| commit | 5a69d55d65966c098ee1acce56bcd660f0de917b | [log] [tgz] |
|---|---|---|
| author | Jerome Forissier <jerome.forissier@linaro.org> | Wed Mar 16 19:33:26 2022 +0100 |
| committer | Jérôme Forissier <jerome@forissier.org> | Wed Mar 30 09:32:26 2022 +0200 |
| tree | 7a4aee804e71c488bba3f791d21b23aecb81a00b | |
| parent | 88d374e56e611163de47dabe1bfc5c39ac5a107d [diff] |
tee-supplicant: add --rpmb-cid command line option In OP-TEE OS, the RPMB device used for secure storage is selected at compile time via an integer identifier (CFG_RPMB_FS_DEV_ID). As mentioned in [1], this ID is assigned by the Linux kernel and is used when tee-supplicant opens the device on behalf of OP-TEE. There are a couple of issues with that: 1. U-Boot and Linux may assign a different number to the same RPMB device. Therefore, the TEE supplicant components in U-Boot and Linux cannot both trust the ID given by OP-TEE. 2. If a system has several RPMB devices, and even if we ignore removable ones, there is no guarantee that the devices will always be enumerated in the same order by the kernel on boot. This results in different device numbers. I observed this behavior on a Hikey620 board with an external eMMC module plugged into the micro SD slot. Sometimes the on-board RPMB (which I don’t use for testing) is /dev/mmcblk0rpmb and the external one is /dev/mmcblk1rpmb; sometimes it is the other way around. In order to remove any ambiguity, introduce a new command line argument to tee-supplicant: --rpmb-cid <CID>. <CID> is the device identification register of the eMMC device that OP-TEE should use for RPMB. It is unique for every flash device. When --rpmb-cid is given, the device number given by OP-TEE is ignored and the specified device is used instead. <CID> can be found in sysfs, for example: # Read the CID of MMC device 0. Its RPMB partition is /dev/mmcblk0rpmb. $ cat /sys/class/mmc_host/mmc0/mmc0\:0001/cid 11010030303847453000e0a18ceb13df $ Link: https://github.com/OP-TEE/optee_os/blob/3.16.0/mk/config.mk#L159-L162 Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Acked-by: Jens Wiklander <jens.wiklander@linaro.org> Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
This git contains source code for the non-secure side implementation of the OP-TEE project making up the client library and tee-supplicant.
All official OP-TEE documentation has moved to http://optee.readthedocs.io. The information that used to be here in this git can be found under optee_client.
// OP-TEE core maintainers