versal: increase CFG_CORE_HEAP_SIZE

Empirically incrementing limit to avoid OOM when executing xtests.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Jerome Forissier <jerome.for

versal: increase CFG_CORE_HEAP_SIZE

Empirically incrementing limit to avoid OOM when executing xtests.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

crypto: versal: rsa: only support sign/verify operations

RSA encryption/decryption is not supported (the PLM does not
return the size of the encrypted/decrypted buffers).

Signed-off-by: Jorge Ramir

crypto: versal: rsa: only support sign/verify operations

RSA encryption/decryption is not supported (the PLM does not
return the size of the encrypted/decrypted buffers).

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

crypto: versal: ecc: sign/verify fix

Both the message (hash) and the generated signatures must be swapped.

The following custom tests were executed for P384 (prime384v1) and
P521 (nistp521) curves.

crypto: versal: ecc: sign/verify fix

Both the message (hash) and the generated signatures must be swapped.

The following custom tests were executed for P384 (prime384v1) and
P521 (nistp521) curves.

Signing and verifying using pkcs#11 alone (ie like done in xtest) was
not sufficient to capture this bug.

PTOOL='pkcs11-tool --module /usr/lib/libckteec.so.0.1.0'
SO_PIN=55555555
PIN=44444444
FILE=hello

printf "OP-TEE: create key pair"
$PTOOL --id 01 --label ldts --token-label fio --pin $PIN \
--keypairgen \
--key-type EC:prime384v1

printf "OP-TEE: read the public key"
$PTOOL -l --pin $PIN --id 01 \
--read-object --type pubkey --output-file pubkey.spki

printf "Openssl: export key to PEM"
openssl ec -inform DER -outform PEM -in pubkey.spki -pubin > pubkey.pub

printf "Create file to sign"
echo "hello world" > $FILE

printf "OpenSSL: create the file sha384"
openssl dgst -binary -sha384 $FILE > $FILE.hash

printf "OP-TEE: generate signature "
$PTOOL --pin $PIN --id 01 --label ldts --token-label fio \
--sign
--input-file $FILE.hash
--output-file $FILE.sig
--mechanism ECDSA
-f openssl

printf "OpenSSL: verify signature"
openssl dgst -sha384 -verify pubkey.pub -signature "$FILE".sig "$FILE"

printf "OP-TEE: verify signature"
$PTOOL --pin $PIN --id 01 --label ldts --token-label fio \
--verify \
--input-file $FILE.hash \
--signature-format openssl \
--signature-file $FILE.sig \
--mechanism ECDSA

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core, ldelf: add support for RISC-V

RISC-V support of argument for ldelf dump state.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@lin

core, ldelf: add support for RISC-V

RISC-V support of argument for ldelf dump state.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core, ldelf: replace is_arm32 with is_32bit

To refer to 32-bit mode, this commit replace is_arm32 with is_32bit
in the following files:
- core/kernel/ldelf_loader.c
- ldelf/include/ldelf.h
- ldelf/m

core, ldelf: replace is_arm32 with is_32bit

To refer to 32-bit mode, this commit replace is_arm32 with is_32bit
in the following files:
- core/kernel/ldelf_loader.c
- ldelf/include/ldelf.h
- ldelf/main.c

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: kernel: move ldelf_loader.c to core/kernel

Make other architecture implementations benefit from ldelf_loader.c,
therefore move it from core/arch/arm/kernel to core/kernel.
The header file is a

core: kernel: move ldelf_loader.c to core/kernel

Make other architecture implementations benefit from ldelf_loader.c,
therefore move it from core/arch/arm/kernel to core/kernel.
The header file is already located outside the arch folder.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

GP131: Add TA property gpd.ta.doesNotCloseHandleOnCorruptObject

Adds the TA property gpd.ta.doesNotCloseHandleOnCorruptObject.

All syscalls operating on an object handle and can return
TEE_ERROR_CO

GP131: Add TA property gpd.ta.doesNotCloseHandleOnCorruptObject

Adds the TA property gpd.ta.doesNotCloseHandleOnCorruptObject.

