libmedtls: mpi_miller_rabin: increase count limit

213cce52a604 ("libmedtls: mpi_miller_rabin: increase count limit") from
branch import/mbedtls-2.6.1

Increase the count limit when generating the wi

libmedtls: mpi_miller_rabin: increase count limit

213cce52a604 ("libmedtls: mpi_miller_rabin: increase count limit") from
branch import/mbedtls-2.6.1

Increase the count limit when generating the witness in the Rabin-Miller
primality test. The previous number 30 was too low to reliably detect
000000022770A7DC599BC90B2FF981CCB5CF05703344C8F350418AAD as a prime
number.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mbedtls: add mbedtls_mpi_init_static()

f934e2913b7b ("mbedtls: add mbedtls_mpi_init_static()") from
branch import/mbedtls-2.6.1

Adds mbedtls_mpi_init_static() which initializes a mbedtls_mpi struct

mbedtls: add mbedtls_mpi_init_static()

f934e2913b7b ("mbedtls: add mbedtls_mpi_init_static()") from
branch import/mbedtls-2.6.1

Adds mbedtls_mpi_init_static() which initializes a mbedtls_mpi struct
with a fixed sized bignum array.

The old behavior to fall back on malloc allocations when memory pool
isn't configured is retained.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove Secure Element API support

There is probably no-one using the Secure Element API. We have never heard
anyone asking questions about it, have no way to test it and we believe
it is not even wo

Remove Secure Element API support

There is probably no-one using the Secure Element API. We have never heard
anyone asking questions about it, have no way to test it and we believe
it is not even working right now. Therefore, remove it.

- The reserved syscalls are still present, but return
TEE_ERROR_NOT_SUPPORTED
- The TEE_SE* functions (GlobalPlatform TEE Secure Element API,
GPD_SPE_024) are removed from libutee.a and the header file
tee_internal_se_api.h is removed as well

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

mempool: add mempool_calloc()

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

lib.mk: centralize profiling flag (-pg)

Code cleanup, no functional change. This commit avoids the duplication of
the -pg flag in the library makefiles.

Signed-off-by: Jerome Forissier <jerome.fori

lib.mk: centralize profiling flag (-pg)

Code cleanup, no functional change. This commit avoids the duplication of
the -pg flag in the library makefiles.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

utee: support prehashed RSA sign/ver without ASN.1

Add TEE Core Internal API extension TEE_ALG_RSASSA_PKCS1_V1_5 to
sign/verify pre-hashed PKCS#1 v1.5 EMSA without ASN.1 around the hash.
This relies

utee: support prehashed RSA sign/ver without ASN.1

Add TEE Core Internal API extension TEE_ALG_RSASSA_PKCS1_V1_5 to
sign/verify pre-hashed PKCS#1 v1.5 EMSA without ASN.1 around the hash.
This relies on libtomcrypt LTC_PKCS_1_V1_5_NA1. The extension can be
turned on with CFG_CRYPTO_RSASSA_NA1.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Gabor Szekely <szvgabor@gmail.com>

show more ...

core: mbedtls: configure bignum word size

Configures mbedtls bignum word size (mbedtls_mpi_uint and mbedtls_mpi_sint)
as 32-bit or 64-bit depending on arm architecture.

Reviewed-by: Jerome Forissie

core: mbedtls: configure bignum word size

Configures mbedtls bignum word size (mbedtls_mpi_uint and mbedtls_mpi_sint)
as 32-bit or 64-bit depending on arm architecture.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: switch to mbedtls for bignum

Adds a mpi_desc.c wrapper to LTC in order to enable usage of bignum
(mpi) routines from mbedtls.

CFG_MBEDTLS_MPI=y (default y) builds the bignum routines for mbed

core: switch to mbedtls for bignum

Adds a mpi_desc.c wrapper to LTC in order to enable usage of bignum
(mpi) routines from mbedtls.

