link.mk: implement support for libnames-after-libgcc variable

Newer versions of libgcc depend on external __getauxval() symbol, which is
now provided by libutils. But libgcc is linked after libutils

link.mk: implement support for libnames-after-libgcc variable

Newer versions of libgcc depend on external __getauxval() symbol, which is
now provided by libutils. But libgcc is linked after libutils, so linker
can't resolve that symbol. We can't include libgcc into linking group with
libtutils, because libgcc provides symbols that conflict with libutil's
ones, like __aeabi_idiv with friends for instance.

So, to resolve libgcc dependency on libutils we need to link with libutils
second time. To make things more generic, we will introduce
$(libnames-after-libgcc) variable for libraries that should be linked after
libgcc.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros

This change applies to arm32 assembler sources.

Instead of using UNWIND(.fnstart) after FUNC or LOCAL_FUNC and
UNWIND(.fnend) before END_FUN

arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros

This change applies to arm32 assembler sources.

Instead of using UNWIND(.fnstart) after FUNC or LOCAL_FUNC and
UNWIND(.fnend) before END_FUNC, let's fold these statements into the
FUNC macros.

The .fnstart/.fnend directives mark the start and end of a function
with an unwind table entry (.ARM.exidx) and therefore a function
without them has no entry and cannot be unwound. This means that a
stack dump (on abort or panic) would stop when reaching such a
function.

As a result of this patch, a small number of functions now have an
entry in the unwind table when they had none before (the functions
which were using FUNC or LOCAL_FUNC but had no .fnstart/.fnend). It was
almost always a bug and this pacth only increases the size of the
.ARM.exidx section by a few bytes (tested on QEMU).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

arm32: move the UNWIND() macro to <asm.S>

All the users of the UNWIND() macro include <asm.S> already, which is
therefore a good place to define this macro. Let's move it from
<kernel/unwind.h> to <

arm32: move the UNWIND() macro to <asm.S>

All the users of the UNWIND() macro include <asm.S> already, which is
therefore a good place to define this macro. Let's move it from
<kernel/unwind.h> to <asm.S>, remove a couple of duplicates in
assembler files, and drop the useless includes.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ta: pkcs11: fix get_attribute_ptrs() against empty attributes

Fix get_attribute_ptrs() to output NULL attribute value references
when the target attribute value is empty, that is when the attribute

ta: pkcs11: fix get_attribute_ptrs() against empty attributes

Fix get_attribute_ptrs() to output NULL attribute value references
when the target attribute value is empty, that is when the attribute
value size is 0.

Fixes: 63f89caa9022 ("ta: pkcs11: attribute helper functions")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: fix trace_attributes() to support empty attribute arrays

Fix trace_attributes() to not print meaningless data when an attribute
array is empty.

Also fix a local variable that is not ini

ta: pkcs11: fix trace_attributes() to support empty attribute arrays

Fix trace_attributes() to not print meaningless data when an attribute
array is empty.

Also fix a local variable that is not initialized in trace_attributes().

Fixes: 63f89caa9022 ("ta: pkcs11: attribute helper functions")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: remove local helper function supported_mechanism_key_size()

Remove local helper function supported_mechanism_key_size() that is
superseded by newly introduced mechanism_supported_key_siz

ta: pkcs11: remove local helper function supported_mechanism_key_size()

Remove local helper function supported_mechanism_key_size() that is
superseded by newly introduced mechanism_supported_key_sizes() that
does the jobs and is up to date.

Fixes: 512cbf1d30 ("ta: pkcs11: adds support for symmetric AES cipher modes")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: minor fixes

Minor ID reordering in enum pkcs11_mechanism_id.

Fix inline comments referring to PKCS11_OK instead of PKCS11_CKR_OK.

Add 0x prefix in error trace in init_persistent_db().

ta: pkcs11: minor fixes

Minor ID reordering in enum pkcs11_mechanism_id.

Fix inline comments referring to PKCS11_OK instead of PKCS11_CKR_OK.

Add 0x prefix in error trace in init_persistent_db().

