- OP-TEE - lists.trustedfirmware.org

Current design of tee-supplicant can't support ftpm requests during kernel space bootup

by Judy Wang

Hi Jens, As we are developing platforms to enable RPMB secure storage + fTPM TA, we realize that the current design of optee-os relying on a user space daemon tee-supplicant to serve requests cannot meet requirements of another open source linux kernel, IMA(Integrity Measurement Architecture). This module will try to collect data from TPM devices, which in our case, is fTPM TA. It has to collect data when kernel space is booting up, so we cannot delay these requests further until user space is up. With RPMB as our secure storage, some requests will be sent back to kernel space, but tee-supplicant context is not yet initialized, which results in IMA detection of TPM devices failed. Therefore, failed on the measurements we need. I am wondering if we have related discussion on how modify the design to serve optee-os requests during kernel bootup. I can't find related topics in LKML archive. Thank you. Judy. Cat from /Documentation/ABI/testing/sysfs-bus-optee-devices What: /sys/bus/tee/devices/optee-ta-<uuid>/ Date: May 2020 KernelVersion 5.8 Contact: op-tee(a)lists.trustedfirmware.org<mailto:op-tee@lists.trustedfirmware.org> Description: OP-TEE bus provides reference to registered drivers under this directory. The <uuid> matches Trusted Application (TA) driver and corresponding TA in secure OS. Drivers are free to create needed API under optee-ta-<uuid> directory. Reference: fTPM TA: microsoft/MSRSec: Security and Privacy Research at Microsoft (github.com)<https://github.com/microsoft/MSRSec> IMA enabling: https://sourceforge.net/p/linux-ima/wiki/Home/#enabling-ima-measurement:~:t…

4 years

4
9
0 0

Issue related to mempool allocation

by ramakanth varala

Hi All, I want to generate a rsa key pair with 4096 bits. Using below mbedTLS api , inside my TEE server side implementation. ret = mbedtls_rsa_gen_key( mbedtls_pk_rsa( key ), mbedtls_ctr_drbg_random, &ctr_drbg, 4096, 65537 ); This is resulting in the below error. mempool_alloc:197Failed to allocate 288 bytes, please tune the pool size failed Mines is arm64 infrastructure, with kernel 4.19.183 and optee_os 3.7.0 We tried doing below change (courtesy: https://github.com/OP-TEE/optee_os/issues/3328) and recompiling tomcrypt library In core/lib/libtomcrypt/mpi_desc.c, we changed MPI_MEMPOOL_SIZE #define MPI_MEMPOOL_SIZE (42 * 1024) to #define MPI_MEMPOOL_SIZE (82 * 1024) This didn’t help, kindly provide your inputs. Thanks

4 years

2
2
0 0

OP-TEE BTI support

by Olivier Deprez

Hi, (in context of testing BTI support when OP-TEE is loaded as a secure partition on top of SEL2/Hafnium) I read through the OP-TEE documentation, and would like to confirm: CFG_CORE_BTI=y seems mandatorily required to support BTI in TAs. It means we cannot enable independently BTI for TAs and 'disable' for TEE core, is this correct? Interestingly I noticed I can build with CFG_CORE_BTI=n and CTG_TA_BTI=y but I appreciate the end result is that the TA get BTI landpads but is not effectively leveraging the arch extension because code page aren't guarde if TEE core option isn't enabled. I was investigating a way to omit building a specific toolchain as it appears to be required when CFG_CORE_BTI=y, but I'll go ahead if there's no way round. Out of curiosity is OP-TEE core pulling gcc libraries? And if yes, which kind? I naively thought OP-TEE core would be freestanding or be independent from toolchain libs. Thanks & Regards, Olivier.

4 years

2
3
0 0

Linaro OP-TEE Contributions (LOC) monthly meeting - July 28 CANCELLED

by Jens Wiklander

Hi, We don't have any topics for the meeting this month. Hence canceling. Regards, Jens on behalf of OP-TEE team

4 years

1
0
0 0

OP-TEE 3.18 SPMC status

by Balint Dobszay

Hi All, This is a follow-up email to the OP-TEE 3.18 release, highlighting the updates to the SPMC and related components. Short summary of introduced changes: - optee_os: Added support to the SPMC to process memory regions described in the SP manifest. This enables running the Trusted Services smm-gateway SP. - manifest: Added new manifest (derived from the fvp manifest) which includes Trusted Services and related kernel modules [1]. - build: Added new top level Makefile to configure optee_os as S-EL1 SPMC, build Trusted Services SPs and test apps [2]. For more details on how to get, build and test the SPMC, please see [3]. Regards, Balint [1]: https://github.com/OP-TEE/manifest/blob/3.18.0/fvp-ts.xml [2]: https://github.com/OP-TEE/build/blob/3.18.0/fvp-psa-sp.mk [3]: https://developer.trustedfirmware.org/w/trusted-services/op-tee-spmc

