From fa0feec3f79aa128434dda050455566e9a16bf61 Mon Sep 17 00:00:00 2001
From: Daniel McIlvaney <damcilva@microsoft.com>
Date: Wed, 21 Aug 2019 16:58:41 -0700
Subject: [PATCH 1/7] Initial commit

---
 .../defaultvars/default_variable_example.bin  |   1 +
 .../AuthVars/defaultvars/default_vars.json    |  10 ++
 .../AuthVars/defaultvars/default_vars.py      | 149 ++++++++++++++++++
 .../AuthVars/defaultvars/defaultvars.h        |  51 ++++++
 TAs/optee_ta/AuthVars/defaultvars/sub.mk      |  12 ++
 TAs/optee_ta/AuthVars/sub.mk                  |   1 +
 6 files changed, 224 insertions(+)
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/default_variable_example.bin
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/default_vars.json
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/default_vars.py
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/defaultvars.h
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/sub.mk

diff --git a/TAs/optee_ta/AuthVars/defaultvars/default_variable_example.bin b/TAs/optee_ta/AuthVars/defaultvars/default_variable_example.bin
new file mode 100644
index 0000000..02e40b0
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/default_variable_example.bin
@@ -0,0 +1 @@
+Default Example Binary
diff --git a/TAs/optee_ta/AuthVars/defaultvars/default_vars.json b/TAs/optee_ta/AuthVars/defaultvars/default_vars.json
new file mode 100644
index 0000000..17158c6
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/default_vars.json
@@ -0,0 +1,10 @@
+{
+    "variables": [
+        {
+            "name": "Default Variable Exampleé",
+            "bin_path": "./default_variable_example.bin",
+            "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}",
+            "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_RUNTIME_ACCESS"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/defaultvars/default_vars.py b/TAs/optee_ta/AuthVars/defaultvars/default_vars.py
new file mode 100644
index 0000000..ed69062
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/default_vars.py
@@ -0,0 +1,149 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+import os, sys, json, codecs
+
+# Variables are encoded as:
+#       BYTE <VAR_NUM>_name[] = L"ECS\x002d2\x20COMPATIBLE\x20STRING";
+#       BYTE <VAR_NUM>_bin[] = { 0x0, 0x1, 0x2, ... };
+#       GUID <VAR_NUM>_guid = {0x12345678,0x9abc,0xdef0,{0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0}};
+#       ATTRIBUTES <VAR_NUM>_attributes = <ATTR1 | ATTR2 | ... >;
+#
+# The function add_vars() will add each variable in the order it was found in the json by calling
+# the add_default_var() function from default_var_utils.c
+
+
+VALID_TYPES = ['EFI_VARIABLE_NON_VOLATILE',
+                'EFI_VARIABLE_BOOTSERVICE_ACCESS',
+                'EFI_VARIABLE_RUNTIME_ACCESS',
+                'EFI_VARIABLE_HARDWARE_ERROR_RECORD',
+                'EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS',
+                'EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS',
+                'EFI_VARIABLE_APPEND_WRITE']
+
+#define EFI_IMAGE_SECURITY_DATABASE_GUID \
+WELL_KNOWN_GUIDS = [
+    ('EFI_IMAGE_SECURITY_DATABASE_GUID','{ 0xd719b2cb, 0x3d3a, 0x4596, { 0xa3, 0xbc, 0xda, 0xd0, 0xe, 0x67, 0x65, 0x6f } }'),
+    ('EFI_GLOBAL_VARIABLE','{ 0x8BE4DF61, 0x93CA, 0x11d2, { 0xAA, 0x0D, 0x00, 0xE0, 0x98, 0x03, 0x2B, 0x8C } }')]
+
+def convert_to_wchar(char):
+    if ord(char) >= 0xd800 and ord(char) <= 0xdfff:
+        raise ValueError("Invalid ECS2 encoding (UTF-16 surrogate) for character '%c'" % char)
+    if ord(char) > 0xffff:
+        raise ValueError("Invalid ECS2 encoding for character '%c', to large for ECS2" % char)
+    if ((ord(char) in range(ord('a'), ord('z'))) or
+            (ord(char) in range(ord('A'), ord('Z'))) or
+            (ord(char) in range(ord('0'), ord('9')))):
+        return char
+    else:
+        # Generates something of the form: <" "\x0123" ">
+        return (r'" "\x' + ('%04x' % ord(char)) + '" "' )
+
+# We could compile unicode strings here, but it is easier to convert to hex representation
+# instead of handing escaping everything correctly. Also verify we are not encoding any 
+# 4 byte characters which ECS2 can't handle.
+def format_wchar_string(string):
+    return 'L"' + ''.join(convert_to_wchar(c) for c in string) + '"'
+
+def format_byte_array(bytes):
+    line_length = 16
+    return '{\n\t%s\n}' % (''.join(['0x%02x, ' % byte + ('\n\t' if ((i+1) % line_length == 0) else '') for i, byte in enumerate(bytes)]))
+
+# Generate tupples of the form:
+#   (name, <binary data>, guid, attributes)
+def parse_json(json_file):
+    json_data = json_file.read()
+    json_data = json.loads(str(json_data))
+    vars = list()
+    for variable in json_data['variables']:
+        variable_name = variable['name']
+        variable_bin_path = variable['bin_path']
+        variable_guild = variable['guid']
+        variable_attributes = variable['attributes']
+
+        with open(variable_bin_path, 'rb') as bin_file:
+            vars.append((format_wchar_string(variable_name),
+                    format_byte_array(bin_file.read()),
+                    variable_guild,
+                    variable_attributes))
+    return vars
+
+def write_header(f):
+    f.write('/* Automatically generated file created by default_vars.py */\n')
+    f.write('/* Add hard-coded variables to the image by editing default_vars.json */\n')
+    f.write('#include <varops.h>\n')
+    f.write('#include <default_var_utils.h>\n')
+
+
+#       CHAR16 var_<VAR_NUM>_name[] = { 0x0, 0x1, 0x2, ... };
+#       BYTE var_<VAR_NUM>_bin[] = { 0x0, 0x1, 0x2, ... };
+#       GUID var_<VAR_NUM>_guid = {0x12345678,0x9abc,0xdef0,{0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0}};
+#       ATTRIBUTES var_<VAR_NUM>_attributes = <ATTR1 | ATTR2 | ... >;
+def write_variables(f, variables):
+    for i,var in enumerate(variables):
+        f.write(('CHAR16 var_%d_name[] = ' % i) + var[0] + ";\n")
+        f.write(('BYTE var_%d_bin[] = ' % i) + var[1] + ";\n")
+        f.write(('GUID var_%d_guid = ' % i) + var[2] + ";\n")
+        f.write(('ATTRIBUTES var_%d_attributes = ' % i) + var[3] + ";\n")
+        f.write('\n')
+
+def format_setvar_single_call(var_num):
+    var_name = 'var_%d_name' % var_num
+    var_name_size = 'sizeof(%s)' % var_name
+    var_bin = 'var_%d_bin' % var_num
+    var_bin_size = 'sizeof(%s)' % var_bin
+    var_guid = 'var_%d_guid' % var_num
+    var_attributes = 'var_%d_attributes' % var_num
+    return 'SetDefaultVariable(%s, %s, %s, %s, %s, %s)' % (
+            var_name, var_name_size, var_bin, var_bin_size,
+            var_guid, var_attributes)
+
+def format_setvar_calls(variables):
+    return ''.join([
+'''
+    res = %s;
+    if (res != TEE_SUCCESS)
+        return res;
+''' % format_setvar_single_call(i) for i,_ in enumerate(variables)
+    ])
+
+def write_end(f, variables):
+    f.write('''
+TEE_Result InitializeDefaultVariables( VOID ) {
+    TEE_Result res;
+%s
+    return TEE_SUCCESS;
+}
+''' % format_setvar_calls(variables))
+
+
+
+num_args = len(sys.argv)
+if num_args != 3:
+#    raise ValueError("Expecting 2 arguments (in.json, out.c)")
+    json_file_in = 'foo'
+    c_file_out = 'bar.c'
+    json_file_in_path = os.path.abspath(os.path.join(os.getcwd(), json_file_in))
+    c_file_out_path = os.path.abspath(os.path.join(os.getcwd(), c_file_out))
+else:
+    json_file_in = sys.argv[1]
+    json_file_in_path = os.path.abspath(os.path.join(os.getcwd(), json_file_in))
+    c_file_out = sys.argv[2]
+    c_file_out_path = os.path.abspath(os.path.join(os.getcwd(), c_file_out))
+
+print("Checking for variable file in", json_file_in_path)
+if os.path.isfile(json_file_in_path):
+    print("Parsing variables from %s" % json_file_in_path)
+else:
+    raise FileNotFoundError("Could not find input " + str(json_file_in_path))
+
+if os.path.isfile(c_file_out_path):
+    os.remove(c_file_out_path)
+
+with codecs.open(json_file_in_path, encoding='utf-8', mode='r') as json_file:
+    variables = parse_json(json_file)
+
+with open(c_file_out_path, 'w') as c_file:
+    write_header(c_file)
+    write_variables(c_file, variables)
+    write_end(c_file, variables)
diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h
new file mode 100644
index 0000000..2b504ec
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h
@@ -0,0 +1,51 @@
+/*  The copyright in this software is being made available under the BSD License,
+ *  included below. This software may be subject to other third party and
+ *  contributor rights, including patent rights, and no such rights are granted
+ *  under this license.
+ *
+ *  Copyright (c) Microsoft Corporation
+ *
+ *  All rights reserved.
+ *
+ *  BSD License
+ *
+ *  Redistribution and use in source and binary forms, with or without modification,
+ *  are permitted provided that the following conditions are met:
+ *
+ *  Redistributions of source code must retain the above copyright notice, this list
+ *  of conditions and the following disclaimer.
+ *
+ *  Redistributions in binary form must reproduce the above copyright notice, this
+ *  list of conditions and the following disclaimer in the documentation and/or
+ *  other materials provided with the distribution.
+ *
+ *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ""AS IS""
+ *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ *  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ *  ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ *  (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ *  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+#include <tee_internal_api.h>
+#include <tee_internal_api_extensions.h>
+#include <utee_defines.h>
+#include "ntdefs.h"
+#include "uefidefs.h"
+#include "defaultbins.h"
+
+TEE_Result
+InitializeDefaultVariables(
+    VOID
+);
+
+TEE_Result
+SetDefaultVariable(
+    CHAR16 *Name, UINT32 NameSize, BYTE *Bin, UINT32 BinSize,
+    GUID Guid, ATTRIBUTES Attributes
+);
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/defaultvars/sub.mk b/TAs/optee_ta/AuthVars/defaultvars/sub.mk
new file mode 100644
index 0000000..fc25ab7
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/sub.mk
@@ -0,0 +1,12 @@
+DEFAULT_VARS_PATHS := $(shell find $(sub-dir) -name '*.bin')
+DEFAULT_VARS_JSON ?= $(sub-dir)/default_vars.json
+#DEFAULT_VAR_PATHS = $(foreach file,$(DEFAULT_VAR_BINS),$(sub-dir)/$(file))
+
+srcs-y += default_vars.c
+global-incdirs-y += ./
+
+gensrcs-y += default_vars
+produce-default_vars = default_vars_encoding.c
+depends-default_vars = $(DEFAULT_VARS_PATHS) $(sub-dir)/default_vars.py $(DEFAULT_VARS_JSON)
+recipe-default_vars = python3 $(sub-dir)default_vars.py $(DEFAULT_VARS_JSON) $(sub-dir-out)/default_vars_encoding.c
+cleanfiles += $(sub-dir-out)/default_vars_encoding.c
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/sub.mk b/TAs/optee_ta/AuthVars/sub.mk
index aa39869..4d713c5 100644
--- a/TAs/optee_ta/AuthVars/sub.mk
+++ b/TAs/optee_ta/AuthVars/sub.mk
@@ -51,6 +51,7 @@ clean: clean_lib_symlinks
 cflags-y += $(AUTHVAR_FLAGS) $(SSL_FLAGS) $(INCLUDE_OVERWRITES)
 
 subdirs-y += lib
+subdirs-y += defaultvars
 
 global-incdirs-y += src/include
 

From f98c4d9cae71b1702f1540c448462a4e1d783e2a Mon Sep 17 00:00:00 2001
From: Daniel McIlvaney <damcilva@microsoft.com>
Date: Thu, 22 Aug 2019 16:17:44 -0700
Subject: [PATCH 2/7] Improve ECS2 unicode handling, add documentation