Use serialargs_get_session_from_handle() instead of the 2 step calls
to serialargs_get() and pkcs11_handle2session().

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ta: pkcs11: adds support for symmetric AES cipher modes

Adds support for the AES modes ECB, CBC, CTR and CTS.

Much infrastructure is added to handle mechanisms.

Reviewed-by: Vesa Jääskeläinen <ves

ta: pkcs11: adds support for symmetric AES cipher modes

Adds support for the AES modes ECB, CBC, CTR and CTS.

Much infrastructure is added to handle mechanisms.

Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: define TA command for encryption/decryption

Adds commands
- PKCS11_CMD_ENCRYPT_INIT
- PKCS11_CMD_DECRYPT_INIT
- PKCS11_CMD_ENCRYPT_UPDATE
- PKCS11_CMD_DECRYPT_UPDATE
- PKCS11_CMD_ENCRYPT

ta: pkcs11: define TA command for encryption/decryption

Adds commands
- PKCS11_CMD_ENCRYPT_INIT
- PKCS11_CMD_DECRYPT_INIT
- PKCS11_CMD_ENCRYPT_UPDATE
- PKCS11_CMD_DECRYPT_UPDATE
- PKCS11_CMD_ENCRYPT_FINAL
- PKCS11_CMD_ENCRYPT_FINAL
- PKCS11_CMD_ENCRYPT_ONESHOT
- PKCS11_CMD_DECRYPT_ONESHOT
in enum pkcs11_ta_cmd.

Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: define TA mechanisms for AES cipher modes

Adds the mechanisms
- PKCS11_CKM_AES_KEY_GEN
- PKCS11_CKM_AES_CBC
- PKCS11_CKM_AES_CTR
- PKCS11_CKM_AES_CTS
- PKCS11_CKM_AES_CBC_PAD
- PKCS11_CK

ta: pkcs11: define TA mechanisms for AES cipher modes

Adds the mechanisms
- PKCS11_CKM_AES_KEY_GEN
- PKCS11_CKM_AES_CBC
- PKCS11_CKM_AES_CTR
- PKCS11_CKM_AES_CTS
- PKCS11_CKM_AES_CBC_PAD
- PKCS11_CKM_AES_ECB_ENCRYPT_DATA
- PKCS11_CKM_AES_CBC_ENCRYPT_DATA
in enum pkcs11_mechanism_id.

Reviewed-by: Vesa Jääskeläinen <vesa.jaaskelainen@vaisala.com>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: experimental C++ support

Update the TA makefiles to support C++ (file extension: .cpp).

This allows the use of C++ in TA and libraries, with limitations (see
below). I consider this work experi

ta: experimental C++ support

Update the TA makefiles to support C++ (file extension: .cpp).

This allows the use of C++ in TA and libraries, with limitations (see
below). I consider this work experimental because it was only tested
with simple cases in xtest, introducing the required changes and
addressing issues one after another. Therefore, some features may be
missing for more complex use cases (additional relocation types or
runtime support...).

Tested with the arm-linux-gnueabihf- and aarch64-linux-gnu- toolchains
(GCC 8.3).

Limitations:

- Clang is not supported at the moment
- Exception handling: shared libraries cannot throw, catch or propagate
exceptions. Doing so would require linking the libraries and the main
program with the shared libgcc [1] which is not straightforward due
to the many dependencies on the GNU libc. Exceptions *can* be used in
the main program however, as well as in static libraries directly
linked with the main program.
- ldelf stack unwinding does not support C++ frames so crash/panic
dumps will likely be truncated when they involve C++ code.

Link: [1] https://gcc.gnu.org/onlinedocs/gcc/Link-Options.html see "-shared-libgcc"
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, QEMUv8, HiKey960)
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf, libutee: rework support of DT_INIT_ARRAY/DT_FINI_ARRAY

Now that we have the standard function dl_iterate_phdr() in libutee, we
can use it to process the initialization and finalization arrays

ldelf, libutee: rework support of DT_INIT_ARRAY/DT_FINI_ARRAY

Now that we have the standard function dl_iterate_phdr() in libutee, we
can use it to process the initialization and finalization arrays in the
ELF files and deprecate the ad-hoc structure __init_fini_info
introduced in commit dd655cb9906c ("ldelf, ta: add support for
DT_INIT_ARRAY and DT_FINI_ARRAY") [1].
Unfortunately, removing __init_fini_info is not an option if we want to
ensure backward compatibility. This concerns only TAs which use ELF
initialization and/or finalization functions.

