OP-TEE and fTPM updates

This is bumping the version of our OP-TEE integration, primarily to refresh the optee_ftpm feed so that recently published CVEs [1] and [2] can be addressed. The updates take place for both qemu-arm64 and the ti-k3 (used for AM62Px SK).

While firmware is not a delivery CIP has committed to maintain, we know some downstream consumers of the bits we have here. Furthermore, the current TPM provider to optee_ftpm imposes certain challenges on integrators that became specifically visible in the light of these two CVEs. We therefore think it is more efficient to share common bits here, rather than waiting for the ecosystem to improve further first.

For further details on fTPM updates, see also [3] and [4].

Jan

[1] https://www.cve.org/CVERecord?id=CVE-2026-6726
[2] https://www.cve.org/CVERecord?id=CVE-2026-6727
[3] https://github.com/OP-TEE/optee_ftpm/issues/29
[4] https://github.com/OP-TEE/optee_ftpm/pull/25

Jan Kiszka (4):
optee: Update to 4.10.0
optee-ftpm: Factor out common recipe bits of qemu-arm64 and ti-k3
targets
optee-ftpm: Update to TPM reference implementation V184
optee-ftpm: Apply security fixes for V184

 ...1-Address-improper-object-slot-reuse.patch |   95 +
 ...PM-2.0-Reference-Implementation-v184.patch | 3885 +++++++++++++++++
 ...EP-timing-side-channel-vulnerability.patch |   46 +
 ...002-Disable-command-TPM2_CertifyX509.patch |   29 +
 .../optee-ftpm-qemu-arm64_4.10+V184.bb        |   17 +
 ...ftpm-qemu-arm64_4.8+v1.62r1-48-ge9fc7b8.bb |   32 -
 .../optee-ftpm/optee-ftpm-ti-k3_4.10+V184.bb  |   15 +
 ...ptee-ftpm-ti-k3_4.8+v1.62r1-48-ge9fc7b8.bb |   30 -
 .../optee-ftpm/optee-ftpm_4.10+V184.inc       |   31 +
 ...4.8.0.bb => optee-os-qemu-arm64_4.10.0.bb} |    0
 ...8.0.inc => optee-os-qemu-arm64_4.10.0.inc} |    2 +-
 ...=> optee-os-tadevkit-qemu-arm64_4.10.0.bb} |    0
 ...0.bb => optee-os-tadevkit-ti-k3_4.10.0.bb} |    0
 ...i-k3_4.8.0.bb => optee-os-ti-k3_4.10.0.bb} |    0
 ...k3_4.8.0.inc => optee-os-ti-k3_4.10.0.inc} |    2 +-
 15 files changed, 4120 insertions(+), 64 deletions(-)
 create mode 100644 recipes-bsp/optee-ftpm/files/0001-Address-improper-object-slot-reuse.patch
 create mode 100644 recipes-bsp/optee-ftpm/files/0001-Update-to-TPM-2.0-Reference-Implementation-v184.patch
 create mode 100644 recipes-bsp/optee-ftpm/files/0002-Address-RSA-OAEP-timing-side-channel-vulnerability.patch
 create mode 100644 recipes-bsp/optee-ftpm/files/0002-Disable-command-TPM2_CertifyX509.patch
 create mode 100644 recipes-bsp/optee-ftpm/optee-ftpm-qemu-arm64_4.10+V184.bb
 delete mode 100644 recipes-bsp/optee-ftpm/optee-ftpm-qemu-arm64_4.8+v1.62r1-48-ge9fc7b8.bb
 create mode 100644 recipes-bsp/optee-ftpm/optee-ftpm-ti-k3_4.10+V184.bb
 delete mode 100644 recipes-bsp/optee-ftpm/optee-ftpm-ti-k3_4.8+v1.62r1-48-ge9fc7b8.bb
 create mode 100644 recipes-bsp/optee-ftpm/optee-ftpm_4.10+V184.inc
 rename recipes-bsp/optee-os/{optee-os-qemu-arm64_4.8.0.bb => optee-os-qemu-arm64_4.10.0.bb} (100%)
 rename recipes-bsp/optee-os/{optee-os-qemu-arm64_4.8.0.inc => optee-os-qemu-arm64_4.10.0.inc} (78%)
 rename recipes-bsp/optee-os/{optee-os-tadevkit-qemu-arm64_4.8.0.bb => optee-os-tadevkit-qemu-arm64_4.10.0.bb} (100%)
 rename recipes-bsp/optee-os/{optee-os-tadevkit-ti-k3_4.8.0.bb => optee-os-tadevkit-ti-k3_4.10.0.bb} (100%)
 rename recipes-bsp/optee-os/{optee-os-ti-k3_4.8.0.bb => optee-os-ti-k3_4.10.0.bb} (100%)
 rename recipes-bsp/optee-os/{optee-os-ti-k3_4.8.0.inc => optee-os-ti-k3_4.10.0.inc} (90%)

2.47.3