ta: Pass config variables prefixed as _CFG_ from conf.mk to build flags

In addition to config variables prefixed as CFG_, some other config
variables are prefixed as _CFG_ and also referenced during

ta: Pass config variables prefixed as _CFG_ from conf.mk to build flags

In addition to config variables prefixed as CFG_, some other config
variables are prefixed as _CFG_ and also referenced during TA
compilation. Add _CFG_ config variables to be compiler flags.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

ta: enable ubsan support for TAs

Introduce CFG_TA_SANITIZE_UNDEFINED config to sanitize trusted
applications. If CFG_TA_SANITIZE_UNDEFINED is set sanitize flags are
propagated to internal TAs (avb,

ta: enable ubsan support for TAs

Introduce CFG_TA_SANITIZE_UNDEFINED config to sanitize trusted
applications. If CFG_TA_SANITIZE_UNDEFINED is set sanitize flags are
propagated to internal TAs (avb, pkcs11, remoteproc, trusted_keys) and
external TAs, which are built with the devkit.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta_dev_kit.mk: use spec-srcs and spec-out-dir

The commit cfa34d9afb5c ("Add support for compiling in-tree TAs") added
spec-srcs and spec-out-dir for special handling of user_ta_header.c when
compili

ta_dev_kit.mk: use spec-srcs and spec-out-dir

The commit cfa34d9afb5c ("Add support for compiling in-tree TAs") added
spec-srcs and spec-out-dir for special handling of user_ta_header.c when
compiling in-tree TAs.

However, these variables are just as relevant for out-of-tree TAs
compiled via ta/mk/ta_dev_kit.mk. So as a simplification switch to use
spec-srcs and spec-out-dir in that file too.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Move mv-if-changed() into mk/macros.mk

Moves the make macro mv-if-changed() into mk/macros.mk to allow use of
it in the TA devkit.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed

Move mv-if-changed() into mk/macros.mk

Moves the make macro mv-if-changed() into mk/macros.mk to allow use of
it in the TA devkit.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mk: Support user static lib for aosp build

The aosp build environment don't allow writing to source folder, move
the $(libname).a in current folder to $(out-link-dir$(sm)). And since
static librarie

mk: Support user static lib for aosp build

The aosp build environment don't allow writing to source folder, move
the $(libname).a in current folder to $(out-link-dir$(sm)). And since
static libraries are not needed for runtime, set the LOCAL_MODULE_CLASS
to STATIC_LIBRARIES to avoid installing by aosp build.

Signed-off-by: Tadd Kao <tadd.kao@mediatek.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Update reported version to GP Core Internal API v1.3.1

Updates the reported version to 1.3.1. Three new defines:
- TEE_CORE_API_REQUIRED_MAJOR_VERSION
- TEE_CORE_API_REQUIRED_MINOR_VERSION
- TEE_COR

Update reported version to GP Core Internal API v1.3.1

Updates the reported version to 1.3.1. Three new defines:
- TEE_CORE_API_REQUIRED_MAJOR_VERSION
- TEE_CORE_API_REQUIRED_MINOR_VERSION
- TEE_CORE_API_REQUIRED_MAINTENANCE_VERSION
are added by the standard as a way for the TA to specify required
version of the API. OP-TEE only supports downgrading to version 1.1.

A simplified OP-TEE specific method is also provided:
Adds the configuration option CFG_TA_OPTEE_CORE_API_COMPAT_1_1 which
enables TEE Internal Core API v1.1 compatibility for in-tree TAs.

The TA dev kit is also updated to recognize
CFG_TA_OPTEE_CORE_API_COMPAT_1_1 and set define
__OPTEE_CORE_API_COMPAT_1_1 to 1 if set.

These new defines does not do anything yet, but in following commits
functions and types will be updated gradually until all functions and
types changed in version 1.3.1 compared to the ones in v1.1 have been
updated.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta_dev_kit.mk: remove extra -o when creating static library

The archiver command: $(AR$(sm)) is not supposed to take a -o argument
to specify its output, contrary to the linker for instance.

