core: riscv: include: misc_arch.h: include stdint.h for uint32_t type

Added <stdint.h> to ensure types like uint32_t are correctly defined,
resolving implicit type issues when including this header.

core: riscv: include: misc_arch.h: include stdint.h for uint32_t type

Added <stdint.h> to ensure types like uint32_t are correctly defined,
resolving implicit type issues when including this header.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu-Chien Peter Lin <peter.lin@sifive.com>

show more ...

riscv: add ELF header definitions

Add RISC-V specific ELF header definitions in a new header
file to support ELF parsing for handling dynamic relocations.

We referred to u-boot/arch/riscv/cpu/start

riscv: add ELF header definitions

Add RISC-V specific ELF header definitions in a new header
file to support ELF parsing for handling dynamic relocations.

We referred to u-boot/arch/riscv/cpu/start.S to obtain the
definitions we need in OP-TEE.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Alvin Chang <alvinga@andestech.com>

show more ...

core: riscv: dynamic allocation of thread_core_local and its stacks

Refer to commit 59724f223500 ("core: dynamic allocation of
thread_core_local and its stacks"), we implement the code for RISC-V
ar

core: riscv: dynamic allocation of thread_core_local and its stacks

Refer to commit 59724f223500 ("core: dynamic allocation of
thread_core_local and its stacks"), we implement the code for RISC-V
architecture. With CFG_DYN_STACK_CONFIG enabled, the thread_core_local
and the two stacks, tmp_stack and abt_stack, are dynamically allocated.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

riscv: kernel: support booting non-contiguous non-zero-based hart IDs

Currently, OP-TEE assumes 0 <= hartid < CFG_TEE_CORE_NB_CORE,
and must be contiguous, which fails to accommodate different
CPU t

riscv: kernel: support booting non-contiguous non-zero-based hart IDs

Currently, OP-TEE assumes 0 <= hartid < CFG_TEE_CORE_NB_CORE,
and must be contiguous, which fails to accommodate different
CPU topologies. For example, some RISC-V platforms, such as
the HiFive Unmatched board, do not run Linux and OP-TEE on
hart0, as it is a monitor core without supervisor mode support.

To address this, introduce hart_index, which is used to index
per-hart structures, such as thread_core_local and root_pgt.
The hart_index will range from 0 to (CFG_TEE_CORE_NB_CORE - 1),
and the primary hart will have an index of 0.

Additionally, a new function, boot_primary_init_core_ids(),
is added to initialize secondary hart IDs for booting via
sbi_hsm_hart_start().

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Samuel Holland <samuel.holland@sifive.com>
Reviewed-by: Zong Li <zong.li@sifive.com>
Reviewed-by: Alvin Chang <alvinga@andestech.com>

show more ...

core: riscv: Improve thread user mode record

Make the asm definitions be more human-readable.

Besides, it's unnecessary to save and restore kernel SP and GP into
thread_user_mode_rec, since they wi

core: riscv: Improve thread user mode record

Make the asm definitions be more human-readable.

Besides, it's unnecessary to save and restore kernel SP and GP into
thread_user_mode_rec, since they will be setup by system call trap
handler before executing thread_unwind_user_mode().

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu Chien Peter Lin <peterlin@andestech.com>

show more ...

core: riscv: Remove thread_exit_user_mode()

Currently, the user mode abort and some system calls return to kernel
mode by thread_exit_user_mode(). Although this function creates a
shorter path to re

core: riscv: Remove thread_exit_user_mode()

Currently, the user mode abort and some system calls return to kernel
mode by thread_exit_user_mode(). Although this function creates a
shorter path to return to kernel mode, it leads to some problems because
the function does not update the core local flags. Especially when
CFG_CORE_DEBUG_CHECK_STACKS=y, some checks will fail due to wrong type
of stack recorded in the core local flags.

