core: arm64: increase thread stack size with KASAN/check-stacks

Increase STACK_THREAD_SIZE from 10 KiB to 12 KiB when
CFG_CORE_SANITIZE_KADDRESS is enabled.

With the previous size, some regression

core: arm64: increase thread stack size with KASAN/check-stacks

Increase STACK_THREAD_SIZE from 10 KiB to 12 KiB when
CFG_CORE_SANITIZE_KADDRESS is enabled.

With the previous size, some regression tests (for example
regression_1006 "Test Basic OS features") may fail due to stack
canary corruption caused by the additional stack usage from
instrumentation.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ffa: verify thread ID before resuming S-EL0 SP

Check that the thread ID for an S-EL0 SP is correct before trying to
resume it. This guards against resuming an unrelated thread.

Signed-off-by:

core: ffa: verify thread ID before resuming S-EL0 SP

Check that the thread ID for an S-EL0 SP is correct before trying to
resume it. This guards against resuming an unrelated thread.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: ffa: fix direct request error code for S-EL0 SP

Direct requests to S-EL0 SPs are delivered using a thread. If no thread
is available return FFA_BUSY, to let the caller know that it should try

core: ffa: fix direct request error code for S-EL0 SP

Direct requests to S-EL0 SPs are delivered using a thread. If no thread
is available return FFA_BUSY, to let the caller know that it should try
again. This should normally never happen, but let's do our best for a
corner case.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: support dynamic protected memory lending

With CFG_CORE_DYN_PROTMEM=y support dynamic protected memory lending.

A new internal struct mobj_ffa_rsm is added to handle dynamic protected
memory f

core: support dynamic protected memory lending

With CFG_CORE_DYN_PROTMEM=y support dynamic protected memory lending.

A new internal struct mobj_ffa_rsm is added to handle dynamic protected
memory for FF-A.

A new internal struct mobj_protmem is add to handle dynamic protected
memory without FF-A.

Lending non-secure memory to OP-TEE to use it as protected memory means
that it should to become inaccessible by the normal world as part of the
process. This part is currently not supported, since it must be done in
a platform specific way for platforms that support that. QEMU don't
support that.

Adding two platform specific functions, plat_get_protmem_config() and
plat_set_protmem_range() for dynamic protected memory. The functions has
__weak implementation to allow easier testing. However,
plat_set_protmem_range() requires CFG_INSECURE=y since it doesn't change
memory protection.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: dynamic allocation of thread_core_local and its stacks

With CFG_DYN_CONFIG enabled, use dynamic allocation of thread_core_local
and the two stacks, tmp_stack and abt_stack, recorded in it.

Si

core: dynamic allocation of thread_core_local and its stacks

With CFG_DYN_CONFIG enabled, use dynamic allocation of thread_core_local
and the two stacks, tmp_stack and abt_stack, recorded in it.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: arm64: increase tmp stack size for debug

Increase STACK_TMP_SIZE when CFG_CORE_DEBUG_CHECK_STACKS=y.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jero

core: arm64: increase tmp stack size for debug

Increase STACK_TMP_SIZE when CFG_CORE_DEBUG_CHECK_STACKS=y.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: arm: ffa: add framework for Logical SPs

Add a framework to register Logical Secure Partitions in parallel with
OP-TEE at S-EL1. This is akin to Pseudo TAs, it provides an ABI but it's
part of

core: arm: ffa: add framework for Logical SPs

Add a framework to register Logical Secure Partitions in parallel with
OP-TEE at S-EL1. This is akin to Pseudo TAs, it provides an ABI but it's
part of the OP-TEE binary. A critical difference is that it's only
available for FF-A and can only use the non-threaded environment, that
is, no mutexes or RPC.

The logical OP-TEE core partition is registered in the framework. The
SPMC is also registered in the framework, but with a nil UUID so it's
not returned by FFA_PARTITION_INFO_GET.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Akshay Belsare <akshay.belsare@amd.com>

show more ...

core: ffa: sp_partition_info_get() takes uuid_words[]

Replace the TEE_UUID *ffa_uuid parameter with uint32_t ffa_uuid_words[4]
to simplify how sp_partition_info_get() is called.

