core: update FS storage API with user space buffer

Updates the create(), read(), and write() function pointers in struct
ts_store_ops to take a user space buffer in addition to the previous
core buf

core: update FS storage API with user space buffer

Updates the create(), read(), and write() function pointers in struct
ts_store_ops to take a user space buffer in addition to the previous
core buffer. Core buffers are normal secure memory while user space
buffers should only be accessed using the user_access.h functions.

The different FS storage implementations are updated accordingly.

Note that the RPMB FS storage implementation resorts to using
enter_user_access() and exit_user_access() due to internal complexities.

Fixes: 4e154320e47c ("core: Apply finer-grained PAN")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: fix reading result in ldelf_dlopen()

The commit 52e7b1a67f8f ("core: use user-access functions in ldelf
interaction") start to use a bounce buffer to initialize the argument
for LDELF_DL_ENTRY

core: fix reading result in ldelf_dlopen()

The commit 52e7b1a67f8f ("core: use user-access functions in ldelf
interaction") start to use a bounce buffer to initialize the argument
for LDELF_DL_ENTRY_DLSYM. However, it also reads the result of
LDELF_DL_ENTRY_DLSYM from the bounce buffer. This is an error since the
result of LDELF_DL_ENTRY_DLSYM still remains on the stack used by ldelf.
So fix this by reading the result from the ldelf stack.

Fixes: 52e7b1a67f8f ("core: use user-access functions in ldelf interaction")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: add check_user_access() helper function

Adds check_user_access() to simplify checking if a user mode memory
buffer may be accessed as expected.

Signed-off-by: Jens Wiklander <jens.wiklander@l

core: add check_user_access() helper function

Adds check_user_access() to simplify checking if a user mode memory
buffer may be accessed as expected.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: kernel: Refine variable declarations and return values in dt.c

Provide initialization values for local variables. The return values of
libfdt functions are returned instead of -1 since libfdt

core: kernel: Refine variable declarations and return values in dt.c

Provide initialization values for local variables. The return values of
libfdt functions are returned instead of -1 since libfdt has its own
error codes and they are useful for debug.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: arm: Move some DT functions to common kernel

Some existed functions for device tree in ARM could be also used for
other architectures. This commit moves most of functions from ARM
architecture

core: arm: Move some DT functions to common kernel

Some existed functions for device tree in ARM could be also used for
other architectures. This commit moves most of functions from ARM
architecture into "core/kernel/dt.c", including external DT descriptor,
DT overlay, external DT initialization, API for adding DT child nodes
and reserved-memory nodes. Since "core/kernel/dt.c" is dependent with
CFG_DT, other functions which are independent with CFG_DT are put into
new file "core/kernel/boot.c".

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: fix update from user parameters with CFG_PAN=y

When CFG_PAN is enabled, OP-TEE kernel can not directly access the user
memory, otherwise an exception occurs. To fix it, we apply user-access
fu

core: fix update from user parameters with CFG_PAN=y

When CFG_PAN is enabled, OP-TEE kernel can not directly access the user
memory, otherwise an exception occurs. To fix it, we apply user-access
functions when OP-TEE kernel updates the parameters from user stack. A
bounce buffer is allocated and the user stack contents are duplicated
into the bounce buffer before OP-TEE kernel accesses them.

Fixes: 376448c26af4 ("core: use user-access functions for passing params")
Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix ldelf invalid access to user stack with CFG_PAN=y

When CFG_PAN is enabled, OP-TEE kernel can not directly access the user
memory, otherwise an exception occurs. To fix it, we apply user-ac

core: fix ldelf invalid access to user stack with CFG_PAN=y

When CFG_PAN is enabled, OP-TEE kernel can not directly access the user
memory, otherwise an exception occurs. To fix it, we apply user-access
functions when ldelf gets the parameters from the user stack "arg".

Fixes: 52e7b1a67f8f ("core: use user-access functions in ldelf interaction")
Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Apply finer-grained PAN

Prior to this commit, the PAN was disabled for most of the time,
within the thread scall handler. After resolving all outstanding
missing unprivileged access functions,

core: Apply finer-grained PAN

Prior to this commit, the PAN was disabled for most of the time,
within the thread scall handler. After resolving all outstanding
missing unprivileged access functions, we can now enable finer-
grained PAN, where the unprivileged access is only allowed inside
handful of special user-access functions.

