virt: add nexus memory area

This patch is the first in series of patches that split OP-TEE RW memory
into two regions: nexus memory and TEE memory. Nexus memory will
be always mapped and it will be

virt: add nexus memory area

This patch is the first in series of patches that split OP-TEE RW memory
into two regions: nexus memory and TEE memory. Nexus memory will
be always mapped and it will be used to store all data that is
vital for OP-TEE core and is not bound to virtual guests.

TEE memory is a memory that holds data specific for certain guest.
There will be TEE memory bank for every guest and it will be mapped
into OP-TEE address space only during call from that guest.

This patch adds nexus memory and moves stacks into it. Also
it provides __nex_bss and __nex_data macros, so one can easily set right
section for a variable.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

trace: fix core id print if in non-atomic context

Make "?" print repetitive equivalent to number of digits needed to display
core id rather than extra spaces as it causes symbolize.py script parsing

trace: fix core id print if in non-atomic context

Make "?" print repetitive equivalent to number of digits needed to display
core id rather than extra spaces as it causes symbolize.py script parsing
failure for call stack addresses in case number of cores is greater than
10.

Also change symbolize.py to detect repetitive "?".

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mempool: fix race in get_pool()

Fixes a race in get_pool() which could leave the pool with zero refences
but still owned by the last thread using the pool.

Some performance number on Hikey with def

mempool: fix race in get_pool()

Fixes a race in get_pool() which could leave the pool with zero refences
but still owned by the last thread using the pool.

Some performance number on Hikey with default configuration:
github/master (edbb89f, before this commit):

4006 real 1m 41.11s
4007 real 1m 14.51s
4008 real 0m 0.13s
4009 real 1m 5.68s

Revert "mempool: optimize reference counting", before this commit:
4006 real 3m 27.78s
4007 real 0m 50.03s
4008 real 0m 0.13s
4009 real 2m 24.07s

With this commit, two runs:
4006 real 1m 37.51s
4007 real 0m 56.67s
4008 real 0m 0.09s
4009 real 1m 3.18s

4006 real 1m 37.61s
4007 real 0m 35.32s
4008 real 0m 0.13s
4009 real 1m 3.15s

Numbers are gathered with this script:
for a in 4006 4007 4008 4009 ; do \
echo -n $a " " >> time.txt ;\
time -o time.txt.tmp xtest -l 15 $a || break ;\
grep real time.txt.tmp >> time.txt
done
cat time.txt

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

atomic.h: add atomic_{load,store}_int()

Adds atomic_load_int() and atomic_store_int().

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.or

atomic.h: add atomic_{load,store}_int()

Adds atomic_load_int() and atomic_store_int().

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mempool: add mempool_calloc()

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

mempool: report max memory usage

Adds CFG_MEMPOOL_REPORT_LAST_OFFSET which if set to y causes mempool to
report each time the maximum amount of memory has increased. This helps
to determine required

mempool: report max memory usage

Adds CFG_MEMPOOL_REPORT_LAST_OFFSET which if set to y causes mempool to
report each time the maximum amount of memory has increased. This helps
to determine required size of a mempool.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mempool: optimize reference counting

Optimizes reference counting in mempool by using refcount_inc() and
refcount_dec() in order to be able to avoid using the mutex in the quick
case.

Reviewed-by:

mempool: optimize reference counting

Optimizes reference counting in mempool by using refcount_inc() and
refcount_dec() in order to be able to avoid using the mutex in the quick
case.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

mempool: add out of memory message

Adds a helpful message when a memory allocation with mempool_alloc()
fails. If this occurs it's because the memory pool size isn't tuned
properly with regards to t

mempool: add out of memory message

Adds a helpful message when a memory allocation with mempool_alloc()
fails. If this occurs it's because the memory pool size isn't tuned
properly with regards to the user of the pool.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

trace levels: Redefine TRACE_MIN level to 0

The global `trace_level` session-wise indicator which is set by
`trace_set_level()` [1], could get a wrong value in case of an
input `level` set to 0, mea

trace levels: Redefine TRACE_MIN level to 0

The global `trace_level` session-wise indicator which is set by
`trace_set_level()` [1], could get a wrong value in case of an
input `level` set to 0, meaning that all logs need to be disabled
by user define `CFG_TEE_TA_LOG_LEVEL=0` when building TA applications.

This inconsistency is caused by a rather wrong value of `TRACE_MIN`
low boundary value set to 1. According to [1] `trace level` will be
set to `TRACE_MAX` (4) in case input level is smaller than `TRACE_MIN`
and larger than `TRACE_MAX`.
In the scenario when the needed log level is 0, `trace level` would be
set to `TRACE_MAX` and will cause a lot of flow log level information
dumped by trace functions/macros that are using `trace_printf()`
primitive.

