ci: hafnium: disable Rust to workaround "no space left on device"

The GitHub Actions CI recently started to fail with a disk space error:

System.IO.IOException: No space left on device : '/home/run

ci: hafnium: disable Rust to workaround "no space left on device"

The GitHub Actions CI recently started to fail with a disk space error:

System.IO.IOException: No space left on device : '/home/runner/actions-runner/cached/_diag/Worker_20251015-153857-utc.log'

Apply the same workaround as in commit a4b310d68bf8 ("ci: xen: disable
Rust to workaround "no space left on device"").

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fs_htree: re-init hash tree when both tag and counter are zero

Creating and update a hash tree involves several RPC commands.
If a power loss occurs during the creation flow, it may result
in

core: fs_htree: re-init hash tree when both tag and counter are zero

Creating and update a hash tree involves several RPC commands.
If a power loss occurs during the creation flow, it may result
in a hash tree with an incomplete header and a counter value of 0.
If attempting to read this file subsequently leads to a
TEE_ERROR_CORRUPT_OBJECT error.

Instead of returning TEE_ERROR_CORRUPT_OBJECT, continue the
initialization flow to support subsequent functionality.

Link: https://github.com/OP-TEE/optee_os/issues/7512
Fixes: 50a814981d8b ("core: provide a hash tree for secure storage")

Signed-off-by: Ox Yeh <ox.yeh@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

drivers: stm32_rtc: prevent registering of RTC interrupt when it's not used by OP-TEE

Do not register the RTC interrupt when it's not used by OP-TEE as it
prevents non-secure world from handling tha

drivers: stm32_rtc: prevent registering of RTC interrupt when it's not used by OP-TEE

Do not register the RTC interrupt when it's not used by OP-TEE as it
prevents non-secure world from handling that interrupt.

The RTC interrupt line is only used if the RTC is set as a wakeup source
or RTC is secured by the RIF (only for STM32MP2x) and RTC PTA and
async notif are enabled.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Clément Le Goffic <legoffic.clement@gmail.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

drivers: regulator: DT property regulator-enable-ramp-delay

Implement regulator DT property regulator-enable-ramp-delay.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Signed-off-by

drivers: regulator: DT property regulator-enable-ramp-delay

Implement regulator DT property regulator-enable-ramp-delay.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Gatien Chevallier <gatien.chevallier@foss.st.com>

show more ...

drivers: regulator: DT property regulator-ramp-delay

Implement regulator DT property regulator-ramp-delay.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Signed-off-by: Thomas Bourg

drivers: regulator: DT property regulator-ramp-delay

Implement regulator DT property regulator-ramp-delay.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Gatien Chevallier <gatien.chevallier@foss.st.com>

show more ...

drivers: regulator: DT properties over-current-protection

Define regulator property flags for the regulator DT binding
properties regulator-over-current-protection and
regulator-active-discharge.

S

drivers: regulator: DT properties over-current-protection

Define regulator property flags for the regulator DT binding
properties regulator-over-current-protection and
regulator-active-discharge.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Gatien Chevallier <gatien.chevallier@foss.st.com>

show more ...

plat-rockchip: rk3588: reject all zero HUK

If the generated HUK consists of all zeros, it cannot be distinguished
from a missing HUK in the OTP. If such a HUK is burned into the OTP, the
next read w

plat-rockchip: rk3588: reject all zero HUK

If the generated HUK consists of all zeros, it cannot be distinguished
from a missing HUK in the OTP. If such a HUK is burned into the OTP, the
next read will return that no HUK was present and generate a new key.
The previous all-zero HUK may already have been used, which violates the
assumption that a HUK doesn't change.

Since a HUK that consists of all zeros is likely an error in the TRNG,
reject the generated HUK, report an error and let upper layers handle
the error.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

plat-rockchip: rk3588: cache HUK in memory

I observed timeout errors when OP-TEE reads the HUK from the OTP area
while running the optee-xtests (tests 1006 and 4013) or using the
pkcs#11 TA.

This i

plat-rockchip: rk3588: cache HUK in memory

I observed timeout errors when OP-TEE reads the HUK from the OTP area
while running the optee-xtests (tests 1006 and 4013) or using the
pkcs#11 TA.

This issue is circumvented by reading the HUK once and caching it in
memory for later use. As a side-effect, this reduces the accesses/reads
from the OTP area.

Unfortunately, I don't know the root cause for the timeout while reading
the fuses. I guess that there is a disabled clock which prevents the
read, but I didn't look further, since caching works fine.

