core: add copy_{to,from}_private()

Adds the copy_{to,from}_private() functions which checks that the user
mode buffer resides in TA private memory and not non-secure shared
memory for instance.

Rev

core: add copy_{to,from}_private()

Adds the copy_{to,from}_private() functions which checks that the user
mode buffer resides in TA private memory and not non-secure shared
memory for instance.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: separate copy_from_user() and friends

Removes the tee_svc_ prefix and moves tee_svc_copy_from_user() and
friends into <kernel/user_access.h> and core/kernel/user/access.c

Reviewed-by: Jerome

core: separate copy_from_user() and friends

Removes the tee_svc_ prefix and moves tee_svc_copy_from_user() and
friends into <kernel/user_access.h> and core/kernel/user/access.c

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

crypto: add function to free rsa keypair

There was no function to proper free a rsa kepair from inside a PTA.
Now there is crypto_acipher_free_rsa_keypair().

Signed-off-by: Elias von Däniken <elias

crypto: add function to free rsa keypair

There was no function to proper free a rsa kepair from inside a PTA.
Now there is crypto_acipher_free_rsa_keypair().

Signed-off-by: Elias von Däniken <elias.vondaeniken@bluewin.ch>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Add a parameter to vm_map_pad() to specify alignment requirement

There are cases where the virtual address returned for a requested
mapping needs to satisfy certain alignment requirements. All

core: Add a parameter to vm_map_pad() to specify alignment requirement

There are cases where the virtual address returned for a requested
mapping needs to satisfy certain alignment requirements. Allow the
calling functions to specify the required alignment as a parameter
to vm_map_pad().

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: load stmm via secure partition

Secure variable storage for EFI variables is critical for enabling and
protecting UEFI Secure Boot. Unfortunately due to the fact that SPD and
SPM are mutually e

core: load stmm via secure partition

Secure variable storage for EFI variables is critical for enabling and
protecting UEFI Secure Boot. Unfortunately due to the fact that SPD and
SPM are mutually exclusive, we can't run StMM from EDK2 and OP-TEE.
An advantage of doing so is that different firmware implementations
can leverage EDK2's StandAloneMM and in cooperation with OP-TEE RPMB
APIs can store UEFI variables in a secure storage.
This makes the variable storage quite generic in any device with an RPMB
partition.

Using a well debugged application is preferable over rewriting the whole
application as a TA. Another advantage is that this inherits the Fault
Tolerant Writes (FTW) functionality built-in on StMM to protect
variables against corruptions during writing. Considering the FFA
changes of the future Arm architectures using an SP that includes
everything seems like a better choice at the moment.
The 'SPM emulation' currently added into OP-TEE only supports
a single SP to be launched. This means that the StMM embedded
application has the RPMB driver built in at the moment. In the future we
can add code (evolving FFA) to launch multiple SPs. So the StMM variable
handling can be decoupled from the RPMB driver, which will reside in a
different SP.

So let's add a user mode secure partition context and support loading
"Standalone MM" of EDK2 into it. A separate syscall handling is added to
serve as different kind of ABI and syscall IDs. The secure partition has
a TA like interface towards normal world, but requests are routed into
the StMM partition instead.

CFG_STMM_PATH is assigned the path of BL32_AP_MM.fd, for instance:
CFG_STMM_PATH=...Build/QemuVirtMmStandalone/DEBUG_GCC5/FV/BL32_AP_MM.fd

Since this is quite tricky to compile and test you can use this [1].
Just clone the repo and run ./build.sh. The script will pick up edk2,
edk2-platforms, op-tee, atf and U-boot and compile all the necessary
binaries for QEMU. A patch (awful hack) has been added to U-boot to
allow RPMB emulation through it's supplicant, since QEMU RPMB emulation
is not yet available.
After compiling and launching QEMU the usual U-boot commands for EFI
variable management will store the variables on an RPMB device.

