core: force read-only flag on .rodata.* sections

This commit fixes a warning with GCC 8.2 that did not occur with GCC 6.2:

$ make out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
CHK ou

core: force read-only flag on .rodata.* sections

This commit fixes a warning with GCC 8.2 that did not occur with GCC 6.2:

$ make out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/core/include/generated/asm-defines.h
CC out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
{standard input}: Assembler messages:
{standard input}:4087: Warning: setting incorrect section attributes for .rodata.__unpaged

The message is printed as the assembler processes this code fragment,
generated by the C compiler:

.section .rodata.__unpaged,"aw"

The older compiler (GCC 6.2) would generate instead:

.section .rodata.__unpaged,"a",%progbits

The problem with .rodata.__unpaged,"aw" is that the "w" (writeable) flag
is not consistent with the section name (.rodata.*), which by convention
is supposed to be read-only.

- The section name (".rodata.__unpaged") is given by our macro:
__rodata_unpaged.
- The "w" flag is added by GCC, not sure why exactly. One reason [1] is
when a relocatable binary is being generated and the structure contains
relocatable data. But, we are not explicitly asking for a relocatable
binary, so this might as well be a bug or counter-intuitive feature of
the compiler.

Anyway, to avoid the warning, we need to fix the section flags. The
section type (%progbits) is optional, it is deduced from the section name
by default. %progbits indicates that the section contains data (i.e., is
not empty).

Link: [1] https://gcc.gnu.org/ml/gcc/2004-05/msg01016.html
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: instrument mutexes with lockdep

Implements lockdep hooks for mutexes. CFG_LOCKDEP is disabled by default,
because it causes a noticeable slowdown (plain xtest runs 2-4x slower).

Tested-by: Je

core: instrument mutexes with lockdep

Implements lockdep hooks for mutexes. CFG_LOCKDEP is disabled by default,
because it causes a noticeable slowdown (plain xtest runs 2-4x slower).

Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU, HiKey960)
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: introduce lockdep algorithm

This commit introduces an algorithm that may be used to detect improper
usage of locks at runtime. It can detect two kinds errors:

1. A thread tries to release a

core: introduce lockdep algorithm

This commit introduces an algorithm that may be used to detect improper
usage of locks at runtime. It can detect two kinds errors:

1. A thread tries to release a lock it does not own,
2. A thread tries to aquire a lock and the operation could *potentially*
result in a deadlock.

The potential deadlock detection assumes that the code adheres to a strict
locking hierarchy, in other word, that there is a partial ordering on the
locks so that there can be no situation where circular waits can occur. To
put things simply, any two locks should be acquired in the same order in
the same thread. This addresses the following case:

[Thread #1] [Thread #2]

lock(A)
lock(B)
lock(B)
lock(A) <-- deadlock!
...

The algorithm builds the lock hierarchy dynamically and reports as soon as
a violation is detected.

The interface is made of two functions: lockdep_lock_acquire() and
lockdep_lock_release(), which are meant to be introduced in the
implementation of the actual lock objects. The "acquire" hook tells the
algorithm that a particular lock is about to be requested by a particular
thread, while the "release" hook is meant to be called before the lock is
actually released. If an error is detected, debugging information is sent
to the console, and panic() is called. The debugging information includes
the lock cycle that was detected (in the above example, {A, B}), as well
as the call stacks at the points where the locks were acquired.

The good thing with such an instrumentation of the locking code is that
there is no need to wait for an actual deadlock to occur in order to
detect potential problems. For instance, the timing of execution in the
above example could be different but the problem would still be detected:

[Thread #1] [Thread #2]

lock(A)
lock(B)
unlock(B)
unlock(A)
lock(B)
lock(A) <-- error!

A pseudo-TA is added for testing (pta/core_lockdep_tests.c).

This code is based on two sources:
- A presentation called "Dl-Check: dynamic potential deadlock detection
tool for Java programs" [1], although the somewhat complex MNR algorithm
for topological ordering of a DAG was not used;
- A depth-first search algorithm [2] was used instead.

