xtest fails to run on fvp -

[satheesbalya-arm]

xtest fails to run and gives the following error. Having read other threads about similar issue I have checked few things and it seems the tee driver has not loaded. I have checked the optee node in dtb. Appreciate any help. Thanks.

root@fvp:~# xtest
Run test suite with level=0
TEE test application started with device [(null)]
Failed to open TEE context: 0xffff0008

optee {
	method = "smc";
	compatible = "linaro,optee-tz";
};
root@fvp:~# ls /dev/tee*
ls: /dev/tee*: No such file or directory

root@fvp:~# ls /sys/firmware/devicetree/base/firmware/optee/
compatible  method      name

root@fvp:~# ps -a | grep tee-supplicant
451 root      0:00 grep tee-supplicant

root@fvp:~# tee-supplicant &
root@fvp:~# ERR [453] TEES:main:678: failed to find an OP-TEE supplicant device

root@fvp:~# dmesg | grep optee
optee: probing for conduit method from DT.
optee: api uid mismatch

OPTEE log:
I/TC: OP-TEE version: 3.3.0-dev #1 Wed May 29 10:21:26 UTC 2019 aarch64
D/TC:0 0 tee_ta_register_ta_store:534 Registering TA store: 'REE' (priority 10)
D/TC:0 0 tee_ta_register_ta_store:534 Registering TA store: 'Secure Storage TA' (priority 9)
D/TC:0 0 mobj_mapped_shm_init:702 Shared memory address range: 6200000, 8200000
D/TC:0 0 gic_it_set_cpu_mask:246 cpu_mask: writing 0xff0000 to 0x8200824
D/TC:0 0 gic_it_set_cpu_mask:250 cpu_mask: 0x0
D/TC:0 0 gic_it_set_prio:263 prio: writing 0x1 to 0x8200426
I/TC: Initialized
D/TC:0 0 init_primary_helper:928 Primary CPU switching to normal world boot
D/TC:4   generic_boot_cpu_on_handler:967 cpu 4: a0 0x0
D/TC:4   init_secondary_helper:952 Secondary CPU Switching to normal world boot

[jforissier]

optee: api uid mismatch

That is clearly why the driver has not loaded. Which kernel version? Upstream driver?

[satheesbalya-arm]

Kernel version is:
4.19.34-yocto-standard

TF-A/Optee/Linux built using Yocto project.

[jbech-linaro]

TF-A/Optee/Linux built using Yocto project.

Is it this recipe? https://layers.openembedded.org/layerindex/branch/master/layer/meta-optee/

Koen left Linaro a while ago, so not sure if there is anyone maintaining that, @fboudra do you know anything about that? The OP-TEE core team, doesn't use Yocto, so we're a bit on thin ice when it comes to issues like this and relies on the people who put together the recipes.

[satheesbalya-arm]

Yes, you're right about the recipe.
https://git.linaro.org/openembedded/meta-linaro.git/tree/meta-optee?h=master

[satheesbalya-arm]

Sorry I missed to add the information that the Linux is running on Xen hypervisor. I have added CFG_VIRTUALIZATION=y in the optee config. It seems Xen 4.12 does not support SMCCC required for communication between kernel and optee-os. I tried a branch that has an experimental support but without success (https://github.com/lorc/xen)

[github-actions]

This issue has been marked as a stale issue because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment saying that you would like to have the label removed otherwise this issue will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time.

[sajtrga]

Did anybody have any luck with this? I am having the exact same issue.
I am running Linux with Xen on QEMU for ARMv8a. I am not using Yocto, I am building individual components manually.
Kernel version: 5.4.50
Xen version: 4.14.0
QEMU version 5.0.0
OP-TEE version: 3.9.0

# tee-supplicant
ERR [120] TEES:main:704: failed to find an OP-TEE supplicant device

# dmesg | grep optee
optee: probing for conduit method from DT.
optee: api uid mismatch

# ls /dev/tee*
ls: /dev/tee*: No such file or directory

# ls /sys/firmware/devicetree/base/firmware/optee/
compatible  method      name

[jforissier]

@sajtrga have you enabled the TEE support in Xen? Quoting https://xenproject.org/2019/12/18/whats-new-in-xen-4-13/:

You also need to build Xen with OP-TEE mediator support (this feature is in “Technology Preview” state and is not enabled by default).

[sajtrga]

Thank you for that, I have not enabled TEE support in Xen. That being said, I now built Xen 4.14 with CONFIG_TEE=y, but I still keep getting the exact same error. I also tried the experimental branch posted above without success.

[jforissier]

OK, at this point I have nothing more to suggest than adding debug traces to the kernel and OP-TEE to figure out the cause of optee: api uid mismatch.

[sajtrga]

I have contacted lorc, the developer of the TEE mediator in Xen, and he helped me resolve a few issues. First, for the record, the proper way to build Xen 4.13 with OP-TEE support is:

1. $ export XEN_CONFIG_EXPERT=y
2. add CONFIG_TEE=y and CONFIG_OPTEE=y to xen/.config

Then, the TEE mediator does not support OP-TEE version 3.9. It fails at the end of the optee_probe function in xen/arch/arm/tee/optee.c, when trying to determine whether OP-TEE was built with virtualization support. OP-TEE version 3.5 seems to go through OK, however.

Lastly, using Linux kernel 5.4 results in the optee driver causing this error:
optee: PTA_CMD_GET_DEVICES invoke function err: ffff0006
Which then causes a kernel panic. Linux kernel 5.1 doesn't seem to have this problem.

However, despite the advances made, I still cannot load tee-supplicant:

# tee-supplicant
ERR [174] TEES:main:704: failed to find an OP-TEE supplicant device

# ls /dev/tee*
ls: /dev/tee*: No such file or directory

# dmesg | grep optee
[    4.384665] optee: probing for conduit method from DT.
[    4.388607] optee: revision 3.4

# ls /sys/firmware/devicetree/base/firmware/optee/
compatible  method      name

[sajtrga]

Last piece of the puzzle: The patch posted in this issue linaro-swg/linux#77
When this modification is made to the optee driver in Linux 5.4, tee-supplicant can be started and xtest finally runs without problems.

I'm sorry for hijacking this old issue, but perhaps it can now be treated as resolved.

[jforissier]

I'm sorry for hijacking this old issue, but perhaps it can now be treated as resolved.

No worries, the important thing now is to make sure that all known issues have been addressed.
You're mentioning a kernel patch which does not seem to have landed upstream yet (5.8). @jenswi-linaro @lorc any comment on this? Thanks.

[jenswi-linaro]

If it was ever posted I've missed it.

[thecuong0000]

I have same problem. Can you give me path to fix this issue?. @sajtrga @jforissier @jenswi-linaro
Kernel version: 4.14
Yocto version: 3.21
root:/ $ ./optee_example_hello_world
./optee_example_hello_world: TEEC_InitializeContext failed with code 0xffff0008
root:/ $ dmesg | grep tee
[ 0.518835] optee: optee_driver_init
[ 0.518912] optee: optee_probe.
[ 0.518928] optee: probing for conduit method from DT.
[ 0.518959] optee: method smc
[ 0.518973] optee: res.a0 0xfe9f78fc res.a1 = 0x00000007 res.a2 = 0x08eb2f18 res.a3 = 0x00000000
[ 0.519107] optee: res.a0 1 0xffffffff res.a1 = 0x00000000 res.a2 = 0x00000000 res.a3 = 0x00000000
[ 0.519130] optee: api uid mismatch