scripts/sign_encrypt.py: Support verification of a signed TA

Adds a new option 'verify' to sign_encrypt.py to verify whether a
Trusted Application is signed correctly.

Required arguments: --uuid, -

scripts/sign_encrypt.py: Support verification of a signed TA

Adds a new option 'verify' to sign_encrypt.py to verify whether a
Trusted Application is signed correctly.

Required arguments: --uuid, --in, --key

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Donald Chan <hoiho@amazon.com>

show more ...

scripts/sign_encrypt.py: readability improvements

A few constant values would have been better if replaced with constant
definitions

Signed-off-by: Donald Chan <hoiho@amazon.com>
Reviewed-by: Jerom

scripts/sign_encrypt.py: readability improvements

A few constant values would have been better if replaced with constant
definitions

Signed-off-by: Donald Chan <hoiho@amazon.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

scripts/sign_encrypt.py: add flags for the encryption key type

Allow encryption key type to be overridden from command-line. Defaults
to SHDR_ENC_KEY_DEV_SPECIFIC.

Reviewed-by: Jerome Forissier <je

scripts/sign_encrypt.py: add flags for the encryption key type

Allow encryption key type to be overridden from command-line. Defaults
to SHDR_ENC_KEY_DEV_SPECIFIC.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Donald Chan <hoiho@amazon.com>

show more ...

checkpatch_inc.sh: Add elf_common.h in ignore list

The typedef warning in elf_common.h is a false positive
since it is an accepted pattern in this header file.

Signed-off-by: Ruchika Gupta <ruchika

checkpatch_inc.sh: Add elf_common.h in ignore list

The typedef warning in elf_common.h is a false positive
since it is an accepted pattern in this header file.

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: add dump_ta_header.py

Add a Python script to dump the information contained in the header of
a TA file (*.ta). One use case is to extract struct shdr::hash, which is
returned by the attesta

scripts: add dump_ta_header.py

Add a Python script to dump the information contained in the header of
a TA file (*.ta). One use case is to extract struct shdr::hash, which is
returned by the attestation PTA to be added in a later commit.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: migrate away from pycryptodome

Move away from pycryptodome and use pyca/cryptography instead.

pycryptodome has been a little confusing due to other similar packages
(pycrypto, pycryptodome

scripts: migrate away from pycryptodome

Move away from pycryptodome and use pyca/cryptography instead.

pycryptodome has been a little confusing due to other similar packages
(pycrypto, pycryptodomex). pyca/cryptography also allow custom backends
other than OpenSSL, so it will make additional signing backends (AWS,
Azure, GCP) possible in the future (where the private key will be
protected by the cloud service provider rather than in plaintext).

Signed-off-by: Donald Chan <hoiho@lab126.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: pkcs11: Add script to verify that helpers are present

Extracts list of symbols from include/pkcs11_ta.h and verifies that they
are present in src/pkcs11_helpers.c or are not used.

Signed-off-by

ta: pkcs11: Add script to verify that helpers are present

Extracts list of symbols from include/pkcs11_ta.h and verifies that they
are present in src/pkcs11_helpers.c or are not used.

Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

scripts: checkpatch_inc.sh: Add CHECKPATCH_OPT for optional arguments

Add new environment variable CHECKPATCH_OPT for configuring common optional
arguments.

In example newer codespell has moved dic

scripts: checkpatch_inc.sh: Add CHECKPATCH_OPT for optional arguments

Add new environment variable CHECKPATCH_OPT for configuring common optional
arguments.

In example newer codespell has moved dictionary to new location.

