libmbedtls: preserve mempool usage on reinit

be040a3e949b ("libmbedtls: preserve mempool usage on reinit") from
branch import/mbedtls-2.16.0

Preserve the use_mempool field when reinitializing X in

libmbedtls: preserve mempool usage on reinit

be040a3e949b ("libmbedtls: preserve mempool usage on reinit") from
branch import/mbedtls-2.16.0

Preserve the use_mempool field when reinitializing X in
mbedtls_mpi_read_binary().

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: mbedtls_mpi_exp_mod() initialize W

ae499f6a39f3 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W") from
branch import/mbedtls-2.16.0

Initialize W using mbedtls_mpi_init_mempool() instea

libmbedtls: mbedtls_mpi_exp_mod() initialize W

ae499f6a39f3 ("libmbedtls: mbedtls_mpi_exp_mod() initialize W") from
branch import/mbedtls-2.16.0

Initialize W using mbedtls_mpi_init_mempool() instead of memset() to
ensure that the temporary variable uses the designated memory pool if
configured.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mbedtls: Support AES-CCM algorithm

Use AES-CCM implementation from libtomcrypt instead of mbedtls version
due to limitations in the mbedtls API.

Acked-by: Etienne Carriere <etienne.carriere@linaro.

mbedtls: Support AES-CCM algorithm

Use AES-CCM implementation from libtomcrypt instead of mbedtls version
due to limitations in the mbedtls API.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: Support cipher XTS algorithm

Cipher XTS is not supported in MbedTLS, use libtomcrypt instead.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jen

libmbedtls: Support cipher XTS algorithm

Cipher XTS is not supported in MbedTLS, use libtomcrypt instead.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: Support DSA algorithm

DSA is not supported in MbedTLS, use libtomcrypt instead.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@li

libmbedtls: Support DSA algorithm

DSA is not supported in MbedTLS, use libtomcrypt instead.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support mbedtls ECC function

Support mbedtls ECC: ecdh and ecdsa.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Je

libmbedtls: support mbedtls ECC function

Support mbedtls ECC: ecdh and ecdsa.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support mbedtls DH function

Implement DH function based on mbedtls.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by:

libmbedtls: support mbedtls DH function

Implement DH function based on mbedtls.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support mbedtls acipher RSA function

Support RSA:
RSASSA_PKCS1_V1_5
RSASSA_PKCS1_PSS_MGF1
RSAES_PKCS1_V1_5
RSAES_PKCS1_OAEP_MGF1

Acked-by: Etienne Carriere <etienne.carriere@linaro.

libmbedtls: support mbedtls acipher RSA function

Support RSA:
RSASSA_PKCS1_V1_5
RSASSA_PKCS1_PSS_MGF1
RSAES_PKCS1_V1_5
RSAES_PKCS1_OAEP_MGF1

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support mbedtls bignum functions

Implement bignum function based on mbedtls.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed

libmbedtls: support mbedtls bignum functions

Implement bignum function based on mbedtls.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support CMAC algorithm

Implement CMAC function based on mbedtls.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jen

libmbedtls: support CMAC algorithm

Implement CMAC function based on mbedtls.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support mbedtls HMAC algorithm

Implement HMAC function based on mbedtls.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off

libmbedtls: support mbedtls HMAC algorithm

Implement HMAC function based on mbedtls.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: implement AES encrypt api

These two implemented interfaces will be used by AES-GCM algo.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Summer Qin <summer.qin@a

libmbedtls: implement AES encrypt api

These two implemented interfaces will be used by AES-GCM algo.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Summer Qin <summer.qin@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support symmetrical ciphers

Adds support for symmetrical ciphers. The XTS mode is not supported in
mbedTLS and will be dealt with later.

Acked-by: Etienne Carriere <etienne.carriere@lin

libmbedtls: support symmetrical ciphers

Adds support for symmetrical ciphers. The XTS mode is not supported in
mbedTLS and will be dealt with later.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support mbedtls hash algorithm

1. Support mbedtls hash algorithm.
2. Add mbedtls source configure

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edis

libmbedtls: support mbedtls hash algorithm

1. Support mbedtls hash algorithm.
2. Add mbedtls source configure

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
[jw: moved hash routines to hash.c using ops interface]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: with mbedtls as crypto lib compile LTC too

When mbedtls is configured as crypto lib compile libtomcrypt too in
order to complement with missing algorithms.