Fix it by removing thread_exit_user_mode(). So that the core local flags
can be correctly updated in the common trap handler.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu Chien Peter Lin <peterlin@andestech.com>

show more ...

core: riscv: Let platform choose native and foreign interrupts

Platform may want to choose different types of native and foreign
interrupts. This commit adds two definitions for the platforms:
1. PL

core: riscv: Let platform choose native and foreign interrupts

Platform may want to choose different types of native and foreign
interrupts. This commit adds two definitions for the platforms:
1. PLAT_THREAD_EXCP_FOREIGN_INTR: to define platform specific foreign
interrupts
2. PLAT_THREAD_EXCP_NATIVE_INTR: to define platform specific native
interrupts.

For RISC-V virt machine, we define all external/mtimer/software
interrupts as foreign interrupts. For RISC-V spike platform, we define
external interrupts as foreign interrupts, and mtimer/software
interrupts as native interrupts.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu Chien Peter Lin <peterlin@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: Implement foreign interrupt handler

In SMP based OP-TEE system, the foreign interrupts, which are handled
outside OP-TEE, might be injected during the execution of OP-TEE. When
OP-TEE r

core: riscv: Implement foreign interrupt handler

In SMP based OP-TEE system, the foreign interrupts, which are handled
outside OP-TEE, might be injected during the execution of OP-TEE. When
OP-TEE receives such foreign interrupts, it should suspend current
thread and yield the execution to the foreign domains to handle those
foreign interrupts.

This commit implements thread_foreign_interrupt_handler(), which is
expected to be called during trap handling. The job of this function are
suspending the current thread, and returning to the other domain to let
them handle the foreign interrupts.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu Chien Peter Lin <peterlin@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: Rename and re-order parameters of the interrupt handlers

Rename thread_interrupt_handler() to thread_native_interrupt_handler(),
since we are going to support the foreign interrupt hand

core: riscv: Rename and re-order parameters of the interrupt handlers

Rename thread_interrupt_handler() to thread_native_interrupt_handler(),
since we are going to support the foreign interrupt handler.

The native interrupts are handled in OP-TEE side, while the foreign
interrupts are handled outside OP-TEE.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu Chien Peter Lin <peterlin@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: Increase size of stacks and extra check space

To support CFG_CORE_DEBUG_CHECK_STACKS=y for RISC-V, we set
STACK_CHECK_EXTRA as 1536 like what ARM does.

To avoid stack overruns when CFG

core: riscv: Increase size of stacks and extra check space

To support CFG_CORE_DEBUG_CHECK_STACKS=y for RISC-V, we set
STACK_CHECK_EXTRA as 1536 like what ARM does.

To avoid stack overruns when CFG_CORE_DEBUG_CHECK_STACKS=y, we increase
the size of abort stack to 4096 bytes and size of thread stack to 10240
bytes.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu-Chien Peter Lin <peterlin@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: Improve the trap handler

In current RISC-V trap handler, we always save the context into struct
thread_trap_regs first, and copy the saved context into another specific
structure to han

core: riscv: Improve the trap handler

In current RISC-V trap handler, we always save the context into struct
thread_trap_regs first, and copy the saved context into another specific
structure to handle that trap. For example, thread_user_ecall_handler()
copies the struct thread_trap_regs to be struct thread_scall_regs before
handling this system call. In fact, such copies may drop the performance
and they should be eliminated.

In this commit, the specific data structure used to save the context is
determined early in the trap handler by checking the type of the trap
from CSR XCAUSE. Thus, the copies between context structures are
eliminated.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu Chien Peter Lin <peterlin@andestech.com>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Tested-by: Yu Chien Peter Lin <peterlin@andestech.com>
Tested-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

core: fix race condition on TA/PTA/StMM context loading

Fix race condition on creation of a context for single instance TAs,
PTAs or StMM application. Such race condition could occur and lead to
dup

core: fix race condition on TA/PTA/StMM context loading

Fix race condition on creation of a context for single instance TAs,
PTAs or StMM application. Such race condition could occur and lead to
duplicated contexts if connected close enough that they are created
after tee_ta_init_session() calls tee_ta_init_session_with_context()
and before the context are added in the centralized context list.