Link: [1] https://www.slideshare.net/IosifItkin/tmpa2017-dlcheck-dynamic-potential-deadlock-detection-tool-for-java-programs
Link: [2] https://en.wikipedia.org/wiki/Topological_sorting#Depth-first_search
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: simplify shm cookie handling

Simplifies SHM cookie handling by storing the cookie in the mobj instead
of putting the burden on the caller. The cookie parameter is dropped
from the thread_rpc_*

core: simplify shm cookie handling

Simplifies SHM cookie handling by storing the cookie in the mobj instead
of putting the burden on the caller. The cookie parameter is dropped
from the thread_rpc_*_payload() functions. All callers of those
functions are also updated and unused cookie members of related structs
are removed too.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: modify tee_otp_get_hw_unique_key to return TEE_Result

Getting the hardware key can fail on some platforms. Modify the function
signature to return an appropriate error code.

Signed-off-by: Da

core: modify tee_otp_get_hw_unique_key to return TEE_Result

Getting the hardware key can fail on some platforms. Modify the function
signature to return an appropriate error code.

Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
Signed-off-by: Jordan Rhee <jordanrh@microsoft.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

optee_msg.h: remove OPTEE_MSG_ATTR_FRAGMENT

OPTEE_MSG_ATTR_FRAGMENT isn't defined. Remove it from comments and replace
with OPTEE_MSG_ATTR_NONCONTIG where applicable.

Acked-by: Jerome Forissier <je

optee_msg.h: remove OPTEE_MSG_ATTR_FRAGMENT

OPTEE_MSG_ATTR_FRAGMENT isn't defined. Remove it from comments and replace
with OPTEE_MSG_ATTR_NONCONTIG where applicable.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

io.h: add READ_ONCE macro

Compiler can rearrange memory reads and writes if it does
not see any dependency on them. This can be troublesome
if we deal with memory which is shared with non-secure wor

io.h: add READ_ONCE macro

Compiler can rearrange memory reads and writes if it does
not see any dependency on them. This can be troublesome
if we deal with memory which is shared with non-secure world.

READ_ONCE macro ensures that compiler will read memory only once.
It is simple wrapper over __compiler_atomic_load(), but it's name
emphasizes it's function.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: make stack trace robust

Makes stack trace robust by checking addresses before copying data.
Kernel stack traces are a bit more relaxed as we have crashed already.

Reviewed-by: Jerome Forissie

core: make stack trace robust

Makes stack trace robust by checking addresses before copying data.
Kernel stack traces are a bit more relaxed as we have crashed already.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960 AArch32, Aarch64)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (Juno, QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: tzc380: fix tzc_configure_region api

Signed-off-by: Silvano di Ninno <silvano.dininno@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

core: support for global shared buffers

Add support of allocating SHM shared with non-secure kernel
and exported to a non-secure userspace application.

Reviewed-by: Jens Wiklander <jens.wiklander@l

core: support for global shared buffers

Add support of allocating SHM shared with non-secure kernel
and exported to a non-secure userspace application.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

show more ...

core: stm32_uart driver

Used by platform stm32mp1.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <je

core: stm32_uart driver

Used by platform stm32mp1.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove get_rng_array()

Removes get_rng_array() in favor of crypto_rng_read() which always uses
the configured RNG implementation to draw random.

Reviewed-by: Jerome Forissier <jerome.forissier@lina

Remove get_rng_array()

Removes get_rng_array() in favor of crypto_rng_read() which always uses
the configured RNG implementation to draw random.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add new RNG implementation

Adds a new cryptographically secure pseudo random number generator known
as Fortuna. The implementation is based on the description in [0]. This
implementation repla

core: add new RNG implementation

Adds a new cryptographically secure pseudo random number generator known
as Fortuna. The implementation is based on the description in [0]. This
implementation replaces the implementation in LTC which was used until
now.

Gathering of entropy has been refined with crypto_rng_add_event() to
better match how entropy is added to Fortuna. A enum crypto_rng_src
identifies the source of the event. The source also controls how the
event is added. There are two options available, queue it in a circular
buffer for later processing or adding it directly to a pool. The former
option is suitable when being called from an interrupt handler or some
other place where RPC to normal world is forbidden.

plat_prng_add_jitter_entropy_norpc() is removed and
plat_prng_add_jitter_entropy() is updated to use this new entropy source
scheme.

The configuration of LTC is simplified by this, now PRNG is always drawn
via prng_mpa_desc.

plat_rng_init() takes care of initializing the PRNG in order to allow
platforms to override or enhance the Fortuna integration.