---
 .../AuthVars/defaultvars/default_vars.py      | 149 ---------------
 .../AuthVars/defaultvars/defaultvars.c        |  94 ++++++++++
 .../AuthVars/defaultvars/defaultvars.h        |  11 +-
 .../AuthVars/defaultvars/defaultvars.py       | 174 ++++++++++++++++++
 ...ult_vars.json => defaultvars_example.json} |   6 +-
 .../defaultvars_secureboot_example.json       |  22 +++
 ...fault_variable_example.bin => example.bin} |   0
 .../AuthVars/defaultvars/example_KEK.bin      | Bin 0 -> 6748 bytes
 .../AuthVars/defaultvars/example_PK.bin       | Bin 0 -> 5189 bytes
 .../AuthVars/defaultvars/example_db.bin       | Bin 0 -> 8903 bytes
 TAs/optee_ta/AuthVars/defaultvars/sub.mk      |  13 +-
 TAs/optee_ta/AuthVars/src/varmgmt.c           |  11 ++
 TAs/optee_ta/AuthVars/sub.mk                  |   2 +-
 13 files changed, 318 insertions(+), 164 deletions(-)
 delete mode 100644 TAs/optee_ta/AuthVars/defaultvars/default_vars.py
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/defaultvars.c
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/defaultvars.py
 rename TAs/optee_ta/AuthVars/defaultvars/{default_vars.json => defaultvars_example.json} (51%)
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json
 rename TAs/optee_ta/AuthVars/defaultvars/{default_variable_example.bin => example.bin} (100%)
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/example_KEK.bin
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/example_PK.bin
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/example_db.bin

diff --git a/TAs/optee_ta/AuthVars/defaultvars/default_vars.py b/TAs/optee_ta/AuthVars/defaultvars/default_vars.py
deleted file mode 100644
index ed69062..0000000
--- a/TAs/optee_ta/AuthVars/defaultvars/default_vars.py
+++ /dev/null
@@ -1,149 +0,0 @@
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License.
-
-import os, sys, json, codecs
-
-# Variables are encoded as:
-#       BYTE <VAR_NUM>_name[] = L"ECS\x002d2\x20COMPATIBLE\x20STRING";
-#       BYTE <VAR_NUM>_bin[] = { 0x0, 0x1, 0x2, ... };
-#       GUID <VAR_NUM>_guid = {0x12345678,0x9abc,0xdef0,{0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0}};
-#       ATTRIBUTES <VAR_NUM>_attributes = <ATTR1 | ATTR2 | ... >;
-#
-# The function add_vars() will add each variable in the order it was found in the json by calling
-# the add_default_var() function from default_var_utils.c
-
-
-VALID_TYPES = ['EFI_VARIABLE_NON_VOLATILE',
-                'EFI_VARIABLE_BOOTSERVICE_ACCESS',
-                'EFI_VARIABLE_RUNTIME_ACCESS',
-                'EFI_VARIABLE_HARDWARE_ERROR_RECORD',
-                'EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS',
-                'EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS',
-                'EFI_VARIABLE_APPEND_WRITE']
-
-#define EFI_IMAGE_SECURITY_DATABASE_GUID \
-WELL_KNOWN_GUIDS = [
-    ('EFI_IMAGE_SECURITY_DATABASE_GUID','{ 0xd719b2cb, 0x3d3a, 0x4596, { 0xa3, 0xbc, 0xda, 0xd0, 0xe, 0x67, 0x65, 0x6f } }'),
-    ('EFI_GLOBAL_VARIABLE','{ 0x8BE4DF61, 0x93CA, 0x11d2, { 0xAA, 0x0D, 0x00, 0xE0, 0x98, 0x03, 0x2B, 0x8C } }')]
-
-def convert_to_wchar(char):
-    if ord(char) >= 0xd800 and ord(char) <= 0xdfff:
-        raise ValueError("Invalid ECS2 encoding (UTF-16 surrogate) for character '%c'" % char)
-    if ord(char) > 0xffff:
-        raise ValueError("Invalid ECS2 encoding for character '%c', to large for ECS2" % char)
-    if ((ord(char) in range(ord('a'), ord('z'))) or
-            (ord(char) in range(ord('A'), ord('Z'))) or
-            (ord(char) in range(ord('0'), ord('9')))):
-        return char
-    else:
-        # Generates something of the form: <" "\x0123" ">
-        return (r'" "\x' + ('%04x' % ord(char)) + '" "' )
-
-# We could compile unicode strings here, but it is easier to convert to hex representation
-# instead of handing escaping everything correctly. Also verify we are not encoding any 
-# 4 byte characters which ECS2 can't handle.
-def format_wchar_string(string):
-    return 'L"' + ''.join(convert_to_wchar(c) for c in string) + '"'
-
-def format_byte_array(bytes):
-    line_length = 16
-    return '{\n\t%s\n}' % (''.join(['0x%02x, ' % byte + ('\n\t' if ((i+1) % line_length == 0) else '') for i, byte in enumerate(bytes)]))
-
-# Generate tupples of the form:
-#   (name, <binary data>, guid, attributes)
-def parse_json(json_file):
-    json_data = json_file.read()
-    json_data = json.loads(str(json_data))
-    vars = list()
-    for variable in json_data['variables']:
-        variable_name = variable['name']
-        variable_bin_path = variable['bin_path']
-        variable_guild = variable['guid']
-        variable_attributes = variable['attributes']
-
-        with open(variable_bin_path, 'rb') as bin_file:
-            vars.append((format_wchar_string(variable_name),
-                    format_byte_array(bin_file.read()),
-                    variable_guild,
-                    variable_attributes))
-    return vars
-
-def write_header(f):
-    f.write('/* Automatically generated file created by default_vars.py */\n')
-    f.write('/* Add hard-coded variables to the image by editing default_vars.json */\n')
-    f.write('#include <varops.h>\n')
-    f.write('#include <default_var_utils.h>\n')
-
-
-#       CHAR16 var_<VAR_NUM>_name[] = { 0x0, 0x1, 0x2, ... };
-#       BYTE var_<VAR_NUM>_bin[] = { 0x0, 0x1, 0x2, ... };
-#       GUID var_<VAR_NUM>_guid = {0x12345678,0x9abc,0xdef0,{0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0}};
-#       ATTRIBUTES var_<VAR_NUM>_attributes = <ATTR1 | ATTR2 | ... >;
-def write_variables(f, variables):
-    for i,var in enumerate(variables):
-        f.write(('CHAR16 var_%d_name[] = ' % i) + var[0] + ";\n")
-        f.write(('BYTE var_%d_bin[] = ' % i) + var[1] + ";\n")
-        f.write(('GUID var_%d_guid = ' % i) + var[2] + ";\n")
-        f.write(('ATTRIBUTES var_%d_attributes = ' % i) + var[3] + ";\n")
-        f.write('\n')
-
-def format_setvar_single_call(var_num):
-    var_name = 'var_%d_name' % var_num
-    var_name_size = 'sizeof(%s)' % var_name
-    var_bin = 'var_%d_bin' % var_num
-    var_bin_size = 'sizeof(%s)' % var_bin
-    var_guid = 'var_%d_guid' % var_num
-    var_attributes = 'var_%d_attributes' % var_num
-    return 'SetDefaultVariable(%s, %s, %s, %s, %s, %s)' % (
-            var_name, var_name_size, var_bin, var_bin_size,
-            var_guid, var_attributes)
-
-def format_setvar_calls(variables):
-    return ''.join([
-'''
-    res = %s;
-    if (res != TEE_SUCCESS)
-        return res;
-''' % format_setvar_single_call(i) for i,_ in enumerate(variables)
-    ])
-
-def write_end(f, variables):
-    f.write('''
-TEE_Result InitializeDefaultVariables( VOID ) {
-    TEE_Result res;
-%s
-    return TEE_SUCCESS;
-}
-''' % format_setvar_calls(variables))
-
-
-
-num_args = len(sys.argv)
-if num_args != 3:
-#    raise ValueError("Expecting 2 arguments (in.json, out.c)")
-    json_file_in = 'foo'
-    c_file_out = 'bar.c'
-    json_file_in_path = os.path.abspath(os.path.join(os.getcwd(), json_file_in))
-    c_file_out_path = os.path.abspath(os.path.join(os.getcwd(), c_file_out))
-else:
-    json_file_in = sys.argv[1]
-    json_file_in_path = os.path.abspath(os.path.join(os.getcwd(), json_file_in))
-    c_file_out = sys.argv[2]
-    c_file_out_path = os.path.abspath(os.path.join(os.getcwd(), c_file_out))
-
-print("Checking for variable file in", json_file_in_path)
-if os.path.isfile(json_file_in_path):
-    print("Parsing variables from %s" % json_file_in_path)
-else:
-    raise FileNotFoundError("Could not find input " + str(json_file_in_path))
-
-if os.path.isfile(c_file_out_path):
-    os.remove(c_file_out_path)
-
-with codecs.open(json_file_in_path, encoding='utf-8', mode='r') as json_file:
-    variables = parse_json(json_file)
-
-with open(c_file_out_path, 'w') as c_file:
-    write_header(c_file)
-    write_variables(c_file, variables)
-    write_end(c_file, variables)
diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars.c b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.c
new file mode 100644
index 0000000..272d215
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.c
@@ -0,0 +1,94 @@
+/*  The copyright in this software is being made available under the BSD License,
+ *  included below. This software may be subject to other third party and
+ *  contributor rights, including patent rights, and no such rights are granted
+ *  under this license.
+ *
+ *  Copyright (c) Microsoft Corporation
+ *
+ *  All rights reserved.
+ *
+ *  BSD License
+ *
+ *  Redistribution and use in source and binary forms, with or without modification,
+ *  are permitted provided that the following conditions are met:
+ *
+ *  Redistributions of source code must retain the above copyright notice, this list
+ *  of conditions and the following disclaimer.
+ *
+ *  Redistributions in binary form must reproduce the above copyright notice, this
+ *  list of conditions and the following disclaimer in the documentation and/or
+ *  other materials provided with the distribution.
+ *
+ *  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ""AS IS""
+ *  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ *  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ *  ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ *  (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ *  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ *  ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include <defaultvars.h>
+
+TEE_Result
+SetDefaultVariable(
+    WCHAR *Name, UINT32 NameSize, BYTE *Bin, UINT32 BinSize,
+    GUID Guid, ATTRIBUTES Attributes
+)
+/*++
+
+    Routine Description:
+
+        Populates and uses a set variable paramteter structure for the
+        pre-compiled default variables. Called from the autogenerated
+        file defaultvars_encoding.c (see defaultvars.py).
+
+    Arguments:
+
+            Name - Null terminated WCHAR string with the variable name
+
+            NameSize - Length of the name
+
+            Bin - Pointer to the binary contents of the variable
+
+            BinSize - Size of the binary
+
+            Guid - Variable GUID
+
+            Attributes - Attributes to set the variable with
+
+    Returns:
+
+    TEE_Result
+
+--*/
+{
+    TEE_Result res;
+    UINT32 totalSize = sizeof(VARIABLE_SET_PARAM) + NameSize + BinSize;
+    PVARIABLE_SET_PARAM setParam = TEE_Malloc(totalSize, TEE_MALLOC_FILL_ZERO);
+
+    if(!setParam) {
+        return TEE_ERROR_OUT_OF_MEMORY;
+    }
+
+    setParam->Size = sizeof(VARIABLE_SET_PARAM);
+    setParam->NameSize = NameSize;
+    setParam->VendorGuid = Guid;
+    setParam->Attributes = Attributes;
+    setParam->DataSize = BinSize;
+    setParam->OffsetName = 0;
+    setParam->OffsetData = NameSize;
+
+    memcpy(&setParam->Payload[0], Name, NameSize);
+    memcpy(&setParam->Payload[NameSize], Bin, BinSize);
+
+    res = SetVariable(totalSize, setParam);
+
+    TEE_Free(setParam);
+
+    return res;
+}
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h
index 2b504ec..2ea8ef3 100644
--- a/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h
+++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h
@@ -35,10 +35,13 @@
 #include <tee_internal_api.h>
 #include <tee_internal_api_extensions.h>
 #include <utee_defines.h>
-#include "ntdefs.h"
-#include "uefidefs.h"
-#include "defaultbins.h"
+#include <ntdefs.h>
+#include <uefidefs.h>
+#include <varops.h>
 
+/*
+ * Defined in an autogenerated file, see defaultvars.py.
+ */
 TEE_Result
 InitializeDefaultVariables(
     VOID
@@ -46,6 +49,6 @@ InitializeDefaultVariables(
 
