arm64: Introduce permissive PAN implementation

Privileged Access Never (PAN) is a part of ARMv8.1 extension that
restricts accesses to unprivileged memory from privileged mode
in order to prevent un

arm64: Introduce permissive PAN implementation

Privileged Access Never (PAN) is a part of ARMv8.1 extension that
restricts accesses to unprivileged memory from privileged mode
in order to prevent unintended accesses to potentially malicious
memory.

This introduces configuration of PAN and helper functions
enter_user_access() and exit_user_access() that toggles PSTATE.PAN
that controls the behavior of PAN.

Current OP-TEE impelmentation is not ready to apply strict PAN policy
due to missing user-access function uses, etc.

Hence, this patch takes a very permissive approach (yet better
than nothing), where PAN is deactivated in the entire lifetime of
thread_svc_handler (i.e., system call).

Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: thread: Add support for canary value randomization

Currently hardcoded magic number is used as thread stack canary,
an attacker with full control over the overflow can embed the
hardcoded cana

core: thread: Add support for canary value randomization

Currently hardcoded magic number is used as thread stack canary,
an attacker with full control over the overflow can embed the
hardcoded canary value on the right location to bypass the overflow
detection.

To add extra layer of security, redefine the canary value as variable,
such that the canary can be initialized during runtime.

The canaries are initialized with static values from thread_init_canaries()
during the early boot stage. The plat_get_random_stack_canaries() is
refactored to support arbitrary-length random numbers, and a new function
called thread_update_canaries() is created to fetch the random values and
update the thread canaries. For CFG_NS_VIRTUALIZATION=y, the updated
function is disabled.

Signed-off-by: Vincent Chuang <Vincent.Chuang@mediatek.com>
Signed-off-by: Randy Hsu <Randy-CY.Hsu@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: interrupt: interrupt chip framework

Extends itr_chip framework to allow interrupt controllers to register
as interrupt chip and other interrupt management methods it their
owns interrupt consu

core: interrupt: interrupt chip framework

Extends itr_chip framework to allow interrupt controllers to register
as interrupt chip and other interrupt management methods it their
owns interrupt consumer through the interrupt_xxx() API function.

This change does not modify the existing interrupt API function that
allow a driver to get an interrupt from the CPU main interrupt controller.
A later change will remove these old API functions.

This changes adds fields in existing structures defined in interrupt.h:
- itr_handler::chip back references the interrupt controller
- itr_chip::handlers is a list head for controller registered handlers
- itr_chip::name for debug trace purpose
- itr_ops::mask and itr_ops::unmask to mask/unmask an interrupt

The new API functions exposed to interrupt consumers are:
- interrupt_add_configure_handler(), interrupt_remove_handler() and
helper functions interrupt_add_handler() and
interrupt_add_handler_with_chip();
- interrupt_alloc_add_handler() and interrupt_remove_free_handler();
- interrupt_configure(), interrupt_enable(), interrupt_disable(),
interrupt_mask() and interrupt_unmask();

Interrupt controllers shall call generic API function
interrupt_call_handlers() to have their registered consumer handlers
called upon their related interrupt occurrences.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver: swap TEE_result and retrieved device reference

Changes dt_driver callback function to return a TEE_Result value
and pass retrieved device reference by a output argument rather
than

core: dt_driver: swap TEE_result and retrieved device reference

Changes dt_driver callback function to return a TEE_Result value
and pass retrieved device reference by a output argument rather
than the opposite.

This change updates dt_driver.c, dt_driver.h and all drivers
implementing related dt_driver callback function.

As a consequence, this change removes all type definition related
to device specific callback handler function types which are useless
as all these now comply with type dt_driver_probe_func defined in
dt_driver.h.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: dt_driver: add helper for old fashion interrupt bindings

Adds a helper function dt_driver_device_from_node_idx_prop_phandle()
in device tree driver probing framework for when a DT node propert

core: dt_driver: add helper for old fashion interrupt bindings

Adds a helper function dt_driver_device_from_node_idx_prop_phandle()
in device tree driver probing framework for when a DT node property
contains a resource references but not the related device phandle as
first property cell, as for property "interrupts" which should get the
interrupt controller phandle from property "interrupt-parent". This
change aims at supporting "interrupts" property DT bindings.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver: define interrupt controller drivers identifier

Defines identifier DT_DRIVER_INTERRUPT in dt_driver_type enumerated type
for interrupt controller drivers.

