core: reference count struct mobj

The mobj interface is changed to use reference counting of mobjs, the
direct mobj_free() call is replaced by mobj_put(). As expected a
mobj_get() is also added to h

core: reference count struct mobj

The mobj interface is changed to use reference counting of mobjs, the
direct mobj_free() call is replaced by mobj_put(). As expected a
mobj_get() is also added to handle multiple references to the same mobj.

This also changes already present reference counting in struct
mobj_reg_shm to use the reference counting mechanism now available in
struct mobj.

The VM_FLAG_EXCLUSIVE_MOBJ flag is removed since the referenced mobj is
put instead when a struct vm_region is removed.

Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960)
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker

gprof: fix TEE core crash by allocating sample buffer dynamically

The gprof sample buffer is in user space memory but is also accessed by
the TEE core. Currently, space is reserved by the TA linker script. The
address and size of the buffer is passed to the TEE core via a call to
the gprof PTA. After this call, the TEE core accesses the buffer
periodically, such as when the TA is interrupted by a timer interrupt.

Commit ef305e54eac8 ("libutee: allocate temp secmem for invoke")
modified the way that private TA memory is mapped in TA to TA
invocations, so that memory is mapped only for the duration of the
call. After this point, the memory is unmapped so the gprof sample
buffer becomes inaccessible, resulting in a crash:

E/TC:0 0 Core data-abort at address 0x121356 (translation fault)
E/TC:0 0 fsr 0x00000007 ttbr0 0x0e19206a ttbr1 0x0e18806a cidr 0x2
E/TC:0 0 cpu #0 cpsr 0x800001f2
E/TC:0 0 r0 0x00000000 r4 0x00000000 r8 0x00000000 r12 0x0017bb4b
E/TC:0 0 r1 0x000021ab r5 0x00000000 r9 0x00000000 sp 0x0e1928f0
E/TC:0 0 r2 0x0011d000 r6 0x00000000 r10 0x00000000 lr 0x0e112763
E/TC:0 0 r3 0x00121356 r7 0x0e1928f0 r11 0x00000000 pc 0x0e12958e
E/TC:0 0 Core data-abort at address 0x121356 .debug_info+1184598 (translation fault)
E/TC:0 0 Call stack:
E/TC:0 0 0x0e12958e tee_ta_gprof_sample_pc at optee_os/core/kernel/tee_ta_manager.c:897

The solution is to allocate and map the sample buffer explicitly in
user space when profiling is initialized, and at the same time get rid
of the reserved area in the TA linker script. The TEE core also needs
to check that the sample buffer is valid before writing to it,
otherwise a malicious TA could crash the core by unmapping that memory.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

drivers: gic: Add GIC_SPI/SGI/PPI helper macros

Add GIC_SPI/SGI/PPI helper macros

Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
Signed-off-by: Sheetal Tigadoli <sheetal.tiga

drivers: gic: Add GIC_SPI/SGI/PPI helper macros

Add GIC_SPI/SGI/PPI helper macros

Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
Signed-off-by: Sheetal Tigadoli <sheetal.tigadoli@broadcom.com>
Reviewed-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add invoke_tests.pta to enumerated TAs

For testing purposes Add invoke_tests.pta to enumerated TAs. This gives
optee_enumerate_devices() in the OP-TEE kernel driver something to
iterate over i

core: add invoke_tests.pta to enumerated TAs

For testing purposes Add invoke_tests.pta to enumerated TAs. This gives
optee_enumerate_devices() in the OP-TEE kernel driver something to
iterate over in case there's no other TAs to enumerate.

Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm32: disable interrupt in thread_excp_vect_workaround

thread_excp_vect_workaround isn't interrupt safe because it use
the tpidr as a temporary register to save value of r0.
That means if a f

core: arm32: disable interrupt in thread_excp_vect_workaround

thread_excp_vect_workaround isn't interrupt safe because it use
the tpidr as a temporary register to save value of r0.
That means if a fiq happened when optee is processing a syscall,
the syscall argument r0 will be changed to unexpected value.