[1] https://git.linaro.org/people/ilias.apalodimas/efi_optee_variables.git/

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Co-developed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Co-developed-by: Pipat Methavanitpong <pipat1010@gmail.com>
Signed-off-by: Pipat Methavanitpong <pipat1010@gmail.com>
Co-developed-by: Miklos Balint <Miklos.Balint@arm.com>
Signed-off-by: Miklos Balint <Miklos.Balint@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: add vm_get_prot()

A following commit, related to the StMM functionality needs to read
the current page attributes before modifying them.
So let's add a function to retrieve the current attribu

core: add vm_get_prot()

A following commit, related to the StMM functionality needs to read
the current page attributes before modifying them.
So let's add a function to retrieve the current attributes.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

drivers: ns16550: Allow customizable serial IO config

Add io_width and reg_shift configurable parameters to struct ns16550_data
in order to support 32 bit register read/write.

Signed-off-by: Sumit

drivers: ns16550: Allow customizable serial IO config

Add io_width and reg_shift configurable parameters to struct ns16550_data
in order to support 32 bit register read/write.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: add tee_pobj_create_final()

Adds tee_pobj_create_final() which finalized a create operation. Until
tee_pobj_create_final() has been called the struct pobj cannot be shared
with any other objec

core: add tee_pobj_create_final()

Adds tee_pobj_create_final() which finalized a create operation. Until
tee_pobj_create_final() has been called the struct pobj cannot be shared
with any other object.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: syscall_storage_next_enum() use live pobj

Instead of using a fake pobj in syscall_storage_next_enum() retrieve the
shared pobj instead in order to get the flags of an already opened
object.

T

core: syscall_storage_next_enum() use live pobj

Instead of using a fake pobj in syscall_storage_next_enum() retrieve the
shared pobj instead in order to get the flags of an already opened
object.

TEE_POBJ_USAGE_ENUM is supplied to tee_pobj_get() to avoid checking for
conflicts with how the pobj is already used.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tee_pobj_get() takes an enum tee_pobj_usage

Changes tee_pobj_get() to take an enum tee_pobj_usage usage instead of a
bool temporary.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signe

core: tee_pobj_get() takes an enum tee_pobj_usage

Changes tee_pobj_get() to take an enum tee_pobj_usage usage instead of a
bool temporary.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove struct tee_obj::flags

struct tee_obj keeps a TEE_ObjectInfo which has a flags field with the
same meaning as the flags field in struct tee_obj. To avoid the two
fields getting out of sy

core: remove struct tee_obj::flags

struct tee_obj keeps a TEE_ObjectInfo which has a flags field with the
same meaning as the flags field in struct tee_obj. To avoid the two
fields getting out of sync remove struct tee_obj::flags and only use
TEE_ObjectInfo::handleFlags.

Additional checks are added in syscall_storage_obj_open() and
syscall_storage_obj_create() to make sure that no undefined flags are
added to TEE_ObjectInfo::handleFlags.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm: rpc i2c trampoline driver

Gives OP-TEE access to the i2c buses initialized and controlled by the
REE kernel. This is done by memory mapping a buffer from the thread's
cache where the inpu

core: arm: rpc i2c trampoline driver

Gives OP-TEE access to the i2c buses initialized and controlled by the
REE kernel. This is done by memory mapping a buffer from the thread's
cache where the input or output data is transferred.

Using this mechanism, OP-TEE clients do not have to worry about REE
RUNTIME_PM features switching off clocks from the controllers or
collisions with other bus masters.

This driver assumes that the I2C chip is on a REE statically assigned
bus which value is known to OP-TEE (it will not query/probe the REE).

The slave address can be either seven or ten bits. When using a ten
bit address, the corresponding flag needs to be set in the command and
the REE adapter must support the requested addressing mode.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

stm32_bsec: always embed shadow OTPs write function

Change the scope of configuration switch CFG_STM32_BSEC_WRITE to
not cover shadow OTP write support. CFG_STM32_BSEC_WRITE is used
to embed or not

stm32_bsec: always embed shadow OTPs write function

Change the scope of configuration switch CFG_STM32_BSEC_WRITE to
not cover shadow OTP write support. CFG_STM32_BSEC_WRITE is used
to embed or not OTP programming support but writing shadow OTPs
is a normal executing an OTP read operation hence this change
embeds stm32_bsec_write_otp() driver API function even when
CFG_STM32_BSEC_WRITE is disabled.

Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
[etienne: rephrase commit log]
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add generic rpc shared memory buffer caching

Replaces tee_fs_rpc_cache_alloc() with thread_rpc_shm_alloc() which also
takes a shared memory type as argument. This allows allocating an kernel
p

core: add generic rpc shared memory buffer caching

Replaces tee_fs_rpc_cache_alloc() with thread_rpc_shm_alloc() which also
takes a shared memory type as argument. This allows allocating an kernel
private RPC buffer when needed.

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add optee_ffa.h defining the OP-TEE ABI for FF-A

Adds optee_ffa.h which defines the OP-TEE ABI when Arm Platform Security
Architecture Firmware Framework for Arm V8-A [1] is used as transport

core: add optee_ffa.h defining the OP-TEE ABI for FF-A

Adds optee_ffa.h which defines the OP-TEE ABI when Arm Platform Security
Architecture Firmware Framework for Arm V8-A [1] is used as transport
instead of raw proprietary SMCs. This ABI where OP-TEE specific
implementation is used to fill the implementation specific gaps in the
specification is called OP-TEE FF-A, or sometimes just FF-A.

A new memref type, struct optee_msg_param_fmem, is added to carry
information needed to create new shared memory mobjs.

Link: [1] https://static.docs.arm.com/den0077/a/DEN0077A_PSA_Firmware_Framework_Arm_v8-A_1.0_EAC.pdf
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: make thread ID a short int

Changes thread_get_id() and thread_get_id_may_fail() to return 'short
int' instead of 'int'. That is, 16 bits instead of 32 on all supported
architectures which is m

core: make thread ID a short int

Changes thread_get_id() and thread_get_id_may_fail() to return 'short
int' instead of 'int'. That is, 16 bits instead of 32 on all supported
architectures which is more than enough since the largest thread ID
value is (CFG_NUM_THREADS - 1). Note, struct wait_queue_elem::handle
is already a short int.

trace_ext_get_thread_id() is not changed (still returns an int) because
it is part of the TA API and modifying it would needlessly introduce
incompatibilities.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: imx_i2c: add I2C support

This driver provides native access to the I2C bus on iMX.

The driver will not query the clock hierarchy - to find the base clock
rate - because it overcomplicates

drivers: imx_i2c: add I2C support

This driver provides native access to the I2C bus on iMX.

The driver will not query the clock hierarchy - to find the base clock
rate - because it overcomplicates the deliverable for not much added
value (this can be done at a later time if required).

The U-Boot and Linux GPL code was initially used as a reference;
however due to the simpler OP-TEE use case requirements, the code was
later re-written following the reference manual [1].

This driver will not access addresses within a I2C slave map.

This driver must not be used while the Linux kernel is running unless
the following is guaranteed:
- that the I2C bus will not be suspended.
- that there will not be collisions with other bus masters.

Without those guarantees, please use a trampoline driver to route the
I2C requests to Linux.

Tested on imx8mm-lpddr4.

[1] i.MX 8M Mini Applications Processor Reference Manual
Document Number: IMX8MMMRM
Rev.2 08/2019

Tested-by: Jorge Ramirez-Ortiz <jorge@foundries.io> (imx8mm)
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: add call_finalcalls()

Adds call_finalcalls() called at the end of paged_init_primary() just
before switching to normal world boot. This allows separation of
initcalls and finalcalls needed by

core: add call_finalcalls()

Adds call_finalcalls() called at the end of paged_init_primary() just
before switching to normal world boot. This allows separation of
initcalls and finalcalls needed by virtualization.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: call call_initcalls() directly

Now that init_teecore() is only a wrapper around call_initcalls(), drop
that function and call call_initcalls() directly from
init_tee_runtime().

Also move the

core: call call_initcalls() directly

Now that init_teecore() is only a wrapper around call_initcalls(), drop
that function and call call_initcalls() directly from
init_tee_runtime().