Acked-by: Jens Wiklander <

core: dt_driver: define interrupt controller drivers identifier

Defines identifier DT_DRIVER_INTERRUPT in dt_driver_type enumerated type
for interrupt controller drivers.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: interrupt: add inline descriptions

Adds inline description comments in interrupt.h and fix an indentation.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carri

core: interrupt: add inline descriptions

Adds inline description comments in interrupt.h and fix an indentation.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: interrupt: interrupt_get_main_chip() returns main controller

Adds helper function interrupt_get_main_chip() to get the struct itr_chip
reference of the CPU main interrupt controller (e.g. the

core: interrupt: interrupt_get_main_chip() returns main controller

Adds helper function interrupt_get_main_chip() to get the struct itr_chip
reference of the CPU main interrupt controller (e.g. the GIC). This
function helps adapting a generic interrupt controller framework to
consider CPU main interrupt controller specific reference.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: rename dt_driver_phandle_args to dt_pargs

Renames struct dt_driver_phandle_args to struct dt_pargs to
shorten the label and prevent ugly line breaks in function
signatures.

Acked-by: Jens Wik

core: rename dt_driver_phandle_args to dt_pargs

Renames struct dt_driver_phandle_args to struct dt_pargs to
shorten the label and prevent ugly line breaks in function
signatures.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: spmc: handle non-secure interrupts

Add FFA_INTERRUPT and FFA_RUN support for signaling non-secure
interrupts and for resuming to the secure world. If a secure partition
is preempted by a non-s

core: spmc: handle non-secure interrupts

Add FFA_INTERRUPT and FFA_RUN support for signaling non-secure
interrupts and for resuming to the secure world. If a secure partition
is preempted by a non-secure interrupt OP-TEE saves the SP's state and
sends an FFA_INTERRUPT to the normal world. After handling the interrupt
the normal world should send an FFA_RUN to OP-TEE so it can continue
running the SP.
If OP-TEE is the active FF-A endpoint (i.e. it is running TAs) the
non-secure interrupts are signaled by the existing
OPTEE_FFA_YIELDING_CALL_RETURN_INTERRUPT message instead of
FFA_INTERRUPT.

Signed-off-by: Imre Kis <imre.kis@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: spmc: support virtualization with SPMC at S-EL1

Adds support for virtualization with OP-TEE as SPMC at S-EL1. This if
the FF-A counterpart of SMC based ABI with virtualization.

Reviewed-by: B

core: spmc: support virtualization with SPMC at S-EL1

Adds support for virtualization with OP-TEE as SPMC at S-EL1. This if
the FF-A counterpart of SMC based ABI with virtualization.

Reviewed-by: Balint Dobszay <balint.dobszay@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add virt_get_current_guest_id()

Adds the helper function virt_get_current_guest_id().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander

core: add virt_get_current_guest_id()

Adds the helper function virt_get_current_guest_id().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: interrupt: rename itr_init()

Renames itr_init() to interrupt_main_init() as a later
change will modify interrupt chip API functions using interrupt_
as prefix.

Reviewed-by: Jens Wiklander <je

core: interrupt: rename itr_init()

Renames itr_init() to interrupt_main_init() as a later
change will modify interrupt chip API functions using interrupt_
as prefix.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: interrupt: rename itr_core_handler()

Renames itr_core_handler() to interrupt_main_handler() as a later
change will modify interrupt chip API functions using interrupt_
as prefix.

Reviewed-by:

core: interrupt: rename itr_core_handler()

Renames itr_core_handler() to interrupt_main_handler() as a later
change will modify interrupt chip API functions using interrupt_
as prefix.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver: add support for DT_DRIVER_PINCTRL

In order to handle pinctrl the same way that other driver are handled by
DT driver support, modify node parsing to refer to the parent node in case

core: dt_driver: add support for DT_DRIVER_PINCTRL

In order to handle pinctrl the same way that other driver are handled by
DT driver support, modify node parsing to refer to the parent node in case
we are handling a pinctrl request.

Signed-off-by: Clément Léger <clement.leger@bootlin.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>

show more ...

core: dt_driver: fix a typo

Replace "controlle" with "controller".

Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

drivers: gpio: add device-tree based gpio controller framework

Build a small gpio framework based on the device-tree infrastructure and
on top of the existing gpio.h content. This framework allows t

drivers: gpio: add device-tree based gpio controller framework

Build a small gpio framework based on the device-tree infrastructure and
on top of the existing gpio.h content. This framework allows to register
gpio controllers and to retrieve gpio struct based on a "<name>-gpios"
properties.

