pta: stm32mp: add debug access PTA

Add the debug access PTA that is responsible of validating whether
a given debug profile is configured or not. This basically means that
the debug configuration sh

pta: stm32mp: add debug access PTA

Add the debug access PTA that is responsible of validating whether
a given debug profile is configured or not. This basically means that
the debug configuration should allow (at least!) access to the debug
peripherals requiring the debug profile being checked.

For now, as it is specific to BSEC, only embed the PTA if the BSEC support
is embedded as well.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

core: pta: add Rockchip secure boot PTA

The S_OTP area for the Rockchip secure boot RSA hash and status register
is accessible only from the secure world. Thus, secure boot must be
enabled from the

core: pta: add Rockchip secure boot PTA

The S_OTP area for the Rockchip secure boot RSA hash and status register
is accessible only from the secure world. Thus, secure boot must be
enabled from the secure world on these board.

The PTA implements 3 functions:

1. Ask the TA from the non-secure world about the current status and hash
of the hardware. This allows to inspect the current status of secure
boot on a specific device.

2. Write an RSA hash into the OTP fuses. It's the responsibility of the
user to calculate the hash and ensure that it matches the key, which
will be used to sign the images.

3. Actually lockdown the device by enabling secure boot. This is a
separate step to allow the user to verify the setup before
potentially bricking a device.

With these functions, a user may use a client running in the normal
world (for example in a boot loader or operating system) to enable
secure boot on a Rockchip device.

Implementing secure boot setup as an OP-TEE PTA has the advantage that
secure boot can be enabled at any time during the device setup instead
of during early boot. This allows a developer/user or additional scripts
to interact with the secure boot setup process.

The hash of the root key is accepted and reported as calculated by
sha256sum and internally converted to the correct byte order that needs
to be burned into the fuses.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: dump ftrace after every ta_entry

This patch implements the feature to dump ftrace buffer to
tee_supplicant after every entry to the ta.
To implement the feature, this patch does some modific

ftrace: dump ftrace after every ta_entry

This patch implements the feature to dump ftrace buffer to
tee_supplicant after every entry to the ta.
To implement the feature, this patch does some modification to the
ftrace dumping process and add a new config CFG_FTRACE_DUMP_EVERY_ENTRY
to control this behavior.
This can reduce the chance of losing the ftrace data due to not
enough ftrace buffer and make debugging long-lived TA possible.

Signed-off-by: Leo Chen <shf.chen@mediatek.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

libutee: make TEE_SetOperationKey2() panic if operation is NULL or not in initial state

The Internal Core API specification v1.3.1 has the following panic
conditions for TEE_SetOperationKey2(), same

libutee: make TEE_SetOperationKey2() panic if operation is NULL or not in initial state

The Internal Core API specification v1.3.1 has the following panic
conditions for TEE_SetOperationKey2(), same as v1.1:

- If operation is not a valid opened operation handle.
- If operation is not in initial state.

Therefore, it should call __GP11_TEE_SetOperationKey2() not the internal
function set_operation_key2(). Then operation is guaranteed to be
non-NULL and the test may be replaced by an assertion.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: make TEE_SetOperationKey() panic if handle state is initialized

According to the TEE Internal Core API specification v1.3.1 section
6.2.6, TEE_SetOperationKey() should panic if the flag
TEE

libutee: make TEE_SetOperationKey() panic if handle state is initialized

According to the TEE Internal Core API specification v1.3.1 section
6.2.6, TEE_SetOperationKey() should panic if the flag
TEE_HANDLE_FLAG_INITIALIZED is set on the operation. Update
TEE_SetOperationKey() accordingly.

A NULL operation should cause a panic, too. Since this condition is
caught in both TEE_SetOperationKey() and __GP11_TEE_SetOperationKey(),
we can drop the NULL check in set_operation_key() and assert instead.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: Fix handling of failed TA_CreateEntryPoint() in keep-alive TAs

Do not mark init as done if init fails. This is necessary to avoid
running a TA uninitialized. Also, add a new marker indicati

libutee: Fix handling of failed TA_CreateEntryPoint() in keep-alive TAs

Do not mark init as done if init fails. This is necessary to avoid
running a TA uninitialized. Also, add a new marker indicating if the
malloc pool and other runtime setup has been performed - this part
of the init must not be repeated.

