core: asan: provide asan_memcpy_unchecked()

Provides asan_memcpy_unchecked() which does a memcpy() that isn't
checked against the tagging in the ASAN shadow area. If ASAN isn't
enabled it's replaced

core: asan: provide asan_memcpy_unchecked()

Provides asan_memcpy_unchecked() which does a memcpy() that isn't
checked against the tagging in the ASAN shadow area. If ASAN isn't
enabled it's replaced by a direct call to memcpy().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: enable non-contiguous temporary reference parameters

Now, when we can pass list of pages between REE and TEE it is possible
to use temporary memory references that are not located in a preallo

core: enable non-contiguous temporary reference parameters

Now, when we can pass list of pages between REE and TEE it is possible
to use temporary memory references that are not located in a preallocated
shared memory area. By employing OPTEE_MSG_ATTR_NONCONTIG parameter
attribute, REE can provide own buffer as a temporary memory reference.

Actually, such parameters are indistinguishable from registered shared
memory references. So, when OP-TEE spots temporary memory reference with
OPTEE_MSG_ATTR_NONCONTIG attribute, it will create `mobj_reg_shm` for it.
After call was handled, it will free that mobj.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (FVP, QEMU v7/v8)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (Juno with and without pager)
Tested-by: Volodymyr Babchuk <vlad.babchuk@gmail.com> (Rcar M3)

show more ...

core: dt: fix getting address and size

According to ePAPR spec.

"
The #address-cells and #size-cells properties may be used in any device
node that has children in the device tree hierarchy and des

core: dt: fix getting address and size

According to ePAPR spec.

"
The #address-cells and #size-cells properties may be used in any device
node that has children in the device tree hierarchy and describes how
child device nodes should be addressed. The #address-cells property
defines the number of <u32> cells used to encode the address field in
a child node’s reg property. The #size-cells property defines the number
of <u32> cells used to encode the size field in a child node’s reg
property.

The #address-cells and #size-cells properties are not inherited from
ancestors in the device tree. They shall be explicitly defined.

An ePAPR-compliant boot program shall supply #address-cells and #size-cells
on all nodes that have children.

If missing, a client program should assume a default value of 2 for

An ePAPR-compliant boot program shall supply #address-cells and #size-cells
on all nodes that have children.
"

So need to use the parent's address-cells and size-cells property.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: dt: introduce dt_have_prop

Introudce dt_have_prop

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

core: dt: typo fix

1. According to ePAPR spec, status should be okay/disabled/fail/fail-sss.
To Linux device tree, "okay" and "ok" are both used. Function is_okay
also use "okay" and "ok". But

core: dt: typo fix

1. According to ePAPR spec, status should be okay/disabled/fail/fail-sss.
To Linux device tree, "okay" and "ok" are both used. Function is_okay
also use "okay" and "ok". But "ok" is not defined in spec. Here only
correct comments

2. size -> sz

Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: asan: fix check_access()

Prior to this patch the for loop in check_access() that checks the
access in the shadow area is skipping accesses smaller than a ASAN block
(8 bytes). This patch fixes

core: asan: fix check_access()

Prior to this patch the for loop in check_access() that checks the
access in the shadow area is skipping accesses smaller than a ASAN block
(8 bytes). This patch fixes that problem and checks also smaller
accesses.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: asan: provide asan_memset_unchecked()

Provides asan_memset_unchecked() which does a memset that isn't checked
against the tagging in the ASAN shadow area. If ASAN isn't enabled it's
replaced b

core: asan: provide asan_memset_unchecked()

Provides asan_memset_unchecked() which does a memset that isn't checked
against the tagging in the ASAN shadow area. If ASAN isn't enabled it's
replaced by a direct call to memset().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove leading spaces and dots in DMSG() messages

Some debug messages have various amounts of leading spaces and dots
(.) probably in an attempt to better align the text. It is unreliable
because de

Remove leading spaces and dots in DMSG() messages

Some debug messages have various amounts of leading spaces and dots
(.) probably in an attempt to better align the text. It is unreliable
because debug traces include function names and line numbers, which
introduce random offsets. Remove these characters.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

ABI change: add OPTEE_MSG_ATTR_NONCONTIG handling

This patch introduces new attribute OPTEE_MSG_ATTR_NONCONTIG to allow
Normal World pass arbitrary list of physical pages as a shared buffer.

