mm: drop the forced PL1 RW permissions for user TAs

We have used simple memory access permission model in OP-TEE, if PL1
permission is forced RW, the PL0 permission can only be set to RW or
no acces

mm: drop the forced PL1 RW permissions for user TAs

We have used simple memory access permission model in OP-TEE, if PL1
permission is forced RW, the PL0 permission can only be set to RW or
no access, so the PL0 permission is set to RW in the user TAs which is
not as expected.

Fix it as follow,
1. when TA is in loading process, the PL1 is set to own the RW
permission while the PL0 with no accesss.
2. when the TA is loaded, the PL0 is set to own the required
permissions defined in ta elf program headers and from the access
control model, the PL1 will own the same permissions as the PL0.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>

show more ...

core: fix pl310 shared mutex registering

Fix missing virtual/physical address conversion. Before this change
the outercache shared mutex was functional only when optee pager was
disable as in such c

core: fix pl310 shared mutex registering

Fix missing virtual/physical address conversion. Before this change
the outercache shared mutex was functional only when optee pager was
disable as in such case shared mutex lied in a flat-mapped memory area
(va==pa). When optee pager is enable (CFG_WITH_PAGER=y), non_linear
mapping of optee core makes optee providing nonsecure world (through
OPTEE_SMC_L2CC_MUTEX_GET_ADDR) an invalid shared mutex physical address.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
[Rebase on top of master]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: assert that mutexes are used from a normal thread only

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etie

core: assert that mutexes are used from a normal thread only

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: assert that no spinlock is held when unmasking IRQs or using a mutex

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
R

core: assert that no spinlock is held when unmasking IRQs or using a mutex

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: assert that IRQs are masked when calling spinlock functions

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-b

core: assert that IRQs are masked when calling spinlock functions

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm32: remove .section .text.proc from proc_a32.S

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wi

core: arm32: remove .section .text.proc from proc_a32.S

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: move spinlock functions to their own file

- 64-bit spinlock functions are implemented in their own file. Do
likewise for 32-bit functions. While we're at it:
- Update comments
- Use local

core: move spinlock functions to their own file

- 64-bit spinlock functions are implemented in their own file. Do
likewise for 32-bit functions. While we're at it:
- Update comments
- Use local labels so that the file is closer to the original ARM-TF
file (lib/locks/exclusive/aarch32/spinlock.S).
- Create a new header file: core/arch/arm/include/kernel/spinlock.h.
- Delete core/arch/arm/include/kernel/tz_proc.h, which is not needed
any more.
- Make sure that cpu_mmu_enable() and friends are in the unpaged
section by using KEEP_PAGER. It looks like previously, they were stored
in the correct place by chance, probably because they were in the same
section as the spinlock functions.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm32_macros: sort based on the CRn

Sort based on CRn

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

core: arm: add more cp15 register access macros

Add more cp15 register access macros.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

core: pager: light refactoring

A light refactoring of the pager to get rid of one ifdef section and
some preparation for coming changes. No changes in behaviour.

Reviewed-by: Jerome Forissier <jero

core: pager: light refactoring

A light refactoring of the pager to get rid of one ifdef section and
some preparation for coming changes. No changes in behaviour.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU pager)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pager: use wrapper function for locking

Simplifies the code by using a wrapper function for locking instead
of the two-step spinlock procedure.

Reviewed-by: Jerome Forissier <jerome.forissier

core: pager: use wrapper function for locking

Simplifies the code by using a wrapper function for locking instead
of the two-step spinlock procedure.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: rename to tee_pager_set_uta_area_attr()

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <j

core: rename to tee_pager_set_uta_area_attr()

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add core_mmu_get_user_pgdir()

Adds core_mmu_get_user_pgdir() to fill in a struct core_mmu_table_info
describing the page directory used for user TAs.

Reviewed-by: Jerome Forissier <jerome.for

core: add core_mmu_get_user_pgdir()

Adds core_mmu_get_user_pgdir() to fill in a struct core_mmu_table_info
describing the page directory used for user TAs.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pgt_cache: describe pgt_cache_list

Adds a comment describing pgt_cache_list.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro

core: pgt_cache: describe pgt_cache_list

Adds a comment describing pgt_cache_list.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: bugfix core_mmu_get_entry_primitive()

Fixes both implementations of core_mmu_get_entry_primitive() to
correctly report TEE_MATTR_TABLE.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.

core: bugfix core_mmu_get_entry_primitive()

Fixes both implementations of core_mmu_get_entry_primitive() to
correctly report TEE_MATTR_TABLE.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: user_ta_dump_state() prints phys addr

user_ta_dump_state() prints physical addresses in addition to
the already present virtual addresses.

Reviewed-by: Jerome Forissier <jerome.forissier@lina

core: user_ta_dump_state() prints phys addr

user_ta_dump_state() prints physical addresses in addition to
the already present virtual addresses.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

pl310: beautify

Use explicit labels instead of comments to make code readable.
Remove useless comments.
Remove few useless instructions.
Indent assembly instructions.

Signed-off-by: Etienne Carrier

pl310: beautify

Use explicit labels instead of comments to make code readable.
Remove useless comments.
Remove few useless instructions.
Indent assembly instructions.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

show more ...

pl310: fix 16-way pl310 support

Get number of ways from the PL310 configuration AUX_CTRL[bit#16].
tz_ssvce_def.h require util.h for BIT32().

Signed-off-by: Etienne Carriere <etienne.carriere@linaro

pl310: fix 16-way pl310 support

Get number of ways from the PL310 configuration AUX_CTRL[bit#16].
tz_ssvce_def.h require util.h for BIT32().

