Add supports for generating identity signing key (IDK_S)

litebox_platform_lvbs/src/mshv/mod.rs

@@ -134,6 +134,9 @@ pub const VSM_VTL_CALL_FUNC_ID_SET_PLATFORM_ROOT_KEY: u32 = 0x1_ffed;
 // This VSM function ID for OP-TEE messages is subject to change
 pub const VSM_VTL_CALL_FUNC_ID_OPTEE_MESSAGE: u32 = 0x1_fff0;
 
+// This VSM function ID for generating the identity signing key is subject to change
+pub const VSM_VTL_CALL_FUNC_ID_GENERATE_IDENTITY_SIGNING_KEY: u32 = 0x1_fff1;
+
 /// VSM Functions
 #[derive(Debug, PartialEq, TryFromPrimitive)]
 #[repr(u32)]
@@ -154,6 +157,7 @@ pub enum VsmFunction {
     OpteeMessage = VSM_VTL_CALL_FUNC_ID_OPTEE_MESSAGE,
     AllocateRingbufferMemory = VSM_VTL_CALL_FUNC_ID_ALLOCATE_RINGBUFFER_MEMORY,
     SetPlatformRootKey = VSM_VTL_CALL_FUNC_ID_SET_PLATFORM_ROOT_KEY,
+    GenerateIdentitySigningKey = VSM_VTL_CALL_FUNC_ID_GENERATE_IDENTITY_SIGNING_KEY,
 }
 
 pub const MSR_EFER: u32 = 0xc000_0080;

litebox_platform_lvbs/src/mshv/vsm.rs

@@ -977,6 +977,9 @@ pub fn vsm_dispatch(func_id: VsmFunction, params: &[u64]) -> i64 {
             mshv_vsm_allocate_ringbuffer_memory(params[0], size)
         }
         VsmFunction::SetPlatformRootKey => mshv_vsm_set_platform_root_key(params[0]),
+        VsmFunction::GenerateIdentitySigningKey => {
+            Err(VsmError::OperationNotSupported("Identity key generation"))
+        }
         VsmFunction::OpteeMessage => Err(VsmError::OperationNotSupported("OP-TEE communication")),
     };
     match result {

litebox_runner_lvbs/src/lib.rs

@@ -257,6 +257,10 @@ fn vtlcall_dispatch(params: &[u64; NUM_VTLCALL_PARAMS]) -> i64 {
             let smc_args_pfn = params[1];
             optee_smc_handler_entry(smc_args_pfn)
         }
+        VsmFunction::GenerateIdentitySigningKey => {
+            let public_key_pa = params[1];
+            litebox_shim_optee::idk::generate_identity_signing_key(public_key_pa)
+        }
         _ => vsm_dispatch(func_id, &params[1..]),
     }
 }

litebox_shim_optee/Cargo.toml

@@ -22,6 +22,7 @@ spin = { version = "0.10.0", default-features = false, features = ["spin_mutex",
 thiserror = { version = "2.0.6", default-features = false }
 zerocopy = { version = "0.8", default-features = false, features = ["derive"] }
 zeroize = { version = "1.8", default-features = false, features = ["alloc"] }
+p384 = { version = "0.13.1", default-features = false, features = ["arithmetic", "ecdsa"] }
 
 [features]
 default = ["platform_lvbs"]