TA dev kit: expose CFG_TA_VERSION build option

Allow to configure version of a TA via CFG_TA_VERSION as TA compile
time option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome

TA dev kit: expose CFG_TA_VERSION build option

Allow to configure version of a TA via CFG_TA_VERSION as TA compile
time option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove script/llvm-objcopy-wrapper

The llvm-objcopy-wrapper script was introduced in commit 98d863a5c0b2
("Experimental Clang support") because llvm-objcopy would not support
some options needed to

Remove script/llvm-objcopy-wrapper

The llvm-objcopy-wrapper script was introduced in commit 98d863a5c0b2
("Experimental Clang support") because llvm-objcopy would not support
some options needed to produce the final TEE binaries from tee.elf or
cause errors when building them. However, since commit 1a9edabc0ed4
("core: link.mk: use gen_tee_bin.py"), objcopy is not used for this
purpose anymore. Thus we can safely use llvm-objcopy.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

TA dev kit: add support for TA encryption

Add CFG_ENCRYPT_TA as TA build time configuration option to enable
encryption of TA using encryption key provided via TA_ENC_KEY build
time option. The defa

TA dev kit: add support for TA encryption

Add CFG_ENCRYPT_TA as TA build time configuration option to enable
encryption of TA using encryption key provided via TA_ENC_KEY build
time option. The default value of TA_ENC_KEY is derived from 16 zero
bytes default hardware unique key.

Also rename scripts/sign.py to scripts/sign_encrypt.py to reflect
optional encryption support along with signing of TAs.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker script. The
address and size of the buffer is passed to the TEE core via a call to
the gprof PTA. After this call, the TEE core accesses the buffer
periodically, such as when the TA is interrupted by a timer interrupt.

Commit ef305e54eac8 ("libutee: allocate temp secmem for invoke")
modified the way that private TA memory is mapped in TA to TA
invocations, so that memory is mapped only for the duration of the
call. After this point, the memory is unmapped so the gprof sample
buffer becomes inaccessible, resulting in a crash:

E/TC:0 0 Core data-abort at address 0x121356 (translation fault)
E/TC:0 0 fsr 0x00000007 ttbr0 0x0e19206a ttbr1 0x0e18806a cidr 0x2
E/TC:0 0 cpu #0 cpsr 0x800001f2
E/TC:0 0 r0 0x00000000 r4 0x00000000 r8 0x00000000 r12 0x0017bb4b
E/TC:0 0 r1 0x000021ab r5 0x00000000 r9 0x00000000 sp 0x0e1928f0
E/TC:0 0 r2 0x0011d000 r6 0x00000000 r10 0x00000000 lr 0x0e112763
E/TC:0 0 r3 0x00121356 r7 0x0e1928f0 r11 0x00000000 pc 0x0e12958e
E/TC:0 0 Core data-abort at address 0x121356 .debug_info+1184598 (translation fault)
E/TC:0 0 Call stack:
E/TC:0 0 0x0e12958e tee_ta_gprof_sample_pc at optee_os/core/kernel/tee_ta_manager.c:897

The solution is to allocate and map the sample buffer explicitly in
user space when profiling is initialized, and at the same time get rid
of the reserved area in the TA linker script. The TEE core also needs
to check that the sample buffer is valid before writing to it,
otherwise a malicious TA could crash the core by unmapping that memory.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are in

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are invoked by user TAs into the TEE core.

And after this patch ftrace will cover both TA and TEE core code. So lets
rename config option from CFG_TA_FTRACE_SUPPORT to CFG_FTRACE_SUPPORT.

It is optional to enable syscall trace via CFG_SYSCALL_FTRACE=y config
option in addition to CFG_FTRACE_SUPPORT=y config option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

TA dev kit: Clang support

Updates ta/mk/ta_dev_kit.mk and other makefiles so that the COMPILER
variable can be used when building TAs: make COMPILER=clang ...

Signed-off-by: Jerome Forissier <jerom

TA dev kit: Clang support

Updates ta/mk/ta_dev_kit.mk and other makefiles so that the COMPILER
variable can be used when building TAs: make COMPILER=clang ...

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: do not use -Wp with the preprocessor and use -o instead of a redirection

This patch cleans up the command line where we use the C preprocessor
to better reflect the documented usage in the GC

build: do not use -Wp with the preprocessor and use -o instead of a redirection

This patch cleans up the command line where we use the C preprocessor
to better reflect the documented usage in the GCC man page, thus
preparing for Clang support.