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Tested-by: Peng Fan <peng.fan@nxp.com> (i.MX6Q-SDB)
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)

show more ...

hikey: enable spi by default and add sample test code

Suggested-by: Daniel Thompson <daniel.thompson@linaro.org>
Suggested-by: Leo Yan <leo.yan@linaro.org>
Suggested-by: Haojian Zhuang <haojian.zhua

hikey: enable spi by default and add sample test code

Suggested-by: Daniel Thompson <daniel.thompson@linaro.org>
Suggested-by: Leo Yan <leo.yan@linaro.org>
Suggested-by: Haojian Zhuang <haojian.zhuang@linaro.org>
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Tested-by: Victor Chong <victor.chong@linaro.org> (with CFG_SPI_TEST=y)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

add static ta for testing interrupt framework

Signed-off-by: Guanchao Liang <liang.guanchao@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne

add static ta for testing interrupt framework

Signed-off-by: Guanchao Liang <liang.guanchao@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU)
[Update commit author to be same as S-o-b: above]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: add code for the interrupt framework

With this commit, we add three more GIC APIs for the kernel of OPTEE-OS:
itr_raise_sgi : can raise software generate interrupt(SGI) from secure
world to no

core: add code for the interrupt framework

With this commit, we add three more GIC APIs for the kernel of OPTEE-OS:
itr_raise_sgi : can raise software generate interrupt(SGI) from secure
world to no-secure world, or secure world to secure world. It's a quick
communication between different worlds and different cores. Because SGI
is using the GIC N-N model, so with this API, every core can receive
the interrupt if want.

itr_raise_pi : can trigger the peripheral interrupt with the corresponding
interrupt number. When sending it to N cores, just one core can receive
the effective interrupt.

itr_set_affinity : can target the peripheral interrupt to the core you
want, it means that one can bind the interrupt to the corresponding core
use this API.

The usage may as follow:
itr_raise_sgi(11, 0x1 << 1)
it will raise SGI11 to core 1, and if you want not only core 1 can receive
SGI11 but also core 2, then you can change the code to
itr_raise_sgi(11, 0x1 << 1 || 0x1 << 2).

itr_set_affinity(61, 0x1 << 1)
itr_raise_pi(61)
These two APIs may use together, the operation set_affinity set the PI61
can just sent to core 1, then raise_pi, core 1 will receive the peripheral
interrupt 61.

Signed-off-by: Guanchao Liang <liang.guanchao@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU)
[Update commit author to be same as S-o-b: above]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core/armv7: cleanup bootargs

In non-A-TF boot modes, OP-TEE core expects some boot arguments:
- nonsecure entry point, default expected from core register LR.
- pagestore address, when pager is enab

core/armv7: cleanup bootargs

In non-A-TF boot modes, OP-TEE core expects some boot arguments:
- nonsecure entry point, default expected from core register LR.
- pagestore address, when pager is enable, from core register R0.
- devicetree address, when DT is enable, from core register R2.

Some non-A-TF booted platform rely on u-boot has bootloader, and
expect u-boot to boot both linux and op-tee. armv7/linux expects the
following boot arguments:
- machine ID, expected from core register R1.
- devicetree address from core register R2.

Before this patch, some platform used CFG_TEE_GDB_BOOT together with
CFG_BUILT_IN_ARGS to both provide op-tee core boot arguments, and
relay linux argument from op-tee entry to linux kernel entry
(nonsecure entry).

This change proposes to rationalize a bit. Both linux and optee expect
device tree from register R2. op-tee could relay machine ID (R1).

This change removes CFG_TEE_GDB_BOOT and CFG_BUILT_IN_ARGS that are now
deprecated.

This change still supports CFG_PAGEABLE_ADDR, CFG_DT_ADDR and
CFG_NS_ENTRY_ADDR to statically define the pagestore, device tree
and nonsecure entry. These can be defined independently.

Since this change, if CFG_WITH_ARM_TRUSTED_FW is not enable, the
standard boot arguments (registers R1 and R2 at optee entry) are
propagated to the non secure entry.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

core/armv7: clear 4th arg of secondary boot cores nonsecure entry

Secondary boot cores shall clean cpu register R4 before leaving secure.
R4 is the 4th argument propagated to non-secure entry by opt

core/armv7: clear 4th arg of secondary boot cores nonsecure entry

Secondary boot cores shall clean cpu register R4 before leaving secure.
R4 is the 4th argument propagated to non-secure entry by optee monitor.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

core: fix stack setup at secondary core entry

stack_tmp_offset is required by secondary boot cores before
pager is initialized.

Fixes: e56a56428def ("core: sm: use stack_tmp for sm_from_nsec")
Sign

core: fix stack setup at secondary core entry

stack_tmp_offset is required by secondary boot cores before
pager is initialized.

Fixes: e56a56428def ("core: sm: use stack_tmp for sm_from_nsec")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: sm: use stack_tmp for sm_from_nsec()

As the C function sm_from_nsec() used by the secure monitor is expected
to be extended over time it needs a larger stack. With this patch the
secure monito

core: sm: use stack_tmp for sm_from_nsec()

As the C function sm_from_nsec() used by the secure monitor is expected
to be extended over time it needs a larger stack. With this patch the
secure monitor uses stack_tmp. The first part of stack_tmp is
permanently reserved for secure and non-secure contexts.

Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3)
Tested-by: Andrew F. Davis <afd@ti.com> (plat-ti)
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (stm-b2260)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU v7 & v8)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...