[0] Link:https://www.schneier.com/academic/paperfiles/fortuna.pdf

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_ta_manager: remove unused function tee_ta_get_client_id()

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Remove license notice from STMicroelectronics files

Since a while the source files license info are defined by SPDX
identifiers. We can safely remove the verbose license text from the
files that are

Remove license notice from STMicroelectronics files

Since a while the source files license info are defined by SPDX
identifiers. We can safely remove the verbose license text from the
files that are owned by either only STMicroelectronics or only both
Linaro and STMicroelectronics.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove vm_info_get_user_range()

Removes the now unused function vm_info_get_user_range().

Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260/pager/GP)
Reviewed-by: Etienne Carri

core: remove vm_info_get_user_range()

Removes the now unused function vm_info_get_user_range().

Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260/pager/GP)
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove tee_mmu_map_init()

Removes tee_mmu_map_init() and adds the map_kinit() call to
vm_info_init().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <j

core: remove tee_mmu_map_init()

Removes tee_mmu_map_init() and adds the map_kinit() call to
vm_info_init().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add vm_set_prot()

Adds vm_set_prot() to update the protection bits of an already registered
region.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <

core: add vm_set_prot()

Adds vm_set_prot() to update the protection bits of an already registered
region.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: more flexible ta mapping

Replaces the current fixed array of TA map entries where some indexes
have a special meaning. The new structures and functions dealing with this
has a vm_ prefix inste

core: more flexible ta mapping

Replaces the current fixed array of TA map entries where some indexes
have a special meaning. The new structures and functions dealing with this
has a vm_ prefix instead of the old tee_mmu_ prefix.

struct tee_ta_region is replaced by struct vm_region, which is now
stored in a linked list using the new TEE_MATTR-bits to identify special
regions.

struct tee_mmu_info is replaced by vm_info, which now keeps the head of
the linked list of regions.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add new TEE_MATTR defines

Adds TEE_MATTR_EPHEMERAL to tag TA mappings which are only used during a
single call (open session or invoke parameters).

Adds TEE_MATTR_PERMANENT to tag TA mappings

core: add new TEE_MATTR defines

Adds TEE_MATTR_EPHEMERAL to tag TA mappings which are only used during a
single call (open session or invoke parameters).

Adds TEE_MATTR_PERMANENT to tag TA mappings that must not be removed
(kernel mappings while in user mode).

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tee_mmu_types.h: define TEE_MATTR_* with BIT

Uses the BIT() macro to define the TEE_MATTR_* macros.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <

core: tee_mmu_types.h: define TEE_MATTR_* with BIT

Uses the BIT() macro to define the TEE_MATTR_* macros.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tee_mmu_add_rwmem(): remove pgdir_offset

Removes the pgdir_offset parameter from the tee_mmu_add_rwmem(). The
function is only called from one place and then with pgdir_offset as -1.

Reviewed

core: tee_mmu_add_rwmem(): remove pgdir_offset

Removes the pgdir_offset parameter from the tee_mmu_add_rwmem(). The
function is only called from one place and then with pgdir_offset as -1.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: introduce asm-defines-y

The Makefile rules that are used to generate a C header file containing
constants for struct offsets etc. are currently in mk/compile.mk. They
are used by core.mk whic

build: introduce asm-defines-y

The Makefile rules that are used to generate a C header file containing
constants for struct offsets etc. are currently in mk/compile.mk. They
are used by core.mk which sets a variable (asm-defines-file) before it
includes compile.mk. This works well for this purpose, but does not
scale to several files.

There is a use case for platform code to be able to use the asm-defines
mechanism, too. Therefore, introduce a variable that can be used in any
sub.mk: asm-defines-y.

In addition, to avoid duplication, the DEFINE and DEFINES macros are
moved to their own header (core/include/gen-asm-defines.h), with the
added benefit that it can be explicitly excluded from the checkpatch
list and thus not generate any warning on the 'DEFINE' macro needing
parentheses.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: add ddr overall register

register_ddr() is used to add overall DDR address range.
SDP memories, static SHM, secure DDR and so on need to fix the
problem that intersect with the overall DDR.

R

core: add ddr overall register

register_ddr() is used to add overall DDR address range.
SDP memories, static SHM, secure DDR and so on need to fix the
problem that intersect with the overall DDR.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Edison Ai <edison.ai@arm.com>

show more ...

Remove the unused file tee_kta_trace.h

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>