This issue could cause a NULL pointer dereference in PKCS#11 TA if
the TA's init failed. F.ex., if `tee-supplicant` was unavailable, the
PKCS#11 TA's `TA_CreateEntryPoint()` would fail to init its tokens,
and an error value would be returned. This in itself is fine, but the
problem is that the init would be marked as done. Hence, for the next
session, the TA's `TA_CreateEntryPoint()` would be omitted during init.

Link: https://github.com/OP-TEE/optee_os/pull/7443
Signed-off-by: Johan Korsnes <johan.korsnes@remarkable.no>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pta: add alarm-related operations to RTC PTA

Add `set_alarm()`, `read_alarm()`, `enable_alarm()`, `wait_alarm()`,
`cancel_wait()` and `set_wake_alarm_status()` operations.
Also update RTC feat

core: pta: add alarm-related operations to RTC PTA

Add `set_alarm()`, `read_alarm()`, `enable_alarm()`, `wait_alarm()`,
`cancel_wait()` and `set_wake_alarm_status()` operations.
Also update RTC features to include alarm and wakeup alarm capabilities.

Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Gatien Chevallier <gatien.chevallier@foss.st.com>

show more ...

Add optee.ta.instanceKeepCrashed property

Add the optee.ta.instanceKeepCrashed property to prevent a TA with
gpd.ta.instanceKeepAlive=true to be restarted. This prevents unexpected
resetting of the

Add optee.ta.instanceKeepCrashed property

Add the optee.ta.instanceKeepCrashed property to prevent a TA with
gpd.ta.instanceKeepAlive=true to be restarted. This prevents unexpected
resetting of the state of the TA.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Alex Lewontin <alex.lewontin@canonical.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: pta: add self tests for transfer list

Add self tests for transfer list.
Adapt CFG_TRANSFER_LIST with its dependencies and add
CFG_TRANSFER_LIST_TEST.

Signed-off-by: Raymond Mao <raymond.mao@l

core: pta: add self tests for transfer list

Add self tests for transfer list.
Adapt CFG_TRANSFER_LIST with its dependencies and add
CFG_TRANSFER_LIST_TEST.

Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

pta: stats: add field for fragmentation metric

Add the field free2sum to struct pta_stats_alloc to enable xtest to
calculate fragmenation metric for the heap.

Signed-off-by: Jens Wiklander <jens.wi

pta: stats: add field for fragmentation metric

Add the field free2sum to struct pta_stats_alloc to enable xtest to
calculate fragmenation metric for the heap.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutee: fix __utee_tcb_init()

Replace realloc() calls with calls to malloc_flags() to make sure that
newly allocated memory is zero initialized.

Fixes: 9d224046e710 ("ldelf, libutee: add minimal T

libutee: fix __utee_tcb_init()

Replace realloc() calls with calls to malloc_flags() to make sure that
newly allocated memory is zero initialized.

Fixes: 9d224046e710 ("ldelf, libutee: add minimal Thread Local Storage support")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutee: TEE_Realloc(): avoid realloc()

TEE_Realloc() and realloc() have slightly different behaviour.
TEE_Realloc() must zero initialize newly allocated memory while
realloc() isn't expected to do

libutee: TEE_Realloc(): avoid realloc()

TEE_Realloc() and realloc() have slightly different behaviour.
TEE_Realloc() must zero initialize newly allocated memory while
realloc() isn't expected to do that. So use malloc_flags() and
raw_malloc_flags() with the MAF_ZERO_INIT flag to make sure that newly
allocated memory is zero initialized.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: pta: stats: get RPMB secure storage allocation stats

Retrieve RPMB secure storage space allocation statistics from
PTA stats STATS_CMD_ALLOC_STATS command.

STATS_NB_POOLS is intentionally not

core: pta: stats: get RPMB secure storage allocation stats

Retrieve RPMB secure storage space allocation statistics from
PTA stats STATS_CMD_ALLOC_STATS command.

STATS_NB_POOLS is intentionally not incremented since it is
expected to give the number of pools which IDs start from 1
(ALLOC_ID_HEAP), not from 0 (ALLOC_ID_ALL) that is a magic
ID.