Move `write_tpidrprw r0` out of `vector_prologue_spectre` and add
`cpsid aif` before it to fix this issue.

Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Reviewed-by: Alix Wu <alix.wu@mediatek.com>
Reviewed-by: YJ Chiang <yj.chiang@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix style issues in cbc_cts_update()

Adds default initialization of local variables, one indentation error
and removes a pair of redundant parentheses.

Reviewed-by: Jerome Forissier <jerome@f

core: fix style issues in cbc_cts_update()

Adds default initialization of local variables, one indentation error
and removes a pair of redundant parentheses.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove algo from crypto_authenc_*()

Removes the algo parameters from all crypto_authenc_*() functions except
crypto_authenc_alloc_ctx().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro

core: remove algo from crypto_authenc_*()

Removes the algo parameters from all crypto_authenc_*() functions except
crypto_authenc_alloc_ctx().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove algo from crypto_mac_*()

Removes the algo parameters from all crypto_mac_*() functions except
crypto_mac_alloc_ctx().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-

core: remove algo from crypto_mac_*()

Removes the algo parameters from all crypto_mac_*() functions except
crypto_mac_alloc_ctx().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove algo from crypto_cipher_*()

Removes the algo parameters from all crypto_cipher_*() functions except
crypto_cipher_alloc_ctx().

tee_aes_cbc_cts_update() is moved into aes-cts.c and rena

core: remove algo from crypto_cipher_*()

Removes the algo parameters from all crypto_cipher_*() functions except
crypto_cipher_alloc_ctx().

tee_aes_cbc_cts_update() is moved into aes-cts.c and renamed to
cbc_cts_update().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove algo from crypto_hash_*()

Removes the algo parameters from all crypto_hash_*() functions except
crypto_hash_alloc_ctx().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Ack

core: remove algo from crypto_hash_*()

Removes the algo parameters from all crypto_hash_*() functions except
crypto_hash_alloc_ctx().

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: compile assembler code with -marm by default

When CFG_FTRACE_SUPPORT=y, thumb mode should not be used in TA code,
because the ftrace code assumes arm instructions. Therefore we have to
pass t

arm32: compile assembler code with -marm by default

When CFG_FTRACE_SUPPORT=y, thumb mode should not be used in TA code,
because the ftrace code assumes arm instructions. Therefore we have to
pass the -marm switch to the compiler and assembler. This is correctly
done for the C compiler but not for the assembler. The same applies to
assembler files in the TEE core when CFG_SYSCALL_FTRACE=y.

More generally and for simplicity, we will assume that all _a32.S files
should be compiled in arm mode and therefore add -marm to
arm32-platform-aflags. Any exception can be handled via file-specific
flags in sub.mk.

Fixes a crash in the setjmp()/longjmp() test of xtest 1006 when Linaro's
GCC 6.2 is used to build the user space libutils.a (more precisely:
lib/libutils/isoc/arch/arm/setjmp_a32.S):