While the documentation recommends to never process the HUK in software,
it is read and processed anyway if it can be read from the fuses. Thus,
I don't think that caching has an effect on the security of the HUK.
The caching is inspired by the HUK handling implemented in the nvmem
driver.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

plat-rockchip: rk3588: refactor reading of HUK

Split the function that reads, generates and persists the HUK into
several helper functions to make the code more readable and simplify
error handling.

plat-rockchip: rk3588: refactor reading of HUK

Split the function that reads, generates and persists the HUK into
several helper functions to make the code more readable and simplify
error handling.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

drivers: rockchip: extract OTP driver from rk3588 platform

The OTP handling is useful outside the rk3588 platform implementation.
For example, the fuses for secure boot are accessible via the OTP.

drivers: rockchip: extract OTP driver from rk3588 platform

The OTP handling is useful outside the rk3588 platform implementation.
For example, the fuses for secure boot are accessible via the OTP.

Extract the OTP write and read support to a separate driver to make it
available for other modules.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

plat-stm32mp1: add new API to erase SRAM3

Add new API TEE_Result stm32mp_syscfg_erase_sram3(void);
to be able to erase SRAM3 by hardware request.

Signed-off-by: Nicolas Toromanoff <nicolas.toromano

plat-stm32mp1: add new API to erase SRAM3

Add new API TEE_Result stm32mp_syscfg_erase_sram3(void);
to be able to erase SRAM3 by hardware request.

Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

plat-stm32mp1: syscfg: add dsb in syscfg driver

Add dsb in syscfg driver to guarantee that the request operations
are performed in SYSCFG register when the external API are called
and before to retu

plat-stm32mp1: syscfg: add dsb in syscfg driver

Add dsb in syscfg driver to guarantee that the request operations
are performed in SYSCFG register when the external API are called
and before to return to caller:
- stm32mp1_iocomp() in init sequence
- stm32mp_set_vddsd_comp_state() and stm32mp_set_hslv_state()
called by PWR driver

Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Gatien Chevallier <gatien.chevallier@foss.st.com>

show more ...

plat-stm32mp1: syscfg: set SYSCFG_CMPCR_READY_TIMEOUT_US to 10ms

CHange timeout to 10 ms instead of 1 ms.
On stm32mp13 we measure 1.5ms delay to have CMPCR_READY equal to 1.
Use 10 ms to be aligned

plat-stm32mp1: syscfg: set SYSCFG_CMPCR_READY_TIMEOUT_US to 10ms

CHange timeout to 10 ms instead of 1 ms.
On stm32mp13 we measure 1.5ms delay to have CMPCR_READY equal to 1.
Use 10 ms to be aligned with TF-A timeout.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: mm: fix zero-length access check inconsistency

Fix vm_check_access_rights() so it handles zero-length memory ranges
consistently. Previously, the function had inconsistent behavior for
zero-le

core: mm: fix zero-length access check inconsistency

Fix vm_check_access_rights() so it handles zero-length memory ranges
consistently. Previously, the function had inconsistent behavior for
zero-length checks:
- For page-aligned addresses: Would skip the page checking loop entirely
and return TEE_SUCCESS.
- For unaligned addresses: Would round uaddr down to page boundary and
return a result based on that page.

With this change flags = SECURE | NON_SECURE will still fail to preserve
the sanity checking, but all other zero-length ranges result in
TEE_SUCCESS.

Specifically this was required due to an interaction between OP-TEE and
Rust where Keymint [0] would call the Teaclave [1] wrapper around
TEE_MACComputeFinal with an empty temporary slice (pointer + length
pair) as the final message (&[]). Rust always requires the pointer to be
non-null, but allows it to dangle when length is zero. As a result the
arguments passed to TEE_MACComputeFinal were message=(void *)1,
messageLen=0. These arguments are passed unmodified to
vm_check_access_rights regardless of the length and presumably relied
on the page-aligned case to handle NULL + 0.

[0] https://android.googlesource.com/tee/optee/ta/keymint/
[1] https://github.com/apache/teaclave-trustzone-sdk

Signed-off-by: Martin Nyhus <martin@nyhus.dev>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Squashed commit upgrading to mbedtls-3.6.4

Squash merging branch import/mbedtls-3.6.4

commit 43e97a8f0625 ("Import mbedtls-3.6.4")
commit 8ac83749d343 ("mbedtls: remove default include/mbedtls/conf

