This all started by wanting to be able to fetch a "persistent value" from RPMB and use that in boot logic. I noticed that the "optee_rpmb read_pvalue" subcommand had two flaws in that regard: No way to actually store the result in e.g. an environment variable, and having to know and provide a "large enough" size of the value.
For the former, it's just a matter of letting the caller provide the name of an environment variable to store the result to in lieu of printing it. For the latter, the tee side should have provided a way to know if a too small buffer was passed, but that was never actually implemented, and instead a silently truncated value would be returned. That has been fixed by adding a new variant of the TA_AVB_CMD_READ_PERSIST_VALUE method which does yield an error along with the proper size to allocate: https://github.com/OP-TEE/optee_os/pull/7959 . That is not yet merged, but I assume it will be soonish; these patches should not be applied until it is. v2: - Drop the part touching common/avb_verify.c, now that the old TA_AVB_CMD_READ_PERSIST_VALUE method is not changed. That doesn't mean it shouldn't be updated at some point (the header file promises behaviour which is not actually implemented), but it is out of scope for what I intend to do currently. - Do make use of the new method in optee_rpmb read_pvalue, and implement the "store result to env var". v1: https://lore.kernel.org/u-boot/[email protected]/ Rasmus Villemoes (4): cmd: optee_rpmb: sanitize TEE_ERROR -> E* translations optee_ta_avb.h: add TA_AVB_CMD_READ_PERSIST_VALUE2 define cmd: optee_rpmb: allocate large enough buffer when reading persistent value cmd: optee_rpmb: make it usable by scripts cmd/optee_rpmb.c | 70 ++++++++++++++++++++++++++------------ include/tee/optee_ta_avb.h | 12 +++++++ 2 files changed, 61 insertions(+), 21 deletions(-) -- 2.55.0
