libutils: asan: raw_realloc(): use unchecked memset() and memcpy()

When raw_realloc() invokes memset() and memcpy() the destination buffer
is not yet tagged for ASAN. Therefore use the unchecked ver

libutils: asan: raw_realloc(): use unchecked memset() and memcpy()

When raw_realloc() invokes memset() and memcpy() the destination buffer
is not yet tagged for ASAN. Therefore use the unchecked versions of
these functions.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: riscv: Update setjmp() and longjmp() for ftrace support

Fix the registers saving/restoring conventions. The length of jump
buffer is increased with one more slot to restore ftrace return s

libutils: riscv: Update setjmp() and longjmp() for ftrace support

Fix the registers saving/restoring conventions. The length of jump
buffer is increased with one more slot to restore ftrace return stack.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

libutils: malloc: fix raw_malloc_buffer_overlaps_heap()

When checking if there's an overlap between allocated buffer and
heap, raw_malloc_buffer_overlaps_heap() considers two cases: when
buffer come

libutils: malloc: fix raw_malloc_buffer_overlaps_heap()

When checking if there's an overlap between allocated buffer and
heap, raw_malloc_buffer_overlaps_heap() considers two cases: when
buffer comes before the pool and the opposite. On the first case,
overlap will happen if the buffer end after the loop start.
Since buf_end is computed as buf_start + len, it will point to
the address of the first byte after the memory region allocated to
the buffer.

Fix raw_malloc_buffer_overlaps_heap() by considering overlap only
when buffer end is bigger than the pool start.

Fixes: 12d739bd5028 ("libutils: use raw_malloc_*() as more primitive bget wrappers")
Signed-off-by: Vitor Sato Eschholz <vsatoes@baylibre.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: Disable stack protector for __aeabi_uidivmod/__aeabi_idivmod

Some toolchain build optee_os with "-fstack-protector-strong",
But the generated codes add "check stack" operations after the
"

libutils: Disable stack protector for __aeabi_uidivmod/__aeabi_idivmod

Some toolchain build optee_os with "-fstack-protector-strong",
But the generated codes add "check stack" operations after the
"ret_idivmod_values", which overwrite the r1 value.

So __aeabi_uidivmod/__aeabi_idivmod will got error value,

Link: https://github.com/OP-TEE/optee_os/issues/6007
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Yuegui He <yuegui.he@amlogic.com>

show more ...

virt: rename CFG_VIRTUALIZATION to CFG_NS_VIRTUALIZATION

With the advent of virtualization support at S-EL2 in the Armv8.4-A
architecture, CFG_VIRTUALIZATION has become ambiguous. Let's rename
it to

virt: rename CFG_VIRTUALIZATION to CFG_NS_VIRTUALIZATION

With the advent of virtualization support at S-EL2 in the Armv8.4-A
architecture, CFG_VIRTUALIZATION has become ambiguous. Let's rename
it to CFG_NS_VIRTUALIZATION to indicate more clearly that it is about
supporting virtualization on the non-secure side.

This commit is the result of the following command:

$ for f in $(git grep -l -w CFG_VIRTUALIZATION); do \
sed -i -e 's/CFG_VIRTUALIZATION/CFG_NS_VIRTUALIZATION/g' $f; \
done

...plus the compatibility line in mk/config.mk:

CFG_NS_VIRTUALIZATION ?= $(CFG_VIRTUALIZATION)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>

show more ...

libutils: mte: add missing calls to strip_tag()

Add missing calls to strip_tag() in raw_malloc_buffer_overlaps_heap()
and raw_malloc_buffer_is_within_alloced(). Without them pointer
arithmetic canno

libutils: mte: add missing calls to strip_tag()

Add missing calls to strip_tag() in raw_malloc_buffer_overlaps_heap()
and raw_malloc_buffer_is_within_alloced(). Without them pointer
arithmetic cannot work. Fixes xtest 1001.1 (make check MEMTAG=y).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: malloc: fix MDBG combined with MEMTAG

Fixes problems with MDBG when combined with memory tagging. MDBG uses an
extra header which wasn't taken into account when tagging the allocated
memor

libutils: malloc: fix MDBG combined with MEMTAG

Fixes problems with MDBG when combined with memory tagging. MDBG uses an
extra header which wasn't taken into account when tagging the allocated
memory. This leads to tag check fault. So fix it by adding the size of
the extra header when tagging the allocated memory.