There are some exceptions where we toggle PAN to allow the OP-TEE
core to access user memory, instead of using user-access functions
or bounce buffers. Those are crypto services and ldelf syscall
handlers. Those are chosen to avoid potential large bounce buffer
allocations.

Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: use user-access functions for passing params

Use user-access functions for parameter-passing between user TA and
the core when calling another TA from a TA and when entering a user
TA.

Signed

core: use user-access functions for passing params

Use user-access functions for parameter-passing between user TA and
the core when calling another TA from a TA and when entering a user
TA.

Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: use user-access functions in ldelf interaction

When interacting with LDELF, replace implicit user space accesses from
privileged mode using proper user-access functions.

Co-developed-by: Seon

core: use user-access functions in ldelf interaction

When interacting with LDELF, replace implicit user space accesses from
privileged mode using proper user-access functions.

Co-developed-by: Seonghyun Park <seonghp@amazon.com>
Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: add bb_strndup_user()

Adds bb_strndup_user() to copy a user space string into a bounce buffer
large enough to hold the string.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Review

core: add bb_strndup_user()

Adds bb_strndup_user() to copy a user space string into a bounce buffer
large enough to hold the string.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: add more user access functions

Add more user access functions: clear_user(), strnlen_user() and
bb_memdup_user(), which can be used to manipulate, check or duplicate
given user space buffers.

core: add more user access functions

Add more user access functions: clear_user(), strnlen_user() and
bb_memdup_user(), which can be used to manipulate, check or duplicate
given user space buffers.

Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: add bounce buffer to user mode context

Adds a bounce buffer for user space buffer to be used during syscall
processing to avoid unchecked privileged access into user space memory.

bb_alloc(),

core: add bounce buffer to user mode context

Adds a bounce buffer for user space buffer to be used during syscall
processing to avoid unchecked privileged access into user space memory.

bb_alloc(), bb_free(), and bb_reset() are added to manage memory
allocation from the bounce buffer.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: thread: Add support for canary value randomization

Currently hardcoded magic number is used as thread stack canary,
an attacker with full control over the overflow can embed the
hardcoded cana

core: thread: Add support for canary value randomization

Currently hardcoded magic number is used as thread stack canary,
an attacker with full control over the overflow can embed the
hardcoded canary value on the right location to bypass the overflow
detection.

To add extra layer of security, redefine the canary value as variable,
such that the canary can be initialized during runtime.

The canaries are initialized with static values from thread_init_canaries()
during the early boot stage. The plat_get_random_stack_canaries() is
refactored to support arbitrary-length random numbers, and a new function
called thread_update_canaries() is created to fetch the random values and
update the thread canaries. For CFG_NS_VIRTUALIZATION=y, the updated
function is disabled.

Signed-off-by: Vincent Chuang <Vincent.Chuang@mediatek.com>
Signed-off-by: Randy Hsu <Randy-CY.Hsu@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: interrupt: core controller uses irq_chip list head

Changes core interrupt controller API function (from interrupt.c) to
use the handlers list head added in struct itr_handler instead of
local

core: interrupt: core controller uses irq_chip list head

Changes core interrupt controller API function (from interrupt.c) to
use the handlers list head added in struct itr_handler instead of
local list head. With this change, main itr_chip is managed as a
standard itr_chip and its interrupts can be fetched from the irq_chip
handler functions.

CPU primary interrupt handler itr_handle() function now calls
generic interrupt controller interrupt_call_handlers().

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: interrupt: interrupt chip framework

Extends itr_chip framework to allow interrupt controllers to register
as interrupt chip and other interrupt management methods it their
owns interrupt consu

core: interrupt: interrupt chip framework

Extends itr_chip framework to allow interrupt controllers to register
as interrupt chip and other interrupt management methods it their
owns interrupt consumer through the interrupt_xxx() API function.

This change does not modify the existing interrupt API function that
allow a driver to get an interrupt from the CPU main interrupt controller.
A later change will remove these old API functions.