This is realized by keeping tee_ta_mutex held while tee_ctxes list is
looked up for matching a context or a new context is added into that
list with its .is_initializing field activated. For that purpose
user TA and StMM application initialization function are split in
2 functions, the 2nd one used to finalizes the context creation
started in the 1st function.

By the way, add inline description comments and fix indentation issues
in uaer_ta.h and remove the inline comment in pseudo_ta.c that refers
to TA loading whereas the function relates to PTA contexts creation.

Closes: https://github.com/OP-TEE/optee_os/issues/6801
Suggested-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: riscv: Apply STATUS helper for RPC resume

Since RPC resume is a kind of exception return, we invoke
xstatus_for_xret() to prepare the CSR STATUS for exception return. But
the actual value of S

core: riscv: Apply STATUS helper for RPC resume

Since RPC resume is a kind of exception return, we invoke
xstatus_for_xret() to prepare the CSR STATUS for exception return. But
the actual value of STATUS when calling thread_rpc() is still saved in
stack. This is to unify the behavior between RPC suspend and resume.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Tested-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

core: riscv: Apply exception return to resume thread

In current implementation, the thread is resumed by function return. It
is not suitable for all scenarios, especially when the thread should be
r

core: riscv: Apply exception return to resume thread

In current implementation, the thread is resumed by function return. It
is not suitable for all scenarios, especially when the thread should be
resumed to user mode. The kernel mode can not return to user mode by
pure function return.

This commit applies exception return to resume the thread. The EPC and
IE are added into thread context. The xstatus_for_xret() helper function
is added to prepare the value of CSR STATUS for exception return.
Currently we only consider PIE(previous interrupt-enable) and
PP(previous privilege mode) for exception return.

We clear thread context when the context is reinitialized, enable native
interrupt, and setup kernel GP/TP. The thread_resume() now takes care of
restoring CSR EPC, STATUS, IE, SCRATCH and all general-purpose
registers. Finally it executes exception return to target privilege mode
encoded in CSR STATUS. The registers GP and TP are also restored since
user mode may use them.

This commit also modify the usage of CSR SCRATCH. In current
implementation the SCRATCH is used to save kernel stack pointer when the
thread is in user mode. The value of TP, which stores thread_core_local
structure, is saved into kernel stack before entering user mode. The
trap handler can then get TP(thread_core_local) from kernel stack. This
is not suitable for SMP system, since the thread might be resumed to
another core, and that core gets wrong TP from kernel stack. Fix it by
directly storing TP into CSR SCRATCH.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Tested-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

core: kernel: factorize delay and timeout implementation

Factorize RISC-V and Arm architectures implementation of delay and
timeout API functions into generic core kernel source directory.

Architec

core: kernel: factorize delay and timeout implementation

Factorize RISC-V and Arm architectures implementation of delay and
timeout API functions into generic core kernel source directory.

Architecture or platform only need to implement timer tick count
read function delay_cnt_read() and timer tick frequency (in Hertz)
delay_cnt_freq() which is related to CFG_CORE_HAS_GENERIC_TIMER support.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: riscv: Rename thread_return_to_ree() to thread_return_to_udomain()

The terminology "udomain", which means untrusted domain, is more precise
terminology for RISC-V architecture, where "domain"

core: riscv: Rename thread_return_to_ree() to thread_return_to_udomain()

The terminology "udomain", which means untrusted domain, is more precise
terminology for RISC-V architecture, where "domain" has already been
defined in RISC-V CoVE and Smmtt specifications.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

core: riscv: Add support fault mitigations in non-threaded code

The previous commit
ce56605a0ede ("core: support fault mitigations in non-threaded code")
supports fault mitigations in non-threaded c

core: riscv: Add support fault mitigations in non-threaded code

The previous commit
ce56605a0ede ("core: support fault mitigations in non-threaded code")
supports fault mitigations in non-threaded code for ARM architecture.

