trace: make output more compact

The new format for traces are:
<type>/<where>:<thread_id> [<func:line>] <message>

<type>:
D = DEBUG
E = ERROR
I = INFO
F = FLOW

<where>:
TA = Trusted Ap

trace: make output more compact

The new format for traces are:
<type>/<where>:<thread_id> [<func:line>] <message>

<type>:
D = DEBUG
E = ERROR
I = INFO
F = FLOW

<where>:
TA = Trusted Application
TC = TEE Core

I.e, it outputs messages like this:
D/TC:00 ta_load:316 ELF load address 0x101000
etc

Thread ID will either take a single or two digits depending on the
number of threads in use.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: add management pseudo TA for secstor TAs

Adds a pseudo TA for management of Trusted Applications and Security
Domains. The pseudo TA only provides a minimal interface, a more
advanced interfac

core: add management pseudo TA for secstor TAs

Adds a pseudo TA for management of Trusted Applications and Security
Domains. The pseudo TA only provides a minimal interface, a more
advanced interface is supposed to be provided by a user TA using this
pseudo TA. Such a TA could for instance implement Global Platforms TEE
Management Framework or OTrP.

The management TA currently only supports installing bootstrap packaged
TAs in secure storage.

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: add atomic load, store and cas

* Adds atomic_load_uint() and atomic_load_u32()
* Adds atomic_store_uint() and atomic_store_u32()
* Adds atomic_cas_uint() and atomic_cas_u32(), compare and

libutils: add atomic load, store and cas

* Adds atomic_load_uint() and atomic_load_u32()
* Adds atomic_store_uint() and atomic_store_u32()
* Adds atomic_cas_uint() and atomic_cas_u32(), compare and store

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pta: add PTA_INVOKE_TESTS_CMD_MUTEX

Adds test functions PTA_INVOKE_TESTS_CMD_MUTEX the invoke tests PTA
(PTA_INVOKE_TESTS_UUID). The PTA_INVOKE_TESTS_CMD_MUTEX function is used
to test in part

core: pta: add PTA_INVOKE_TESTS_CMD_MUTEX

Adds test functions PTA_INVOKE_TESTS_CMD_MUTEX the invoke tests PTA
(PTA_INVOKE_TESTS_UUID). The PTA_INVOKE_TESTS_CMD_MUTEX function is used
to test in particular read and write mutex, but also mutex over all.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: allow multithreaded pseudo TAs

Introduces TA_FLAG_CONCURRENT valid for pseudo TAs only which allows
concurrent execution of the TA.

With this change a pseudo TA configured with TA_FLAG_CONCUR

core: allow multithreaded pseudo TAs

Introduces TA_FLAG_CONCURRENT valid for pseudo TAs only which allows
concurrent execution of the TA.

With this change a pseudo TA configured with TA_FLAG_CONCURRENT would
accept multiple sessions where each can be used concurrently with the
other sessions.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

optee: use correct type to hold exceptions state

cpu_spin_lock_xsave() returns exceptions state in uin32_t, not
in unsigned int.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-b

optee: use correct type to hold exceptions state

cpu_spin_lock_xsave() returns exceptions state in uin32_t, not
in unsigned int.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee: fix improper calloc usage

calloc() takes number of entries as first argument, and size of entry
as a second. There was several places, where argument order was
reversed.

Signed-off-by: Volodym

tee: fix improper calloc usage

calloc() takes number of entries as first argument, and size of entry
as a second. There was several places, where argument order was
reversed.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Keep assembly functions in separate sections

To get a more fine grained selection of which area (init, paged,
unpaged) an assembly function is assigned do the equivalent of
-ffunction-sections but i

Keep assembly functions in separate sections

To get a more fine grained selection of which area (init, paged,
unpaged) an assembly function is assigned do the equivalent of
-ffunction-sections but in assembly.

Some functions has to be in specific places in the binary for a
successful boot, link script is updated accordingly.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Util: add ASM version ROUNDDOWN and ROUNDUP definitions

Add ROUNDDOWN and ROUNDUP definitions for ASM version which are
different from C versions

Signed-off-by: Kevin Peng <kevinp@marvell.com>
Revi

Util: add ASM version ROUNDDOWN and ROUNDUP definitions

Add ROUNDDOWN and ROUNDUP definitions for ASM version which are
different from C versions

Signed-off-by: Kevin Peng <kevinp@marvell.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Util: add some useful SIZE definitions

Add some useful SIZE_XX definitions like 4k, 1M, etc...

