scripts: add remote processor firmware signature tool

Add a script that signs one or several remote processor ELF firmware that
will be authenticated by the remoteproc TA.

This tool adds a binary h

scripts: add remote processor firmware signature tool

Add a script that signs one or several remote processor ELF firmware that
will be authenticated by the remoteproc TA.

This tool adds a binary header, a signature and a TLV list.

The header contains a magic number, a version number and
the size of the different blobs (signature, images, TLV list blobs).

The signature contains a signature authenticating the
header blob hash and the TLV blob hash.

The TLV blob contains a list of data formatted as Type/Length/Value
fields. It contains information for the remoteproc TA and
the remoteproc platform specific PTA.

The TLV types from 0 to 0x00010000 are predefined information used by
the remoteproc TA:
- algorithm used for signature
- algorithm used for computing segment's hash
- number of images to load
- types of the images to load
- sizes of the images to load
- a copy of the elf segment tables with associated hash

the TLV types from 0x00010000 to 0x00020000 contains information
transferred to the remoteproc platform PTA.

Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: add derive_rpmb_key.py

Adds the script derive_rpmb_key.py that can derive the RPMB key OP-TEE uses
offline or in normal world during a production step.

Signed-off-by: Jens Wiklander <jens.

scripts: add derive_rpmb_key.py

Adds the script derive_rpmb_key.py that can derive the RPMB key OP-TEE uses
offline or in normal world during a production step.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ftrace: change implementation to use binary circular buffer

The current implementation of function tracing (CFG_FTRACE_SUPPORT)
produces human-readable text into the output buffer that is passed to

ftrace: change implementation to use binary circular buffer

The current implementation of function tracing (CFG_FTRACE_SUPPORT)
produces human-readable text into the output buffer that is passed to
tee-supplicant and ultimately saved to the Linux filesystem. Two main
issues with that:

1. The string formatting code is somewhat complex. It introduces
significant overhead in the execution time of the instrumented
functions.
2. The various policies about how to handle a buffer full condition
(CFG_FTRACE_BUF_WHEN_FULL) are not very convenient. In particular,
"shift" is typically the most desirable option because it always
keeps the most recent entries, but it is very inefficient to the
point of not being usable in practice.

This commit addresses the above concerns by making the ftrace buffer
circular one, each entry being 64-bit value. The formatting code is
offloaded to a new Python script: scripts/ftrace_format.py. The
output is unchanged except for an added field showing the current
depth in the call stack.

Typical usage (captured on QEMUv8):

build$ mkdir -p ../tmp
build$ chmod a+w ../tmp
build$ make CFG_FTRACE_SUPPORT=y CFG_FTRACE_BUF_SIZE=15000 \
CFG_TA_MCOUNT=y CFG_ULIBS_MCOUNT=y CFG_SYSCALL_FTRACE=y \
QEMU_VIRTFS_AUTOMOUNT=y run
$ xtest regression_1004
...
$ cp /tmp/ftrace-cb3e5ba0-adf1-11e0-998b-0002a5d5c51b.out /mnt/host/tmp
build$ cd ..
optee$ optee_os/scripts/ftrace_format.py \
tmp/ftrace-cb3e5ba0-adf1-11e0-998b-0002a5d5c51b.out |
optee_os/scripts/symbolize.py \
-d optee_os/out/arm/core \
-d out-br/build/optee_test_ext-1.0/ta/*/out | less
TEE load address @ 0x5ab04000
Function graph for TA: cb3e5ba0-adf1-11e0-998b-0002a5d5c51b @ 80085000
| 1 | __ta_entry() {
| 2 | __utee_entry() {
43.840 us | 3 | ta_header_get_session()
7.216 us | 3 | tahead_get_trace_level()
14.480 us | 3 | trace_set_level()
| 3 | malloc_add_pool() {
| 4 | raw_malloc_add_pool() {
46.032 us | 5 | bpool()
| 5 | raw_realloc() {
166.256 us | 6 | bget()
23.056 us | 6 | raw_malloc_return_hook()
267.952 us | 5 | }
398.720 us | 4 | }
426.992 us | 3 | }
| 3 | TEE_GetPropertyAsU32() {
23.600 us | 4 | is_propset_pseudo_handle()
| 4 | __utee_check_instring_annotation() {
26.416 us | 5 | strlen()
| 5 | check_access() {
| 6 | TEE_CheckMemoryAccessRights() {
| 7 | _utee_check_access_rights() {
| 8 | syscall_check_access_rights() {
| 9 | ts_get_current_session() {
4.304 us | 10 | ts_get_current_session_may_fail()
10.976 us | 9 | }
| 9 | to_user_ta_ctx() {
2.496 us | 10 | is_user_ta_ctx()
8.096 us | 9 | }
| 9 | vm_check_access_rights() {
| 10 | vm_buf_is_inside_um_private() {
| 11 | core_is_buffer_inside() {
...

