core: tpm: fix syntax in trace message

Fixes build warning (trace message below) when CFG_CORE_TPM_EVENT_LOG=y.

core/kernel/tpm.c:115:8: warning: format ‘%lu’ expects argument of type ‘long unsigne

core: tpm: fix syntax in trace message

Fixes build warning (trace message below) when CFG_CORE_TPM_EVENT_LOG=y.

core/kernel/tpm.c:115:8: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 7 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
115 | EMSG("TPM: Not enough space for the log: %zu, %lu",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
116 | buf_size, tpm_log_size);
| ~~~~~~~~~~~~
| |
| size_t {aka unsigned int}


Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

virt: rename CFG_VIRTUALIZATION to CFG_NS_VIRTUALIZATION

With the advent of virtualization support at S-EL2 in the Armv8.4-A
architecture, CFG_VIRTUALIZATION has become ambiguous. Let's rename
it to

virt: rename CFG_VIRTUALIZATION to CFG_NS_VIRTUALIZATION

With the advent of virtualization support at S-EL2 in the Armv8.4-A
architecture, CFG_VIRTUALIZATION has become ambiguous. Let's rename
it to CFG_NS_VIRTUALIZATION to indicate more clearly that it is about
supporting virtualization on the non-secure side.

This commit is the result of the following command:

$ for f in $(git grep -l -w CFG_VIRTUALIZATION); do \
sed -i -e 's/CFG_VIRTUALIZATION/CFG_NS_VIRTUALIZATION/g' $f; \
done

...plus the compatibility line in mk/config.mk:

CFG_NS_VIRTUALIZATION ?= $(CFG_VIRTUALIZATION)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>

show more ...

ldelf: Provide access to TS load address

Propagate ELF load address from ldelf to user mode context as a
preparation for load address relative memory regions.

Signed-off-by: Imre Kis <imre.kis@arm.

ldelf: Provide access to TS load address

Propagate ELF load address from ldelf to user mode context as a
preparation for load address relative memory regions.

Signed-off-by: Imre Kis <imre.kis@arm.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core, ldelf: add support for RISC-V

RISC-V support of argument for ldelf dump state.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@lin

core, ldelf: add support for RISC-V

RISC-V support of argument for ldelf dump state.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core, ldelf: replace is_arm32 with is_32bit

To refer to 32-bit mode, this commit replace is_arm32 with is_32bit
in the following files:
- core/kernel/ldelf_loader.c
- ldelf/include/ldelf.h
- ldelf/m

core, ldelf: replace is_arm32 with is_32bit

To refer to 32-bit mode, this commit replace is_arm32 with is_32bit
in the following files:
- core/kernel/ldelf_loader.c
- ldelf/include/ldelf.h
- ldelf/main.c

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: kernel: move ldelf_loader.c to core/kernel

Make other architecture implementations benefit from ldelf_loader.c,
therefore move it from core/arch/arm/kernel to core/kernel.
The header file is a

core: kernel: move ldelf_loader.c to core/kernel

Make other architecture implementations benefit from ldelf_loader.c,
therefore move it from core/arch/arm/kernel to core/kernel.
The header file is already located outside the arch folder.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: finalize scall layer

Finalizes the new scall layer by renaming remaining files so the generic
scall layer resides in core/include/kernel/scall.h and
core/kernel/scall.c.

New architectures are

core: finalize scall layer

Finalizes the new scall layer by renaming remaining files so the generic
scall layer resides in core/include/kernel/scall.h and
core/kernel/scall.c.

New architectures are expected to provide a
core/arch/arm/include/kernel/arch_scall.h with functions needed to deal
with the architecture specific struct thread_scall_regs usage in
core/kernel/scall.c.

New architectures are also expected to provide an implementation of
scall_save_panic_stack() called from scall_sys_return_helper().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: introduce scall layer from svc parts

Introduces a scall layer by renaming various thread_svc* names and
_*handle_svc() functions and function pointers as a first step in doing
architecture neu

core: introduce scall layer from svc parts

Introduces a scall layer by renaming various thread_svc* names and
_*handle_svc() functions and function pointers as a first step in doing
architecture neutral syscall processing.

The name scall is used instead of syscall since the syscall_ prefix is
reserved for the functions implementing the actual syscall. While scall
is the infrastructure used to reach the syscall functions.

No files are renamed and removed at this stage. This patch doesn't
change any behaviour.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: notif: allow GIC_PPI usage for async notif

Allows to use GIC_PPI interrupts for asynchronous notification.