This changes adds fields in existing structures defined in interrupt.h:
- itr_handler::chip back references the interrupt controller
- itr_chip::handlers is a list head for controller registered handlers
- itr_chip::name for debug trace purpose
- itr_ops::mask and itr_ops::unmask to mask/unmask an interrupt

The new API functions exposed to interrupt consumers are:
- interrupt_add_configure_handler(), interrupt_remove_handler() and
helper functions interrupt_add_handler() and
interrupt_add_handler_with_chip();
- interrupt_alloc_add_handler() and interrupt_remove_free_handler();
- interrupt_configure(), interrupt_enable(), interrupt_disable(),
interrupt_mask() and interrupt_unmask();

Interrupt controllers shall call generic API function
interrupt_call_handlers() to have their registered consumer handlers
called upon their related interrupt occurrences.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver: swap TEE_result and retrieved device reference

Changes dt_driver callback function to return a TEE_Result value
and pass retrieved device reference by a output argument rather
than

core: dt_driver: swap TEE_result and retrieved device reference

Changes dt_driver callback function to return a TEE_Result value
and pass retrieved device reference by a output argument rather
than the opposite.

This change updates dt_driver.c, dt_driver.h and all drivers
implementing related dt_driver callback function.

As a consequence, this change removes all type definition related
to device specific callback handler function types which are useless
as all these now comply with type dt_driver_probe_func defined in
dt_driver.h.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: dt_driver: add helper for old fashion interrupt bindings

Adds a helper function dt_driver_device_from_node_idx_prop_phandle()
in device tree driver probing framework for when a DT node propert

core: dt_driver: add helper for old fashion interrupt bindings

Adds a helper function dt_driver_device_from_node_idx_prop_phandle()
in device tree driver probing framework for when a DT node property
contains a resource references but not the related device phandle as
first property cell, as for property "interrupts" which should get the
interrupt controller phandle from property "interrupt-parent". This
change aims at supporting "interrupts" property DT bindings.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver: define interrupt controller drivers identifier

Defines identifier DT_DRIVER_INTERRUPT in dt_driver_type enumerated type
for interrupt controller drivers.

Acked-by: Jens Wiklander <

core: dt_driver: define interrupt controller drivers identifier

Defines identifier DT_DRIVER_INTERRUPT in dt_driver_type enumerated type
for interrupt controller drivers.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: interrupt: rename internal itr_chip to itr_main_chip

Renames local variable itr_chip into itr_main_chip to emphasize it is
the CPU main interrupt controller.

Reviewed-by: Jens Wiklander <jens

core: interrupt: rename internal itr_chip to itr_main_chip

Renames local variable itr_chip into itr_main_chip to emphasize it is
the CPU main interrupt controller.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: interrupt: interrupt_get_main_chip() returns main controller

Adds helper function interrupt_get_main_chip() to get the struct itr_chip
reference of the CPU main interrupt controller (e.g. the

core: interrupt: interrupt_get_main_chip() returns main controller

Adds helper function interrupt_get_main_chip() to get the struct itr_chip
reference of the CPU main interrupt controller (e.g. the GIC). This
function helps adapting a generic interrupt controller framework to
consider CPU main interrupt controller specific reference.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: rename dt_driver_phandle_args to dt_pargs

Renames struct dt_driver_phandle_args to struct dt_pargs to
shorten the label and prevent ugly line breaks in function
signatures.

Acked-by: Jens Wik

core: rename dt_driver_phandle_args to dt_pargs

Renames struct dt_driver_phandle_args to struct dt_pargs to
shorten the label and prevent ugly line breaks in function
signatures.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver_test: move source file to core/pta/test/

Moves dt_driver_test.c from core/kernel/ to core/pta/test/ where most
embedded tests implementation are located. This is legitimate as the
te

core: dt_driver_test: move source file to core/pta/test/

Moves dt_driver_test.c from core/kernel/ to core/pta/test/ where most
embedded tests implementation are located. This is legitimate as the
test results are retrieved from the Invoke PTA interface, even if the
test is not effectively run from an invocation command of that PTA.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver_test: fix test failure status

Before this change, failing clock/reset/gpios tests do print a
"not run" status message because related status dt_test_state.probe_xxx
remains to DEFAUL

core: dt_driver_test: fix test failure status

Before this change, failing clock/reset/gpios tests do print a
"not run" status message because related status dt_test_state.probe_xxx
remains to DEFAULT value and are never set to FAILED. Fix this and
move each test to a specific local function to ease error cases
management using 'goto' instructions.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver_test: clarify "not run" status message

Changes trace message from "not passed" to "not run" when a test
is not run.

Suggested-by: Jerome Forissier <jerome.forissier@linaro.org>
Acke

core: dt_driver_test: clarify "not run" status message

Changes trace message from "not passed" to "not run" when a test
is not run.

Suggested-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...