core: libmbedtls: use crypto_acipher_free_rsa_keypair() instead of open-coding

There is a function to free an RSA keypair, use it instead of
duplicating the code.

Signed-off-by: Jerome Forissier <j

core: libmbedtls: use crypto_acipher_free_rsa_keypair() instead of open-coding

There is a function to free an RSA keypair, use it instead of
duplicating the code.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: libmbedtls: crypto_acipher_free_rsa_keypair(): add missing free for s->dq

The crypto_acipher_free_rsa_keypair() function lacks a call to
crypto_bignum_free() for the dq member of the key. Add

core: libmbedtls: crypto_acipher_free_rsa_keypair(): add missing free for s->dq

The crypto_acipher_free_rsa_keypair() function lacks a call to
crypto_bignum_free() for the dq member of the key. Add it.

Fixes: a1d5c81f8834 ("crypto: add function to free rsa keypair")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: add generic struct ts_session

As a step in making room for Secure Partitions (SPs) running at S-EL0
add a Trusted Service (TS) abstraction. Both TAs and SPs is a TS.

Adds the generic struct t

core: add generic struct ts_session

As a step in making room for Secure Partitions (SPs) running at S-EL0
add a Trusted Service (TS) abstraction. Both TAs and SPs is a TS.

Adds the generic struct ts_session. All future sessions structs
(currently only struct tee_ta_session exists) should add this struct to
allow generic session operations.

With this struct comes new functions replacing previous struct
tee_ta_session oriented functions. The following functions are replaced
as:
tee_ta_get_current_session() -> ts_get_current_session()
tee_ta_push_current_session() -> ts_push_current_session()
tee_ta_pop_current_session() -> ts_pop_current_session()
tee_ta_get_calling_session() -> ts_get_calling_session()

ts_get_current_session() is changed compared to its predecessor to
panic() in case of failure to return a valid pointer.

A new function ts_get_current_session_may_fail() is added to handle an
eventual case where a return NULL session may be handled.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: strtoul.c: adjust license text to upstream

Adjust the license text in strtoul.c according to upstream commit "Use
remove-advertising-clause script to edit BSD licenses" [1].
With this, the

libutils: strtoul.c: adjust license text to upstream

Adjust the license text in strtoul.c according to upstream commit "Use
remove-advertising-clause script to edit BSD licenses" [1].
With this, the file also matches its SPDX License identifier correctly.

Link: [1]: https://sourceware.org/git/?p=newlib-cygwin.git;a=commit;h=9042d0ce65533a26fc3264206db5828d5692332c
Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Acked-by: Jerome Forissier <jerome@forissier.org>
[jf: minor edits to commit message]
Signed-off-by: Jerome Forissier <jerome@forissier.org>

show more ...

Add alignment parameter to FUNC() and LOCAL_FUNC() macros

Adds a default alignment parameter to FUNC() and LOCAL_FUNC() assembly
macros. This is needed since the function macro also sets the sectio

Add alignment parameter to FUNC() and LOCAL_FUNC() macros

Adds a default alignment parameter to FUNC() and LOCAL_FUNC() assembly
macros. This is needed since the function macro also sets the section
of the function making any alignment directives before the function
macro useless.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: provide empty __getauxval() implementation

Never version of libgcc are built with LSE implementation in mind. To
determine if LSE is available on platform it calls __getauxval(), so in
som

libutils: provide empty __getauxval() implementation

Never version of libgcc are built with LSE implementation in mind. To
determine if LSE is available on platform it calls __getauxval(), so in
some cases we can get undefined reference to __getauxval() error.

Prominent case is libgcc_eh.a library, which is used by C++ TAs. Exception
handler depends on atomic operations, so it tries to call
init_have_lse_atomics() first. This function in turn calls __getauxval(),
which causes linking error.

