core: arm: refactor struct mobj_ffa

Moves the non-secure shared memory specific fields of struct mobj_ffa
into the new struct mobj_ffa_shm which in turn embeds struct mobj_ffa.

This prepares for an

core: arm: refactor struct mobj_ffa

Moves the non-secure shared memory specific fields of struct mobj_ffa
into the new struct mobj_ffa_shm which in turn embeds struct mobj_ffa.

This prepares for another derivate of struct mobj_ffa that deals with
another kind of memory.

No change in functionality.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: ABI description for dynamic protected memory

Extend the SMC and FF-A ABI to handle dynamic protected memory lending.
The capability bits OPTEE_SMC_SEC_CAP_DYNAMIC_PROTMEM and
OPTEE_FFA_SEC_CAP

core: ABI description for dynamic protected memory

Extend the SMC and FF-A ABI to handle dynamic protected memory lending.
The capability bits OPTEE_SMC_SEC_CAP_DYNAMIC_PROTMEM and
OPTEE_FFA_SEC_CAP_PROTMEM respectively tells its availability.

OPTEE_MSG_CMD_GET_PROTMEM_CONFIG tells the minimal size and required
alignment of protected memory to lend.

For the SMC ABI, OPTEE_MSG_CMD_LEND_PROTMEM lends protected memory
and OPTEE_MSG_CMD_RECLAIM_PROTMEM returns the memory to normal world use.

For the FF-A ABI, FFA_LEND framework request followed by
OPTEE_MSG_CMD_ASSIGN_PROTMEM lends protected memory and
OPTEE_FFA_RELEASE_PROTMEM followed by the FFA_RECLAIM framework
request returns the memory to normal world use.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: arm: SMC ABI to return protected memory configuration

Extend the SMC ABI to return the protect memory configuration.

A capability bit, OPTEE_SMC_SEC_CAP_PROTMEM, is added to announce that
the

core: arm: SMC ABI to return protected memory configuration

Extend the SMC ABI to return the protect memory configuration.

A capability bit, OPTEE_SMC_SEC_CAP_PROTMEM, is added to announce that
the new SMC fast call OPTEE_SMC_GET_PROTMEM_CONFIG is available.
OPTEE_SMC_GET_PROTMEM_CONFIG returns the physical memory range of
reserved protected memory.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: sync ABI description files

Syncs the ABI description files optee_ffa.h and optee_msg.h with their
counterpart in the Linux kernel driver. Small changes in comments and
introduction of uint8_t

core: sync ABI description files

Syncs the ABI description files optee_ffa.h and optee_msg.h with their
counterpart in the Linux kernel driver. Small changes in comments and
introduction of uint8_t octets[24] as an alternative to struct
optee_msg_param_value value.

No ABI changes or extensions.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

plat: rpi5: add basic Raspberry Pi 5 support

RPi5 is based on new BCM2712 SoC which is based on quad Cortex-A76.

BCM2712 still does not provide secure memory so we are free to locate
OP-TEE anythin

plat: rpi5: add basic Raspberry Pi 5 support

RPi5 is based on new BCM2712 SoC which is based on quad Cortex-A76.

BCM2712 still does not provide secure memory so we are free to locate
OP-TEE anything we want. It would be most beneficial to locate OP-TEE
right after TF-A, at address 0x80000, but RPi5 loader places kernel
there and it's location can't be changed.

According to PCB silkscreen, RPi5 boards can have 1GB, 2GB, 4GB or 8GB
of memory. To be compatible with any variant, OP-TEE is placed close
to the end of the first gigabyte.

BCM2712 uses PL011 as debug UART so we enable its driver.

According to specification, BCM2712 includes cryptography extensions,
but this basic port does not enable them.