When G

ta_dev_kit.mk: remove extra -o when creating static library

The archiver command: $(AR$(sm)) is not supposed to take a -o argument
to specify its output, contrary to the linker for instance.

When GNU ar is used, -o is simply ignored. However when LLVM ar is used
an error is printed. Therefore remove this unwanted -o.

Fixes: 9faf0da7b854 ("mk: add library common makefile support")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta_dev_kit.mk: set CFLAGS32 and CFLAGS64 to $(CFLAGS) by default

Prior to commit 19fdfcf617e3 ("build: ldelf and TAs can rely on
CFLAGS32/CFLAGS64") was $(arch-bits-$(sm)) not set for TAs (note: $(s

ta_dev_kit.mk: set CFLAGS32 and CFLAGS64 to $(CFLAGS) by default

Prior to commit 19fdfcf617e3 ("build: ldelf and TAs can rely on
CFLAGS32/CFLAGS64") was $(arch-bits-$(sm)) not set for TAs (note: $(sm)
is the submodule name, i.e., ta_arm32 or ta_arm64 for TAs). As a result,
$$(CFLAGS$$(arch-bits-$$(comp-sm-$2))) expanded to the value of CFLAGS
in mk/compile.mk.
With the introduction of the above commit, $(arch-bits-$(sm)) is always
set to 32 or 64 depending on the TA architecture, so mk/compile.mk now
evaluates $(CFLAGS32) or $(CFLAGS64). In order to keep the previous
behavior while still allowing specific overrides for 32 or 64-bit, set
CFLAGS32 and CFLAGS64 to $(CFLAGS) by default. This is consistent with
what was done for other submodules in commit b09cddcab1ee ("Introduce
CFLAGS32 and CFLAGS64").

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

build: ldelf and TAs can rely on CFLAGS32/CFLAGS64

Defines arch-bits-$(sm) for ldelf and intree TAs sub components
so that they can build using CFLAGS32 (or CFLAGS64) directives
possibly passed by t

build: ldelf and TAs can rely on CFLAGS32/CFLAGS64

Defines arch-bits-$(sm) for ldelf and intree TAs sub components
so that they can build using CFLAGS32 (or CFLAGS64) directives
possibly passed by the build environment.

Defines arch-bits-ta_arm32 (resp. 64) in TA devkit to leverage
CFLAGS32 (reps. CFLAGS64) directive passed by the build process. This
change is needed for external package willing to pass specific
directive to TA build sequence as toolchain's sysroot path.

Adds an inline comment describing $(sm) value in the in tree TAs build
instructions.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta_dev_kit.mk: make sure that libutils is linked second time

libgcc depends on __getauxval symbol from libuils. As, generally libutils
is linked before libgcc, we will get "unresolved symbol" error.

ta_dev_kit.mk: make sure that libutils is linked second time

libgcc depends on __getauxval symbol from libuils. As, generally libutils
is linked before libgcc, we will get "unresolved symbol" error. To resolve
this dependency we need to link libutils second time - after libgcc.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: experimental C++ support

Update the TA makefiles to support C++ (file extension: .cpp).

This allows the use of C++ in TA and libraries, with limitations (see
below). I consider this work experi

ta: experimental C++ support

Update the TA makefiles to support C++ (file extension: .cpp).

This allows the use of C++ in TA and libraries, with limitations (see
below). I consider this work experimental because it was only tested
with simple cases in xtest, introducing the required changes and
addressing issues one after another. Therefore, some features may be
missing for more complex use cases (additional relocation types or
runtime support...).

Tested with the arm-linux-gnueabihf- and aarch64-linux-gnu- toolchains
(GCC 8.3).

Limitations:

- Clang is not supported at the moment
- Exception handling: shared libraries cannot throw, catch or propagate
exceptions. Doing so would require linking the libraries and the main
program with the shared libgcc [1] which is not straightforward due
to the many dependencies on the GNU libc. Exceptions *can* be used in
the main program however, as well as in static libraries directly
linked with the main program.
- ldelf stack unwinding does not support C++ frames so crash/panic
dumps will likely be truncated when they involve C++ code.

