fix(nxp-crypto): restricts generating nxp_mkvb via ns-world
Master-key-verification-blob (MKVB) value generated on request from
the secure world, is same to the MKVB value generated on request from
Normal world. Leading to the leak og MKVB to non-secure world.
Fix to prevent MKVB generation for requests originating from non-secure
world.
- For non-secure world, this SMC is return failure.
Additional fix for bound-check before continuing to generate the MKVB.
Change-Id: I9940b4dfe33289c2d57595a2a08acff29a12c974
Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
diff --git a/plat/nxp/common/sip_svc/sip_svc.c b/plat/nxp/common/sip_svc/sip_svc.c
index 1c8668e..4eec0ac 100644
--- a/plat/nxp/common/sip_svc/sip_svc.c
+++ b/plat/nxp/common/sip_svc/sip_svc.c
@@ -100,7 +100,7 @@
}
/* break is not required as SMC_RETx return */
case SIP_SVC_HUK:
- if (is_sec_enabled() == false) {
+ if (ns != 0 || is_sec_enabled() == false) {
NOTICE("SEC is disabled.\n");
SMC_RET1(handle, SMC_UNK);
}