June 2023 - OP-TEE - lists.trustedfirmware.org

[PATCH v6 0/4] introduce tee-based EFI Runtime Variable Service

by Masahisa Kojima

This series introduces the tee based EFI Runtime Variable Service. The eMMC device is typically owned by the non-secure world(linux in this case). There is an existing solution utilizing eMMC RPMB partition for EFI Variables, it is implemented by interacting with OP-TEE, StandaloneMM(as EFI Variable Service Pseudo TA), eMMC driver and tee-supplicant. The last piece is the tee-based variable access driver to interact with OP-TEE and StandaloneMM. Changelog: v5 -> v6 - new patch #4 is added in this series, #1-#3 patches are unchanged. automatically update super block flag when the efivarops support SetVariable runtime service, so that user does not need to manually remount the efivarfs as RW. v4 -> v5 - rebase to efi-next based on v6.4-rc1 - set generic_ops.query_variable_info, it works as expected as follows. $ df -h /sys/firmware/efi/efivars/ Filesystem Size Used Avail Use% Mounted on efivarfs 16K 1.3K 15K 8% /sys/firmware/efi/efivars v3 -> v4: - replace the reference from EDK2 to PI Specification - remove EDK2 source code reference comments - prepare nonblocking variant of set_variable, it just returns EFI_UNSUPPORTED - remove redundant buffer size check - argument name change in mm_communicate - function interface changes in setup_mm_hdr to remove (void **) cast v2 -> v3: - add CONFIG_EFI dependency to TEE_STMM_EFI - add missing return code check for tee_client_invoke_func() - directly call efivars_register/unregister from tee_stmm_efi.c rfc v1 -> v2: - split patch into three patches, one for drivers/tee, one for include/linux/efi.h, and one for the driver/firmware/efi/stmm - context/session management into probe() and remove() same as other tee client driver - StMM variable driver is moved from driver/tee/optee to driver/firmware/efi - use "tee" prefix instead of "optee" in driver/firmware/efi/stmm/tee_stmm_efi.c, this file does not contain op-tee specific code, abstracted by tee layer and StMM variable driver will work on other tee implementation. - PTA_STMM_CMD_COMMUNICATE -> PTA_STMM_CMD_COMMUNICATE - implement query_variable_store() but currently not used - no use of TEEC_SUCCESS, it is defined in driver/tee/optee/optee_private.h. Other tee client drivers use 0 instead of using TEEC_SUCCESS - remove TEEC_ERROR_EXCESS_DATA status, it is referred just to output error message Masahisa Kojima (4): efi: expose efivar generic ops register function efi: Add EFI_ACCESS_DENIED status code efi: Add tee-based EFI variable driver efivarfs: automatically update super block flag drivers/firmware/efi/Kconfig | 15 + drivers/firmware/efi/Makefile | 1 + drivers/firmware/efi/efi.c | 18 + drivers/firmware/efi/stmm/mm_communication.h | 236 +++++++ drivers/firmware/efi/stmm/tee_stmm_efi.c | 638 +++++++++++++++++++ drivers/firmware/efi/vars.c | 8 + fs/efivarfs/super.c | 33 + include/linux/efi.h | 12 + 8 files changed, 961 insertions(+) create mode 100644 drivers/firmware/efi/stmm/mm_communication.h create mode 100644 drivers/firmware/efi/stmm/tee_stmm_efi.c base-commit: d0a1865cf7e2211d9227592ef4141f4632e33908 -- 2.30.2

8 months, 3 weeks

3
16
0 0

Preparing for OP-TEE 3.22.0

by Joakim Bech

[BCC all OP-TEE maintainers] Hi OP-TEE maintainers & contributors, OP-TEE v3.22.0 is scheduled to be released at 2023-07-07 (*). So, now is a good time to start testing the master branch on the various platforms and report/fix any bugs. The GitHub pull request for collecting Tested-by tags or any other comments is https://github.com/OP-TEE/optee_os/pull/6125. As usual, we will create a release candidate tag one week before the release date for final testing. In addition to that you can find some additional information related to releases here: https://optee.readthedocs.io/en/latest/general/releases.html Regards, Joakim Bech (*) We moved this from July 14th to July 7th due to vacation and holiday schedules.

9 months, 3 weeks

1
1
0 0

optee_benchmark found optee_os function vm_set_ctx() spent much time

by haiyuan.ghy＠alibaba-inc.com

The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list.

9 months, 3 weeks

3
8
0 0

core: fix fragmented memory retrieve

by 梅建强(禹夜)

Hi, Jens, Sorry for forgetting to revise the PR in time, because my github email changed so I haven't received any comments. Could you help me reopen the PR since I don't have the right? I will re-fix the problem as requested. Thanks. https://github.com/OP-TEE/optee_os/pull/5966 <https://github.com/OP-TEE/optee_os/pull/5966 > Regards, Yuye.