In the future we can make __getauxval() to return actual platform
capabilities.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

libutils: arm: add .cantunwind to __gnu_mcount_nc()

The __gnu_mcount_nc() function lacks proper annotation as registers are
pushed onto the stack. The unwind table information for this symbol is
the

libutils: arm: add .cantunwind to __gnu_mcount_nc()

The __gnu_mcount_nc() function lacks proper annotation as registers are
pushed onto the stack. The unwind table information for this symbol is
therefore incorrect and stack unwinding may fail in spectacular ways.
For example, xtest 1007 enters an infinite loop as ldelf tries to unwind
the call stack when the TA panics:

# Platform: QEMU
(buildhost)$ make CFG_FTRACE_SUPPORT=y CFLAGS_ta_arm32=-pg run
(qemu)$ xtest 1007
...
E/TC:? 0 TA panicked with code 0xbeef
E/LD: Status of TA 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b
E/LD: arch: arm
E/LD: region 0: va 0x00102000 pa 0x0e300000 size 0x002000 flags rw-s (ldelf)
E/LD: region 1: va 0x00104000 pa 0x0e302000 size 0x00c000 flags r-xs (ldelf)
E/LD: region 2: va 0x00110000 pa 0x0e30e000 size 0x001000 flags rw-s (ldelf)
E/LD: region 3: va 0x00111000 pa 0x0e30f000 size 0x004000 flags rw-s (ldelf)
E/LD: region 4: va 0x00115000 pa 0x0e313000 size 0x001000 flags r--s
E/LD: region 5: va 0x00116000 pa 0x0e426000 size 0x003000 flags rw-s (stack)
E/LD: region 6: va 0x00149000 pa 0x00001000 size 0x02b000 flags r-xs [0] .ta_head .text .plt .rodata .gnu.hash .ARM.extab .ARM.exidx .dynsym .dynstr .hash
E/LD: region 7: va 0x00174000 pa 0x0002c000 size 0x0e7000 flags rw-s [0] .dynamic .tdata .tbss .got .rel.got .rel.plt .data .init_array .bss .rel.dyn
E/LD: region 8: va 0x00291000 pa 0x00000000 size 0x00b000 flags r-xs [1] .hash .gnu.hash .dynsym .dynstr .rel.dyn .rel.plt .plt .text .rodata .ARM.extab .ARM.exidx
E/LD: region 9: va 0x0029c000 pa 0x0000a000 size 0x002000 flags rw-s [1] .tdata .tbss .init_array .dynamic .got .data .bss
E/LD: [0] 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b @ 0x00149000 (out-br/build/optee_test_ext-1.0/ta/os_test/out/5b9e0e40-2636-11e1-ad9e-0002a5d5c51b.elf)
E/LD: [1] ffd2bded-ab7d-4988-95ee-e4962fff7154 @ 0x00291000 (out-br/build/optee_test_ext-1.0/ta/os_test_lib/out/libos_test.so)
E/LD: Call stack:
E/LD: 0x0029481c _utee_panic at optee_os/lib/libutee/arch/arm/utee_syscalls_a32.S:51
E/LD: 0x002944fc TEE_Panic at optee_os/lib/libutee/tee_api_panic.c:24
E/LD: 0x0014c494 ta_entry_panic at out-br/build/optee_test_ext-1.0/ta/os_test/os_test.c:787
E/LD: 0x00293574 __gnu_mcount_nc at optee_os/lib/libutils/ext/arch/arm/mcount_a32.S:44
E/LD: 0x00293574 __gnu_mcount_nc at optee_os/lib/libutils/ext/arch/arm/mcount_a32.S:44
E/LD: 0x00293574 __gnu_mcount_nc at optee_os/lib/libutils/ext/arch/arm/mcount_a32.S:44
[repeats indefinitely]

The bug is triggered by commit 3513f961cda0 ("arm32: fold
UNWIND(.fnstart/.fnend) into the FUNC macros"). Prior to that commit,
the unwind entry for __gnu_mcount_nc() was "0x1 [cantunwind]", probably
because the function had no .fnstart/.fnend directive.

This commit adds a .cantunwind directive to restore the previous
behavior: unwinding stops at __gnu_mcount_nc(). Since the ftrace code
overwrites LR on the stack, it seems there is no simple way to produce
correct and comprehensive stack dumps short of introducing an unwind
helper function with a knowledge of the ftrace transformation, similar
to what ftrace_return() does.