This allows one to use:

export CHECKPATCH=<path to linux kernel source>/scripts/checkpatch.pl
export CHECKPATCH_OPT=--codespellfile=/usr/lib/python3/dist-packages/codespell_lib/data/dictionary.txt

Signed-off-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mem_usage.py: consider all allocatable sections

All allocatable sections end up using memory when the TEE binary is
loaded. Therefore the 'A' (allocatable) flag in the readelf output is
all that mat

mem_usage.py: consider all allocatable sections

All allocatable sections end up using memory when the TEE binary is
loaded. Therefore the 'A' (allocatable) flag in the readelf output is
all that matters when gathering memory usage data using mem_usage.py.
The combinations that are currently hardcoded in the script ('AX',
'WA', 'A', 'AL') are fragile and need to be replaced. For example, with
COMPILER=clang many sections have the 'W' flag set.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add secure partitions store

SPs need to be started as part of the initialisation process of the
OP-TEE kernel. The secure partition store uses the embedded_ts store to
load SPs

Signed-off-by:

core: add secure partitions store

SPs need to be started as part of the initialisation process of the
OP-TEE kernel. The secure partition store uses the embedded_ts store to
load SPs

Signed-off-by: Jelle Sels <jelle.sels@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: move early_ta implementation to embedded_ts

Ealy_ta's are similar to embedded SPs. Move all shared logic to the
embedded_ts.

Signed-off-by: Jelle Sels <jelle.sels@arm.com>
Reviewed-by: Jens W

core: move early_ta implementation to embedded_ts

Ealy_ta's are similar to embedded SPs. Move all shared logic to the
embedded_ts.

Signed-off-by: Jelle Sels <jelle.sels@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

early_ta: use scattered array helpers

Simplifies the core linker script by replacing the hard coded
.rodata.early_ta section with use of SCATTERED_ARRAY_DEFINE_PG_ITEM()
instead.

Reviewed-by: Jerom

early_ta: use scattered array helpers

Simplifies the core linker script by replacing the hard coded
.rodata.early_ta section with use of SCATTERED_ARRAY_DEFINE_PG_ITEM()
instead.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: support both pycryptodome and pycryptodomex

Current actual Python library for cryptography is being distributed in
two flavors: pycroptodome and pycroptodomex. They are basically the same
l

scripts: support both pycryptodome and pycryptodomex

Current actual Python library for cryptography is being distributed in
two flavors: pycroptodome and pycroptodomex. They are basically the same
library, but with different import names:

- pycryptodome provides 'Crypto' module and indented to directly replace
old pycrypto library

- pycryptodomex provides 'Cryptodome' module and is intended for old
distributions, where pycrypto is still present

Most of the modern Linux distributions provide both of the libraries, so
there is no difference which one is to use. But some of them (like
Yocto/Poky) provide only one.

This patches makes scripts agnostic to a crypto library flavor being used
by trying to import Cryptodome first and then Crypto if first import fails.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

scripts/sign_encrypt.py: add flags for the signing algorithm

+ Update the sign_encrypt.py so that it can choose the signing algorithm
between PSS and PKCS#1.5.
+ Convert the if/else into a try/exc

scripts/sign_encrypt.py: add flags for the signing algorithm

+ Update the sign_encrypt.py so that it can choose the signing algorithm
between PSS and PKCS#1.5.
+ Convert the if/else into a try/except for the signature check

Signed-off-by: Mingyuan Xiang <mingyuan@oxhainan.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: load stmm via secure partition

Secure variable storage for EFI variables is critical for enabling and
protecting UEFI Secure Boot. Unfortunately due to the fact that SPD and
SPM are mutually e

core: load stmm via secure partition

Secure variable storage for EFI variables is critical for enabling and
protecting UEFI Secure Boot. Unfortunately due to the fact that SPD and
SPM are mutually exclusive, we can't run StMM from EDK2 and OP-TEE.
An advantage of doing so is that different firmware implementations
can leverage EDK2's StandAloneMM and in cooperation with OP-TEE RPMB
APIs can store UEFI variables in a secure storage.
This makes the variable storage quite generic in any device with an RPMB
partition.

Using a well debugged application is preferable over rewriting the whole
application as a TA. Another advantage is that this inherits the Fault
Tolerant Writes (FTW) functionality built-in on StMM to protect
variables against corruptions during writing. Considering the FFA
changes of the future Arm architectures using an SP that includes
everything seems like a better choice at the moment.
The 'SPM emulation' currently added into OP-TEE only supports
a single SP to be launched. This means that the StMM embedded
application has the RPMB driver built in at the moment. In the future we
can add code (evolving FFA) to launch multiple SPs. So the StMM variable
handling can be decoupled from the RPMB driver, which will reside in a
different SP.

