Add alignment parameter to FUNC() and LOCAL_FUNC() macros

Adds a default alignment parameter to FUNC() and LOCAL_FUNC() assembly
macros. This is needed since the function macro also sets the sectio

Add alignment parameter to FUNC() and LOCAL_FUNC() macros

Adds a default alignment parameter to FUNC() and LOCAL_FUNC() assembly
macros. This is needed since the function macro also sets the section
of the function making any alignment directives before the function
macro useless.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: compiler.h: introduce fallthrough pseudo-keyword

Adds the fallthrough pseudo-keyword to be used in switch/case
statements. Tested with GCC 6.2.1, 7.2.1, 8.2.1, 8.3.0, 9.2.1 and Clang
9.0.1

libutils: compiler.h: introduce fallthrough pseudo-keyword

Adds the fallthrough pseudo-keyword to be used in switch/case
statements. Tested with GCC 6.2.1, 7.2.1, 8.2.1, 8.3.0, 9.2.1 and Clang
9.0.1 and 10.0.0.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: do not redefine ARRAY_SIZE

Do not redefine ARRAY_SIZE if it is already defined

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Etienne Carriere <etienne.carriere@lina

libutils: do not redefine ARRAY_SIZE

Do not redefine ARRAY_SIZE if it is already defined

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: thread: add compiler barrier to thread_set_exceptions()

With compiler optimizer enable (-O2) compiler generate invalid code
for thread_get_id_may_fail(). The curr_thread read got re-order
afte

core: thread: add compiler barrier to thread_set_exceptions()

With compiler optimizer enable (-O2) compiler generate invalid code
for thread_get_id_may_fail(). The curr_thread read got re-order
after exceptions unmask.

Signed-off-by: Khoa Hoang <admin@khoahoang.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros

This change applies to arm32 assembler sources.

Instead of using UNWIND(.fnstart) after FUNC or LOCAL_FUNC and
UNWIND(.fnend) before END_FUN

arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros

This change applies to arm32 assembler sources.

Instead of using UNWIND(.fnstart) after FUNC or LOCAL_FUNC and
UNWIND(.fnend) before END_FUNC, let's fold these statements into the
FUNC macros.

The .fnstart/.fnend directives mark the start and end of a function
with an unwind table entry (.ARM.exidx) and therefore a function
without them has no entry and cannot be unwound. This means that a
stack dump (on abort or panic) would stop when reaching such a
function.

As a result of this patch, a small number of functions now have an
entry in the unwind table when they had none before (the functions
which were using FUNC or LOCAL_FUNC but had no .fnstart/.fnend). It was
almost always a bug and this pacth only increases the size of the
.ARM.exidx section by a few bytes (tested on QEMU).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

arm32: move the UNWIND() macro to <asm.S>

All the users of the UNWIND() macro include <asm.S> already, which is
therefore a good place to define this macro. Let's move it from
<kernel/unwind.h> to <

arm32: move the UNWIND() macro to <asm.S>

All the users of the UNWIND() macro include <asm.S> already, which is
therefore a good place to define this macro. Let's move it from
<kernel/unwind.h> to <asm.S>, remove a couple of duplicates in
assembler files, and drop the useless includes.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: remove stack dump macros and multiple log levels

Of the various xPRINT_STACK() macros (x in {E,I,D,F}), only
EPRINT_STACK() is used. Let's simplify the code by removing the macros
altogether a

core: remove stack dump macros and multiple log levels

Of the various xPRINT_STACK() macros (x in {E,I,D,F}), only
EPRINT_STACK() is used. Let's simplify the code by removing the macros
altogether and calling print_kernel_stack() instead. Since only the
TRACE_ERROR is used, the 'level' argument to print_kernel_stack(),
print_stack_arm32() and print_stack_arm64() is removed too.

In addition to simplifying the code, these changes will allow the
consolidation of the stack unwinding code between core and ldelf.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: add stack overflow detection

This commit introduces CFG_CORE_DEBUG_CHECK_STACKS to check the stack
limits using compiler instrumentation (-finstrument-functions). When
enabled, the C compiler

core: add stack overflow detection

This commit introduces CFG_CORE_DEBUG_CHECK_STACKS to check the stack
limits using compiler instrumentation (-finstrument-functions). When
enabled, the C compiler will insert entry and exit hooks in all
functions in the TEE core. On entry, the stack pointer is checked and
if an overflow is detected, panic() is called.

How is this helpful since we have stack canaries already?
1. When a dead canary is found, the call stack will give no indication
of the root cause of the corruption which may have happened quite some
time before. Running the test case again with a debugger attached and a
watchpoint on the canary is not always an option.
2. The system may corrupt the stack and hang in an exception handler
before the first canary check, for instance, during boot when the
temporary stack is used. This code will likely catch such issues, too.