Link: [1] https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html see "-shared-libgcc"
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, QEMUv8, HiKey960)
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Allow use of cc-option in core/arch/arm/arm.mk

It can be useful to call the cc-option macro when setting flags in
core/arch/arm/arm.mk. Unfortunately cc-option is defined in
mk/compile.mk which is t

Allow use of cc-option in core/arch/arm/arm.mk

It can be useful to call the cc-option macro when setting flags in
core/arch/arm/arm.mk. Unfortunately cc-option is defined in
mk/compile.mk which is too late to be useful (core/arch/arm/arm.mk is
included by core/core.mk before mk/compile.mk).

This commit addresses the issue by moving the definition of cc-option
to its own file, mk/cc-option.mk, which is then included by
core/arch/arm/arm.mk. There is a dependency on the compiler definitions
(mk/gcc.mk or mk/clang.mk) and on $(arch-bit-$(sm)) so
core/arch/arm/arm.mk is modified accordingly.

Moving cc-option out of mk/compile.mk means that all non-core
submodules would lose the definition unless they include
mk/cc-option.mk; the TA dev kit is modified so that TAs can call
cc-option from within their sub.mk files. As for other submodules, they
are internal and do not use cc-options as of now so they are not
modified.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Remove libmpa in favor of libmbedtls

We currently have two "big numbers" library, Mbed TLS and MPA. Both can
be used by libutee to implement the TEE Internal Core API Arithmetical
functions, and by

Remove libmpa in favor of libmbedtls

We currently have two "big numbers" library, Mbed TLS and MPA. Both can
be used by libutee to implement the TEE Internal Core API Arithmetical
functions, and by the TEE core or pseudo-TAs. This situation is
reflected by two configuration variables allowing to choose between
libmbedtls and libmpa:

- CFG_TA_MBEDTLS_MPI (default y) configures libutee,
- CFG_CORE_MBEDTLS_MPI (default y) configures the TEE core/PTAs.

In addition there is CFG_TA_MBEDTLS (default y, mandatory when
CFG_TA_MBEDTLS_MPI is y) to build libmbedtls and install it into the
SDK for direct use by TAs (libmbedtls also has function to deal with
certificates for instance).

MBed TLS has been supported and used by default for just over a year;
and we have recently found an issue with the MPA implementation of the
integer multiplication with modulus (mpa_mulmod()) [1] [2]. Therefore,
now is a good time to remove libmpa and use libmbedtls instead.

Link: [1] https://github.com/OP-TEE/optee_os/pull/3541#issuecomment-577592381
Link: [2] https://github.com/OP-TEE/optee_test/pull/389
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

TA dev kit: expose CFG_TA_VERSION build option

Allow to configure version of a TA via CFG_TA_VERSION as TA compile
time option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome

TA dev kit: expose CFG_TA_VERSION build option

Allow to configure version of a TA via CFG_TA_VERSION as TA compile
time option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

TA dev kit: Clang support

Updates ta/mk/ta_dev_kit.mk and other makefiles so that the COMPILER
variable can be used when building TAs: make COMPILER=clang ...

Signed-off-by: Jerome Forissier <jerom

TA dev kit: Clang support

Updates ta/mk/ta_dev_kit.mk and other makefiles so that the COMPILER
variable can be used when building TAs: make COMPILER=clang ...

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive
asm(".cantunwind");
^
Fix this by turning __ta_entry() into an assembler wrapper.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: arm64: Add support for function tracing of user TAs

Function tracing (ftrace) is a useful debugging technique to dump
function call graph for in-depth analysis of program execution and also

libutee: arm64: Add support for function tracing of user TAs

Function tracing (ftrace) is a useful debugging technique to dump
function call graph for in-depth analysis of program execution and also
to get useful information in case of any program abort.

