Allow building libutils etc. as shared libraries

When CFG_ULIBS_SHARED=y (default n), build libutils, libmpa/libmbedtls
and libutee as shared libraries (.so). The static archives (.a) are
still prod

Allow building libutils etc. as shared libraries

When CFG_ULIBS_SHARED=y (default n), build libutils, libmpa/libmbedtls
and libutee as shared libraries (.so). The static archives (.a) are
still produced. The linker uses shared libraries by default when
present so TAs just need to be re-built to use the shared libraries.

For the time being, in-tree TAs are always linked statically for
practical reasons. Indeed, in-tree TAs (such as ta/avb) are likely
to be used as "early TAs". If such a TA was linked against shared
libraries, then those libraries would need to be installed in the
"early TA" area, too. While this works fine technically, it requires
some more steps in the Makefiles to make sure the proper dependencies
are installed and also it would mean that those libraries take
precedence over the ones potentially installed in the REE FS etc.
In other words, it would raise questions that we do not want nor need
to address now.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: switch to to mbedtls for bignum

Adds tee_api_arith_mpi.c wrapper providing the TEE Arithmetical API around
the big (mpi) routines from mbedtls.

CFG_TA_MBEDTLS_MPI=y (default y) enables the usag

ta: switch to to mbedtls for bignum

Adds tee_api_arith_mpi.c wrapper providing the TEE Arithmetical API around
the big (mpi) routines from mbedtls.

CFG_TA_MBEDTLS_MPI=y (default y) enables the usage of the bignum routines
in libutee.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Do not make in-tree TAs depend on a phony target

Commit cf903a62bc12 ("Add dependency on ta-dev-kit when building in-tree
TA") introduces a dependency of the in-tree TA object files on the phony
tar

Do not make in-tree TAs depend on a phony target

Commit cf903a62bc12 ("Add dependency on ta-dev-kit when building in-tree
TA") introduces a dependency of the in-tree TA object files on the phony
target 'ta_dev_kit'. The purpose was to make sure the dev kit files are
available when make starts building the TA. Unfortunately, this introduces
useless recompilation (the lines marked with >):

$ make -s && make
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/conf.cmake
CHK out/arm-plat-vexpress/export-ta_arm32/mk/conf.mk
> CC out/arm-plat-vexpress/ta/avb/entry.o
> CC out/arm-plat-vexpress/ta/avb/user_ta_header.o
> CPP out/arm-plat-vexpress/ta/avb/ta.lds
> LD out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf
> OBJDUMP out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.dmp
> OBJCOPY out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.stripped.elf
> SIGN out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.ta

This happens because phony targets are always considered new by the make
program, so they'd rather not be used as dependencies. Instead, replace
'ta-dev-kit' by the actual list of all the files in the TA dev kit. Then,
the second make invocation will not rebuild anything:

$ make -s && make
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/conf.cmake
CHK out/arm-plat-vexpress/export-ta_arm32/mk/conf.mk

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add dependency on ta-dev-kit when building in-tree TA

Fixes the following errors which may reportedly be triggered by plain
"make" too [1]:

$ make -s clean && make -s out/arm-plat-vexpress/ta/avb/

Add dependency on ta-dev-kit when building in-tree TA

Fixes the following errors which may reportedly be triggered by plain
"make" too [1]:

$ make -s clean && make -s out/arm-plat-vexpress/ta/avb/entry.o
cc1: warning: out/arm-plat-vexpress/export-ta_arm32/include: No such file or directory [-Wmissing-include-dirs]
ta/avb/entry.c:5:30: fatal error: tee_internal_api.h: No such file or directory
compilation terminated.
mk/compile.mk:146: recipe for target 'out/arm-plat-vexpress/ta/avb/entry.o' failed
make: *** [out/arm-plat-vexpress/ta/avb/entry.o] Error 1

$ make -s clean && make -s out/arm-plat-vexpress/ta/avb/user_ta_header.o
cc1: warning: out/arm-plat-vexpress/export-ta_arm32/include: No such file or directory [-Wmissing-include-dirs]
out/arm-plat-vexpress/export-ta_arm32/src/user_ta_header.c:5:22: fatal error: compiler.h: No such file or directory
compilation terminated.
mk/compile.mk:154: recipe for target 'out/arm-plat-vexpress/ta/avb/user_ta_header.o' failed
make: *** [out/arm-plat-vexpress/ta/avb/user_ta_header.o] Error 1

Link: [1] https://github.com/OP-TEE/build/issues/285
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

In-tree TAs: prevent double slash in object paths

When processing the source files for an in-tree user TA (ta/*/user_ta.mk),
make sure not to insert a double slash in the object file path.