Signed-off-by: Kevin Peng <kevinp@marvell.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.

Util: add some useful SIZE definitions

Add some useful SIZE_XX definitions like 4k, 1M, etc...

Signed-off-by: Kevin Peng <kevinp@marvell.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Add CFG_CORE_LARGE_PHYS_ADDR for 64bit paddr_t

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Dump call stack on TA panic

Adds support for dumping the call stack of a user-mode TA when it
panics. Stack unwinding happens in kernel mode by re-using
abort_print_error() in core/arch/arm/kernel/a

Dump call stack on TA panic

Adds support for dumping the call stack of a user-mode TA when it
panics. Stack unwinding happens in kernel mode by re-using
abort_print_error() in core/arch/arm/kernel/abort.c. Like for abort
dumps, the helper script scripts/symbolize.py may be used to obtain
source-level information.

This feature is enabled by default. Set CFG_UNWIND=n to disable it
(or CFG_TEE_CORE_DEBUG=n).

In libutee, the utee_panic() syscall wrapper is renamed __utee_panic()
and now takes an additional parameters: a stack pointer, in addition to
the panic code. utee_panic() is written in assembly and pushes some
registers onto the stack before calling __utee_panic(). When it is time
to return from syscall_panic(), tee_svc_sys_return_helper() uses the
stack pointer to get the information needed to unwind the TA stack.
A struct abort_info is created and abort_print_error() is called.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey 32/64)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMUv8)

show more ...

libutee: add unwind pseudo-ops to syscall wrappers

It is currently not possible to unwind a call stack from within a
syscall wrapper, that is the utee_xxx() functions such as utee_panic()
for instan

libutee: add unwind pseudo-ops to syscall wrappers

It is currently not possible to unwind a call stack from within a
syscall wrapper, that is the utee_xxx() functions such as utee_panic()
for instance. That is because the assembler macro that defines the
utee_ functions lacks the proper .fnstart/.save/.fnend pseudo-ops.
Add them.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: remove Trusted UI code

Removes all the TUI-related code from libutee (lib/libutee/tui), as
well as its dependencies: lib/libpng and lib/libzlib. Two reasons for
this:
1. This is far from b

libutee: remove Trusted UI code

Removes all the TUI-related code from libutee (lib/libutee/tui), as
well as its dependencies: lib/libpng and lib/libzlib. Two reasons for
this:
1. This is far from being a complete and testable TUI implementation.
In other words, it is dead code, more or less.
2. lib/libzlib (version 1.2.8) contains several CVE vulnerabilities.
Even if the code is not used, it may trigger some code analysis tools
and is a problem for some projects.

Reported-by: Jianhui Li <airbak.li@hisilicon.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutils: malloc: use asan_memset_unchecked()

The malloc implementation uses the new asan_memset_unchecked() function
internally instead of memset() to avoid unexpected asserts when the
address sani

libutils: malloc: use asan_memset_unchecked()

The malloc implementation uses the new asan_memset_unchecked() function
internally instead of memset() to avoid unexpected asserts when the
address sanitizer is enabled.

bget() tags the requested amount of memory allocated, but eventual
padding etc isn't tagged so writes there from instrumented functions,
for instance the normal memset(), will be caught.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: printf() fix: remove newline added by mistake

puts() was recently modified [1] to always add a trailing newline (\n).
This change has broken printf() which uses puts() internally.

Fix the

libutee: printf() fix: remove newline added by mistake

puts() was recently modified [1] to always add a trailing newline (\n).
This change has broken printf() which uses puts() internally.

Fix the issue by calling trace_ext_puts() instead.

Fixes: 6246cc9d957c ("libutee: puts(): add trailing newline")
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add support for early Trusted Applications

Early TAs are user-mode Trusted Applications that are embedded at link
time in the TEE binary. A special read-only data section is used to
store them (.rod

Add support for early Trusted Applications

Early TAs are user-mode Trusted Applications that are embedded at link
time in the TEE binary. A special read-only data section is used to
store them (.rodata.early_ta). A Python script takes care of converting
the TAs into a C source file with the proper linker section attribute.