At least with this patch the unwinding code does not fail.

Fixes: 3513f961cda0 ("arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Use fallthrough pseudo-keyword in switch/case statements

Use fallthrough; in switch/case statements. Imported libraries
(libtomcrypt, libmbedtls) are not modified to minimize differences with
upstre

Use fallthrough pseudo-keyword in switch/case statements

Use fallthrough; in switch/case statements. Imported libraries
(libtomcrypt, libmbedtls) are not modified to minimize differences with
upstream.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: compiler.h: introduce fallthrough pseudo-keyword

Adds the fallthrough pseudo-keyword to be used in switch/case
statements. Tested with GCC 6.2.1, 7.2.1, 8.2.1, 8.3.0, 9.2.1 and Clang
9.0.1

libutils: compiler.h: introduce fallthrough pseudo-keyword

Adds the fallthrough pseudo-keyword to be used in switch/case
statements. Tested with GCC 6.2.1, 7.2.1, 8.2.1, 8.3.0, 9.2.1 and Clang
9.0.1 and 10.0.0.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Provide TEE_ATTR_FLAG_VALUE and TEE_ATTR_FLAG_PUBLIC

Provides TEE_ATTR_FLAG_VALUE and TEE_ATTR_FLAG_PUBLIC which are defined
already in GP v1.0 [1] and also expected in GP v1.1 [2]. The old
TEE_ATTR

Provide TEE_ATTR_FLAG_VALUE and TEE_ATTR_FLAG_PUBLIC

Provides TEE_ATTR_FLAG_VALUE and TEE_ATTR_FLAG_PUBLIC which are defined
already in GP v1.0 [1] and also expected in GP v1.1 [2]. The old
TEE_ATTR_BIT_VALUE and TEE_ATTR_BIT_PROTECTED are kept for backwards
compatibility for now.

[1]: GlobalPlatform TEE Internal API Specification v1.0
[2]: GlobalPlatform TEE Internal Core API Specification v1.1

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: do not redefine ARRAY_SIZE

Do not redefine ARRAY_SIZE if it is already defined

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Etienne Carriere <etienne.carriere@lina

libutils: do not redefine ARRAY_SIZE

Do not redefine ARRAY_SIZE if it is already defined

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

libutee: fix TEE_GetOperationInfoMultiple()

The size parameter passed to TEE_GetOperationInfoMultiple() tells the
size of the op_info buffer. The maximum number of keys which can be
contained in the

libutee: fix TEE_GetOperationInfoMultiple()

The size parameter passed to TEE_GetOperationInfoMultiple() tells the
size of the op_info buffer. The maximum number of keys which can be
contained in the struct can be calculated from this size parameter.

Prior to this patch is was assumed that the caller by this specified the
exact number of keys to report. This is not correct as the size
parameter is only the upper limit. Fix this by instead figuring out how
many keys (one or two) needs to be returned and after that check if the
buffer is large enough.

Fixes: 05304565f188 ("GP11 : TEE_GetOperationInfoMultiple")
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: fix TEE_SetOperationKey() and TEE_SetOperationKey2()

Supplying TEE_HANDLE_NULL instead of a valid key handle is supposed to
clear an eventual already present key from the operation handle a

libutee: fix TEE_SetOperationKey() and TEE_SetOperationKey2()

Supplying TEE_HANDLE_NULL instead of a valid key handle is supposed to
clear an eventual already present key from the operation handle and
return TEE_SUCCESS. Prior to this patch the key(s) where halfway cleared
and then functions panicked with TEE_ERROR_BAD_PARAMETERS. So fix this.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: TEE_GetOperationInfo() v1.1 update

In the v1.1 specification [1] TEE_GetOperationInfo() is required to set
keySize and requiredKeyUsage to 0 if TEE_HANDLE_FLAG_EXPECT_TWO_KEYS is
set in han

libutee: TEE_GetOperationInfo() v1.1 update

In the v1.1 specification [1] TEE_GetOperationInfo() is required to set
keySize and requiredKeyUsage to 0 if TEE_HANDLE_FLAG_EXPECT_TWO_KEYS is
set in handleState.

