OP-TEE: Add option for PKCS11 TA (CFG_PKCS11_TA_LOCK_PIN_AFTER_FAILED_LOGIN_ATTEMPTS)

[TanelDettenborn]

Introducing a build time option for OP-TEE's PKCS11 TA: lockPinAfterFailedLoginAttempts. If lockPinAfterFailedLoginAttempts is set to true then PKCS11 TA is build with CFG_PKCS11_TA_LOCK_PIN_AFTER_FAILED_LOGIN_ATTEMPTS=y and respectively CFG_PKCS11_TA_LOCK_PIN_AFTER_FAILED_LOGIN_ATTEMPTS=n if option is set to false.

Default value is false.

Note: This is a custom feature. It is not part of the OP-TEE's upstream, but I have opened a pull request towards OP-TEE repository. I will updated this pull request if my OP-TEE's pull request receives any comments.

Description of changes

Checklist for things done

• Summary of the proposed changes in the PR description
• More detailed description in the commit message(s)
• Commits are squashed into relevant entities - avoid a lot of minimal dev time commits in the PR
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• PR linked to architecture documentation and requirement(s) (ticket id)
• Test procedure described (or includes tests). Select one or more:
  • Tested on Lenovo X1 x86_64
  • Tested on Jetson Orin NX or AGX aarch64
  • Tested on Polarfire riscv64
• Author has run make-checks and it passes
• All automatic Github Action checks pass - see actions
• Author has added reviewers and removed PR draft status
• Change requires full re-installation
• Change can be updated with nixos-rebuild ... switch
  Note: Need to remove /data/tee-directory

Instructions for Testing

• List all targets that this applies to: Jetson Orin NX or AGX
• Is this a new feature
  • List the test steps to verify:
    A complete testing requires two sequence limited and unlimited logins.
    Common for both cases are initilization:
    alias p11="pkcs11-tool-optee --slot-index 0 --label test"
p11 --init-token --so-pin 1111
p11 --init-pin --login --so-pin 1111 --new-pin 2222

Limited login attempts
Compile PKCS11 TA with lockPinAfterFailedLoginAttempts = false
!! remove secure storage rm -rf /data/tee !!
p11 --login --pin 1232 --list-object
p11 --init-pin --login --so-pin 1234 --new-pin 2222
--> Both returns CKR_PIN_INCORRECT
p11 --login --pin 2222 --list-object
p11 --init-pin --login --so-pin 1111 --new-pin 2222
--> Both are able to login (operation success)
7x: p11 --login --pin 1232 --list-object
7x: p11 --init-pin --login --so-pin 1234 --new-pin 2222
--> Both PINs are locked: CKR_PIN_LOCKED
p11 --login --pin 2222 --list-object
p11 --init-pin --login --so-pin 1111 --new-pin 2222
--> Both returns CKR_PIN_LOCKED

Unlimited login attempts
Compile PKCS11 TA with lockPinAfterFailedLoginAttempts = true
!! remove secure storage rm -rf /data/tee !!
p11 --login --pin 1232 --list-object
p11 --init-pin --login --so-pin 1234 --new-pin 2222
--> Both returns CKR_PIN_INCORRECT
p11 --login --pin 2222 --list-object
p11 --init-pin --login --so-pin 1111 --new-pin 2222
--> Both are able to login (operation success)
7x: p11 --login --pin 1232 --list-object
7x: p11 --init-pin --login --so-pin 1234 --new-pin 2222
--> Both returns CKR_PIN_INCORRECT
p11 --login --pin 2222 --list-object
p11 --init-pin --login --so-pin 1111 --new-pin 2222
--> Both are able to login (operation success)

• If it is an improvement how does it impact existing functionality?
  Adds feature into PKCS11 TA and convenience option for fine tuning it.

[johannarautanen]

Command functionality works:
Limited login attempts-version; after 7 tries PIN was locked.
Unlimited login attempts-version; PIN wasn’t locked after 7 or more tries.

Comfirm from Tanel, that the successfully-note is that: "Using slot with index 0 (0x0)"
p11 --login --pin 2222 --list-object
p11 --init-pin --login --so-pin 1111 --new-pin 2222
--> Both are able to login (operation success)

And other thing confirmed: after PIN is locked, need to give the "rm -rf /data/tee" and also reboot the GHAF to be able to try the cases again.

Tried with:
NVIDIA Jetson AGX Orin native, booted Orin AGX from eMMC
Check with commit: d58ebb1
Limited login attempts-version

•  commands works: PIN was locked finally
• automation cases: ok
• launching app: ok

NVIDIA Jetson AGX Orin native, booted Orin AGX from eMMC
build in own machine to get the
Unlimited login attempts-version
• commands work: didn’t lock the PIN
• automation cases: ok
• launching app: ok

NVIDIA Jetson AGX Orin cross compile, booted Orin AGX from eMMC
Check with commit: d58ebb1
Limited login attempts-version

•  commands works: PIN was locked finally
• automation cases: ok
  launching app: ok

NVIDIA Jetson AGX Orin cross compile, booted Orin AGX from eMMC
build in own machine to the get the
Unlimited login attempts-version
• commands work: didn’t lock the PIN
• launching app: ok

NVIDIA Jetson NX Orin native, booted Orin NX from memory stick
Check with commit: d58ebb1
Limited login attempts-version

•  commands works: PIN was locked finally
• launching app: ok

NVIDIA Jetson NX Orin native, booted Orin NX from eMMC
build in own machine to the get the
Unlimited login attempts-version
• commands work: didn’t lock the PIN
• launching app: ok

NVIDIA Jetson NX Orin cross compile, booted Orin NX from memory stick
Check with commit: d58ebb1
Limited login attempts-version
• commands works: PIN was locked finally
launching app: ok

NVIDIA Jetson NX Orin cross compile, booted Orin NX from memory stick
build in own machine to the get the
Unlimited login attempts-version
• commands work: didn’t lock the PIN
• launching app: ok
/