CFG_MBEDTLS_MPI=y (default y) builds the bignum routines for mbedtls and
also enables their usage in LTC and by that replaces libmpa for
privileged mode usage.

User mode TAs still use libmpa.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: add mbedtls_mpi_init_mempool()

782fddd10ccb ("libmbedtls: add mbedtls_mpi_init_mempool()") from
branch import/mbedtls-2.6.1

Adds mbedtls_mpi_init_mempool() which initializes a mbedtls_m

libmbedtls: add mbedtls_mpi_init_mempool()

782fddd10ccb ("libmbedtls: add mbedtls_mpi_init_mempool()") from
branch import/mbedtls-2.6.1

Adds mbedtls_mpi_init_mempool() which initializes a mbedtls_mpi struct
to use the mempool mbedtls_mpi_mempool if configured for memory
allocation. All local memory allocation is changed to use
mbedtls_mpi_init_mempool() instead of mbedtls_mpi_init(). This will give
a stack like alloc/free pattern for which the mempool is optimized.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: make mbedtls_mpi_mont*() available

338738340a8c ("libmbedtls: make mbedtls_mpi_mont*() available") from
branch import/mbedtls-2.6.1

Makes mbedtls_mpi_montg_init(), mbedtls_mpi_montmul()

libmbedtls: make mbedtls_mpi_mont*() available

338738340a8c ("libmbedtls: make mbedtls_mpi_mont*() available") from
branch import/mbedtls-2.6.1

Makes mbedtls_mpi_montg_init(), mbedtls_mpi_montmul() and
mbedtls_mpi_montred() available for external use.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libmbedtls: configure mbedTLS for different modes

Split mbedTLS into 3 partitions: CRYPTO, X509 and TLS. CRYPTO is for
kernel and user mode. X509 and TLS are mainly for user mode.

Reviewed-by: Jero

libmbedtls: configure mbedTLS for different modes

Split mbedTLS into 3 partitions: CRYPTO, X509 and TLS. CRYPTO is for
kernel and user mode. X509 and TLS are mainly for user mode.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mempool: report max memory usage

Adds CFG_MEMPOOL_REPORT_LAST_OFFSET which if set to y causes mempool to
report each time the maximum amount of memory has increased. This helps
to determine required

mempool: report max memory usage

Adds CFG_MEMPOOL_REPORT_LAST_OFFSET which if set to y causes mempool to
report each time the maximum amount of memory has increased. This helps
to determine required size of a mempool.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mempool: optimize reference counting

Optimizes reference counting in mempool by using refcount_inc() and
refcount_dec() in order to be able to avoid using the mutex in the quick
case.

Reviewed-by:

mempool: optimize reference counting

Optimizes reference counting in mempool by using refcount_inc() and
refcount_dec() in order to be able to avoid using the mutex in the quick
case.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mempool: add out of memory message

Adds a helpful message when a memory allocation with mempool_alloc()
fails. If this occurs it's because the memory pool size isn't tuned
properly with regards to t

mempool: add out of memory message

Adds a helpful message when a memory allocation with mempool_alloc()
fails. If this occurs it's because the memory pool size isn't tuned
properly with regards to the user of the pool.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

trace levels: Redefine TRACE_MIN level to 0

The global `trace_level` session-wise indicator which is set by
`trace_set_level()` [1], could get a wrong value in case of an
input `level` set to 0, mea

trace levels: Redefine TRACE_MIN level to 0

The global `trace_level` session-wise indicator which is set by
`trace_set_level()` [1], could get a wrong value in case of an
input `level` set to 0, meaning that all logs need to be disabled
by user define `CFG_TEE_TA_LOG_LEVEL=0` when building TA applications.

This inconsistency is caused by a rather wrong value of `TRACE_MIN`
low boundary value set to 1. According to [1] `trace level` will be
set to `TRACE_MAX` (4) in case input level is smaller than `TRACE_MIN`
and larger than `TRACE_MAX`.
In the scenario when the needed log level is 0, `trace level` would be
set to `TRACE_MAX` and will cause a lot of flow log level information
dumped by trace functions/macros that are using `trace_printf()`
primitive.

