core: user_ta: load_elf(): return meaningful error code

If any error is encountered when the TEE core attempts to load a TA from
TA storage, the next storage is tried and so on until the TA is
succe

core: user_ta: load_elf(): return meaningful error code

If any error is encountered when the TEE core attempts to load a TA from
TA storage, the next storage is tried and so on until the TA is
successfully loaded or there is no more storage to try. In this case, a
generic error code (TEE_ERROR_ITEM_NOT_FOUND) is returned to the caller
of load_elf() and ultimately to the client. This is not super useful,
especially when debug traces are disabled, because the user has no way
to differentiate a true "not found" situation (which might be a
configuration or deployement issue) from an issue with the TA file
itself or an out-of-memory condition etc.

This commit changes the return code of load_elf() to better reflect the
errors. When load_elf_from_store() returns TEE_ERROR_ITEM_NOT_FOUND or
TEE_ERROR_STORAGE_NOT_AVAILABLE, the next storage is tried.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

drivers: bcm_gpio: add IPROC GPIO driver

low level driver for Broadcom IPROC GPIO controller.

Signed-off-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>
Acked-by: Etienne Carriere <etienne.car

drivers: bcm_gpio: add IPROC GPIO driver

low level driver for Broadcom IPROC GPIO controller.

Signed-off-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Victor Chong <victor.chong@linaro.org>

show more ...

plat-bcm: update platform configurations

-add more device ranges and definitions.
-fix dynamic shm api.
-cleanup plaform def.
-enable PL022 SPI, bcm HWRNG and bcm SOTP driver.

Acked-by: Etienne Car

plat-bcm: update platform configurations

-add more device ranges and definitions.
-fix dynamic shm api.
-cleanup plaform def.
-enable PL022 SPI, bcm HWRNG and bcm SOTP driver.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>

show more ...

core: arm: imx: handle errata 845369

Under very rare timing circumstances, a data corruption might occur on
a dirty cache line that is evicted from the L1 Data Cache due to another
cache line being

core: arm: imx: handle errata 845369

Under very rare timing circumstances, a data corruption might occur on
a dirty cache line that is evicted from the L1 Data Cache due to another
cache line being entirely written.
Configurations affected:
This erratum affects configurations with either:
- One processor if the ACP is present
- Two or more processors

This erratum can be worked round by setting bit[22] of the undocumented
Diagnostic Control Register to 1. This register is encoded as
CP15 c15 0 c0 1. The bit can be written in Secure state only, with the
following.
Read/Modify/Write code sequence:
MRC p15,0,rt,c15,c0,1
ORR rt,rt,#0x00400000
MCR p15,0,rt,c15,c0,1

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

core: arm: imx: a9: tune ACTLR

Tune ACTLR. To SLL, the value is 0xE at runtime.
To others, the value should be 0x4F at runtime.
Bit3 will be enabled when enable L2.

The SMP bit for i.MX6SLL needs t

core: arm: imx: a9: tune ACTLR

Tune ACTLR. To SLL, the value is 0xE at runtime.
To others, the value should be 0x4F at runtime.
Bit3 will be enabled when enable L2.

The SMP bit for i.MX6SLL needs to be make ldrex/strex
instruction work properly.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

core: arm: imx: a7: set L1 Data prefetch

The default value of L1PCTL field in ACTLR is 0x3, which is
"3 outstanding pre-fetches permitted", the value should not
be override with 0 to decrease the pe

core: arm: imx: a7: set L1 Data prefetch

The default value of L1PCTL field in ACTLR is 0x3, which is
"3 outstanding pre-fetches permitted", the value should not
be override with 0 to decrease the performance.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

core: Introduce OPTEE_SMC_GET_THREAD_COUNT

This call should be used to query OP-TEE about number of threads
(basically, CFG_NUM_THREADS build option).

It is introduced after discussion at [1] about

core: Introduce OPTEE_SMC_GET_THREAD_COUNT

This call should be used to query OP-TEE about number of threads
(basically, CFG_NUM_THREADS build option).

It is introduced after discussion at [1] about possibility to read
number of supported threads. It is needed for XEN OP-TEE mediator to
mitigate possible DoS from virtual guest. If XEN knows number of
OP-TEE threads, it can limit number of standard calls from the guest
on own side.

Also, it can be used by optee client driver, to ratelimit number of calls
from its side.

