- Jul 04, 2022
-
-
Jerome Forissier authored
Increase the size of the guest (DomU) RAM from 128 to 160 MB to fix an issue with xtest 6018: * regression_6018 Large object o regression_6018.1 Storage id: 00000001 writing 0 writing 1 writing 2 writing 3 writing 4 writing 5 regression_6000.c:1895: fs_write(&sess, obj, block, block_size) has an unexpected value: 0xffff3024 = TEE_ERROR_TARGET_DEAD, expected 0x0 = TEEC_SUCCESS regression_6018.1 FAILED For some reason, this test passes in CI [1] but not on my laptop ("make XEN_BOOT=y run", login: "root", run /bin/domu, login: "test" then run "xtest 6018"). tee-supplicant receives error ENOSPC when trying to write to /data/tee. Since the root FS in the guest is a ramdisk, increasing the RAM seems to be the appropriate solution. Link: [1] https://github.com/OP-TEE/optee_os/blob/578f89d28d2b66c35128f095989c355fbc2ef3ab/.azure-pipelines.yml#L256 Signed-off-by:Jerome Forissier <jerome.forissier@linaro.org> Acked-by:
Jens Wiklander <jens.wiklander@linaro.org>
-
- Jun 29, 2022
-
-
Etienne Carriere authored
Configures U-Boot with stm32mp15_defconfig that was introduced in U-Boot tag v2021.10 for devices booted with OP-TEE and U-Boot stored in TF-A FIP container. From U-Boot v2021.10 onward, stm32mp15_trusted_defconfig is dedicated to boot scheme that do not use TF-A FIP format. Acked-by:
Etienne Carriere <etienne.carriere@linaro.org>
-
Jerome Forissier authored
The regular expression used to detect TEE core panics or assertion failures must not allow multi-line text to match, otherwise the following input may trigger it (test case: xtest 1007 with "make COMPILER=clang"). E/TC:? 0 TA panicked with code 0xbeef E/LD: Status of TA 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b E/LD: arch: arm E/LD: region 0: va 0x00102000 pa 0x0e300000 size 0x002000 flags rw-s (ldelf) E/LD: region 1: va 0x00104000 pa 0x0e302000 size 0x00e000 flags r-xs (ldelf) E/LD: region 2: va 0x00112000 pa 0x0e310000 size 0x001000 flags rw-s (ldelf) E/LD: region 3: va 0x00113000 pa 0x0e311000 size 0x004000 flags rw-s (ldelf) E/LD: region 4: va 0x00117000 pa 0x0e315000 size 0x001000 flags r--s E/LD: region 5: va 0x00118000 pa 0x0e410000 size 0x003000 flags rw-s (stack) E/LD: region 6: va 0x00184000 pa 0x00001000 size 0x015000 flags r-xs [0] E/LD: region 7: va 0x00199000 pa 0x00016000 size 0x0e5000 flags rw-s [0] E/LD: assertion 'maps[map_idx].sz == sz' failed at ldelf/ta_elf.c:1451 in ta_elf_print_mappings() In addition to using '[^n]*' instead of '.*', a couple of things need fixing too: - In Expect, `^` and `$` are the beginning and end of the current matching buffer, not the beginning and end of a line. Therefore `^` is not appropriate here. - `\n` should not be matched because if it is consumed for example at the end of an expression to mean "end of line", then it cannot be available to another expression to mean "beginning of line". Fixes: 09900ef9 ("qemu-check.exp: trap only OP-TEE Core assert or panic") Signed-off-by:
-
- Jun 28, 2022
-
-
Balint Dobszay authored
Build the Linux test applications used by Trusted Services to invoke the services provided by Secure Partitions. Acked-by:
Gyorgy Szing <gyorgy.szing@arm.com> Signed-off-by:
Balint Dobszay <balint.dobszay@arm.com>
-
Balint Dobszay authored
Build the Linux drivers used by Trusted Services to access FF-A from user space. Acked-by:
-
Balint Dobszay authored
