plat-k3: drivers: Set firewall for DTHEv2 RNG

Set firewall to protect DTHEv2 RNG from non-secure world.

Signed-off-by: Suhaas Joshi <s-joshi@ti.com>
Reviewed-by: T Pratham <t-pratham@ti.com>
Review

plat-k3: drivers: Set firewall for DTHEv2 RNG

Set firewall to protect DTHEv2 RNG from non-secure world.

Signed-off-by: Suhaas Joshi <s-joshi@ti.com>
Reviewed-by: T Pratham <t-pratham@ti.com>
Reviewed-by: Andrew Davis <afd@ti.com>

show more ...

plat-k3: drivers: Remove code to get firewall configs

The ti_crypto_init_rng_fwl() function gets firewall configurations
before setting new ones. This is pointless, since we are not using
the config

plat-k3: drivers: Remove code to get firewall configs

The ti_crypto_init_rng_fwl() function gets firewall configurations
before setting new ones. This is pointless, since we are not using
the configurations that we get anywhere. Therefore remove these blocks
of code.

Signed-off-by: Suhaas Joshi <s-joshi@ti.com>
Reviewed-by: Andrew Davis <afd@ti.com>
Reviewed-by: T Pratham <t-pratham@ti.com>

show more ...

plat-k3: drivers: Refactor SA2UL RNG firewall setup

sa2ul_init() contains code to set firewall for SA2UL RNG. However,
almost the same code can also be used to firewall DTHEv2 RNG. Therefore
refacto

plat-k3: drivers: Refactor SA2UL RNG firewall setup

sa2ul_init() contains code to set firewall for SA2UL RNG. However,
almost the same code can also be used to firewall DTHEv2 RNG. Therefore
refactor this code into a separate function in the ti_sci driver.

Signed-off-by: Suhaas Joshi <s-joshi@ti.com>
Reviewed-by: T Pratham <t-pratham@ti.com>
Reviewed-by: Andrew Davis <afd@ti.com>

show more ...

core: mm: add extra xlat table when core ASan is enabled

Enabling CFG_CORE_SANITIZE_KADDRESS increases MMU translation
table usage in multiple ways. In addition to ASan shadow regions,
the overall s

core: mm: add extra xlat table when core ASan is enabled

Enabling CFG_CORE_SANITIZE_KADDRESS increases MMU translation
table usage in multiple ways. In addition to ASan shadow regions,
the overall size of the core image grows, including code, data,
and stack mappings. This often leads to additional page table splits
and higher xlat table consumption.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

plat-stm32mp1: default enable CFG_STM32_DEBUG_ACCESS_PTA

In order to handle request on the debug configuration, default enable
CFG_STM32_DEBUG_ACCESS_PTA to embed the debug access PTA.

Signed-off-b

plat-stm32mp1: default enable CFG_STM32_DEBUG_ACCESS_PTA

In order to handle request on the debug configuration, default enable
CFG_STM32_DEBUG_ACCESS_PTA to embed the debug access PTA.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

pta: stm32mp: add debug access PTA

Add the debug access PTA that is responsible of validating whether
a given debug profile is configured or not. This basically means that
the debug configuration sh

pta: stm32mp: add debug access PTA

Add the debug access PTA that is responsible of validating whether
a given debug profile is configured or not. This basically means that
the debug configuration should allow (at least!) access to the debug
peripherals requiring the debug profile being checked.

For now, as it is specific to BSEC, only embed the PTA if the BSEC support
is embedded as well.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

core: arm: fix feat_pauth_implemented not consider QARMA3 algorithm

The feat_pauth_implemented function does not take
ID_AA64ISAR2_EL1.{GPA3,APA3} into account, which indicates the
processor support

core: arm: fix feat_pauth_implemented not consider QARMA3 algorithm

The feat_pauth_implemented function does not take
ID_AA64ISAR2_EL1.{GPA3,APA3} into account, which indicates the
processor supports the QARMA3.

According to Arm's documentation, ID_AA64ISAR1_EL1.{GPI,GPA,API,APA}
should be zero if ID_AA64ISAR2_EL1.{GPA3,APA3} are non-zero.
Therefore, OP-TEE wrongly reports that PAC is not available to TA
when the CPU uses QARMA3 algorithm.

This commit also introduces the register read function and related
definitions for ID_AA64ISAR2_EL1.

Signed-off-by: Leo Chen <shf.chen@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: dt: add overlay support to dt_enable_secure_status

Add support to write the "secure-status" property to overlays in
addition to the inline DTB changes if the user enabled the overlay
support.

core: dt: add overlay support to dt_enable_secure_status

Add support to write the "secure-status" property to overlays in
addition to the inline DTB changes if the user enabled the overlay
support.

Most BL33 firmwares don't reuse the DTB provided to OP-TEE. Therefore
add an overlay for the requested node to not lose the changes done by
OP-TEE. The overlay can be used by the BL33 firmware to apply the
changes.