Signed-off-by: Jens

core: ffa: sp_partition_info_get() takes uuid_words[]

Replace the TEE_UUID *ffa_uuid parameter with uint32_t ffa_uuid_words[4]
to simplify how sp_partition_info_get() is called.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Akshay Belsare <akshay.belsare@amd.com>

show more ...

core: ffa: add spmc_is_reserved_id()

Add spmc_is_reserved_id() and replace direct checks against spmd_id and
spmc_id. spmd_id and spmc_id are changed to static variables since they
don't need to be

core: ffa: add spmc_is_reserved_id()

Add spmc_is_reserved_id() and replace direct checks against spmd_id and
spmc_id. spmd_id and spmc_id are changed to static variables since they
don't need to be exported any longer.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Akshay Belsare <akshay.belsare@amd.com>

show more ...

core: arm: ffa: use SMC Calling Convention 1.2

Add struct thread_smc_1_2_regs as a replacement for struct
thread_smc_args when dealing with FF-A SMCs. struct thread_smc_1_2_regs
covers the registers

core: arm: ffa: use SMC Calling Convention 1.2

Add struct thread_smc_1_2_regs as a replacement for struct
thread_smc_args when dealing with FF-A SMCs. struct thread_smc_1_2_regs
covers the registers x0-x17 to support passing arguments and results
according to SMC Calling Convention (SMCCC) version 1.2.

The difference is that before this change x8-x17 couldn't be used as
argument nor result and the content was preserved. With this patch are
x8-x17 returned as zeroes. New FF-A SMCs can take and return values in
the full range x0-x17.

64-bit SMCCC version 1.1 and earlier specified x4-x17 as unpredictable
or scratch registers. FF-A has specified x0-x7 as argument and result
registers, regardless of SMCCC. This has changed with SMCCC version 1.2
where the two standards harmonize on this.

struct thread_smc_1_2_regs is added in a 32-bit version for
compatibility, but it only covers r0-r7.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: arm64: increase thread stack size for debug

Increase STACK_THREAD_SIZE when CFG_CORE_DEBUG_CHECK_STACKS=y.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Foriss

core: arm64: increase thread stack size for debug

Increase STACK_THREAD_SIZE when CFG_CORE_DEBUG_CHECK_STACKS=y.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: arm64: increase size of abort stack to 4096

To avoid stack overruns with CFG_WITH_PAGER=y and
CFG_CORE_DEBUG_CHECK_STACKS=y increase the abort stack from 3072 to
4096.

Signed-off-by: Jens Wik

core: arm64: increase size of abort stack to 4096

To avoid stack overruns with CFG_WITH_PAGER=y and
CFG_CORE_DEBUG_CHECK_STACKS=y increase the abort stack from 3072 to
4096.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: ffa: read S-EL0 SP properties from manifest

So far the properties of S-EL0 SPs have been hardcoded when queried by
FFA_PARTITION_INFO_GET. This was supposed to be a temporary workaround,
so re

core: ffa: read S-EL0 SP properties from manifest

So far the properties of S-EL0 SPs have been hardcoded when queried by
FFA_PARTITION_INFO_GET. This was supposed to be a temporary workaround,
so replace this with reading the properties from the SP's manifest which
is the proper solution.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

show more ...

core: arm: increase tmp stack for CFG_NS_VIRTUALIZATION

CFG_NS_VIRTUALIZATION requires slightly more stack when enabled so add
that to the group of conditions using the larger tmp stack.