Acked-by: Jerome Forissier <jerome.

core: with mbedtls as crypto lib compile LTC too

When mbedtls is configured as crypto lib compile libtomcrypt too in
order to complement with missing algorithms.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: support mbedTLS in kernel mode

Initial step of mbedtls cryptos integration.
Directory created and interface file is drafted.
All function interfaces are set to "not supported".
The mbedt

libmbedtls: support mbedTLS in kernel mode

Initial step of mbedtls cryptos integration.
Directory created and interface file is drafted.
All function interfaces are set to "not supported".
The mbedtls can be selected by specifying build flags
"CFG_CRYPTOLIB_NAME=mbedtls" and "CFG_CRYPTOLIB_DIR=lib/libmbedtls"

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: fix no CRT issue

b95a6c5de200 ("libmbedtls: fix no CRT issue") from branch
import/mbedtls-2.16.0

In NO_CRT mode, Q and P may be invalid. But Q and P will be re-filled
again if PRNG func

libmbedtls: fix no CRT issue

b95a6c5de200 ("libmbedtls: fix no CRT issue") from branch
import/mbedtls-2.16.0

In NO_CRT mode, Q and P may be invalid. But Q and P will be re-filled
again if PRNG function is valid. So add judgement process if it is
in NO_CRT mode.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Summer Qin <summer.qin@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: add interfaces in mbedtls for context memory operation

ac34734ac2c8 ("libmbedtls: add interfaces in mbedtls for context memory
operation") from branch import/mbedtls-2.16.0

For integrat

libmbedtls: add interfaces in mbedtls for context memory operation

ac34734ac2c8 ("libmbedtls: add interfaces in mbedtls for context memory
operation") from branch import/mbedtls-2.16.0

For integrating into OPTEE_OS, it needs add some interfaces:
1. add mbedtls_cipher_clone() for cipher to copy context between two
operations.
2. add mbedtls_cipher_setup_info() for cipher. cipher need to get its
"cipher_info" according the key length, while the key length is not an
input in allocate function. So, use a default key len in the beginning.
It need to reset the cipher info again in init function.
3. add mbedtls_cipher_cmac_setup() for cmac. This function is separate
from mbedtls_cipher_cmac_starts().
4. copy hmac context in md.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Squashed commit upgrading to mbedtls-2.16.0

Squash merging branch import/mbedtls-2.16.0

9ee2a92de51f ("libmbedtls: compile new files added with 2.16.0")
9b0818d48d29 ("mbedtls: fix memory leak in m

Squashed commit upgrading to mbedtls-2.16.0

Squash merging branch import/mbedtls-2.16.0

9ee2a92de51f ("libmbedtls: compile new files added with 2.16.0")
9b0818d48d29 ("mbedtls: fix memory leak in mpi_miller_rabin()")
2d6644ee0bbe ("libmedtls: mpi_miller_rabin: increase count limit")
d831db4c238a ("libmbedtls: add mbedtls_mpi_init_mempool()")
df0f4886b663 ("libmbedtls: make mbedtls_mpi_mont*() available")
7b0792062b65 ("libmbedtls: refine mbedtls license header")
2616e2d9709f ("mbedtls: configure mbedtls to reach for config")
d686ab1c51b7 ("mbedtls: remove default include/mbedtls/config.h")
50a57cfac892 ("Import mbedtls-2.16.0")

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: export PRIxVA_WIDTH and add PRIxPA_WIDTH

Export two macros that are useful to print virtual or physical addresses
with the full width required by the native type, that is, 0x + 8
character

libutils: export PRIxVA_WIDTH and add PRIxPA_WIDTH

Export two macros that are useful to print virtual or physical addresses
with the full width required by the native type, that is, 0x + 8
characters when the pointer size is 32 bits, and 0x + 16 characters when
it is 64 bits.