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

scripts/symbolize.py: Fix crash when .elf file not found

The script will crash if the xxx.elf file cannot be found.

```
TypeError: expected str, bytes or os.PathLike object, not NoneType
```

This

scripts/symbolize.py: Fix crash when .elf file not found

The script will crash if the xxx.elf file cannot be found.

```
TypeError: expected str, bytes or os.PathLike object, not NoneType
```

This commit add check for None value.

Signed-off-by: Kun Lai <me@imlk.top>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

scripts/symbolize.py: Support RISC-V architecture

If we get RISC-V architecture flag from ELF file, assign "self._arch" as
"riscv32-unknown-linux-gnu-" or "riscv64-unknown-linux-gnu-", since they
ar

scripts/symbolize.py: Support RISC-V architecture

If we get RISC-V architecture flag from ELF file, assign "self._arch" as
"riscv32-unknown-linux-gnu-" or "riscv64-unknown-linux-gnu-", since they
are prefixes of RISC-V's official toolchains.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

arm64: memtag: strip tag from crash dumps

The MTE tag is not really useful when displaying a crash dump. In fact
it makes it more complicated for tools like script/symbolize.py to
retrieve the actua

arm64: memtag: strip tag from crash dumps

The MTE tag is not really useful when displaying a crash dump. In fact
it makes it more complicated for tools like script/symbolize.py to
retrieve the actual (untagged) virtual address, especially as we now
support non-Arm architectures and therefore blindly stripping the MTE
bits is not possible.

This commit strips the tag in call stacks displayed by
print_stack_arm64(). It also removes it from the virtual address shown
on abort (__print_abort_info()) since symbolize.py does try to resolve
the address as symbol + offset ; but in this case the tagged address is
printed as well, because it can be helpful to diagnose tag check faults.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: sp: Allow to embed binary SPs to OP-TEE binary

If the ELF header is not found in the file, then assume it's a binary
format SP.

Signed-off-by: Imre Kis <imre.kis@arm.com>
Acked-by: Jens Wikla

core: sp: Allow to embed binary SPs to OP-TEE binary

If the ELF header is not found in the file, then assume it's a binary
format SP.

Signed-off-by: Imre Kis <imre.kis@arm.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: checkpatch: rework and add examples to help message

- See https://git-scm.com/book/en/v2/Git-Tools-Revision-Selection for
more info about Git Revision Selections.

Signed-off-by: Andrew M

scripts: checkpatch: rework and add examples to help message

- See https://git-scm.com/book/en/v2/Git-Tools-Revision-Selection for
more info about Git Revision Selections.

Signed-off-by: Andrew Mustea <andrew.mustea@microsoft.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

scripts: checkpatch: allow git revision selections as arguments

- The git commands `git rev-parse` and `git rev-list` were added in
version 2.19.
- `git rev-parse` can parse revision names or any

scripts: checkpatch: allow git revision selections as arguments

- The git commands `git rev-parse` and `git rev-list` were added in
version 2.19.
- `git rev-parse` can parse revision names or any revision selection and
return the corresponding git object name. This includes being able to
parse commit ranges, specific hashes, branch names, git tags, etc.
See 'https://git-scm.com/book/en/v2/Git-Tools-Revision-Selection' for
more info.
- If `git rev-parse` returns a range of git objects, `git rev-list` can
convert it into a list of commit ids.

