JJérôme Forissiercore: sp: Allow to embed binary SPs to OP-TEE binary
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
ftrace: Add support for syscall function tracer This patch adds support for syscall tracing in TEE core. It complements existing ftrace support for user TAs via adding trace for syscalls that are invoked by user TAs into the TEE core. And after this patch ftrace will cover both TA and TEE core code. So lets rename config option from CFG_TA_FTRACE_SUPPORT to CFG_FTRACE_SUPPORT. It is optional to enable syscall trace via CFG_SYSCALL_FTRACE=y config option in addition to CFG_FTRACE_SUPPORT=y config option. Signed-off-by: Sumit Garg <sumit.garg@linaro.org> Reviewed-by: Jerome Forissier <jerome@forissier.org> | 6 年前 | |
scripts: use python's hex() in ta_bin_to_c.py - Python has a built in function to turn a byte into its respective hex value that can be used instead of string formatting the values directly. - Using the built in function instead of the previous string formatting method fixed an issue where bytes were failing to be written when we used an archaic yocto bsp from broadcom. - The built in function also has the benefit of being easier to read and understand. Signed-off-by: Dhananjay Phadke <dphadke@linux.microsoft.com> Signed-off-by: Andrew Mustea <andrew.mustea@microsoft.com> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org> | 4 年前 | |
scripts: checkpatch: rework and add examples to help message - See https://git-scm.com/book/en/v2/Git-Tools-Revision-Selection for more info about Git Revision Selections. Signed-off-by: Andrew Mustea <andrew.mustea@microsoft.com> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> | 3 年前 | |
core: riscv: define RISC-V instruction set architecture in encoding.h Define standard RISC-V instruction opcodes, control and status registers. This file is auto-generated from riscv-opcodes and it is subject of regular updates. Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> Acked-by: Jerome Forissier <jerome.forissier@linaro.org> | 3 年前 | |
scripts: convert remainging scripts to python3 Convert the remaining scripts to python3. Mostly done with 2to3 and manual adjustements to the code afterwards. Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de> Acked-by: Jens Wiklander <jens.wiklander@linaro.org> Acked-by: Jerome Forissier <jerome@forissier.org> Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, QEMUv8) | 6 年前 | |
scripts/gen_ldelf_hex.py: do not use f-strings f-strings were introduced in Python 3.6 [1] and will therefore cause an error with prior versions: | File "scripts/gen_ldelf_hex.py", line 68 | print(f'RO load segment found after RW one(s) (m={n})') | ^ | SyntaxError: invalid syntax For better compatibility use .format() instead. Link: [1] https://docs.python.org/3/whatsnew/3.6.html#pep-498-formatted-string-literals Fixes: c706c2449b50 ("scripts/gen_ldelf_hex.py: relax rules for PT_LOAD segments") Signed-off-by: Jerome Forissier <jerome@forissier.org> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> | 6 年前 | |
core: load stmm via secure partition Secure variable storage for EFI variables is critical for enabling and protecting UEFI Secure Boot. Unfortunately due to the fact that SPD and SPM are mutually exclusive, we can't run StMM from EDK2 and OP-TEE. An advantage of doing so is that different firmware implementations can leverage EDK2's StandAloneMM and in cooperation with OP-TEE RPMB APIs can store UEFI variables in a secure storage. This makes the variable storage quite generic in any device with an RPMB partition. Using a well debugged application is preferable over rewriting the whole application as a TA. Another advantage is that this inherits the Fault Tolerant Writes (FTW) functionality built-in on StMM to protect variables against corruptions during writing. Considering the FFA changes of the future Arm architectures using an SP that includes everything seems like a better choice at the moment. The 'SPM emulation' currently added into OP-TEE only supports a single SP to be launched. This means that the StMM embedded application has the RPMB driver built in at the moment. In the future we can add code (evolving FFA) to launch multiple SPs. So the StMM variable handling can be decoupled from the RPMB driver, which will reside in a different SP. So let's add a user mode secure partition context and support loading "Standalone MM" of EDK2 into it. A separate syscall handling is added to serve as different kind of ABI and syscall IDs. The secure partition has a TA like interface towards normal world, but requests are routed into the StMM partition instead. CFG_STMM_PATH is assigned the path of BL32_AP_MM.fd, for instance: CFG_STMM_PATH=...Build/QemuVirtMmStandalone/DEBUG_GCC5/FV/BL32_AP_MM.fd Since this is quite tricky to compile and test you can use this [1]. Just clone the repo and run ./build.sh. The script will pick up edk2, edk2-platforms, op-tee, atf and U-boot and compile all the necessary binaries for QEMU. A patch (awful hack) has been added to U-boot to allow RPMB emulation through it's supplicant, since QEMU RPMB emulation is not yet available. After compiling and launching QEMU the usual U-boot commands for EFI variable management will store the variables on an RPMB device. [1] https://git.linaro.org/people/ilias.apalodimas/efi_optee_variables.git/ Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> Co-developed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Co-developed-by: Pipat Methavanitpong <pipat1010@gmail.com> Signed-off-by: Pipat Methavanitpong <pipat1010@gmail.com> Co-developed-by: Miklos Balint <Miklos.Balint@arm.com> Signed-off-by: Miklos Balint <Miklos.Balint@arm.com> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> | 5 年前 | |
