From ccd5e266d24d72d22a3c009791e40fd1ced0af98 Mon Sep 17 00:00:00 2001 From: Etienne Carriere Date: Fri, 18 Nov 2022 17:07:56 +0100 Subject: [PATCH 1/3] optee ftpm: CFG_TA_FTPM_RPMB_STORAGE selects RPMB storage Adds configuration switch CFG_TA_FTPM_RPMB_STORAGE that, when enable, makes fTPM OP-TEE TA to explicitly use the eMMC RPMB secure storage of OP-TEE instead of OP-TEE private storage which depends on OP-TEE configuration. The configuration switch is default disabled for compatibility reasons. Signed-off-by: Etienne Carriere --- .../ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c | 12 +++++++++--- Samples/ARM32-FirmwareTPM/optee_ta/fTPM/sub.mk | 3 +++ 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c b/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c index 908806bf..ae3bc985 100644 --- a/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c +++ b/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c @@ -49,6 +49,12 @@ #include #include +#ifdef CFG_TA_FTPM_RPMB_STORAGE +#define CHOOSEN_TEE_STORAGE TEE_STORAGE_PRIVATE_RPMB +#else +#define CHOOSEN_TEE_STORAGE TEE_STORAGE_PRIVATE +#endif + // // Overall size of NV, not just the TPM's NV storage // @@ -157,7 +163,7 @@ _plat__NvInitFromStorage() objID = s_StorageObjectID + i; // Attempt to open TEE persistent storage object. - Result = TEE_OpenPersistentObject(TEE_STORAGE_PRIVATE, + Result = TEE_OpenPersistentObject(CHOOSEN_TEE_STORAGE, (void *)&objID, sizeof(objID), TA_STORAGE_FLAGS, @@ -175,7 +181,7 @@ _plat__NvInitFromStorage() } // Storage object was not found, create it. - Result = TEE_CreatePersistentObject(TEE_STORAGE_PRIVATE, + Result = TEE_CreatePersistentObject(CHOOSEN_TEE_STORAGE, (void *)&objID, sizeof(objID), TA_STORAGE_FLAGS, @@ -313,7 +319,7 @@ _plat__NvWriteBack() // Force storage stack to update its backing store TEE_CloseObject(s_NVStore[i]); - Result = TEE_OpenPersistentObject(TEE_STORAGE_PRIVATE, + Result = TEE_OpenPersistentObject(CHOOSEN_TEE_STORAGE, (void *)&objID, sizeof(objID), TA_STORAGE_FLAGS, diff --git a/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/sub.mk b/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/sub.mk index 2d9ba241..83fe167c 100644 --- a/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/sub.mk +++ b/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/sub.mk @@ -4,6 +4,7 @@ CFG_TA_MEASURED_BOOT ?= n CFG_TA_DEBUG ?= n CFG_TEE_TA_LOG_LEVEL ?= 0 CFG_TA_EVENT_LOG_SIZE ?= 1024 +CFG_TA_FTPM_RPMB_STORAGE ?= n cflags-y += -DTHIRTY_TWO_BIT \ -DCFG_TEE_TA_LOG_LEVEL=$(CFG_TEE_TA_LOG_LEVEL) \ @@ -14,6 +15,8 @@ cflags-y += -DTHIRTY_TWO_BIT \ -fstack-protector \ -Wstack-protector +cflags-$(CFG_TA_FTPM_RPMB_STORAGE) += -DCFG_TA_FTPM_RPMB_STORAGE + ifeq ($(CFG_TA_MEASURED_BOOT),y) cflags-y += -DEVENT_LOG_SIZE=$(CFG_TA_EVENT_LOG_SIZE) cflags-y += -DMEASURED_BOOT From 916362fba0f2b97240d5b5d047b986fff723df89 Mon Sep 17 00:00:00 2001 From: Etienne Carriere Date: Sun, 20 Nov 2022 14:52:06 +0100 Subject: [PATCH 2/3] optee ftpm: add block braces in event log debug instructions Adds braces around instruction block related to fTPMDebug unless what the local variables are defined after other instructions and may make compilation toolchain to warn. Signed-off-by: Etienne Carriere --- .../ARM32-FirmwareTPM/optee_ta/fTPM/platform/fTPM_event_log.