This patch sets the `TRACE_MIN` to 0 in order to assure a proper trace
level setting and completely disable all logs in case
`CFG_TEE_TA_LOG_LEVEL=0`.

[1]
void trace_set_level(int level)
{
if (((int)level >= TRACE_MIN) && (level <= TRACE_MAX))
trace_level = level;
else
trace_level = TRACE_MAX;
}

Acked-by: Christoph Gellner <cgellner@de.adit-jv.com>
Signed-off-by: Ovidiu Mihalachi <ovidiu_mihalachi@mentor.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Move __early_ta from <compiler.h> to <kernel/early_ta.h>

The __early_ta macro is used only in C files generated by
scripts/ta_bin_to_c.py. There is no reason to have it defined in a widely
used head

Move __early_ta from <compiler.h> to <kernel/early_ta.h>

The __early_ta macro is used only in C files generated by
scripts/ta_bin_to_c.py. There is no reason to have it defined in a widely
used header like <compiler.h>.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: force read-only flag on .rodata.* sections

This commit fixes a warning with GCC 8.2 that did not occur with GCC 6.2:

$ make out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
CHK ou

core: force read-only flag on .rodata.* sections

This commit fixes a warning with GCC 8.2 that did not occur with GCC 6.2:

$ make out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/core/include/generated/asm-defines.h
CC out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
{standard input}: Assembler messages:
{standard input}:4087: Warning: setting incorrect section attributes for .rodata.__unpaged

The message is printed as the assembler processes this code fragment,
generated by the C compiler:

.section .rodata.__unpaged,"aw"

The older compiler (GCC 6.2) would generate instead:

.section .rodata.__unpaged,"a",%progbits

The problem with .rodata.__unpaged,"aw" is that the "w" (writeable) flag
is not consistent with the section name (.rodata.*), which by convention
is supposed to be read-only.

- The section name (".rodata.__unpaged") is given by our macro:
__rodata_unpaged.
- The "w" flag is added by GCC, not sure why exactly. One reason [1] is
when a relocatable binary is being generated and the structure contains
relocatable data. But, we are not explicitly asking for a relocatable
binary, so this might as well be a bug or counter-intuitive feature of
the compiler.

Anyway, to avoid the warning, we need to fix the section flags. The
section type (%progbits) is optional, it is deduced from the section name
by default. %progbits indicates that the section contains data (i.e., is
not empty).

Link: [1] https://gcc.gnu.org/ml/gcc/2004-05/msg01016.html
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: Import strtoul from newlib

This patch imports strtoul from newlib which the latest version of libfdt
depends on.

Some modification of the original source is required to do this,
specifica

libutils: Import strtoul from newlib

This patch imports strtoul from newlib which the latest version of libfdt
depends on.

Some modification of the original source is required to do this,
specifically:

This is an import of the newlib 1.19.0 version of strtoul dropping

- Headers and prototypes for re-entrancy

- Any reliance on errno

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: isoc: implement isalpha(), isspace() and isupper()

This patch implements isalpha(), isspace() and isupper() which are
dependencies for a subsequent patch which brings in strtoul from newli

libutils: isoc: implement isalpha(), isspace() and isupper()

This patch implements isalpha(), isspace() and isupper() which are
dependencies for a subsequent patch which brings in strtoul from newlib.

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: Import strrchr from newlib

libfdt 1.4.7 depends on strrchr, this patch imports the same from newlib.

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Etienne Carr

libutils: Import strrchr from newlib

libfdt 1.4.7 depends on strrchr, this patch imports the same from newlib.