9 months, 3 weeks

2
1
0 0

[RFC PATCH 1/1] tests/avocado: Introduce avocado tests for aarch64 S-EL2 booting

by shiju.jose＠huawei.com

From: Shiju Jose <shiju.jose(a)huawei.com> Add avocado tests for aarch64 S-EL2, include booting and run xtest on linux terminal. The prebuilt S-EL2 images are corresponding to the https://github.com/jenswi-linaro/manifest.git \ -m qemu_v8.xml -b qemu_sel2 How to run ========== "make check-avocado" in qemu/build or with QEMU_CI=1 and QEMU_CI_AVOCADO_TESTING=1 "amd64-fedora-container", "build-cfi-aarch64" and "avocado-cfi-aarch64" on gitlab for qemu Question: Presently tested with the prebuilt images temporarily in /tests/data/sel2-boot-images/prebuilt-sel2-images.zip Can the prebuilt images for SEL2 available in the OP-TEE/TF-A/similar release? Note1: The pre-built S-EL2 images used are few months old as there are some issue found in xtest with the images build from the recent Linaro SEL2 code. Note2: On gitlab CI, there is an outstanding issue found in booting linux, after starting network OK. Signed-off-by: Shiju Jose <shiju.jose(a)huawei.com> --- tests/avocado/machine_aarch64_virt.py | 63 ++++++++++++++++++ .../sel2-boot-images/prebuilt-sel2-images.zip | Bin 0 -> 23151996 bytes 2 files changed, 63 insertions(+) create mode 100644 tests/data/sel2-boot-images/prebuilt-sel2-images.zip diff --git a/tests/avocado/machine_aarch64_virt.py b/tests/avocado/machine_aarch64_virt.py index a90dc6ff4b..039673fd40 100644 --- a/tests/avocado/machine_aarch64_virt.py +++ b/tests/avocado/machine_aarch64_virt.py @@ -11,13 +11,16 @@ import time import os import logging +import shutil from avocado_qemu import QemuSystemTest from avocado_qemu import wait_for_console_pattern from avocado_qemu import exec_command from avocado_qemu import BUILD_DIR +from avocado_qemu import is_readable_executable_file from avocado.utils import process from avocado.utils.path import find_command +from avocado.utils import archive class Aarch64VirtMachine(QemuSystemTest): KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 ' @@ -144,3 +147,63 @@ def test_aarch64_virt_gicv2(self): :avocado: tags=cpu:max """ self.common_aarch64_virt("virt,gic-version=2") + + def copy_sel2_prebuilt_images(self): + """extract the prebuilt S-EL2 binaries to the test directory. """ + + relative_path = "./tests/data/sel2-boot-images/prebuilt-sel2-images.zip" + prebuilt_bin_path = os.path.join(BUILD_DIR, relative_path) + target_dir = os.path.join(BUILD_DIR) + + self.assertTrue(os.path.exists(prebuilt_bin_path)) + self.assertTrue(os.path.exists(target_dir)) + archive.extract(prebuilt_bin_path, target_dir) + + timeout = 1000 + def test_aarch64_sel2_boot(self): + """ + :avocado: tags=arch:aarch64 + :avocado: tags=machine:secure + :avocado: tags=machine:virt + :avocado: tags=cpu:max + """ + + self.copy_sel2_prebuilt_images() + self.vm.set_console() + kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE + + 'console=ttyAMA0,38400 keep_bootcon root=/dev/vda2 nokaslr') + + self.vm.add_args("-cpu", "max,sme=off,pauth-impdef=on") + self.vm.add_args("-machine", + "virt,secure=on," + "virtualization=on," + "mte=on," + "gic-version=3") + self.vm.add_args("-d", "unimp") + self.vm.add_args("-semihosting-config", "enable=on,target=native") + self.vm.add_args("-smp", "2", "-m", "1024") + self.vm.add_args('-bios', 'bl1.bin') + self.vm.add_args('-initrd', 'rootfs.cpio.gz') + self.vm.add_args('-kernel', 'Image') + self.vm.add_args('-machine', 'acpi=off') + self.vm.add_args('-append', kernel_command_line) + self.vm.add_args('-object', 'rng-random,filename=/dev/urandom,id=rng0') + self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0,max-bytes=1024,period=1000') + self.vm.launch() + self.wait_for_console_pattern('Welcome to Buildroot') + time.sleep(0.1) + exec_command(self, 'root') + time.sleep(0.1) + + def test_aarch64_sel2_xtest(self): + """ + :avocado: tags=arch:aarch64 + :avocado: tags=machine:secure + :avocado: tags=machine:virt + :avocado: tags=cpu:max + """ + self.test_aarch64_sel2_boot() + exec_command(self, 'xtest') + time.sleep(0.1) + self.wait_for_console_pattern('subtests of which 0 failed') + time.sleep(0.1) diff --git a/tests/data/sel2-boot-images/prebuilt-sel2-images.zip b/tests/data/sel2-boot-images/prebuilt-sel2-images.zip new file mode 100644 index 0000000000..13c5e1e4cc Binary files /dev/null and b/tests/data/sel2-boot-images/prebuilt-sel2-images.zip differ -- 2.25.1