Signed-off-by: Andrew Mustea <andrew.mustea@microsoft.com>

show more ...

sign_encrypt.py: rename to hash_size and sig_size

Renames digest_len to hash_size and sig_len to sig_size in order to
match the names used in the corresponding C code.

Reviewed-by: Jerome Forissier

sign_encrypt.py: rename to hash_size and sig_size

Renames digest_len to hash_size and sig_len to sig_size in order to
match the names used in the corresponding C code.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

sign_encrypt.py: add subkey support

Adds support to sign TAs using a subkey. Two new commands are added to
help with this:
- sign-subkey: signs a new subkey using either the root key or the keys
fro

sign_encrypt.py: add subkey support

Adds support to sign TAs using a subkey. Two new commands are added to
help with this:
- sign-subkey: signs a new subkey using either the root key or the keys
from another subkey
- subkey-uuid: calculate the UUID of next TA or subkey

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

sign_encrypt.py: add display command

Adds a display command to sign_encrypt.py doing what dump_ta_header.py
used to do. Removes the now redundant script dump_ta_header.py.

Reviewed-by: Jerome Foris

sign_encrypt.py: add display command

Adds a display command to sign_encrypt.py doing what dump_ta_header.py
used to do. Removes the now redundant script dump_ta_header.py.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

sign_encrypt.py: add command func in argument parsing

While parsing the argument assign the function to handle the command for
easier dispatching of the command.

Reviewed-by: Jerome Forissier <jero

sign_encrypt.py: add command func in argument parsing

While parsing the argument assign the function to handle the command for
easier dispatching of the command.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

sign_encrypt.py: refactor with BinaryImage class

Moves manipulations of the TA binary into a BinaryImage class for some
abstraction and better structure of the code for the different
sub-commands.

sign_encrypt.py: refactor with BinaryImage class

Moves manipulations of the TA binary into a BinaryImage class for some
abstraction and better structure of the code for the different
sub-commands.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

sign_encrypt.py: refactor argument parsing

Uses the add_subparsers() method from argparse.ArgumentParser to add
the command instead of adding command and options at the same level.
With this we have

sign_encrypt.py: refactor argument parsing

Uses the add_subparsers() method from argparse.ArgumentParser to add
the command instead of adding command and options at the same level.
With this we have one parser for each command to allow the argparse
module to handle checks for optional and mandatory options. This makes
the argument parsing a bit more modular and easier to extend.

Behavior of the script is supposed to be unchanged with the exception of
printed help and errors since that now relies more on the argparse
module.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

sign_encrypt.py: make logger global

Makes the logger variable global to avoid passing it to all functions
that needs to log something.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Ac

sign_encrypt.py: make logger global

Makes the logger variable global to avoid passing it to all functions
that needs to log something.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: define RISC-V instruction set architecture in encoding.h

Define standard RISC-V instruction opcodes, control and status registers.
This file is auto-generated from riscv-opcodes and it

core: riscv: define RISC-V instruction set architecture in encoding.h

Define standard RISC-V instruction opcodes, control and status registers.
This file is auto-generated from riscv-opcodes and it is subject of
regular updates.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

scripts: use python's hex() in ta_bin_to_c.py

- Python has a built in function to turn a byte into its respective hex
value that can be used instead of string formatting the values
directly.
- U

scripts: use python's hex() in ta_bin_to_c.py

- Python has a built in function to turn a byte into its respective hex
value that can be used instead of string formatting the values
directly.
- Using the built in function instead of the previous string formatting
method fixed an issue where bytes were failing to be written when
we used an archaic yocto bsp from broadcom.
- The built in function also has the benefit of being easier to read and
understand.