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: introduce lockdep algorithm

This commit introduces an algorithm that may be used to detect improper
usage of locks at runtime. It can detect two kinds errors:

1. A thread tries to release a

core: introduce lockdep algorithm

This commit introduces an algorithm that may be used to detect improper
usage of locks at runtime. It can detect two kinds errors:

1. A thread tries to release a lock it does not own,
2. A thread tries to aquire a lock and the operation could *potentially*
result in a deadlock.

The potential deadlock detection assumes that the code adheres to a strict
locking hierarchy, in other word, that there is a partial ordering on the
locks so that there can be no situation where circular waits can occur. To
put things simply, any two locks should be acquired in the same order in
the same thread. This addresses the following case:

[Thread #1] [Thread #2]

lock(A)
lock(B)
lock(B)
lock(A) <-- deadlock!
...

The algorithm builds the lock hierarchy dynamically and reports as soon as
a violation is detected.

The interface is made of two functions: lockdep_lock_acquire() and
lockdep_lock_release(), which are meant to be introduced in the
implementation of the actual lock objects. The "acquire" hook tells the
algorithm that a particular lock is about to be requested by a particular
thread, while the "release" hook is meant to be called before the lock is
actually released. If an error is detected, debugging information is sent
to the console, and panic() is called. The debugging information includes
the lock cycle that was detected (in the above example, {A, B}), as well
as the call stacks at the points where the locks were acquired.

The good thing with such an instrumentation of the locking code is that
there is no need to wait for an actual deadlock to occur in order to
detect potential problems. For instance, the timing of execution in the
above example could be different but the problem would still be detected:

[Thread #1] [Thread #2]

lock(A)
lock(B)
unlock(B)
unlock(A)
lock(B)
lock(A) <-- error!

A pseudo-TA is added for testing (pta/core_lockdep_tests.c).

This code is based on two sources:
- A presentation called "Dl-Check: dynamic potential deadlock detection
tool for Java programs" [1], although the somewhat complex MNR algorithm
for topological ordering of a DAG was not used;
- A depth-first search algorithm [2] was used instead.

Link: [1] https://www.slideshare.net/IosifItkin/tmpa2017-dlcheck-dynamic-potential-deadlock-detection-tool-for-java-programs
Link: [2] https://en.wikipedia.org/wiki/Topological_sorting#Depth-first_search
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: sys/queue.h: add STAILQ_FOREACH_SAFE()

Import macro STAILQ_FOREACH_SAFE from FreeBSD.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@l

libutils: sys/queue.h: add STAILQ_FOREACH_SAFE()

Import macro STAILQ_FOREACH_SAFE from FreeBSD.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: Fix base64 encoding function

Bitwise OR of unsigned int and a signed char is machine dependent and
could lead to invalid base64 encoding.

This commit makes it use unsigned char instead.

S

libutee: Fix base64 encoding function

Bitwise OR of unsigned int and a signed char is machine dependent and
could lead to invalid base64 encoding.

This commit makes it use unsigned char instead.

Signed-off-by: Krzysztof Jackiewicz <k.jackiewicz@samsung.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

pager: enable BestFit allocation when using the pager

When running xtest 6018 we have got panics because of
TEE_ERROR_OUT_OF_MEMORY errors when trying to allocate memory (using
malloc and calloc). T

pager: enable BestFit allocation when using the pager

When running xtest 6018 we have got panics because of
TEE_ERROR_OUT_OF_MEMORY errors when trying to allocate memory (using
malloc and calloc). The reason for this seems to be a fragmented heap
when running with the pager enabled. By enabling the BestFit algorithm
in bget we have seen a much improved use of the heap with a lot less
fragmentation. We have been running xtest on QEMU v8 and HiKey 6220 and
the performance difference seems to be negligible.

Fixes: https://github.com/OP-TEE/optee_os/issues/2580

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (HiKey 6220, QEMU v8)
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Allow mixed declaration and code

Removes the -Wdeclaration-after-statement compiler flag to allow mixed
declaration and code

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by:

Allow mixed declaration and code

Removes the -Wdeclaration-after-statement compiler flag to allow mixed
declaration and code

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...