Add OP-TEE heap, RNG and time platform support under WOLFSSL_OPTEE

Author: dgarske

src/internal.c

@@ -11998,6 +11998,20 @@ ProtocolVersion MakeDTLSv1_3(void)
     }
 #endif
 
+#elif defined(WOLFSSL_OPTEE)
+    word32 LowResTimer(void)
+    {
+        TEE_Time now;
+
+    /* TEE_GetSystemTime is monotonic for the life of the trusted
+     * application and is not the normal world's clock, so it cannot be
+     * steered from outside. It has no relation to the epoch, which is all
+     * this needs. */
+        TEE_GetSystemTime(&now);
+
+        return (word32)now.seconds;
+    }
+
 #elif defined(TIME_OVERRIDES)
 #if !defined(NO_ASN) && !defined(NO_ASN_TIME)
     /* use same asn time overrides unless user wants tick override above */

src/tls13.c

@@ -2117,6 +2117,20 @@ int DeriveTls13Keys(WOLFSSL* ssl, int secret, int side, int store)
     }
 #endif
 
+#elif defined(WOLFSSL_OPTEE)
+    word32 TimeNowInMilliseconds(void)
+    {
+        TEE_Time now;
+
+    /* TEE_GetSystemTime is monotonic for the life of the trusted
+     * application and is not the normal world's clock, so it cannot be
+     * steered from outside. It has no relation to the epoch, which is all
+     * this needs. */
+        TEE_GetSystemTime(&now);
+
+        return (word32)((now.seconds * 1000) + now.millis);
+    }
+
 #elif defined(TIME_OVERRIDES)
 #if !defined(NO_ASN) && !defined(NO_ASN_TIME)
     word32 TimeNowInMilliseconds(void)
@@ -2400,6 +2414,20 @@ int DeriveTls13Keys(WOLFSSL* ssl, int secret, int side, int store)
     }
 #endif
 
+#elif defined(WOLFSSL_OPTEE)
+    sword64 TimeNowInMilliseconds(void)
+    {
+        TEE_Time now;
+
+        /* TEE_GetSystemTime is monotonic for the life of the trusted
+         * application and is not the normal world's clock, so it cannot be
+         * steered from outside. It has no relation to the epoch, which is all
+         * this needs. */
+        TEE_GetSystemTime(&now);
+
+        return ((sword64)now.seconds * 1000) + (sword64)now.millis;
+    }
+
 #elif defined(TIME_OVERRIDES)
 #if !defined(NO_ASN) && !defined(NO_ASN_TIME)
     sword64 TimeNowInMilliseconds(void)

wolfcrypt/benchmark/benchmark.c

@@ -19013,6 +19013,22 @@ void bench_mldsaKeySign(byte level)
         return ret;
 #endif
     }
+#elif defined(WOLFSSL_OPTEE)
+
+    double current_time(int reset)
+    {
+        TEE_Time now;
+
+        (void)reset;
+
+        /* Monotonic for the life of the trusted application, millisecond
+         * granularity. Short operations need enough iterations that the
+         * resolution does not dominate. */
+        TEE_GetSystemTime(&now);
+
+        return (double)now.seconds + ((double)now.millis / 1000.0);
+    }
+
 #elif defined(WOLFSSL_ZEPHYR)
 
     #include <time.h>

wolfcrypt/src/random.c

@@ -221,6 +221,9 @@ This library contains implementation for the random number generator.
 #elif defined(WOLFSSL_DEOS)
 #elif defined(MICRIUM)
 #elif defined(WOLFSSL_NUCLEUS)
+#elif defined(WOLFSSL_OPTEE)
+    /* for TEE_GenerateRandom */
+    #include <tee_internal_api.h>
 #elif defined(WOLFSSL_PB)
 #elif defined(WOLFSSL_ZEPHYR)
 #elif defined(WOLFSSL_TELIT_M2MB)
@@ -10570,6 +10573,21 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
         return 0;
     }
 
