From 6e8bb1fb0ae81ff02e1057d47bcb08ca2d84d27b Mon Sep 17 00:00:00 2001 From: Igor Opaniuk Date: Thu, 4 Apr 2024 15:19:47 +0200 Subject: [PATCH 1/5] tee: optee: fix description in Kconfig Fix OPTEE_TA_AVB symbol description in Kconfig: s/"write"rb"/"write_rb"/g Reviewed-by: Heinrich Schuchardt Reviewed-by: Ilias Apalodimas Signed-off-by: Igor Opaniuk Signed-off-by: Ilias Apalodimas --- drivers/tee/optee/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig index 9dc65b0501e..db0bcfa6f15 100644 --- a/drivers/tee/optee/Kconfig +++ b/drivers/tee/optee/Kconfig @@ -19,7 +19,7 @@ config OPTEE_TA_AVB default y help Enables support for the AVB Trusted Application (TA) in OP-TEE. - The TA can support the "avb" subcommands "read_rb", "write"rb" + The TA can support the "avb" subcommands "read_rb", "write_rb" and "is_unlocked". config OPTEE_TA_RPC_TEST From fbdaafbb80506bc931d3940396cb86d257703de1 Mon Sep 17 00:00:00 2001 From: Igor Opaniuk Date: Thu, 4 Apr 2024 15:19:48 +0200 Subject: [PATCH 2/5] cmd: optee_rpmb: close tee session Close tee session after each optee_rpmb invocation, as there is no reason to keep it open, considering the absence of any available mechanism to clean up all open sessions automatically before handing over control to the Linux kernel. Without proper clean-up we might end up with orphaned sessions registered in OP-TEE OS core (obvious resource leak). Signed-off-by: Igor Opaniuk Signed-off-by: Ilias Apalodimas --- cmd/optee_rpmb.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/cmd/optee_rpmb.c b/cmd/optee_rpmb.c index e0e44bbed04..b3cafd92410 100644 --- a/cmd/optee_rpmb.c +++ b/cmd/optee_rpmb.c @@ -87,8 +87,10 @@ static int read_persistent_value(const char *name, rc = tee_shm_alloc(tee, name_size, TEE_SHM_ALLOC, &shm_name); - if (rc) - return -ENOMEM; + if (rc) { + rc = -ENOMEM; + goto close_session; + } rc = tee_shm_alloc(tee, buffer_size, TEE_SHM_ALLOC, &shm_buf); @@ -125,6 +127,9 @@ out: tee_shm_free(shm_buf); free_name: tee_shm_free(shm_name); +close_session: + tee_close_session(tee, session); + tee = NULL; return rc; } @@ -139,17 +144,20 @@ static int write_persistent_value(const char *name, struct tee_param param[2]; size_t name_size = strlen(name) + 1; + if (!value_size) + return -EINVAL; + if (!tee) { if (avb_ta_open_session()) return -ENODEV; } - if (!value_size) - return -EINVAL; rc = tee_shm_alloc(tee, name_size, TEE_SHM_ALLOC, &shm_name); - if (rc) - return -ENOMEM; + if (rc) { + rc = -ENOMEM; + goto close_session; + } rc = tee_shm_alloc(tee, value_size, TEE_SHM_ALLOC, &shm_buf); @@ -178,6 +186,9 @@ out: tee_shm_free(shm_buf); free_name: tee_shm_free(shm_name); +close_session: + tee_close_session(tee, session); + tee = NULL; return rc; } From dfac18e944f23bf64ce3638aa8d57f9e0c0e6c26 Mon Sep 17 00:00:00 2001 From: Igor Opaniuk Date: Thu, 4 Apr 2024 15:19:49 +0200 Subject: [PATCH 3/5] cmd: optee_rpmb: build cmd for sandbox Support CMD_OPTEE_RPMB for SANDBOX configurations. Test: $ ./u-boot -d arch/sandbox/dts/test.dtb ... => optee_rpmb write_pvalue test_variable test_value Wrote 11 bytes => optee_rpmb read_pvalue test_variable 11 Read 11 bytes, value = test_value Reviewed-by: Mattijs Korpershoek Tested-by: Mattijs Korpershoek Signed-off-by: Igor Opaniuk Signed-off-by: Ilias Apalodimas --- cmd/Kconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cmd/Kconfig b/cmd/Kconfig index 8eeb99eea5e..9dd90da1d9b 100644 --- a/cmd/Kconfig +++ b/cmd/Kconfig @@ -1348,7 +1348,9 @@ config CMD_CLONE config CMD_OPTEE_RPMB bool "Enable read/write support on RPMB via OPTEE" - depends on SUPPORT_EMMC_RPMB && OPTEE + depends on (SUPPORT_EMMC_RPMB && OPTEE) || SANDBOX_TEE + default y if SANDBOX_TEE + select OPTEE_TA_AVB if SANDBOX_TEE help Enable the commands for reading, writing persistent named values in the Replay Protection Memory Block partition in eMMC by From f5d14bea8faac0ded5f366b437801a229b165bb6 Mon Sep 17 00:00:00 2001 