1. When invoking the C preprocessor, there is no need for -Wp to pass
arguments, so remove it.

2. -MD is not supposed to take a file name when passed to cpp. The
dependency output file name is overridden with -MF.

3. Lastly, it is better to use -o to specify the output file instead
of redirecting standard output, because if an error occurs during
preprocessing we don't want the output file to be created.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Remove ASM define for assembly files

Removes the ASM define for assembly files now that they rely on the
predefined macro __ASSEMBLER__ instead.

Reviewed-by: Jerome Forissier <jerome.forissier@lina

Remove ASM define for assembly files

Removes the ASM define for assembly files now that they rely on the
predefined macro __ASSEMBLER__ instead.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: add headers for user-space to access sysregs

User space may require to access system registers like generic timer
registers in case function tracing is enabled etc. So provide headers
for u

libutee: add headers for user-space to access sysregs

User space may require to access system registers like generic timer
registers in case function tracing is enabled etc. So provide headers
for user space to access sysregs.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Support offline signing of TAs.

Add generate-digest and stitch-ta support to script sign.py. One can
generate a digest for the loadable TA file, sign it offline and later
stitch the generated signat

Support offline signing of TAs.

Add generate-digest and stitch-ta support to script sign.py. One can
generate a digest for the loadable TA file, sign it offline and later
stitch the generated signature to the loadable TA binary file.

For this purpose sign.py gets an extra initial command argument to select
between sign/digest/stitch operations. If no command is provided, `sign`
is assumed, preserving previous usage.

Signed-off-by: Markus S. Wamser <markus.wamser@mixed-mode.de>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

In-tree TAs: avoid recompiling when a library changes

When a library is changed (libutee.a, libutils.a, etc.) the in-tree TAs
are re-built from scratch. We can easily avoid recompilation and only
re

In-tree TAs: avoid recompiling when a library changes

When a library is changed (libutee.a, libutils.a, etc.) the in-tree TAs
are re-built from scratch. We can easily avoid recompilation and only
re-link instead.

For example, without this patch:
$ make -s -j10
$ touch out/arm-plat-vexpress/export-ta_arm32/lib/libutee.a
$ make out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/conf.cmake
CC out/arm-plat-vexpress/ta/avb/entry.o
CC out/arm-plat-vexpress/ta/avb/user_ta_header.o
AS out/arm-plat-vexpress/ta/avb/ta_entry_a32.o
LD out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf

With this patch applied:
$ make -s -j10
$ touch out/arm-plat-vexpress/export-ta_arm32/lib/libutee.a
$ make out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
LD out/arm-plat-vexpress/ta/avb/023f8f1a-292a-432b-8fc4-de8471358067.elf

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive
asm(".cantunwind");
^
Fix this by turning __ta_entry() into an assembler wrapper.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ta.ld.S: move .dynamic section next to .got

Changes the TA linker script so that the .dynamic section is adjacent
to the .got section. This prepares for using the Clang compiler (more
precisely:

ta: ta.ld.S: move .dynamic section next to .got

Changes the TA linker script so that the .dynamic section is adjacent
to the .got section. This prepares for using the Clang compiler (more
precisely: the LLVM linker, ld.lld).

Contrary to GCC, Clang enables the "RELRO" feature (RELocations Read-
Only) by default. In a nutshell: RELRO causes the linker to emit an
additional segment called RELRO, which tells the program loader that
a part of the binary may be turned to read-only mode once the
relocations are done. The goal is to increase protection against
arbitrary code execution attacks. The sections that are concerned are
.got and .dynamic, among others. Since there is only one RELRO segment,
the sections that are supposed to be covered have to be contiguous. If
they are not (which is currently the case in ta.ld.S), ld.lld shows an
error:

ld.lld: error: section: .dynamic is not contiguous with other relro sections

Therefore, move .dynamic next to .got so that all the RELRO-eligible
sections are contiguous.

