Enable ASLR by default

With this patch both CFG_TA_ASLR and CFG_CORE_ASLR are set to 'y' by
default.

Removes CFG_TA_ASLR?=y for plat-hikey and plat-vexpress (qemu_virt).

If the current platform do

Enable ASLR by default

With this patch both CFG_TA_ASLR and CFG_CORE_ASLR are set to 'y' by
default.

Removes CFG_TA_ASLR?=y for plat-hikey and plat-vexpress (qemu_virt).

If the current platform doesn't use CFG_DT=y and hasn't overridden
get_aslr_seed() a warning message will be printed on the secure uart and
execution will resume with the default load address.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: support ASLR and paging

Adds support for CFG_WITH_PAGER=y and CFG_CORE_ASLR=y.

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: add support for CFG_CORE_ASLR

Adds support for CFG_CORE_ASLR to load TEE Core at a random address.
ASLR makes the exploitation of memory corruption vulnerabilities more
difficult.

Paging is c

core: add support for CFG_CORE_ASLR

Adds support for CFG_CORE_ASLR to load TEE Core at a random address.
ASLR makes the exploitation of memory corruption vulnerabilities more
difficult.

Paging is currently not supported with CFG_CORE_ASLR=y.

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker script. The
address and size of the buffer is passed to the TEE core via a call to
the gprof PTA. After this call, the TEE core accesses the buffer
periodically, such as when the TA is interrupted by a timer interrupt.

Commit ef305e54eac8 ("libutee: allocate temp secmem for invoke")
modified the way that private TA memory is mapped in TA to TA
invocations, so that memory is mapped only for the duration of the
call. After this point, the memory is unmapped so the gprof sample
buffer becomes inaccessible, resulting in a crash:

E/TC:0 0 Core data-abort at address 0x121356 (translation fault)
E/TC:0 0 fsr 0x00000007 ttbr0 0x0e19206a ttbr1 0x0e18806a cidr 0x2
E/TC:0 0 cpu #0 cpsr 0x800001f2
E/TC:0 0 r0 0x00000000 r4 0x00000000 r8 0x00000000 r12 0x0017bb4b
E/TC:0 0 r1 0x000021ab r5 0x00000000 r9 0x00000000 sp 0x0e1928f0
E/TC:0 0 r2 0x0011d000 r6 0x00000000 r10 0x00000000 lr 0x0e112763
E/TC:0 0 r3 0x00121356 r7 0x0e1928f0 r11 0x00000000 pc 0x0e12958e
E/TC:0 0 Core data-abort at address 0x121356 .debug_info+1184598 (translation fault)
E/TC:0 0 Call stack:
E/TC:0 0 0x0e12958e tee_ta_gprof_sample_pc at optee_os/core/kernel/tee_ta_manager.c:897

The solution is to allocate and map the sample buffer explicitly in
user space when profiling is initialized, and at the same time get rid
of the reserved area in the TA linker script. The TEE core also needs
to check that the sample buffer is valid before writing to it,
otherwise a malicious TA could crash the core by unmapping that memory.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are in

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are invoked by user TAs into the TEE core.

And after this patch ftrace will cover both TA and TEE core code. So lets
rename config option from CFG_TA_FTRACE_SUPPORT to CFG_FTRACE_SUPPORT.

It is optional to enable syscall trace via CFG_SYSCALL_FTRACE=y config
option in addition to CFG_FTRACE_SUPPORT=y config option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: Add support for multi-threaded MPIDR values

If the MT bit is set the affinities are shifted in the MPIDR register
so the get_core_pos_mpidr function needs to be modified accordingly.
This is n

core: Add support for multi-threaded MPIDR values

If the MT bit is set the affinities are shifted in the MPIDR register
so the get_core_pos_mpidr function needs to be modified accordingly.
This is necessary to make OP-TEE to be able to run on multi-threaded
systems. The number of threads/core can be modified by the
CFG_CORE_THREAD_SHIFT makefile parameter. The default value is the
existing single threaded mode.