This change replace macro COMPILE_TIME_ASSERT() with static_assert()
as the former i

core: notif: allow GIC_PPI usage for async notif

Allows to use GIC_PPI interrupts for asynchronous notification.

This change replace macro COMPILE_TIME_ASSERT() with static_assert()
as the former is deprecated.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dt_driver: differentiate error codes if property is not found

Differentiates error codes in dt_driver_device_from_node_idx_prop() if
the requested resource is not found by returning TEE_ERROR_

core: dt_driver: differentiate error codes if property is not found

Differentiates error codes in dt_driver_device_from_node_idx_prop() if
the requested resource is not found by returning TEE_ERROR_ITEM_NOT_FOUND.
This is useful to differentiate cases for optional properties in
drivers.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: kernel: move otp_stubs.c to core/kernel

otp_stubs.c is architecture-agnostic, therefore, move it
from core/arch/arm/kernel to core/kernel.

Signed-off-by: Marouene Boubakri <marouene.boubakri@

core: kernel: move otp_stubs.c to core/kernel

otp_stubs.c is architecture-agnostic, therefore, move it
from core/arch/arm/kernel to core/kernel.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: kernel: delay: sort-out architecture-independant code from arch dir

This commit moves core/arch/arm/kernel/delay.c to core/kernel/delay.c.
Keeps architecture-dependant code in
core/arch/$ARCH/

core: kernel: delay: sort-out architecture-independant code from arch dir

This commit moves core/arch/arm/kernel/delay.c to core/kernel/delay.c.
Keeps architecture-dependant code in
core/arch/$ARCH/include/kernel/delay_arch.h and moves generic functions
to core/include/kernel/delay.h

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: move tee_time.c and tee_time_ree.c to core/kernel

tee_time.c and tee_time_ree.c are architecture-independant code therefore
move them from core/arch/arm/kernel to core/kernel.

Signed-off-by:

core: move tee_time.c and tee_time_ree.c to core/kernel

tee_time.c and tee_time_ree.c are architecture-independant code therefore
move them from core/arch/arm/kernel to core/kernel.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Correct the description of core_is_buffer_outside

Correct the function description of core_is_buffer_outside
in comment.

Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Reviewed-by: J

core: Correct the description of core_is_buffer_outside

Correct the function description of core_is_buffer_outside
in comment.

Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: struct serial_ops: make all functions optional except putc()

Many platforms only use the putc() function pointer in struct
serial_ops. Therefore, explicitly make the others optional (flush(

drivers: struct serial_ops: make all functions optional except putc()

Many platforms only use the putc() function pointer in struct
serial_ops. Therefore, explicitly make the others optional (flush(),
have_rx_data() and getchar()) by adding comments to the struct and
making sure the code checks the pointer before using them.

With this it should be clear that drivers do not need to provide
stub functions.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: embedded_ts: use mempool to decompress TS image

Changes embedded TS management to have zlib using default mempool to
allocate buffers for image decompression. This is useful as the process
can

core: embedded_ts: use mempool to decompress TS image

Changes embedded TS management to have zlib using default mempool to
allocate buffers for image decompression. This is useful as the process
can require buffer of several kilobytes.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: kernel: move trace_ext.c to core/kernel

Functions in trace_ext.c are architecture independent, therefore, code
could be moved to core/kernel.

Signed-off-by: Marouene Boubakri <marouene.boubak

core: kernel: move trace_ext.c to core/kernel

Functions in trace_ext.c are architecture independent, therefore, code
could be moved to core/kernel.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: add fault mitigations in ree_fs_ta_open()

Adds and enables fault mitigation in ree_fs_ta_open() to check the
signature of the TA before returning success.

Acked-by: Jerome Forissier <jerome.f

core: add fault mitigations in ree_fs_ta_open()

Adds and enables fault mitigation in ree_fs_ta_open() to check the
signature of the TA before returning success.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add fault mitigations in buf_ta_open()

Adds and enables fault mitigation in buf_ta_open() to check both the
signature of the TA and then also the hash of the TA before returning
success.

