core: support shared irq

With some platforms would have multiplexed interrupts
and software implement difference interrupt handler.
Currently the interrupt mechanism only handle the first
matched ha

core: support shared irq

With some platforms would have multiplexed interrupts
and software implement difference interrupt handler.
Currently the interrupt mechanism only handle the first
matched handler, and can not support shared irq.

New change to keep find another matched handler if the
previous handler return none.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: davidwang <davidwang@realtek.com>

show more ...

core: add common user_mode_ctx_print_mappings()

Adds a common user_mode_ctx_print_mappings() which prints the current
user mode mappings.

Acked-by: Pipat Methavanitpong <pipat.methavanitpong@linaro

core: add common user_mode_ctx_print_mappings()

Adds a common user_mode_ctx_print_mappings() which prints the current
user mode mappings.

Acked-by: Pipat Methavanitpong <pipat.methavanitpong@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add struct user_mode_ctx

Adds struct user_mode_ctx which replaces user mode specific fields used
for memory mapping.

Acked-by: Pipat Methavanitpong <pipat.methavanitpong@linaro.org>
Acked-by:

core: add struct user_mode_ctx

Adds struct user_mode_ctx which replaces user mode specific fields used
for memory mapping.

Acked-by: Pipat Methavanitpong <pipat.methavanitpong@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: reference count struct mobj

The mobj interface is changed to use reference counting of mobjs, the
direct mobj_free() call is replaced by mobj_put(). As expected a
mobj_get() is also added to h

core: reference count struct mobj

The mobj interface is changed to use reference counting of mobjs, the
direct mobj_free() call is replaced by mobj_put(). As expected a
mobj_get() is also added to handle multiple references to the same mobj.

This also changes already present reference counting in struct
mobj_reg_shm to use the reference counting mechanism now available in
struct mobj.

The VM_FLAG_EXCLUSIVE_MOBJ flag is removed since the referenced mobj is
put instead when a struct vm_region is removed.

Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960)
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker script. The
address and size of the buffer is passed to the TEE core via a call to
the gprof PTA. After this call, the TEE core accesses the buffer
periodically, such as when the TA is interrupted by a timer interrupt.

Commit ef305e54eac8 ("libutee: allocate temp secmem for invoke")
modified the way that private TA memory is mapped in TA to TA
invocations, so that memory is mapped only for the duration of the
call. After this point, the memory is unmapped so the gprof sample
buffer becomes inaccessible, resulting in a crash:

E/TC:0 0 Core data-abort at address 0x121356 (translation fault)
E/TC:0 0 fsr 0x00000007 ttbr0 0x0e19206a ttbr1 0x0e18806a cidr 0x2
E/TC:0 0 cpu #0 cpsr 0x800001f2
E/TC:0 0 r0 0x00000000 r4 0x00000000 r8 0x00000000 r12 0x0017bb4b
E/TC:0 0 r1 0x000021ab r5 0x00000000 r9 0x00000000 sp 0x0e1928f0
E/TC:0 0 r2 0x0011d000 r6 0x00000000 r10 0x00000000 lr 0x0e112763
E/TC:0 0 r3 0x00121356 r7 0x0e1928f0 r11 0x00000000 pc 0x0e12958e
E/TC:0 0 Core data-abort at address 0x121356 .debug_info+1184598 (translation fault)
E/TC:0 0 Call stack:
E/TC:0 0 0x0e12958e tee_ta_gprof_sample_pc at optee_os/core/kernel/tee_ta_manager.c:897

The solution is to allocate and map the sample buffer explicitly in
user space when profiling is initialized, and at the same time get rid
of the reserved area in the TA linker script. The TEE core also needs
to check that the sample buffer is valid before writing to it,
otherwise a malicious TA could crash the core by unmapping that memory.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

core: remove algo from crypto_mac_*()

Removes the algo parameters from all crypto_mac_*() functions except
crypto_mac_alloc_ctx().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-

core: remove algo from crypto_mac_*()

Removes the algo parameters from all crypto_mac_*() functions except
crypto_mac_alloc_ctx().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are in

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are invoked by user TAs into the TEE core.

And after this patch ftrace will cover both TA and TEE core code. So lets
rename config option from CFG_TA_FTRACE_SUPPORT to CFG_FTRACE_SUPPORT.

It is optional to enable syscall trace via CFG_SYSCALL_FTRACE=y config
option in addition to CFG_FTRACE_SUPPORT=y config option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: add support for dumping build configuration info on boot

During development, we occasionally experience crashes within the TEE
core. When the tests are run locally, the developer has all the n

core: add support for dumping build configuration info on boot

During development, we occasionally experience crashes within the TEE
core. When the tests are run locally, the developer has all the needed
information to troubleshoot the issue. But when the crash occurs on a
remote host (CI for instance), it is sometimes inconvenient or even
impossible to retrieve files other than the console logs. As a result,
it is equally inconvenient or impossible to obtain a symbolized crash
dump (scripts/symbolize.py needs the dump message but also tee.elf).
If the exact build configuration is known, then it is possible to
reproduce the build locally (assuming the same toolchain is also used
which is not a problem in practice) and proceed with debugging.
Unfortunately the values of the CFG_ flags are not always shown in the
logs and omitting only one flag can significantly change the TEE
binary.