Signed-off-by: Imre Kis <imre.kis@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Update CHANGELOG for 3.7.0

Update CHANGELOG for 3.7.0

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Akshay Bhat <akshay.bhat@timesys.com> (Atmel SAM)
Tested-by: Andrew F. Davis <af

Update CHANGELOG for 3.7.0

Update CHANGELOG for 3.7.0

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Akshay Bhat <akshay.bhat@timesys.com> (Atmel SAM)
Tested-by: Andrew F. Davis <afd@ti.com> (plat-k3, plat-ti)
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> WaRP7
Tested-by: Clement Faure <clement.faure@nxp.com> (mx6sllevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (mx6sxsabresd)
Tested-by: Clement Faure <clement.faure@nxp.com> (mx6ulevk, mx6ullevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (mx7dsabresd)
Tested-by: Clement Faure <clement.faure@nxp.com> (mx8mm, mx8mn, mx8mq)
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (stm32mp1)
Tested-by: Igor Opaniuk <igor.opaniuk@gmail.com> (Poplar)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (Juno)
Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960, GP)
Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey, GP)
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMUv8)
Tested-by: Joakim Bech <joakim.bech@linaro.org> (FVP)
Tested-by: Joakim Bech <joakim.bech@linaro.org> (Rpi3b)
Tested-by: Joakim Bech <joakim.bech@linaro.org> (Rpi3b with NFS)
Tested-by: Michael Grand <michael.grand.mg@gmail.com> ZynqMP (zcu102, ultra96v1)
Tested-by: Rouven Czerwinski <r.czerwinski@pengutronix.de> (imx-imx8mqevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (LS1046A-RDB)
Tested-by: Sumit Garg <sumit.garg@linaro.org> (Developerbox)
Tested-by: Victor Chong <victor.chong@linaro.org> (Hikey620 AOSP)

show more ...

core: add support for dumping build configuration info on boot

During development, we occasionally experience crashes within the TEE
core. When the tests are run locally, the developer has all the n

core: add support for dumping build configuration info on boot

During development, we occasionally experience crashes within the TEE
core. When the tests are run locally, the developer has all the needed
information to troubleshoot the issue. But when the crash occurs on a
remote host (CI for instance), it is sometimes inconvenient or even
impossible to retrieve files other than the console logs. As a result,
it is equally inconvenient or impossible to obtain a symbolized crash
dump (scripts/symbolize.py needs the dump message but also tee.elf).
If the exact build configuration is known, then it is possible to
reproduce the build locally (assuming the same toolchain is also used
which is not a problem in practice) and proceed with debugging.
Unfortunately the values of the CFG_ flags are not always shown in the
logs and omitting only one flag can significantly change the TEE
binary.

This commit introduces CFG_SHOW_CONF_ON_BOOT (default n). When enabled,
the contents of the build configuration file $O/conf.mk is printed
to the secure console during initialization with TRACE_INFO severity.
The file is compressed to reduce memory usage and space used in the
logs, and it is encoded into printable text.

To obtain the conf.mk file, one needs to copy and paste the encoded
text into 'base64 -d | xz -d'. These two commands are also required at
build time when CFG_SHOW_CONF_ON_BOOT is y.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: REE FS TAs: disable CFG_REE_FS_TA_BUFFERED by default

Now that the TA loader is in user space [1], the main reason why we had
introduced CFG_REE_FS_TA_BUFFERED [2] does not exist anymore. Ther

core: REE FS TAs: disable CFG_REE_FS_TA_BUFFERED by default

Now that the TA loader is in user space [1], the main reason why we had
introduced CFG_REE_FS_TA_BUFFERED [2] does not exist anymore. Therefore
we can set it to 'n' by default, thus saving some time and memory.

[1] commit d1911a85142d ("core: load TAs using ldelf")
[2] commit 7db24ad625b9 ("core: REE FS TAs: add option to verify
signature before processing")

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: allow display of larger durations

Currently the ftrace buffer shows durations in microseconds and modulo
1000000 us. It is problematic if values larger than one second are
measured.

This pa

ftrace: allow display of larger durations

Currently the ftrace buffer shows durations in microseconds and modulo
1000000 us. It is problematic if values larger than one second are
measured.

This patch makes sure that no invalid value is ever displayed when an
overflow occurs. Instead, the trace will contain dashes, such as
"--------- us".