As there is no way to load OP-TEE image into memory during boot
process, TF-A with OPTEE_ALLOW_SMC_LOAD=1 option should be used. In
this case OP-TEE can be loaded via Linux kernel or U-Boot.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Co-developed-by: Hugo Trippaers <htrippaers@schubergphilis.com>
Signed-off-by: Hugo Trippaers <htrippaers@schubergphilis.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

mmu: ignore VA spaces in core_mmu_get_type_by_pa

VA spaces have no valid PA addresses stored in memory map, so they are
not valid return values for core_mmu_get_type_by_pa() function.

This issues w

mmu: ignore VA spaces in core_mmu_get_type_by_pa

VA spaces have no valid PA addresses stored in memory map, so they are
not valid return values for core_mmu_get_type_by_pa() function.

This issues was discovered when OP-TEE tried to access a device tree
that was stored at the very beginning of physical address space. In
may case it had PA address 0x112C0, which was "covered" by
RES_VASPACE:

D/TC:0 0 dump_mmap_table:838 type RES_VASPACE va 0x1d800000..0x1e1fffff pa 0x00000000..0x009fffff size 0x00a00000 (pgdir)

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

drivers: ele: remove sab_init() initialization

ELE firmware has been divided into 2 firmwares for i.MX8ULP and i.MX95:
Primary and secondary firmware.
SAB init command is in Secondary firmware, whic

drivers: ele: remove sab_init() initialization

ELE firmware has been divided into 2 firmwares for i.MX8ULP and i.MX95:
Primary and secondary firmware.
SAB init command is in Secondary firmware, which will be loaded when
rootfs comes up, so this command is not available when OP-TEE is
initializing.
Moreover, we are not using any ELE command which is available in
secondary firmware, So removing sab_init() function.
Will add it when it will be used in driver.

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: ele: update struct get_info_rsp{} fields

There has been an addition of PQC related fields in
Get Info Command response for i.MX95.

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Ac

drivers: ele: update struct get_info_rsp{} fields

There has been an addition of PQC related fields in
Get Info Command response for i.MX95.

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: ele: enable getting HUK/RNG from ELE on imx95

Enable support of getting HUK and RNG from ELE on imx95

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.

drivers: ele: enable getting HUK/RNG from ELE on imx95

Enable support of getting HUK and RNG from ELE on imx95

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: imx: enable MU and ELE drivers for imx95

Enable both MU and ELE driver for imx95

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

core: imx: add MU_BASE and MU_SIZE for imx95

Add MU Base address and MU size for imx95

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

drivers: imx: mu: add support for imx95

Add MU driver support for imx95

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

drivers: imx: mu: rename imx_mu_8ulp.c to imx_mu_8ulp_9x.c

Since same file is used for both i.MX8ULP and i.MX9X platforms,
renaming it to more accurate name.

Signed-off-by: Sahil Malhotra <sahil.ma

drivers: imx: mu: rename imx_mu_8ulp.c to imx_mu_8ulp_9x.c

Since same file is used for both i.MX8ULP and i.MX9X platforms,
renaming it to more accurate name.

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: build temporary Docker images

Instead of running the base CI image (jforissier/optee_os_ci:qemu_check)
and pulling the whole OP-TEE source tree (manifest.git) and toolchains
in each check job, d

ci: build temporary Docker images

Instead of running the base CI image (jforissier/optee_os_ci:qemu_check)
and pulling the whole OP-TEE source tree (manifest.git) and toolchains
in each check job, do it once per target platform (QEMUv7, QEMuv8, and
QEMUv8 on arm64) and save the image as a "job artifact". Each check
job then loads the image it needs and proceeds with the check command.
In addition to saving bandwidth on the external network, this has the
advantage of making the jobs easier to reproduce and investigate in case
of failure since it is easy to download the artifact from the CI page,
load it into Docker, and run the same make check command. There is a
small penalty on execution time for saving and restoring the image, but
it's only a few minutes at most.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: QEMUv8: run one command per job

Split the QEMUv8 jobs so that each jobs runs a single "make check"
command. This allows to make the job names more descriptive, and
potentially benefit more from

ci: QEMUv8: run one command per job

Split the QEMUv8 jobs so that each jobs runs a single "make check"
command. This allows to make the job names more descriptive, and
potentially benefit more from multiple parallel jobs.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

MAINTAINERS: add entry for Qualcomm platforms

Add myself as maintainer for Qualcomm platforms

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linar

MAINTAINERS: add entry for Qualcomm platforms

Add myself as maintainer for Qualcomm platforms

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

plat: Add support for Qualcomm Kodiak platform

Introduce initial Qualcomm platform support for the Kodiak which is the
SoC codename also known by product names SC7280/QCM6490 in upstream.