 TEE_Result
 SetDefaultVariable(
-    CHAR16 *Name, UINT32 NameSize, BYTE *Bin, UINT32 BinSize,
+    WCHAR *Name, UINT32 NameSize, BYTE *Bin, UINT32 BinSize,
     GUID Guid, ATTRIBUTES Attributes
 );
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars.py b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.py
new file mode 100644
index 0000000..3212290
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.py
@@ -0,0 +1,174 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+from __future__ import print_function
+
+import os, sys, json, codecs
+
+# Reads a utf-8 encoded json file containing default variables, then generates 
+# a .c file which is responsible for placing those variables into memory when
+# the TA first runs (ie has no stored NV state available).
+# ex: python defaultvars.py input.json output.c
+
+# The json file must be utf-8 encoded.
+# -- The name field may contain valid unicode characters so long as they can be encoded
+#       with ECS2 (a subset of utf-16 which does not allow 4 byte merged characters).
+# -- The binary path is relative to the TA root (AuthvVars/), or
+#       absolute (/path/to/file.json).
+# -- The guid can be either valid C GUID struct syntax or one of the well known 
+#       GUIDs from uefidefs.h
+# -- The attributes are also selected from uefidefs.h.
+# 
+# Example JSON to add a one-time volatile variable:
+# {
+#     "variables": [
+#         {
+#             "name": "ECS2 Variable Name",
+#             "bin_path": "/path/to/variable.bin",
+#             "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}",
+#                                               < OR >
+#             "guid": "<EFI_IMAGE_SECURITY_DATABASE_GUID / EFI_GLOBAL_VARIABLE>",
+#             "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+#         }
+#     ]
+# }
+
+def write_header(f, input_file_name):
+    f.write(
+'''
+/* Automatically generated file created by defaultvars.py */
+/* Add hard-coded variables to the image by editing %s */
+
+#include <defaultvars.h>
+
+''' % input_file_name)
+
+# Convert characters to a valid ECS2 encoding. Leave a subset of basic ASCII
+#  characters alone, but convert anything else to the form \x1234. Each 
+# character of the form \x1234 is enclosed in quotes: ie "foo / bar" becomes 
+# L"foo " "\x002f" " bar". The compiler will automatically  concatenate the 
+# strings. Throws an error on any valid utf-16 characters which cannot be
+# represented by ECS2.
+def convert_to_ecs2_wchar(char):
+    if ord(char) >= 0xd800 and ord(char) <= 0xdfff:
+        raise ValueError("Invalid ECS2 encoding (UTF-16 surrogate) for character '%c'" % char)
+    if ord(char) > 0xffff:
+        raise ValueError("Invalid ECS2 encoding for character '%c', to large for ECS2" % char)
+    if ((ord(char) in range(ord('a'), ord('z'))) or
+            (ord(char) in range(ord('A'), ord('Z'))) or
+            (ord(char) in range(ord('0'), ord('9'))) or
+            (ord(char) == ord(' '))):
+        # Leave very basic characters alone (a-z,A-Z,0-9,' ')
+        return char
+    else:
+        # Generates something of the form: " "\x0123" " for everything else
+        return (r'" "\x' + ('%04x' % ord(char)) + '" "' )
+
+# We could compile unicode strings here, but it is easier to convert to hex 
+# representation instead of handing escaping everything correctly. Also 
+# verify we are not encoding any 4 byte characters which ECS2 can't handle.
+def format_wchar_string(string):
+    return 'L"' + ''.join(convert_to_ecs2_wchar(c) for c in string) + '"'
+
+# Formats data into a valid C array (ie { 0x0, 0x1, 0x2, ...})
+def format_byte_array(bytes):
+    line_length = 16
+    return '{\n\t%s\n}' % (''.join([
+        '0x%02x, ' % byte + ('\n\t' if ((i+1) % line_length == 0) else '') 
+            for i, byte in enumerate(bytearray(bytes))
+        ]))
+
+# Generate tupples of the form:
+#   (name, <binary data>, guid, attributes)
+# from a file containing json data.
+def parse_json(json_file):
+    json_data = json_file.read()
+    json_data = json.loads(json_data, encoding='utf-8')
+    vars = list()
+    for variable in json_data['variables']:
+        variable_name = variable['name']
+        variable_bin_path = variable['bin_path']
+        variable_guild = variable['guid']
+        variable_attributes = variable['attributes']
+
+        with open(variable_bin_path, 'rb') as bin_file:
+            vars.append((format_wchar_string(variable_name),
+                    format_byte_array(bin_file.read()),
+                    variable_guild,
+                    variable_attributes))
+    return vars
+
+# Generates a code chunk for each variable of the form:
+#       WCHAR var_<VAR_NUM>_name[] = L"Abcd" "\x1234" "5678";
+#       GUID var_<VAR_NUM>_guid = {0x12345678,0x9abc,0xdef0,{0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0}};
+#               <or>
+#       GUID var_<VAR_NUM>_guid = <EFI_IMAGE_SECURITY_DATABASE_GUID / EFI_GLOBAL_VARIABLE>
+#       ATTRIBUTES var_<VAR_NUM>_attributes = "ATTR1 | ATTR2 | ... ";
+#       BYTE var_<VAR_NUM>_bin[] = { 0x0, 0x1, 0x2, ... };
+def write_variables(f, variables):
+    for i,var in enumerate(variables):
+        f.write(('WCHAR var_%d_name[] = ' % i) + var[0] + ";\n")
+        f.write(('GUID var_%d_guid = ' % i) + var[2] + ";\n")
+        f.write(('ATTRIBUTES var_%d_attributes = {' % i) + var[3] + "};\n")
+        f.write(('BYTE var_%d_bin[] = ' % i) + var[1] + ";\n")
+        f.write('\n')
+
+# Calls SetDefaultVariable() with variables created with write_variables() for
+# a given variable number
+def format_setvar_single_call(var_num):
+    var_name = 'var_%d_name' % var_num
+    var_name_size = 'sizeof(%s)' % var_name
+    var_bin = 'var_%d_bin' % var_num
+    var_bin_size = 'sizeof(%s)' % var_bin
+    var_guid = 'var_%d_guid' % var_num
+    var_attributes = 'var_%d_attributes' % var_num
+    return 'SetDefaultVariable(%s, %s, %s, %s, %s, %s)' % (
+            var_name, var_name_size, var_bin, var_bin_size,
+            var_guid, var_attributes)
+
+# Fills in the body of InitializeDefaultVariables() with calls to set 
+# each variable from the json file in the order they are found in the file.
+def format_setvar_calls(variables):
+    return ''.join([
+'''
+    res = %s;
+    if (res != TEE_SUCCESS)
+        return res;
+''' % format_setvar_single_call(i) for i,_ in enumerate(variables)
+    ])
+
+# Defines the function InitializeDefaultVariables(), then fills it with a
+# a set call for each default variable.
+def write_end(f, variables):
+    f.write('''
+TEE_Result InitializeDefaultVariables( VOID ) {
+    TEE_Result res;
+%s
+    DMSG("Done setting %d default variables");
+    return TEE_SUCCESS;
+}
+''' % (format_setvar_calls(variables), len(variables)) )
+
+num_args = len(sys.argv)
+if num_args != 3:
+    raise ValueError("Expecting 2 arguments (in.json, out.c)")
+else:
+    json_file_in = sys.argv[1]
+    json_file_in_path = os.path.abspath(json_file_in)
+    c_file_out = sys.argv[2]
+    c_file_out_path = os.path.abspath(c_file_out)
+
+print("defaultvars.py: Checking for variable file at", json_file_in_path)
+if not os.path.isfile(json_file_in_path):
+    raise FileNotFoundError("Could not find input " + str(json_file_in_path))
+
+if os.path.isfile(c_file_out_path):
+    print("defaultvars.py: Clearing output file at", c_file_out_path)
+    os.remove(c_file_out_path)
+
+with codecs.open(json_file_in_path, encoding='utf-8', mode='r') as json_file:
+    variables = parse_json(json_file)
+
+with open(c_file_out_path, 'w') as c_file:
+    write_header(c_file, json_file_in_path)
+    write_variables(c_file, variables)
+    write_end(c_file, variables)
diff --git a/TAs/optee_ta/AuthVars/defaultvars/default_vars.json b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json
similarity index 51%
rename from TAs/optee_ta/AuthVars/defaultvars/default_vars.json
rename to TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json
index 17158c6..cd5f272 100644
--- a/TAs/optee_ta/AuthVars/defaultvars/default_vars.json
+++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json
@@ -1,10 +1,10 @@
 {
     "variables": [
         {
-            "name": "Default Variable Exampleé",
-            "bin_path": "./default_variable_example.bin",
+            "name": "Default Volatile Variable Example / (Supports ECS-2 characters ✍)",
+            "bin_path": "defaultvars/example.bin",
             "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}",
-            "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_RUNTIME_ACCESS"
+            "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
         }
     ]
 }
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json
new file mode 100644
index 0000000..45445d9