In addition, the unit is changed from microseconds (us) to milliseconds
(ms) when the duration exceeds a predefined value set by CFG_FTRACE_US_MS
(default: 10000 us).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

ftrace: allow tracing of syscall wrappers only

Introduces a new configuration flag: CFG_SYSCALL_WRAPPERS_MCOUNT to
control the instrumentation of the system call wrapper functions
(utee_*) with -pg,

ftrace: allow tracing of syscall wrappers only

Introduces a new configuration flag: CFG_SYSCALL_WRAPPERS_MCOUNT to
control the instrumentation of the system call wrapper functions
(utee_*) with -pg, for function tracing and gprof.
The default value is taken from CFG_ULIBS_MCOUNT.
The main use case is to trace only the system calls in a TA:
CFG_TA_FTRACE_SUPPORT=y CFG_SYSCALL_WRAPPERS_MCOUNT=y

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

Update revision for release tag 3.6.0-rc1

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

core: load TAs using ldelf

Uses ldelf to load and relocate TAs instead of parsing and loading the
ELFs in TEE Core. TA abort dumps, ASLR and ftrace are temporarily
removed or disabled to be re-enabl

core: load TAs using ldelf

Uses ldelf to load and relocate TAs instead of parsing and loading the
ELFs in TEE Core. TA abort dumps, ASLR and ftrace are temporarily
removed or disabled to be re-enabled in following commits.

Loading dynamically linked TAs are from now on always supported and
cannot be disabled via configuration flags. CFG_TA_DYNLINK is also
removed as a configuration option.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: arm64: Add support for function tracing of user TAs

Function tracing (ftrace) is a useful debugging technique to dump
function call graph for in-depth analysis of program execution and also

libutee: arm64: Add support for function tracing of user TAs

Function tracing (ftrace) is a useful debugging technique to dump
function call graph for in-depth analysis of program execution and also
to get useful information in case of any program abort.

In case of TA, this function graph information is dumped in a buffer
kept in .bss section of corresponding instrumented TA. So this buffer
can be dumped to normal world in case TA session closes or in case of
any abort. Also size of this ftrace buffer is configurable per TA via
following config option during TA compilation:

CFG_FTRACE_BUF_SIZE=2048

Function tracing is completely optional debugging feature which could
be enabled via command line config option CFG_TA_FTRACE_SUPPORT=y.

Along with this user needs to add cflag: "-pg" to the files for whom
function graph is to be generated. Typically for the whole TA, it should
be compiled with CFG_TA_MCOUNT=y.

And in case user wants to set "-pg" for particular file, following should
go in corresponding sub.mk:

cflags-<file-name>-y+=-pg

Also, to generate function graph for user mode libraries enable
CFG_ULIBS_MCOUNT=y which will set "-pg" for all library files.

Currently this patch adds support for function tracing of 64-bit
TAs only.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)

show more ...

Rename CFG_ULIBS_GPROF to CFG_ULIBS_MCOUNT

CFG_ULIBS_GPROF builds the user mode libraries with -pg, which adds
instrumentation to all functions in the form of a call to mcount().
This was historical

Rename CFG_ULIBS_GPROF to CFG_ULIBS_MCOUNT

CFG_ULIBS_GPROF builds the user mode libraries with -pg, which adds
instrumentation to all functions in the form of a call to mcount().
This was historically used by gprof, but other tools can benefit from
this instrumentation. Therefore, rename the config flag as well as a
couple of source files to remove the reference to gprof.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)

show more ...

config.mk: fix CFG_OPTEE_REVISION_MINOR

The current release is 3.5.0, change the revision to match.

Fixes https://github.com/OP-TEE/optee_os/issues/3028

Signed-off-by: Rouven Czerwinski <r.czerwin

config.mk: fix CFG_OPTEE_REVISION_MINOR

The current release is 3.5.0, change the revision to match.

Fixes https://github.com/OP-TEE/optee_os/issues/3028

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

Introduce CFG_CORE_DUMP_OOM

Introduces CFG_CORE_DUMP_OOM which if y will print an error and dump the
stack on memory allocation failures using malloc() and friends.

