core: Add support to access a TPM event log in secure memory.

Support for OPTEE to be able to receive a TPM event log through
a DTB so it can forward it to a TA (such as a TPM service)
in order to e

core: Add support to access a TPM event log in secure memory.

Support for OPTEE to be able to receive a TPM event log through
a DTB so it can forward it to a TA (such as a TPM service)
in order to extend the measurements.

CFG_CORE_TPM_EVENT_LOG enables this feature.
CFG_TPM_LOG_BASE_ADDR hardcodes the phys address of the event log
in case CFG_DT is not set.
CFG_TPM_MAX_LOG_SIZE harcodes the size of the event log in case
CFG_DT is not set.

When this feature is enabled, the PTA_SYSTEM_GET_TPM_EVENT_LOG
command is available to any TA.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: set TA version property mandated by GPD

Set version property "gpd.ta.version" of the TA to the version
information set in TA API through macros PKCS11_TA_VERSION_MAJOR,
PKCS11_TA_VERSION

ta: pkcs11: set TA version property mandated by GPD

Set version property "gpd.ta.version" of the TA to the version
information set in TA API through macros PKCS11_TA_VERSION_MAJOR,
PKCS11_TA_VERSION_MINOR and PKCS11_TA_VERSION_PATCH.

This change also adds a short description in "gpd.ta.description".

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

ftrace: define CFG_FTRACE_BUF_SIZE in mk/config.mk

The main configuration file is a better place to define the size of the
ftrace buffer than the TA linker script.

Signed-off-by: Jerome Forissier <

ftrace: define CFG_FTRACE_BUF_SIZE in mk/config.mk

The main configuration file is a better place to define the size of the
ftrace buffer than the TA linker script.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove libmpa in favor of libmbedtls

We currently have two "big numbers" library, Mbed TLS and MPA. Both can
be used by libutee to implement the TEE Internal Core API Arithmetical
functions, and by

Remove libmpa in favor of libmbedtls

We currently have two "big numbers" library, Mbed TLS and MPA. Both can
be used by libutee to implement the TEE Internal Core API Arithmetical
functions, and by the TEE core or pseudo-TAs. This situation is
reflected by two configuration variables allowing to choose between
libmbedtls and libmpa:

- CFG_TA_MBEDTLS_MPI (default y) configures libutee,
- CFG_CORE_MBEDTLS_MPI (default y) configures the TEE core/PTAs.

In addition there is CFG_TA_MBEDTLS (default y, mandatory when
CFG_TA_MBEDTLS_MPI is y) to build libmbedtls and install it into the
SDK for direct use by TAs (libmbedtls also has function to deal with
certificates for instance).

MBed TLS has been supported and used by default for just over a year;
and we have recently found an issue with the MPA implementation of the
integer multiplication with modulus (mpa_mulmod()) [1] [2]. Therefore,
now is a good time to remove libmpa and use libmbedtls instead.

Link: [1] https://github.com/OP-TEE/optee_os/pull/3541#issuecomment-577592381
Link: [2] https://github.com/OP-TEE/optee_test/pull/389
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: add debug trace at command entry/exit

Add debug traces at entry and exit of the command invocation handler
of the TA. Prints TA command as a readable string thanks to ck_helpers.c

Signe

ta: pkcs11: add debug trace at command entry/exit

Add debug traces at entry and exit of the command invocation handler
of the TA. Prints TA command as a readable string thanks to ck_helpers.c

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: string debug trace for ta command ids

ck_helper.c/.h provide will helper functions for IDs. This change
starts with providing a string ID for a numerical command ID.

Matching IDs a stri

ta: pkcs11: string debug trace for ta command ids

ck_helper.c/.h provide will helper functions for IDs. This change
starts with providing a string ID for a numerical command ID.

Matching IDs a strings are stored in a constant array. Macros
PKCS11_ID() ease definition of ID/string conversion arrays content.
Function id2str() finds the string for a IDs possibly skip a given
prefix, i.e. printing "ENCRYPT" instead of "PKCS11_CKFM_ENCRYPT".

TA command IDs are the first introduced ID/string conversion util.
Function id2str_ta_cmd() return string "PKCS11_CMD_..." for a known
command ID.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: invocation command PKCS11

Introduce a first invocation command for the TA: PKCS11_CMD_PING
can be used the check TA presence and possibly retrieve TA version
information if client provid

ta: pkcs11: invocation command PKCS11

Introduce a first invocation command for the TA: PKCS11_CMD_PING
can be used the check TA presence and possibly retrieve TA version
information if client provides an output buffer.

Add helpers to trace command and parameters configuration.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Markus S. Wamser <markus.wamser@mixed-mode.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: specific IDs in TA API

Define PKCS11_UNAVAILABLE_INFORMATION to reflect the PKCS#11 specific
IDCK_UNAVAILABLE_INFORMATION. It is used as PKCS11_UNDEFINED_ID for
invalid or not applicable

ta: pkcs11: specific IDs in TA API

Define PKCS11_UNAVAILABLE_INFORMATION to reflect the PKCS#11 specific
IDCK_UNAVAILABLE_INFORMATION. It is used as PKCS11_UNDEFINED_ID for
invalid or not applicable IDs.