All syscalls operating on an object handle and can return
TEE_ERROR_CORRUPT_OBJECT must also do special treatment when
TEE_ERROR_CORRUPT_OBJECT is returned. Prior to
gpd.ta.doesNotCloseHandleOnCorruptObject this meant removing the object
and closing the object handle. With the
gpd.ta.doesNotCloseHandleOnCorruptObject property the object handle
shouldn't be close if this the current TA has the property set to true.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: syscall_hash_final() support XOF

Adds support in syscall_hash_final() for Extendable Output Functions,
that is, TEE_ALG_SHAKE128 and TEE_ALG_SHAKE256 for now.

Acked-by: Etienne Carriere <etie

core: syscall_hash_final() support XOF

Adds support in syscall_hash_final() for Extendable Output Functions,
that is, TEE_ALG_SHAKE128 and TEE_ALG_SHAKE256 for now.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Enable SHA-3 support by default

Enables all the supported SHA-3 algorithms by default.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.

Enable SHA-3 support by default

Enables all the supported SHA-3 algorithms by default.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: LTC: conditionally enable SHA-3 implementation

Enables SHA-3 implementation in libtomcrypt and add OP-TEE wrappers.

Adds LTC fallback for mbedtls configurations since mbedtls doesn't
support

core: LTC: conditionally enable SHA-3 implementation

Enables SHA-3 implementation in libtomcrypt and add OP-TEE wrappers.

Adds LTC fallback for mbedtls configurations since mbedtls doesn't
support SHA-3 yet.

Implementation of the crypto_hmac_*_alloc_ctx() functions is updated to
only add a full implementation if the corresponding hash function also
is configured.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: crypto: add API for SHA-3

Adds an API for the SHA-3 [1] algorithms SHA3-224, SHA3_256, SHA3_384,
SHA3_512, SHAKE128, and SHAKE256. SHAKE128 and SHAKE256 are
Extendable-Output Functions (XOF),

core: crypto: add API for SHA-3

Adds an API for the SHA-3 [1] algorithms SHA3-224, SHA3_256, SHA3_384,
SHA3_512, SHAKE128, and SHAKE256. SHAKE128 and SHAKE256 are
Extendable-Output Functions (XOF), but handled as hashes in the API.

Adds API for SHA-3 based HMAC functions.

For XOF algorithms crypto_hash_final() can be called multiple times and
generate an arbitrary amount of data. Note that this data will have a
common prefix if done over the same input (see A.2 in [1]).

[1] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

GP131: Update gpd.tee.trustedStorage.antiRollback.protectionLevel

Updates used values for
gpd.tee.trustedStorage.antiRollback.protectionLevel according to TEE
Internal Core API version 1.3.1.

Note

GP131: Update gpd.tee.trustedStorage.antiRollback.protectionLevel

Updates used values for
gpd.tee.trustedStorage.antiRollback.protectionLevel according to TEE
Internal Core API version 1.3.1.

Note that protection level 0 is not valid any longer, so report level
100 when RPMB isn't in use. Only root can tamper with the REE FS storage
due to the REE file system permissions.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

GP131: add TA property gpd.client.endian

Adds the new property "gpd.client.endian" to report the endianness used
by a client.

At the moment there is no way for a client to report its endianness to

GP131: add TA property gpd.client.endian

Adds the new property "gpd.client.endian" to report the endianness used
by a client.

