build: always link in-tree TAs with the -static flag

Shared libraries may remain in the output directory as artifacts
from previous builds, causing unintended behavior. To prevent this,
in-tree TAs

build: always link in-tree TAs with the -static flag

Shared libraries may remain in the output directory as artifacts
from previous builds, causing unintended behavior. To prevent this,
in-tree TAs are now always linked using the -static flag, regardless
of whether shared libraries are enabled.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

build: ta: add RISC-V linker script

Sort out the common code compiled by TA,
abstract RISCV and ARM compile the common part of TA.

Signed-off-by: liushiwei <liushiwei@eswincomputing.com>
Reviewed-b

build: ta: add RISC-V linker script

Sort out the common code compiled by TA,
abstract RISCV and ARM compile the common part of TA.

Signed-off-by: liushiwei <liushiwei@eswincomputing.com>
Reviewed-by: chenchaokai <chenchaokai@eswincomputing.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Update reported version to GP Core Internal API v1.3.1

Updates the reported version to 1.3.1. Three new defines:
- TEE_CORE_API_REQUIRED_MAJOR_VERSION
- TEE_CORE_API_REQUIRED_MINOR_VERSION
- TEE_COR

Update reported version to GP Core Internal API v1.3.1

Updates the reported version to 1.3.1. Three new defines:
- TEE_CORE_API_REQUIRED_MAJOR_VERSION
- TEE_CORE_API_REQUIRED_MINOR_VERSION
- TEE_CORE_API_REQUIRED_MAINTENANCE_VERSION
are added by the standard as a way for the TA to specify required
version of the API. OP-TEE only supports downgrading to version 1.1.

A simplified OP-TEE specific method is also provided:
Adds the configuration option CFG_TA_OPTEE_CORE_API_COMPAT_1_1 which
enables TEE Internal Core API v1.1 compatibility for in-tree TAs.

The TA dev kit is also updated to recognize
CFG_TA_OPTEE_CORE_API_COMPAT_1_1 and set define
__OPTEE_CORE_API_COMPAT_1_1 to 1 if set.

These new defines does not do anything yet, but in following commits
functions and types will be updated gradually until all functions and
types changed in version 1.3.1 compared to the ones in v1.1 have been
updated.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: use CFLAGS_ta_armXX etc. when building in-tree TAs

In-tree TAs currently ignore CFLAGS_ta_arm32/CFLAGS_ta_arm64 and
CPPFLAGS_ta_arm32/CPPFLAGS_ta_arm64, contrary to out-of tree TAs which
are

build: use CFLAGS_ta_armXX etc. when building in-tree TAs

In-tree TAs currently ignore CFLAGS_ta_arm32/CFLAGS_ta_arm64 and
CPPFLAGS_ta_arm32/CPPFLAGS_ta_arm64, contrary to out-of tree TAs which
are built with ta/mk/ta_dev_kit.mk. Add these flags for convenience and
consistency.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

build: use CFLAGS32/CFLAGS64 when building in-tree TAs

Commit 19fdfcf617e3 ("build: ldelf and TAs can rely on CFLAGS32/CFLAGS64")
only partially implements what is mentioned in the commit descriptio

build: use CFLAGS32/CFLAGS64 when building in-tree TAs

Commit 19fdfcf617e3 ("build: ldelf and TAs can rely on CFLAGS32/CFLAGS64")
only partially implements what is mentioned in the commit description.
The ldelf part is OK, but in-tree TAs still don't use CFLAGS32 or
CFLAGS64. The reason is that the submodule name $(sm) is not ta_arm32 or
ta_arm64 like for TAs build with the "dev kit". Instead, $(sm) is the
name of the directory (such as "avb" for core/ta/avb, "pkcs11" for
core/ta/pkcs11, etc.). Therefore, it is not arch-bits-ta_arm32 or
arch-bits-ta_arm64 that needs to be set but arch-bits-$(sm).

Fixes: 19fdfcf617e3 ("build: ldelf and TAs can rely on CFLAGS32/CFLAGS64")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Ralph Siemsen <ralph.siemsen@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: ldelf and TAs can rely on CFLAGS32/CFLAGS64

Defines arch-bits-$(sm) for ldelf and intree TAs sub components
so that they can build using CFLAGS32 (or CFLAGS64) directives
possibly passed by t

build: ldelf and TAs can rely on CFLAGS32/CFLAGS64

Defines arch-bits-$(sm) for ldelf and intree TAs sub components
so that they can build using CFLAGS32 (or CFLAGS64) directives
possibly passed by the build environment.

Defines arch-bits-ta_arm32 (resp. 64) in TA devkit to leverage
CFLAGS32 (reps. CFLAGS64) directive passed by the build process. This
change is needed for external package willing to pass specific
directive to TA build sequence as toolchain's sysroot path.