Acked-by:

plat: Add support for Qualcomm Kodiak platform

Introduce initial Qualcomm platform support for the Kodiak which is the
SoC codename also known by product names SC7280/QCM6490 in upstream.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Co-developed-by: Casey Connolly <casey.connolly@linaro.org>
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

core: drivers: introduce Qualcomm GENI UART driver

Introduce a driver for the GENI UART found on modern Qualcomm platforms.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens W

core: drivers: introduce Qualcomm GENI UART driver

Introduce a driver for the GENI UART found on modern Qualcomm platforms.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
Signed-off-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>
[SG: cleaned up the driver]
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

ci: rework (host cleanup, matrix builds, Rust enabled, cancel on push)

This is a big cleanup of the CI file:

- Enable Rust again, effectively reverting commit 6c9dd3eb9fec ("ci:
disable Rust glob

ci: rework (host cleanup, matrix builds, Rust enabled, cancel on push)

This is a big cleanup of the CI file:

- Enable Rust again, effectively reverting commit 6c9dd3eb9fec ("ci:
disable Rust globally"). In order to do so, a "host cleanup" script
is introduced (scripts/ci-host-cleanup.sh). It is run by the QEMU
jobs before launching the CI Docker image. The script removes a bunch
of files that are not needed (~ 24 GB), thus leaving more space for
the Docker image to grow as the build proceeds. The script is mostly
copied from the teaclave-trustzone-sdk CI [1].
- Make the platform builds faster and easier to monitor by using the
matrix keyword to launch parallel jobs. Each platform build job now
has the target architecture and platforms clearly specified so it's
easy to see if a platform is broken from the GitHub actions page
without looking at the logs. This also reduces code duplication.
- The ci-cancel.yml workflow is replaced with the cancel-in-progress
setting in the concurrency block of the CI the workflow. This is
simpler and avoids the "Cancel obsolete CI" entries in the project's
actions log.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Link: https://github.com/apache/teaclave-trustzone-sdk/blob/f67a5ddcde3e/.github/workflows/reuse_test_in_optee_repo.yml#L40-L67 [1]
Acked-by: Yuan Zhuang <yuanz@apache.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Update CHANGELOG for 4.8.0

Update CHANGELOG for 4.8.0 and collect Tested-by tags.

Link: https://github.com/OP-TEE/optee_os/pull/7567
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested

Update CHANGELOG for 4.8.0

Update CHANGELOG for 4.8.0 and collect Tested-by tags.

Link: https://github.com/OP-TEE/optee_os/pull/7567
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_virt)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)
Tested-by: Amey Raghatate <ameyavinash.raghatate@amd.com> (AMD Versal Gen 2)
Tested-by: Guiyong Hwang <gy.hwang@telechips.com> (telechips-tcc805x)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (rpi3 model 3B)
Tested-by: Etienne Carriere <etienne.carriere@foss.st.com> (stm32mp1-135F_DK)
Tested-by: Etienne Carriere <etienne.carriere@foss.st.com> (stm32mp1-157C_EV1)
Tested-by: Etienne Carriere <etienne.carriere@foss.st.com> (stm32mp1-157C_EV1_SCMI)
Tested-by: Etienne Carriere <etienne.carriere@foss.st.com> (stm32mp1-157C_DK2)
Tested-by: Etienne Carriere <etienne.carriere@foss.st.com> (stm32mp1-157C_DK2_SCMI)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (rockchip-rk3399 Rockpi4B)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (FVP)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (Hikey)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (Hikey + RPMB kernel routing)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (rockchip-rk3399 Rockpi4B)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (imx-mx8mqevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx6dlsabresd)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx6qsabresd)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx6sllevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx6sxsabresd)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx6ulevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx6ullevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx6ulzevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx7dsabresd)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx7ulpevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx8dxlevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx8mmevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx8mnevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx8mqevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx8mpevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx8qmmek)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx8qxpmek)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx8ulpevk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx93evk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx91evk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (imx-mx95evk)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (LX2160A-RDB)
Tested-by: Sahil Malhotra <sahil.malhotra@nxp.com> (LS1046A-RDB)