Fixes th

In-tree TAs: prevent double slash in object paths

When processing the source files for an in-tree user TA (ta/*/user_ta.mk),
make sure not to insert a double slash in the object file path.

Fixes the following error:

$ make -s
$ make clean
CLEAN out/arm-plat-vexpress
rmdir: failed to remove 'out/arm-plat-vexpress/ta/avb': No such file or directory
Makefile:98: recipe for target 'clean' failed
make: *** [clean] Error 1

The error results from the fact that we have two kinds of object files in
the in-tree TAs:
- The object files built from ta/*/user_ta.mk. For AVB, we have
out/arm-plat-vexpress/ta/avb//entry.o (notice the repeated slash).
- The object files that correspond to "specified source files", i.e.,
constructed from $(spec-out-dir) and $(spec-srcs). For AVB we have
out/arm-plat-vexpress/ta/avb/user_ta_header.o.
When "make clean" creates the list of directories to be removed, it strips
the /filename part and keeps only the directory part, resulting in:

rmdir ... out/arm-plat-vexpress/ta/avb/ out/arm-plat-vexpress/ta/avb

Trying to remove the same directory twice: "No such file or directory".

Fixes: https://github.com/OP-TEE/optee_os/issues/2484
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Andrew F. Davis <afd@ti.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

Add support for compiling in-tree TAs

Adds support for compiling in-tree TAs. Unless specified via
CFG_USER_TA_TARGET_<ta-name> the TA will be built with the first TA
target (aka TA dev kit, when de

Add support for compiling in-tree TAs

Adds support for compiling in-tree TAs. Unless specified via
CFG_USER_TA_TARGET_<ta-name> the TA will be built with the first TA
target (aka TA dev kit, when delivered) specified in the variable
ta-targets which is initialized in core/arch/arm/plat-*/conf.mk.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: support variables user-ta-{uuid,ldadd}

Replaces the old variables "binary" and "ldadd" with "user-ta-uuid" and
"user-ta-ldadd" respectively.

Reviewed-by: Jerome Forissier <jerome.forissier@lina

ta: support variables user-ta-{uuid,ldadd}

Replaces the old variables "binary" and "ldadd" with "user-ta-uuid" and
"user-ta-ldadd" respectively.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: prepare for in-tree ta building

Prepare for in-tree TA building by adding $(sm) to all TA dev-kit
variables that may cause conflicts either with the core linking or when
linking multiple TAs.

R

ta: prepare for in-tree ta building

Prepare for in-tree TA building by adding $(sm) to all TA dev-kit
variables that may cause conflicts either with the core linking or when
linking multiple TAs.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: configure and compile mbedtls

Configures mbedtls with a minimal user mode TA configuration and makes
it compile.

Adds dummy include/mbedtls_config_kernel.h to give a good error message

libmbedtls: configure and compile mbedtls

Configures mbedtls with a minimal user mode TA configuration and makes
it compile.

Adds dummy include/mbedtls_config_kernel.h to give a good error message
in case mbedTLS is compiled in for kernel mode.

mbedTLS is enabled for TAs with CFG_TA_MBEDTLS = y
Builtin self tests are enabled with CFG_TA_MBEDTLS_SELF_TEST = y

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

TA dev kit: add support for creating shared libraries

A new Makefile include (ta/arch/arm/link_shlib.mk) is introduced, it is
quite similar to the file used to generate a TA (ta/arch/arm/link.mk)
ex

TA dev kit: add support for creating shared libraries

A new Makefile include (ta/arch/arm/link_shlib.mk) is introduced, it is
quite similar to the file used to generate a TA (ta/arch/arm/link.mk)
except that is produces a shared object: $(SHLIBNAME).so. A signed file
is also produced: $(SHLIBUUID).ta.