The feature is disabled by default. To enable it, the paths to the TA
binaries have to be given in $(EARLY_TA_PATHS). They should be ELF
files. Typical build steps:
$ make ... CFG_EARLY_TA=y ta_dev_kit # (1)
$ # ... build the TAs ... # (2)
$ make ... EARLY_TA_PATHS=path/to/<uuid>.stripped.elf # (3)
Notes:
- Setting CFG_EARLY_TA=y during the first step (1) is not necessary,
but it will avoid rebuilding libraries during the third step (3)
- CFG_EARLY_TA is automatically enabled when EARLY_TA_PATHS is non-empty
in step (3)
- Several TAs may be given in $(EARLY_TA_PATHS) (3)

Early TAs are given a higher load priority than REE FS TAs, since they
should be available even before tee-supplicant is ready.

Suggested-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: clean and unwind arm32_aeabi_[l]divmod_a32.S

Division support can be used in kernel land and user land. Kernel
land already support unwind on assembly (kernel/unwind.h) but
userland do not. Fo

core: clean and unwind arm32_aeabi_[l]divmod_a32.S

Division support can be used in kernel land and user land. Kernel
land already support unwind on assembly (kernel/unwind.h) but
userland do not. For simplicity of the userland part, simply
define local macros to support unwind in both conditions.

Clean ldivmod from locally defined macros already provided by arm.S.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix memory address comparison

Addresses are unsigned values. Subtracting address values results
in an unsigned value. Since qsort comparison function expects a signed
integer return value, the

core: fix memory address comparison

Addresses are unsigned values. Subtracting address values results
in an unsigned value. Since qsort comparison function expects a signed
integer return value, the unsigned address subtraction value gets
signed and can produce a wrong result. This change overcomes the issue
by producing a +1/0/-1 signed value based on the address unsigned
values comparison.

Introduce CMP_TRILEAN() in util.h to implement the operation.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: puts(): add trailing newline

puts() should print the supplied string and a trailing newline. Fix it
accordingly.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by:

libutee: puts(): add trailing newline

puts() should print the supplied string and a trailing newline. Fix it
accordingly.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: printf(): remove prefix and other non-standard behavior

Our implementation of printf() does not comply with the standards,
because it adds a prefix to the output and may print truncation
ch

libutee: printf(): remove prefix and other non-standard behavior

Our implementation of printf() does not comply with the standards,
because it adds a prefix to the output and may print truncation
characters. By doing so it becomes inconsistent with puts(). It is a
problem because the compiler has the ability to perform optimizations
and, in some cases, may invoke puts() instead of printf().

Therefore, remove any output that is not strictly specified in the
printf() parameters.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: provide an implementation of putchar()

Calling printf() from a TA to print a single character results in a
linker error:

39 TEE_Result TA_CreateEntryPoint(void)
40 {
41 pr

libutee: provide an implementation of putchar()

Calling printf() from a TA to print a single character results in a
linker error:

39 TEE_Result TA_CreateEntryPoint(void)
40 {
41 printf(".");
42 /* ... */
43 }

hello_world_ta.o: In function `TA_CreateEntryPoint':
hello_world_ta.c:41: undefined reference to `putchar'

In this case, the compiler has optimized the printf() call into a call
to putchar(), assuming that we have a C library and that it complies to
the relevant standards (so that printf() and putchar() may be used
interchangeably).

One way to fix the issue is to prevent such optimizations by using
-fno-builtin or -ffreestanding, at the cost of slightly larger code
size and possibly reduced performance.

Another option is to simply provide the missing putchar() function. It
is the purpose of this commit.

Reported-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libzlib: gcc7 ready

Updates compiler flags to make libzlib gcc7 ready.

Reviewed-by: Igor Opaniuk <igor.opaniuk@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

libpng: gcc7 ready

Updates compiler flags to make libpng gcc7 ready.

Reviewed-by: Igor Opaniuk <igor.opaniuk@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

libmpa: Implement Montgomery ladder

The mpa_exp_mod() function implements a LtoR algorithm. The LtoR
algorithm is sensitive to timing attacks since it leaks information
about the exponent since it's

libmpa: Implement Montgomery ladder

The mpa_exp_mod() function implements a LtoR algorithm. The LtoR
algorithm is sensitive to timing attacks since it leaks information
about the exponent since it's doing a different amount of work in each
loop when doing the modular exponentiation. It will always do a square
in each loop, but it will also do an additional multiply when the
exponent bit k=1.

This patch implements the Montgomery ladder (and thereby replaces the
old LtoR implementation), which always does the same amount of
operations in each loop and thereby make it more robust to timing
attacks.

Fixes: OP-TEE-2016-0002 which was reported by Applus+ Laboratories.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey, GP)
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260, GP)

show more ...