show more ...

core: Relax StMM dependency to TEE_STORAGE_PRIVATE

This allows to run StMM without the userspace supplicant if the
in-kernel RPMB service is available.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens

core: Relax StMM dependency to TEE_STORAGE_PRIVATE

This allows to run StMM without the userspace supplicant if the
in-kernel RPMB service is available.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

show more ...

ci: disable Rust globally

There has been several job failures due to insufficient disk space on
the CI runners recently. Commit a4b310d68bf8 ("ci: xen: disable Rust to
workaround "no space left on d

ci: disable Rust globally

There has been several job failures due to insufficient disk space on
the CI runners recently. Commit a4b310d68bf8 ("ci: xen: disable Rust to
workaround "no space left on device"") and commit 3d0429ac12cd ("ci:
hafnium: disable Rust to workaround "no space left on device"") fixed
individual jobs. Now other QEMUv8 jobs are failing too, probably because
of the upgrade of the optee_rust project [1]. Therefore, disable Rust
globally until a better solution is found.

Link: https://github.com/OP-TEE/manifest/commit/2987d8edf188 [1]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: pkcs11: be flexible on RSA private key optional attributes

Allow RSA private key to partially store the RSA private key optional
attributes without facing complaints from the GP TEE API.

On one

ta: pkcs11: be flexible on RSA private key optional attributes

Allow RSA private key to partially store the RSA private key optional
attributes without facing complaints from the GP TEE API.

On one hand, in the PKCS#11 specification, RSA private key attributes
CKA_PRIME_1, CKA_PRIME_2, CKA_EXPONENT_1, CKA_EXPONENT_2 and
CKA_COEFFICIENT are optional and the spec does not add much constraints
on their presence.

On the other hand, the GP TEE Internal Core API requests that these
5 optional attributes are all present or none is present at all.

As a trade-off, allow PKCS#11 client to partially provide them but do not
load them into the TEE object unless they are all present.

Fixes: 3dc4089afde2 ("ta: pkcs11: correct RSA keys extended attributes sanitation")
Closes: https://github.com/OP-TEE/optee_os/issues/5418
Closes: https://github.com/OP-TEE/optee_os/issues/7520
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

show more ...

ta: remoteproc: clarify remoteproc_get_tlv() behavior

Add an inline comment to explicitly state that TA remoteproc local
function remoteproc_get_tlv() loads specific values in its output
arguments w

ta: remoteproc: clarify remoteproc_get_tlv() behavior

Add an inline comment to explicitly state that TA remoteproc local
function remoteproc_get_tlv() loads specific values in its output
arguments when it returns with error code TEE_ERROR_NO_DATA.
This way it is clearer that caller expect such values on such error
cases.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>

show more ...

ta: remoteproc: clarify case empty key info is last TLV cell

Clarify case when remote processor firmware key info
TLV RPROC_TLV_PKEYINFO is present but empty (size = 0) and is placed
last in the TLV

ta: remoteproc: clarify case empty key info is last TLV cell

Clarify case when remote processor firmware key info
TLV RPROC_TLV_PKEYINFO is present but empty (size = 0) and is placed
last in the TLVs memory area hence its value cell start address matches
the TLV area end address. The previous implementation was fine but
it looked odd the main loop does not address the case.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>

show more ...