9 months, 3 weeks

1
0
0 0

Linaro OP-TEE Contribution, LOC, monthly meeting June 27

by Jens Wiklander

Hi, On Tuesday, June 27 it's time for another LOC monthly meeting. For time and connection details see the calendar at https://www.trustedfirmware.org/meetings/ I'd like to discuss how MbedTLS is used in OP-TEE. While trying to update to MbedTLS 3.4 on the 4.x WIP branch [1] we have run into yet another issue with the CRT parameters used in the RSA implementation. See [2] for more details on the CRT problem. [1] https://github.com/jenswi-linaro/optee_os/tree/wip_4_0_0 [2] https://github.com/jenswi-linaro/optee_os/pull/9 any other topics? Thanks, Jens

10 months

1
0
0 0

PKCS11 TA: MR https://github.com/OP-TEE/optee_os/pull/5166

by dourlent cédric

Hi, I contact you about the merge request https://github.com/OP-TEE/optee_os/pull/5166 that is mandatory to be able to use ECC private key imported in PKCS11 TA and not generate by the TA. Currently the status is Attribute on generated ECC private key are - EC_PARAMS - VALUE - EC_POINT => This object can be use for crypto operation Attribute on imported ECC private key are - EC_PARAMS - VALUE => PKCS11 TA can not use it because TA expect EC_POINTS attributes on ECC Private key. Could you accept the merge request and have a coherence between generated and imported object even if for the moment it's doesn't respect PKCS11 standard ? Two options for the next step. - check with PKCS11 editors to upgrade the spec and have a same behavior between RSA Private object and ECC Private object. - rework the code of the TA for ECC to link Private and public object but that mean that ECC Private and Public object must be present in the same slot to be able to perform crypto operation. Best regards, Cédric Dourlent,

10 months

3
2
0 0

[GIT PULL] Use kmemdup() in OP-TEE driver for v6.5

by Jens Wiklander

Hello arm-soc maintainers, Please pull this small patch to the OP-TEE driver that replaces kmalloc() + memcpy() with kmemdup() at one place. Thanks, Jens The following changes since commit f1fcbaa18b28dec10281551dfe6ed3a3ed80e3d6: Linux 6.4-rc2 (2023-05-14 12:51:40 -0700) are available in the Git repository at: https://git.linaro.org/people/jens.wiklander/linux-tee.git tags/optee-use-kmemdup-for-6.5 for you to fetch changes up to 6a8b7e80105416cc7324fda295608ea2d3f98862: tee: optee: Use kmemdup() to replace kmalloc + memcpy (2023-06-15 08:49:55 +0200) ---------------------------------------------------------------- Use kmemdup() in OP-TEE driver ---------------------------------------------------------------- Jiapeng Chong (1): tee: optee: Use kmemdup() to replace kmalloc + memcpy drivers/tee/optee/smc_abi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)

10 months, 1 week

1
0
0 0

[PATCH v2] tee: optee: Use kmemdup() to replace kmalloc + memcpy

by Jiapeng Chong

Use kmemdup rather than duplicating its implementation. ./drivers/tee/optee/smc_abi.c:1542:12-19: WARNING opportunity for kmemdup. Reported-by: Abaci Robot <abaci(a)linux.alibaba.com> Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5480 Signed-off-by: Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com> --- Changes in v2: -Add one commit message. drivers/tee/optee/smc_abi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/tee/optee/smc_abi.c b/drivers/tee/optee/smc_abi.c index 3861ae06d902..d5b28fd35d66 100644 --- a/drivers/tee/optee/smc_abi.c +++ b/drivers/tee/optee/smc_abi.c @@ -1541,12 +1541,11 @@ static int optee_load_fw(struct platform_device *pdev, * This uses the GFP_DMA flag to ensure we are allocated memory in the * 32-bit space since TF-A cannot map memory beyond the 32-bit boundary. */ - data_buf = kmalloc(fw->size, GFP_KERNEL | GFP_DMA); + data_buf = kmemdup(fw->data, fw->size, GFP_KERNEL | GFP_DMA); if (!data_buf) { rc = -ENOMEM; goto fw_err; } - memcpy(data_buf, fw->data, fw->size); data_pa = virt_to_phys(data_buf); reg_pair_from_64(&data_pa_high, &data_pa_low, data_pa); reg_pair_from_64(&data_size_high, &data_size_low, data_size); -- 2.20.1.7.g153144c

10 months, 1 week

3
2
0 0

reference keymint & gatekeeper TAs

by Nagendra Modadugu

I'm writing to get further information regarding the support roadmap for OP-TEE based TA's - specifically keymint and gatekeeper. The implementations I could find are here: https://github.com/linaro-swg/kmgk, and was wondering whether these are supported? Please respond off list if you find that would be more appropriate for discussion. thanks.

10 months, 1 week

2
1
0 0

2024

2023

2022

2021

2020

OP-TEE June 2023