Squashed commit upgrading to mbedtls-3.6.4

Squash merging branch import/mbedtls-3.6.4

commit 43e97a8f0625 ("Import mbedtls-3.6.4")
commit 8ac83749d343 ("mbedtls: remove default include/mbedtls/config.h")
commit 89c0fc652535 ("mbedtls: configure mbedtls to reach for config")
commit 59c9730a19a8 ("libmbedtls: make mbedtls_mpi_mont*() available")
commit 20d408b354b4 ("libmbedtls: add mbedtls_mpi_init_mempool()")
commit ae519b65d8e1 ("libmedtls: mpi_miller_rabin: increase count limit")
commit eec216feead8 ("libmbedtls: add interfaces in mbedtls for context memory operation")
commit 436c9dec3733 ("libmbedtls: fix no CRT issue")
commit eb7fd40aa0c1 ("libmbedtls: add SM2 curve")
commit 6ca24312de58 ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pss_verify_ext()")
commit a7a355ebd993 ("libmbedtls: add fault mitigation in mbedtls_rsa_rsassa_pkcs1_v15_verify()")
commit 45083a9c2d7f ("libmbedtls: fix cipher_wrap.c for chacha20 and chachapoly")
commit a345e1bb1572 ("libmbedtls: fix cipher_wrap.c for NIST AES Key Wrap mode")
commit 015ba93f356d ("libmbedtls: allow inclusion of arm_neon.h")
commit 3c7a228496a7 ("libmbedtls: add CFG_CORE_UNSAFE_MODEXP and CFG_TA_MBEDTLS_UNSAFE_MODEXP")
commit c88a506a0f55 ("libmbedtls: use mempool_calloc() for temporary memory")
commit b22584209222 ("libmbedtls: fix build warning related to deprecated DTLS connect ID")
commit 4afc1eba8114 ("libmbedtls: sync with DTLS connect ID build fix")
commit 85329760d40b ("libmbedtls: fix compilation warning with GCC14")

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_virt)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)

show more ...

core: crypto: fix AES-GCM in-place decryption order

Fix AES-GCM in-place decryption to ensure GHASH always uses the original
ciphertext. Previously, plaintext could overwrite ciphertext before GHASH

core: crypto: fix AES-GCM in-place decryption order

Fix AES-GCM in-place decryption to ensure GHASH always uses the original
ciphertext. Previously, plaintext could overwrite ciphertext before GHASH,
causing authentication failures. Now GHASH is processed before decryption,
so in-place and non in-place decryption both work correctly without extra
buffering or conditional checks.

Tested with both in-place and non in-place decryption; all cases now
produce correct authentication tags.

Fixes: 1fca7e269b13 ("core: crypto: add new AES-GCM implementation")
Signed-off-by: Rayan Hu <rayan.hu@mediatek.com>
Reviewed-by: Menson Chen <menson.chen@mediatek.com>
Reviewed-by: ChingMing Chen <chingming.chen@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: xen: disable Rust to workaround "no space left on device"

The GitHub Actions CI recently started to fail with a disk space error:

[...]
2025-09-25T09:24:51.2006517Z >>> Finalizing host direct

ci: xen: disable Rust to workaround "no space left on device"

The GitHub Actions CI recently started to fail with a disk space error:

[...]
2025-09-25T09:24:51.2006517Z >>> Finalizing host directory
2025-09-25T09:24:51.2007142Z mkdir -p /__w/optee_os/optee_repo_qemu_v8/out-br/host
2025-09-25T09:24:51.2028001Z printf "%s/host/\n" bash busybox dtc host-acl host-attr host-autoconf host-automake host-blake3 host-ccache host-e2fsprogs host-fakeroot host-hiredis host-libtool host-m4 host-makedevs host-mkpasswd host-patchelf host-pkgconf host-skeleton host-util-linux host-xxhash host-zstd ifupdown-scripts initscripts keyutils libaio libcurl libffi libglib2 libopenssl libzlib mmc-utils ncurses opensc openssl optee_client_ext optee_examples_ext optee_os_ext optee_rust_examples_ext optee_test_ext pcre2 pcsc-lite pixman qemu readline skeleton skeleton-init-common skeleton-init-sysv slirp strace toolchain toolchain-external toolchain-external-custom tpm2-tools tpm2-tss urandom-scripts util-linux util-linux-libs xen_ext yajl zlib | tac | rsync -a --hard-links --files-from=- --no-R -r /__w/optee_os/optee_repo_qemu_v8/out-br/per-package /__w/optee_os/optee_repo_qemu_v8/out-br/host
2025-09-25T09:24:56.6942688Z rsync: [receiver] write failed on "/__w/optee_os/optee_repo_qemu_v8/out-br/host/lib/libLLVM.so.19.1-rust-1.86.0-stable": No space left on device (28)
2025-09-25T09:24:56.6943698Z rsync error: error in file IO (code 11) at receiver.c(381) [receiver=3.2.7]
2025-09-25T09:24:56.7952984Z rsync: [sender] write error: Broken pipe (32)
2025-09-25T09:24:56.7962889Z make[2]: *** [Makefile:717: host-finalize] Error 11
2025-09-25T09:24:56.7997049Z make[1]: *** [Makefile:23: _all] Error 2
2025-09-25T09:24:56.7998137Z make[1]: Leaving directory '/__w/optee_os/optee_repo_qemu_v8/out-br'
2025-09-25T09:24:56.7999290Z make: *** [common.mk:354: buildroot] Error 2