Actual support for dynamically linked TAs in the OP-TEE ELF loader will
be added in subsequent patches.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

TA dev kit: minor cleanup

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

ta: pass CFG_ variables as defines

Pass all CFG_ variables as -D<varname>=<value> command line parameters
for the C preprocessor. Variables set to "n" are not passed and
variables set to "y" are sup

ta: pass CFG_ variables as defines

Pass all CFG_ variables as -D<varname>=<value> command line parameters
for the C preprocessor. Variables set to "n" are not passed and
variables set to "y" are supplied with the value "1" instead. This is
the same translation as done for conf.h when compiling OP-TEE OS.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: rework how ENABLE_MDBG=1 is passed

Reworks how ENABLE_MDBG=1 is passed when compiling the TA.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wik

ta: rework how ENABLE_MDBG=1 is passed

Reworks how ENABLE_MDBG=1 is passed when compiling the TA.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta_dev_kit.mk: define ENABLE_MDBG when CFG_TEE_TA_MALLOC_DEBUG is set

In order to use the memory leak detection code, a user-mode TA needs
two things:
- A version of libutils.a that was built with m

ta_dev_kit.mk: define ENABLE_MDBG when CFG_TEE_TA_MALLOC_DEBUG is set

In order to use the memory leak detection code, a user-mode TA needs
two things:
- A version of libutils.a that was built with malloc debug code. This
is taken care of by ta/ta.mk which sets ENABLE_MDBG=1 when
CFG_TEE_TA_MALLOC_DEBUG is 'y'.
- The proper declarations for mdbg_malloc(), mdbg_free(), mdbg_check()
etc. as well as the macro redefinitions for malloc(), free() etc. in
the header files when the TA is built. This patch adds the
missing definition of ENABLE_MDBG in ta/mk/ta_dev_kit.mk when
CFG_TEE_TA_MALLOC_DEBUG is 'y'.

In addition, the usage of CFG_TEE_TA_MALLOC_DEBUG and
CFG_TEE_CORE_MALLOC_DEBUG is better documented in mk/conf.mk.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>

show more ...

Dump call stack on TA panic

Adds support for dumping the call stack of a user-mode TA when it
panics. Stack unwinding happens in kernel mode by re-using
abort_print_error() in core/arch/arm/kernel/a

Dump call stack on TA panic

Adds support for dumping the call stack of a user-mode TA when it
panics. Stack unwinding happens in kernel mode by re-using
abort_print_error() in core/arch/arm/kernel/abort.c. Like for abort
dumps, the helper script scripts/symbolize.py may be used to obtain
source-level information.

This feature is enabled by default. Set CFG_UNWIND=n to disable it
(or CFG_TEE_CORE_DEBUG=n).

In libutee, the utee_panic() syscall wrapper is renamed __utee_panic()
and now takes an additional parameters: a stack pointer, in addition to
the panic code. utee_panic() is written in assembly and pushes some
registers onto the stack before calling __utee_panic(). When it is time
to return from syscall_panic(), tee_svc_sys_return_helper() uses the
stack pointer to get the information needed to unwind the TA stack.
A struct abort_info is created and abort_print_error() is called.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey 32/64)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMUv8)

show more ...

libutee: remove Trusted UI code

Removes all the TUI-related code from libutee (lib/libutee/tui), as
well as its dependencies: lib/libpng and lib/libzlib. Two reasons for
this:
1. This is far from b

libutee: remove Trusted UI code

Removes all the TUI-related code from libutee (lib/libutee/tui), as
well as its dependencies: lib/libpng and lib/libzlib. Two reasons for
this:
1. This is far from being a complete and testable TUI implementation.
In other words, it is dead code, more or less.
2. lib/libzlib (version 1.2.8) contains several CVE vulnerabilities.
Even if the code is not used, it may trigger some code analysis tools
and is a problem for some projects.