This commit introduces CFG_SHOW_CONF_ON_BOOT (default n). When enabled,
the contents of the build configuration file $O/conf.mk is printed
to the secure console during initialization with TRACE_INFO severity.
The file is compressed to reduce memory usage and space used in the
logs, and it is encoded into printable text.

To obtain the conf.mk file, one needs to copy and paste the encoded
text into 'base64 -d | xz -d'. These two commands are also required at
build time when CFG_SHOW_CONF_ON_BOOT is y.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: exclude only foreign interrupt time

Current TA function execution time feature only reports user mode
execution time and exclude any non-user mode execution time. But in
case of syscalls whi

ftrace: exclude only foreign interrupt time

Current TA function execution time feature only reports user mode
execution time and exclude any non-user mode execution time. But in
case of syscalls which are essentially function invocations from TA
into the kernel, we shouldn't exclude syscall execution time in order
to account for actual function execution time. That means we only
exclude time that is spent serving foreign interrupts.

So changes in this patch allows to incorporate syscall execution time
in the function graph output.

Fixes: f5df167c2ffb ("ftrace: Add function execution time support")
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: add DT function to read/modify DT

Add DT functions:
dt_get_irq()
get the interrupt number of a node

dt_disable_status()
disable the 'status' field of node's prop

dt_enable_secure_status(

core: add DT function to read/modify DT

Add DT functions:
dt_get_irq()
get the interrupt number of a node

dt_disable_status()
disable the 'status' field of node's prop

dt_enable_secure_status()
set 'secure-status' field of node's prop and disable
the 'status' field in the same time

Signed-off-by: Cedric Neveux <cedric.neveux@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: replace thread_nintr_handler_ptr with weak function

Removes registration of platform specific secure interrupt handler in
thread_nintr_handler_ptr. Instead a __weak overridable
itr_core_handle

core: replace thread_nintr_handler_ptr with weak function

Removes registration of platform specific secure interrupt handler in
thread_nintr_handler_ptr. Instead a __weak overridable
itr_core_handler() is provided. Platforms which expects to receive
secure interrupts must override the default function. The default
function calls panic() if called.

With this also nintr is removed from struct thread_handlers and
consequently all platforms are updated to stop using that field.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix possible NULL dereference in tee_ta_close_session()

This patch fixes a possible NULL dereference in a debug print in
tee_ta_close_session() which is done before checking the supplied
param

core: fix possible NULL dereference in tee_ta_close_session()

This patch fixes a possible NULL dereference in a debug print in
tee_ta_close_session() which is done before checking the supplied
parameter for NULL.

Fixes: 99164a05ff51 ("core: do not use virtual addresses as session identifier")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: Add function execution time support

Add support to dump function execution time at corresponding function
exit points in output ftrace buffer.

To achieve proper function execution time we n

ftrace: Add function execution time support

Add support to dump function execution time at corresponding function
exit points in output ftrace buffer.

To achieve proper function execution time we need to exclude TA suspend
time from timestamps, so add corresponding support in TEE core.

Also user mapping must be active to access ftrace buffer, so do that
during TA resume.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: console: fix use after free when CFG_DT=y

Commit 770b2afacf33 ("core: more flexible console init from DT") has
split configure_console_from_dt() in two parts, the first one being
moved to a ne

core: console: fix use after free when CFG_DT=y

Commit 770b2afacf33 ("core: more flexible console init from DT") has
split configure_console_from_dt() in two parts, the first one being
moved to a new function: get_console_node_from_dt(). Unfortunately,
this function may return pointers to a freed buffer.

Fix the problem by allocating each output string on the heap and letting
the caller clean on return.

Fixes: 770b2afacf33 ("core: more flexible console init from DT")
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinksi@pengutronix.de>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: dump ftrace data with ldelf

Uses ldelf to dump ftrace data from a TA.

Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerom

core: dump ftrace data with ldelf

Uses ldelf to dump ftrace data from a TA.

Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: load TAs using ldelf

Uses ldelf to load and relocate TAs instead of parsing and loading the
ELFs in TEE Core. TA abort dumps, ASLR and ftrace are temporarily
removed or disabled to be re-enabl

core: load TAs using ldelf

Uses ldelf to load and relocate TAs instead of parsing and loading the
ELFs in TEE Core. TA abort dumps, ASLR and ftrace are temporarily
removed or disabled to be re-enabled in following commits.