Link: [1] https://lists.xenproject.org/archives/html/xen-devel/2019-01/msg01460.html

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: arm: kern.ld.S: minimize padding between .heap1 and .nozi

When OP-TEE is build with CFG_WITH_LPAE=y, the things stored in the
.nozi section do not need to be aligned on more than 4 KiB. Only t

core: arm: kern.ld.S: minimize padding between .heap1 and .nozi

When OP-TEE is build with CFG_WITH_LPAE=y, the things stored in the
.nozi section do not need to be aligned on more than 4 KiB. Only the
non-LPAE case requires 16 KiB alignment for the L1 page table.

Use an #ifdef to minimize the extra space between .heap1 and .nozi,
thus making the heap size closer to what is requested by
CFG_CORE_HEAP_SIZE. This can be useful when trying to minimize the
size of the TEE core binary, which could otherwise be bigger than
necessary by as much as 12 KiB.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm: kern.ld.S: use ABSOLUTE() in some assertions

Symbols defined inside output sections are relative to the section
start. Therefore, when we want to check the actual address, we need
to appl

core: arm: kern.ld.S: use ABSOLUTE() in some assertions

Symbols defined inside output sections are relative to the section
start. Therefore, when we want to check the actual address, we need
to apply the ABSOLUTE() builtin function to the symbol.

Note that symbols defined outside output sections are absolute by
default, and therefore need not be treated the same.

kern.ld.S has two incorrect assertions which can never fail, because
the value that is checked is in fact 0 (since we are at the beginning
of a section in both cases).

Fix the code by adding the missing ABSOLUTE().

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

plat-imx: mx6: add support for the TZC380 to MX6Q

Use the generic RAM layout to configure the TZC380 according to the
device configuration.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutroni

plat-imx: mx6: add support for the TZC380 to MX6Q

Use the generic RAM layout to configure the TZC380 according to the
device configuration.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Peng Fan <peng.fan@nxp.com>

show more ...

plat-rpi3: Use generic memory layout

plat-rpi3 have quite standard memory layout, so there is no sense
to maintain separate configuration if it possible to use generic
one.

Signed-off-by: Ying-Chun

plat-rpi3: Use generic memory layout

plat-rpi3 have quite standard memory layout, so there is no sense
to maintain separate configuration if it possible to use generic
one.

Signed-off-by: Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

show more ...

stm32mp1: shres: set GPIO secure hardening

Set secure hardening for the GPIOZ pins according to their
peripheral registration.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Je

stm32mp1: shres: set GPIO secure hardening

Set secure hardening for the GPIOZ pins according to their
peripheral registration.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: shres: configure ETZPC protection

With this change, platform configures the ETZPC firewall
according to shared peripheral being assigned to either the
secure or the non-secure world.

Sign

stm32mp1: shres: configure ETZPC protection

With this change, platform configures the ETZPC firewall
according to shared peripheral being assigned to either the
secure or the non-secure world.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: shres: check RCC secure hardening

This change add a platform consistency test between shared
resource registering and SoC RCC hardening.

When secure resources are registered, RCC secure h

stm32mp1: shres: check RCC secure hardening

This change add a platform consistency test between shared
resource registering and SoC RCC hardening.

When secure resources are registered, RCC secure hardening
must be enabled unless what secure world cannot guaranty
the resource reliability.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: shres: secure clock parents

Add API function stm32mp_register_clock_parents_secure().
The function registers as secure the parent clock(s) of the
target clock reference. This API is used b

stm32mp1: shres: secure clock parents

Add API function stm32mp_register_clock_parents_secure().
The function registers as secure the parent clock(s) of the
target clock reference. This API is used by shared_resources.c
when a clock is registered as secure so that its dependencies
are also registered as secure.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: shres: registering shared resources

This change implements a driver for the stm32mp1 resources that may
be assigned to either secure or non-secure worlds upon the platform
configuration.

stm32mp1: shres: registering shared resources

This change implements a driver for the stm32mp1 resources that may
be assigned to either secure or non-secure worlds upon the platform
configuration.

Other drivers shall register their resources (when applicable) using
the API functions stm32mp_register_{secure|non_secure}_periph*():
- stm32mp_register_*_periph() registers a resource from its
platform ID.
- stm32mp_register_*_periph_iomem() registers a resource from its
IOMEM base address.
- stm32mp_register_*_periph_gpio() registers a resource from its
GPIO reference, bank and position.