From: Igor Opaniuk Date: Thu, 4 Apr 2024 15:19:50 +0200 Subject: [PATCH 4/5] test: py: add optee_rpmb tests Add read/write tests for optee_rpmb cmd. Signed-off-by: Igor Opaniuk Signed-off-by: Ilias Apalodimas --- test/py/tests/test_optee_rpmb.py | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 test/py/tests/test_optee_rpmb.py diff --git a/test/py/tests/test_optee_rpmb.py b/test/py/tests/test_optee_rpmb.py new file mode 100644 index 00000000000..8a081b5c494 --- /dev/null +++ b/test/py/tests/test_optee_rpmb.py @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: GPL-2.0+ +# +# Tests for OP-TEE RPMB read/write support + +""" +This tests optee_rpmb cmd in U-Boot +""" + +import pytest +import u_boot_utils as util + +@pytest.mark.buildconfigspec('cmd_optee_rpmb') +def test_optee_rpmb_read_write(u_boot_console): + """Test OP-TEE RPMB cmd read/write + """ + response = u_boot_console.run_command('optee_rpmb write_pvalue test_variable test_value') + assert response == 'Wrote 11 bytes' + + response = u_boot_console.run_command('optee_rpmb read_pvalue test_variable 11') + assert response == 'Read 11 bytes, value = test_value' \ No newline at end of file From b905599b36e3d8158c5cd045c26278416909b422 Mon Sep 17 00:00:00 2001 From: Igor Opaniuk Date: Thu, 4 Apr 2024 15:19:51 +0200 Subject: [PATCH 5/5] tee: remove common.h inclusion The usage of the common.h include file is deprecated [1], and has already been removed from several files. Get rid of all inclusions in the "drivers/tee" directory, and replace it with required include files directly where needed. [1] doc/develop/codingstyle.rst Reviewed-by: Ilias Apalodimas Signed-off-by: Igor Opaniuk Reviewed-by: Sam Protsenko Signed-off-by: Ilias Apalodimas --- drivers/tee/broadcom/chimp_optee.c | 3 ++- drivers/tee/optee/core.c | 1 - drivers/tee/optee/i2c.c | 1 - drivers/tee/optee/rpmb.c | 1 - drivers/tee/optee/supplicant.c | 2 +- drivers/tee/sandbox.c | 2 +- drivers/tee/tee-uclass.c | 1 - 7 files changed, 4 insertions(+), 7 deletions(-) diff --git a/drivers/tee/broadcom/chimp_optee.c b/drivers/tee/broadcom/chimp_optee.c index 37f9b094f76..bd146ef2899 100644 --- a/drivers/tee/broadcom/chimp_optee.c +++ b/drivers/tee/broadcom/chimp_optee.c @@ -3,9 +3,10 @@ * Copyright 2020 Broadcom. */ -#include #include #include +#include +#include #ifdef CONFIG_CHIMP_OPTEE diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c index 47f845cffe3..5fc0505c788 100644 --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -3,7 +3,6 @@ * Copyright (c) 2018-2020 Linaro Limited */ -#include #include #include #include diff --git a/drivers/tee/optee/i2c.c b/drivers/tee/optee/i2c.c index ef4e10f9912..e3fb99897c5 100644 --- a/drivers/tee/optee/i2c.c +++ b/drivers/tee/optee/i2c.c @@ -3,7 +3,6 @@ * Copyright (c) 2020 Foundries.io Ltd */ -#include #include #include #include diff --git a/drivers/tee/optee/rpmb.c b/drivers/tee/optee/rpmb.c index 5bc13757ea8..bacced6af6c 100644 --- a/drivers/tee/optee/rpmb.c +++ b/drivers/tee/optee/rpmb.c @@ -3,7 +3,6 @@ * Copyright (c) 2018 Linaro Limited */ -#include #include #include #include diff --git a/drivers/tee/optee/supplicant.c b/drivers/tee/optee/supplicant.c index f9dd874b594..8a426f53ba8 100644 --- a/drivers/tee/optee/supplicant.c +++ b/drivers/tee/optee/supplicant.c @@ -3,10 +3,10 @@ * Copyright (c) 2018, Linaro Limited */ -#include #include #include #include +#include #include #include "optee_msg.h" diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c index ec66401878c..8ad7c09efdd 100644 --- a/drivers/tee/sandbox.c +++ b/drivers/tee/sandbox.c @@ -2,7 +2,7 @@ /* * Copyright (C) 2018 Linaro Limited */ -#include + #include #include #include diff --git a/drivers/tee/tee-uclass.c b/drivers/tee/tee-uclass.c index 52412a4098e..0194d732193 100644 --- a/drivers/tee/tee-uclass.c +++ b/drivers/tee/tee-uclass.c @@ -5,7 +5,6 @@ #define LOG_CATEGORY UCLASS_TEE -#include #include #include #include