Note: another option to fix this issue is to pass '-z norelro' to the
linker, but that would obviously prevent future support of RELRO in the
TA loader.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: Enable support for 32 bit apps

By default 32 bit trusted applications are compiled in thumb mode but
thumb mode doesn't support function graph tracing due to missing frame
pointer support re

ftrace: Enable support for 32 bit apps

By default 32 bit trusted applications are compiled in thumb mode but
thumb mode doesn't support function graph tracing due to missing frame
pointer support required to trace function call chain. So rather compile
trusted applications in ARM mode in case function tracing is enabled.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

ta: export CFG_TA_MCOUNT in dev kit config

Exports CFG_TA_MCOUNT in TA dev kit configuration.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wikland

ta: export CFG_TA_MCOUNT in dev kit config

Exports CFG_TA_MCOUNT in TA dev kit configuration.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: load TAs using ldelf

Uses ldelf to load and relocate TAs instead of parsing and loading the
ELFs in TEE Core. TA abort dumps, ASLR and ftrace are temporarily
removed or disabled to be re-enabl

core: load TAs using ldelf

Uses ldelf to load and relocate TAs instead of parsing and loading the
ELFs in TEE Core. TA abort dumps, ASLR and ftrace are temporarily
removed or disabled to be re-enabled in following commits.

Loading dynamically linked TAs are from now on always supported and
cannot be disabled via configuration flags. CFG_TA_DYNLINK is also
removed as a configuration option.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: prevent unwinding of __ta_entry()

Since commit eeb866c431db ("Add TA entry point function: __ta_entry()"),
__ta_entry() is the first function in the user space call stack, not
__utee_entry().

arm32: prevent unwinding of __ta_entry()

Since commit eeb866c431db ("Add TA entry point function: __ta_entry()"),
__ta_entry() is the first function in the user space call stack, not
__utee_entry(). Therefore, the asm(".cantunwind") declaration should be
moved from __utee_entry() to __ta_entry().

When utee_return() was moved from __utee_entry() to __ta_entry() by
commit fde3a7f212f8 ("Remove redundant __noreturn from __utee_entry()"),
it caused a regression in xtest 1010.3. The stack unwinding would enter
an infinite loop as follows:

E/TC:? 0 User TA prefetch-abort at address 0x0 (translation fault)
E/TC:? 0 fsr 0x00000005 ttbr0 0x3f07906a ttbr1 0x3f06c06a cidr 0x2
E/TC:? 0 cpu #7 cpsr 0x80000110
E/TC:? 0 r0 0x00000001 r4 0x00161448 r8 0x00161438 r12 0x00152f80
E/TC:? 0 r1 0x00000002 r5 0x00152f40 r9 0x00152f30 sp 0x00152f10
E/TC:? 0 r2 0x00000000 r6 0x00152f80 r10 0x0000000a lr 0x0015498d
E/TC:? 0 r3 0x00152f14 r7 0x00161458 r11 0x00245420 pc 0x00000000
E/TC:? 0 Status of TA 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b (0x3f069c30) (active)
E/TC:? 0 arch: arm load address: 0x00153000 ctx-idr: 2
E/TC:? 0 stack: 0x00150000 12288
E/TC:? 0 region 0: va 0x00100000 pa 0x3f000000 size 0x002000 flags ---R-X
E/TC:? 0 region 1: va 0x00150000 pa 0x3f110000 size 0x003000 flags rw-RW-
E/TC:? 0 region 2: va 0x00153000 pa 0x3f113000 size 0x00e000 flags r-xR-- [0] .ta_head .text .plt .rodata .ARM.extab .ARM.extab.text.unlikely .ARM.extab.text.__aeabi_ldivmod .ARM.extab.text.__aeabi_uldivmod .ARM.extab.text.utee_panic .ARM.exidx .dynsym .dynstr .hash
E/TC:? 0 region 3: va 0x00161000 pa 0x3f121000 size 0x0e5000 flags rw-RW- [0] .got .rel.got .rel.plt .dynamic .data .bss .rel.dyn
E/TC:? 0 region 4: va 0x00246000 pa 0x3f101000 size 0x001000 flags r-xR-- [1] .hash .dynsym .dynstr .rel.plt .plt .text .ARM.exidx
E/TC:? 0 region 5: va 0x00247000 pa 0x3f102000 size 0x001000 flags rw-RW- [1] .dynamic .got
E/TC:? 0 region 6: va 0x00248000 pa 0x3f100000 size 0x001000 flags r-----
E/TC:? 0 [0] 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b @ 0x00153000 (optee_test/out/ta/os_test/5b9e0e40-2636-11e1-ad9e-0002a5d5c51b.elf)
E/TC:? 0 [1] ffd2bded-ab7d-4988-95ee-e4962fff7154 @ 0x00246000 (optee_test/out/ta/os_test_lib/libos_test.so)
E/TC:? 0 Call stack:
E/TC:? 0 0x00000000 ???
E/TC:? 0 0x0015c629 __ta_entry at optee_os/out/arm/export-ta_arm32/src/user_ta_header.c:41
E/TC:? 0 0x0015c62d tahead_get_trace_level at optee_os/out/arm/export-ta_arm32/src/user_ta_header.c:117
E/TC:? 0 0x0015c62d tahead_get_trace_level at optee_os/out/arm/export-ta_arm32/src/user_ta_header.c:117
...