Add support for building Secure Partitions implemented by the Trusted Services project. The patch contains helper functions to invoke the TS buildsystem in order to build SPs and include them into the OP-TEE bin. It also adds a new top level Makefile which configures OP-TEE and TF-A for the S-EL1 SPMC scenario on FVP platform. Link: https://www.trustedfirmware.org/projects/trusted-services/ Acked-by:
-
Balint Dobszay authored
The Measured Boot option not only enables the relevant config options for TF-A and optee_os, but also building the fTPM TA and its Linux driver. This is unnecessary when the consumer of the Event Log is not fTPM but e.g. the PSA Attestation SP (as introduced in the next commit). This commit modifies the MEASURED_BOOT option to only set the TF-A and optee_os config, and adds the MEASURED_BOOT_FTPM option for the fTPM related components. To keep backwards compatibility if MEASURED_BOOT is selected, by default MEASURED_BOOT_FTPM is enabled too. Reviewed-by:
-
Balint Dobszay authored
Add support for sharing a host directory with the FVP. Reviewed-by:
-
Balint Dobszay authored
Add support for running the Base Platform FVP. This model offers more configuration options and more peripherals than the Foundation model. It's available free of charge on the Arm Developer website. Link: https://developer.arm.com/downloads/-/arm-ecosystem-models Reviewed-by:
-
Balint Dobszay authored
Refactor the FVP path and argument variables to prepare for adding a new FVP platform in the next commit. Reviewed-by:
-
Jerome Forissier authored
Adds Xen upstream patch "optee: enable OPTEE_SMC_SEC_CAP_MEMREF_NULL capability" ([1] present in Xen 4.16.0) in order to avoid failures in the GlobalPlatform test suite [2]: optee/build $ export GP_PACKAGE=~/work/TEE_Initial_Configuration-Test_Suite_v2_0_0_2-2017_06_09.7z optee/build $ make -j10 XEN_BOOT=y run ... $ xtest gp_ ... gp_10081 FAILED first error at gp_10000.c:1653 gp_10082 FAILED first error at gp_10000.c:1673 gp_10083 FAILED first error at gp_10000.c:1693 gp_10155 FAILED first error at gp_10000.c:3346 gp_10156 FAILED first error at gp_10000.c:3366 gp_10157 FAILED first error at gp_10000.c:3386 gp_10229 FAILED first error at gp_10000.c:5039 gp_10230 FAILED first error at gp_10000.c:5059 gp_10231 FAILED first error at gp_10000.c:5079 gp_10303 FAILED first error at gp_10000.c:6732 gp_10304 FAILED first error at gp_10000.c:6752 gp_10305 FAILED first error at gp_10000.c:6772 gp_10632 FAILED first error at gp_10000.c:15608 gp_10633 FAILED first error at gp_10000.c:15629 gp_10634 FAILED first error at gp_10000.c:15650 gp_10706 FAILED first error at gp_10000.c:17375 gp_10707 FAILED first error at gp_10000.c:17396 gp_10708 FAILED first error at gp_10000.c:17417 gp_10780 FAILED first error at gp_10000.c:19142 gp_10781 FAILED first error at gp_10000.c:19163 gp_10782 FAILED first error at gp_10000.c:19184 gp_10854 FAILED first error at gp_10000.c:20909 gp_10855 FAILED first error at gp_10000.c:20930 gp_10856 FAILED first error at gp_10000.c:20951 For each failed test there is a TA log: E/TA: checkUpdateParameterMemref:195 Received buffer is not NULL but expected to be NULL. Link: [1] https://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=d4fb5f166c2b Link: [2] https://github.com/OP-TEE/optee_os/issues/4897 Signed-off-by:
-
- Jun 06, 2022
-
-
Jerome Forissier authored
"make optee-rust OPTEE_RUST_ENABLE=y" always runs the setup.sh script in $(ROOT)/optee_rust. The script clones about 600 MB of data. That can't be done each time especially since the check-rust target depends on optee-rust. Signed-off-by:
