core: dt_driver: Add support for disabled devices

In systems where there are multiple instances of the devices like two TRNGs
where one is reserved for REE environment and one is for TEE environment

core: dt_driver: Add support for disabled devices

In systems where there are multiple instances of the devices like two TRNGs
where one is reserved for REE environment and one is for TEE environment
those can be defined in device tree in following way:

ree-trng {
status = "okay";
secure-status = "disabled";
...
}

tee-trng {
status = "disabled";
secure-status = "okay";
...
}

If OP-TEE has driver enabled for the device both devices will be probed.

Driver can detect device's 'status' and 'secure-status' settings and return
TEE_ERROR_NODE_DISABLED value for one that is not for its use.

This will indicate to device driver probing to continue without an error.

Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pta: scmi: new API to support MSG header communication protocol

in the SCMI PTA.
Adds a new capability and a new command to the SCMI PTA API to support
SCMI MSG header communication protocol.

core: pta: scmi: new API to support MSG header communication protocol

in the SCMI PTA.
Adds a new capability and a new command to the SCMI PTA API to support
SCMI MSG header communication protocol. Capability
PTA_SCMI_CAPS_MSG_HEADER allows client and service to negotiate the
desired transport configuration. Command PTA_SCMI_CMD_PROCESS_MSG_CHANNEL
allows client to request processing of a message sent based on that
message exchange protocol where input and output SCMI messages are
exchange using OP-TEE shared memory references provided by the
client.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee: fix value of TEE_ECC_CURVE_SM2

The GlobalPlatform TEE Interbal Core API specification v1.3 has the
following text:

In TEE Internal Core API v1.2 and v1.2.1, TEE_ECC_CURVE_25519 and
TEE_E

libutee: fix value of TEE_ECC_CURVE_SM2

The GlobalPlatform TEE Interbal Core API specification v1.3 has the
following text:

In TEE Internal Core API v1.2 and v1.2.1, TEE_ECC_CURVE_25519 and
TEE_ECC_CURVE_SM2 were incorrectly assigned the same identifier.

Indeed, both were 0x00000300. In v1.3, TEE_ECC_CURVE_SM2 is now
0x00000400. Update the code accordingly.

This is an API and ABI change, but note that this value is used only
in TEE_IsAlgorithmSupported(). Therefore, only TAs that dynamically
check for algorithm support at runtime may be impacted. This change
was tested on QEMUv8 by running "old" TAs (built without this commit)
with a "newer" OP-TEE OS (including this commit), that is:
- 'make run' and run 'xtest'
- apply this change
- 'make arm-tf && make run-only' and run 'xtest' again. No errors.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add support for MTE

Adds support for the Armv8.5-A Memory Tagging Extension with
CFG_MEMTAG=y.

A memtag.h API is introduced to handle this extension. If CFG_MEMTAG=n
the API doesn't add any o

core: add support for MTE

Adds support for the Armv8.5-A Memory Tagging Extension with
CFG_MEMTAG=y.

A memtag.h API is introduced to handle this extension. If CFG_MEMTAG=n
the API doesn't add any overhead and the behaviour is unchanged. With
CFG_MEMTAG=y a check is performed to see if the platform can support MTE
and the API is dynamically configured accordingly. This means that it's
safe to have CFG_MEMTAG=y even for platforms not supporting MTE. There
will be some minimal overhead then, but likely not noticeable.

An entry is also added in the TEE_PROPSET_TEE_IMPLEMENTATION for a u32
property "org.trustedfirmware.optee.cpu.feat_memtag_implemented". The
property is set to a non-zero value only if CFG_CORE_MEMTAG is
configured and the underlying CPU supports FEAT_MTE.