Ensure the stats are all 0 for when RPMB_FS is not supported or we
failed to get the stats info. For this, let's zero initialize the
shared buffer so that these default stats also apply on other stats
that may not be reachable (deprecate public DDR pool, Nexus heap).

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libtuee: allow NULL output coefficients in TEE_BigIntComputeExtendedGcd()

Fix TEE_BigIntComputeExtendedGcd() for when only one of u and v output
coefficients reference is NULL as allowed by the GP T

libtuee: allow NULL output coefficients in TEE_BigIntComputeExtendedGcd()

Fix TEE_BigIntComputeExtendedGcd() for when only one of u and v output
coefficients reference is NULL as allowed by the GP TEE Internal Core API
specification.

Reported-by: Stefan Schmidt <snst@meek.de>
Closes: https://github.com/OP-TEE/optee_os/issues/7217
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tree-wide: use power-of-2 rounding macros where applicable

Use ROUNDUP2(), ROUNDUP2_OVERFLOW(), ROUNDUP2_DIV() and ROUNDDOWN2() at
places where the rounding argument is a variable value and we want

tree-wide: use power-of-2 rounding macros where applicable

Use ROUNDUP2(), ROUNDUP2_OVERFLOW(), ROUNDUP2_DIV() and ROUNDDOWN2() at
places where the rounding argument is a variable value and we want to
leverage the implementation of these routines optimized for a
power-of-2 rounding argument.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

pta: veraison_attestation: integrate Veraison remote attestation PTA

Copy remote attestation PTA functionality from the repository:
https://github.com/iisec-suzaki/optee-ra (commit: 80ca8ef), and ma

pta: veraison_attestation: integrate Veraison remote attestation PTA

Copy remote attestation PTA functionality from the repository:
https://github.com/iisec-suzaki/optee-ra (commit: 80ca8ef), and make
the following adjustments for integration:

- Add build configuration for remote attestation PTA by introducing
the CFG_VERAISON_ATTESTATION_PTA option to align with the new naming
convention.
- Replace the custom base64 implementation with the base64 library
added in PR OP-TEE#7007.
- Update QCBOR integration by removing custom QCBOR files and using
the standard library, adjusting paths as necessary.
- Apply region validation improvements introduced in PR OP-TEE#6195.
- Update API calls in sign.c to align with libmbedtls changes from
PR OP-TEE#6151.
- Calculate the required buffer size at runtime to minimize memory
allocation.
- Refactor code to improve readability and maintainability.
- Add SPDX license identifier (BSD-2-Clause) and copyright notice.

Signed-off-by: Yuichi Sugiyama <yuichis@ricsec.co.jp>
Reviewed-by: Thomas Fossati <thomas.fossati@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: fix TEE_MemMove()'s return type

In all the published versions of the TEE Internal API Specification,
the return type of TEE_MemMove() has always been void, not void *.

Fixes: b01047730e77

libutee: fix TEE_MemMove()'s return type

In all the published versions of the TEE Internal API Specification,
the return type of TEE_MemMove() has always been void, not void *.

Fixes: b01047730e77 ("Open-source the TEE Core")
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_api_types.h: default alignment for TEE_BigIntFMMContext

Remove the custom alignment from TEE_BigIntFMMContext.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Car

tee_api_types.h: default alignment for TEE_BigIntFMMContext

Remove the custom alignment from TEE_BigIntFMMContext.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

user_ta_header.h: update TA_FLAGS_MASK for RPMB support

TA_FLAG_DEVICE_ENUM_RPMB 12 is a valid flag now. Fixes usage of
this new flag at runtime in TAs.

Signed-off-by: Mikko Rapeli <mikko.rapeli@li

user_ta_header.h: update TA_FLAGS_MASK for RPMB support

TA_FLAG_DEVICE_ENUM_RPMB 12 is a valid flag now. Fixes usage of
this new flag at runtime in TAs.