At the moment there is no way for a client to report its endianness to
OP-TEE so assume that all are little-endian.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

GP131: Update TEE_AsymmetricEncrypt() and TEE_AsymmetricDecrypt()

Updates TEE_AsymmetricEncrypt() and TEE_AsymmetricDecrypt() according to
TEE Internal Core API version 1.3.1. The srcLen and dstLen

GP131: Update TEE_AsymmetricEncrypt() and TEE_AsymmetricDecrypt()

Updates TEE_AsymmetricEncrypt() and TEE_AsymmetricDecrypt() according to
TEE Internal Core API version 1.3.1. The srcLen and dstLen parameters
are changed to use size_t instead of uint32_t

Adds the optional attribute TEE_ATTR_RSA_OAEP_MGF_HASH which if provided
specifies the MGF1 hash function to use. Prior to GP v1.3.1 it was
implementation defined. OP-TEE only supports using the same MGF1 hash
function as the internal hash function of the algorithim, that is, for
the algorithm TEE_ALG_RSAES_PKCS1_OAEP_MGF1_x that hash function
TEE_ALG_x is used.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

GP131: Update TEE_CreatePersistentObject()

Update TEE_CreatePersistentObject() according to TEE Internal Core API
version 1.3.1. The objectIDLen parameter is changed to use size_t
instead of uint32_

GP131: Update TEE_CreatePersistentObject()

Update TEE_CreatePersistentObject() according to TEE Internal Core API
version 1.3.1. The objectIDLen parameter is changed to use size_t
instead of uint32_t.

The object parameter is now an optional pointer to a handle. When NULL
the standard says:
If attributes is a handle on an initialized transient object,
the initialized transient object SHALL be transformed to a
persistent object.
So syscall_storage_obj_create() is also updated accordingly.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

GP131: Update TEE_Param

Updates TEE_Param according to TEE Internal Core API version 1.3.1.

A compatibility type with a __GP11_ prefix is added for compatibility
with version 1.1. The two API funct

GP131: Update TEE_Param

Updates TEE_Param according to TEE Internal Core API version 1.3.1.

A compatibility type with a __GP11_ prefix is added for compatibility
with version 1.1. The two API functions TEE_InvokeTACommand() and
TEE_OpenTASession() are updated in a similar manner.

For the two TA entry functions TA_InvokeCommandEntryPoint() and
TA_OpenSessionEntryPoint() we are implementing those in directly in
user_ta_header.c since it's compiled with the TA and can used
conditionals based on __OPTEE_CORE_API_COMPAT_1_1.

These TA entry points calls __ta_open_sess() and __ta_invoke_cmd() to
convert TEE_Param to the compatibility __GP11_TEE_Param and in then call
the compatibility entry points __GP11_TA_OpenSessionEntryPoint() and
__GP11_TA_InvokeCommandEntryPoint().

Supplying __GP11_TA_OpenSessionEntryPoint() and
__GP11_TA_InvokeCommandEntryPoint() as function pointers ensures that
libutee doesn't try to look up the compatibility entry points when not
needed.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

GP131: Update HKDF defines

OP-TEE provides an HKDF implementation as an extension to the TEE
Internal Core API which predates version 1.3 of the specification where
HKDF was officially introduced.

GP131: Update HKDF defines

OP-TEE provides an HKDF implementation as an extension to the TEE
Internal Core API which predates version 1.3 of the specification where
HKDF was officially introduced.

Update with the official defines and resolve name clashes. With this
OP-TEE supports both the old extension and the new official API.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

GP131: Add TEE_ALG_ECDH_DERIVE_SHARED_SECRET and TEE_ALG_ECDSA_SHA*

Adds the defines
- TEE_ALG_ECDH_DERIVE_SHARED_SECRET
- TEE_ALG_ECDSA_SHA1
- TEE_ALG_ECDSA_SHA224
- TEE_ALG_ECDSA_SHA256
- TEE_ALG_

GP131: Add TEE_ALG_ECDH_DERIVE_SHARED_SECRET and TEE_ALG_ECDSA_SHA*

Adds the defines
- TEE_ALG_ECDH_DERIVE_SHARED_SECRET
- TEE_ALG_ECDSA_SHA1
- TEE_ALG_ECDSA_SHA224
- TEE_ALG_ECDSA_SHA256
- TEE_ALG_ECDSA_SHA386
- TEE_ALG_ECDSA_SHA512
from TEE Internal Core API version 1.3.1 to replace the previous now
deprecated defines:
- TEE_ALG_ECDSA_P192
- TEE_ALG_ECDSA_P224
- TEE_ALG_ECDSA_P256
- TEE_ALG_ECDSA_P384
- TEE_ALG_ECDSA_P521
- TEE_ALG_ECDH_P192
- TEE_ALG_ECDH_P224
- TEE_ALG_ECDH_P256
- TEE_ALG_ECDH_P384
- TEE_ALG_ECDH_P521

The new defines have new values and the values from the old defines are
not reused.