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json
@@ -0,0 +1,22 @@
+{
+    "variables": [
+        {
+            "name": "db",
+            "bin_path": "defaultvars/example_db.bin",
+            "guid": "EFI_IMAGE_SECURITY_DATABASE_GUID",
+            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+        },
+        {
+            "name": "KEK",
+            "bin_path": "defaultvars/example_KEK.bin",
+            "guid": "EFI_GLOBAL_VARIABLE",
+            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+        },
+        {
+            "name": "PK",
+            "bin_path": "defaultvars/example_PK.bin",
+            "guid": "EFI_GLOBAL_VARIABLE",
+            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+        }
+    ]
+}
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/defaultvars/default_variable_example.bin b/TAs/optee_ta/AuthVars/defaultvars/example.bin
similarity index 100%
rename from TAs/optee_ta/AuthVars/defaultvars/default_variable_example.bin
rename to TAs/optee_ta/AuthVars/defaultvars/example.bin
diff --git a/TAs/optee_ta/AuthVars/defaultvars/example_KEK.bin b/TAs/optee_ta/AuthVars/defaultvars/example_KEK.bin
new file mode 100644
index 0000000000000000000000000000000000000000..16706ad7ab5d6f568cb51bec88f467070e67d53b
GIT binary patch
literal 6748
zcmchbcT^NfyT+Me$Z5zKhMb{?BuNC3AV?IDoU<ec1|%pjk`al5B*{S}D?xG+QL-pW
zqU0<{lynE(y?4Ley=V8Id*}2y-Bs1qRa5=+@2&Tl#{m;lUm?Kw{kKMfz5?$MXM8MI
zopIQ@8Tmr=!4-YmLI6e54+eqYBmfaMo<*n%$QBa<24P_U1lV}Ip(>$=L?9ec7K-==
zfP&BiC@^LgCKv<;Lj%qF?^1;)r70vd#j>iXuU>Zl?S2pex;rZz1~6e`>OnBcsWlbV
zVOj_`8>F?Tqnj&COF<qc48X+!CTb$MI2;hZ0>A;dsE83Yk%%N*SOk5DNs37t0rYTM
zfcn=npg*7CZ0Tv|hH!zY+4=w|5bGbuL{AwL1tP&f*W-gxAP`2@Yc|#AvW(@A*$dp}
z3g3o>wwSr7*M|+S)<_B5gc{i^NzF_f!4i%|nm_ndCI^}blaA&l>{vTL%&^p8e|BG1
ztTfs<ktRtKp$r~}E++Xt@D}dQX}d-LshRf5GQX#|phn!Ab!;{wrDNiCNYLaE3n~6r
zpHE6-c7%>@j9gn1pCASdUn2Ov;^(jo?k@&qylOeX$yp&?siOPviNc>KpL~Ht7<0Qx
zIOr+Cx6cAvB$HLf8&`9POL+{}w9~cKvTC;*2fQ3Au!9Jj5_(%#o9^8wm-1gp2hoLw
zwW}Vi_D~TWV?|yZFg0aM`SF8;#K<+;359N8Fj0BfkC?HZM}sjz7@%BTKnEa1FCim2
z2y_7f0~o;d%Mu784M+w;$LqA1^{dJAMz3ilEFWd)W|IS?Kb7$Fy<uOjxq>_jdOc#9
zsNjS!`ueG#OJCF@sXwke`dwq9z#t5L%pR;scmpxZbG`5pf(6V}OuNGuFIR0?x&_UW
zjXCd!Yb((xInz6Dm%Q*B++=IR+t)jW$(cY<v3WAZQp?dLV`0Yb97u&4<G0#{h2rad
z<u#TOiCnr}tp&7oEK7B}-rJsv-AnH{vxXg%vdmVh+HQ%5%#|`tseFF#@;Zq8Lc2Ku
zXJzN%?W8H8Hln&rbriAah|h98#xAj>l8gD(q~=!)3nv8KEE5$M;{-;~=-IhpoF?}7
zWi+pe*IenIW8iev5VE8TK0Jddu}HibjQb|VjW6Cm+8-`MUxcKC8yq}aoO7GP5n#m*
zw{dj%XrklX>c4)Z&A+*StIK-pWP9~7Gw&?ss!z))|90-Z%sKT3>3kwDN_VvaccgXr
z2Gw+(pd3`gVq>`#)_Fx@^``hR+$=7~x~hyD9t_;bz@tf5BiiDqt&1#$@<FrM?Ur!G
z-dC1+U3XL4V6sPZC^@}ON}%TcVMl{2YD;v)LP7I<&R?_T5ZVT;8mXj7EJGH^PFO!z
zUhP_>D+u|pT*QR>(nP^pcRag!8Xgno;rf!Z$?0xHvpj*7q>*Fagp9>DY~-9&Gst+o
zHg{8BhD1$#?Q4qT>*@Yp;O6Gzn^wL0UeoLzLM=-i)6_vuCuCjcC7HNLW!asOtMfC>
zHNHLu23tvr(-{{mWP~kQU;u@MgT}-5Z+Lj~MD@+S*R|4{OVxXm@7aC-BpHAlP709x
z`m}K`Wv1ii=J}sI5Rv=~5B{o6^oW0@0QiyuU^E5LvTO?pp%{!UY_4xt{h>Gqu2dio
zsVNp?)PYexdyUNApXGU>NssK)o^QT|(ni*t;~p}Twn~sQydq!1B7go_x^1Y}-7?|}
zyL@NW$s1wWYfB}eIi75HGb2r@NpK{#bnU}uW&mA3T{Qq%wj(Vq!Ttn(6A}M#NGg2a
zIPo#Zg7cX&5&0qqZz>pabGeob`m}TxPcz8tfuG|*vdOh~F7=~5GbsS0;=yjdi%oxi
zc<GanY>n=$-Y2e)ldZ3z5Gez@9@dXp9?GSYJ>^h)cEaz}1)eSBSz%G7z_7q?OgJ|$
zyd(IX6f+%Q?{JLLZRoM7n|P`$6-G^+dE~`UU0myL$hWTH-D6v@zxLtcI;XtFYpe&J
zoAIBkVF3|XlJdfW!rAeY^gX=$H;yt5C$*8i$ar8e{brn56h%)Xv{<}^0k1UROYJQa
z5h^a@w4j$a+*48xv<^3UXS0dLjFl6%D7{#X1?c;b8k2SVdqt|Jj@HoxQZfKbV&M0M
z@>_yAD@V^s5Vc~$ZOtY&+I+*uL`QPl%PR##BG<bFi?=u#o{i<5)~ZZIR&9KZLiX%X
zLLi?-3cJE8&6-S3c`DDWG)AtOKVxoZ<XwnI&A%1NAAvJ1v)`gJscpDcA7$Dos=48E
zvoHBdotC^09)XHtbT)6|6JahMI@aTtdlx)@zbI%3-1(`tUlhawFwrmsZu|n_RX{or
zN=C<6Sl=waH%(&P^G(rxB%AVY6^eomIQNh~LP!>9G`;c@<IyAfldgZFP=hiJ?z)^k
zsL+U1y;#lLU1XY_xe+tnW2NAs^L_S;M|WMwA(9Md&qledVOS*ftl_*tDnRDBj=dp%
zp1aW|(rwcX$*aYKH81|w>QS>IbJo;)F%8V&%>&Ws_g)`bOY*8h9;pwT-g8I9dkGJ3
zzvIT-*$t(ef9<trAWl{%F2haNvxU&{evz_j7)zBiQzXE15ahu$TJnu?JjW45tf3xp
zQWu=pqRvM<`Jtantj4Lo<yi8j+~=a<>>UQe_BmU)U(j+=eTy=)D5ESlkbRR`zw~O*
z7~4bq2|q_dezWh79RwYQYW+`AinJZS=9|lG3W+Xs&*VJKDax|dz+=8XhM*|I(|yON
z8~i96@!6j16*rJoa^gjWjilH#Y@qv;$Cj1%c%Tv5)w6fa<3w|D_ZVUGjwwSCdpLOb
z#o>zR6*s{}_#=dfA1^_t%HgLL8!wj6pgvw5A5Dg#y1f8~fDAuaM{h$4FTY`#R4XM@
z*BOI#tU}>(a9Dim(8YPaol?Shqcb-~+hADkmdL%Zh(|(`1f^4q<)JCZQ~F+hi87VV
zPm7;PbktKV&9^;_oz|7rtDejL^uCoQhfhP^KV9y}w9$;sUDe<&fF@vgIiA~H`sGA^
zH&+2)$R>RDvzqpD^lN67YD}e4Txb`Wd$gp?8XImA6L?@cl_-<~jY29kfX;tI;Xg#r
zzlpg22|`ieFChFko2!2!WA}i`eaY!Z;w*PjgYONRE2OJZaEqQ;#}?ba8zm8MC}d*{
zwfHfuKy`}iACT#xc^ddS_+yBU=^m{tmwonPt@`#_<wm*Mi4o?W6IXYwKmbw<xwG0h
z5!ii@kocKgL!i0MhMOs)Y1ZevPT4NQjZkC5BnGj=o*c<MntcS!ja=gnG{oC*B@WSS
zkf3Hdz|(W>Y2JeGZO|Al<)VAZuF<IvGgc>Kg<BMlb;&H{ow?;|yayy!1XjT>EsU0w
zg5D2r`A46&6qUAE=^0i|_;%lXk9&i&;+rl11|5s~60O*)rS7qnG&~A3Xqn8Wi9xO}
z1Z9-M-NFBI?#uDgix8hOK2B1pL7zxA9Y6obJz=KZq>F<N6^tcg7AGrNF`igLjwqIi
zQi+L_IEVSI01rua&Q*~USRn5tU)MgxlP6ZOBm&nC22@0w3wPSg^bd0skeJ))LFaO6
z-qssm<uq)r1T2g`*5s}i<1HmlUwwJQQIkKR`XrL4ajDJRCU+?-;=qRX?M&|DD<$F*
z%SGNcrm%L7hND&A_QBST;|mSrU|N`d?rCLpt?X;X1SiMz1L!TmcG&hZyQ4B`_Vg&m
z`SZ;L<B<0~Z(|yD(v(YG$>-NaKWY?zKhk<ny`?Af4H34*UE@@(l#1t`<LRu|?OfOc
zJlu>vr%ik5Lku6+{+DFL2H;K;*W*~+dC2Ap^(MjpD;fVG;{PP0-6Cb_{Blg!70&Us
zn1Sk>o|@H7wlaERUgyp%Nlgp}p*Fb5Mz)h@6P}<L8#UHe=?YNm$1kxn7$3O4FZa{c
z;8~?cemWC660y?M>t9&eAiWP$jgi;%Dkr>kn?lKr(kk_gsPdR^%{$EXhuA_R8z#f!
zq3+r@IC443YSEdE)B{?sOt&&et{QCf_gSw695$@)XQcWh(o&K2H6OYSj|VWXkR*M!
z4Rxl3+*kGF@7xZ{#=nsPhifG-EH3^i9uC`BUPBI5YqUtkF3&^759Rd6G~b;;tPh`*
zDP`W{-SZ{l$?xcZdZtF>Y!y~KJ2a&I+TWPljSBU+u^2*roZ~&$bahFYz2H2wuA~KO
z9AVX&ojwLKN_H8F83|&uoOtP_m=`m^2@kLoeG%NI{KcnVy(^r(;E^?1=Chqy81Y)Q
zz*>fiWWwydgVy42a|1NC;1zHEPF38&SVdOhMS9}lb89#G9eCQsD;^oM7y6A!{LR1!
z??Z#be7YXi;q{0dJ$tRCSLH6k_fnpPIKF?UCh>%hIju?fbSjDcN-%qc@73N9uKpGF
zVMDg+L9d;fmU`~?-<0Cjz)W3^LP@8o1y^+&+cD)%t<aM%NQqhB7LZ*)fQ`n%0%ZFy
znF;vff~2siJVwgQspn1;TUk4=v}Mb<2qct7l2WH~DS<QLD3B#OK{G`soPhYhNfG}(
z&-`PW`iHa=odQBoAPlJQ+Uzk+NLs}G(xpM8M2Y7kBO%(n8_yl~0k*;HTK2E6LY#OF
zw6058=*J^wnKD;y)fbtQ9=KDekZ>>FW|a-??8ummu&aag;K|(~Nj%|h+u`5YnCXhV
zd3VUJ&{66R#NK$U_o}v4_}OT6=RB>QJI>hy?d17*XTGc4Jp3b7UynW7ku;k3NIA@v
zq7M0ocVAMQ7u7^1SLsuGZs$Br<P;?-HQV=G+*>Us;Of^Hp)?N2SHduu!h(m|`Aj2q
zRQ=qOVVLgq5)1QA+28g@_F`_Ql6@p<_DQV9U%<rrAYmi7GhT#MEqp6T{Q9#w2g(}g
zooT%L>3m9s2&w+FY{S<4g~USDu<DnTCVbxzs*qnEfZ%WE-yMO=GdiiKLx(ExZ=uTh
zL^;`hPc`#aPL=OAtpL@Zb~pd#jr}QhiT)*a(ZOi|s$V;QlFOa{ZCh(3!WMS@G6DFf
zoW71A(E&XEl!=C5JTq<*hqYjXk0A)>i+!gut*6MU3lgK^4nE_T2h{e%Y`xmO#6>4*
z&eL`lMhg$dtY<*iAA7yu<hvEdM*j6XhOb#Ymd&sQrTeYSmQizEsm61QzDo8aLLH^I
znv!MTy%hnI3Ix|w4{d%siM)0XY9c5_VSJ$c2{~!qh8^NMrR=tT^_W_LJJa20)PyXk
z!mj6=c*Sl!Zr3iI+ce3CuMA}GGFk(3u4N}F!|OgXXwbZN<mKC?v}0xd6mj9<7iMt*
znJ%R$QqGng#z`K|87PpqcsI-0QlvZo_}cK!;$ikXQ$@}6`7BQrtIj|_;)V$?E_egS
z|8q{yT9EvHu$XEstUbRH3Xc4ilSr+|5kr$QBb72W{V`{NGfFRlQ>sa((s~eK@x2FT
zfO3k__yNnM#rDQ_9V#!E<+M<(RD1M2b==ZMXXwIVv3D)$xjJj#`}kn_yAe}fQ$!3j
zdGDk#Q?_e{Uj=>eiL1`2dZyJL^Mo!P2*!XsF#qBtp{kn7_3D9ta?ZmQDNw=v_Y$A%
zdi5Jpd(2np%<u{y7njSIJVj<F7nEhabf!I_@0Vs==ZsJ$3e%jb&OI!R%DfIcA)oGv
zUNW)i&{Uz;75uCn9+x=&t#msASW_m;kR2oMaK9>LWa<_%*Nl_=4z6XIROLqeb;XlJ
zG@s3sj!NUL_%vO?w%5~1Y_8ttZ2|5sRnNxm_v&g!4wSfA&3~kCY!tD{VpW*<5trln
z<4m`vp>mKuEF|6OPK*V~Ku4wAgR&9r9K(vCfIas}=iD-m`OI38ALVUygRu{rSga)&
z8)Lpi=vVNn{pjLSue0G>4_lG+>N3UuvQ{|7L>XdccwdL}9$Y8@pY^tLj8CCms+i%V
z7jtRy=WAyLkMt}1{FF0a+xjxfO%pr6GAi$vtWjQqdK@_?H3}I#TM;+P$2j7r;02cv
zbH{xt#Qrf_l;FMs#cWUZaci)s><H8nECB5vbw*PZ7GqPtrgLlXD2g^=kH#V6Fg*6n
z_%lgpuz#`R6zh)+`E`xn^sWFX%)wtI!MDU83jf)F`Dca%#lZ;xyh{LJlY{kc!_k)0
zWdWBQ|Bj`HgQKgxr<*Gr3J_mb;*jI$*xI<bx!S;)0EWvNd~!;4M{9(ehnt-zOu-G|
z?uM|uG!@}!KkKp`lU(?3+hMv6jtCo=mL<Z|2c~X`xNGa_?rdpo`#;7591s^46$V7%
z!k5N_u=uZ{*kut23j9BrGcUmXYtAfxKW8;XHMIYB>6OC&5sjTI)sZcwcQ`9JJJyy@
z?)csSo8k~ns4jZ)E>)0hxU6pkyqPz$7WOBl)+C-MD3qW~c+#~$8(f*1#=pE@8#jVC
z_q7#LR01%}sC>uPO0_A}4(JZijDdyrp9{@pUZ7exSNr<+ZaY~?5h%R*%5ip%b^NK5
z;w9-<wuor=+B`<}jk3k`A5`t5Z9Sh>I)xTfw%DUEH==i=);d&A6iCSk9#$*IJ5Me_
zBG&gsAnQ;N@4dz2N8~aW9C$(wUP>4Bn$44?_jnD8Pl!MITwO@BmG0%?%{)aI=B$^+
zZy$(}2X=us7R-Ayy!y7S<J-!8<br*|0_Js!Rx<o>9AhYdp%DerM6Z+@0L8}R!v;Y>
zs4J8p2->j502t9L%}5NPf>2nUD)eQ^=JnW<eKa1|EAi{Ci8Kdj|GNVP7(&Q|k8v9V
ziD8AIfFX}I!qGiRAeWB`{i}<>eA&tdLC3T}3Pn2|g}H|Yq%9*F&)M{FrKMP%iU5<#
z8<-(_z->S~OEXJ7RL#ND(_KnP$Qt1+=<>Uk1+Cp&gxv2sUe*e^|MJQ`gwV1;YaA_I
zv~JO&MVn;iXfXf+=mQWFMBfTnVB@0yC>9nD2n4zGdbNHp1K`jbzYXN=?frKH*&;mu
zc?8cteZD`p@t=aj_bC!-z#n*JPI%)P2uHJqc2;!kinem9k-o7Q#R7R=Mr%H`Z>~6L
z`$26E=4^Js_RWVy^!J<U`@;=v2uJR8)8?9EjeO}EbnI7A6Rur1{Rr&0?$_1d$I0b8
zPx~UOAH0G3P$tjeo_=@rJeFiMiFt83k-3VOFk0<`n+NK5IO?B2<n;!t+h>y`Ha@-m
ze8%meGl}1)HpMAX?IcN(MKk>|8my!}oPz7Gvb@i5X?O4G_hyE&<%RVWoEbd)<Y-SB
z_b_NTfP9fCDpDpaczwRVNnx>6AUNTP6Q7a)jUPJ2LEQoj4YN8k7^Fw3SKBNq=0vJ<
z!-s5X@#&UJ{PWsSVHy&ZLPT#V!racH1sf%6mX|ta7y7t@w-c{#^F+le$x8>(+m9V9
z7~1v_HJ)L_YwjVX3tzCGYRSv_%nE4YJ8^lr>TD)C`jwL$hG7jVwwK<f2x2|~AjMb2
zEhkhR=|#sJHb=k%&WVJ>1J0~IrIp_rF>{nGUUcHLv!Hg)c2|6aEn3D(@>wa=KD3Rg
ztv|SSN33c|6ZyKr0+aQ2S)32!NSZt|WvH%u)ijY9iGPJCqCVL|`kT*sP8EY`4pm*)
z+g195>SPW#iOl)9ACW%KIvj~>a~WV*$wwb3$}mPdzqe9Ak#|M2=&MsKzME9My`v%i
KQ8>8e`F{bgmn&8P