This commit still only uses the default tag with the value 0 resulting
in unchanged pointers when accessing memory. However, all plumbing is in
place allowing for instance tagging of the heap in a later commit.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: arm64: add read_dczid_el0()

Adds read_dczid_el0() to read Data Cache Zero ID register.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wikla

libutee: arm64: add read_dczid_el0()

Adds read_dczid_el0() to read Data Cache Zero ID register.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: dt_driver: drivers to test probe deferral

Implements driver providers for some emulated resource (clocks and reset
controllers), consumer drivers and a embedded test DTSI file to
test the DT_D

core: dt_driver: drivers to test probe deferral

Implements driver providers for some emulated resource (clocks and reset
controllers), consumer drivers and a embedded test DTSI file to
test the DT_DRIVER probe sequence.

The driver consumer run few tests and logs results locally. The
result participates in core self test result reported by the
PTA test interface.

One can test with vexpress platform flavor qemu_virt and qemu_v8 using,
for example, the build instruction below:
make PLATFORM=vexpress-qemu_virt \
CFG_DT_DRIVER_EMBEDDED_TEST=y \
CFG_EMBED_DTB_SOURCE_FILE=embedded_dtb_test.dts

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pta: add remote attestation PTA

Add a PTA to perform remote attestation of user space TAs and TEE core
memory. Enabled with CFG_ATTESTATION_PTA=y. Four commands are defined:

- PTA_ATTESTATION

core: pta: add remote attestation PTA

Add a PTA to perform remote attestation of user space TAs and TEE core
memory. Enabled with CFG_ATTESTATION_PTA=y. Four commands are defined:

- PTA_ATTESTATION_GET_PUBKEY

Returns the public RSA key used to sign the measurements generated by
the other commands. The key pair is generated on first call (any
command) and saved to secure storage. It is therefore device-specific.

- PTA_ATTESTATION_GET_TA_SHDR_DIGEST

Returns the digest found in the secure header (struct shdr) of a TA
or trusted shared library given its UUID.

- PTA_ATTESTATION_HASH_TA_MEMORY

This command must be called by a user space TA (not a CA). It computes
a hash of the memory pages that belong to the caller and contain code
or read-only data. This hash is therefore a runtime measurement of the
TA execution environment, including shared libraries (if any). It can be
used to remotely attest that the device is running untampered TA code.

- PTA_ATTESTATION_HASH_TEE_MEMORY

Returns a hash of the TEE OS core (.text and .rodata sections, less the
small part of .text that may be modified at boot). Similar to
PTA_ATTESTATION_HASH_TA_MEMORY, the hash is computed each time the
command is called, so that the result reflects the actual memory
content.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

pta: add PTA for RTC

On some systems, when the RTC is secured, there is no way for the
normal world to access it. This PTA uses the RTC API to allow a
Linux OP-TEE based RTC driver to communicate wi

pta: add PTA for RTC

On some systems, when the RTC is secured, there is no way for the
normal world to access it. This PTA uses the RTC API to allow a
Linux OP-TEE based RTC driver to communicate with the RTC that is
secured.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Clément Léger <clement.leger@bootlin.com>

show more ...

libutee: TEE_{Create,Open}PersistentObject() should accept NULL object ID

Passing a NULL objectId to TEE_CreatePersistentObject() or
TEE_OpenPersistentObject() should be allowed as long as objectIdL

libutee: TEE_{Create,Open}PersistentObject() should accept NULL object ID

Passing a NULL objectId to TEE_CreatePersistentObject() or
TEE_OpenPersistentObject() should be allowed as long as objectIdLen is
zero. Indeed, a zero-size object identifier is valid as per the
description of TEE_RenamePersistentObject(). In addition, "a Trusted
Application SHALL NOT pass the NULL pointer in an [in] parameter, except
perhaps if the buffer size is zero". Thus (NULL, 0) is valid.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: Panic when IV is provided for ECB modes

Ideally, the ECB mode doesn't need an IV at all.
The GlobalPlatform spec says "IV required: No" for
the algorithms that use this mode (Table 6-6b).

libutee: Panic when IV is provided for ECB modes

Ideally, the ECB mode doesn't need an IV at all.
The GlobalPlatform spec says "IV required: No" for
the algorithms that use this mode (Table 6-6b).

So, in order to be inclined to the requirement of the
spec, the implementation can panic when IV is provided
for ECB modes.