Reviewed-by: Jerome Forissier <j

Introduce CFG_CORE_DUMP_OOM

Introduces CFG_CORE_DUMP_OOM which if y will print an error and dump the
stack on memory allocation failures using malloc() and friends.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Error out if CFG_TA_GPROF_SUPPORT and CFG_ULIBS_SHARED are both enabled

The gprof sample buffer is currently allocated at link time by the TA
linker script: ta/arch/arm/ta.ld.S. The size of the buff

Error out if CFG_TA_GPROF_SUPPORT and CFG_ULIBS_SHARED are both enabled

The gprof sample buffer is currently allocated at link time by the TA
linker script: ta/arch/arm/ta.ld.S. The size of the buffer is a
function of the total TA code size (.text segment). While this works
fine for statically linked TAs, it is problematic when shared libraries
are used, because in this case the total .text size is not known at
link time. As a result, the pre-allocated buffer may be too small,
resulting in the following error when the TA is initialized:

E/TA: __utee_gprof_init:159 gprof: could not allocate profiling buffer

One way to fix this problem is to allocate the buffer at run time, once
all the shared libraries have been loaded. Since the TA loader is about
to be reworked and moved to user space, let's wait for this to occur
before implementing a long term solution. This commit just prohibits the
problematic configuration in mk/config.mk.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove CFG_DYN_SHM_CAP

Removes the now obsolete CFG_DYN_SHM_CAP. CFG_CORE_DYN_SHM should be
used instead to enable/disable support for dynamic shared memory.

Reviewed-by: Etienne Carriere <et

core: remove CFG_DYN_SHM_CAP

Removes the now obsolete CFG_DYN_SHM_CAP. CFG_CORE_DYN_SHM should be
used instead to enable/disable support for dynamic shared memory.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: introduce CFG_CORE_RESERVED_SHM

Introduces CFG_CORE_RESERVED_SHM which if set to y enables reserved shared
memory, else disables support for reserved shared memory.

Reviewed-by: Etienne Carri

core: introduce CFG_CORE_RESERVED_SHM

Introduces CFG_CORE_RESERVED_SHM which if set to y enables reserved shared
memory, else disables support for reserved shared memory.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: introduce CFG_CORE_DYN_SHM

Introduces CFG_CORE_DYN_SHM which if set to y enables dynamic shared
memory, else disables support for dynamic shared memory. In contrast
with CFG_DYN_SHM_CAP it act

core: introduce CFG_CORE_DYN_SHM

Introduces CFG_CORE_DYN_SHM which if set to y enables dynamic shared
memory, else disables support for dynamic shared memory. In contrast
with CFG_DYN_SHM_CAP it actually removes the support instead of just
omit reporting it.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: introduce CFG_CORE_HUK_SUBKEY_COMPAT

Adds CFG_CORE_HUK_SUBKEY_COMPAT which if set to 'y' makes
huk_subkey_derive() produce RPMB and SSK keys identical to the legacy
code.

Reviewed-by: Joakim

core: introduce CFG_CORE_HUK_SUBKEY_COMPAT

Adds CFG_CORE_HUK_SUBKEY_COMPAT which if set to 'y' makes
huk_subkey_derive() produce RPMB and SSK keys identical to the legacy
code.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support mbedTLS in kernel mode

Initial step of mbedtls cryptos integration.
Directory created and interface file is drafted.
All function interfaces are set to "not supported".
The mbedt

libmbedtls: support mbedTLS in kernel mode

Initial step of mbedtls cryptos integration.
Directory created and interface file is drafted.
All function interfaces are set to "not supported".
The mbedtls can be selected by specifying build flags
"CFG_CRYPTOLIB_NAME=mbedtls" and "CFG_CRYPTOLIB_DIR=lib/libmbedtls"

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Move CFG_CORE_MBEDTLS_MPI init to mk/config.mk

Moves default assignment of CFG_CORE_MBEDTLS_MPI into mk/config.mk

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklan

Move CFG_CORE_MBEDTLS_MPI init to mk/config.mk

Moves default assignment of CFG_CORE_MBEDTLS_MPI into mk/config.mk

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Move CFG_CRYPTOLIB_{NAME,DIR} init to mk/config.mk

Moves default initialization of CFG_CRYPTOLIB_NAME and CFG_CRYPTOLIB_DIR
to mk/config.mk.

Only assigns default y to CFG_CRYPTO_RSASSA_NA1 in case

Move CFG_CRYPTOLIB_{NAME,DIR} init to mk/config.mk

Moves default initialization of CFG_CRYPTOLIB_NAME and CFG_CRYPTOLIB_DIR
to mk/config.mk.

Only assigns default y to CFG_CRYPTO_RSASSA_NA1 in case
CFG_CRYPTOLIB_NAME == tomcrypt.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...