core: user_ta: implement ASLR for TAs

Introduces CFG_TA_ASLR to enable Address Space Layout Randomization of
Trusted Applications. ASLR makes the exploitation of memory corruption
vulnerabilities ha

core: user_ta: implement ASLR for TAs

Introduces CFG_TA_ASLR to enable Address Space Layout Randomization of
Trusted Applications. ASLR makes the exploitation of memory corruption
vulnerabilities harder.
The feature is disabled by default except for the configurations I
could test (QEMU and HiKey960).
When CFG_TA_ASLR=y, the stack and subsequent ELF file(s) needed by the
TA are mapped into the user VA space with a random offset comprised
between CFG_TA_ASLR_MIN_OFFSET_PAGES and CFG_TA_ASLR_MAX_OFFSET_PAGES
pages (that is between 0 and 128 pages by default).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU, HiKey960)
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Allow building libutils etc. as shared libraries

When CFG_ULIBS_SHARED=y (default n), build libutils, libmpa/libmbedtls
and libutee as shared libraries (.so). The static archives (.a) are
still prod

Allow building libutils etc. as shared libraries

When CFG_ULIBS_SHARED=y (default n), build libutils, libmpa/libmbedtls
and libutee as shared libraries (.so). The static archives (.a) are
still produced. The linker uses shared libraries by default when
present so TAs just need to be re-built to use the shared libraries.

For the time being, in-tree TAs are always linked statically for
practical reasons. Indeed, in-tree TAs (such as ta/avb) are likely
to be used as "early TAs". If such a TA was linked against shared
libraries, then those libraries would need to be installed in the
"early TA" area, too. While this works fine technically, it requires
some more steps in the Makefiles to make sure the proper dependencies
are installed and also it would mean that those libraries take
precedence over the ones potentially installed in the REE FS etc.
In other words, it would raise questions that we do not want nor need
to address now.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: REE FS TAs: add option to verify signature before processing

Adds configuration flag CFG_REE_FS_TA_BUFFERED, default enabled.

A new TA store is introduced which depends on the TEE FS TA store

core: REE FS TAs: add option to verify signature before processing

Adds configuration flag CFG_REE_FS_TA_BUFFERED, default enabled.

A new TA store is introduced which depends on the TEE FS TA store to
load the whole binary into a temporary buffer in secure DDR and
authenticate it before being processed further.

This reduces the attack surface of the TEE core in case of a
vulnerability in the ELF loader, at the expense of increased memory
usage at load time.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reported-by: Bastien Simondi <bsimondi@netflix.com> [3.6]
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

mk/config.mk: remove untrue comment

The comment stating that the REE filesystem is the only possible storage
to load Trusted Applications from is not true anymore. As described in
documentation/opte

mk/config.mk: remove untrue comment

The comment stating that the REE filesystem is the only possible storage
to load Trusted Applications from is not true anymore. As described in
documentation/optee_design.md, two other options are possible (early TAs
and secure storage). Therefore, remove the comment.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

virt: add virtualization subsystem

This patch adds virtualization framework to OP-TEE.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

virt: add nexus memory area

This patch is the first in series of patches that split OP-TEE RW memory
into two regions: nexus memory and TEE memory. Nexus memory will
be always mapped and it will be

virt: add nexus memory area

This patch is the first in series of patches that split OP-TEE RW memory
into two regions: nexus memory and TEE memory. Nexus memory will
be always mapped and it will be used to store all data that is
vital for OP-TEE core and is not bound to virtual guests.

TEE memory is a memory that holds data specific for certain guest.
There will be TEE memory bank for every guest and it will be mapped
into OP-TEE address space only during call from that guest.

This patch adds nexus memory and moves stacks into it. Also
it provides __nex_bss and __nex_data macros, so one can easily set right
section for a variable.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

bget_malloc: add nex_malloc pool

If virtualization enabled, this pool will be used to allocate
memory for OP-TEE nexus needs.
Without virtualization, generic malloc pool will be used.