Signed-off-by: Sadiq Hussain <sadiq.muchumarri@intel.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Generate ELF Note for BTI in all arm64 asm files

Add program property note section in the assembly files to
ensure that when linking them, program property note section
is generated in the final ELF

Generate ELF Note for BTI in all arm64 asm files

Add program property note section in the assembly files to
ensure that when linking them, program property note section
is generated in the final ELF.

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

elf_common: add GNU note types and properties

Add NT_GNU_PROPERTY_TYPE_0 bits and
GNU_PROPERTY_AARCH64_FEATURE_1_AND used to tell which
CPU features the binary is compatible with.

Signed-off-by: Ru

elf_common: add GNU note types and properties

Add NT_GNU_PROPERTY_TYPE_0 bits and
GNU_PROPERTY_AARCH64_FEATURE_1_AND used to tell which
CPU features the binary is compatible with.

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pta: APDU pseudo trusted application

Allow trusted applications and REE clients to send APDU frames to a
secure element.

Even though secure elements are usually accessible from serial buses,

core: pta: APDU pseudo trusted application

Allow trusted applications and REE clients to send APDU frames to a
secure element.

Even though secure elements are usually accessible from serial buses,
when they have been initialized in OP-TEE is possible that the SCP03
secret keys are only available in the Trusted World and therefore APDU
requests must be handled in OP-TEE.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: crypto: Secure Element cryptographic interface

Extract cryptographic operations specific to Secure Elements from the
more generic cryptographic interface.

Also, the Secure Channel Protocol03

core: crypto: Secure Element cryptographic interface

Extract cryptographic operations specific to Secure Elements from the
more generic cryptographic interface.

Also, the Secure Channel Protocol03 is a global protocol supported by
most SEs and not NXP SE05X specific. Use this commit to reflect this
fact.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee: Fix warning in TEE_BigIntInvMod()

Fixes a -Wdeclaration-after-statement warning in TEE_BigIntInvMod:
lib/libutee/tee_api_arith_mpi.c: In function ‘TEE_BigIntInvMod’:
lib/libutee/tee_api_ari

libutee: Fix warning in TEE_BigIntInvMod()

Fixes a -Wdeclaration-after-statement warning in TEE_BigIntInvMod:
lib/libutee/tee_api_arith_mpi.c: In function ‘TEE_BigIntInvMod’:
lib/libutee/tee_api_arith_mpi.c:539:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
mbedtls_mpi mpi_dest;
^~~~~~~~~~~

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: Fix warning in bigint_binary_mod()

Fixes a -Wdeclaration-after-statement warning in bigint_binary_mod:
lib/libutee/tee_api_arith_mpi.c: In function ‘bigint_binary_mod’:
lib/libutee/tee_api_

libutee: Fix warning in bigint_binary_mod()

Fixes a -Wdeclaration-after-statement warning in bigint_binary_mod:
lib/libutee/tee_api_arith_mpi.c: In function ‘bigint_binary_mod’:
lib/libutee/tee_api_arith_mpi.c:358:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
mbedtls_mpi mpi_dest;
^~~~~~~~~~~
lib/libutee/tee_api_arith_mpi.c: In function ‘TEE_BigIntInvMod’:
lib/libutee/tee_api_arith_mpi.c:539:2: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
mbedtls_mpi mpi_dest;

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: define error core TEE_ERROR_DEFER_DRIVER_INIT

Define TEE_Result implementation specific error code
TEE_ERROR_DEFER_DRIVER_INIT intended to be used when a driver instance
fails to initialize

libutee: define error core TEE_ERROR_DEFER_DRIVER_INIT

Define TEE_Result implementation specific error code
TEE_ERROR_DEFER_DRIVER_INIT intended to be used when a driver instance
fails to initialize because another device driver it depends on is not
yet initialized.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

lib: libutee: init array to 0

Add missing initialization in array declaration.

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Revi

lib: libutee: init array to 0

Add missing initialization in array declaration.