Moving the .cantunwind directive fixes the issue.

Fixes: fde3a7f212f8 ("Remove redundant __noreturn from __utee_entry()")
Fixes: eeb866c431db ("Add TA entry point function: __ta_entry()")
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

libutee: arm64: Add support for function tracing of user TAs

Function tracing (ftrace) is a useful debugging technique to dump
function call graph for in-depth analysis of program execution and also

libutee: arm64: Add support for function tracing of user TAs

Function tracing (ftrace) is a useful debugging technique to dump
function call graph for in-depth analysis of program execution and also
to get useful information in case of any program abort.

In case of TA, this function graph information is dumped in a buffer
kept in .bss section of corresponding instrumented TA. So this buffer
can be dumped to normal world in case TA session closes or in case of
any abort. Also size of this ftrace buffer is configurable per TA via
following config option during TA compilation:

CFG_FTRACE_BUF_SIZE=2048

Function tracing is completely optional debugging feature which could
be enabled via command line config option CFG_TA_FTRACE_SUPPORT=y.

Along with this user needs to add cflag: "-pg" to the files for whom
function graph is to be generated. Typically for the whole TA, it should
be compiled with CFG_TA_MCOUNT=y.

And in case user wants to set "-pg" for particular file, following should
go in corresponding sub.mk:

cflags-<file-name>-y+=-pg

Also, to generate function graph for user mode libraries enable
CFG_ULIBS_MCOUNT=y which will set "-pg" for all library files.

Currently this patch adds support for function tracing of 64-bit
TAs only.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)

show more ...

TA dev kit: always link shared libraries against OP-TEE libraries

If a TA shared library is created, and needs to call OP-TEE functions,
it needs to link against the TEE libraries (libutee, libutils

TA dev kit: always link shared libraries against OP-TEE libraries

If a TA shared library is created, and needs to call OP-TEE functions,
it needs to link against the TEE libraries (libutee, libutils etc.) in
a similar way to TAs.

This patch adds the proper flags.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Link user libraries with 4K page size

Set the linker flag max-page-size to 4K when linking shared user
libraries. This is used to avoid unnecessary large holes in the virtual
memory map between segm

Link user libraries with 4K page size

Set the linker flag max-page-size to 4K when linking shared user
libraries. This is used to avoid unnecessary large holes in the virtual
memory map between segments with different attributes.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove redundant __noreturn from __utee_entry()

As __ta_entry() acts as function entry point, it makes sense to
logically return from this api only via utee_return(). So remove
redundant __noreturn

Remove redundant __noreturn from __utee_entry()

As __ta_entry() acts as function entry point, it makes sense to
logically return from this api only via utee_return(). So remove
redundant __noreturn from __utee_entry().

Fixes: eeb866c431db ("Add TA entry point function: __ta_entry()")
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add TA entry point function: __ta_entry()

Symbol __utee_entry may be undefined in a TA in case libutee is
built as a shared library (CFG_ULIBS_SHARED=y). Add a wrapper function
to avoid this issue.

Add TA entry point function: __ta_entry()

Symbol __utee_entry may be undefined in a TA in case libutee is
built as a shared library (CFG_ULIBS_SHARED=y). Add a wrapper function
to avoid this issue.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Replace ta_head.entry with elf entry

Prior to this patch the entry function of the TA was stored in ta_head
which is located in a read-only section of the TA. This results in the
linker emitting a r

Replace ta_head.entry with elf entry

Prior to this patch the entry function of the TA was stored in ta_head
which is located in a read-only section of the TA. This results in the
linker emitting a relocation modifying a read-only section. This is a
problem if the read-only section is mapped read-only while relocations
are performed. To avoid this problematic relocation the ta_head.entry
is removed and the ELF entry point is used instead.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: arm: ta.ld.S: move relocation segments

Move relocation segments into the read/write section to avoid
modifications of the read only compared to what is in the ELF.
This is needed for sharing of

ta: arm: ta.ld.S: move relocation segments

Move relocation segments into the read/write section to avoid
modifications of the read only compared to what is in the ELF.
This is needed for sharing of read only sections of TAs.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...