Adds an inline comment describing $(sm) value in the in tree TAs build
instructions.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

Install in-tree TAs into $(TA_DEV_KIT_DIR)/ta

In order for a build environment to easily pick all the in-tree TAs, and
not depend too much on the layout of the out directory, copy them into
the "dev

Install in-tree TAs into $(TA_DEV_KIT_DIR)/ta

In order for a build environment to easily pick all the in-tree TAs, and
not depend too much on the layout of the out directory, copy them into
the "dev kit" directory similar to what is already done for TA shared
libraries when CFG_ULIBS_SHARED=y. Libraries are copied to
$(TA_DEV_KIT_DIR)/lib/*.ta so let's use $(TA_DEV_KIT_DIR)/ta/*.ta
for the in-tree TAs.

Suggested-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: Add missing default of user-ta-version

When a user TA is built with the TA dev kit (out-of-tree TA),
user-ta-version is always set to the value of CFG_TA_VERSION (default:
0) by ta_dev_kit.mk. B

ta: Add missing default of user-ta-version

When a user TA is built with the TA dev kit (out-of-tree TA),
user-ta-version is always set to the value of CFG_TA_VERSION (default:
0) by ta_dev_kit.mk. But for in-tree TAs, this variable is never set
outside the in-tree TA makefiles (ta/*/user_ta.mk). Therefore it is
mandatory for in-tree user TAs to set the variable or various issues
will happen (build error or unexpected version taken from the TA that
happened to have been built just before).

To address the problem and for consistency this commit sets a default
value of 0 for user-ta-version in ta/mk/build-user-ta.mk before
including user_ta.mk.

Fixes: 682f256caaf6 ("TA dev kit: expose CFG_TA_VERSION build option")
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

Remove libmpa in favor of libmbedtls

We currently have two "big numbers" library, Mbed TLS and MPA. Both can
be used by libutee to implement the TEE Internal Core API Arithmetical
functions, and by

Remove libmpa in favor of libmbedtls

We currently have two "big numbers" library, Mbed TLS and MPA. Both can
be used by libutee to implement the TEE Internal Core API Arithmetical
functions, and by the TEE core or pseudo-TAs. This situation is
reflected by two configuration variables allowing to choose between
libmbedtls and libmpa:

- CFG_TA_MBEDTLS_MPI (default y) configures libutee,
- CFG_CORE_MBEDTLS_MPI (default y) configures the TEE core/PTAs.

In addition there is CFG_TA_MBEDTLS (default y, mandatory when
CFG_TA_MBEDTLS_MPI is y) to build libmbedtls and install it into the
SDK for direct use by TAs (libmbedtls also has function to deal with
certificates for instance).

MBed TLS has been supported and used by default for just over a year;
and we have recently found an issue with the MPA implementation of the
integer multiplication with modulus (mpa_mulmod()) [1] [2]. Therefore,
now is a good time to remove libmpa and use libmbedtls instead.

Link: [1] https://github.com/OP-TEE/optee_os/pull/3541#issuecomment-577592381
Link: [2] https://github.com/OP-TEE/optee_test/pull/389
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

In-tree TAs: avoid recompiling when a library changes

When a library is changed (libutee.a, libutils.a, etc.) the in-tree TAs
are re-built from scratch. We can easily avoid recompilation and only
re

In-tree TAs: avoid recompiling when a library changes

When a library is changed (libutee.a, libutils.a, etc.) the in-tree TAs
are re-built from scratch. We can easily avoid recompilation and only
re-link instead.

For example, without this patch:
$ make -s -j10
$ touch out/arm-plat-vexpress/export-ta_arm32/lib/libutee.a
$ make out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/conf.cmake
CC out/arm-plat-vexpress/ta/avb/entry.o
CC out/arm-plat-vexpress/ta/avb/user_ta_header.o
AS out/arm-plat-vexpress/ta/avb/ta_entry_a32.o
LD out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf

With this patch applied:
$ make -s -j10
$ touch out/arm-plat-vexpress/export-ta_arm32/lib/libutee.a
$ make out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
LD out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive
asm(".cantunwind");
^
Fix this by turning __ta_entry() into an assembler wrapper.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Allow building libutils etc. as shared libraries

When CFG_ULIBS_SHARED=y (default n), build libutils, libmpa/libmbedtls
and libutee as shared libraries (.so). The static archives (.a) are
still prod

Allow building libutils etc. as shared libraries

When CFG_ULIBS_SHARED=y (default n), build libutils, libmpa/libmbedtls
and libutee as shared libraries (.so). The static archives (.a) are
still produced. The linker uses shared libraries by default when
present so TAs just need to be re-built to use the shared libraries.

For the time being, in-tree TAs are always linked statically for
practical reasons. Indeed, in-tree TAs (such as ta/avb) are likely
to be used as "early TAs". If such a TA was linked against shared
libraries, then those libraries would need to be installed in the
"early TA" area, too. While this works fine technically, it requires
some more steps in the Makefiles to make sure the proper dependencies
are installed and also it would mean that those libraries take
precedence over the ones potentially installed in the REE FS etc.
In other words, it would raise questions that we do not want nor need
to address now.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: switch to to mbedtls for bignum

Adds tee_api_arith_mpi.c wrapper providing the TEE Arithmetical API around
the big (mpi) routines from mbedtls.

CFG_TA_MBEDTLS_MPI=y (default y) enables the usag

ta: switch to to mbedtls for bignum

Adds tee_api_arith_mpi.c wrapper providing the TEE Arithmetical API around
the big (mpi) routines from mbedtls.