[1] Released in version 3.9.0.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf, libutee: add minimal Thread Local Storage support

Preparing for C++ support in TAs.

Adds enough runtime Thread Local Storage (TLS) support for the GNU C++
compilers (arm-linux-gnueabihf-g++,

ldelf, libutee: add minimal Thread Local Storage support

Preparing for C++ support in TAs.

Adds enough runtime Thread Local Storage (TLS) support for the GNU C++
compilers (arm-linux-gnueabihf-g++, aarch64-linux-gnu-g++) to work with
OP-TEE. That is:

- A Thread Control Block,
- The __tls_get_addr() and dl_iterate_phdr() functions.

Note that __tls_get_addr() is an ABI helper so it has no prototype in a
user-accessible header file. dl_iterate_phdr() however is defined in
<link.h> and may be used in a TA. The file lib/libutee/include/link.h is
borrowed from Android's Bionic [1] with minor changes (added the
required #include statement and named the function parameters). A
similar <link.h> header is provided by other C libraries such as GNU
libc, musl and FreeBSD/NetBSD/OpenBSD.

Link: [1] https://android.googlesource.com/platform/bionic/+/master/libc/include/link.h
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ta.ld.S: add .eh_frame_hdr and .eh_frame sections

Preparing for C++ support in TAs.

Adds .eh_frame_hdr and .eh_frame sections to the TA linker script.
Those may be generated by the C++ compiler

ta: ta.ld.S: add .eh_frame_hdr and .eh_frame sections

Preparing for C++ support in TAs.

Adds .eh_frame_hdr and .eh_frame sections to the TA linker script.
Those may be generated by the C++ compiler. The fragment is compied
from GCC's internal linker script (shown by -Wl,-verbose).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ta.ld.S: add .gcc_except_table section

Preparing for C++ support in TAs.

Adds a .gcc_except_table section merging the multiple entries that may
be generated by the C++ compiler. The fragment is

ta: ta.ld.S: add .gcc_except_table section

Preparing for C++ support in TAs.

Adds a .gcc_except_table section merging the multiple entries that may
be generated by the C++ compiler. The fragment is copied from GCC's
internal linker script (shown by -Wl,-verbose).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ta.ld.S: add .tdata and .tbss sections

Preparing for C++ support in TAs.

TA object file generated by a thread-enabled toolchain (such as g++
built without --disable-threads) may contain .tdata*

ta: ta.ld.S: add .tdata and .tbss sections

Preparing for C++ support in TAs.

TA object file generated by a thread-enabled toolchain (such as g++
built without --disable-threads) may contain .tdata* and .tbss*
sections even if the application is single threaded. Those are similar
to .data and .bss except that they are templates to be used by the
runtime code to set up Thread Local Storage data blocks.

This commit adds those two sections as well as related relocation
sections (.rel.tdata, .rel.tbss, .rela.tdata, .rela.tbss). The
fragments are copied from GCC's internal linker script (shown by
-Wl,-verbose). They are inserted next to .dynamic and .got because they
may all be part of a RELRO segment if the linker chooses to create one.
In practice there can be only one RELRO segment [1] so sections have to
be contiguous. Note that ldelf currently ignores RELRO.

[1] https://reviews.llvm.org/D40029

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ta.ld.S: add __exidx_start and __exidx_end

Preparing for C++ support in TAs.

__exidx_start and __exidx_end are referenced by libgcc_eh.a.

Signed-off-by: Jerome Forissier <jerome@forissier.org>

ta: ta.ld.S: add __exidx_start and __exidx_end

Preparing for C++ support in TAs.