E/TC:? 0 User TA prefetch-abort at address 0x0 (translation fault)
E/TC:? 0 fsr 0x00000005 ttbr0 0x0e19206a ttbr1 0x0e18806a cidr 0x2
E/TC:? 0 cpu #1 cpsr 0x60000110
E/TC:? 0 r0 0x00000000 r4 0x00115780 r8 0x00000000 r12 0x00115658
E/TC:? 0 r1 0x00000001 r5 0x0011fb8c r9 0x00000000 sp 0x001156a0
E/TC:? 0 r2 0x00000000 r6 0x60000110 r10 0x00000000 lr 0x00000000
E/TC:? 0 r3 0x00000000 r7 0x00000000 r11 0x001156bc pc 0x00000000
E/LD: Status of TA 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b
E/LD: arch: arm
E/LD: region 0: va 0x00102000 pa 0x0e300000 size 0x002000 flags rw-s (ldelf)
E/LD: region 1: va 0x00104000 pa 0x0e302000 size 0x00a000 flags r-xs (ldelf)
E/LD: region 2: va 0x0010e000 pa 0x0e30c000 size 0x001000 flags rw-s (ldelf)
E/LD: region 3: va 0x0010f000 pa 0x0e30d000 size 0x003000 flags rw-s (ldelf)
E/LD: region 4: va 0x00112000 pa 0x0e310000 size 0x001000 flags r--s
E/LD: region 5: va 0x00113000 pa 0x0e444000 size 0x003000 flags rw-s (stack)
E/LD: region 6: va 0x0011b000 pa 0x00001000 size 0x024000 flags r-xs [0]
E/LD: region 7: va 0x0013f000 pa 0x00025000 size 0x10f000 flags rw-s [0]
E/LD: region 8: va 0x00266000 pa 0x00000000 size 0x003000 flags r-xs [1]
E/LD: region 9: va 0x00269000 pa 0x00002000 size 0x002000 flags rw-s [1]
E/LD: region 10: va 0x00300000 pa 0x40a67570 size 0x001000 flags rw-- (param)
E/LD: [0] 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b @ 0x0011b000
E/LD: [1] ffd2bded-ab7d-4988-95ee-e4962fff7154 @ 0x00266000
E/LD: Call stack:
E/LD: 0x00000000

Note: the crash is due to the fact that the compiler was configured for
-mthumb by default, whereas Arm's GCC 8.3 for instance defaults to
-marm. The compiler switches can be checked with:

$ echo 'void f() {};' | \
arm-linux-gnueabihf-gcc -frecord-gcc-switches -xc -c - -o test
$ readelf -p .GCC.command.line test

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

plat-imx: add UART6 & 7 for i.MX6UL/L

The i.MX6UL/L variants contains additional UARTs which are not present
on the Cortex A9 variants. Add them to register file so they can be used
for new board de

plat-imx: add UART6 & 7 for i.MX6UL/L

The i.MX6UL/L variants contains additional UARTs which are not present
on the Cortex A9 variants. Add them to register file so they can be used
for new board definitions.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Acked-by: Clement Faure <clement.faure@nxp.com>

show more ...

pta: bcm_pta: add Broadcom bnxt pta

Add Broadcom bnxt pta which uses Broadcom bnxt
drivers to manage firmware on bnxt device

Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
Signed-off-by: She

pta: bcm_pta: add Broadcom bnxt pta

Add Broadcom bnxt pta which uses Broadcom bnxt
drivers to manage firmware on bnxt device

Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
Signed-off-by: Sheetal Tigadoli <sheetal.tigadoli@broadcom.com>
Reviewed-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: bnxt: add Broadcom bnxt driver

Add Broadcom bnxt driver which helps to load the
firmware on bnxt device

Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
Signed-off-by: Sheetal Tigadol

drivers: bnxt: add Broadcom bnxt driver

Add Broadcom bnxt driver which helps to load the
firmware on bnxt device

Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
Signed-off-by: Sheetal Tigadoli <sheetal.tigadoli@broadcom.com>
Reviewed-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

plat-rockchip: add rk3399 and px30 flavors

Add support for the both the 6-core rk3399 as well as the 4-core px30
Rockchip socs to be used as secure payload together with trusted firmware.

Signed-of

plat-rockchip: add rk3399 and px30 flavors

Add support for the both the 6-core rk3399 as well as the 4-core px30
Rockchip socs to be used as secure payload together with trusted firmware.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: use GENMASK instead of opencoding bitmask on rk322x platform

GENMASK is way better to describe a registers mask than 0xffff0000,
so switch to it for the existing rk322x platform code.

plat-rockchip: use GENMASK instead of opencoding bitmask on rk322x platform

GENMASK is way better to describe a registers mask than 0xffff0000,
so switch to it for the existing rk322x platform code.

Suggested-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: split platform_init for ddr region protection

rk322x currently expects to be loaded from U-Boot-SPL directly and defines
one platform service to initialize security settings for its p

plat-rockchip: split platform_init for ddr region protection

rk322x currently expects to be loaded from U-Boot-SPL directly and defines
one platform service to initialize security settings for its purposes.