So let's add a user mode secure partition context and support loading
"Standalone MM" of EDK2 into it. A separate syscall handling is added to
serve as different kind of ABI and syscall IDs. The secure partition has
a TA like interface towards normal world, but requests are routed into
the StMM partition instead.

CFG_STMM_PATH is assigned the path of BL32_AP_MM.fd, for instance:
CFG_STMM_PATH=...Build/QemuVirtMmStandalone/DEBUG_GCC5/FV/BL32_AP_MM.fd

Since this is quite tricky to compile and test you can use this [1].
Just clone the repo and run ./build.sh. The script will pick up edk2,
edk2-platforms, op-tee, atf and U-boot and compile all the necessary
binaries for QEMU. A patch (awful hack) has been added to U-boot to
allow RPMB emulation through it's supplicant, since QEMU RPMB emulation
is not yet available.
After compiling and launching QEMU the usual U-boot commands for EFI
variable management will store the variables on an RPMB device.

[1] https://git.linaro.org/people/ilias.apalodimas/efi_optee_variables.git/

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Co-developed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Co-developed-by: Pipat Methavanitpong <pipat1010@gmail.com>
Signed-off-by: Pipat Methavanitpong <pipat1010@gmail.com>
Co-developed-by: Miklos Balint <Miklos.Balint@arm.com>
Signed-off-by: Miklos Balint <Miklos.Balint@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee: add <elf.h>

Preparing for C++ support in TAs.

Adds header file <elf.h> in addition to <elf32.h> and <elf64.h>. This
file defines the various Elf types depending on the current
architecture

libutee: add <elf.h>

Preparing for C++ support in TAs.

Adds header file <elf.h> in addition to <elf32.h> and <elf64.h>. This
file defines the various Elf types depending on the current
architecture. In other words: when building for Aarch32 Elf_* is defined
as Elf32_*, but when building for Aarch64 it is defined as Elf64_*. This
will be useful for programs which need to examine their own structure
via dl_iterate_phdr() (which will come in a later commit).

Note: <elf.h> serves the same purpose as FreeBSD's <sys/elf.h> but does
it differently; the file is not imported from FreeBSD.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

symbolize.py: infer PC from (E)LR

When translating a call stack address to source file and line number,
subtract 2 to try and reflect the PC at the time the call was made or
the exception occurred.

symbolize.py: infer PC from (E)LR

When translating a call stack address to source file and line number,
subtract 2 to try and reflect the PC at the time the call was made or
the exception occurred. This makes the calls easier to follow and
corresponds to what the GDB backtrace command (bt) does. For data or
prefetch aborts it is even more important because now we report exactly
the line that caused the abort instead of showing the next one, which
could be misleading.

As a result of this fix, the extra "nop" instruction in __ta_entry() is
not needed anymore so remove it.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

symbolize.py: ignore error if ELF file is not found

When processing the memory map of a TA, it can happen that the ELF file
for a region is not found. One typical reason is a missing -d argument
on

symbolize.py: ignore error if ELF file is not found

When processing the memory map of a TA, it can happen that the ELF file
for a region is not found. One typical reason is a missing -d argument
on the command line (can easily happen when a TA uses shared libraries
for instance).

In the above case, the script crashes with no clear indication about
the cause. This commit fixes the crash by ignoring ELFs that are not
found. This is consistent with the general behavior of symbolize.py,
which is to always print out all the information it is fed and simply
augment it with debug information when possible.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

scripts/pem_to_pub.py: use Cryptodome module instead of Crypto

Upgrade scripts/pem_to_pub.py to use module Cryptodome instead of
module Crypto for consistency with the other helper Python scripts
of

scripts/pem_to_pub.py: use Cryptodome module instead of Crypto

Upgrade scripts/pem_to_pub.py to use module Cryptodome instead of
module Crypto for consistency with the other helper Python scripts
of OP-TEE OS package.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

checkpatch: move options to config file

move checkpatch command line options to config file setting.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Acked-by: Jerome Forissier <jerome@forissi

checkpatch: move options to config file

move checkpatch command line options to config file setting.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts/gen_ldelf_hex.py: do not use f-strings

f-strings were introduced in Python 3.6 [1] and will therefore
cause an error with prior versions:

| File "scripts/gen_ldelf_hex.py", line 68
| prin

scripts/gen_ldelf_hex.py: do not use f-strings

f-strings were introduced in Python 3.6 [1] and will therefore
cause an error with prior versions:

| File "scripts/gen_ldelf_hex.py", line 68
| print(f'RO load segment found after RW one(s) (m={n})')
| ^
| SyntaxError: invalid syntax

For better compatibility use .format() instead.