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>

show more ...

libutee: Handle zero sized buffer allocations

The GlobalPlatform TEE internal API specification mentions the following
about zero sized buffer allocations:
"The value returned is undefined but guara

libutee: Handle zero sized buffer allocations

The GlobalPlatform TEE internal API specification mentions the following
about zero sized buffer allocations:
"The value returned is undefined but guaranteed to be different from NULL.
The Trusted Application SHALL NOT access the returned pointer.
The Trusted Application SHOULD panic if the memory pointed to by such a
pointer is accessed for either read or write"

But, we would never observe a TA panic because a zero size is internally
translated to 1 and finally to (2 * sizeof(long)) in the bget() function.

This patch handles this aspect so to return a known non-NULL invalid
pointer when the requested size is zero.

Signed-off-by: Sadiq Hussain <sadiq.muchumarri@intel.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Revert "libutee: TEE_MACCompareFinal(): panic if input size is too large"

This reverts commit dbb3274a60f0b258fe115ed1678fc569335c0c5d. It turns
out the panic reason cited in the commit ("If input d

Revert "libutee: TEE_MACCompareFinal(): panic if input size is too large"

This reverts commit dbb3274a60f0b258fe115ed1678fc569335c0c5d. It turns
out the panic reason cited in the commit ("If input data exceeds maximum
length for the algorithm") applies to the message only and has nothing
to do with macLen. The same sentence appears elsewhere in the spec where
there is no ambiguity.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: TEE_MACCompareFinal(): panic if input size is too large

The GlobalPlatform TEE Internal Core API specification mentions the
following panic reason for TEE_MACCompareFinal(): "if input data

libutee: TEE_MACCompareFinal(): panic if input size is too large

The GlobalPlatform TEE Internal Core API specification mentions the
following panic reason for TEE_MACCompareFinal(): "if input data exceeds
the maximum length for the algorithm". The current code returns
TEE_ERROR_MAC_INVALID instead. Fix this by assigning error code
TEE_ERROR_BAD_PARAMETERS which gets translated into a panic later.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

synquacer: rng-pta: move rng_pta_client.h to common path

Header is platform independent and can be used by generic RNG PTA.

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Reviewed-by: Jerome

synquacer: rng-pta: move rng_pta_client.h to common path

Header is platform independent and can be used by generic RNG PTA.

Signed-off-by: Sergiy Kibrik <Sergiy_Kibrik@epam.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: enable FF-A with SPM Core at S-EL2

This enables support for FF-A with SPM Core at S-EL2 in a secure
hypervisor while OP-TEE is running at S-EL1 as a SP.
This configuration is also know as "S-E

core: enable FF-A with SPM Core at S-EL2

This enables support for FF-A with SPM Core at S-EL2 in a secure
hypervisor while OP-TEE is running at S-EL1 as a SP.
This configuration is also know as "S-EL2 SPMC" in the FFA specification.

Compile with CFG_CORE_SEL2_SPMC=y

Note that this is an experimental feature, ABIs etc may have
incompatible changes.

This depends on using the FF-A v4 patchset in the Linux kernel.

Reviewed-by: Jelle Sels <jelle.sels@arm.com>
Co-developed-by: Marc Bonnici <marc.bonnici@arm.com>
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm64: add read_cntvct()

Adds read_cntvct() to read Counter-timer Virtual Count register.

Note that arm32 already have this function.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-of

arm64: add read_cntvct()

Adds read_cntvct() to read Counter-timer Virtual Count register.

Note that arm32 already have this function.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Rename to barrier_read_counter_timer()

Renames barrier_read_cntpct() to barrier_read_counter_timer() to use a
neutral name for the counter.

With SPMC at S-EL2 OP-TEE will be virtualized and must us

Rename to barrier_read_counter_timer()

Renames barrier_read_cntpct() to barrier_read_counter_timer() to use a
neutral name for the counter.

With SPMC at S-EL2 OP-TEE will be virtualized and must use CNTVCT
instead of CNTPCT while the old physical OP-TEE must continue to use
CNTPCT.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...