In case of TA, this function graph information is dumped in a buffer
kept in .bss section of corresponding instrumented TA. So this buffer
can be dumped to normal world in case TA session closes or in case of
any abort. Also size of this ftrace buffer is configurable per TA via
following config option during TA compilation:

CFG_FTRACE_BUF_SIZE=2048

Function tracing is completely optional debugging feature which could
be enabled via command line config option CFG_TA_FTRACE_SUPPORT=y.

Along with this user needs to add cflag: "-pg" to the files for whom
function graph is to be generated. Typically for the whole TA, it should
be compiled with CFG_TA_MCOUNT=y.

And in case user wants to set "-pg" for particular file, following should
go in corresponding sub.mk:

cflags-<file-name>-y+=-pg

Also, to generate function graph for user mode libraries enable
CFG_ULIBS_MCOUNT=y which will set "-pg" for all library files.

Currently this patch adds support for function tracing of 64-bit
TAs only.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)

show more ...

ta: switch to to mbedtls for bignum

Adds tee_api_arith_mpi.c wrapper providing the TEE Arithmetical API around
the big (mpi) routines from mbedtls.

CFG_TA_MBEDTLS_MPI=y (default y) enables the usag

ta: switch to to mbedtls for bignum

Adds tee_api_arith_mpi.c wrapper providing the TEE Arithmetical API around
the big (mpi) routines from mbedtls.

CFG_TA_MBEDTLS_MPI=y (default y) enables the usage of the bignum routines
in libutee.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: support variables user-ta-{uuid,ldadd}

Replaces the old variables "binary" and "ldadd" with "user-ta-uuid" and
"user-ta-ldadd" respectively.

Reviewed-by: Jerome Forissier <jerome.forissier@lina

ta: support variables user-ta-{uuid,ldadd}

Replaces the old variables "binary" and "ldadd" with "user-ta-uuid" and
"user-ta-ldadd" respectively.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: prepare for in-tree ta building

Prepare for in-tree TA building by adding $(sm) to all TA dev-kit
variables that may cause conflicts either with the core linking or when
linking multiple TAs.

R

ta: prepare for in-tree ta building

Prepare for in-tree TA building by adding $(sm) to all TA dev-kit
variables that may cause conflicts either with the core linking or when
linking multiple TAs.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: configure and compile mbedtls

Configures mbedtls with a minimal user mode TA configuration and makes
it compile.

Adds dummy include/mbedtls_config_kernel.h to give a good error message

libmbedtls: configure and compile mbedtls

Configures mbedtls with a minimal user mode TA configuration and makes
it compile.

Adds dummy include/mbedtls_config_kernel.h to give a good error message
in case mbedTLS is compiled in for kernel mode.

mbedTLS is enabled for TAs with CFG_TA_MBEDTLS = y
Builtin self tests are enabled with CFG_TA_MBEDTLS_SELF_TEST = y

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

TA dev kit: add support for creating shared libraries

A new Makefile include (ta/arch/arm/link_shlib.mk) is introduced, it is
quite similar to the file used to generate a TA (ta/arch/arm/link.mk)
ex

TA dev kit: add support for creating shared libraries

A new Makefile include (ta/arch/arm/link_shlib.mk) is introduced, it is
quite similar to the file used to generate a TA (ta/arch/arm/link.mk)
except that is produces a shared object: $(SHLIBNAME).so. A signed file
is also produced: $(SHLIBUUID).ta.

Actual support for dynamically linked TAs in the OP-TEE ELF loader will
be added in subsequent patches.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

TA dev kit: minor cleanup

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

ta: pass CFG_ variables as defines

Pass all CFG_ variables as -D<varname>=<value> command line parameters
for the C preprocessor. Variables set to "n" are not passed and
variables set to "y" are sup

ta: pass CFG_ variables as defines

Pass all CFG_ variables as -D<varname>=<value> command line parameters
for the C preprocessor. Variables set to "n" are not passed and
variables set to "y" are supplied with the value "1" instead. This is
the same translation as done for conf.h when compiling OP-TEE OS.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...