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: add flag to enumerate TAs when secure storage is ready

Add TA_FLAG_DEVICE_ENUM_TEE_STORAGE_PRIVATE with similar usage as
TA_FLAG_DEVICE_ENUM_SUPP except that it is used to add an enumeration
p

core: add flag to enumerate TAs when secure storage is ready

Add TA_FLAG_DEVICE_ENUM_TEE_STORAGE_PRIVATE with similar usage as
TA_FLAG_DEVICE_ENUM_SUPP except that it is used to add an enumeration
point when secure storage is ready.

The new TA function PTA_CMD_GET_DEVICES_RPMB is added to the device PTA
to report TAs depending on RPMB.

PTA_CMD_GET_DEVICES_RPMB will if CFG_REE_FS!=y and CFG_RPMB_FS=y first
try to initialize RPMB and only if successful will it return eventual
TAs with the TA_FLAG_DEVICE_ENUM_TEE_STORAGE_PRIVATE flag set.

PTA_CMD_GET_DEVICES_SUPP will if CFG_REE_FS=y include TAs with the
TA_FLAG_DEVICE_ENUM_TEE_STORAGE_PRIVATE flag set in the list of TAs to
return.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

pta: remoteproc: Add command to release remote processor resources

This patch introduces a new PTA command `PTA_REMOTEPROC_RELEASE` to
release the resources associated with a remote processor.

- De

pta: remoteproc: Add command to release remote processor resources

This patch introduces a new PTA command `PTA_REMOTEPROC_RELEASE` to
release the resources associated with a remote processor.

- Definition of the `PTA_REMOTEPROC_RELEASE` PTA command the header file
- Implement the command in the stm32mp remote proc PTA to request the
clean of the remoteproc memories.

Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

Move base64.{c,h} from libutee to libutils

Make the base64 routines publicly available by moving them from libutee
to libutils. The _ prefix is removed from the public functions since
they aren't in

Move base64.{c,h} from libutee to libutils

Make the base64 routines publicly available by moving them from libutee
to libutils. The _ prefix is removed from the public functions since
they aren't internal to libutee any longer.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Fix TA_FLAGS_MASK

Add missing TA_FLAG_DONT_CLOSE_HANDLE_ON_CORRUPT_OBJECT to
TA_FLAGS_MASK.

Fixes: 138c5102ef4c ("GP131: Add TA property gpd.ta.doesNotCloseHandleOnCorruptObject")
Suggested-by: Mik

Fix TA_FLAGS_MASK

Add missing TA_FLAG_DONT_CLOSE_HANDLE_ON_CORRUPT_OBJECT to
TA_FLAGS_MASK.

Fixes: 138c5102ef4c ("GP131: Add TA property gpd.ta.doesNotCloseHandleOnCorruptObject")
Suggested-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutee: handle buffer_two_blocks correctly

For operations with buffer_two_blocks true, calculate the required size
of the out buffer (req_dlen) correctly in TEE_CipherUpdate().
tee_buffer_update()

libutee: handle buffer_two_blocks correctly

For operations with buffer_two_blocks true, calculate the required size
of the out buffer (req_dlen) correctly in TEE_CipherUpdate().
tee_buffer_update() is fixed with a matching update.

buffer_two_blocks set to true mandates buffering at least one block + a
byte and at most two full blocks.

Fix needed by TEE_ALG_AES_CTS and TEE_ALG_AES_XTS.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutee: process a full buffer immediately

In tee_buffer_update, libutee currently delays processing an input
block until more space is needed in the buffer, which is perfectly
valid behavior, but d

libutee: process a full buffer immediately

In tee_buffer_update, libutee currently delays processing an input
block until more space is needed in the buffer, which is perfectly
valid behavior, but doesn't match AOSP compatibility requirements.

Specifically, both CTS (testKatEncryptOneByteAtATime [1]) and VTS
(EncryptionOperationsTest.*OneByteAtATime [2]) expect block cipher
implementations to produce an output block as soon as a full block
of input has been received. Change libutee behavior to be AOSP
compatible.

Link: https://android.googlesource.com/platform/cts/+/refs/heads/main/tests/tests/keystore/src/android/keystore/cts/BlockCipherTestBase.java#779 [1]
Link: https://android.googlesource.com/platform/hardware/interfaces/+/refs/heads/main/security/keymint/aidl/vts/functional/KeyMintAidlTestBase.cpp#827 [2]
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...