Signed-off-by: Dhananjay Phadke <dphadke@linux.microsoft.com>
Signed-off-by: Andrew Mustea <andrew.mustea@microsoft.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

symbolize.py: translate TA panic codes

When a TA panics, the TEE core shows the panic code as follows:

E/TC:? 0 TA panicked with code 0xffff000f

The value is whatever was passed to TEE_Panic() by

symbolize.py: translate TA panic codes

When a TA panics, the TEE core shows the panic code as follows:

E/TC:? 0 TA panicked with code 0xffff000f

The value is whatever was passed to TEE_Panic() by the TA or the library
that caused the panic; typically, the TEE Intenal Core API functions
implemented in libutee. It quite often happens that this value is a
TEE_Result code. Therefore it is convenient to translate the hexadecimal
value to a symbolic name (TEE_ERROR_*). With this commit, if a match is
found, the name is shown in parentheses like so:

E/TC:? 0 TA panicked with code 0xffff000f (TEE_ERROR_SECURITY)

If the code doesn't correspond to a known TEE_Result value however
nothing is appended to the output.

Suggested-by: Peter Griffin <peter.griffin@linaro.org>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Peter Griffin <peter.griffin@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

symbolize.py: strip MTE tag

When the Armv8.5 Memory Tagging Extension is enabled, the address shown
in data-abort messages may include a non-zero tag. For example (xtest
1038):

E/TC:? 0 User mode

symbolize.py: strip MTE tag

When the Armv8.5 Memory Tagging Extension is enabled, the address shown
in data-abort messages may include a non-zero tag. For example (xtest
1038):

E/TC:? 0 User mode data-abort at address 0x2000000401824f0 (tag check fault)

The tag needs to be cleared before the address can be translated into
symbol + offset.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts/gen_tee_bin.py: inlude .ctors in included sections

Includes the section .ctors in sections included in the pager binary.
This fixes a problem where the constructor function pointers are all

scripts/gen_tee_bin.py: inlude .ctors in included sections

Includes the section .ctors in sections included in the pager binary.
This fixes a problem where the constructor function pointers are all
zeroes. Constructors are normally not used by OP-TEE, but with
CFG_CORE_SANITIZE_KADDRESS=y it's used to initialize access to global
variables.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

get_maintainer.py: add OP-TEE mailing list(s) to --release-to

The release annoucements should be sent to the general OP-TEE mailing
list(s), in addition to the maintainers and reviewers. Add the nee

get_maintainer.py: add OP-TEE mailing list(s) to --release-to

The release annoucements should be sent to the general OP-TEE mailing
list(s), in addition to the maintainers and reviewers. Add the needed
bits to extract this information.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: sp: Append fdt manifest to SP image

Sp use a manifest file that define information about the SP. A device
tree (fdt) will be used as a manifest file. This is in line with the
Hafnium SPMC mani

core: sp: Append fdt manifest to SP image

Sp use a manifest file that define information about the SP. A device
tree (fdt) will be used as a manifest file. This is in line with the
Hafnium SPMC manifest format.

The fdt will be appended to the SP image by adding a --manifest flag to
the scripts/ts_bin_to_c.py script.

Link: https://trustedfirmware-a.readthedocs.io/en/latest/components/ffa-manifest-binding.html
Signed-off-by: Jelle Sels <jelle.sels@arm.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

scripts: add print_tee_hash.py

Adds a Python script to return the SHA256 hash of the .text* and .rodata*
sections of tee.elf, excluding the small area in .text that contains
data initialized early a

scripts: add print_tee_hash.py

Adds a Python script to return the SHA256 hash of the .text* and .rodata*
sections of tee.elf, excluding the small area in .text that contains
data initialized early after boot. This hash value can later be compared
with the hash returned at runtime by the attestation PTA which will come
in the next commit.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: kern.ld.S: move .scattered_array* into .data.rel.ro

Moves the symbols tagged with .scattered_array* from the .rodata output
section into a new output section: .data.rel.ro, which is also writ

core: kern.ld.S: move .scattered_array* into .data.rel.ro

Moves the symbols tagged with .scattered_array* from the .rodata output
section into a new output section: .data.rel.ro, which is also writeable
(hence the suppression of __SECTION_FLAGS_RODATA in scattered_array.h)
but placed in tee.elf to be mapped read-only after relocations are
applied. The new section is created only when core ASLR is enabled,
otherwise no relocation can occur and we can keep the previous code.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...