core: interrupt: halt other cores when one is panicking

When one core panics, send an SGI (CFG_CORE_HALT_CORES_ON_PANIC_SGI)
to halt other cores if CFG_CORE_HALT_CORES_ON_PANIC is enabled.

Signed-o

core: interrupt: halt other cores when one is panicking

When one core panics, send an SGI (CFG_CORE_HALT_CORES_ON_PANIC_SGI)
to halt other cores if CFG_CORE_HALT_CORES_ON_PANIC is enabled.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: print current guest ID in logs

If CFG_NS_VIRTUALIZATION is enabled include the current guest ID on each
log line. A number is added before the core number identifying the
currently set guest I

core: print current guest ID in logs

If CFG_NS_VIRTUALIZATION is enabled include the current guest ID on each
log line. A number is added before the core number identifying the
currently set guest ID, for example:
D/TC:2 0 0 call_initcalls:40 level 1 teecore_init_pub_ram()

Where the "2" indicates that this is done with guest ID 2 active.

Update the symbolize.py script accordingly to recognize and ignore an
eventual guest ID in a log entry.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: add support for transfer list

Add supports for Transfer List on both aarch32/64.
Fetch arguments from {x,r}{0-3} and check if a valid Transfer List
exists, which compliant to the Firmware Hand

core: add support for transfer list

Add supports for Transfer List on both aarch32/64.
Fetch arguments from {x,r}{0-3} and check if a valid Transfer List
exists, which compliant to the Firmware Handoff specification.
The Transfer List will be mapped during early initialization and
unmapped before exiting to next boot stage.
DTB and pagable address will be parsed from the Transfer List if
they exist as Transfer Entries.
If Transfer List does not exist or is invalid, legacy argument
handoff is backwards compatible.

Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: add transfer list API

Introduce Transfer List API into kernel to implement Firmware
Handoff specification

Link: https://github.com/FirmwareHandoff/firmware_handoff
Signed-off-by: Raymond Mao

core: add transfer list API

Introduce Transfer List API into kernel to implement Firmware
Handoff specification

Link: https://github.com/FirmwareHandoff/firmware_handoff
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: interrupt: remove old API functions

Remove old itr_xxx() API functions.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

core: notif: upgrade to new interrupt framework

Uses main controller ops to call .raise_sgi as the old API functions
itr_xxx() are deprecated.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org

core: notif: upgrade to new interrupt framework

Uses main controller ops to call .raise_sgi as the old API functions
itr_xxx() are deprecated.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: fix data abort during ftrace

With commit c10e3fa93d24 ("core: fix race in handling TA panic") the
resources of a panicked TAs are released as early as possible, including
the user space mapped

core: fix data abort during ftrace

With commit c10e3fa93d24 ("core: fix race in handling TA panic") the
resources of a panicked TAs are released as early as possible, including
the user space mapped ftrace buffer. However, the pointer to the ftrace
buffer is stored in the ts_session for quick and easy access. The ftrace
buffer is always retrieved with get_fbuf() that already have a few other
checks to see if the buffer is currently available. So add a check to
see that the TA hasn't panicked also.

Fixes: c10e3fa93d24 ("core: fix race in handling TA panic")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)

show more ...

core: interrupt: helper function interrupt_alloc_add_conf_handler()

Adds interrupt API function interrupt_alloc_add_conf_handler() to
allocate, configure and register an interrupt handler, providing

core: interrupt: helper function interrupt_alloc_add_conf_handler()

Adds interrupt API function interrupt_alloc_add_conf_handler() to
allocate, configure and register an interrupt handler, providing
interrupt type and priority.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

drivers: move to interrupt_call_handlers()

Removes itr_handle() in favor to interrupt_call_handlers(). This
changes updates all implemented main interrupt controller drivers that
are the GIC driver,

drivers: move to interrupt_call_handlers()

Removes itr_handle() in favor to interrupt_call_handlers(). This
changes updates all implemented main interrupt controller drivers that
are the GIC driver, the HFIC driver and Atmel SAIC driver.