The syscall ABI maintains compatibility by handling both the old and new
values in parallel from now on.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: drivers: nxp: always disable povdd after trying to fuse the SFP

- The LX series manual specifies that the POVDD pin should always be
reset to GND before powering off or resetting the SoC.
-

core: drivers: nxp: always disable povdd after trying to fuse the SFP

- The LX series manual specifies that the POVDD pin should always be
reset to GND before powering off or resetting the SoC.
- The SFP driver will leave the POVDD pin raised if it encounters an
error while fusing.
- Change SFP driver to always unset POVDD after any fuse attempt.

Signed-off-by: Andrew Mustea <andrew.mustea@microsoft.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Sahil Malhotra <sahil.malhotra@nxp.com>

show more ...

core: drivers: nxp: bit shift the ITS and SB bits when reading the SFP

- The Intent to Secure (ITS) and Secure Boot (SB) flags are written to a
given pointer in ls_sfp_get_its() and ls_sfp_get_sb(

core: drivers: nxp: bit shift the ITS and SB bits when reading the SFP

- The Intent to Secure (ITS) and Secure Boot (SB) flags are written to a
given pointer in ls_sfp_get_its() and ls_sfp_get_sb() respectively.
- The written values are equivalent to the entire masked OSPR0 and OSPR1
registers.
- The two functions should instead update a pointer with a boolean
integer containing the bit shifted value of the desired flag.

Signed-off-by: Andrew Mustea <andrew.mustea@microsoft.com>
Reviewed-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: drivers: nxp: update LX series SFP fuse timeout

- The LX series manual specifies that fusing the SFP can take up to
100ms to complete.
- The fuse timeout in the LS SFP driver should be chang

core: drivers: nxp: update LX series SFP fuse timeout

- The LX series manual specifies that fusing the SFP can take up to
100ms to complete.
- The fuse timeout in the LS SFP driver should be changed to 150ms
so that the possible 100ms timeout has a buffer to interpret errors.

Signed-off-by: Andrew Mustea <andrew.mustea@microsoft.com>
Reviewed-by: Sahil Malhotra <sahil.malhotra@nxp.com>

show more ...

core: riscv: provide cache_helpers_rv.S

Simple implementation of instruction cache and data cache operations
that relies on RISC-V's fence and fence.i instructions.

Signed-off-by: Marouene Boubakri

core: riscv: provide cache_helpers_rv.S

Simple implementation of instruction cache and data cache operations
that relies on RISC-V's fence and fence.i instructions.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: provide arch_scall_rv.S

Provide an implementation of scall_do_call(), syscall_sys_return()
and syscall_panic().

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: J

core: riscv: provide arch_scall_rv.S

Provide an implementation of scall_do_call(), syscall_sys_return()
and syscall_panic().

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: arch_scall.c: implement scall_save_panic_stack()

Provide an implementation of scall_save_panic_stack() needed by
scall_sys_return_helper().

Signed-off-by: Marouene Boubakri <marouene.b

core: riscv: arch_scall.c: implement scall_save_panic_stack()

Provide an implementation of scall_save_panic_stack() needed by
scall_sys_return_helper().

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: provide arch_scall.h

Specifies what registers from thread_scall_regs are used for system calls.
The syscall number is provided in t0 register. The syscall max args is
provided in t1 reg

core: riscv: provide arch_scall.h

Specifies what registers from thread_scall_regs are used for system calls.
The syscall number is provided in t0 register. The syscall max args is
provided in t1 register. The return value is provided in a0 register.
The panic and panic code are provided respectively in a1 and a2 registers.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...