CFG_TA_MBEDTLS_MPI=y (default y) enables the usage of the bignum routines
in libutee.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Do not make in-tree TAs depend on a phony target

Commit cf903a62bc12 ("Add dependency on ta-dev-kit when building in-tree
TA") introduces a dependency of the in-tree TA object files on the phony
tar

Do not make in-tree TAs depend on a phony target

Commit cf903a62bc12 ("Add dependency on ta-dev-kit when building in-tree
TA") introduces a dependency of the in-tree TA object files on the phony
target 'ta_dev_kit'. The purpose was to make sure the dev kit files are
available when make starts building the TA. Unfortunately, this introduces
useless recompilation (the lines marked with >):

$ make -s && make
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/conf.cmake
CHK out/arm-plat-vexpress/export-ta_arm32/mk/conf.mk
> CC out/arm-plat-vexpress/ta/avb/entry.o
> CC out/arm-plat-vexpress/ta/avb/user_ta_header.o
> CPP out/arm-plat-vexpress/ta/avb/ta.lds
> LD out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf
> OBJDUMP out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.dmp
> OBJCOPY out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.stripped.elf
> SIGN out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.ta

This happens because phony targets are always considered new by the make
program, so they'd rather not be used as dependencies. Instead, replace
'ta-dev-kit' by the actual list of all the files in the TA dev kit. Then,
the second make invocation will not rebuild anything:

$ make -s && make
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/conf.cmake
CHK out/arm-plat-vexpress/export-ta_arm32/mk/conf.mk

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add dependency on ta-dev-kit when building in-tree TA

Fixes the following errors which may reportedly be triggered by plain
"make" too [1]:

$ make -s clean && make -s out/arm-plat-vexpress/ta/avb/

Add dependency on ta-dev-kit when building in-tree TA

Fixes the following errors which may reportedly be triggered by plain
"make" too [1]:

$ make -s clean && make -s out/arm-plat-vexpress/ta/avb/entry.o
cc1: warning: out/arm-plat-vexpress/export-ta_arm32/include: No such file or directory [-Wmissing-include-dirs]
ta/avb/entry.c:5:30: fatal error: tee_internal_api.h: No such file or directory
compilation terminated.
mk/compile.mk:146: recipe for target 'out/arm-plat-vexpress/ta/avb/entry.o' failed
make: *** [out/arm-plat-vexpress/ta/avb/entry.o] Error 1

$ make -s clean && make -s out/arm-plat-vexpress/ta/avb/user_ta_header.o
cc1: warning: out/arm-plat-vexpress/export-ta_arm32/include: No such file or directory [-Wmissing-include-dirs]
out/arm-plat-vexpress/export-ta_arm32/src/user_ta_header.c:5:22: fatal error: compiler.h: No such file or directory
compilation terminated.
mk/compile.mk:154: recipe for target 'out/arm-plat-vexpress/ta/avb/user_ta_header.o' failed
make: *** [out/arm-plat-vexpress/ta/avb/user_ta_header.o] Error 1

Link: [1] https://github.com/OP-TEE/build/issues/285
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

In-tree TAs: prevent double slash in object paths

When processing the source files for an in-tree user TA (ta/*/user_ta.mk),
make sure not to insert a double slash in the object file path.

Fixes th

In-tree TAs: prevent double slash in object paths

When processing the source files for an in-tree user TA (ta/*/user_ta.mk),
make sure not to insert a double slash in the object file path.

Fixes the following error:

$ make -s
$ make clean
CLEAN out/arm-plat-vexpress
rmdir: failed to remove 'out/arm-plat-vexpress/ta/avb': No such file or directory
Makefile:98: recipe for target 'clean' failed
make: *** [clean] Error 1

The error results from the fact that we have two kinds of object files in
the in-tree TAs:
- The object files built from ta/*/user_ta.mk. For AVB, we have
out/arm-plat-vexpress/ta/avb//entry.o (notice the repeated slash).
- The object files that correspond to "specified source files", i.e.,
constructed from $(spec-out-dir) and $(spec-srcs). For AVB we have
out/arm-plat-vexpress/ta/avb/user_ta_header.o.
When "make clean" creates the list of directories to be removed, it strips
the /filename part and keeps only the directory part, resulting in:

rmdir ... out/arm-plat-vexpress/ta/avb/ out/arm-plat-vexpress/ta/avb

Trying to remove the same directory twice: "No such file or directory".

Fixes: https://github.com/OP-TEE/optee_os/issues/2484
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Andrew F. Davis <afd@ti.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

Add support for compiling in-tree TAs

Adds support for compiling in-tree TAs. Unless specified via
CFG_USER_TA_TARGET_<ta-name> the TA will be built with the first TA
target (aka TA dev kit, when de

Add support for compiling in-tree TAs

Adds support for compiling in-tree TAs. Unless specified via
CFG_USER_TA_TARGET_<ta-name> the TA will be built with the first TA
target (aka TA dev kit, when delivered) specified in the variable
ta-targets which is initialized in core/arch/arm/plat-*/conf.mk.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...