Signed-off

core: arm: increase tmp stack for CFG_NS_VIRTUALIZATION

CFG_NS_VIRTUALIZATION requires slightly more stack when enabled so add
that to the group of conditions using the larger tmp stack.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: ffa: Deny unsupported memory sharing operations

Fragmented memory sharing operations and memory sharing where the
transaction descriptors are forwarded in a custom buffer are not
supported for

core: ffa: Deny unsupported memory sharing operations

Fragmented memory sharing operations and memory sharing where the
transaction descriptors are forwarded in a custom buffer are not
supported for SP destinations. Return early FFA_ERROR if these
conditions are detected.
Add CFG_NS_VIRTUALIZATION condition for virt_unset_guest calls in
thread_spmc.c as a minor refactoring step.

Signed-off-by: Imre Kis <imre.kis@arm.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: fix race condition on TA/PTA/StMM context loading

Fix race condition on creation of a context for single instance TAs,
PTAs or StMM application. Such race condition could occur and lead to
dup

core: fix race condition on TA/PTA/StMM context loading

Fix race condition on creation of a context for single instance TAs,
PTAs or StMM application. Such race condition could occur and lead to
duplicated contexts if connected close enough that they are created
after tee_ta_init_session() calls tee_ta_init_session_with_context()
and before the context are added in the centralized context list.

This is realized by keeping tee_ta_mutex held while tee_ctxes list is
looked up for matching a context or a new context is added into that
list with its .is_initializing field activated. For that purpose
user TA and StMM application initialization function are split in
2 functions, the 2nd one used to finalizes the context creation
started in the 1st function.

By the way, add inline description comments and fix indentation issues
in uaer_ta.h and remove the inline comment in pseudo_ta.c that refers
to TA loading whereas the function relates to PTA contexts creation.

Closes: https://github.com/OP-TEE/optee_os/issues/6801
Suggested-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: make is_initializing field a generic service context

Replace fields is_initializing from struct user_mode_ctx and
struct stmm_ctx with a common new field is_initialing in generic
struct tee_ta

core: make is_initializing field a generic service context

Replace fields is_initializing from struct user_mode_ctx and
struct stmm_ctx with a common new field is_initialing in generic
struct tee_ta_ctx so that it can be used in generic context loading
functions for contexts which initialization is done with tee_ta_mutex
released.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: spmc, sp: cleanup FF-A ID handling

When OP-TEE implements the S-EL1 SPMC, from an FF-A point-of-view the
core OP-TEE functionality is running in a logical SP that resides at the
same exception

core: spmc, sp: cleanup FF-A ID handling

When OP-TEE implements the S-EL1 SPMC, from an FF-A point-of-view the
core OP-TEE functionality is running in a logical SP that resides at the
same exception level as the SPMC. This means that the SPMC and the SP
should have separate FF-A IDs, i.e. the SPMC ID and a normal endpoint ID
for the SP. The SPMC ID is described in the SPMC manifest which gets
parsed by the SPMD, so this ID should be queried from the SPMD. OP-TEE's
endpoint ID is assigned by the SPMC.

Currently OP-TEE's FF-A endpoint ID and the SPMC ID are mixed together
and hardcoded, this patch implements the correct ID handling mechanism
as described above.

Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

show more ...

core: arm64: increase STACK_ABT_SIZE from 1024 to 3072 when log level is 0

When adding "make check CFG_WITH_PAGER=y CFG_TEE_CORE_LOG_LEVEL=0" to
the QEMUv8 CI job, I noticed that OP-TEE fails to boo

core: arm64: increase STACK_ABT_SIZE from 1024 to 3072 when log level is 0

When adding "make check CFG_WITH_PAGER=y CFG_TEE_CORE_LOG_LEVEL=0" to
the QEMUv8 CI job, I noticed that OP-TEE fails to boot and hangs with no
message printed on the console. The root cause is memory corruption of
the translation tables triggered by a stack overflow. Indeed, the pager
uses the abort stack to handle unmapped pages, and therefore it requires
quite a bit of stack space. The log level is not very relevant.
Therefore, fix the issue by removing the particular case for log level 0.