Yuan Zhuang <zhuangyuan04@baidu.com> Acked-by:
-
- May 18, 2022
-
-
Jerome Forissier authored
Adds a Xen bug fix from upstream [1]. With this we will be able to get rid of a revert in the linux kernel [2]. Link: [1] https://github.com/xen-project/xen/commit/1c3ed9c908732d19660fbe83580674d585464d4c Link: [2] https://github.com/linaro-swg/linux/commit/665750f493d3fcf307952f19c0442c092b76d852 Signed-off-by:
-
- May 12, 2022
-
-
Jerome Forissier authored
Commit 8b808915 ("qemu_v8: xen: apply patch to fix issue with RPC buffer release") really did only one part of the job. Only the Xen tools are built with Buildroot; the hypervisor itself (which needs the patch mentioned in the commit) is actually built from the top-level xen/ directory. As a result the issue is stil present. This commit changes the QEMUv8 makefiles as well as the Buildroot configuration for Xen so that both the hypervisor and the tools are built. As for the Xen configuration (enabling OP-TEE support), it is introduced via a patch to the defconfig file. Signed-off-by:
-
Jerome Forissier authored
Adds a patch to revert a Xen commit [1] which causes a regression with OP-TEE. There is no more logs to the secure console after these lines: I/TC: Added guest 1 D/TC:2 tee_entry_exchange_capabilities:100 Asynchronous notifications are disabled D/TC:2 tee_entry_exchange_capabilities:109 Dynamic shared memory is enabled ...and TAs fail to open sessions with TEEC_ERROR_COMMUNICATION. This is to prepare building Xen with Buildroot. The version of Xen pulled by $(ROOT)/buildroot/package/xen is 4.14.3 and is affected by this issue while the one we are currently using in $(ROOT)/xen is 4.14.1 and doesn't have the regression. Signed-off-by:
-
- May 06, 2022
-
-
Yuan Zhuang authored
When C source code is built into the Rust TA, the Rust crate `cc`[1] uses gcc compiler defined in the env var `CC`. Setting `CC` in `optee_rust_examples_ext.mk` fixes the building error of those Rust TAs in buildroot. [1] https://crates.io/crates/cc Signed-off-by:
-
Yuan Zhuang authored
In the new version of Teaclave TrustZone SDK, OPTEE_DIR is checked in setup.sh. If OPTEE_DIR is not set, it will download OP-TEE source code. Set OPTEE_DIR as the directory of OP-TEE repo. Signed-off-by:
Joakim Bech <joakim.bech@linaro.org> Acked-by:
-
- May 05, 2022
-
-
Joakim Bech authored
With LOG_LEVEL=50 and DEBUG=1, BL31 becomes too big, with LOG_LEVEL=40 we will miss a few debug prints, but it will at produce a valid binary and more importantly, you'll get an elf-file with all debug symbols, i.e., it's GDB makes up for the missing prints. Signed-off-by:
-
Jerome Forissier authored
CFG_FLASH_SIZE can be used to generate only linux-4g or linux-8g instead of both. Signed-off-by:
-
- May 04, 2022
-
-
Jerome Forissier authored
Adds a patch to be applied by Buildroot when building Xen. This fixes a race condition in RPC buffer management, which causes random failures in the OP-TEE CI jobs [1]. The patch is being upstreamed [2]. Link: [1] https://dev.azure.com/OPTEE/optee_os/_build/results?buildId=2827&view=logs&j=705748f3-7146-5e86-79af-1c0266d20a8c&t=d3458a7d-1a81-5639-8e63-8927d807e53a&l=7812 Link: [2] https://lists.xenproject.org/archives/html/xen-devel/2022-05/msg00245.html Fixes: https://github.com/OP-TEE/optee_os/issues/5288 Signed-off-by:
-
- May 03, 2022
-
-
Jens Wiklander authored
Introduces the option MEMTAG which enabled tagging of memory using the ARM Memory Tagging Extension (MTE). Acked-by:
-
Jens Wiklander authored