literal 0
HcmV?d00001

diff --git a/TAs/optee_ta/AuthVars/defaultvars/example_PK.bin b/TAs/optee_ta/AuthVars/defaultvars/example_PK.bin
new file mode 100644
index 0000000000000000000000000000000000000000..85f63546d04b89dc5aa02e8dec47896a20c8f260
GIT binary patch
literal 5189
zcmeI0hf@^E0*BdMa$K_HU2@dfC1;SFc7X#Vs{|1w!;%$P$yq@%5+$RcB*_>MB#WRT
zQNofDBp&IZ-mAKIcdzdLfa{v72{qk4)%}~V=bJeqFeRfT8Qy=(3f1`$c#AUU-4pHU
zn;Tj&Wn#A_P3%hmEY$!Q1VT^&6oe$#A~Zqv5PUF*01qG|BoU0zjM%3D5rOisl&Sz0
zp9R2zA$brm2n>dXSP$G{h)T^;Np4Nz)YM!4Uj4WGL1gFEIT0{`oe*M-520m5tLee?
zJ>Bduw%(3zt}uNSWf&4bNC51N6bK0ffRqFf076XEoRLCQ8i5o&-^8WGrOg2r1QWpc
zvkmBvHk_|}-*EGEf$7-$16UB}@B2J|WC#{Sg?E0P6pRId@bYT8v>z(4J&EHkcAG7E
z9U0MX?V{HdIkH?YBccU0cTks^o-&6eABwiU^{+__u|!gTC`{h6b-t5x9mSpQryyPx
zZ;^5#744}3{sdh}4Y=)#>@MikWqIGmB#9IDmbi$z_k5L*i$eX7auq*xVi-<M`o;gf
z`o|mOj&5vx8&dD_O<6xj3w<FifDi31gyuYJ-y<qmqF#E+{PsOv5XB?fc`77ivlSWo
zfb8q2h(6WCQ;RkE0?H}@vlWAE1D(8v&6Yu*o7IG&<gLkl9m}mAezY<{OW7dih{zY(
zd&|8H6o&*cXM60e`7(jR;81Z|)C=-Us(9=SUJhf{oTu?%2nY{UXapDn<mW@kMhgO+
z;e!D@;PUq~5WXxR9RmH-sLx?iM_cqkQ9l`XkYkij3sC<^!jE|){66L?%2?>-XdFfH
z5qbRO<3N}G*t;^nANTXQhG4-UJQGMS!33h268_LQYK&|ik_ox7Uskbf2k*XUoo2!7
z7iFM+LEV|fd9$)CaA=*YlVsQU5T;~_k4-9)E0@8=SALANaOc6O)LXnZC@GOx?SE2#
zJvxQYsH>xxsS&=|xb3^?t=7HxhBt5Irh1<B($h{|iSXGf_DRjr9+%os+B1W;WTK_5
zJHMn(Uh1T1%+<qEijDc>n(($MrPW=o%BQwHW1T-D>xPe4pM4@ThsMv$ju5qS_dLE(
zOS$68{1A_*tDYR5eeuo-OdT%ueCXa+8GcfUfe!;waxA47W`yZp`ogT+B#{UwVU(TY
z&3BfD&K*Ik2L{6HySiPr8%LYVaU6m(kY)e&W8uw0kK9?k+u1^*WmVhyAzQMBLPI)6
zPEa0(5%G_O)wV^Y;!RehFycHu$Hu2Qs$Q)8n2>`BS97NF*p0J1l_x{iNt^9aYJJbH
z7j@mr?1U*C%wm;{U(o~ge)}(*U9lTtW7kyBr?Wxm_I+q4uxzfGC56MEr#a#rt&#6q
zU@i`Siz{Wver~1XY&@J<KaNU_^m47>ZFRa8-KI=tBW>>3KQ4D|6E=2AjSjU~Z75tf
zk)zU)SoxCSSUWY)2WYLwY1#Cd_)KwoU20$CnPLoeI-==1t;{9HXeexj%g;@>)d%>S
znr@`3P34@yX~^62zyOwj=o}B5zv1C|g7))WAH^!I#k!q|9`1lYL<XQmPy<vyUv1*=
zF*9^?^Zs8Rh)Vy72Y=4yd5?dl0Qfrvz~>Y=k7Z|gINeZENn6tk?O)Yq!8Izh;q~R>
zY=$uU^jb{*?u<Ygng!EuFxRGwHNe!L67O?RcSzB)KBHYEpnW(h+d16lem(j#xALo}
zN6(Q8ii?#I1>Rh@a$~F*sfeUDj2xn-rvaltBOL(qcuQ7RiaP<J<$3?kuuRmhMM@mc
zyz_|$1?>WlU?vz}3)esceNeScf)4e$9q2fiW~unbrRhWObOyktwzvJr#ctqHR8>NF
zKB_yfFTph~%~lcXnK8KSWg7>-qm)hafJZ0&NZ6?hJX0dD1lOj+yGGiQe0sIy%EfQg
zkZgearDLp7bFW?F_yY}@NJhro10P|=@`fNYp;eS`uYK|E%G<Ncyvo;V32u9@-yf}m
z1xFJ|D<dx=^Y2fv^a}2(9^{%$7-0G^_ko3Mt$Wt7biFOma*0Y-lB(d(4Z4=1415+@
zp%tp`85w)}`|E-;`IO=o8p#{<KAaXJEd3bNMC0yGsrIp>Z9JKb8~{%V`8NMV_hP})
z!9yy~261F(o28wB(8wXhfzl>!sd!lQa@WQ34PMstk447~n&UA~*S^GJdbjBD@kd2V
zx*}_=TP=?TYEEoWV~SVPIbN^{&fmw*y%v2mhG55W>oQn2G%Gg6TD6Fw*Icyv(<B@9
zmHkP`G}Yqs1yd4`d;-jzhZQ?#0)am%Xa-#Qk+z={Bmf}iFa%V8f>0ii4S~`yvz0Wp
zDep{CS@eEYb05p6|I378p@Yu7)OS6li&3r50>uT4DgKb_A1Fl8XCYj1`9mr#811v=
zqU{CtnQ7I;sa_iuFT-y$l3v}7;rkdGq8&Sp$IT<6nJ3Ms%`(Aq4-Fm6NQ>Of*D-GE
zZWuv*0fIS+*EV<C)Hw1cSIaNJZa%*)7T@FZwxhD>Y4}~e5i1XO&-*^ek<B;!kge?q
z=DAv*9a9OKMhQ87=H3lYL*KHDWwRuPg6UEbfxS>K_79a`**+CGVkuF2(MOG8MeTY*
zOcQSh_{8g-2HFp$wUkCnNAkB=$zROcBLYKlsZH$~9Aaz={6M}Ihe?%u=tr(Qq~n2(
z<igh9;%;8NIouF*lu>Hn_~p@6x%Eq8^WD=04+={2>`^2fmp^*am68~}VKWN5o9{X5
z!1s(F$g4c^VIaiNt(!G7zc1p-D~cOzfp+!oD0&^C7q$;Q?cT8Gs1c5Yjg;*#iAlO$
zTtM9Q6b%$4d!@PmzTM6TJ__m=H1tQa4ma)uvj*n`!d~_@X9x<LJ(lU9XYV>;wM|kf
z!G%TM&m2BGeRM-T`BRHCKVIihWZ{OWM`ZNfOA};OlWb2SG7cwAd;(MCYT6!@r%SzT
zVpyE(ypuF#q+nb(oBzJ2<3fQDN;xQ7>DMXqX}eq6VO_w5;1S$?es|f5@kiZ!#X{lh
zh?!9x16+J9hh`l_y^0vxMdKbXEw{o&T*?j}oXVt#pgTt)!#RLXe?#Hlte$_d;{GoP
z#ehG7@Sl8K{T&&*2QB@ir|wF?Z()aeOxvnupJou3CfFvGJG}WoCDB~M#TIex*C`c-
zW8$FTTrc!-NNw1=a6_vdCIvo+{DlU+&6S$9Cpt&wkR2z!?go)yj5ua%xn(@0doMX<
zloln@)@jGjp3^$x|IP66Hmhocg;^@A_<nDJbkT)fPna7m>IyX6*KFyYXParVj@6(*
zui}HE`G8+QABpJ~+$*=ukNr6aUa?iX#R}L~&d^_(#nqAArm`Wk39GnfzNjABGqMpB
zf81VL)ox>KRx=*Zt<^)U%3J-_UU-ceuD8e}{%o=P<5Ct0oi+5a+`6S{VE{hXJcIwG
zaK-HB!^N_2|HneS)G|Z<F<gd$K`}c>_U+WOy_cGJixzMv8wGKJByyfu_;{7nc*eb(
za~r{4(%ihuqDQb0!3m+RUAlw>n<Od`#l1mIv9^+}PHU6>0u>BoGduKDNypcA?TZr1
zPBM7@LmZmFNnEgsGJCl~)e$Y6Tz3>B(6ZQh)vj<cFM7|8>GgDBoMfeh6t2|Q&I<N|
zr}<zx;KfkK+Tj_>B8&-UQg~cb*Pu|Vmh9x1y$993_yV?x<95`b&Y${#clvNW*&@8B
z_jO{6VU|XfEA8B>*gI7Dw*&ni#tmb+ubz<`{Pj+C>X{_&1>Vla-OeSwz@7E@Q>Ls6
ze@etBgMUayLIB}3e)%5UU4Uk`#CQVyf64eaEB+5M-dLcon!_b_N%DSLNgS-x@<!LS
z+RGV>`<yz%Q(IY0BkYLN%<U&m#=Sv_b~>CLvelrDcb}7{@!s-%!woRklh|a&yg#{g
zAZmj)9++QRqxOSoCn}?To{;PQLZ|LVZ<BdKQFAD?;v4DutN45i7lbu#xVzywky1gL
zPJC_)<DkAPyKe57yy>QJzwJu!e)H;XPNshf69Y|u+rHb#r(ljHs?<^Y2xoeHKW%T}
zSDTUfq^daxgnrum!osiRBav&k70hrQs$C`tHwTs2S2F&Hesh9vyPxn_J=a5UCxAlW
z(aV=m@633jjgsp0eKV#n11*K!*a$Dxg>c%#0^iwI`9%%x;?s!6%66zlw9Tvh?2jPx
zG?(GTu~4q-;}t$?MTvvFh~VpDWnrBfpZy2)x}vy?@7mJjrf<!_C|Bx4R&q3@lV?2k
zI?BJ!4qmVaFZr6h(k32CQsYD}uuzVi+PW!kA+pY%3CLNOnY5$|w*g~<cTD#mG52zg
ztVS0YJLoSyd*Xuh$Vd-&?0KUjmB7rA)rvfxOy!mg<E{>n?|bVSRP7KsY_Atu>(si~
zduu>TMi2$b#KmG|vvk6qc3a$FFPvOrp`DizxBW##VcrvL{s}BXvs=MICUh@UhLFK)
z?D18`+2fQB&R3G1`Eo8I$yG7bjG27u;9LY2bp2e=tj>iKkoYHx_}8BKdrkeFcAhIB
zJ{E+RarMK_OPcM;3~7UdD>V@82KBqiNGdd`O>KhGs<AqmI)iD9TER3Yo$FhRJA1cc
z6E1NteWKD(<*Gzm%>?(kS~bX^HxVKMqPIr4geHxRXE=LA==40YA4H97l{!Cka1&jb
z^pk%9zfg1`xatzA2m6fwT>_-)IDlfMjGu1+yQYZPhmMBPc=_K*#Me5zq`YV*^CX2Q
zg<FpOATN!_!`63>axdG@#Pc2Tyj4w-TN1e(*MjQ7nm|7WSRn)aa(I#RM#*p;tFrLG
zK_>iS8{e4sm3|8YY939ZTD>r2S%s+(YO>v7Iv_f8nPwGqlI*6KHiFfY9MY;b)Tn%(
uZ`Sc>KBYuEvaW*OQs}Fv4*t)70GH19#(yaPO8vi5|F6{lEA{_J>i+{K4AFA{