Reviewed-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: dt_driver: add dt_driver_provider_priv_data()

Implements dt_driver_provider_priv_data() to get the private data
registered with a provider. Regulator framework will use this
function to return

core: dt_driver: add dt_driver_provider_priv_data()

Implements dt_driver_provider_priv_data() to get the private data
registered with a provider. Regulator framework will use this
function to return the regulator handle associated to a regulator
provider driver.

Acked-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: dt_driver: define DT_DRIVER_REGULATOR

Adds DT_DRIVER_REGULATOR for a regulator consumer to retrieve its
regulator device(s) from device tree information.

Acked-by: Gatien Chevallier <gatien.c

core: dt_driver: define DT_DRIVER_REGULATOR

Adds DT_DRIVER_REGULATOR for a regulator consumer to retrieve its
regulator device(s) from device tree information.

Acked-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: add non-volatile monotonic counter interface

Adds a stubbed non-volatile monotonic counter interface with a REE FS
counter. Platforms or drivers overrides the weak functions
nv_counter_get_ree

core: add non-volatile monotonic counter interface

Adds a stubbed non-volatile monotonic counter interface with a REE FS
counter. Platforms or drivers overrides the weak functions
nv_counter_get_ree_fs() and nv_counter_incr_ree_fs_to() to provide a
non-stubbed implementation of the counter.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: tpm: don't write to SPMC manifest

If "CFG_CORE_SEL1_SPMC=y" the TPM event log info is read from the SPMC
manifest instead of the external DT. The TPM event log handler code is
setting the even

core: tpm: don't write to SPMC manifest

If "CFG_CORE_SEL1_SPMC=y" the TPM event log info is read from the SPMC
manifest instead of the external DT. The TPM event log handler code is
setting the event log's address to zero in the DT, which fails since the
SPMC manifest is mapped as read-only. Remove this zeroing for the S-EL1
SPMC use case, it has no added security benefits since the SPMC manifest
DT itself is always in secure memory anyways.

Fixes: 722c618f0dfa ("core: map manifest using MEM_AREA_MANIFEST_DT")
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

show more ...

core: allow zero length for bounce buffer input

Allows zero length for bb_memdup_user(), bb_memdup_user_private(), and
bb_strndup_user().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
R

core: allow zero length for bounce buffer input

Allows zero length for bb_memdup_user(), bb_memdup_user_private(), and
bb_strndup_user().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: add bb_free_wipe()

Adds bb_free_wipe() the bounce buffer counter-part of free_wipe().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere

core: add bb_free_wipe()

Adds bb_free_wipe() the bounce buffer counter-part of free_wipe().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: dt_driver: fix error handling in probe_dt_drivers()

When the dt_driver_probe_list is empty but the dt_driver_failed_list
is not empty, meaning a probe has failed, and that there's no more prob

core: dt_driver: fix error handling in probe_dt_drivers()

When the dt_driver_probe_list is empty but the dt_driver_failed_list
is not empty, meaning a probe has failed, and that there's no more probe
to defer, the probe_dt_drivers() does not panic().

Fix and simplify the error handling to panic if a probe has failed.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: fix race in handling TA panic

A TA context (struct tee_ta_ctx), can only be accessed and manipulated
if either locked or set to busy by the current thread, or if it has no
no other references.

core: fix race in handling TA panic

A TA context (struct tee_ta_ctx), can only be accessed and manipulated
if either locked or set to busy by the current thread, or if it has no
no other references.

Prior to this patch this wasn't followed by tee_ta_open_session(),
tee_ta_invoke_command(), and dump_ta_memstats(). Accesses were made to
the "panicked" field of struct tee_ta_ctx.
destroy_ta_ctx_from_session() was also manipulating sessions possibly
being used by other threads.

So fix this by only accessing the internals of the TA context while
holding the needed lock. destroy_ta_ctx_from_session() is removed, the
new ts_ops callback release_state() is used instead to free what can be
freed from a panicked TA context. The last session referencing the TA
context will free it.