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/fTPM_event_log.c b/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/fTPM_event_log.c index 27f52b42..c25209a7 100644 --- a/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/fTPM_event_log.c +++ b/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/fTPM_event_log.c @@ -333,6 +333,7 @@ static unsigned int process_event(unsigned int buf_index, &resplen, &response); #ifdef fTPMDebug + { uint16_t ret_tag; uint32_t resp_size; uint32_t tpm_rc; @@ -345,6 +346,7 @@ static unsigned int process_event(unsigned int buf_index, MSG("TPM2_PCR_EXTEND_COMMAND returned value:\n"); MSG("\tret_tag = 0x%.4x, size = 0x%.8x, rc = 0x%.8x\n", SwapBytes16(ret_tag), SwapBytes32(resp_size), SwapBytes32(tpm_rc)); + } #endif free(response); From 1b288ebbb408b6abc893bd2b09f373c40e8baef2 Mon Sep 17 00:00:00 2001 From: Etienne Carriere Date: Sun, 20 Nov 2022 14:57:17 +0100 Subject: [PATCH 3/3] optee_ta: close persistent object once synced Changes NVMem.c WriteBack operation to open/close the TEE object related to the 512byte block only when there are accessed in storage. NVMem initialization function now closes the TEE object handles once read or created with initialization data. This change is useful on devices where OP-TEE run with a small secure memory (few hundreds of kByte). OP-TEE core, as per release tag 3.19.0, consumes about 500 bytes per object opened by a TA. Keeping the 32 objects of fTPM TA always open puts a high 20kB pressure on OP-TEE core heap for these devices. Signed-off-by: Etienne Carriere --- .../optee_ta/fTPM/platform/NVMem.c | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c b/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c index ae3bc985..1b9d1074 100644 --- a/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c +++ b/Samples/ARM32-FirmwareTPM/optee_ta/fTPM/platform/NVMem.c @@ -232,6 +232,10 @@ _plat__NvInitFromStorage() i, bytesRead, objID, s_NVStore[i]); #endif } + + /* Close object now, it will be opened back upon update */ + TEE_CloseObject(s_NVStore[i]); + s_NVStore[i] = TEE_HANDLE_NULL; } // Storage objects are open and valid, next validate revision @@ -302,13 +306,22 @@ _plat__NvWriteBack() // Form storage object ID for this block. objID = s_StorageObjectID + i; - // Move data position associated with handle to start of block. + // Open TEE persistent storage object: shall not fail + Result = TEE_OpenPersistentObject(CHOOSEN_TEE_STORAGE, + (void *)&objID, sizeof(objID), + TA_STORAGE_FLAGS, + &s_NVStore[i]); + if (Result != TEE_SUCCESS) { + goto Error; + } + + // Move data position associated with handle to start of block. Result = TEE_SeekObjectData(s_NVStore[i], 0, TEE_DATA_SEEK_SET); if (Result != TEE_SUCCESS) { goto Error; } - // Write out this block. + // Write out this block. Result = TEE_WriteObjectData(s_NVStore[i], (void *)&(s_NV[i * NV_BLOCK_SIZE]), NV_BLOCK_SIZE); @@ -316,18 +329,10 @@ _plat__NvWriteBack() goto Error; } - // Force storage stack to update its backing store + + // Close file to not waste secure resource in the dear TEE TEE_CloseObject(s_NVStore[i]); - - Result = TEE_OpenPersistentObject(CHOOSEN_TEE_STORAGE, - (void *)&objID, - sizeof(objID), - TA_STORAGE_FLAGS, - &s_NVStore[i]); - // Success? - if (Result != TEE_SUCCESS) { - goto Error; - } + s_NVStore[i] = TEE_HANDLE_NULL; // Clear dirty bit. s_blockMap &= ~(0x1ULL << i);