Skip to content

Commit 8befe07

Browse files
tkaratapanistkaratapanis
committed
tee/optee_supplicant: Added optee supplicant
Support for extracting (from libteec), patching and compiling optee_client/tee-supplicant by NuttX apps. Defaults to version 4.6.0 (same as the current libteec). Enabled with: CONFIG_OPTEE_SUPPLICANT=y CONFIG_LIBTEEC=y And the following for the nuttx kernel: CONFIG_ALLOW_BSD_COMPONENTS=y CONFIG_FS_ANONMAP=y CONFIG_DEV_OPTEE_SMC=y CONFIG_DEV_OPTEE_SUPPLICANT=y The version of the supplicant needs to match the libteec version since the patch to be applied might fail otherwise. If the versions differ the build will be aborted. More info: - https://github.com/OP-TEE/optee_client - https://optee.readthedocs.io/en/latest/architecture/secure_storage.html Signed-off-by: Theodore Karatapanis <tkaratapanis@census-labs.com>
1 parent 6bca3c2 commit 8befe07

File tree

5 files changed

+591
-0
lines changed

5 files changed

+591
-0
lines changed

‎tee/optee_supplicant/0001-tee-supplicant-port-to-nuttx.patch

Lines changed: 316 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,316 @@
1+
From b31fe60eb64610f36c501ad7462f92dfe149fc19 Mon Sep 17 00:00:00 2001
2+
From: Theodore Karatapanis <tkaratapanis@census-labs.com>
3+
Date: Fri, 18 Jul 2025 17:10:36 +0300
4+
Subject: [PATCH] tee-supplicant: port to nuttx
5+
6+
Replace include of linux/tee.h with nuttx/tee.h
7+
Remove Daemon references
8+
Remove threads (if the supplicant is killed and it has spawned 2 threads
9+
it might crash the system).
10+
---
11+
tee-supplicant/src/rpmb.c | 6 +-
12+
tee-supplicant/src/tee_supp_fs.c | 2 +-
13+
tee-supplicant/src/tee_supplicant.c | 163 +---------------------------
14+
3 files changed, 6 insertions(+), 165 deletions(-)
15+
16+
diff --git a/tee-supplicant/src/rpmb.c b/tee-supplicant/src/rpmb.c
17+
index d5ea0ea..964a758 100644
18+
--- a/tee-supplicant/src/rpmb.c
19+
+++ b/tee-supplicant/src/rpmb.c
20+
@@ -27,8 +27,8 @@
21+
22+
#include <dirent.h>
23+
#include <fcntl.h>
24+
-#include <linux/types.h>
25+
-#include <linux/mmc/ioctl.h>
26+
+#include <sys/types.h>
27+
+#include <nuttx/mmcsd.h>
28+
#include <netinet/in.h>
29+
#include <pthread.h>
30+
#include <rpmb.h>
31+
@@ -776,7 +776,7 @@ static bool remap_rpmb_dev_id(uint16_t dev_id, uint16_t *ndev_id)
32+
#endif /* RPMB_EMU */
33+
34+
static inline void set_mmc_io_cmd(struct mmc_ioc_cmd *cmd, unsigned int blocks,
35+
- __u32 opcode, int write_flag)
36+
+ uint32_t opcode, int write_flag)
37+
{
38+
cmd->blksz = 512;
39+
cmd->blocks = blocks;
40+
diff --git a/tee-supplicant/src/tee_supp_fs.c b/tee-supplicant/src/tee_supp_fs.c
41+
index cc4120f..460e872 100644
42+
--- a/tee-supplicant/src/tee_supp_fs.c
43+
+++ b/tee-supplicant/src/tee_supp_fs.c
44+
@@ -45,7 +45,7 @@
45+
#ifndef __aligned
46+
#define __aligned(x) __attribute__((__aligned__(x)))
47+
#endif
48+
-#include <linux/tee.h>
49+
+#include <nuttx/tee.h>
50+
51+
#ifndef PATH_MAX
52+
#define PATH_MAX 255
53+
diff --git a/tee-supplicant/src/tee_supplicant.c b/tee-supplicant/src/tee_supplicant.c
54+
index b6add55..a2765b7 100644
55+
--- a/tee-supplicant/src/tee_supplicant.c
56+
+++ b/tee-supplicant/src/tee_supplicant.c
57+
@@ -61,7 +61,7 @@
58+
#ifndef __aligned
59+
#define __aligned(x) __attribute__((__aligned__(x)))
60+
#endif
61+
-#include <linux/tee.h>
62+
+#include <nuttx/tee.h>
63+
64+
#define RPC_NUM_PARAMS 5
65+
66+
@@ -111,34 +111,6 @@ struct tee_supplicant_params supplicant_params = {
67+