Fixes: fd10f62b8210 ("core: keep alive TA context can be created after TA has panicked")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Tested-by: Wentao Sun <wentao.sun@amlogic.com>

show more ...

core: add release_state to struct ts_ops

Adds the optional function pointer release_state() to struct ts_ops.
This callback will be called when a TA has panicked and as many
resources as possible ne

core: add release_state to struct ts_ops

Adds the optional function pointer release_state() to struct ts_ops.
This callback will be called when a TA has panicked and as many
resources as possible need to be released early. release_state() is a
subset of the destroy() callback. When the destroy() is called
eventually it will free the entire state of the TA regardless if
release_state() has been called before or not. This allows freeing
resources while there are still open sessions to the TA.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: use BB_MEMDUP_USER() where needed

Uses BB_MEMDUP_USER() instead of bb_memdup_user() where the destination
buffer isn't a void * in order to avoid using a extra void * variable to
handle the ou

core: use BB_MEMDUP_USER() where needed

Uses BB_MEMDUP_USER() instead of bb_memdup_user() where the destination
buffer isn't a void * in order to avoid using a extra void * variable to
handle the output pointer from bb_memdup_user().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: ldelf: apply finer-grained PAN

Prior to this commit, PAN was disabled when executing ldelf syscalls.
With the new user buffer aware ts_store API we can now enable
finer-grained PAN in ldelf sy

core: ldelf: apply finer-grained PAN

Prior to this commit, PAN was disabled when executing ldelf syscalls.
With the new user buffer aware ts_store API we can now enable
finer-grained PAN in ldelf syscalls.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: update ts_store API with user space buffer

Updates the read() function pointer in struct ts_store_ops to take an
user space buffer in addition to the previous core buffer. Core buffers
are nor

core: update ts_store API with user space buffer

Updates the read() function pointer in struct ts_store_ops to take an
user space buffer in addition to the previous core buffer. Core buffers
are normal secure memory while user space buffers should only be accessed
using the user_access.h functions.

The different TA storage implementations are updated accordingly.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: assign memory tags to bounce buffers

Just as the heap uses memory tags (CFG_MEMTAG=y) use memory tags for the
temporary bounce buffers. This should catch problems with out of bounds
accesses,

core: assign memory tags to bounce buffers

Just as the heap uses memory tags (CFG_MEMTAG=y) use memory tags for the
temporary bounce buffers. This should catch problems with out of bounds
accesses, using already freed, reset bounce buffers.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: asan: prevent nefarious optimization in unchecked memcpy() and memset()

Add __inhibit_loop_to_libcall qualifier to asan_memcpy_unchecked() and
asan_memset_unchecked() so that the compiler does

core: asan: prevent nefarious optimization in unchecked memcpy() and memset()

Add __inhibit_loop_to_libcall qualifier to asan_memcpy_unchecked() and
asan_memset_unchecked() so that the compiler does not invoke the real
(checked) memcpy() and memset().

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: allow redefinition of function huk_subkey_derive()

Set the function huk_subkey_derive() as weak to allow platform custom
implementation.
We add __huk_subkey_derive() with the implementation of

core: allow redefinition of function huk_subkey_derive()

Set the function huk_subkey_derive() as weak to allow platform custom
implementation.
We add __huk_subkey_derive() with the implementation of
HUK derivation so the default implementation is still accessible
when huk_subkey_derive() is overridden.
This is useful if the key derivation is implemented using hardware
discovered during intilization.
If the substem used to derive a key is disabled, the function
__huk_subkey_derive() can be used as a fallback.

Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: pta: add helper functions to support calls from TA when CFG_PAN=y

Introduce helper function to make it easier to use bounce buffers in a
PTA entry point to support calls with memrefs from user

core: pta: add helper functions to support calls from TA when CFG_PAN=y

Introduce helper function to make it easier to use bounce buffers in a
PTA entry point to support calls with memrefs from user space TAs when
PAN is enabled.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...