This patch sets the `TRACE_MIN` to 0 in order to assure a proper trace
level setting and completely disable all logs in case
`CFG_TEE_TA_LOG_LEVEL=0`.

[1]
void trace_set_level(int level)
{
if (((int)level >= TRACE_MIN) && (level <= TRACE_MAX))
trace_level = level;
else
trace_level = TRACE_MAX;
}

Acked-by: Christoph Gellner <cgellner@de.adit-jv.com>
Signed-off-by: Ovidiu Mihalachi <ovidiu_mihalachi@mentor.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Move __early_ta from <compiler.h> to <kernel/early_ta.h>

The __early_ta macro is used only in C files generated by
scripts/ta_bin_to_c.py. There is no reason to have it defined in a widely
used head

Move __early_ta from <compiler.h> to <kernel/early_ta.h>

The __early_ta macro is used only in C files generated by
scripts/ta_bin_to_c.py. There is no reason to have it defined in a widely
used header like <compiler.h>.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: force read-only flag on .rodata.* sections

This commit fixes a warning with GCC 8.2 that did not occur with GCC 6.2:

$ make out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
CHK ou

core: force read-only flag on .rodata.* sections

This commit fixes a warning with GCC 8.2 that did not occur with GCC 6.2:

$ make out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CHK out/arm-plat-vexpress/core/include/generated/asm-defines.h
CC out/arm-plat-vexpress/core/arch/arm/kernel/user_ta.o
{standard input}: Assembler messages:
{standard input}:4087: Warning: setting incorrect section attributes for .rodata.__unpaged

The message is printed as the assembler processes this code fragment,
generated by the C compiler:

.section .rodata.__unpaged,"aw"

The older compiler (GCC 6.2) would generate instead:

.section .rodata.__unpaged,"a",%progbits

The problem with .rodata.__unpaged,"aw" is that the "w" (writeable) flag
is not consistent with the section name (.rodata.*), which by convention
is supposed to be read-only.

- The section name (".rodata.__unpaged") is given by our macro:
__rodata_unpaged.
- The "w" flag is added by GCC, not sure why exactly. One reason [1] is
when a relocatable binary is being generated and the structure contains
relocatable data. But, we are not explicitly asking for a relocatable
binary, so this might as well be a bug or counter-intuitive feature of
the compiler.

Anyway, to avoid the warning, we need to fix the section flags. The
section type (%progbits) is optional, it is deduced from the section name
by default. %progbits indicates that the section contains data (i.e., is
not empty).

Link: [1] https://gcc.gnu.org/ml/gcc/2004-05/msg01016.html
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey960)
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

trace: get thread_id right in print_thread_id()

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

trace: check for CFG_MSG_LONG_PREFIX_MASK only once per message

There is no need for repeated checks for every portion of
extended prefix.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>

trace: check for CFG_MSG_LONG_PREFIX_MASK only once per message

There is no need for repeated checks for every portion of
extended prefix.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

trace: print core id if in atomic context

If (D|E|I|F)MSG is called with foreign interrupts masked
we can report core ID. "?" will be printed instead, if
foreign interrupts aren't masked.

With this

trace: print core id if in atomic context

If (D|E|I|F)MSG is called with foreign interrupts masked
we can report core ID. "?" will be printed instead, if
foreign interrupts aren't masked.

With this patch log looks like this:

D/TC:2 0 core_mmu_set_user_map:940 0xe181b88 0xeee8003
D/TC:? 0 __wq_rpc:40 wake thread 1 0xe16f028 -3
D/TC:1 thread_handle_std_smc:612 a7: 2
D/TC:3 0 core_mmu_set_user_map:940 0x0 0x0

Where first digit shows core id and second - thread id.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Use inttypes.h over stdint.h on some .h files

Uses inttypes.h over stdint.h on some .h files to be nice to U-boot.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wikla

Use inttypes.h over stdint.h on some .h files

Uses inttypes.h over stdint.h on some .h files to be nice to U-boot.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: introduce MAX_UNSAFE() and MIN_UNSAFE()

This change allows one to use MAX_UNSAFE() and MIN_UNSAFE() macros
in particular conditions where MAX()/MIN() macros fail to build
from C source fil

libutils: introduce MAX_UNSAFE() and MIN_UNSAFE()

This change allows one to use MAX_UNSAFE() and MIN_UNSAFE() macros
in particular conditions where MAX()/MIN() macros fail to build
from C source file implementation with error traces as below:

In file included from core/arch/arm/include/arm.h:8:0,
from core/arch/arm/include/kernel/thread.h:11,
from core/arch/arm/kernel/asm-defines.c:7:
lib/libutils/ext/include/util.h:24:16: error: missing binary operator before token "("
(__extension__({ __typeof__(a) _a = (a); \
^
core/arch/arm/plat-stm/./platform_config.h:190:25: note: in expansion of macro ‘MAX’
#define STM_SECDDR_END MAX(TZSRAM_BASE + TZSRAM_SIZE, \
^~~
core/arch/arm/plat-stm/./platform_config.h:204:6: note: in expansion of macro ‘STM_SECDDR_END’
#if (STM_SECDDR_END < 0x80000000ULL)
^~~~~~~~~~~~~~
make: *** [out/core/include/generated/.asm-defines.s] Error 1

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove license notice from STMicroelectronics files

Since a while the source files license info are defined by SPDX
identifiers. We can safely remove the verbose license text from the
files that are

Remove license notice from STMicroelectronics files

Since a while the source files license info are defined by SPDX
identifiers. We can safely remove the verbose license text from the
files that are owned by either only STMicroelectronics or only both
Linaro and STMicroelectronics.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

util: remove unused macros

After commit 9a8117de1263 ("util: update fallback ADD_OVERFLOW() macro")
and commit ecdedc94e720 ("util: update fallback SUB_OVERFLOW() macro"),
the following macros are n

util: remove unused macros

After commit 9a8117de1263 ("util: update fallback ADD_OVERFLOW() macro")
and commit ecdedc94e720 ("util: update fallback SUB_OVERFLOW() macro"),
the following macros are not used anymore. Remove them.

__INTOF_HALF_MAX_SIGNED(type)
__INTOF_MAX_SIGNED(type)
__INTOF_MIN_SIGNED(type)
__INTOF_MIN(type)
__INTOF_MAX(type)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

util: update fallback SUB_OVERFLOW() macro

Updates the fallback SUB_OVERFLOW() macro to better support mixed types
in the arguments.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-b

util: update fallback SUB_OVERFLOW() macro

Updates the fallback SUB_OVERFLOW() macro to better support mixed types
in the arguments.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

util: update fallback ADD_OVERFLOW() macro

Updates the fallback ADD_OVERFLOW() macro to better support mixed types
in the arguments.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-b

util: update fallback ADD_OVERFLOW() macro

Updates the fallback ADD_OVERFLOW() macro to better support mixed types
in the arguments.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: MIN/MAX macros for assembly code

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

util: fix fallback SUB_OVERFLOW() macro

This only applies when the compiler doesn't provide the
__builtin_sub_overflow() function (before GCC 5.1).

Fixes problem due to integer promotion in overflo

util: fix fallback SUB_OVERFLOW() macro

This only applies when the compiler doesn't provide the
__builtin_sub_overflow() function (before GCC 5.1).

Fixes problem due to integer promotion in overflow macros when result is
a signed type and the subtrahend is an unsigned type with a low value.

SUB_OVERFLOW() still doesn't handle all combinations of signed and
unsigned types in the parameters.

Fixes: ce0d8e2da340 ("util: add macros for arithmetics with overflow checking")
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

util: fix fallback ADD_OVERFLOW() macro

This only applies when the compiler doesn't provide the
__builtin_add_overflow() function (before GCC 5.1).

Fixes problem due to integer promotion in overflo

util: fix fallback ADD_OVERFLOW() macro

This only applies when the compiler doesn't provide the
__builtin_add_overflow() function (before GCC 5.1).

Fixes problem due to integer promotion in overflow macros when result is
a signed type and the second addend is an unsigned type with value 0.

ADD_OVERFLOW() still doesn't handle all combinations of signed and
unsigned types in the parameters.

Fixes: ce0d8e2da340 ("util: add macros for arithmetics with overflow checking")
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Prevent unused warnings in speculation_barrier.h

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.b

Prevent unused warnings in speculation_barrier.h

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

libutils: import speculation_barrier.h

Import speculation_barrier.h from [1]. This file implements a set of
wrapper macros for the __builtin_load_no_speculate builtin function
detailed at [2]. This

libutils: import speculation_barrier.h

Import speculation_barrier.h from [1]. This file implements a set of
wrapper macros for the __builtin_load_no_speculate builtin function
detailed at [2]. This builtin function defines a speculation barrier,
which can be used to limit the conditions under which a value which has
been loaded can be used under specualtive execution.

The header file provided here allows a migration path to using the
builtin function for users who are unable to immediately upgrade to a
compiler which supports the builtin.

(Description taken from the README.md file of the speculation_barrier
project by Arm on GitHub [3])

Link: [1] https://raw.githubusercontent.com/ARM-software/speculation-barrier/80e65cd830b321ff676941c2fab773da450e6dae/speculation_barrier.h
Link: [2] https://www.arm.com/security-update
Link: [3] https://github.com/ARM-software/speculation-barrier
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

show more ...