Link: [1] https://docs.python.org/3/whatsnew/3.6.html#pep-498-formatted-string-literals
Fixes: c706c2449b50 ("scripts/gen_ldelf_hex.py: relax rules for PT_LOAD segments")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

checkpatch: ignore USLEEP_RANGE

OP-TEE has no usleep_range() function so ignore related checks.
Prevents reports like:

CHECK: usleep_range is preferred over udelay; see Documentation/timers/timers-

checkpatch: ignore USLEEP_RANGE

OP-TEE has no usleep_range() function so ignore related checks.
Prevents reports like:

CHECK: usleep_range is preferred over udelay; see Documentation/timers/timers-howto.rst
#30: FILE: core/arch/arm/plat-stm32mp1/pm/psci.c:215:
+ udelay(100);

Suggested-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

scripts/gen_ldelf_hex.py: relax rules for PT_LOAD segments

Latest Clang [1] generates the following ldelf.elf:

Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg A

scripts/gen_ldelf_hex.py: relax rules for PT_LOAD segments

Latest Clang [1] generates the following ldelf.elf:

Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x001000 0x00000000 0x00000000 0x04834 0x04834 R E 0x1000
LOAD 0x005838 0x00004838 0x00004838 0x01620 0x01620 R 0x1000
LOAD 0x007000 0x00006000 0x00006000 0x0006c 0x0006c RW 0x1000
LOAD 0x00706c 0x0000606c 0x0000606c 0x00068 0x00078 RW 0x1000
DYNAMIC 0x007000 0x00006000 0x00006000 0x00060 0x00060 RW 0x4
GNU_RELRO 0x007000 0x00006000 0x00006000 0x0006c 0x01000 R 0x1
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0
EXIDX 0x006800 0x00005800 0x00005800 0x002b8 0x002b8 R 0x4

Nothing wrong with that from a strict ELF compliance point of view, but
it doesn't meet the requirements of our current gen_ldelf_hex.py script
which makes the build fail:

$ scripts/gen_ldelf_hex.py --input out/arm-plat-vexpress/ldelf/ldelf.elf \
--output out/arm-plat-vexpress/core/ldelf_hex.c
Expected load segment to be read/write

I think our script is a bit too strict, what really matters is that
OP-TEE creates two memory mappings for the PT_LOAD segments of ldelf,
one is RX and the other is RW. We can therefore concatenate segments as
long as we have one or more non-writable segments followed by one or
more writable ones.

This commit relaxes the requirements in gen_ldelf_hex.py and implements
the above conditions instead.

[1] clang version 11.0.0 (https://github.com/llvm/llvm-project.git
6b3168f8cdb46656330929877b0b4daab35d30de)

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, GCC 8.3/Clang 10/Clang pre-11)
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMUv8, GCC 8.3/Clang 10)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: early_ta: expose TA flags in struct early_ta

Store TA flags in early TA descriptions so that such TAs can later be
enumerated by the device PTA when TA_FLAG_DEVICE_ENUM is set.
Change ta_bin_t

core: early_ta: expose TA flags in struct early_ta

Store TA flags in early TA descriptions so that such TAs can later be
enumerated by the device PTA when TA_FLAG_DEVICE_ENUM is set.
Change ta_bin_to_c.py to read the TA flags from its ELF file and store
it in the early TA description.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
[jf: minor edits to commit message and one comment]
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts/ta_bin_to_c.py: remove blank lines

Python functions don't have to start with a blank line. Remove them for
consistency with other scripts.

Signed-off-by: Jerome Forissier <jerome@forissier.

scripts/ta_bin_to_c.py: remove blank lines

Python functions don't have to start with a blank line. Remove them for
consistency with other scripts.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...