On all future platforms we will want to approach this differently in that
OP-TEE gets started out of Trusted Firmware which in turn already should
have done core security settings and inside OP-TEE we will only want to
protect OP-TEEs memory region against non-secure access.

So create a general service calling into a flavor-specific function to
protect the memory region but also leave rk322x its special init functon.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: cleanup build infrastructure to make room for more platforms

Most features used by rk322x really will be limited to it even in the
future as all other platforms will be a secure paylo

plat-rockchip: cleanup build infrastructure to make room for more platforms

Most features used by rk322x really will be limited to it even in the
future as all other platforms will be a secure payload together with
trusted firmware.

So clean up the make files accordingly.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: make hardcoded uart optional

Rockchip SoCs can obviously use multiple uarts and while there is always
a uart used on the reference designs and hence on most boards, some boards
may wa

plat-rockchip: make hardcoded uart optional

Rockchip SoCs can obviously use multiple uarts and while there is always
a uart used on the reference designs and hence on most boards, some boards
may want to use a different uart.

OP-TEE can already initialize the uart from a chosen node from devicetree
and only needs the hardcoded uart for really early logs which will only
be needed during development.

So make the hard-coded uart optional and make it configurable via
the newly introduced CFG_EARLY_CONSOLE config settings.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: setup thread_handlers when working with Trusted Firmware

Most Rockchip platforms will use Trusted Firmware. All Aarch64 SoCs will
do so, but also the rk3288 has TF-A support and could

plat-rockchip: setup thread_handlers when working with Trusted Firmware

Most Rockchip platforms will use Trusted Firmware. All Aarch64 SoCs will
do so, but also the rk3288 has TF-A support and could use OP-TEE as secure
payload, with the RK322x SoC being the exception.

Therefore setup the thread_handlers in a way to work for both cases.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: make gic init handle both GICv2 and GICv3

For a gic-v3 the setup is slightly different, so make sure the
gic init handles both correctly for future platform-flavours.

Signed-off-by:

plat-rockchip: make gic init handle both GICv2 and GICv3

For a gic-v3 the setup is slightly different, so make sure the
gic init handles both correctly for future platform-flavours.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: map io peripherals individually

Most Rockchip platforms will generally only need a very minimal subset
of a SoCs peripherals, so there is no need to map the whole io area
and instead

plat-rockchip: map io peripherals individually

Most Rockchip platforms will generally only need a very minimal subset
of a SoCs peripherals, so there is no need to map the whole io area
and instead we should only map the relevant devices.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: move memory layout from platform_config to conf.mk

Makes it easier to integrate additional flavours later on.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Ack

plat-rockchip: move memory layout from platform_config to conf.mk

Makes it easier to integrate additional flavours later on.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat-rockchip: remove boilerplate license blocks

All Rockchip platform files do have SPDX tags denoting the files licenses,
so there is no need to keep the now duplicate license boilerplate around.

plat-rockchip: remove boilerplate license blocks

All Rockchip platform files do have SPDX tags denoting the files licenses,
so there is no need to keep the now duplicate license boilerplate around.

Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Kever Yang <kever.yang@rock-chips.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: imx: disable CAAM for all i.MX6/7 flavors

Currently, using an upstream kernel with i.MX6/7 devices and OP-TEE
results in OP-TEE stalling during the loading of trusted applications.
OP-TEE trie

core: imx: disable CAAM for all i.MX6/7 flavors

Currently, using an upstream kernel with i.MX6/7 devices and OP-TEE
results in OP-TEE stalling during the loading of trusted applications.
OP-TEE tries to use the CAAM for verification, unfortunately the
upstream kernel will turn off the clocks for the CAAM, resulting in the
bus transaction stalling on the bus and the processor requiring a hard
reset. Disable the NXP CAAM driver until the clock issues are resolved.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Acked-by: Clement Faure <clement.faure@nxp.com>

show more ...