More debugging info:

build$ make -j$(nproc) CFG_WITH_PAGER=y CFG_TEE_CORE_LOG_LEVEL=0 \
CFG_CORE_ASLR=n
build$ aarch64-linux-gnu-nm -n ../optee_os/out/arm/core/tee.elf
...
000000000e115000 B __nozi_start
000000000e115000 b thread_user_kdata_page
000000000e116000 b xlat_tables_ul1
000000000e118000 b xlat_tables
000000000e11d000 b base_xlation_table
000000000e11d100 B __nozi_end
000000000e11d100 B __nozi_stack_start
000000000e11d100 b stack_abt
000000000e11e200 B stack_tmp
...
build$ make run-only
optee_qemuv8$ gdb-multiarch
(gdb) symbol-file optee_os/out/arm/core/tee.elf
(gdb) target remote localhost:1234
(gdb) p sizeof(base_xlation_table)
$1 = 256
(gdb) watch *(char [256]*)base_xlation_table
(gdb) c # 5 times
Thread 1 hit Hardware watchpoint 1: *(char [256]*)base_xlation_table
(gdb) bt

At this point the call stack is:

hash_sha256_check()
fobj_load_page()
pager_deploy_page()
pager_get_page()
tee_pager_handle_fault()
abort_handler()
el1_sync_abort()

This code is indeed not supposed to touch base_xlation_table, it does
so due to the overflow of stack_abt.

Suggested-by: Jens Wikander <jens.wiklander@linaro.org>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: kernel: factorize delay and timeout implementation

Factorize RISC-V and Arm architectures implementation of delay and
timeout API functions into generic core kernel source directory.

Architec

core: kernel: factorize delay and timeout implementation

Factorize RISC-V and Arm architectures implementation of delay and
timeout API functions into generic core kernel source directory.

Architecture or platform only need to implement timer tick count
read function delay_cnt_read() and timer tick frequency (in Hertz)
delay_cnt_freq() which is related to CFG_CORE_HAS_GENERIC_TIMER support.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: ffa: add SPMC_CORE_SEL1_MAX_SHM_COUNT

Add SPMC_CORE_SEL1_MAX_SHM_COUNT, telling how many shared memory object
are supported in a configuration with SPMC at S-EL1.

Signed-off-by: Jens Wiklande

core: ffa: add SPMC_CORE_SEL1_MAX_SHM_COUNT

Add SPMC_CORE_SEL1_MAX_SHM_COUNT, telling how many shared memory object
are supported in a configuration with SPMC at S-EL1.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: add pl310_nsbase() function

Add pl310_nsbase() function to return non-secure PL310 base address.

The default implementation is a weak function that returns the secure
PL310 base address to ma

core: add pl310_nsbase() function

Add pl310_nsbase() function to return non-secure PL310 base address.

The default implementation is a weak function that returns the secure
PL310 base address to match the previous behavior where only the secure
base address was returned.

It is up to the platform to implement that function.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ffa: add notifications with SPMC at S-EL1

Adds support for asynchronous notifications via FF-A with SPMC at S-EL1.

The OP-TEE FF-A ABI is extended to report support for asynchronous
notificat

core: ffa: add notifications with SPMC at S-EL1

Adds support for asynchronous notifications via FF-A with SPMC at S-EL1.

The OP-TEE FF-A ABI is extended to report support for asynchronous
notifications during OPTEE_FFA_EXCHANGE_CAPABILITIES.

The SPMC at S-EL1 is extended to provide the FF-A notifications ABI to a
normal world VM.

The notifications depends on having a non-secure SGI interrupt ID
available to notify normal world that a notification is pending.
Notifications becomes available once platform code has called
thread_spmc_set_async_notif_intid() with a designed SGI ID.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: prefix header file guard names with __

Improves header files guard names consistency by using a __ prefix
where missing.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by:

core: prefix header file guard names with __

Improves header files guard names consistency by using a __ prefix
where missing.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: fix header file guard names

Fixes header file guards macro name prefix (mostly missing occurrences)
that should reflect the file base directory sub-path where applicable.

Reviewed-by: Jens Wi

core: fix header file guard names

Fixes header file guards macro name prefix (mostly missing occurrences)
that should reflect the file base directory sub-path where applicable.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...