Reviewed-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>

show more ...

core: dt: add add_dt_node_overlay_fragment helper

Add a helper to add overlays to an external-dt for a caller provided
node. The overlay can be used by the caller to overwrite node
properties. The s

core: dt: add add_dt_node_overlay_fragment helper

Add a helper to add overlays to an external-dt for a caller provided
node. The overlay can be used by the caller to overwrite node
properties. The subsequent BL33 can use the overlay to apply the changes
to the BL33 DTB and kernel DTB.

Reviewed-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>

show more ...

core: dt: add support to pass target-path to add_dt_overlay_fragment

Exentend the API to be able to specify the DTB overlay "target-path".

Reviewed-by: Etienne Carriere <etienne.carriere@st.com>
Si

core: dt: add support to pass target-path to add_dt_overlay_fragment

Exentend the API to be able to specify the DTB overlay "target-path".

Reviewed-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>

show more ...

core: dt: fix add_res_mem_dt_node for _CFG_USE_DTB_OVERLAY use-cases

Currently add_res_mem_dt_node() doesn't add a overlay fragment if
CFG_EXTERNAL_DTB_OVERLAY=y and the provided DTB already contain

core: dt: fix add_res_mem_dt_node for _CFG_USE_DTB_OVERLAY use-cases

Currently add_res_mem_dt_node() doesn't add a overlay fragment if
CFG_EXTERNAL_DTB_OVERLAY=y and the provided DTB already contains a
"/reserved-memory" e.g. due to some co-processor reserved-memory
descriptions.

To fix this add_res_mem_dt_node() must always add a "/reserved-memory"
DTB overlay fragment if a DTB overlay shall be created
(_CFG_USE_DTB_OVERLAY=y).

Reviewed-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>

show more ...

core: tee_ree_fs: remove corrupt file without rollback protection

During the creation of the OP-TEE REE-FS database file, several
RPC commands are executed. If an unexpected power outage occurs
duri

core: tee_ree_fs: remove corrupt file without rollback protection

During the creation of the OP-TEE REE-FS database file, several
RPC commands are executed. If an unexpected power outage occurs
during this process, it may result in an incomplete dirf.db file
with a size of 0 bytes, and this file has not yet been configured
with rollback protection.

This change extends the error handling in ree_fs_open_primitive
function to conditionally remove the corrupted file when rollback
protection is not set, allowing the caller to recreate the file
later. This also resolves the previously mentioned dirf.db issue.

Link: https://github.com/OP-TEE/optee_os/issues/7512
Signed-off-by: Ox Yeh <ox.yeh@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

core: atomic ftrace buffer map update

When switching sessions, that is, calling ts_push_current_session() or
ts_pop_current_session(), a foreign interrupt may save the current
thread. When this happ

core: atomic ftrace buffer map update

When switching sessions, that is, calling ts_push_current_session() or
ts_pop_current_session(), a foreign interrupt may save the current
thread. When this happens, the ftrace buffer mapping must be consistent
with the current session, or bad things, like OP-TEE core crashing or
corrupting TA memory, might occur. Fix this by masking foreign
interrupts while updating the linked list, and disable the ftrace buffer
while setting new TA mappings.

All mappings of a TA are removed if the TA crashes, even if user
mappings might still be active. Add checks in the functions accessing
the ftrace buffer that the buffer is accessible before accessing it to
avoid eventual OP-TEE core crashes.

Fixes: 17513217b24c ("ftrace: dump ftrace after every ta_entry")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Acked-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>

show more ...

core: user_ta: fix cleared userspace PAUTH keys

Restore pointer authentication keys that were cleared when commit
referenced below was integrated since vm_info_init(), called after
the keys are gene

core: user_ta: fix cleared userspace PAUTH keys

Restore pointer authentication keys that were cleared when commit
referenced below was integrated since vm_info_init(), called after
the keys are generated, resets the user context structure.

Closes: https://github.com/OP-TEE/optee_os/issues/7659
Fixes: 614b28146e96 ("core: user_ta: PAUTH key initialization may fail")
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Reviewed-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

zynqmp: add platform_banner for ZynqMP

Add a platform_banner for zynqmp platforms.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Acked-by: Etienne Carriere <etienne.carriere@st.com>
Reviewed-by:

zynqmp: add platform_banner for ZynqMP

Add a platform_banner for zynqmp platforms.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Acked-by: Etienne Carriere <etienne.carriere@st.com>
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>

show more ...

zynqmp: add flavors for kria starter kits

Add PLATFORM_FLAVOR for kd240, kr260 and kv260 kria starter kits.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Acked-by: Etienne Carriere <etienne.carr

zynqmp: add flavors for kria starter kits

Add PLATFORM_FLAVOR for kd240, kr260 and kv260 kria starter kits.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Acked-by: Etienne Carriere <etienne.carriere@st.com>
Reviewed-by: Ricardo Salveti <ricardo@foundries.io>

show more ...

core: only dump ftrace buffer with TA mapped

The ftrace buffer is mapped in secure user space. The dump_ftrace()
callback must only be called if the buffer is mapped. During TA panic
the dump_ftrace

core: only dump ftrace buffer with TA mapped

The ftrace buffer is mapped in secure user space. The dump_ftrace()
callback must only be called if the buffer is mapped. During TA panic
the dump_ftrace() might get called as part of the TA context cleanup and
cause a crash. So fix this by skipping the dump_ftrace() callback during
those occasions.