Signed-off-by: Clément Léger <clement.leger@bootlin.com>
Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Add missing conditional compilation for RISC-V

RV64 also uses kern_sp. The elf.h is also used by RV32 and RV64.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome

Add missing conditional compilation for RISC-V

RV64 also uses kern_sp. The elf.h is also used by RV32 and RV64.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ffa: parse boot info

With CFG_CORE_SEL2_SPMC=y OP-TEE is executed as an SP at S-EL1. The
manifest describing the OP-TEE SP is passed as a boot argument.

The manifest contains among other thin

core: ffa: parse boot info

With CFG_CORE_SEL2_SPMC=y OP-TEE is executed as an SP at S-EL1. The
manifest describing the OP-TEE SP is passed as a boot argument.

The manifest contains among other things the two properties
"load-address" and "mem-size". These cover the secure memory allocated
for OP-TEE to cover core and TA memory. The retrieved memory range is
saved with a call to core_mmu_set_secure_memory() to be used when
initializing MMU and other memory configuration.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add dt_getprop_as_number()

Adds dt_getprop_as_number() to read a property and parse it as a number
returned as a uint64_t. The size of the property determines if it's read
as an unsigned 32-bi

core: add dt_getprop_as_number()

Adds dt_getprop_as_number() to read a property and parse it as a number
returned as a uint64_t. The size of the property determines if it's read
as an unsigned 32-bit or 64-bit integer.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

driver: tpm2: remove TPM2 driver

Remove TPM2 driver from OP-TEE core. OP-TEE will instead rely on a
remote REE TPM2 driver allowing REE OS to embed TPM2 software stack
and leverage TPM2 features.

A

driver: tpm2: remove TPM2 driver

Remove TPM2 driver from OP-TEE core. OP-TEE will instead rely on a
remote REE TPM2 driver allowing REE OS to embed TPM2 software stack
and leverage TPM2 features.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

pta: stats: fix compilation incompatible pointer warning

To reproduce the issue:
$ make PLATFORM=imx-mx8mmevk CFG_WITH_STATS=y CFG_TA_STATS=y

core/pta/stats.c: In function ‘get_user_ta_stats’:
core

pta: stats: fix compilation incompatible pointer warning

To reproduce the issue:
$ make PLATFORM=imx-mx8mmevk CFG_WITH_STATS=y CFG_TA_STATS=y

core/pta/stats.c: In function ‘get_user_ta_stats’:
core/pta/stats.c:169:37: warning: passing argument 2 of ‘tee_ta_instance_stats’ from incompatible pointer type [-Wincompatible-pointer-types]
169 | &p[0].memref.size);
| ^~~~~~~~~~~~~~~~~
| |
| size_t * {aka long unsigned int *}
In file included from core/include/kernel/pseudo_ta.h:10,
from core/pta/stats.c:8:
core/include/kernel/tee_ta_manager.h:171:56: note: expected ‘uint32_t *’ {aka ‘unsigned int *’} but argument is of type ‘size_t *’ {aka ‘long unsigned int *’}
171 | TEE_Result tee_ta_instance_stats(void *buff, uint32_t *buff_size);
| ~~~~~~~~~~^~~~~~~~~
core/pta/stats.c: At top level:
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics

Fixes: 7509620b8b95 ("GP131: Update TEE_Param")
Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: dt_driver: move related content from dt.h to dt_driver.h

Moves so-called dt_driver related declarations and definitions from
dt.h to dt_drivers.h. Incidentally adds an inline description to
en

core: dt_driver: move related content from dt.h to dt_driver.h

Moves so-called dt_driver related declarations and definitions from
dt.h to dt_drivers.h. Incidentally adds an inline description to
enum dt_driver_type. This change clarifies when a source file shall
include dt.h and/or dt_driver.h.

This change updates driver source files to include none, one or both of
these header files where applicable.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: pass secure memory parameter to virt_init_memory()

Pass the physical secure memory range as a parameter from secure_only[].
This avoids using hard coded defines in virt_init_memory().

CFG_NS_

core: pass secure memory parameter to virt_init_memory()

Pass the physical secure memory range as a parameter from secure_only[].
This avoids using hard coded defines in virt_init_memory().

CFG_NS_VIRTUALIZATION=y depends on secure_only[] to have all memory as
consecutive memory ranges, but that's unchanged behaviour from before
since it was expected that the entire range from TEE_RAM_START to
TA_RAM_START + TA_RAM_SIZE is usable memory.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: linker.h: remove *_SZ_UNSAFE defines

Removes the now unused *_SZ_UNSAFE defines.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.

core: linker.h: remove *_SZ_UNSAFE defines

Removes the now unused *_SZ_UNSAFE defines.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...