Fixes: 08a5c4f9ae42 ("libutils: add MTE support in malloc() and friends")
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: riscv: provide setjmp_rv.S

Implement setjmp() and longjmp() in setjmp_rv.S

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

libutils: setjmp.h: add defines for RISC-V

Add jmp buffer size and type for RISC-V.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

libutils: change assert() to conform with stdlib implementation

Changes assert() definition to return a (dummy) value when expression
to true. This change allows to integrate external libraries whic

libutils: change assert() to conform with stdlib implementation

Changes assert() definition to return a (dummy) value when expression
to true. This change allows to integrate external libraries which
assume assert() conforms to such implementation, as found in GCC
or LLVM toolchains.

Removes inline description comment that could be confusing.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: use raw_malloc_*() as more primitive bget wrappers

The malloc implementation is layered on top of BGET, where the
raw_malloc_*() layer is the most primitive layer on top of BGET. This
lay

libutils: use raw_malloc_*() as more primitive bget wrappers

The malloc implementation is layered on top of BGET, where the
raw_malloc_*() layer is the most primitive layer on top of BGET. This
layer is unlocked so it's up to the caller to handle eventual
synchronization.

Until now this rule hasn't been followed completely by letting
raw_malloc_get_stats() call gen_malloc_get_stats() and not the other way
around. So fix this and also provide raw_malloc_buffer_overlaps_heap()
and raw_malloc_buffer_is_within_alloced().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: fix gen_malloc_buffer_overlaps_heap()

Fixes invalid range check in gen_malloc_buffer_overlaps_heap().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wikla

libutils: fix gen_malloc_buffer_overlaps_heap()

Fixes invalid range check in gen_malloc_buffer_overlaps_heap().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add support for compiler stack protector

This change add support for CFG_CORE_STACK_PROTECTOR{,_STRONG,_ALL}
and CFG_TA_STACK_PROTECTOR{,_STRONG,_ALL}. This flag enable the
compiler stack overflow p

Add support for compiler stack protector

This change add support for CFG_CORE_STACK_PROTECTOR{,_STRONG,_ALL}
and CFG_TA_STACK_PROTECTOR{,_STRONG,_ALL}. This flag enable the
compiler stack overflow protection feature -fstack-protector* and
also generate random stack canary value on kernel boot and TA entry.

Weak function plat_get_random_stack_canary() can be override by
platform to provide random stack canary value for the core kernel.

Signed-off-by: Khoa Hoang <admin@khoahoang.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: prefix system header guard with 2 underscore chars

Adds prefix "__" to standard header files implemented in libutils. This
is applicable as these header guards macro are system macros. Thi

libutils: prefix system header guard with 2 underscore chars

Adds prefix "__" to standard header files implemented in libutils. This
is applicable as these header guards macro are system macros. This
change prevents conflicts with external component as faced with
SCP-firmware [1] that implements wrapper headers with #include_next for
assert.h and stdlib.h using ASSERT_H [2] and STDLIB_H [3] as header
guards as in libutils.

Prior this change did stdint.h both define STDINT_H and _STDINT_H but
guards only upon STDINT_H. This change removes STDINT_H.

Link: [1] https://github.com/ARM-software/SCP-firmware.git
Link: [2] https://github.com/ARM-software/SCP-firmware/blob/v2.11.0/framework/include/assert.h#L8-L9
Link: [3] https://github.com/ARM-software/SCP-firmware/blob/v2.11.0/framework/include/stdlib.h#L8-L9
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: implement aligned_alloc()

Implements aligned_alloc() in bget_malloc.c based on memalign(). The
implementation also covers when ENABLE_MDBG is enabled, that is when
CFG_TEE_CORE_MALLOC_DEBU

libutils: implement aligned_alloc()

Implements aligned_alloc() in bget_malloc.c based on memalign(). The
implementation also covers when ENABLE_MDBG is enabled, that is when
CFG_TEE_CORE_MALLOC_DEBUG is enabled.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: brel: bugfix memset scope larger than expected

In the case of wipe = true and previous buffer is free, memset
the current buffer, rather then current buffer with previous free
buffer.

Sig

libutils: brel: bugfix memset scope larger than expected

In the case of wipe = true and previous buffer is free, memset
the current buffer, rather then current buffer with previous free
buffer.

Signed-off-by: Zengxx <zengxiaoxu@huawei.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Guangwei Zhou <zhouguangwei5@huawei.com>

show more ...

libutils:assert.h:add compiler check for static_assert

static_assert is belong to reserved word since C++11.
We only need this definition when not using C++ or
the C++ version less than C++11.

Sign

libutils:assert.h:add compiler check for static_assert

static_assert is belong to reserved word since C++11.
We only need this definition when not using C++ or
the C++ version less than C++11.