Define PKCS11_TRUE/PKCS11_FALSE for boolean attributes.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Markus S. Wamser <markus.wamser@mixed-mode.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: base for PKCS#11 services and TA API

PKCS11 TA aims at providing PKCS#11 compliant services through a
trusted application operating as a secure service provider. This
is the first step f

ta: pkcs11: base for PKCS#11 services and TA API

PKCS11 TA aims at providing PKCS#11 compliant services through a
trusted application operating as a secure service provider. This
is the first step for the PKCS#11 TA that introduces the TA skeleton
source file tree.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Markus S. Wamser <markus.wamser@mixed-mode.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

TA dev kit: expose CFG_TA_VERSION build option

Allow to configure version of a TA via CFG_TA_VERSION as TA compile
time option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome

TA dev kit: expose CFG_TA_VERSION build option

Allow to configure version of a TA via CFG_TA_VERSION as TA compile
time option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove script/llvm-objcopy-wrapper

The llvm-objcopy-wrapper script was introduced in commit 98d863a5c0b2
("Experimental Clang support") because llvm-objcopy would not support
some options needed to

Remove script/llvm-objcopy-wrapper

The llvm-objcopy-wrapper script was introduced in commit 98d863a5c0b2
("Experimental Clang support") because llvm-objcopy would not support
some options needed to produce the final TEE binaries from tee.elf or
cause errors when building them. However, since commit 1a9edabc0ed4
("core: link.mk: use gen_tee_bin.py"), objcopy is not used for this
purpose anymore. Thus we can safely use llvm-objcopy.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

TA dev kit: add support for TA encryption

Add CFG_ENCRYPT_TA as TA build time configuration option to enable
encryption of TA using encryption key provided via TA_ENC_KEY build
time option. The defa

TA dev kit: add support for TA encryption

Add CFG_ENCRYPT_TA as TA build time configuration option to enable
encryption of TA using encryption key provided via TA_ENC_KEY build
time option. The default value of TA_ENC_KEY is derived from 16 zero
bytes default hardware unique key.

Also rename scripts/sign.py to scripts/sign_encrypt.py to reflect
optional encryption support along with signing of TAs.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker script. The
address and size of the buffer is passed to the TEE core via a call to
the gprof PTA. After this call, the TEE core accesses the buffer
periodically, such as when the TA is interrupted by a timer interrupt.

Commit ef305e54eac8 ("libutee: allocate temp secmem for invoke")
modified the way that private TA memory is mapped in TA to TA
invocations, so that memory is mapped only for the duration of the
call. After this point, the memory is unmapped so the gprof sample
buffer becomes inaccessible, resulting in a crash:

E/TC:0 0 Core data-abort at address 0x121356 (translation fault)
E/TC:0 0 fsr 0x00000007 ttbr0 0x0e19206a ttbr1 0x0e18806a cidr 0x2
E/TC:0 0 cpu #0 cpsr 0x800001f2
E/TC:0 0 r0 0x00000000 r4 0x00000000 r8 0x00000000 r12 0x0017bb4b
E/TC:0 0 r1 0x000021ab r5 0x00000000 r9 0x00000000 sp 0x0e1928f0
E/TC:0 0 r2 0x0011d000 r6 0x00000000 r10 0x00000000 lr 0x0e112763
E/TC:0 0 r3 0x00121356 r7 0x0e1928f0 r11 0x00000000 pc 0x0e12958e
E/TC:0 0 Core data-abort at address 0x121356 .debug_info+1184598 (translation fault)
E/TC:0 0 Call stack:
E/TC:0 0 0x0e12958e tee_ta_gprof_sample_pc at optee_os/core/kernel/tee_ta_manager.c:897

The solution is to allocate and map the sample buffer explicitly in
user space when profiling is initialized, and at the same time get rid
of the reserved area in the TA linker script. The TEE core also needs
to check that the sample buffer is valid before writing to it,
otherwise a malicious TA could crash the core by unmapping that memory.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are in

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are invoked by user TAs into the TEE core.

And after this patch ftrace will cover both TA and TEE core code. So lets
rename config option from CFG_TA_FTRACE_SUPPORT to CFG_FTRACE_SUPPORT.

It is optional to enable syscall trace via CFG_SYSCALL_FTRACE=y config
option in addition to CFG_FTRACE_SUPPORT=y config option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

TA dev kit: Clang support

Updates ta/mk/ta_dev_kit.mk and other makefiles so that the COMPILER
variable can be used when building TAs: make COMPILER=clang ...

Signed-off-by: Jerome Forissier <jerom

TA dev kit: Clang support

Updates ta/mk/ta_dev_kit.mk and other makefiles so that the COMPILER
variable can be used when building TAs: make COMPILER=clang ...