I could not identify which change exactly caused the limit to be reached,
and I didn't manage to identify any obvious waste of disk space in the
build. I noticed however that building with RUST_ENABLE=y (the default)
uses approximately 6 GB more than with RUST_ENABLE=n (27 GB vs 21 GB,
that's the size of the whole OP-TEE tree in the end).
The two "nightly" Rust toolchains that are downloaded when optee_rust is
built account for 1.6 GB on their own.

Therefore, and until we find a better solution or GitHub increases the
disk space allocated to CI jobs, disable Rust in the Xen and Xen FF-A
jobs. This allows the Xen jobs to pass again.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: add STM32MP23 platforms build

Adds STM32MP235f-dk board build to the CI.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

dts: stm32: move compatible of agent1 as the first line of the node

Move compatible of agent1 as the first line of the node to be aligned
with stm32mp23-st-scmi-cfg.dtsi

Signed-off-by: Thomas Bourg

dts: stm32: move compatible of agent1 as the first line of the node

Move compatible of agent1 as the first line of the node to be aligned
with stm32mp23-st-scmi-cfg.dtsi

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

drivers: stm32_rifsc: add support of stm32mp23

Add support of stm32mp23 platform in RIFSC driver.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Etienne Carriere <etienne

drivers: stm32_rifsc: add support of stm32mp23

Add support of stm32mp23 platform in RIFSC driver.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

drivers: stm32_tamp: support STM32MP23x SoC family

Add support for STM32MP23 SoC family.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@fo

drivers: stm32_tamp: support STM32MP23x SoC family

Add support for STM32MP23 SoC family.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

dt-bindings: shared bindings between STM32MP25x and STM32MP23x boards

As the STM32MP23 SoC family is a derivative of the STM32MP25 SoC family,
the device tree bindings can be shared as they are comp

dt-bindings: shared bindings between STM32MP25x and STM32MP23x boards

As the STM32MP23 SoC family is a derivative of the STM32MP25 SoC family,
the device tree bindings can be shared as they are compatible.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

plat-stm32mp2: conf: support STM32MP23x SoC family

Add support for the STM32MP23 SoC family and the stm32mp235f-dk board.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: E

plat-stm32mp2: conf: support STM32MP23x SoC family

Add support for the STM32MP23 SoC family and the stm32mp235f-dk board.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

dts: stm32: add stm32mp235f-dk board support

Add STM32MP235F Discovery Kit board support. It embeds a STM32MP235FAK
SoC, with 2GB of LPDDR4, 2*USB typeA, 1*USB3 typeC, 1*ETH, wifi/BT
combo, DSI HDMI

dts: stm32: add stm32mp235f-dk board support

Add STM32MP235F Discovery Kit board support. It embeds a STM32MP235FAK
SoC, with 2GB of LPDDR4, 2*USB typeA, 1*USB3 typeC, 1*ETH, wifi/BT
combo, DSI HDMI, LVDS connector ...

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

dts: stm32: introduce stm32mp23 SoCs family

STM32MP23 family is composed of 3 SoCs defined as following:

-STM32MP231: common part composed of 1*Cortex-A35, common peripherals
like SDMMC, UART, SPI,

dts: stm32: introduce stm32mp23 SoCs family

STM32MP23 family is composed of 3 SoCs defined as following:

-STM32MP231: common part composed of 1*Cortex-A35, common peripherals
like SDMMC, UART, SPI, I2C, parallel display, 1*ETH ...

-STM32MP233: STM32MP231 + 1*Cortex-A35 (dual CPU), a second ETH, CAN-FD.

-STM32MP235: STM32MP233 + GPU/AI and video encode/decode, DSI and LDVS
display.

A second diversity layer exists for security features/ A35 frequency:
-STM32MP23xY, "Y" gives information:
-Y = A means A35@1.2GHz + no cryp IP and no secure boot.
-Y = C means A35@1.2GHz + cryp IP and secure boot.
-Y = D means A35@1.5GHz + no cryp IP and no secure boot.
-Y = F means A35@1.5GHz + cryp IP and secure boot.

Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...