Signed-off-by: Gavin Liu <Gavin.Liu@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: libutils, libutee, ta: add .note.GNU-stack section to .S files

When building for arm32 with GNU binutils 2.39, the linker outputs
warnings when linking Trusted Applications:

arm-unknown-lin

arm32: libutils, libutee, ta: add .note.GNU-stack section to .S files

When building for arm32 with GNU binutils 2.39, the linker outputs
warnings when linking Trusted Applications:

arm-unknown-linux-uclibcgnueabihf-ld.bfd: warning: utee_syscalls_a32.o: missing .note.GNU-stack section implies executable stack
arm-unknown-linux-uclibcgnueabihf-ld.bfd: NOTE: This behaviour is deprecated and will be removed in a future version of the linker

We could silence the warning by adding the '--no-warn-execstack' option
to the TA link flags, like we did in the parent commit for the TEE core
and ldelf. Indeed, ldelf always allocates a non-executable piece of
memory for the TA to use as a stack.

However it seems preferable to comply with the common ELF practices in
this case. A better fix is therefore to add the missing .note.GNU-stack
sections in the assembler files.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: Import strtok_r() from newlib

Import strtok_r() from newlib.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jer

libutils: Import strtok_r() from newlib

Import strtok_r() from newlib.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

riscv: create makefiles and directories tree for riscv

This commits creates the very first makefiles, directories and
subdirectories for RISC-V port. It also creates a new platform flavor
named plat

riscv: create makefiles and directories tree for riscv

This commits creates the very first makefiles, directories and
subdirectories for RISC-V port. It also creates a new platform flavor
named plat-spike. Spike is a reference functional RISC-V ISA simulator
which provides full system emulation and it is developed alongside the
RISC-V toolchain.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: fix MTE error in realloc()

With memory tagging realloc() should only untag the old buffer if the
allocation of a new buffer is successful.

The implementation of realloc() prior to this pa

libutils: fix MTE error in realloc()

With memory tagging realloc() should only untag the old buffer if the
allocation of a new buffer is successful.

The implementation of realloc() prior to this patch is based on bgetr().
This is not so convenient with MTE enabled since the old buffer must be
untagged before calling bgetr(). If realloc() fails the memory tags must
be restored, but this was not done.

Restoring the tags is made somewhat more complicated by the fact that
the size reported by bget_buf_size() may actually be larger than the
size of the tagged buffer. Memalign() is sometimes forced to allocate
buffers larger than requested in order to honor the requested alignment.

So instead of using bgetr(), realloc() is implemented using bget(),
memcpy(), memset() and brel() as needed. This is the same thing that
bgetr() did, except that the old buffer is not untagged until a new
buffer has been successfully allocated.

Fixes: 08a5c4f9ae42 ("libutils: add MTE support in malloc() and friends")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a gp_20056)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: add MTE support in malloc() and friends

Adds support for memory tagging using the hardware assisted Armv8.5-A
Memory Tagging Extension in malloc() and friends.

When allocating memory the

libutils: add MTE support in malloc() and friends

Adds support for memory tagging using the hardware assisted Armv8.5-A
Memory Tagging Extension in malloc() and friends.

When allocating memory the acquired memory range in tagged a special
pointer with the tag coded in the top bits of the pointer. Accessing
this memory without the coded tag will result in a Tag Check Exception.

MTE is enabled for both OP-TEE core and TAs at the same time with
CFG_MEMTAG=y.

When the memory is freed it's untagged again. All accesses to heap
memory using old/stale pointers will be caught. This is an efficient
method to catch use-after-free and buffer overruns on the heap. The
buffer overruns are limited in granularity to blocks of 16 bytes.
However, the heap itself is also managed in blocks of 16 bytes so
smaller buffer overruns will not damage the heap.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: refactor heap tagging

Refactors the heap tagging with CFG_CORE_SANITIZE_KADDRESS to use two new
hooks maybe_tag_buf() and maybe_untag_buf().

maybe_tag_buf() is called from raw_malloc_retu

libutils: refactor heap tagging

Refactors the heap tagging with CFG_CORE_SANITIZE_KADDRESS to use two new
hooks maybe_tag_buf() and maybe_untag_buf().

maybe_tag_buf() is called from raw_malloc_return_hook() which is called
after bget(). maybe_untag_buf() is called before brel() is called.

This removes some of the local modifications to bget.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

assert.h: add static_assert

Adds the static_assert macro from C11.

Acked-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens W

assert.h: add static_assert

Adds the static_assert macro from C11.

Acked-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

lib: libutils: isoc: remove unused thread.h from bget_malloc.c

This commit removes thread.h from lib/libutils/isoc/bget_malloc.c since
it is not used, but also to eliminate the dependency between ge

lib: libutils: isoc: remove unused thread.h from bget_malloc.c

This commit removes thread.h from lib/libutils/isoc/bget_malloc.c since
it is not used, but also to eliminate the dependency between generic
libraries code and architecture-specific core functions.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...