Updates the matching rules to only trap OP-TEE Core assert or panic. Panic or assert in a TA may very well be part of a test case. Reviewed-by:
-
- Apr 11, 2022
-
-
Jens Wiklander authored
Adds a missing linux dependency for the flash-image target. This should fix erros like: CC [M] drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.o mformat -i .../build/../out/boot.img.fat -n 64 -h 255 -T 131072 -v "BOOT IMG" -C :: mcopy -i .../build/../out/boot.img.fat .../build/../linux/arch/arm64/boot/Image :: .../build/../linux/arch/arm64/boot/Image: No such file or directory Acked-by:
-
- Apr 01, 2022
-
-
Etienne Carriere authored
Provision a GPT partition for U-Boot to store its environment. U-Boot expects this partition to be labeled u-boot-env. Acked-by:
-
Etienne Carriere authored
Changes stm32mp1 SDcard partitions to use a single FIP formatted image to store U-Boot and OP-TEE binaries. The change also removes duplicated fsbl partition that is not used. Changes build directives to use standard OP-TEE binary images and embed U-Boot DTB in the FIP image. Acked-by:
-
- Feb 15, 2022
-
-
Jerome Forissier authored
Set BR2_PER_PACKAGE_DIRECTORIES=y to allow better parallelism when building Buildroot packages [1] and therefore faster build times on multi-core machines. Link: [1] https://buildroot.org/downloads/manual/manual.html#top-level-parallel-build Signed-off-by:
Jerome Forissier <jerome@forissier.org> Reviewed-by:
-
Jerome Forissier authored
When BR2_PACKAGE_OPENSSL=y, OPENSC_DEPENDENCIES is overwritten with 'openssl' which is wrong. 'openssl' should be appended instead, otherwise the dependency on 'pcsc-lite' is lost. This issue was found when building with BR2_PER_PACKAGE_DIRECTORIES=y which triggers a parallel build. It looks like the non-parallel build works by chance (a matter of build order probably). Signed-off-by:
-
- Feb 10, 2022
-
-
Sadiq Hussain authored
Steps to reproduce: 1)cd into the QEMU build directory 2)make CFG_TEE_BENCHMARK=y run We end up in a compile error as mentioned in https://github.com/OP-TEE/build/issues/489 and https://github.com/linaro-swg/optee_benchmark/issues/17 Turns out the path to benchmark sources wasn't properly defined and hence "BR2_PACKAGE_OPTEE_BENCHMARK_EXT_SITE" was incorrect. Signed-off-by:
Sadiq Hussain <sadiq.muchumarri@intel.com> Acked-by:
-
Jens Wiklander authored
Adds support for building TF-A and OP-TEE the SPMC at EL3. A special manifest is added to be consumed by the SPMC. Acked-by:
-
- Feb 03, 2022
-
-
Ruchika Gupta authored
Introduces option PAUTH, which can be used to enable Pointer Authentication for TA's. Signed-off-by:
Ruchika Gupta <ruchika.gupta@linaro.org> Reviewed-by:
-
- Jan 25, 2022
-
-
Ruchika Gupta authored
XEN fails to boot linux when cpu is selected as max with following kernel crash. Hence revert to using cortex-a57 when XEN_BOOT is selected. [ 0.000000] ------------[ cut here ]------------ [ 0.000000] kernel BUG at arch/arm64/kernel/traps.c:498! [ 0.000000] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-gdbeb6ea978fc #1 [ 0.000000] Hardware name: linux,dummy-virt (DT) [ 0.000000] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.000000] pc : do_undefinstr+0x2bc/0x2e0 [ 0.000000] lr : do_undefinstr+0x2c8/0x2e0 [ 0.000000] sp : ffffd399cddc3c60 [ 0.000000] x29: ffffd399cddc3c60 x28: ffffd399cddd34c0 x27: 0000000000000000 [ 0.000000] x26: 0000000000000000 x25: 0000000000000000 x24: ffffd399cd830008 [ 0.000000] x23: 00000000000000c5 x22: ffffd399cd7810bc x21: ffffd399cddc3e30 [ 0.000000] x20: 