Shared resource driver exports some APIs to query a resource
registration state, stm32mp_periph_is_*(),
stm32mp_gpio_bank_is_*(), stm32mp_clock_is_*().

The driver saves the peripheral assignation. The API does not
allow peripherals to change state at runtime. Moverover, to
prevent testing a resource status before it is registered,
the first query on a resource state locks further registering.
Later attempt to register a peripheral will panic the core.

Resources are either secure on non-secure but clock that maybe
shared in which case it will be assigned to the secure world but
a platform service will allow non-secure to access the resource
(i.e. enable/disable the clock). Note such service is out of the
scope of this change, yet this explains API stm32mp_clock_is_shared().

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: fix ordering in IOMEM mapping registering

Swap RCC_BASE and PWR_BASE mapping registering for a nice alpha
ordering of the mapping definitions.

Signed-off-by: Etienne Carriere <etienne.car

stm32mp1: fix ordering in IOMEM mapping registering

Swap RCC_BASE and PWR_BASE mapping registering for a nice alpha
ordering of the mapping definitions.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: prefer vaddr_t to uintptr_t

Use vaddr_t and paddr_t instead of uintptr_t where applicable.

This change also simplifies some platform get-base-address functions
to use io_pa_or_va().

Sign

stm32mp1: prefer vaddr_t to uintptr_t

Use vaddr_t and paddr_t instead of uintptr_t where applicable.

This change also simplifies some platform get-base-address functions
to use io_pa_or_va().

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: make all local variables be initialized

Update platform to conform with OP-TEE directive about local variables
initialization.

Also rename variable labels excep into exceptions as more ex

stm32mp1: make all local variables be initialized

Update platform to conform with OP-TEE directive about local variables
initialization.

Also rename variable labels excep into exceptions as more explicit.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: embed stm32_rng driver

Platform embeds RNG driver and maps the RNG1 interface registers.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jens Wiklander <jens.wiklander

stm32mp1: embed stm32_rng driver

Platform embeds RNG driver and maps the RNG1 interface registers.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stm32mp1: util for shared resources refcount

Implement {incr|decr}_shrefcnt(refcount, secure_flag) to provide
reference counting for secure, non secure and resources used both
from secure and non se

stm32mp1: util for shared resources refcount

Implement {incr|decr}_shrefcnt(refcount, secure_flag) to provide
reference counting for secure, non secure and resources used both
from secure and non secure world.

Functions {incr|decr}_refcnt(refcount) is a secure refcount only
reference counting.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm: link tee.elf with lib archives

Links tee.elf with the library archives instead of -llibname in order to
detect multiply defined symbols in several libraries.

Acked-by: Jerome Forissier <

core: arm: link tee.elf with lib archives

Links tee.elf with the library archives instead of -llibname in order to
detect multiply defined symbols in several libraries.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: user_ta: implement ASLR for TAs

Introduces CFG_TA_ASLR to enable Address Space Layout Randomization of
Trusted Applications. ASLR makes the exploitation of memory corruption
vulnerabilities ha

core: user_ta: implement ASLR for TAs

Introduces CFG_TA_ASLR to enable Address Space Layout Randomization of
Trusted Applications. ASLR makes the exploitation of memory corruption
vulnerabilities harder.
The feature is disabled by default except for the configurations I
could test (QEMU and HiKey960).
When CFG_TA_ASLR=y, the stack and subsequent ELF file(s) needed by the
TA are mapped into the user VA space with a random offset comprised
between CFG_TA_ASLR_MIN_OFFSET_PAGES and CFG_TA_ASLR_MAX_OFFSET_PAGES
pages (that is between 0 and 128 pages by default).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU, HiKey960)
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: user_ta: use consistent formatting for addresses in TA dump

Improve the layout of the TA dump message by using fixed width for
physical and virtual addresses: 0x + 8 or 16 characters, dependin

core: user_ta: use consistent formatting for addresses in TA dump

Improve the layout of the TA dump message by using fixed width for
physical and virtual addresses: 0x + 8 or 16 characters, depending on
the address size (32 or 64 bits). This makes the output more
consistent, more readable, and nicer overall.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

generic_boot: reserve optee_tzdram memory

Aside from reserving the shared memory, also reserve the TZDRAM OP-TEE
memory.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: R

generic_boot: reserve optee_tzdram memory

Aside from reserving the shared memory, also reserve the TZDRAM OP-TEE
memory.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...