scripts/gen_tee_bin.py: inlude .ctors in included sections Includes the section .ctors in sections included in the pager binary. This fixes a problem where the constructor function pointers are all zeroes. Constructors are normally not used by OP-TEE, but with CFG_CORE_SANITIZE_KADDRESS=y it's used to initialize access to global variables. Acked-by: Jerome Forissier <jerome.forissier@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> | 4 年前 | |
get_maintainer.py: add OP-TEE mailing list(s) to --release-to The release annoucements should be sent to the general OP-TEE mailing list(s), in addition to the maintainers and reviewers. Add the needed bits to extract this information. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Acked-by: Jens Wiklander <jens.wiklander@linaro.org> | 4 年前 | |
mem_usage.py: consider all allocatable sections All allocatable sections end up using memory when the TEE binary is loaded. Therefore the 'A' (allocatable) flag in the readelf output is all that matters when gathering memory usage data using mem_usage.py. The combinations that are currently hardcoded in the script ('AX', 'WA', 'A', 'AL') are fragile and need to be replaced. For example, with COMPILER=clang many sections have the 'W' flag set. Signed-off-by: Jerome Forissier <jerome@forissier.org> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> Acked-by: Jens Wiklander <jens.wiklander@linaro.org> | 5 年前 | |
scripts: migrate away from pycryptodome Move away from pycryptodome and use pyca/cryptography instead. pycryptodome has been a little confusing due to other similar packages (pycrypto, pycryptodomex). pyca/cryptography also allow custom backends other than OpenSSL, so it will make additional signing backends (AWS, Azure, GCP) possible in the future (where the private key will be protected by the cloud service provider rather than in plaintext). Signed-off-by: Donald Chan <hoiho@lab126.com> Acked-by: Jerome Forissier <jerome@forissier.org> | 4 年前 | |
scripts: add print_tee_hash.py Adds a Python script to return the SHA256 hash of the .text* and .rodata* sections of tee.elf, excluding the small area in .text that contains data initialized early after boot. This hash value can later be compared with the hash returned at runtime by the attestation PTA which will come in the next commit. Signed-off-by: Jerome Forissier <jerome@forissier.org> Reviewed-by: Sumit Garg <sumit.garg@linaro.org> Acked-by: Jens Wiklander <jens.wiklander@linaro.org> | 4 年前 | |
sign_encrypt.py: rename to hash_size and sig_size Renames digest_len to hash_size and sig_len to sig_size in order to match the names used in the corresponding C code. Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org> Acked-by: Etienne Carriere <etienne.carriere@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> | 3 年前 | |
scripts/sign_encrypt.py: Support signing TAs using AWS KMS This adds support for signing trusted applications (TAs) using a customer owned AWS KMS asymmetric key. When the option to --key points to a valid Amazon Resource Name (ARN), the signing operation will be delegated to AWS KMS. IAM credentials are provided via environment variables. Requires boto3 to work correctly. Acked-by: Jerome Forissier <jerome@forissier.org> Signed-off-by: Donald Chan <hoiho@amazon.com> | 4 年前 | |
symbolize.py: translate TA panic codes When a TA panics, the TEE core shows the panic code as follows: E/TC:? 0 TA panicked with code 0xffff000f The value is whatever was passed to TEE_Panic() by the TA or the library that caused the panic; typically, the TEE Intenal Core API functions implemented in libutee. It quite often happens that this value is a TEE_Result code. Therefore it is convenient to translate the hexadecimal value to a symbolic name (TEE_ERROR_*). With this commit, if a match is found, the name is shown in parentheses like so: E/TC:? 0 TA panicked with code 0xffff000f (TEE_ERROR_SECURITY) If the code doesn't correspond to a known TEE_Result value however nothing is appended to the output. Suggested-by: Peter Griffin <peter.griffin@linaro.org> Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Acked-by: Peter Griffin <peter.griffin@linaro.org> Acked-by: Jens Wiklander <jens.wiklander@linaro.org> | 4 年前 | |
scripts: add --input argument to tee_bin_parser.py Adds an optional --input argument to tee_bin_parser.py to select a different file to parse than the default "../out/arm/core/tee.bin". Reviewed-by: Jerome Forissier <jerome@forissier.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> | 6 年前 | |
core: sp: Allow to embed binary SPs to OP-TEE binary If the ELF header is not found in the file, then assume it's a binary format SP. Signed-off-by: Imre Kis <imre.kis@arm.com> Acked-by: Jens Wiklander <jens.wiklander@linaro.org> | 3 年前 | |
scripts: add update_changelog.py Add a simple helper script that makes the tedious and slightly error prone update process easier and more stable. Usage example: $ ./scripts/update_changelog.py --changelog-file CHANGELOG.md \ --release-version 3.7.0 --previous-release-version 3.6.0 \ --release-date 2019-10-18 Signed-off-by: Joakim Bech <joakim.bech@linaro.org> Acked-by: Jerome Forissier <jerome@forissier.org> | 6 年前 |