Reported-by: Jianhui Li <airbak.li@hisilicon.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Update link rules for User TA

Let's use --start-group / --end-group to allow all libraries added by the
user to use any symbols provided by optee-os lib without having to add that
library again.

Fo

Update link rules for User TA

Let's use --start-group / --end-group to allow all libraries added by the
user to use any symbols provided by optee-os lib without having to add that
library again.

For example, if one provides its own library libexample.a that use
strcmp(), which is provided by libutils.a, and he want to compile its TA
with libexample.a, he'll add

libdirs += ...
libnames += example

in his TA Makefile

But the linker will not find strcmp() symbol unless he adds utils lib
explicitly:
libnames += utils example
even if it is already specified in ta_dev_kit.mk because the order matter,
unless it uses -start-group / --end-group

Signed-off-by: Pierre Peiffer <ppeiffer@invensense.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
[jerome.forissier@linaro.org: wrap line in commit description]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

make clean: don't fail on non-empty directory

"make clean" may report errors when trying to clean with different
configuration values than the ones used during the build. For instance:

$ make -s CF

make clean: don't fail on non-empty directory

"make clean" may report errors when trying to clean with different
configuration values than the ones used during the build. For instance:

$ make -s CFG_RPMB_FS=y
$ make clean
CLEAN out/arm-plat-vexpress
rmdir: failed to remove 'out/arm-plat-vexpress/core/tee': Directory not empty
rmdir: failed to remove 'out/arm-plat-vexpress/core': Directory not empty
rmdir: failed to remove 'out/arm-plat-vexpress': Directory not empty
Makefile:88: recipe for target 'clean' failed
make: *** [clean] Error 1

The clean command should not fail, since the build tree was properly
cleaned for the requested configuration. Fix this by using
'rmdir --ignore-fail-on-non-empty'.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Make sure "make clean" removes everything "make" has created under $(O)

"make clean" would leave behind some files and many directories. Fix
this by correctly tracking the files and directories crea

Make sure "make clean" removes everything "make" has created under $(O)

"make clean" would leave behind some files and many directories. Fix
this by correctly tracking the files and directories created under $(O)
during the build process:
- Fix incorrect file names in $(cleanfiles) and add a few missing
ones.
- Introduce a makefile macro: $(cleandirs-for-rmdir), defined in a new
file: mk/cleandirs.mk. It returns the list of directories that should
be removed, given a list of files.
The clean target removes the files, then all the directories in depth-
first order. $(O) is also removed, if found to be empty.

Note that a more straightforward approach was discussed in [1]: use
"rm -rf $(O)/some_dir" and get rid of the whole file and directory
tracking via $(cleanfiles) and $(cleandirs). Although it was agreed it
would be safe, doing so would necessarily break the backward
compatibility for build scripts relying on "make O=<some path>", due to
the additional level ($(O)/some_dir).

Finally, mk/cleandirs.mk is exported to the TA dev kit and the clean
rule for the TAs is updated.

[1] https://github.com/OP-TEE/optee_os/pull/1270

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Andy Green <andy@warmcat.com>

show more ...

ta_dev_kit.mk: get optional flags from $(CFLAGS_$(sm))/$(CPPFLAGS_$(sm))

This provides an easy way to append some flags to the TA build, for
instance: `make CFLAGS_ta_arm64=-O0' to disable optimizat

ta_dev_kit.mk: get optional flags from $(CFLAGS_$(sm))/$(CPPFLAGS_$(sm))

This provides an easy way to append some flags to the TA build, for
instance: `make CFLAGS_ta_arm64=-O0' to disable optimizations in 64-bit
TAs.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mk: add library common makefile support

It is not always suitable to place the third party library source in
the optee-os directory, provide a common library makefile here, the
usage is similar as T

mk: add library common makefile support

It is not always suitable to place the third party library source in
the optee-os directory, provide a common library makefile here, the
usage is similar as TA, the only difference is as follow:
TA Makefile:
BINARY := xxx
LIB Makefile:
LIBNAME := libxxx
And xxx.ta or libxxx.a is the target.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Zeng Tao <prime.zeng@huawei.com>

show more ...