Loading dynamically linked TAs are from now on always supported and
cannot be disabled via configuration flags. CFG_TA_DYNLINK is also
removed as a configuration option.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove tee_ta_dump_current()

tee_ta_dump_current() is only called from abort_print_current_ta(), move
the trivial implementation into abort_print_current_ta() and remove
tee_ta_dump_current().

core: remove tee_ta_dump_current()

tee_ta_dump_current() is only called from abort_print_current_ta(), move
the trivial implementation into abort_print_current_ta() and remove
tee_ta_dump_current().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: lockdep: support non-blocking acquire

Adds support for non-blocking lock semantics such as mutex_trylock().
A new function is introduced to instrument this operation:
lockdep_tryacquire(). It

core: lockdep: support non-blocking acquire

Adds support for non-blocking lock semantics such as mutex_trylock().
A new function is introduced to instrument this operation:
lockdep_tryacquire(). It should be called when it is known that
ownership of the underlying object has been granted to the caller. It
behaves similarly to lockdep_acquire() in that it does record the call
stack and records that the lock is owned. But it does not create any
dependencies to the locks that are currently owned by the caller. See
"Dynamic Lock Dependency Analysis of Concurrent Systems" [1] section
5.3.

Link: [1] http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.87.132&rep=rep1&type=pdf
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: lockdep: support lock destroy

With lockdep enabled (CFG_LOCKDEP=y), additional cleanup is needed when
a mutex is destroyed. This patch adds mutex_destroy_check() which is
called when a mutex i

core: lockdep: support lock destroy

With lockdep enabled (CFG_LOCKDEP=y), additional cleanup is needed when
a mutex is destroyed. This patch adds mutex_destroy_check() which is
called when a mutex is destroyed with mutex_destroy(). From
mutex_destroy_check() the corresponding lockdep node and all edges
referring to it are removed.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: prepare support for TA function tracing

To support TA function tracing OP-TEE core role being:
- To initialize and register ftrace buffer per TA session.
- To dump TA ftrace buffer to normal w

core: prepare support for TA function tracing

To support TA function tracing OP-TEE core role being:
- To initialize and register ftrace buffer per TA session.
- To dump TA ftrace buffer to normal world via RPC call in case TA
session closes or in case of TA abort.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)

show more ...

core: move embedded DTB out of init sections

This change makes generic boot to discover non-secure memory and
console configuration from the external DTB only, no more from the
embedded DTB as prior

core: move embedded DTB out of init sections

This change makes generic boot to discover non-secure memory and
console configuration from the external DTB only, no more from the
embedded DTB as prior this change. When generic boot attempts to access
embedded DTB, the embedded DTB gets located in init read-only data
section become unnecessary too big. With this change, embedded DTB now
lies in the standard pageable read-only data section, relaxing memory
footprint constraint.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: handle_db: add ptr_destructor argument

Adds ptr_destructor argument to handle_db_destroy() which is called for
each registered pointer.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.

core: handle_db: add ptr_destructor argument

Adds ptr_destructor argument to handle_db_destroy() which is called for
each registered pointer.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix session closure when open panicked

Change tee_ta_close_session() function to support panicked TA contexts.
Prior this change, the function did not expect referenced context
had previously

core: fix session closure when open panicked

Change tee_ta_close_session() function to support panicked TA contexts.
Prior this change, the function did not expect referenced context
had previously panicked. Since recent changes for reloadable keep alive
TAs, referenced below, Panic on open session does completely release
context which session closure is expected to proceed to.

Fixes: https://github.com/OP-TEE/optee_os/issues/3003
Fixes: fd10f62b8210 ("core: keep alive TA context can be created after TA has panicked")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU, GP)

show more ...

core: FS: wipe sensitive data after use

The secure storage code makes use of various cryptographic data (keys
and IVs). Make sure the buffers are wiped after use to minimize the
risks that sensitive

core: FS: wipe sensitive data after use

The secure storage code makes use of various cryptographic data (keys
and IVs). Make sure the buffers are wiped after use to minimize the
risks that sensitive data may be leaked to an attacker who would have
gained some access to the secure memory.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reported-by: Bastien Simondi <bsimondi@netflix.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

core: check for overflow in msg_param_mobj_from_noncontig()

msg_param_mobj_from_noncontig() does not check that buf_ptr + size does
not overflow. As a result, num_pages could be computed small, whil

core: check for overflow in msg_param_mobj_from_noncontig()

msg_param_mobj_from_noncontig() does not check that buf_ptr + size does
not overflow. As a result, num_pages could be computed small, while
size could be big. Only num_pages will be mapped/registered in the
returned mobj. If the caller does not compare mobj->size with required
size, it can end up manipulating memory out of the intended region.

Fix the issue by using overflow checking macros.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reported-by: Bastien Simondi <bsimondi@netflix.com> [1.2]
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...