This is a clarification compared to the v1.0 [2] specification where
nothing special was noted for those fields when
TEE_HANDLE_FLAG_EXPECT_TWO_KEYS is set.

[1]: GlobalPlatform TEE Internal Core API Specification v1.1
[2]: GlobalPlatform TEE Internal API Specification v1.0
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: TEE_AllocateOperation(): digest operations must have 0 max key size

Make sure that the "maxKeySize" parameter supplied to
TEE_AllocateOperation() is 0 for digest operations since they don't

libutee: TEE_AllocateOperation(): digest operations must have 0 max key size

Make sure that the "maxKeySize" parameter supplied to
TEE_AllocateOperation() is 0 for digest operations since they don't
accept any keys.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: fix TEE_CloseAndDeletePersistentObject1() with TEE_HANDLE_NULL

Fixing TEE_CloseAndDeletePersistentObject1() to return TEE_SUCCESS if
called with TEE_HANDLE_NULL as required in the v1.1 spec

libutee: fix TEE_CloseAndDeletePersistentObject1() with TEE_HANDLE_NULL

Fixing TEE_CloseAndDeletePersistentObject1() to return TEE_SUCCESS if
called with TEE_HANDLE_NULL as required in the v1.1 specification [1]
where the function was introduced.

[1]: GlobalPlatform TEE Internal Core API Specification v1.1
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

GP 1.1: Check parameters annotated in the specification

Checks that all the function parameters which are annotated in the
specification [1] are compliant with regards to memory access and memory
lo

GP 1.1: Check parameters annotated in the specification

Checks that all the function parameters which are annotated in the
specification [1] are compliant with regards to memory access and memory
location. In case the check fails the TA panics to help debugging. The
more precise and expensive checks can be disabled with
CFG_TA_STRICT_ANNOTATION_CHECKS=n.

TEE_Realloc(), TEE_MemMove(), TEE_MemCompare(), TEE_MemFill() are
skipped for performance reasons. The TA will instead die with a fatal
exception if buffers supplied to these functions do not follow the
annotation rules.

[1]: GlobalPlatform TEE Internal Core API Specification v1.1

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

crypto: add function to free rsa keypair

There was no function to proper free a rsa kepair from inside a PTA.
Now there is crypto_acipher_free_rsa_keypair().

Signed-off-by: Elias von Däniken <elias

crypto: add function to free rsa keypair

There was no function to proper free a rsa kepair from inside a PTA.
Now there is crypto_acipher_free_rsa_keypair().

Signed-off-by: Elias von Däniken <elias.vondaeniken@bluewin.ch>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: fix memset(), memcpy(), memmove() with -O3

When libutils is built with optimization -O3 (make CFG_CC_OPT_LEVEL=3),
memset() may cause infinite recursion. This bug was observed with GCC
8.3

libutils: fix memset(), memcpy(), memmove() with -O3

When libutils is built with optimization -O3 (make CFG_CC_OPT_LEVEL=3),
memset() may cause infinite recursion. This bug was observed with GCC
8.3 with QEMUv8. The reason is, at this optimization level the compiler
may decide to replace loops with calls to memset(), which is obviously
not valid when the loop is in the memset function itself. This behavior
can be turned off with -fno-tree-loop-distribute-patterns.

Therefore, add the appropriate build flag to memset.c. Note that a
similar fix was introduced in upstream newlib [1] but since it depends
on the newlib build script to detect compiler support, the patch is not
directly applicable. Instead $(call cc-option,...) is used here.

Although I have not observed any issue with memcpy() and memmove(),
upstream did apply the compiler flag to these functions too [1], [2],
which seems quite reasonable so do the same here.

Link: [1] https://github.com/bminor/newlib/commit/10e4d79a191f07999bc94b21535fba5d7c04f419
Link: [2] https://github.com/bminor/newlib/commit/82dfae9ab0734b9946321590162dc6021057fec1
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: memset(): add -O2 only if optimization is -Os

Commit 5b2aaa117eee ("libutee: optimize memcpy() for speed") added -O2
to memset.c to exclude the slower implementation which would be selecte

libutils: memset(): add -O2 only if optimization is -Os

Commit 5b2aaa117eee ("libutee: optimize memcpy() for speed") added -O2
to memset.c to exclude the slower implementation which would be selected
when level is -Os (in which case __OPTIMIZE_SIZE__ is defined).