literal 0
HcmV?d00001

diff --git a/TAs/optee_ta/AuthVars/defaultvars/example_db.bin b/TAs/optee_ta/AuthVars/defaultvars/example_db.bin
new file mode 100644
index 0000000000000000000000000000000000000000..3b74d60627daea11c247d2098cee03b50b101618
GIT binary patch
literal 8903
zcmcIp2UHVVyCos?PUyWz2b}~$6X{6rMY{A3i9kS#l+dIX>4H=N5s)HEFNzcq5D^ii
z3J4-iKtM!!L9hSy-Rpbze`~!zD=V4r%*;98I<wE-v%j-Q04ArGAi??hc~5~o0)HgW
ze{oM^&Sg_Q?vB_s2@}V107EeZ27zD{02w}!O|%-w5f=gm;o$%z_(X!yYS9N|AOcV!
zhFl52K$rjw7+i=827$qp9$!?mocA;ew2JEkw-`m}PH+F?dJqZrb}kqPz=n@&48euc
z>#AsT=y@X@(DuHrNG}dOB?S&R022q;=*eK>FaRzAzyO$-m^nR}s1yt?iv1#_5K`s<
z6N~|%`_Tu*X&;7;_GoWM4n-u=7r=nHejO5<F)ju~frD))24g@VoF<ZV7w}{T8w1H?
zLFzOCSJ}D{OE|$B=N?r?U(xrTXq?(h#H??w(L0ZEKhu9kUh(Co$E=f$`O>x5_H!V`
z1iyg|A*~p0=-XYKK<gGfhcO#klvY9K#APGtwr@5=b!Re34K6;>m8#kGR{<<*z4>Ma
z8E-$LP|zR5OoittO^)14f>JfDJ9#V8%5Ir7zSb;5vAHK=res02PJ`RxwL58qy*o_E
zS&FA`S*ZK+yTXd)iZWGUP2(&&4EJ3Hg?4D2xY%FDp7;dC*qlISt7$4!i)6<Lvc`%>
z$`ow+=6O3Sj208*#y&0|6!lrD=;kdJ`l{LWgawhePWkb{T6w^@ARJJM5nuq2VrP&Q
z3Id%#zyJ=Qcp8Bq=K-lO%E=}@c9TYE>4co#jg`ZEqar9k^&JS`9~=JZlq)G<C>3K@
z$jZKuCMq5Wc@D)#NdG$T*hh_v0fTV3%CZKYSJJJ;Ji1*+369$?PN!GlNoL5Ilg^o$
zeNjBZ8*d!TE8Q+rXaC&WW_OUo6yuhxbHq`?i0_Z@HG1!!EU%45oo2*t?xd}Q!RU$0
z^0T$fTiRSh18I>8?y)m|Gh{3brG4jdbG9CgHH1G6NNvoo&(?dCoWzs|MB+fMU4G*x
zsiBd}*KjR3t2ks;8dP?5K=P&2Gn3Zb!ON>m)<oqAmG=~?GSEd?Wi^F&Js7_*51(iK
zz#FSd7Na}USaMJuU!chG1v)#J_|DSdv921u(b;kR>#6CJ+tpjKz?v#`zU*u0W7Gv{
zb1P)*LI*)sA570GvmQzQcGZ_c>^8R*6P?Zz@mZ#_Ex(Lue7<M5x<gT(_1UklJ~Psd
z8>vFtExurGYZG-S<WibCN-g$1`fBu`weC4{OjMrRrDPk5k;irN*J@tr7n{|NhVG%_
zJW6VK77HGV9^LC^dY%%}&S@{n+Lrt#)}&TY^Qf0kyU9W5L(Hm_U#}JMo3-*8Hrgm_
zv#SQYS77HtiMb3tk^{<}auH_Je(cp*<8oiiB24Orf>aCcI|j1K&yssInBN<gdZ7A_
z(&x}4v+bN|_Nut~ZJa}48bNRkIe+S#a{Qx-iW{g^O58_T0mxRHy2oL9XUjmJ4to-5
z$}92d?=vA=eJT<y&m<C1^O$`O%m*-d1Xy<1`hy*slQfz?`N>tQziZr^9yk;D7svom
z7!^SAV`USb!pz`wN&h!G5S98H9sC`e*b)EE0^m~?0ApDI3(M}PD4ORf<sB`LG>%jj
zz;#N{s0Wn@Rs#;&?EC1VPxAtIbeYjZ`imV}7=84EZ-fWzR9%u#mImlMJm{_Q^WCG*
zP`0se&M5TMe`$ux%Dt<KF81YiFNm|Ery!8rG;+Q^HwPF68EFFOnvdttOP)!Bse7k|
zj7nesWRaf0v*htrl?=MfBbW<@sINSvrp&0`A<_-^yB6d+l4U8^=h-qbIF|#ks_gIF
z_H-D&eZ4v<sz|55@L7^qLYBQ8#ye+Z$HzW_Geka*I)g_u`-`w!FL=IOV3kvY2FHfD
z?Z&su<(JOxQsL$SXCAx88?_EPG)-lwO2^RC7aaNt(^ozWHWT`w<3H$F_G#_ui6XCp
z&3(LUz8h)djU1t|cv1@Rv+$y{Y34z}Ps)b{X4CrUXXrFwIZr*+I-X{*jj~d_iiM~;
z^vy#pOHn#Li<{whl~Fl4`+5f(g7Zb>2n*F4o3wsh79z|;Xr1Y%PkR*_$FBB?B+@bf
zXL{J~(mk!S#jA(6D7+sc;N2aT4*Ei4pUDp8w^mlmMnx5S&sJ{ovShz5J$|S*6<5Fh
zHXc3rkro0O7cK9Nsk3gkJQk??YNzu`?s7K!BUZtsG|b`?(c7<JY%6E9=qw+$%C*E>
zwTbDjd#Vp*Ni^vx1Q3y^sU#K&rYFJq1emx!-`zVA2>QW-X27NIX#2r}cmOVz3<2dI
zM0f!>A4W;d#9H3cp|CegVKKO^f_ha%`&)!!C`UX7sUp0k%5>Trf)E16WPic+cPiAO
zy$SPLDSEEdhSoTFU%Io*Hb1AFJUeKo<YTZqFX7YQ6m@{6CfIXOt!W(-&HdW?tyMZy
z=9Yo88F4Afd;^W#K%xcp1n?HcpV&oosIV8#e5hpLaB03KmN?+|w5zJLJ}N?c%<2lt
zJIxP1w$;av`*A0lY4N__o~bx>lei2&)8MAJf&ZPH_hu<{#d8%R0{h`UY!g-6tdqsA
z7;+u$*e^|yrJdSBjMGnt`4A7>hC4q?smqU7j1_%kA$_#q2nz~d$!zIVWfx<W<p+w?
z*-ff1gumtvA)X3yB^9>bO>jBuGWsz1OHPHp>)YFxWj4-<E%nb8XB1ZyI_eOyE57!o
zsUR}yV>OD5DDob6=4;>w3ah^O(cz<MHq2U?UY2qfmL`m}QT7h*$@zTIUEcZZ?a;@T
zuYx}oId<n@RZIeTb{Q7oEgB?9(xZ0pveUtja~w1zXb_;wGTO8k$`YC%#PRr9YmT6>
zS&eiTEnDwb7W)*X@|DP#wA|5?Z?~N;-k5Cj;K%8H9#gU@dL<?{;@mVz^$hF1=$y|p
zCVoNbGIbppmD!SyTj<^`c88?Q8p#?rE)=~S=wc`q(oqP`lRug@pL1~6i0lOzLdRCp
z_)+KYPTlV3D-(*^fX$C<>aQf;XIE>)y;x01*-MQ|l#*HFCahoskId$hMbluZkPb^g
z-~OP&e^AfgDDHnJLNVZPMELK#Tm2I=_K#Rzm70wZ=XA$BA298xJzt+gSdnC(Qt8|`
zK_T8+&dnNab2O_&cT5-@THvF59CknQMU;Wn9-}OubJ6lc?X9)C^?RCM%yIYJ`1&7;
zgrX7XkMG;2!ut1bq>n>&L^`@1_}TK?=L2>PYIazZqb<xbSr7+<#ZsjVpS(GcP@PMZ
zQT}GDsoou?H#DtA1P0|YN|yo+L9YpEmr+$a=Eni-cs;DO$an$!s(IQ=3oDI8*C^~r
z>>}^ln7_LiJ}|Z!oOs+>QQc{0Y*sfF*snf7sLWft?I^s?#Hsy`5z+9j|MlukA{uMT
z8kr4C(~>|4#yp4rvGCo6H=p0#i3+F@;-!*)9uUWE5ELA@2WQ*KJlTJ&hV#yX)6Gs6
zA&^4K6VEwSEjg8w>aw^Q>LYcA_r2&BjxfP#q25n4NlA7o6e4o_BWhwD<sZAPO%95c
z(70Q9;osyn{q5J^%Ii2tgf2}a=<>H91gpvO-rrSr)fK+c_$5xD?Opd}hmv=NvHK2;
zPv%MzB&x(ES1SA+tT-O=v>v_>eDu6){qu>AMI<AKNy%|t<3ri|DmUC*^Y$sV&OYMU
zS~=sYN>wyFf%EOw#tn<8fx#!qZ3Z`0tG%F$AH-hhRPG+?4bX2I%WQkcZ1O*FYrL3C
zgevy+Fz)v#9|S@+62CFtyc<9co7Dd|nGqj=xlJjia-syN7s`#N!T%#O{)6IwXGW)G
z+UmuX<X#Eh$+hH>Ms;7^#&$;;V}#!~56;YX7Sm`4!Yp&g>9141pkxP4uCDX7psp8h
zQs!`;^6jn+Gd&=(%Z+>a_1vMTov!il(&{?ZRSu101zo>;q*{hF7m>7fxnIfZJ`1h+
z$9NqfmfE;+SrSJ3A2t)n7iVcE7PQfi=y|be6}-A&x+OehzZQDX`r%W4Za_LC9raMh
z0dj0Ilzo*VbKEi7gBEgC!&kUxE2fB8IUfeo%UW7qKB^pxSzlR0k2dObN~f$WQi>nQ
z8^6}=`wFo?NUFJ5a7A!0kWAqA<HwY~xrqdu<+a%dW{hu#+e-Q|(LTz{QP9uD{tN9F
z-l?7``xf0))k$d)Yu8hh_ZnoL<vE)CDxBMP>aL$kY4Qj!EYw!)PGq<0n}A{M-s@+|
zBJ8OPvOmsqkgqk0tmUgo-I%|!-&MK2Fv8#nUiCNW(I9-DqQV7VW+or|W{*_(2)lXG
zARuFX$D}P&xC3}47-D*Gn`w}1>_cp^v9sR0hI^jyD>>Owt^<9Vl1WVLH{0RIGnr>3
zBG1$YUU>G@E4bD<X4FwT{JvZJyFvG1b!kBz+}xFT%=w#|k@fu+PHZJJtIW_PX@tF@
zi0qO#*nAQ!LjCD3JBd(gxHLYU&#Rit^b5!7U0gj9-9<8<A~&kzsOWR~E`keS7?3U2
zpjl!4CLsRrIK<!E%wJvVFRl}70U;O=4uZY`B%P^E;hDF?W^Em~$-Xx6z_)k1S5UCE
z{+S03&5hd^(vCTk(prmWVrff-zsAt6Mp8@9dN)ya?%y{l+`Ql`H+$<AbK7T0^Xy7!
z#-S*mO3aqq*OsL`GXKl7cP*%Z<}mlUmaB(pL&7*O(_S8)Scj~tH_VdBYr5`#%{^x)
zm<iI~P;w_-aECU;1PCi&^5`dCSo!kLz}#`eAYLcL5-OgZvZXpDa;dVxS_<0vOLt=w
zQzB>iZ}B}Nh0yEG?|hxEjIdNVtN5vJWvoHHSj%w5BLlr5uaopvyEv*ktNU5p?MNM(
zScaXKsi{JQI7dPxGMDJfU-3z7IyQ3_nRVS>N-x)lX}n8oDYWe^kN=|ta0dI|o_pkP
zh6~qjx8dJgNxrHHVDKpc4DR6%sUo%|9P9ahG2}1rH9&YOj07M$ePPFkf{hJfSfh9v
z5JHJB+4{J+dO7<dy<n68`Dr5ol)%8z!4v7_0AmAKPFskfwA!xr-bf#$lP`x7(i?^J
zwmq!`z_2d#^gJ#U{@e2$MlP=24jg*6-o61G+P2>Aj=m@lTYJYp?E(xChfBa=aJU!(
ztCDc>AED@J2!x0KM{*Vd1b*bq_4}NSRW7PyZS!e`1NM(qira)9T74=+ZknW}T`{5f
zXi_DRk;6P)D8WYBHIjOtPEz7t4HetMCv+m2W1oZyzi6x9R0vCvX*T-$u5C2Gr<5Ts
zR3XmNEW!oenxHzcd8Lh0H#aW$L|HB|8D7t;R)cQb9MEFZU<_Hp<g#A%*CwrP-=`R(
z8*4ifx~(s1_32B?o2%eAC+oz_nd1>njL`QFx`O0`7TEdu29CB&tXbZLq=$5EE7u1|
zEl<_k#cOv;qTafkp&1Y@C6pL9b+sM~-spxH60Ydf3dYzI+9K^~&DQFL0wzdpo#QON
zT35$}wnRJYUNNQSf^cyS$8Q;3!5P*=nEGW9Zo1VKgT{ZT5C-IjohfgC8lOlA9|Qqm
zBxpepyzl1#?myeW5IP9WVYmCkP=7;>T^<Qmog&^K3Jz2lz>0k$tmLPsq1ByAMC}+<
zUc$I8%xj!0JC6A!!1%8|XuuFsHewt@95jv{juMUnw#tRQlL7+47PX@P?h)8e&vHYs
zRj4o;6(<9wg%DG!&R06OxQz+VOLMtZ0G6j0utSUiLqNY!w@^D;)5X^pC4KIky|>3%
z&!3n-Ymf9ihjMp4Z9RwjQ3&%nhlLMzEnp#z#Wxn*SPOg^iy1%!`vnkZv6lii_=MQ`
zz{4W|fgq=q9KD}00FGAvV<3Nj|KAPd=<WN@Bl!MhnSU2)1fk*y@ND?NkF=W7#S|fM
z5$?wqyhW|Rr^u{P=@~AmW(GCheQzpOMn{6Fw5rBTg+(afC*Nn?!EN4UvSR+Im-4y6
zI8u?Hg`>T`MxW+MS5;O9Crip3ievv<89u4kpSHIfG~?-!&0V@xXuCnS?8!4JPeCu=
zKU|{mNc&zcH7lV}a(iD}v(N=~A$It&8>g%8&HfNYv14(3`uJoH`L2ds9yH(30B*^?
z)#!@2QDC!P;~4cQL1(M)+%#Kq*!Tv+-Z>gN_j9vO3ANnIeUYy>*1AP8)h3z@A|G8c
z2!=+sy|-&xXQHFBg*mlEg|;a)wq0Tx(~RNhA~%eiObHKF=|=Sgq-OB7yjfx7Xoi+u
zDi@P4Yr+Lpa^<q6+M8mCx}yh%6~f``rFd8R^P5^$nU$TERE@}!OhOw9=(6jhpS#GW
za5tW_PS%S`>`la6Rw&v#OE#bL!UMhZz_pPx`iNk3|E>1uRJE|bAsY`|qR+#?J0rUG
zBf{2=@l*Zza6OYUxX8ES*w2d5d<@1#n5X794}okWnljZ)o^$=YOA6^smSDN%%*7}R
z8CkhjRXT6uw>(^RlR+!E_<|(|Y$+EX<B+{#j9ny0@Y&&Bp)K2b&R1AyCSh|Zncg&i
z6?NF66&;hlKVJh@*>rsLpd`eV4o#4D^HW)yS%m3d^@HFK{rG_QJN>|$!0JcmPyHb9
zGx@F`gnt1R5PtnX!o_d^z%D?nehB=@#iykt4kax9U7cL*ZG9a%6wtmdNN-oHgq$v~
z@8$~2%rGgKq!>&L{#`bHgox7+2#@@aq<R(*{*fxrpQ&DQ^>RS^`~0Rh{?E!WL)u!r
zbe3pw<;g*&Ya0${yQ`?^RyAbMC~OlyqV)+!<mADN_+81`yQS44!FB<7CyN?#5CjKm
zv1i47KCeq0{XPyhlZaZLmT2_7n8|MuW5X@nIjwrz`9PoVmiGsOvVmr{^M;7v<*{|X
z<`|Z5%>&#-$cl@p-Cmh83S)yMa#mnB?R8gn9)3&lldnp&#Od>l_ebU)QNMj;!MDkG
z6^OSGBy#79HMF4<?s8!@Y*|;|&9_a6av}0jwz^hqBs3FnKs$o4@?a6N9B#|wjz@Ym
z@=l6FAM3v2t7(RxS4b0H=o|81tu)d(uq1)RINn!csHmU!Wb|J*KXasp`%^iv`w}2I
zfbw4qk5vvVm*e~*33mj*Qb}|@SyzWrKHt*KT?jV5XZZgk3FG@FgUPGKmUb?q7t&KK
zCWdnvdH|CjlAsG{1Db{Eg{sji|0hYn!WRo(EM|X*0U#~{7yT{<=0C|FD+W4%7NGGn
z#)^ULzb6L&L*KuZ0h;6BEBdzs9(mPoNy)a!7*Kc#$x%XmzE!w9S1S|Kj?2X3-Gp6C
zu?={2B6(KDeXnboziEm!IqnV71XG_DvAC04!aDN=B&C9ZzVv4ETY0#+Ur)DrZ|4%E
zYmIKK>aoj~UDb?{haO;B_96INdbv*0-g<Df&!tBOoIYaayCrcZ{g5dFqK(7&#o@h>
zq?+x0k~qRIas#a1p@vN#I_&2cFTfmY!<ToehUiKQE>zUre5Ck1CGxTn>q+cd3#)1h
zverjOp+LUi@^X=2Jyoht94G(w@T`y2W!bxyHtTb^loew{@AvjIqaK9nUw2YvOf0UY
zz7Q_xg6H3ws%01SpqrqtB``(|mt4~>Fz5Z#<6#Yn0g=*6!7Se{OgB-OAHC{n07rqP
z*BU0hmRva{X2VDK(TsS`V>d2Y3ouLdZ;C7oEvfieJby79c$bb5bJ6s<b$)n*^F0s5
zPTR8FnYV~yVl@6fgGtWItHPsr%paa#2jy2%e#Dz=2@$q`h<}rtv*+_wkGH1u_~JsT
z)VR+|CwD|zKBwo)Z!oBQ9FDVem%WQShGGyTcALMfIy!Do4BxpoA<iy{GGA6SBfO${
zsU;*Le4A5dkEQ!bbIJ|!>nb;*-`8>EbYu@c$tbn5dsS#p$kC3b^uKmtSEacit6=a_
z7*g~OWW>MJj>RnGuQCwxhYYy?-bP%)ZV$@+kO8PD4i3nm@0!Z}c<XqZQ#}9~{8bOG
z{YN;K58(O1v21^Gtg@q@qX!b@>FDMAbK_C$y9OWtNw^qR5#WFXRs*oRk&>s!-$MZP
zA4!i1VEB<9)t~A8Ap!qr6naz;ymDHV%X1T3<1F`tY@podYX{W)3!g64#Kw|kP&zrw
ze+mOBd&OPEN5-%tJO<lr^ypTiXa_>-J~-3gDD~<Yfs9y2e&JQ4(2~axkZcTuamaI$
znmjo{lTv_L?w^B(Y#R&81#}8cz0UBnDzc;4r|Ff+a8Qa`>7ny};_>M$D9zF_-rTBm
z$5t<yq&?~KD>(hCsBjY%g(6#a#X`}BjpNOyU7Z?Rj1;QMM@XZFbfvKOcFbFE7x1OB
zAFmd%vn<+*3ixnRHAI6hR31`-pr$Ru;}*a)6Qh8_%h(0^8O7jvhpa0-xDy=&?nJ{6
z?#Ql(H_Q+rWk1^HAeevB{Tu8|O#n)#9Locd0i=JDATBOG@gLrS7#IJSW7=Pi$$mLz
z{zW0?R+?>D6#bH(B5LxbS>yXJn@%SK{-<M5K~R8KsS2P3BL#?0A07!5_oAU8Oca2f
zMtD#`F>xs|xR9-wt+<3F;2<LD0N9F%iP?&Z*xHNRi`d%Q!^9;J;$n^tutFYuJV9It
zKB$m|lnL932m*ls;4p-kn23R)f(RCSSV&^=_p9lMoS_sCB6&er!fR5%mBFJBB}~)>
zSe<6Z4lx0+o}f^#P$ydJf1`gS%ICZ9_!s7Q;J`170vloX<FUWk@x{IijoZ&T#R`oz
zU<v$7c(6jF^N%C_G#)?P{{KFf?_c(&e<|kt+*fXVnY+}9YM{3(8#GLDIwVf1XG2mR
z_f@^BYVGJ4EIVLqph~Mk5w}X*s=kIJ(w>yM7#q0F)lzVlsp#qc5GlGWkSDibm#cKw
zg`okRslD2Lyh|`Z`<_;@y|cU`;j#9*(Tn$V=#@r#{NSp%BeL47FS$tdlnwc97m42#
zZ+#sDDR+%%ygAb1p4owffGPr}r`PK9NFy#=)bmJ8c3a|6fg3K=)ZDwTl2onCpY@dD
zlbXR;nWxz1adt}bEcN}IlyS1AjzWYpn{$4mWSJeBthHu03}<dr$5+p0cJVH2Oe>)_
z$Ge5HB+wT78e+{Q!kUo%K23Atql{b@*=6WS7KW)xA8N0<>@^nCZXm6u=C$hdo+HbG
z_6e^C#Qok=)d4lnF$L*sqf3JIgNiPK+?2UN15S~5N3*BiR*0#bS3mj2!aTXorGZIZ
z9$}0?J<Kq9rn><*P8`}`o0Ht+kLpbDx?0om+G<HvlK9182O-DjKm#4^BPFE@5-Q?e
zsf8yfi*_(*jF)*Rtw&uRMX}GsHl3R6ucLmESFxbkhYjCQhGArzmR-;3z^5WMui_3l
zX)_e(d7hV0f_#>EuH%4-#Vcyo!3s|WS7dWYq2MBB<%59b=$pK`N<cJ)<c#ddEmY9}
e37$O%rjO1ru64^=CL}NuTvej~g`A(Z=)VB3rsqBY