Signed-off-by

bget_malloc: add nex_malloc pool

If virtualization enabled, this pool will be used to allocate
memory for OP-TEE nexus needs.
Without virtualization, generic malloc pool will be used.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Update revision for release tag 3.4.0-rc1

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

core: pta: Add device pseudo TA

This pseudo TA enumerates OP-TEE pseudo TAs which can act as devices/
services for Linux TEE bus driver. For differentiation of such devices,
added TA_FLAG_DEVICE_ENU

core: pta: Add device pseudo TA

This pseudo TA enumerates OP-TEE pseudo TAs which can act as devices/
services for Linux TEE bus driver. For differentiation of such devices,
added TA_FLAG_DEVICE_ENUM optional flag in pseudo TA header.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Document CFG_USER_TA_TARGETS and CFG_USER_TA_TARGET_<ta-name>

Document the configuration flags that controls the target architecture for
user mode libraries and in-tree TAs.

Signed-off-by: Jerome F

Document CFG_USER_TA_TARGETS and CFG_USER_TA_TARGET_<ta-name>

Document the configuration flags that controls the target architecture for
user mode libraries and in-tree TAs.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: generic_boot: Add add_dt_overlay_fragment()

This patch adds a dt routine add_dt_overlay_fragment(). This purpose of
which is to encapsulate the dynamic FDT node entries OPTEE provides inside
o

core: generic_boot: Add add_dt_overlay_fragment()

This patch adds a dt routine add_dt_overlay_fragment(). This purpose of
which is to encapsulate the dynamic FDT node entries OPTEE provides inside
of a

fragment@0 {
target-path = "/";
__overlay__ {
/* OPTEE nodes go here */
};
};

A subsequent set of patches will wrapper up existing dynamic OPTEE nodes

- /firmware/optee
- /psci
- /reserved/memory
optee@0xaddress

Once done it will be possible for a DTB in memory to be populated
with OPTEE fragments and for a subsequent bootloader to merge the OPTEE
populated overlay into a DTB loaded by a later stage.

if CFG_EXTERNAL_DTB_OVERLAY is not defined then this code has no effect.

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: embedded secure device tree

This change introduces configurations CFG_EMDED_DTB and
CFG_EMBED_DTB_SOURCE_FILE. When CFG_EMDED_DTB=y a device
tree blob (DTB) is embedded in a read-only section

core: embedded secure device tree

This change introduces configurations CFG_EMDED_DTB and
CFG_EMBED_DTB_SOURCE_FILE. When CFG_EMDED_DTB=y a device
tree blob (DTB) is embedded in a read-only section of the
core based on an in-tree device tree source (DTS) file.

CFG_EMBED_DTS_SOURCE_FILE defines the relative path of
the target device in core/arch/$(ARCH)/dts.

Non empty CFG_EMBED_DTS_SOURCE_FILE content implies CFG_EMBED_DTB=y.
CFG_EMBED_DTB=y mandates CFG_EMBED_DTS_SOURCE_FILE definition.
CFG_EMDED_DTB=y mandates CFG_DT=y.

Since the embedded DTB is read-only, core do not attempt to
modify it adding information such as OP-TEE resources nodes and
properties. Core still get generic information such as system
memory address range and debug console configuration
from the embedded DTB.

Documentation includes a DT section in the OP-TEE design
description.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mk/config.mk: default enable CFG_CRYPTO_RSASSA_NA1

Enable the TEE_ALG_RSASSA_PKCS1_V1_5 extension by default.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Gabor Szekely <

mk/config.mk: default enable CFG_CRYPTO_RSASSA_NA1

Enable the TEE_ALG_RSASSA_PKCS1_V1_5 extension by default.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Gabor Szekely <szvgabor@gmail.com>

show more ...

trace levels: Redefine TRACE_MIN level to 0

The global `trace_level` session-wise indicator which is set by
`trace_set_level()` [1], could get a wrong value in case of an
input `level` set to 0, mea

trace levels: Redefine TRACE_MIN level to 0

The global `trace_level` session-wise indicator which is set by
`trace_set_level()` [1], could get a wrong value in case of an
input `level` set to 0, meaning that all logs need to be disabled
by user define `CFG_TEE_TA_LOG_LEVEL=0` when building TA applications.