.fs_parent_path = TEE_FS_PARENT_PATH,
68+
};
69+
70+
-static void *thread_main(void *a);
71+
-
72+
-static size_t num_waiters_inc(struct thread_arg *arg)
73+
-{
74+
- size_t ret = 0;
75+
-
76+
- tee_supp_mutex_lock(&arg->mutex);
77+
- arg->num_waiters++;
78+
- assert(arg->num_waiters);
79+
- ret = arg->num_waiters;
80+
- tee_supp_mutex_unlock(&arg->mutex);
81+
-
82+
- return ret;
83+
-}
84+
-
85+
-static size_t num_waiters_dec(struct thread_arg *arg)
86+
-{
87+
- size_t ret = 0;
88+
-
89+
- tee_supp_mutex_lock(&arg->mutex);
90+
- assert(arg->num_waiters);
91+
- arg->num_waiters--;
92+
- ret = arg->num_waiters;
93+
- tee_supp_mutex_unlock(&arg->mutex);
94+
-
95+
- return ret;
96+
-}
97+
-
98+
static void *paged_aligned_alloc(size_t sz)
99+
{
100+
void *p = NULL;
101+
@@ -492,8 +464,6 @@ static int usage(int status)
102+
{
103+
fprintf(stderr, "Usage: tee-supplicant [options] [<device-name>]\n");
104+
fprintf(stderr, "\t-h, --help: this help\n");
105+
- fprintf(stderr, "\t-d, --daemonize: run as a daemon (fork and return "
106+
- "after child has opened the TEE device or on error)\n");
107+
fprintf(stderr, "\t-f, --fs-parent-path: secure fs parent path [%s]\n",
108+
supplicant_params.fs_parent_path);
109+
fprintf(stderr, "\t-l, --ta-path: TA load path\n");
110+
@@ -546,7 +516,7 @@ static bool write_response(int fd, union tee_rpc_invoke *request)
111+
data.buf_ptr = (uintptr_t)&request->send;
112+
data.buf_len = sizeof(struct tee_iocl_supp_send_arg) +
113+
sizeof(struct tee_ioctl_param) *
114+
- (__u64)request->send.num_params;
115+
+ (uint64_t)request->send.num_params;
116+
if (ioctl(fd, TEE_IOC_SUPPL_SEND, &data)) {
117+
EMSG("TEE_IOC_SUPPL_SEND: %s", strerror(errno));
118+
return false;
119+
@@ -584,35 +554,6 @@ static bool find_params(union tee_rpc_invoke *request, uint32_t *func,
120+
return true;
121+
}
122+
123+
-static bool spawn_thread(struct thread_arg *arg)
124+
-{
125+
- int e = 0;
126+
- pthread_t tid;
127+
-
128+
- memset(&tid, 0, sizeof(tid));
129+
-
130+
- DMSG("Spawning a new thread");
131+
-
132+
- /*
133+
- * Increase number of waiters now to avoid starting another thread
134+
- * before this thread has been scheduled.
135+
- */
136+
- num_waiters_inc(arg);
137+
-
138+
- e = pthread_create(&tid, NULL, thread_main, arg);
139+
- if (e) {
140+
- EMSG("pthread_create: %s", strerror(e));
141+
- num_waiters_dec(arg);
142+
- return false;
143+
- }
144+
-
145+
- e = pthread_detach(tid);
146+
- if (e)
147+
- EMSG("pthread_detach: %s", strerror(e));
148+
-
149+
- return true;
150+
-}
151+
-
152+
static bool process_one_request(struct thread_arg *arg)
153+
{
154+
size_t num_params = 0;
155+
@@ -631,17 +572,12 @@ static bool process_one_request(struct thread_arg *arg)
156+
params = (struct tee_ioctl_param *)(&request.send + 1);
157+
params->attr = TEE_IOCTL_PARAM_ATTR_META;
158+
159+
- num_waiters_inc(arg);
160+
-
161+
if (!read_request(arg->fd, &request))
162+
return false;
163+
164+
if (!find_params(&request, &func, &num_params, &params, &num_meta))
165+
return false;
166+
167+
- if (num_meta && !num_waiters_dec(arg) && !spawn_thread(arg))
168+
- return false;
169+
-
170+
switch (func) {
171+
case OPTEE_MSG_RPC_CMD_LOAD_TA:
172+
ret = load_ta(num_params, params);
173+
@@ -681,24 +617,6 @@ static bool process_one_request(struct thread_arg *arg)
174+
return write_response(arg->fd, &request);
175+
}
176+
177+
-static void *thread_main(void *a)
178+
-{
179+
- struct thread_arg *arg = a;
180+
-
181+