literal 0
HcmV?d00001

diff --git a/TAs/optee_ta/AuthVars/defaultvars/sub.mk b/TAs/optee_ta/AuthVars/defaultvars/sub.mk
index fc25ab7..6313153 100644
--- a/TAs/optee_ta/AuthVars/defaultvars/sub.mk
+++ b/TAs/optee_ta/AuthVars/defaultvars/sub.mk
@@ -1,12 +1,11 @@
 DEFAULT_VARS_PATHS := $(shell find $(sub-dir) -name '*.bin')
-DEFAULT_VARS_JSON ?= $(sub-dir)/default_vars.json
-#DEFAULT_VAR_PATHS = $(foreach file,$(DEFAULT_VAR_BINS),$(sub-dir)/$(file))
+DEFAULT_VARS_JSON ?= $(sub-dir)/defaultvars_example.json
 
-srcs-y += default_vars.c
+srcs-y += defaultvars.c
 global-incdirs-y += ./
 
 gensrcs-y += default_vars
-produce-default_vars = default_vars_encoding.c
-depends-default_vars = $(DEFAULT_VARS_PATHS) $(sub-dir)/default_vars.py $(DEFAULT_VARS_JSON)
-recipe-default_vars = python3 $(sub-dir)default_vars.py $(DEFAULT_VARS_JSON) $(sub-dir-out)/default_vars_encoding.c
-cleanfiles += $(sub-dir-out)/default_vars_encoding.c
\ No newline at end of file
+produce-default_vars = defaultvars_encoding.c
+depends-default_vars = $(DEFAULT_VARS_PATHS) $(sub-dir)/defaultvars.py $(DEFAULT_VARS_JSON)
+recipe-default_vars = python3 $(sub-dir)/defaultvars.py $(DEFAULT_VARS_JSON) $(sub-dir-out)/defaultvars_encoding.c
+cleanfiles += $(sub-dir-out)/defaultvars_encoding.c
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/src/varmgmt.c b/TAs/optee_ta/AuthVars/src/varmgmt.c
index 86d98d0..e9f4525 100644
--- a/TAs/optee_ta/AuthVars/src/varmgmt.c
+++ b/TAs/optee_ta/AuthVars/src/varmgmt.c
@@ -32,6 +32,10 @@
  */
 
 #include <varmgmt.h>
+#ifdef CFG_AUTHVARS_DEFAULT_VARS
+#include <defaultvars.h>
+#endif
+
 
 // 
 // Auth Var in-memory storage layout
@@ -207,6 +211,13 @@ AuthVarInitStorage(
         if (status == TEE_ERROR_ITEM_NOT_FOUND)
         {
             DMSG("No stored variables found");
+#ifdef CFG_AUTHVARS_DEFAULT_VARS
+            status = InitializeDefaultVariables();
+            if (status != TEE_SUCCESS) {
+                EMSG("Failed to set default variables");
+                goto Cleanup;
+            }
+#endif
             status = TEE_SUCCESS;
         }
         goto Cleanup;
diff --git a/TAs/optee_ta/AuthVars/sub.mk b/TAs/optee_ta/AuthVars/sub.mk
index 4d713c5..c846f68 100644
--- a/TAs/optee_ta/AuthVars/sub.mk
+++ b/TAs/optee_ta/AuthVars/sub.mk
@@ -51,7 +51,7 @@ clean: clean_lib_symlinks
 cflags-y += $(AUTHVAR_FLAGS) $(SSL_FLAGS) $(INCLUDE_OVERWRITES)
 
 subdirs-y += lib
-subdirs-y += defaultvars
+subdirs-$(CFG_AUTHVARS_DEFAULT_VARS) += defaultvars
 
 global-incdirs-y += src/include
 

From ccb37620971ecf683a9833a2e273270c8570668f Mon Sep 17 00:00:00 2001
From: Daniel McIlvaney <damcilva@microsoft.com>
Date: Fri, 23 Aug 2019 17:56:13 -0700
Subject: [PATCH 3/7] Add documentation, small cleanup

---
 TAs/optee_ta/AuthVars/README.md               |  4 ++
 TAs/optee_ta/AuthVars/defaultvars/README.md   | 63 +++++++++++++++++++
 .../defaultvars_secureboot_example.json       |  6 +-
 TAs/optee_ta/AuthVars/defaultvars/sub.mk      | 11 +++-
 4 files changed, 78 insertions(+), 6 deletions(-)
 create mode 100644 TAs/optee_ta/AuthVars/defaultvars/README.md

diff --git a/TAs/optee_ta/AuthVars/README.md b/TAs/optee_ta/AuthVars/README.md
index 250db49..87e07e0 100644
--- a/TAs/optee_ta/AuthVars/README.md
+++ b/TAs/optee_ta/AuthVars/README.md
@@ -24,6 +24,10 @@ The storage is currently encrypted by OP-TEE using a TA Storage Key (TSK) encryp
 
 The UEFI spec describes an authenticated variable store for use with Secure Boot. The TA supports variable reads and writes up to 16KB in size (this is a limitation of the rich OS side driver). This should allow for a reasonable set of Secure Boot keys to be stored.
 