00000000d5182101 x19: ffffd399cddc3ce0 x18: 0000000000000014 [ 0.000000] x17: 0000000049426f60 x16: 0000000056a84232 x15: 0000000099ac15ae [ 0.000000] x14: 00000000ab810c49 x13: 501bac190a4c3eb1 x12: 89c8a6a0aab2e7c5 [ 0.000000] x11: 00000000c16d9c19 x10: 00000000e4fb46a5 x9 : 00000000d78a73db [ 0.000000] x8 : 0000000000000014 x7 : 501bac190a4c3eb1 x6 : 89c8a6a0aab2e7c5 [ 0.000000] x5 : ffffd399cddd5910 x4 : 0000000000000000 x3 : ffffd399ce0e70f8 [ 0.000000] x2 : 0000000000000000 x1 : ffffd399cddd34c0 x0 : 00000000000000c5 [ 0.000000] Call trace: [ 0.000000] do_undefinstr+0x2bc/0x2e0 [ 0.000000] el1_undef+0x2c/0x4c [ 0.000000] el1h_64_sync_handler+0x84/0xd0 [ 0.000000] el1h_64_sync+0x78/0x7c [ 0.000000] start_kernel+0x4c4/0x664 [ 0.000000] __primary_switched+0xc0/0xc8 [ 0.000000] Code: 17ffff8d a9425bf5 17ffffb1 a9025bf5 (d4210000) [ 0.000000] ---[ end trace 32823fcd1957a64b ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- Signed-off-by:
-
- Jan 14, 2022
-
-
Etienne Carriere authored
Explicitly enable platform config switch STM32MP_USE_STM32IMAGE to enforce TF-A legacy boot of OP-TEE and U-Boot images in several storage partitions. Platform stm32mp1 changed in TF-A v2.6 in that the default configuration do enable use of a FIP image. Upgrading platform build to use FIP is out of the scope of this change. Acked-by:
-
- Jan 12, 2022
-
-
Ruchika Gupta authored
-cpu max provides support of maximum feature set available with AArch64 architecture.This includes FEAT_PAuth and FEAT_BTI. Additionally sve is turned off as linux fails to boot with sve=on when -cpu max is enabled. Signed-off-by:
-
- Jan 11, 2022
-
-
Jerome Forissier authored
Upstream buildroot commit 43147827a7b7 ("package/python3-cryptography: drop package") has made host-python3-cryptography unavailable. This dependency needs to be replaced with host-python-cryptography. This fix is needed to upgrade Buildroot from 2021.08 to 2021.11. Signed-off-by: -
Jens Wiklander authored
Introduces SPMC_AT_EL which controls configuration of TF-A and optee_os. Currently the value "n" and "1" are supported, with the following meanings: "n" - No SPMC at all, that is, the default configuration using the SMC based ABI. "1" - SPMC implemented at S-EL1, that is, in OP-TEE. TF-A is configured accordingly with SPMD instead of OPTEED. Acked-by: -
Jens Wiklander authored
Drops ARM_TSP_RAM_LOCATION from TF_A_FLAGS as it's not needed any longer. Acked-by:
-
Jens Wiklander authored
Always try to enable FF-A in the kernel. The kernel tries to probe for FF-A, but only enables it if other components supports it. Acked-by:
-
- Jan 05, 2022
-
-
Jerome Forissier authored
In order to match all the digits in a number on its own line, use (\\d+)\r not (\\d+) which could return a truncated value depending on what the content of input buffer is when the matching is done. Signed-off-by:
Sumit Garg <sumit.garg@linaro.org>
-
Jerome Forissier authored
When running only the Trusted Keys test in Xen, qemu-check.exp waits for a prompt twice causing a hang. Move the expect command at the right place to fix that. Signed-off-by:
-
- Jan 03, 2022
-
-
Sumit Garg authored
Add a new argument for script: qemu-check.exp as the type of tests to be executed. After this change its possible to run tests granularly as follows: - Executes all tests: $ make check $ make check CHECK_TESTS=all - Execute only xtest tests: $ make check CHECK_TESTS=xtest - Execute only trusted-keys tests: $ make check CHECK_TESTS=trusted-keys Signed-off-by:
-