Since the optimization level can now be selected globally with
CFG_CC_OPT_LEVEL, -O2 should not be forced unconditionally or it could
actually reduce the desired level (when CFG_CC_OPT_LEVEL=3).

Therefore, add -O2 only if the global optimization is -Os.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: Fix fputs() when CFG_TEE_TA_LOG_LEVEL=0

When Optee OS is compiled with CFG_TEE_TA_LOG_LEVEL=0, Optee
test fails to compile properly:

arm-none-linux-gnueabihf-ld.bfd: libutils.a(fputs.o):

libutils: Fix fputs() when CFG_TEE_TA_LOG_LEVEL=0

When Optee OS is compiled with CFG_TEE_TA_LOG_LEVEL=0, Optee
test fails to compile properly:

arm-none-linux-gnueabihf-ld.bfd: libutils.a(fputs.o): in function `fputs':
fputs.c:15: undefined reference to `trace_ext_puts'
link.mk:109: recipe for target '5b9e0e40-2636-11e1-ad9e-0002a5d5c51b.elf'
failed

fputs is referenced by libstdc++.a which is used by the os_test
TA for the C++ tests.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: thread: add compiler barrier to thread_set_exceptions()

With compiler optimizer enable (-O2) compiler generate invalid code
for thread_get_id_may_fail(). The curr_thread read got re-order
afte

core: thread: add compiler barrier to thread_set_exceptions()

With compiler optimizer enable (-O2) compiler generate invalid code
for thread_get_id_may_fail(). The curr_thread read got re-order
after exceptions unmask.

Signed-off-by: Khoa Hoang <admin@khoahoang.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add unwind library (libunw)

Adds libunw to consolidate the stack unwinding code found in
ldelf/unwind_arm{32,64}.c and core/arch/arm/kernel/unwind_arm{32,64}.c.

The library is called "libunw" rathe

Add unwind library (libunw)

Adds libunw to consolidate the stack unwinding code found in
ldelf/unwind_arm{32,64}.c and core/arch/arm/kernel/unwind_arm{32,64}.c.

The library is called "libunw" rather than "libunwind" to avoid
confusion with the GNU libunwind [1]. The header file is <unw/unwind.h>
to avoid a conflict with GCC's <unwind.h>.

Link: [1] https://www.nongnu.org/libunwind
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros

This change applies to arm32 assembler sources.

Instead of using UNWIND(.fnstart) after FUNC or LOCAL_FUNC and
UNWIND(.fnend) before END_FUN

arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros

This change applies to arm32 assembler sources.

Instead of using UNWIND(.fnstart) after FUNC or LOCAL_FUNC and
UNWIND(.fnend) before END_FUNC, let's fold these statements into the
FUNC macros.

The .fnstart/.fnend directives mark the start and end of a function
with an unwind table entry (.ARM.exidx) and therefore a function
without them has no entry and cannot be unwound. This means that a
stack dump (on abort or panic) would stop when reaching such a
function.

As a result of this patch, a small number of functions now have an
entry in the unwind table when they had none before (the functions
which were using FUNC or LOCAL_FUNC but had no .fnstart/.fnend). It was
almost always a bug and this pacth only increases the size of the
.ARM.exidx section by a few bytes (tested on QEMU).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

arm32: move the UNWIND() macro to <asm.S>

All the users of the UNWIND() macro include <asm.S> already, which is
therefore a good place to define this macro. Let's move it from
<kernel/unwind.h> to <

arm32: move the UNWIND() macro to <asm.S>

All the users of the UNWIND() macro include <asm.S> already, which is
therefore a good place to define this macro. Let's move it from
<kernel/unwind.h> to <asm.S>, remove a couple of duplicates in
assembler files, and drop the useless includes.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...