This inconsistency is caused by a rather wrong value of `TRACE_MIN`
low boundary value set to 1. According to [1] `trace level` will be
set to `TRACE_MAX` (4) in case input level is smaller than `TRACE_MIN`
and larger than `TRACE_MAX`.
In the scenario when the needed log level is 0, `trace level` would be
set to `TRACE_MAX` and will cause a lot of flow log level information
dumped by trace functions/macros that are using `trace_printf()`
primitive.

This patch sets the `TRACE_MIN` to 0 in order to assure a proper trace
level setting and completely disable all logs in case
`CFG_TEE_TA_LOG_LEVEL=0`.

[1]
void trace_set_level(int level)
{
if (((int)level >= TRACE_MIN) && (level <= TRACE_MAX))
trace_level = level;
else
trace_level = TRACE_MAX;
}

Acked-by: Christoph Gellner <cgellner@de.adit-jv.com>
Signed-off-by: Ovidiu Mihalachi <ovidiu_mihalachi@mentor.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: instrument mutexes with lockdep

Implements lockdep hooks for mutexes. CFG_LOCKDEP is disabled by default,
because it causes a noticeable slowdown (plain xtest runs 2-4x slower).

Tested-by: Je

core: instrument mutexes with lockdep

Implements lockdep hooks for mutexes. CFG_LOCKDEP is disabled by default,
because it causes a noticeable slowdown (plain xtest runs 2-4x slower).

Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU, HiKey960)
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

pager: enable BestFit allocation when using the pager

When running xtest 6018 we have got panics because of
TEE_ERROR_OUT_OF_MEMORY errors when trying to allocate memory (using
malloc and calloc). T

pager: enable BestFit allocation when using the pager

When running xtest 6018 we have got panics because of
TEE_ERROR_OUT_OF_MEMORY errors when trying to allocate memory (using
malloc and calloc). The reason for this seems to be a fragmented heap
when running with the pager enabled. By enabling the BestFit algorithm
in bget we have seen a much improved use of the heap with a lot less
fragmentation. We have been running xtest on QEMU v8 and HiKey 6220 and
the performance difference seems to be negligible.

Fixes: https://github.com/OP-TEE/optee_os/issues/2580

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (HiKey 6220, QEMU v8)
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Update revision to 3.3

The commit [1] that changed the revision macros from 3.2 to 3.3 was not
pushed to the master branch when I created the 3.3.0-rc1 tag. Pick this
commit now.

[1] Commit b5aecc0

Update revision to 3.3

The commit [1] that changed the revision macros from 3.2 to 3.3 was not
pushed to the master branch when I created the 3.3.0-rc1 tag. Pick this
commit now.

[1] Commit b5aecc05ca32 ("Update revision for release tag 3.3.0-rc1")
(tag 3.3.0-rc1)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

trace: print core id if in atomic context

If (D|E|I|F)MSG is called with foreign interrupts masked
we can report core ID. "?" will be printed instead, if
foreign interrupts aren't masked.

With this

trace: print core id if in atomic context

If (D|E|I|F)MSG is called with foreign interrupts masked
we can report core ID. "?" will be printed instead, if
foreign interrupts aren't masked.

With this patch log looks like this:

D/TC:2 0 core_mmu_set_user_map:940 0xe181b88 0xeee8003
D/TC:? 0 __wq_rpc:40 wake thread 1 0xe16f028 -3
D/TC:1 thread_handle_std_smc:612 a7: 2
D/TC:3 0 core_mmu_set_user_map:940 0x0 0x0

Where first digit shows core id and second - thread id.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Add CFG_IN_TREE_EARLY_TAS

Adds CFG_IN_TREE_EARLY_TAS which is used to embed in-tree TAs as early
TAs in the OP-TEE binary.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by:

