validate last_at_pwrlvl bounds before use [13] 083009355 fix(arm): validate last_at_pwrlvl before forwarding it [14] 9b53aab02 docs: add LTS Dependabot release step [15] 353c4fe1d fix(fdt-wrappers): reject negative cell counts [16] 810363985 fix(el3-spmc): harden composite MRD validation [17] [1] https://review.trustedfirmware.org/q/I702ce90e229188830f8936bee2999610e9559… [2] https://review.trustedfirmware.org/q/I0a0f9b5ad0017f38d767f583d7765a2f79861… [3] https://review.trustedfirmware.org/q/I40deb494ad6d03b9640673044687a4a83c1f7… [4] https://review.trustedfirmware.org/q/I658521c1eec1c79933ba8082ba507df04d174… [5] https://review.trustedfirmware.org/q/I3203e9eb23315f2442e3715549f7541207fe4… [6] https://review.trustedfirmware.org/q/I999ed43421d083af148c3e92cef9d8ca5c635… [7] https://review.trustedfirmware.org/q/I6fe089876aa2d764a67733041751202e2bd3c… [8] https://review.trustedfirmware.org/q/I5a4e2acdd007ba56039b992bde77d2a940030… [9] https://review.trustedfirmware.org/q/Ic658273bd4502c28281a7963a8c862c26da64… [10] https://review.trustedfirmware.org/q/I2f109242b6dd3b3c5e9289881e3dd5466c74f… [11] https://review.trustedfirmware.org/q/Ida2460b7fe6f27b23382a1259a5ac93fe36bd… [12] https://review.trustedfirmware.org/q/Iee25103004bd424fb498e6b23b0f88b2abcc7… [13] https://review.trustedfirmware.org/q/I0d7b679ced6d17274dfcc5d57f50e8021bdba… [14] https://review.trustedfirmware.org/q/I0a0dbc9e60713796b99bc4b9d11b403671c0e… [15] https://review.trustedfirmware.org/q/I22cfbf65449e4b32d5ba2a39bbac89e0fd2ab… [16] https://review.trustedfirmware.org/q/I67bf1e5773211df80d3b8ba71157a87d70ce2… [17] https://review.trustedfirmware.org/q/I207d2fe57766bee83a7c4c8b51f259b08934b… Alternatively, Change Log is available in the documentation section: https://trustedfirmware-a.readthedocs.io/en/lts-v2.10.35/change-log.html Thanks, TF-A LTS team

1 month, 3 weeks

1
0
0 0

Canceled event with note: TF-A Tech Forum @ Thu Sep 17, 2026 5pm - 6pm (GMT+2) (tf-a@lists.trustedfirmware.org)

by Olivier Deprez

This event has been canceled with a note: "Hi cancelling as no topic planned. Regards, Olivier. " TF-A Tech Forum Thursday Sep 17, 2026 ⋅ 5pm – 6pm Central European Time - Paris Location https://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34… https://www.google.com/url?q=https%3A%2F%2Flinaro-org.zoom.us%2Fj%2F9355786… Trusted Firmware is inviting you to a scheduled Zoom meeting. Topic: TF-A Tech Forum Time: May 15, 2025 02:00 PM London Every 2 weeks on Thu, 78 occurrence(s) Please download and import the following iCalendar (.ics) files to your calendar system. Weekly: https://linaro-org.zoom.us/meeting/tJcocu6gqDgjEtOkyBhSQauR1sUyFwIcNKLa/ics… Join Zoom Meeting https://linaro-org.zoom.us/j/93557863987?pwd=56a1l8cBnetDTZ6eazHGaE1Ctk4W34… Meeting ID: 935 5786 3987 Passcode: 939141 --- One tap mobile +12532158782,,93557863987# US (Tacoma) +13017158592,,93557863987# US (Washington DC) --- Dial by your location • +1 253 215 8782 US (Tacoma) • +1 301 715 8592 US (Washington DC) • +1 305 224 1968 US • +1 309 205 3325 US • +1 312 626 6799 US (Chicago) • +1 346 248 7799 US (Houston) • +1 360 209 5623 US • +1 386 347 5053 US • +1 507 473 4847 US • +1 564 217 2000 US • +1 646 558 8656 US (New York) • +1 646 931 3860 US • +1 669 444 9171 US • +1 669 900 9128 US (San Jose) • +1 689 278 1000 US • +1 719 359 4580 US • +1 253 205 0468 US • 833 548 0276 US Toll-free • 833 548 0282 US Toll-free • 833 928 4608 US Toll-free • 833 928 4609 US Toll-free • 833 928 4610 US Toll-free • 877 853 5247 US Toll-free • 888 788 0099 US Toll-free Meeting ID: 935 5786 3987 Find your local number: https://linaro-org.zoom.us/u/adoz9mILli Guests d82620130(a)gmail.com namyoon(a)google.com shaikadnanafrid(a)gmail.com tf-a(a)lists.trustedfirmware.org ~~//~~ Sent by Google Calendar: https://calendar.google.com/calendar/ You are receiving this email because you are an attendee on the event. Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more https://support.google.com/calendar/answer/37135#forwarding

1 month, 3 weeks

1
0
0 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

TF-A