- /*
182+
- * Now that this thread has been scheduled, compensate for the
183+
- * initial increase in spawn_thread() before.
184+
- */
185+
- num_waiters_dec(arg);
186+
-
187+
- while (!arg->abort) {
188+
- if (!process_one_request(arg))
189+
- arg->abort = true;
190+
- }
191+
-
192+
- return NULL;
193+
-}
194+
-
195+
static void set_ta_path(void)
196+
{
197+
char *ta_path_str = NULL;
198+
@@ -764,62 +682,10 @@ err_path:
199+
exit(EXIT_FAILURE);
200+
}
201+
202+
-/*
203+
- * Similar to the standard libc function daemon(0, 0) but the parent process
204+
- * issues a blocking read on pipefd[0] before exiting.
205+
- * Returns 0 on success, <0 on error.
206+
- */
207+
-static int make_daemon(int pipefd[2])
208+
-{
209+
- int fd = 0;
210+
- char c = 0;
211+
- int n = 0;
212+
-
213+
- switch (fork()) {
214+
- case -1:
215+
- return -1;
216+
- case 0:
217+
- /* In child */
218+
- close(pipefd[0]);
219+
- break;
220+
- default:
221+
- /* In parent */
222+
- close(pipefd[1]);
223+
- n = read(pipefd[0], &c, 1);
224+
- close(pipefd[0]);
225+
- if (!n) {
226+
- /*
227+
- * Nothing has been read: child has closed without
228+
- * writing (either exited on error or crashed)
229+
- */
230+
- return -1;
231+
- }
232+
- /* Child is done with the opening of the TEE device */
233+
- _exit(EXIT_SUCCESS);
234+
- }
235+
-
236+
- if (setsid() < 0)
237+
- return -2;
238+
-
239+
- if (chdir("/") < 0)
240+
- return -3;
241+
-
242+
- fd = open("/dev/null", O_RDWR);
243+
- if (fd < 0)
244+
- return -4;
245+
- dup2(fd, 0);
246+
- dup2(fd, 1);
247+
- dup2(fd, 2);
248+
- close(fd);
249+
-
250+
- return 0;
251+
-}
252+
253+
int main(int argc, char *argv[])
254+
{
255+
struct thread_arg arg = { .fd = -1 };
256+
- int pipefd[2] = { 0, };
257+
- bool daemonize = false;
258+
char *dev = NULL;
259+
int e = 0;
260+
int long_index = 0;
261+
@@ -835,7 +701,6 @@ int main(int argc, char *argv[])
262+
static struct option long_options[] = {
263+
/* long name | has argument | flag | short value */
264+
{ "help", no_argument, 0, 'h' },
265+
- { "daemonize", no_argument, 0, 'd' },
266+
{ "fs-parent-path", required_argument, 0, 'f' },
267+
{ "ta-path", required_argument, 0, 'l' },
268+
{ "ta-dir", required_argument, 0, 't' },
269+
@@ -850,9 +715,6 @@ int main(int argc, char *argv[])
270+
case 'h' :
271+
return usage(EXIT_SUCCESS);
272+
break;
273+
- case 'd':
274+
- daemonize = true;
275+
- break;
276+
case 'f':
277+
supplicant_params.fs_parent_path = optarg;
278+
break;
279+
@@ -898,18 +760,6 @@ int main(int argc, char *argv[])
280+
exit(EXIT_FAILURE);
281+
}
282+
283+
- if (daemonize) {
284+
- if (pipe(pipefd) < 0) {
285+
- EMSG("pipe(): %s", strerror(errno));
286+
- exit(EXIT_FAILURE);
287+
- }
288+
- e = make_daemon(pipefd);
289+
- if (e < 0) {
290+
- EMSG("make_daemon(): %d", e);
291+
- exit(EXIT_FAILURE);
292+
- }
293+
- }
294+
-
295+
if (dev) {
296+
arg.fd = open_dev(dev, &arg.gen_caps);
297+
if (arg.fd < 0) {
298+
@@ -929,15 +779,6 @@ int main(int argc, char *argv[])
299+
if(e < 0)
300+
fprintf(stderr, "sd_notify_ready() failed: %s\n", strerror(-e));
301+
302+
- if (daemonize) {
303+
- /* Release parent */
304+
- if (write(pipefd[1], "", 1) != 1) {
305+
- EMSG("write(): %s", strerror(errno));
306+
- exit(EXIT_FAILURE);
307+
- }
308+
- close(pipefd[1]);
309+
- }
310+
-
311+
while (!arg.abort) {
312+
if (!process_one_request(&arg))
313+
arg.abort = true;
314+
--
315+
2.49.0.rc2.11.g4b68faf6b9.dirty
316+

0 commit comments

Comments
 (0)