Add CFG_IN_TREE_EARLY_TAS

Adds CFG_IN_TREE_EARLY_TAS which is used to embed in-tree TAs as early
TAs in the OP-TEE binary.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mk/config.mk: remove obsolete comment

NOWERROR=1 has been made obsolete by commit beb065df6ee5 ("Do not set
-Werror by default"). Remove it.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro

mk/config.mk: remove obsolete comment

NOWERROR=1 has been made obsolete by commit beb065df6ee5 ("Do not set
-Werror by default"). Remove it.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Update revision for release tag 3.2.0-rc1

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

pta: add system pTA

Add system pTA, which provides misc. auxiliary services, extending
existing GlobalPlatform Core API.
Add a call for seeding entropy to the default RNG pool.

Reviewed-by: Jens Wi

pta: add system pTA

Add system pTA, which provides misc. auxiliary services, extending
existing GlobalPlatform Core API.
Add a call for seeding entropy to the default RNG pool.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

show more ...

libmbedtls: configure and compile mbedtls

Configures mbedtls with a minimal user mode TA configuration and makes
it compile.

Adds dummy include/mbedtls_config_kernel.h to give a good error message

libmbedtls: configure and compile mbedtls

Configures mbedtls with a minimal user mode TA configuration and makes
it compile.

Adds dummy include/mbedtls_config_kernel.h to give a good error message
in case mbedTLS is compiled in for kernel mode.

mbedTLS is enabled for TAs with CFG_TA_MBEDTLS = y
Builtin self tests are enabled with CFG_TA_MBEDTLS_SELF_TEST = y

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm32: add support for dynamically linked TAs

This commit adds support for 32-bit dynamically linked Trusted
Applications. The config flag for this feature is CFG_TA_DYNLINK,
default enabled.

core: arm32: add support for dynamically linked TAs

This commit adds support for 32-bit dynamically linked Trusted
Applications. The config flag for this feature is CFG_TA_DYNLINK,
default enabled.

Why do this? Several reasons:

1. Save space in the TA storage area. The OP-TEE core libraries
(libutee, libutils, libmpa) could very well be provided as shared
objects (.so) rather than archive files (.a). They would be installed
only once in the TA storage, instead of being duplicated inside each TA.
2. Allow upgrade of some libraries without re-linking the TAs.
3. Pave the way to sharing code pages between TAs, thus potentially
reducing the memory footprint of the TEE.

The ELF loader is updated as follows:

- Locate the dynamic section in the program headers (PT_DYNAMIC entry).
- Find the required external libraries by looking for DT_NEEDED entries
in the dynamic section. Libraries are .so files signed like TAs and
identified by a UUID so that the TA stores can be re-used. Using a UUID
is also more flexible, because a new versions of a library may keep the
same UUID or use another one.
- Load all the libraries.
- Process the dynamic relocations of type R_ARM_GLOB_DAT and
R_ARM_JUMP_SLOT by resolving symbols by name, in breadth first order.
- Map the library code and data into the user VA space.

The stack unwinding code will be updated in a later commit. As a result
only the main executable may be unwound ; stack dumps will stop if the
call stack goes inside a shared library.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960 32/64)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

ta: TEE_Malloc() and friend: skips layers

Prior to this patch TEE_Malloc(), TEE_Realloc() and TEE_Free() were using
two extra layers implemented on top of the well known malloc(),
realloc(), calloc(

ta: TEE_Malloc() and friend: skips layers

Prior to this patch TEE_Malloc(), TEE_Realloc() and TEE_Free() were using
two extra layers implemented on top of the well known malloc(),
realloc(), calloc() and free() functions. With this patch the extra layers
are skipped.

When compiled for user TAs realloc() clears all memory that otherwise
would be uninitialized memory since it's required by the spec [1] if
TEE_Malloc() is called with the hint TEE_MALLOC_FILL_ZERO. Since that's
the only recognized hint in the spec realloc() assumes that it's always
needed.

[1] GP TEE Internal Core API Specification v1.1

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...