To rea

ABI change: add OPTEE_MSG_ATTR_NONCONTIG handling

This patch introduces new attribute OPTEE_MSG_ATTR_NONCONTIG to allow
Normal World pass arbitrary list of physical pages as a shared buffer.

To read this list of page address two new functions are added:
- msg_param_extract_pages() is a helper function that read pages list
into provided array

- msg_param_mobj_from_noncontig_param() constructs mobj from provided
struct optee_msg_param parameter. This mobj then can be used in
various parts of OP-TEE

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: ubsan: fix __ubsan_handle_nonnull_arg()

Fixes error:
core/kernel/ubsan.c:114:6: error: conflicting types for built-in function '__ubsan_handle_nonnull_arg' [-Werror]
void __ubsan_handle_nonnu

core: ubsan: fix __ubsan_handle_nonnull_arg()

Fixes error:
core/kernel/ubsan.c:114:6: error: conflicting types for built-in function '__ubsan_handle_nonnull_arg' [-Werror]
void __ubsan_handle_nonnull_arg(struct nonnull_arg_data *data, size_t arg_no);
^~~~~~~~~~~~~~~~~~~~~~~~~~
core/kernel/ubsan.c:229:6: error: conflicting types for built-in function '__ubsan_handle_nonnull_arg' [-Werror]
void __ubsan_handle_nonnull_arg(struct nonnull_arg_data *data,
^~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

When compiling with gcc 6.2.1

For the record: with GCC 6.0.0 __ubsan_handle_nonnull_arg() was changed to
take only one argument.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

msg_param: add msg_param.c with helper functions

This patch adds various helper functions to manipulate with parameters
passed to/from normal world.

Also it introduces new optee_param type which is

msg_param: add msg_param.c with helper functions

This patch adds various helper functions to manipulate with parameters
passed to/from normal world.

Also it introduces new optee_param type which is used to pass long
lists of parameters.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (Hikey)

show more ...

core: fix the keepalive condition in close session

According to the The GP Internal Core API v1.1:
The keepalive flag should be ignored when the single instance flag is
not set.

Reviewed-by: Jens W

core: fix the keepalive condition in close session

According to the The GP Internal Core API v1.1:
The keepalive flag should be ignored when the single instance flag is
not set.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>

show more ...

core: add linker.h for link script symbols

Moves all core extern declarations of linker script symbols into
<kernel/linker.h>.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off

core: add linker.h for link script symbols

Moves all core extern declarations of linker script symbols into
<kernel/linker.h>.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove __early_bss

Initialize the .bss section early from assembler before entering C
code. As a result, the __early_bss qualifier is not needed anymore.
Remove it, as well as the related symb

core: remove __early_bss

Initialize the .bss section early from assembler before entering C
code. As a result, the __early_bss qualifier is not needed anymore.
Remove it, as well as the related symbols (__early_bss_start and
__early_bss_end).

This makes the code simpler hence easier to maintain, at the expense
of initialization time, since .bss is cleared before CPU caches are
turned on (and doing it later would mean some C function have been
called already). Here are some performance numbers measured on HiKey.
The "memset" column measures the time it takes to clear .bss in C,
without this patch. The "assembly" column reports the time taken by the
clear_bss loop in this patch. Timings were performed using CNTPCT.
Worst case is a ~1 ms overhead in boot time.

memset(): | assembly:
ms (bytes) | ms (bytes)
--------------+--------------
Aarch64 0.30 (72824) | 0.08 (73528)
Aarch32 0.27 (65016) | 1.24 (65408)
Aarch32/pager 0.03 (11328) | 0.23 (11736)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey 32/64)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey/pager)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: set_invoke_timeout() use ADD_OVERFLOW()

Replaces the integer overflow checks in set_invoke_timeout() with
ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off

core: set_invoke_timeout() use ADD_OVERFLOW()

Replaces the integer overflow checks in set_invoke_timeout() with
ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm: generic boot: dt: switch console to /secure-chosen/stdout-path

If CFG_DT=y, check the Device Tree's /secure-chosen node and look for
the stdout-path property. Adjust the console output ac

core: arm: generic boot: dt: switch console to /secure-chosen/stdout-path

If CFG_DT=y, check the Device Tree's /secure-chosen node and look for
the stdout-path property. Adjust the console output accordingly.
The DT bindings for this property have been proposed on the LKML [1].