The downside is increased stack usage and a significant runtime overhead
which is why this feature should be enabled only for troubleshooting.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, QEMUv8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: add sprintf()

Preparing for C++ support in TAs.

Implement sprintf() in libutils.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linar

libutils: add sprintf()

Preparing for C++ support in TAs.

Implement sprintf() in libutils.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: atomic.h: add atomic_{load,store}_short()

Adds atomic functions operating on the 'short int' type.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <et

libutils: atomic.h: add atomic_{load,store}_short()

Adds atomic functions operating on the 'short int' type.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: atomic.h: fix atomic_load_u32() types

Prior to this patch was atomic_load_u32() using wrong types, unsigned int
instead of the expected uint32_t. Fix this by changing the types.

Reviewed-

libutils: atomic.h: fix atomic_load_u32() types

Prior to this patch was atomic_load_u32() using wrong types, unsigned int
instead of the expected uint32_t. Fix this by changing the types.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: confine_array_index: arm64: replace csdb by hint #20

Older compilers such as GCC 6.2 do not support the csdb mnemonic [1].
For better compatibility, replace it by its equivalent: hint #20.

libutils: confine_array_index: arm64: replace csdb by hint #20

Older compilers such as GCC 6.2 do not support the csdb mnemonic [1].
For better compatibility, replace it by its equivalent: hint #20.

CC out/arm/ldelf/ta_elf_rel.o
{standard input}: Assembler messages:
{standard input}:274: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:371: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:667: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:776: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1010: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1084: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1413: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1495: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1671: Error: unknown mnemonic `csdb' -- `csdb'
make[1]: *** [mk/compile.mk:157: out/arm/ldelf/ta_elf_rel.o] Error 1

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: confine_array_index: fix clang build trace for Thumb2

Avoid trace 'deprecated instruction in IT block [-Werror,-Winline-asm]'
when building with CLang. The message states performance issue

libutils: confine_array_index: fix clang build trace for Thumb2

Avoid trace 'deprecated instruction in IT block [-Werror,-Winline-asm]'
when building with CLang. The message states performance issue which
is true but prefer the performance cost over the security flaw hence
warning trace is removed without embedded code changed.

Fixes: 2b6dd0df52b4 ("confine_array_index.h: add A32 and T32 versions of confine_array_index()")
Suggested-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: confine_array_index: fix 32bit modes implementation

Fix implementation of confine_array_index() for 32bit Arm and Thumb2
modes as previous implementation did not set the return value
expli

libutils: confine_array_index: fix 32bit modes implementation

Fix implementation of confine_array_index() for 32bit Arm and Thumb2
modes as previous implementation did not set the return value
explicitly and relied on luck with the layout of the machine code
to return the correct value.

Fixes: https://github.com/OP-TEE/optee_os/issues/3799
Fixes: 2b6dd0df52b4 ("confine_array_index.h: add A32 and T32 versions of confine_array_index()")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (qemu,qemu_v8)
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

util.h: add ROUNDUP_DIV(x, y) macro

Adds the ROUNDUP_DIV(x, y) macro which Rounds up to the nearest multiple
of y and then divides by y. Safe against overflow, y has to be a
multiple of 2 just as in

util.h: add ROUNDUP_DIV(x, y) macro

Adds the ROUNDUP_DIV(x, y) macro which Rounds up to the nearest multiple
of y and then divides by y. Safe against overflow, y has to be a
multiple of 2 just as in the other two ROUNDUP*() macros.

This macro is intended to be used to convert from "number of bytes" to
"number of pages" or similar units. Example:
num_pages = ROUNDUP_DIV(num_bytes, SMALL_PAGE_SIZE);

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

confine_array_index.h: add A32 and T32 versions of confine_array_index()

Adds inline assembly implementations for the A32 and T32 instruction
sets. The implementation is based on __load_no_speculate

confine_array_index.h: add A32 and T32 versions of confine_array_index()

Adds inline assembly implementations for the A32 and T32 instruction
sets. The implementation is based on __load_no_speculate1() in
<speculation_barrier.h>.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: import confine_array_index.h from Fuchsia

Imports confine_array_index.h from [1].

Replaced include statements to suit OP-TEE and removed the namespace
directive. Added content from [2] as

libutils: import confine_array_index.h from Fuchsia

Imports confine_array_index.h from [1].

Replaced include statements to suit OP-TEE and removed the namespace
directive. Added content from [2] as a comment to clarify the license.

The speculation safe function confine_array_index() is provided with
this.

Note that only AArch64 and x86_64 versions of the function is implemented
in this commit.