Also move the file to core/kernel/initcall.c since that's what it does.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: call fobj_generate_authenc_key() via initcalls

Calls fobj_generate_authenc_key() via initcalls instead of a direct call
in init_teecore().

Reviewed-by: Etienne Carriere <etienne.carriere@lina

core: call fobj_generate_authenc_key() via initcalls

Calls fobj_generate_authenc_key() via initcalls instead of a direct call
in init_teecore().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: call teecore_init_pub_ram() via initcalls

Calls teecore_init_pub_ram() via initcalls instead of a direct call in
init_teecore().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Si

core: call teecore_init_pub_ram() via initcalls

Calls teecore_init_pub_ram() via initcalls instead of a direct call in
init_teecore().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add debug prints for initcall functions

Adds debug prints when calling function. Enabled with DMSG() prints and
gives an output like:
D/TC:0 0 call_initcalls:30 level 3 check_ta_store()
D/TC:0

core: add debug prints for initcall functions

Adds debug prints when calling function. Enabled with DMSG() prints and
gives an output like:
D/TC:0 0 call_initcalls:30 level 3 check_ta_store()
D/TC:0 0 check_ta_store:635 TA store: "REE"
D/TC:0 0 call_initcalls:30 level 3 init_user_ta()
D/TC:0 0 call_initcalls:30 level 3 verify_pseudo_tas_conformance()
D/TC:0 0 call_initcalls:30 level 3 mobj_mapped_shm_init()
D/TC:0 0 mobj_mapped_shm_init:447 Shared memory address range: e300000, 10300000
D/TC:0 0 call_initcalls:30 level 3 tee_cryp_init()
D/TC:0 0 call_initcalls:30 level 4 tee_fs_init_key_manager()
D/TC:0 0 call_initcalls:30 level 5 init_console_itr()
D/TC:0 0 gic_it_set_cpu_mask:251 cpu_mask: writing 0xff to 0x10d00828
D/TC:0 0 gic_it_set_cpu_mask:253 cpu_mask: 0xff
D/TC:0 0 gic_it_set_prio:266 prio: writing 0x1 to 0x10d00428
D/TC:0 0 call_initcalls:30 level 6 mobj_init()
D/TC:0 0 call_initcalls:30 level 6 default_mobj_init()
I/TC:0 0 init_teecore:73 Initialized

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: make core_is_buffer_*() paddr_t compatible

The core_is_buffer_*() helpers are sometimes used with physical
addresses (type paddr_t). This can cause problem on platforms where
sizeof(paddr_t) >

core: make core_is_buffer_*() paddr_t compatible

The core_is_buffer_*() helpers are sometimes used with physical
addresses (type paddr_t). This can cause problem on platforms where
sizeof(paddr_t) > sizeof(vaddr_t), that is on ARM32 systems with
CFG_CORE_LARGE_PHYS_ADDR=y. The FVP platform compiled for AArch32 is one
such system which as a consequence fails with:
E/TC:0 0 check_phys_mem_is_outside:335 Non-sec mem (0x880000000:0x180000000) ove
rlaps map (type 12 0xff000000:0x1000000)
E/TC:0 0 Panic at core/arch/arm/mm/core_mmu.c:336 <check_phys_mem_is_outside>

This patch fixes this problem by taking input addresses as paddr_t and
sizes as paddr_ssize_t instead. The wrapper macros which did some
automatic casting removed. The requires updates at some of the places
where these functions are called.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: simple typo fixes in comments in core/include tree

* changed "the the" to "the" in crypto.h
* changed "the the" to "if the" in handle.h

Signed-off-by: Markus S. Wamser <github-dev@mail2013.wa

core: simple typo fixes in comments in core/include tree

* changed "the the" to "the" in crypto.h
* changed "the the" to "if the" in handle.h

Signed-off-by: Markus S. Wamser <github-dev@mail2013.wamser.eu>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tzc400: simplify tzc_configure_region() arguments

Change tzc_configure_region() to used the newly defined structure
tzc_region_config.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

tzc400: simplify tzc_configure_region() arguments

Change tzc_configure_region() to used the newly defined structure
tzc_region_config.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...