4 years

1
0
0 0

OP-TEE 3.18.0 has been released

by Jens Wiklander

Hi, I'm pleased to announce that OP-TEE version 3.18.0 is now available. The list of changes can be found in the changelog [1]. A big thank you to everyone who participated with contributions and helping out with testing the release [2]. [1] https://github.com/OP-TEE/optee_os/blob/master/CHANGELOG.md [2] https://github.com/OP-TEE/optee_os/commit/1ee647035939e073a2e8dddb727c0f019… Regards, Jens

4 years

1
0
0 0

[PATCH] optee: smc_abi.c: fix wrong pointer passed to IS_ERR/PTR_ERR()

by Yang Yingliang

It should be 'rpc_arg' pass to IS_ERR/PTR_ERR(). Fixes: ed8faf6c8f8c ("optee: add OPTEE_SMC_CALL_WITH_RPC_ARG and OPTEE_SMC_CALL_WITH_REGD_ARG") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tee/optee/smc_abi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/tee/optee/smc_abi.c b/drivers/tee/optee/smc_abi.c index 385cb0aee610..a1c1fa1a9c28 100644 --- a/drivers/tee/optee/smc_abi.c +++ b/drivers/tee/optee/smc_abi.c @@ -884,8 +884,8 @@ static int optee_smc_do_call_with_arg(struct tee_context *ctx, rpc_arg_offs = OPTEE_MSG_GET_ARG_SIZE(arg->num_params); rpc_arg = tee_shm_get_va(shm, offs + rpc_arg_offs); - if (IS_ERR(arg)) - return PTR_ERR(arg); + if (IS_ERR(rpc_arg)) + return PTR_ERR(rpc_arg); } if (rpc_arg && tee_shm_is_dynamic(shm)) { -- 2.25.1

4 years, 1 month

2
1
0 0

[PATCH] optee: Remove duplicate 'of' in two places.

by Jiang Jian

file: ./drivers/tee/optee/optee_smc.h line: 192 * a2 Size of of SHM chanegd to * a2 Size of SHM Signed-off-by: Jiang Jian <jiangjian(a)cdjrlc.com> --- drivers/tee/optee/optee_smc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tee/optee/optee_smc.h b/drivers/tee/optee/optee_smc.h index c60896cf71cb..73b5e7760d10 100644 --- a/drivers/tee/optee/optee_smc.h +++ b/drivers/tee/optee/optee_smc.h @@ -189,7 +189,7 @@ struct optee_smc_call_get_os_revision_result { * Have config return register usage: * a0 OPTEE_SMC_RETURN_OK * a1 Physical address of start of SHM - * a2 Size of of SHM + * a2 Size of SHM * a3 Cache settings of memory, as defined by the * OPTEE_SMC_SHM_* values above * a4-7 Preserved -- 2.17.1

4 years, 1 month

2
1
0 0

[PATCH] tee: tee_get_drvdata(): fix description of return value

by Marc Kleine-Budde

This patch fixes the description of tee_get_drvdata()'s return value. It actually returns the driver_data pointer supplied to tee_device_alloc() since the TEE subsystem was added to the kernel. Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem") Cc: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> --- drivers/tee/tee_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 8aa1a4836b92..cebe4963ad87 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -1075,7 +1075,7 @@ EXPORT_SYMBOL_GPL(tee_device_unregister); /** * tee_get_drvdata() - Return driver_data pointer * @teedev: Device containing the driver_data pointer - * @returns the driver_data pointer supplied to tee_register(). + * @returns the driver_data pointer supplied to tee_device_alloc(). */ void *tee_get_drvdata(struct tee_device *teedev) { -- 2.35.1

4 years, 1 month

2
1
0 0

[GIT PULL] TEE Fixes for v5.19

by Jens Wiklander

Hello arm-soc maintainers, Please pull these small fixes in the TEE subssytem. The OP-TEE driver patch fixes an error which was introduced during the merge window. I'm not sure if the error really can be triggered, but it would be nice to have it fixed before the release. Thanks, Jens The following changes since commit b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3: Linux 5.19-rc2 (2022-06-12 16:11:37 -0700) are available in the Git repository at: https://git.linaro.org/people/jens.wiklander/linux-tee.git/ tags/tee-fixes-for-v5.19 for you to fetch changes up to e5ce073c8a1e01b215a5eb32ba48f8d17ded3bd5: tee: tee_get_drvdata(): fix description of return value (2022-07-08 10:51:24 +0200) ---------------------------------------------------------------- Fixes for TEE subsystem A fix for the recently merged commit ed8faf6c8f8c ("optee: add OPTEE_SMC_CALL_WITH_RPC_ARG and OPTEE_SMC_CALL_WITH_REGD_ARG"). Two small fixes in comment, repeated words etc. ---------------------------------------------------------------- Jiang Jian (1): optee: Remove duplicate 'of' in two places. Marc Kleine-Budde (1): tee: tee_get_drvdata(): fix description of return value Yang Yingliang (1): optee: smc_abi.c: fix wrong pointer passed to IS_ERR/PTR_ERR() drivers/tee/optee/optee_smc.h | 2 +- drivers/tee/optee/smc_abi.c | 4 ++-- drivers/tee/tee_core.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)

4 years, 1 month

1
0
0 0

2026

2025

2024

2023

2022

2021

2020

OP-TEE