[1] https://www.spinics.net/lists/arm-kernel/msg566034.html

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

dt: Add dt_map_dev()

Maps a device into memory from its FDT node.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-

dt: Add dt_map_dev()

Maps a device into memory from its FDT node.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

dt: Add FDT manipulation functions

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wikland

dt: Add FDT manipulation functions

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: introduce struct dt_driver

When CFG_DT=y, a linker section is created (.rodata.dtdrv) to hold all
the DT-compatible drivers. The table can later be queried at runtime.
Some manipulation functi

core: introduce struct dt_driver

When CFG_DT=y, a linker section is created (.rodata.dtdrv) to hold all
the DT-compatible drivers. The table can later be queried at runtime.
Some manipulation functions are exported in <kernel/dt.h>.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add common implementation for console_putc() and console_flush()

Since most platforms now use the same console_putc() and
console_flush(), move them to core/kernel/console.c. Make them __weak

core: add common implementation for console_putc() and console_flush()

Since most platforms now use the same console_putc() and
console_flush(), move them to core/kernel/console.c. Make them __weak
so that platforms may still provide their own.
The common code expects the platforms to initialize whatever serial
device from console_init() and call register_console().

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: allow SDP buffers as memory reference parameters

Before this change, at OP-TEE entry (from non secure), memory
reference parameters needed to match the 'shm_mobj': the nonsecure
shared memory.

core: allow SDP buffers as memory reference parameters

Before this change, at OP-TEE entry (from non secure), memory
reference parameters needed to match the 'shm_mobj': the nonsecure
shared memory.

This change allows memory reference parameters to match the
registered SDP memories and be used when invoking TA that
claimed the SDP support through TA_FLAG_SECURE_DATA_PATH.

As SDP memory is not default mapped in OP-TEE core, nonsecure cannot
invoke a pseudo/static TA with a SDP memref parameter. only a user TA
can invoke a pseudo/static TA with a SDP memref parameter.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

rename 'static TA' into 'pseudo TA'

This renaming prevents confusion of what is a static TA: static
TAs are NOT Trusted Application operating at OP-TEE core privilege
execution level. There are rath

rename 'static TA' into 'pseudo TA'

This renaming prevents confusion of what is a static TA: static
TAs are NOT Trusted Application operating at OP-TEE core privilege
execution level. There are rather OP-TEE core services that offer
an invocation API based on GP TEE specified invocation API:
open session, invoke command and close session.

This change renames all 'static TA' references into 'pseudo TA'
references.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add support for user TA profiling with gprof (-pg)

Adds the infrastructure to collect profiling information from Trusted
Applications running in user mode and instrumented with -pg.
Enable with: CFG

Add support for user TA profiling with gprof (-pg)

Adds the infrastructure to collect profiling information from Trusted
Applications running in user mode and instrumented with -pg.
Enable with: CFG_TA_GPROF_SUPPORT=y.

Profiling support in itself adds no significant performance overhead.
Instrumented applications however may run 1.3x - 2x slower, and have a
larger .bss section (+1.36 times .text size for 32-bit TAs, +1.77 times
.text size for 64-bit ones).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (D02 64-bit)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU 32-bit)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove tee_dispatch_* functions

Prior to this patch the tee_dispatch_* functions where called when invoking
TAs from normal world.

The tee_dipatch_* functions provided little value and has no

core: remove tee_dispatch_* functions

Prior to this patch the tee_dispatch_* functions where called when invoking
TAs from normal world.

The tee_dipatch_* functions provided little value and has now been
collapsed into the architecture specific entry_std.c reducing the stack
usage.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove obsolete mobj_is_unsafe()

Removes obsolete mobj_is_unsafe(). As a consequence some tee_ta_manager code
can be removed too.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
T

core: remove obsolete mobj_is_unsafe()

Removes obsolete mobj_is_unsafe(). As a consequence some tee_ta_manager code
can be removed too.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...