Acke

core: add fault mitigations in buf_ta_open()

Adds and enables fault mitigation in buf_ta_open() to check both the
signature of the TA and then also the hash of the TA before returning
success.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: implement a method to dump user TA runtime status

This patch is to dump user TA runtime status for debug purposes.
The change includes:
1. Add new command (STATS_CMD_TA_STATS) in the stats PTA

core: implement a method to dump user TA runtime status

This patch is to dump user TA runtime status for debug purposes.
The change includes:
1. Add new command (STATS_CMD_TA_STATS) in the stats PTA.
2. Add tee_ta_dump_stats() to scan all ongoing TA instance and sessions
and snapshot their status.
3. Add new function: entry_dump_memstats() to __utee_entry() to get TA
heap statistics.
4. Add new compile option (CFG_TA_STATS, default n) to enable this
feature.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Weizhao Jiang <weizhaoj@amazon.com>
Signed-off-by: Weizhao Jiang <weizhaoj@amazon.com>
[jf: edit commit message]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: ree_fs: copy in encrypted TA header only once

In ree_fs_ta_open() when an encrypted TA is loaded there is an encrypted
TA sub-header. Prior to this patch it was copied in from non-secure
share

core: ree_fs: copy in encrypted TA header only once

In ree_fs_ta_open() when an encrypted TA is loaded there is an encrypted
TA sub-header. Prior to this patch it was copied in from non-secure
shared memory twice, first one time to read the total size of the
header, and then a second time to copy in the entire header. Fix this
by only copying in what wasn't copied the first time.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ree_fs: check ta size before use

Check that the total loaded size of a TA matches what is in the sign
header. This prevents an eventual attacker from providing arbitrary
values in the img_size

core: ree_fs: check ta size before use

Check that the total loaded size of a TA matches what is in the sign
header. This prevents an eventual attacker from providing arbitrary
values in the img_size field of the signed header.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Suggested-by: Asaf Modelevsky <amodele@amazon.com>
Reported-by: Asaf Modelevsky <amodele@amazon.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: dt: allow null value in reg property

This change allows reg property to have value 0. The reg property can
be used to describe an element that is not a physical address and
for which 0 is a va

core: dt: allow null value in reg property

This change allows reg property to have value 0. The reg property can
be used to describe an element that is not a physical address and
for which 0 is a valid value.

Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: support loading TAs signed with a subkey

Adds support to load TAs signed with subkey or a chain of subkeys. This
allows delegation of TA signing without distributing the root key. TAs
signed w

core: support loading TAs signed with a subkey

Adds support to load TAs signed with subkey or a chain of subkeys. This
allows delegation of TA signing without distributing the root key. TAs
signed with a subkey are confined to the UUID-V5 namespace of the subkey
to avoid TA UUID clashes with different subkeys.

SHDR_SUBKEY is a type of header which enables chains of public keys.
The public root key is used to verify the first public subkey, which
then is used to verify the next public subkey and so on.

The TA is finally verified using the last subkey. All these headers are
added in front of the TA binary so everything needed to verify the TA is
available when it's loaded into memory.

For example:
Subkey
struct shdr
magic: 0x4f545348
img_type: 3 (SHDR_SUBKEY)
img_size: 320 bytes
algo: 0x70414930 (TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256)
hash_size: 32 bytes
sig_size: 256 bytes
hash: f573f329fe77be686ce71647909c4ea35b5e1cd7de86369bd7d9fca31f6a4d65
struct shdr_subkey
uuid: f04fa996-148a-453c-b037-1dcfbad120a6
name_size: 64
subkey_version: 1
max_depth: 4
algo: 0x70414930 (TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256)
attr_count: 2
next name: "mid_level_subkey"
Next header at offset: 692 (0x2b4)
Subkey
struct shdr
magic: 0x4f545348
img_type: 3 (SHDR_SUBKEY)
img_size: 320 bytes
algo: 0x70414930 (TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256)
hash_size: 32 bytes
sig_size: 256 bytes
hash: 233a6dcf1a2cf69e50cde8e20c4129157da707c76fa86ce12ee31037edef02d7
struct shdr_subkey
uuid: 1a5948c5-1aa0-518c-86f4-be6f6a057b16
name_size: 64
subkey_version: 1
max_depth: 3
algo: 0x70414930 (TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256)
attr_count: 2
next name: "subkey1_ta"
Next header at offset: 1384 (0x568)
Bootstrap TA
struct shdr
magic: 0x4f545348
img_type: 1 (SHDR_BOOTSTRAP_TA)
img_size: 84576 bytes
algo: 0x70414930 (TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256)
hash_size: 32 bytes
sig_size: 256 bytes
hash: ea31ac7dc2cc06a9dc2853cd791dd00f784b5edc062ecfa274deeb66589b4ca5
struct shdr_bootstrap_ta
uuid: 5c206987-16a3-59cc-ab0f-64b9cfc9e758
ta_version: 0
TA offset: 1712 (0x6b0) bytes
TA size: 84576 (0x14a60) bytes

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_virt)
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: ree_fs: refactor check_update_version()

Refactors check_update_version() to support more than one version
database.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etien

core: ree_fs: refactor check_update_version()

Refactors check_update_version() to support more than one version
database.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...