+### Default Variables
+
+The AuthVar TA can encode a set of default variables at compile time, and place them into NV memory when it first runs. This is useful for forcing at default set of UEFI Secure Boot variables to be active during first boot, and as a protection against RPMB wipes. This can be turned on by setting `CFG_AUTHVARS_DEFAULT_VARS=y`. See [defaultvars/README.md](./defaultvars/README.md) for details on configuring this behavior.
+
 ## Debugging AuthVars
 
 ### Clearing Storage
diff --git a/TAs/optee_ta/AuthVars/defaultvars/README.md b/TAs/optee_ta/AuthVars/defaultvars/README.md
new file mode 100644
index 0000000..ecb5b4b
--- /dev/null
+++ b/TAs/optee_ta/AuthVars/defaultvars/README.md
@@ -0,0 +1,63 @@
+# Default Variables
+
+Setting `CFG_AUTHVARS_DEFAULT_VARS=y` will cause the AuthVars TA to ensure a set of default variables are present during first boot.
+
+If the TA detects that there is no pre-existing non-volatile storage it will set the default variables as if it received a call from UEFI. The name, GUID, attributes, and binary data of the variables are defined in a JSON file, passed via `CFG_DEFAULT_VARS_JSON=/path/to/vars.json`.
+
+## JSON File
+The JSON file pointed to by `CFG_DEFAULT_VARS_JSON=/path/to/vars.json` defines which variables will be added.
+
+* **`name:`** ECS-2 encodable string. Since the JSON file is saved as UTF-8 the unicode characters can be placed directly in the string.
+* **`bin_path:`** Path to the binary contents of the variable. If the variable is authenticated this binary should include the authentication headers. **If** the path is not absolute, it is taken relative to the AuthVars TA root directory (`MSRSec/TAs/optee_ta/AuthVars`).
+* **`guid:`** The variable GUID, must be valid C syntax. May also be one of the well known GUIDs `EFI_IMAGE_SECURITY_DATABASE_GUID` or `EFI_GLOBAL_VARIABLE`.
+* **`attributes:`** The attributes the variable should be saved with (from `uefidefs.h`). Must be valid C syntax.
+
+The variables will be saved into the AuthVar TA in the order they are found in the JSON file.
+
+```json
+{
+    "variables": [
+        {
+            "name": "Default Volatile Variable Example / (Supports ECS-2 characters ✍)",
+            "bin_path": "defaultvars/example.bin",
+            "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}",
+            "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+        }
+    ]
+}
+```
+
+### Text Encoding of Variable Names
+The JSON file **must be `UTF-8` encoded**, as the python script explicitly decodes it as UTF-8. The JSON file may contain *MOST*, **but not all** unicode characters. UEFI uses ECS-2 encoding for its strings, a subset of UTF-16. ECS-2 does not allow 4-byte characters to be stored, so no UTF-16 surrogate pairs. Valid ECS-2 values are: `[0x0000, 0xd800] ∪ [0xdfff, 0xffff]`. The python script used to compile the variables will check the validity of the encoding for each character.
+
+
+## Compilation
+At compilation time `defaultvars.py` runs, taking the JSON file found at `CFG_DEFAULT_VARS_JSON`, and creating the file `$(sub-dir-out)/defaultvars_encoding.c`. This C file encodes each variable in the JSON file as a set of C variables:
+```c
+WCHAR var_0_name[] = L"Abcd" "\x1234" "5678";
+GUID var_0_guid = {0x12345678,0x9abc,0xdef0,{0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0}};
+ATTRIBUTES var_0_attributes = "EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS";
+BYTE var_0_bin[] = { 0x0, 0x1, 0x2, 0x3, ... };
+
+WCHAR var_2_name[] = L"XYZ" "\x1234" "5678";
+...
+```
+
+The generated C file also contains the definition for `InitializeDefaultVariables()`, which is defined in `defaultvars.h`, and is called during initialization of the TA in `AuthVarInitStorage()` if and only if there is no pre-existing non-volatile storage pressent (assuming `CFG_DEFAULT_VARS_JSON=y`).
+
+```c
+TEE_Result InitializeDefaultVariables( VOID ) {
+    TEE_Result res;
+
+    res = SetDefaultVariable(var_0_name, sizeof(var_0_name), var_0_bin, sizeof(var_0_bin), var_0_guid, var_0_attributes);
+    if (res != TEE_SUCCESS)
+        return res;
+
+    res = SetDefaultVariable(var_1_name, sizeof(var_1_name), var_1_bin, sizeof(var_1_bin), var_1_guid, var_1_attributes);
+    if (res != TEE_SUCCESS)
+        return res;
+
+    DMSG("Done setting 2 default variables");
+    return TEE_SUCCESS;
+}
+```
diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json
index 45445d9..a172370 100644
--- a/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json
+++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json
@@ -4,19 +4,19 @@
             "name": "db",
             "bin_path": "defaultvars/example_db.bin",
             "guid": "EFI_IMAGE_SECURITY_DATABASE_GUID",
-            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
         },
         {
             "name": "KEK",
             "bin_path": "defaultvars/example_KEK.bin",
             "guid": "EFI_GLOBAL_VARIABLE",
-            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
         },
         {
             "name": "PK",
             "bin_path": "defaultvars/example_PK.bin",
             "guid": "EFI_GLOBAL_VARIABLE",
-            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+            "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
         }
     ]
 }
\ No newline at end of file
diff --git a/TAs/optee_ta/AuthVars/defaultvars/sub.mk b/TAs/optee_ta/AuthVars/defaultvars/sub.mk
index 6313153..8ffdf4f 100644
--- a/TAs/optee_ta/AuthVars/defaultvars/sub.mk
+++ b/TAs/optee_ta/AuthVars/defaultvars/sub.mk
@@ -1,11 +1,16 @@
+CFG_DEFAULT_VARS_JSON ?= $(sub-dir)/defaultvars_example.json
+
 DEFAULT_VARS_PATHS := $(shell find $(sub-dir) -name '*.bin')
-DEFAULT_VARS_JSON ?= $(sub-dir)/defaultvars_example.json
 
 srcs-y += defaultvars.c
 global-incdirs-y += ./
 
+# Make can have trouble tracking updates to binary files outside the tree.
+# It is very fast to rebuild the encoding, so just do that every time.
+.PHONY: always_rebuild_defaultvars
+
 gensrcs-y += default_vars
 produce-default_vars = defaultvars_encoding.c
-depends-default_vars = $(DEFAULT_VARS_PATHS) $(sub-dir)/defaultvars.py $(DEFAULT_VARS_JSON)
-recipe-default_vars = python3 $(sub-dir)/defaultvars.py $(DEFAULT_VARS_JSON) $(sub-dir-out)/defaultvars_encoding.c
+depends-default_vars = always_rebuild_defaultvars
+recipe-default_vars = python $(sub-dir)/defaultvars.py $(CFG_DEFAULT_VARS_JSON) $(sub-dir-out)/defaultvars_encoding.c
 cleanfiles += $(sub-dir-out)/defaultvars_encoding.c
\ No newline at end of file

From 9d5c2e0a190ebf13fad9528eb673f9f0846fea21 Mon Sep 17 00:00:00 2001
From: Daniel McIlvaney <damcilva@microsoft.com>
Date: Fri, 23 Aug 2019 18:06:22 -0700
Subject: [PATCH 4/7] Add description of each example JSON

---
 TAs/optee_ta/AuthVars/defaultvars/README.md              | 9 ++++++++-
 .../AuthVars/defaultvars/defaultvars_example.json        | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/TAs/optee_ta/AuthVars/defaultvars/README.md b/TAs/optee_ta/AuthVars/defaultvars/README.md
index ecb5b4b..a92990a 100644
--- a/TAs/optee_ta/AuthVars/defaultvars/README.md
+++ b/TAs/optee_ta/AuthVars/defaultvars/README.md
@@ -21,12 +21,19 @@ The variables will be saved into the AuthVar TA in the order they are found in t
             "name": "Default Volatile Variable Example / (Supports ECS-2 characters ✍)",
             "bin_path": "defaultvars/example.bin",
             "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}",
-            "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+            "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
         }
     ]
 }
 ```
 
+### Examples
+Two examples are included, along with binaries.
+
+The first example, `defaultvars_example.json`, is included by default if `CFG_DEFAULT_VARS_JSON` is left unset. It adds a single variable (as shown above).
+
+The second example, `defaultvars_secureboot_example.json` can be used by setting `CFG_DEFAULT_VARS_JSON=defaultvars/defaultvars_secureboot_example.json`. This example automatically enables secure boot using **NON-SECURE** keys from the [TurnkeySecurity](https://github.com/ms-iot/security/tree/master/TurnkeySecurity) repository. They are included for example purposes only. A production image must use newly generated signing keys.
+
 ### Text Encoding of Variable Names
 The JSON file **must be `UTF-8` encoded**, as the python script explicitly decodes it as UTF-8. The JSON file may contain *MOST*, **but not all** unicode characters. UEFI uses ECS-2 encoding for its strings, a subset of UTF-16. ECS-2 does not allow 4-byte characters to be stored, so no UTF-16 surrogate pairs. Valid ECS-2 values are: `[0x0000, 0xd800] ∪ [0xdfff, 0xffff]`. The python script used to compile the variables will check the validity of the encoding for each character.
 
diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json
index cd5f272..30fe0bc 100644
--- a/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json
+++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json
@@ -4,7 +4,7 @@
             "name": "Default Volatile Variable Example / (Supports ECS-2 characters ✍)",
             "bin_path": "defaultvars/example.bin",
             "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}",
-            "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
+            "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"
         }
     ]
 }
\ No newline at end of file

From 10cddd312ced12012bd1df1a8acbd15be05446a3 Mon Sep 17 00:00:00 2001
From: Daniel McIlvaney <damcilva@microsoft.com>
Date: Fri, 23 Aug 2019 18:12:00 -0700
Subject: [PATCH 5/7] Add TODO message.

---
 TAs/optee_ta/AuthVars/src/varmgmt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/TAs/optee_ta/AuthVars/src/varmgmt.c b/TAs/optee_ta/AuthVars/src/varmgmt.c
index e9f4525..30e23b8 100644
--- a/TAs/optee_ta/AuthVars/src/varmgmt.c
+++ b/TAs/optee_ta/AuthVars/src/varmgmt.c
@@ -215,6 +215,10 @@ AuthVarInitStorage(
             status = InitializeDefaultVariables();
             if (status != TEE_SUCCESS) {
                 EMSG("Failed to set default variables");
+                // TODO: We should set up all the variables which were just
+                // created, or add variable by variable checking to make sure
+                // we don't miss any variables in the case one fails, or the 
+                // TA is interuppted during its first boot.
                 goto Cleanup;
             }
 #endif

From 0dbeaa77f1c0d670c174fcd91c71fe3f7c862b4e Mon Sep 17 00:00:00 2001
From: Daniel McIlvaney <damcilva@microsoft.com>
Date: Thu, 5 Sep 2019 14:03:36 -0700
Subject: [PATCH 6/7] Update TAs/optee_ta/AuthVars/README.md

---
 TAs/optee_ta/AuthVars/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/TAs/optee_ta/AuthVars/README.md b/TAs/optee_ta/AuthVars/README.md
index 87e07e0..54a8323 100644
--- a/TAs/optee_ta/AuthVars/README.md
+++ b/TAs/optee_ta/AuthVars/README.md
@@ -26,7 +26,7 @@ The UEFI spec describes an authenticated variable store for use with Secure Boot
 
 ### Default Variables
 
-The AuthVar TA can encode a set of default variables at compile time, and place them into NV memory when it first runs. This is useful for forcing at default set of UEFI Secure Boot variables to be active during first boot, and as a protection against RPMB wipes. This can be turned on by setting `CFG_AUTHVARS_DEFAULT_VARS=y`. See [defaultvars/README.md](./defaultvars/README.md) for details on configuring this behavior.
+The AuthVar TA can encode a set of default variables at compile time, and place them into NV memory when it first runs. This is useful for forcing a default set of UEFI Secure Boot variables to be active during first boot, and as a protection against RPMB wipes. This can be turned on by setting `CFG_AUTHVARS_DEFAULT_VARS=y`. See [defaultvars/README.md](./defaultvars/README.md) for details on configuring this behavior.
 
 ## Debugging AuthVars
 

From dc0aa4db880a542518a0605a2267df48ba284891 Mon Sep 17 00:00:00 2001
From: Daniel McIlvaney <damcilva@microsoft.com>
Date: Mon, 16 Sep 2019 14:40:41 -0700
Subject: [PATCH 7/7] Expand TODO comment

---
 TAs/optee_ta/AuthVars/src/varmgmt.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/TAs/optee_ta/AuthVars/src/varmgmt.c b/TAs/optee_ta/AuthVars/src/varmgmt.c
index 30e23b8..f56dd55 100644
--- a/TAs/optee_ta/AuthVars/src/varmgmt.c
+++ b/TAs/optee_ta/AuthVars/src/varmgmt.c
@@ -215,10 +215,20 @@ AuthVarInitStorage(
             status = InitializeDefaultVariables();
             if (status != TEE_SUCCESS) {
                 EMSG("Failed to set default variables");
-                // TODO: We should set up all the variables which were just
-                // created, or add variable by variable checking to make sure
-                // we don't miss any variables in the case one fails, or the 
-                // TA is interuppted during its first boot.
+                // TODO: Make this operation atomic.
+
+                // Ex: Setting default variables {A, B, C, db, kek, pk}.
+                // If {A, B, C} are set correctly, but setting db fails, the TA
+                // we be in a bad state. The TA will be 'initialized' since it
+                // has at least one persistent object available (A, B, and C),
+                // and will make no further attempts to set db, kek, pk.
+                //
+                // This step must be made atomic either by removing the variables,
+                // or setting a NV flag when done. Setting a flag is probably
+                // preferable since it will handle both graceful failures and
+                // premature power cycles.
+
+                // WipeMemory();
                 goto Cleanup;
             }
 #endif