Example:

vaddr_t va = 0x1234;

DMSG("va=0x%0*" PRIxVA, PRIxVA_WIDTH, va);

The above code will print "va=0x00001234" if vaddr_t is 32 bits, and
"va=0x0000000000001234" if vaddr_t is 64 bits.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: fix off-by-one errors in base64_dec()

There is a possible buffer overflow in base64_dec(). Since the output
buffer size is *blen, the last byte of the buffer is buf[*blen - 1] and
therefore

libutee: fix off-by-one errors in base64_dec()

There is a possible buffer overflow in base64_dec(). Since the output
buffer size is *blen, the last byte of the buffer is buf[*blen - 1] and
therefore the buffer must not be written to when the current index m is
such that (m >= *blen), not (m > *blen).

Reported-by: Naveen Thenkani <tnaveenmca@gmail.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee: lessen dependency on mbedtls internals

Until now tee_api_arith_mpi.c assumed that for instance
TEE_BigIntConvertFromOctetString() wouldn't do a
mbedtls_mpi_free(mpi);
mbedtls_mpi_init(mpi);

libutee: lessen dependency on mbedtls internals

Until now tee_api_arith_mpi.c assumed that for instance
TEE_BigIntConvertFromOctetString() wouldn't do a
mbedtls_mpi_free(mpi);
mbedtls_mpi_init(mpi);
sequence on the supplied mpi argument. Doing so replaces the special
allocation type MBEDTLS_MPI_ALLOC_TYPE_STATIC with
MBEDTLS_MPI_ALLOC_TYPE_MALLOC. This results in the value of the mpi
argument isn't propagated further to the dest argument of
TEE_BigIntConvertFromOctetString().

With this patch we're instead explicitly copying the value of
mbedtls_mpi to a TEE_BigInt when the value should be returned.

This patch is also needed when upgrading to mbedtls-2.16 or there will
be errors.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU, GP)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: fix deprecated TA_FLAG_REMAP_SUPPORT inline comment

Update inline comment and value for the deprecated TA flag
TA_FLAG_REMAP_SUPPORT.

Signed-off-by: Etienne Carriere <etienne.carriere@lina

libutee: fix deprecated TA_FLAG_REMAP_SUPPORT inline comment

Update inline comment and value for the deprecated TA flag
TA_FLAG_REMAP_SUPPORT.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutil: add UDIV_ROUND_NEAREST() macro

Default integer division rounds down. Here the interest is
to round to the nearest unsigned integer.

This is inspired from [1].

Link: [1] https://chromium.g

libutil: add UDIV_ROUND_NEAREST() macro

Default integer division rounds down. Here the interest is
to round to the nearest unsigned integer.

This is inspired from [1].

Link: [1] https://chromium.googlesource.com/chromiumos/platform/ec/+/master/include/util.h

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

core: ignore deprecated TA flags EXEC_DDR and USER_MODE

Commit 387b0ee39b1b ("core: deprecate TA property flags EXEC_DDR and
USER_MODE") removes the requirement for user TAs to set the flags
TA_FLAG

core: ignore deprecated TA flags EXEC_DDR and USER_MODE

Commit 387b0ee39b1b ("core: deprecate TA property flags EXEC_DDR and
USER_MODE") removes the requirement for user TAs to set the flags
TA_FLAG_EXEC_DDR (bit 0) and TA_FLAG_USER_MODE (bit 1), the rationale
being that they are meaningless in the current implementation.
The macros are re-defined to be zero to reflect the fact that they have
no use. But, instead of ignoring the previous values, the TEE core now
requires that bits 0 and 1 must *not* be set. This is a problem because
it needlessly breaks backward compatibility. A TA built against OP-TEE
3.0.0 will not work with 3.1.0 or later:

E/TC:? 0 tee_ta_init_user_ta_session:1040 Invalid TA flag(s) 0x3

This commit changes the acceptable flags mask (TA_FLAGS_MASK) to
include the previous EXEC_DDR and USER_MODE bits, thus restoring
backward compatibility.

Fixes: 387b0ee39b1b ("core: deprecate TA property flags EXEC_DDR and USER_MODE")
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...