Fixes: 17513217b24c ("ftrace: dump ftrace after every ta_entry")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

core: riscv: kernel: simplify hartid query API

The thread_get_hartid_by_hartindex() function is removed as there
is no need to query remote hartids. Additionally, using this API
before secondary har

core: riscv: kernel: simplify hartid query API

The thread_get_hartid_by_hartindex() function is removed as there
is no need to query remote hartids. Additionally, using this API
before secondary hart initialization would return incorrect values.

Replace with the simpler thread_get_hartid() which returns the current
hart's ID reliably.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

core: riscv: kernel: add hart index sanity check

Add debug-only bounds checking in __get_core_pos() to prevent
out-of-bounds array access into per-core data structures.

Signed-off-by: Yu-Chien Pete

core: riscv: kernel: add hart index sanity check

Add debug-only bounds checking in __get_core_pos() to prevent
out-of-bounds array access into per-core data structures.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

drivers: caam: improve empty aad updates

In caam_ae_update_aad an update without data was already handled as long
as the data pointer was NULL. This change updates the logic to also
account for the

drivers: caam: improve empty aad updates

In caam_ae_update_aad an update without data was already handled as long
as the data pointer was NULL. This change updates the logic to also
account for the case where the pointer is non-null but the length is
zero. When that was the case caam_cpy_buf would exit early without
allocating, leaving aad->data as NULL, making caam_cpy_block_src fail.

This was found through the Android Keymint tests because Rust represents
empty buffers (Rust slices) with a non-null pointer and length 0.

Fixes: faaf0c5975d2 ("drivers: caam: Add AES GCM")
Signed-off-by: Martin Nyhus <martin@nyhus.dev>
Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>

show more ...

core: pta: add Rockchip secure boot PTA

The S_OTP area for the Rockchip secure boot RSA hash and status register
is accessible only from the secure world. Thus, secure boot must be
enabled from the

core: pta: add Rockchip secure boot PTA

The S_OTP area for the Rockchip secure boot RSA hash and status register
is accessible only from the secure world. Thus, secure boot must be
enabled from the secure world on these board.

The PTA implements 3 functions:

1. Ask the TA from the non-secure world about the current status and hash
of the hardware. This allows to inspect the current status of secure
boot on a specific device.

2. Write an RSA hash into the OTP fuses. It's the responsibility of the
user to calculate the hash and ensure that it matches the key, which
will be used to sign the images.

3. Actually lockdown the device by enabling secure boot. This is a
separate step to allow the user to verify the setup before
potentially bricking a device.

With these functions, a user may use a client running in the normal
world (for example in a boot loader or operating system) to enable
secure boot on a Rockchip device.

Implementing secure boot setup as an OP-TEE PTA has the advantage that
secure boot can be enabled at any time during the device setup instead
of during early boot. This allows a developer/user or additional scripts
to interact with the secure boot setup process.

The hash of the root key is accepted and reported as calculated by
sha256sum and internally converted to the correct byte order that needs
to be burned into the fuses.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

plat-rockchip: rk3588: define more OTP indexes

The OTP area contains other values in addition to the HW_UNIQUE_KEY. For
example, the SECURE_BOOT_STATUS and the RSA_HASH, which are used by the
ROM co

plat-rockchip: rk3588: define more OTP indexes

The OTP area contains other values in addition to the HW_UNIQUE_KEY. For
example, the SECURE_BOOT_STATUS and the RSA_HASH, which are used by the
ROM code to verify booted images, are located there as well.

Define the index (in 32 bit words) and length (in 32 bit words) of these
values, too, to allow applications to read and write these locations.

Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: dump ftrace after every ta_entry

This patch implements the feature to dump ftrace buffer to
tee_supplicant after every entry to the ta.
To implement the feature, this patch does some modific

ftrace: dump ftrace after every ta_entry

This patch implements the feature to dump ftrace buffer to
tee_supplicant after every entry to the ta.
To implement the feature, this patch does some modification to the
ftrace dumping process and add a new config CFG_FTRACE_DUMP_EVERY_ENTRY
to control this behavior.
This can reduce the chance of losing the ftrace data due to not
enough ftrace buffer and make debugging long-lived TA possible.

Signed-off-by: Leo Chen <shf.chen@mediatek.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

plat: qcom: add platform banner

Display a basic platform banner.

Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-b

plat: qcom: add platform banner

Display a basic platform banner.

Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Tony Hamilton <tonyh@qti.qualcomm.com>

show more ...

drivers: qcom: prng: add PRNG driver

The Qualcomm PRNG hardware generates cryptographic keys and random
numbers.

The PRNG is configured by the first-stage bootloader. This includes the
reseed frequ

drivers: qcom: prng: add PRNG driver

The Qualcomm PRNG hardware generates cryptographic keys and random
numbers.

The PRNG is configured by the first-stage bootloader. This includes the
reseed frequency.

This driver only consumes the generated output.

Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Tony Hamilton <tonyh@qti.qualcomm.com>

show more ...