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: do not use -Wp with the preprocessor and use -o instead of a redirection

This patch cleans up the command line where we use the C preprocessor
to better reflect the documented usage in the GC

build: do not use -Wp with the preprocessor and use -o instead of a redirection

This patch cleans up the command line where we use the C preprocessor
to better reflect the documented usage in the GCC man page, thus
preparing for Clang support.

1. When invoking the C preprocessor, there is no need for -Wp to pass
arguments, so remove it.

2. -MD is not supposed to take a file name when passed to cpp. The
dependency output file name is overridden with -MF.

3. Lastly, it is better to use -o to specify the output file instead
of redirecting standard output, because if an error occurs during
preprocessing we don't want the output file to be created.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Remove ASM define for assembly files

Removes the ASM define for assembly files now that they rely on the
predefined macro __ASSEMBLER__ instead.

Reviewed-by: Jerome Forissier <jerome.forissier@lina

Remove ASM define for assembly files

Removes the ASM define for assembly files now that they rely on the
predefined macro __ASSEMBLER__ instead.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: add headers for user-space to access sysregs

User space may require to access system registers like generic timer
registers in case function tracing is enabled etc. So provide headers
for u

libutee: add headers for user-space to access sysregs

User space may require to access system registers like generic timer
registers in case function tracing is enabled etc. So provide headers
for user space to access sysregs.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Support offline signing of TAs.

Add generate-digest and stitch-ta support to script sign.py. One can
generate a digest for the loadable TA file, sign it offline and later
stitch the generated signat

Support offline signing of TAs.

Add generate-digest and stitch-ta support to script sign.py. One can
generate a digest for the loadable TA file, sign it offline and later
stitch the generated signature to the loadable TA binary file.

For this purpose sign.py gets an extra initial command argument to select
between sign/digest/stitch operations. If no command is provided, `sign`
is assumed, preserving previous usage.

Signed-off-by: Markus S. Wamser <markus.wamser@mixed-mode.de>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

In-tree TAs: avoid recompiling when a library changes

When a library is changed (libutee.a, libutils.a, etc.) the in-tree TAs
are re-built from scratch. We can easily avoid recompilation and only
re

In-tree TAs: avoid recompiling when a library changes

When a library is changed (libutee.a, libutils.a, etc.) the in-tree TAs
are re-built from scratch. We can easily avoid recompilation and only
re-link instead.

For example, without this patch:
$ make -s -j10
$ touch out/arm-plat-vexpress/export-ta_arm32/lib/libutee.a
$ make out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/conf.cmake
CC out/arm-plat-vexpress/ta/avb/entry.o
CC out/arm-plat-vexpress/ta/avb/user_ta_header.o
AS out/arm-plat-vexpress/ta/avb/ta_entry_a32.o
LD out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf

With this patch applied:
$ make -s -j10
$ touch out/arm-plat-vexpress/export-ta_arm32/lib/libutee.a
$ make out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
LD out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive
asm(".cantunwind");
^
Fix this by turning __ta_entry() into an assembler wrapper.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ta.ld.S: move .dynamic section next to .got

Changes the TA linker script so that the .dynamic section is adjacent
to the .got section. This prepares for using the Clang compiler (more
precisely:

ta: ta.ld.S: move .dynamic section next to .got

Changes the TA linker script so that the .dynamic section is adjacent
to the .got section. This prepares for using the Clang compiler (more
precisely: the LLVM linker, ld.lld).

Contrary to GCC, Clang enables the "RELRO" feature (RELocations Read-
Only) by default. In a nutshell: RELRO causes the linker to emit an
additional segment called RELRO, which tells the program loader that
a part of the binary may be turned to read-only mode once the
relocations are done. The goal is to increase protection against
arbitrary code execution attacks. The sections that are concerned are
.got and .dynamic, among others. Since there is only one RELRO segment,
the sections that are supposed to be covered have to be contiguous. If
they are not (which is currently the case in ta.ld.S), ld.lld shows an
error:

ld.lld: error: section: .dynamic is not contiguous with other relro sections

Therefore, move .dynamic next to .got so that all the RELRO-eligible
sections are contiguous.

Note: another option to fix this issue is to pass '-z norelro' to the
linker, but that would obviously prevent future support of RELRO in the
TA loader.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: Enable support for 32 bit apps

By default 32 bit trusted applications are compiled in thumb mode but
thumb mode doesn't support function graph tracing due to missing frame
pointer support re

ftrace: Enable support for 32 bit apps

By default 32 bit trusted applications are compiled in thumb mode but
thumb mode doesn't support function graph tracing due to missing frame
pointer support required to trace function call chain. So rather compile
trusted applications in ARM mode in case function tracing is enabled.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

ta: export CFG_TA_MCOUNT in dev kit config

Exports CFG_TA_MCOUNT in TA dev kit configuration.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wikland

ta: export CFG_TA_MCOUNT in dev kit config

Exports CFG_TA_MCOUNT in TA dev kit configuration.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...