This commit adds the related modification for RISC-V architecture to
support it too.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: prefix header file guard names with __

Improves header files guard names consistency by using a __ prefix
where missing.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by:

core: prefix header file guard names with __

Improves header files guard names consistency by using a __ prefix
where missing.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: fix header file guard names

Fixes header file guards macro name prefix (mostly missing occurrences)
that should reflect the file base directory sub-path where applicable.

Reviewed-by: Jens Wi

core: fix header file guard names

Fixes header file guards macro name prefix (mostly missing occurrences)
that should reflect the file base directory sub-path where applicable.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: riscv: Implement SBI based protocol

Rename thread_return_from_nsec_call() to thread_return_to_ree() for more
general behavior, since TEE might not only be called by REE, but also
do something

core: riscv: Implement SBI based protocol

Rename thread_return_from_nsec_call() to thread_return_to_ree() for more
general behavior, since TEE might not only be called by REE, but also
do something on its own initiative (e.g., handle secure interrupts).

This commit also implements SBI based protocol used to return control to
REE. The register a7 encodes SBI TEE extension ID, which is temporarily
defined here. We may have ratified SBI TEE extension in the future and
we can apply ratified ID at that time. The register a6 is unused and
encoded as 0. The returned arguments are encoded into registers a0~a5
and should be provided by the caller.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: Implement panic_at_abi_return as guard of ABI call

The ABI call to REE domain should not return. We implement
panic_at_abi_return macro as guard of ABI call. When the ABI call return
il

core: riscv: Implement panic_at_abi_return as guard of ABI call

The ABI call to REE domain should not return. We implement
panic_at_abi_return macro as guard of ABI call. When the ABI call return
illegally, the system will enter panic or an infinite loop.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: riscv: thread_private_arch.h: add std and fast calls prototypes

This commit adds the following prototypes to thread_private_arch.h:
- thread_std_abi_entry()
- __thread_std_abi_entry()
- thread

core: riscv: thread_private_arch.h: add std and fast calls prototypes

This commit adds the following prototypes to thread_private_arch.h:
- thread_std_abi_entry()
- __thread_std_abi_entry()
- thread_handle_fast_abi()
- thread_handle_std_abi()

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Alvin Chang <alvinga@andestech.com>
Tested-by: Alvin Chang <alvinga@andestech.com>

show more ...

core: riscv: thread_arch.h: rename thread_smc_args to thread_abi_args

SMC is an ARM-related keyword referring to Secure Monitor Call.
This commit renames thread_smc_args to thread_abi_args in
thread

core: riscv: thread_arch.h: rename thread_smc_args to thread_abi_args

SMC is an ARM-related keyword referring to Secure Monitor Call.
This commit renames thread_smc_args to thread_abi_args in
thread_arch.h and keeps the same members to guarantee compatibility
with the existing secure and non-secure domain communication protocol.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Alvin Chang <alvinga@andestech.com>
Tested-by: Alvin Chang <alvinga@andestech.com>

show more ...

core: riscv: Support Privileged Access Never by CSR status.SUM bit

The SUM (Supervisor User Memory access) bit modifies the privilege with
which S-mode loads and stores the user virtual memory. When

core: riscv: Support Privileged Access Never by CSR status.SUM bit

The SUM (Supervisor User Memory access) bit modifies the privilege with
which S-mode loads and stores the user virtual memory. When SUM bit is
0, S-mode accesses to pages whose U bit of corresponding PTE is set will
fault. When SUM bit is 1, these accesses are permitted.

When CFG_PAN is disabled in RISC-V architecture, the status.SUM bit is
initialized as 1 by default. Therefore all accesses to user pages will
succeed. When CFG_PAN is enabled, the status.SUM bit is initialized as
0, and only set to 1 when kernel needs to access user pages.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Tested-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

core: riscv: Fix width of status CSR

Since we also support RV64 with 64-bit register width, fix the width of
status CSR by declaring it as "unsigned long" and encoding it by general
bit-wise operati

core: riscv: Fix width of status CSR

Since we also support RV64 with 64-bit register width, fix the width of
status CSR by declaring it as "unsigned long" and encoding it by general
bit-wise operations instead of invoking fixed-width API.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...