__exidx_start and __exidx_end are referenced by libgcc_eh.a.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

symbolize.py: infer PC from (E)LR

When translating a call stack address to source file and line number,
subtract 2 to try and reflect the PC at the time the call was made or
the exception occurred.

symbolize.py: infer PC from (E)LR

When translating a call stack address to source file and line number,
subtract 2 to try and reflect the PC at the time the call was made or
the exception occurred. This makes the calls easier to follow and
corresponds to what the GDB backtrace command (bt) does. For data or
prefetch aborts it is even more important because now we report exactly
the line that caused the abort instead of showing the next one, which
could be misleading.

As a result of this fix, the extra "nop" instruction in __ta_entry() is
not needed anymore so remove it.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: export CFG_TEE_TA_LOG_LEVEL with ?= not :=

The value of CFG_TEE_TA_LOG_LEVEL used at optee_os build time is
exported to the TA dev kit ($O/export_ta_arm{32,64}/mk/conf.mk). The
purpose is to pro

ta: export CFG_TEE_TA_LOG_LEVEL with ?= not :=

The value of CFG_TEE_TA_LOG_LEVEL used at optee_os build time is
exported to the TA dev kit ($O/export_ta_arm{32,64}/mk/conf.mk). The
purpose is to provide a default value to the TA build environment,
which can easily be changed from the command line ("make
CFG_TEE_TA_LOG_LEVEL=3" for example).

However the following TA Makefile won't behave as expected:

BINARY := <somme uuid>
CFG_TEE_TA_LOG_LEVEL := 3 # Ignored!
include $(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk

This commit changes := to ?= so that ta_dev_kit.mk won't override any
value that may have been set previously in the TA Makefile or the
environment.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: fix race when generating conf.mk

This patch fixes the following error triggered by a heavily parallel build:

echo sm := ta_arm64 > .../export-ta_arm64/mk/conf.mk.tmp
/bin/bash: .../export-

build: fix race when generating conf.mk

This patch fixes the following error triggered by a heavily parallel build:

echo sm := ta_arm64 > .../export-ta_arm64/mk/conf.mk.tmp
/bin/bash: .../export-ta_arm64/mk/conf.mk.tmp: No such file or directory

Fixes: https://github.com/OP-TEE/optee_os/issues/3999
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Ross Burton <ross.burton@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mk: core: ta: Configurable Python interpreter

Build systems that manage multiple different python interpreters need
explicit control over which version of the interpreter to use.
This patch enables

mk: core: ta: Configurable Python interpreter

Build systems that manage multiple different python interpreters need
explicit control over which version of the interpreter to use.
This patch enables one to override the default interpreter with the path
to a specific one.

Signed-off-by: Dick Olsson <hi@senzilla.io>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ta: pkcs11: persistent object support

A persistent object (token object in PKCS#11 spec) is stored as
a binary blob of attribute list identified by a UUID.

The persistent database stores the UUIDs

ta: pkcs11: persistent object support

A persistent object (token object in PKCS#11 spec) is stored as
a binary blob of attribute list identified by a UUID.

The persistent database stores the UUIDs of the persistent objects
of the token.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: support command to import and destroy object

Implement commands PKCS11_CMD_CREATE_OBJECT and PKCS11_CMD_DESTROY_OBJECT.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-

ta: pkcs11: support command to import and destroy object

Implement commands PKCS11_CMD_CREATE_OBJECT and PKCS11_CMD_DESTROY_OBJECT.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: attribute helper functions

* Helper functions for object attributes management.
* Helper functions to safely parse client attributes template
to create a list of attributes for a objec

ta: pkcs11: attribute helper functions

* Helper functions for object attributes management.
* Helper functions to safely parse client attributes template
to create a list of attributes for a object in the PKCS11 ta.
* Helper functions for assigning or checking object attributes
according to PKCS#11 specification.
* Add id-to-string conversion for attribute/class/key types.
* Helper functions to analyze object attributes.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: helper for serial arguments with allocation

Helper functions for serial arguments that expect memory allocation.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Eti

ta: pkcs11: helper for serial arguments with allocation

Helper functions for serial arguments that expect memory allocation.

Reviewed-by: Ricardo Salveti <ricardo@foundries.io>
Co-developed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...