Link: [1] https://fuchsia.googlesource.com/fuchsia/+/39d9b8c2dbb0f6133a835676f8f669b07aca6b30/zircon/system/ulib/fbl/include/fbl/confine_array_index.h
Link: [2] https://fuchsia.googlesource.com/fuchsia/+/39d9b8c2dbb0f6133a835676f8f669b07aca6b30/LICENSE

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Move core/include/config.h to lib/libutils/ext/include

In order to be able to use the IS_ENABLED() macro in user space
libraries, move config.h from core to libutils.

Signed-off-by: Jerome Forissie

Move core/include/config.h to lib/libutils/ext/include

In order to be able to use the IS_ENABLED() macro in user space
libraries, move config.h from core to libutils.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

trace: Add weak platform tracer function

Add weak platform tracer function
This would allow each platform to carry out
plat specific logging, possibly to some media
for post-mortem analysis

Signed-

trace: Add weak platform tracer function

Add weak platform tracer function
This would allow each platform to carry out
plat specific logging, possibly to some media
for post-mortem analysis

Signed-off-by: Sheetal Tigadoli <sheetal.tigadoli@broadcom.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

Assembly FUNC macros take optional section

Adds an optional section parameter to the macros FUNC() and LOCAL_FUNC()

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklande

Assembly FUNC macros take optional section

Adds an optional section parameter to the macros FUNC() and LOCAL_FUNC()

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Fix warning in fallback SUB_OVERFLOW() macro

Fixes two warnings for 'comparison of integers of different signs' in
the __INTOF_SUB() helper macro used by the fallback SUB_OVERFLOW()
macro.

Fixes: e

Fix warning in fallback SUB_OVERFLOW() macro

Fixes two warnings for 'comparison of integers of different signs' in
the __INTOF_SUB() helper macro used by the fallback SUB_OVERFLOW()
macro.

Fixes: ecdedc94e720 ("util: update fallback SUB_OVERFLOW() macro")
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Experimental Clang support

Allows building with Clang with "make COMPILER=clang [other flags...]".
The clang command has to be in the $PATH, as well as the associated
tools (clang-cpp, ld.lld, llvm-

Experimental Clang support

Allows building with Clang with "make COMPILER=clang [other flags...]".
The clang command has to be in the $PATH, as well as the associated
tools (clang-cpp, ld.lld, llvm-ar, llvm-nm, llvm-objcopy and
llvm-readelf).

Tested with Clang built from the master branch of [1] (development
version for 9.0):

mkdir build; cd build
cmake -G Ninja -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=~/llvm-install \
-DLLVM_ENABLE_PROJECTS="clang;lld" \
-DLLVM_TARGETS_TO_BUILD="AArch64;ARM" \
~/llvm-project/llvm
ninja && ninja install

Limitations:

- CFG_CORE_SANITIZE_KADDRESS=y is not supported.
- CFG_WITH_PAGER is supported, but requires that the TEE core be
linked with the GNU linker. The reason is documented in
mk/clang.mk.

Bug:

- ldelf assertion failure in xtest 1019 when CFG_ULIBS_SHARED=y (QEMU)
E/LD: assertion 'maps[map_idx].sz == sz' failed at ldelf/ta_elf.c:1114 in ta_elf_print_mappings()
Prevents ldelf from displaying the TA mappings on abort or panic, but
does not seem to cause any other problem.

Link: [1] https://github.com/llvm/llvm-project/commits/8351c327647
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU pager/no pager)
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMUv8, pager/no pager)
Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960, 32/64, GP)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: relax noreturn label

Replaces attribute label identifier noreturn with __noreturn__ to
prevent conflicts when importing code which defines label noreturn
itself as a macro. This change app

libutils: relax noreturn label

Replaces attribute label identifier noreturn with __noreturn__ to
prevent conflicts when importing code which defines label noreturn
itself as a macro. This change applies suggestion from the GCC
documentation [1], applicable even prio GCC 4.x.x, cited below.

> You may optionally specify attribute names with ‘__’ preceding
> and following the name. This allows you to use them in header
> files without being concerned about a possible macro of the same
> name. For example, you may use the attribute name __noreturn__
> instead of noreturn.

Link: [1] https://gcc.gnu.org/onlinedocs/gcc-8.3.0/gcc/Attribute-Syntax.html#Attribute-Syntax
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workar

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workaround. I tried 4.9, 6.2,
8.2, and 8.3 from various sources (Linaro or Ubuntu). If
__SECTION_FLAGS_RODATA is empty, this warning is always present:

CC out/arm-plat-vexpress/core/mm/fobj.o
{standard input}: Assembler messages:
{standard input}:402: Warning: setting incorrect section attributes for .rodata.__unpaged

The generated assembler file contains the "aw" flags:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"aw",%progbits

By reverting the above commit, we have:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"a",%progbits //,"aw",%progbits

...and the assembler does not warn anymore.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should d

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should depend on __GCC_VERSION. This prepares for Clang.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...