+#elif defined(WOLFSSL_OPTEE)
+
+    /* OP-TEE trusted application. TEE_GenerateRandom is the secure world's
+     * own entropy source, so it seeds the DRBG here rather than replacing it;
+     * a build that would rather use it directly can still set
+     * CUSTOM_RAND_GENERATE_BLOCK. */
+    int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)
+    {
+        (void)os;
+
+        TEE_GenerateRandom(output, (size_t)sz);
+
+        return 0;
+    }
+
 #elif defined(WOLFSSL_PB)
 
     int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz)

wolfcrypt/src/wc_port.c

@@ -4922,6 +4922,25 @@ time_t fsl_time(time_t* t)
 }
 #endif
 
+#if defined(WOLFSSL_OPTEE)
+
+time_t optee_time(time_t* timer)
+{
+    TEE_Time reeTime;
+
+    /* Seconds since the epoch, from the rich OS. See the note on XTIME in
+     * wc_port.h: the normal world owns this clock, so it is not a trusted
+     * time source. */
+    TEE_GetREETime(&reeTime);
+
+    if (timer != NULL)
+        *timer = (time_t)reeTime.seconds;
+
+    return (time_t)reeTime.seconds;
+}
+
+#endif /* WOLFSSL_OPTEE */
+
 #if defined(MICRIUM)
 
 time_t micrium_time(time_t* timer)

wolfssl/wolfcrypt/settings.h

@@ -3525,8 +3525,11 @@
     #define NO_WRITEV
     #define NO_MAIN_DRIVER
     #define SINGLE_THREADED
-    #define NO_ASN_TIME /* no wall clock in a TA */
-    #define USER_TICKS
+    /* No trusted wall clock in a trusted application: the only one belongs to
+     * the normal world. The timers come from TEE_GetSystemTime, which is
+     * monotonic and outside the normal world's reach, so USER_TICKS is not
+     * needed; a project can still define it to supply its own. */
+    #define NO_ASN_TIME
 #endif /* WOLFSSL_OPTEE */
 
 /* FreeScale MMCAU hardware crypto has 4 byte alignment.

wolfssl/wolfcrypt/types.h

@@ -833,6 +833,25 @@ enum {
     #endif
     #define XREALLOC(p, n, h, t) m2mb_os_realloc((p), (n))
 
+#elif defined(WOLFSSL_OPTEE)
+    /* An OP-TEE trusted application links libutee rather than a C library and
+     * has no std heap; the TEE Internal Core API supplies the allocator.
+     * TEE_MALLOC_FILL_ZERO so an allocation never carries another one's
+     * bytes, which matters more here than the cost: a trusted application
+     * holds key material. */
+    #include <tee_internal_api.h>
+    #define XMALLOC(s, h, t)     ((void)(h), (void)(t), \
+        TEE_Malloc((size_t)(s), TEE_MALLOC_FILL_ZERO))
+    #ifdef WOLFSSL_XFREE_NO_NULLNESS_CHECK
+        #define XFREE(p, h, t)   do { (void)(h); (void)(t); \
+            TEE_Free(p); } while (0)
+    #else
+        #define XFREE(p, h, t)   do { void* xp = (p); (void)(h); (void)(t); \
+            if (xp != NULL) TEE_Free(xp); } while (0)
+    #endif
+    #define XREALLOC(p, n, h, t) ((void)(h), (void)(t), \
+        TEE_Realloc((p), (size_t)(n)))
+
 #elif defined(NO_WOLFSSL_MEMORY)
     #ifdef WOLFSSL_NO_MALLOC
         /* this platform does not support heap use */

wolfssl/wolfcrypt/wc_port.h

@@ -1748,6 +1748,20 @@ WOLFSSL_ABI WOLFSSL_API int wolfCrypt_Cleanup(void);
             extern time_t deos_time(time_t* timer);
             #define XTIME(t1) deos_time((t1))
         #endif
+#elif defined(WOLFSSL_OPTEE)
+    #include <time.h>
+    #include <tee_internal_api.h>
+    /* A trusted application has no trusted wall clock. TEE_GetREETime is the
+     * normal world's, so it is attacker influenced and fit for logging and
+     * freshness, not for deciding certificate validity. That is why the
+     * WOLFSSL_OPTEE block in settings.h sets NO_ASN_TIME; a port that turns
+     * that off is choosing to trust the rich OS clock. */
+    #ifndef XTIME
+        extern time_t optee_time(time_t* timer);
+        #define XTIME(t1)   optee_time((t1))
+    #endif
+    #define WOLFSSL_GMTIME
+
 #elif defined(MICRIUM)
     #include <clk.h>
     #include <time.h>