libutee, ldelf: add leading underscore to syscall wrappers

libutee defines assembler wrapper functions for each OP-TEE system call.
These wrappers have a utee_ prefix. This commit adds a leading
und

libutee, ldelf: add leading underscore to syscall wrappers

libutee defines assembler wrapper functions for each OP-TEE system call.
These wrappers have a utee_ prefix. This commit adds a leading
underscore so that the names cannot clash with user-defined symbols.
Doing so is common practice for "system" libraries, as defined by the C
standard in a set of requirements that can be summarized as follows
(excerpt from the GNU libc documentation [1]):

[R]eserved names include all external identifiers (global functions
and variables) that begin with an underscore (‘_’) and all identifiers
regardless of use that begin with either two underscores or an
underscore followed by a capital letter are reserved names. This is so
that the library and header files can define functions, variables, and
macros for internal purposes without risk of conflict with names in
user programs.

The utee_*() wrappers are internal to OP-TEE and are not supposed to be
called directly by TAs so this should not have any user-visible impact.

Link: [1] https://www.gnu.org/software/libc/manual/html_node/Reserved-Names.html
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: atomic.h: fix atomic_load_u32() types

Prior to this patch was atomic_load_u32() using wrong types, unsigned int
instead of the expected uint32_t. Fix this by changing the types.

Reviewed-

libutils: atomic.h: fix atomic_load_u32() types

Prior to this patch was atomic_load_u32() using wrong types, unsigned int
instead of the expected uint32_t. Fix this by changing the types.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: confine_array_index: arm64: replace csdb by hint #20

Older compilers such as GCC 6.2 do not support the csdb mnemonic [1].
For better compatibility, replace it by its equivalent: hint #20.

libutils: confine_array_index: arm64: replace csdb by hint #20

Older compilers such as GCC 6.2 do not support the csdb mnemonic [1].
For better compatibility, replace it by its equivalent: hint #20.

CC out/arm/ldelf/ta_elf_rel.o
{standard input}: Assembler messages:
{standard input}:274: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:371: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:667: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:776: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1010: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1084: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1413: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1495: Error: unknown mnemonic `csdb' -- `csdb'
{standard input}:1671: Error: unknown mnemonic `csdb' -- `csdb'
make[1]: *** [mk/compile.mk:157: out/arm/ldelf/ta_elf_rel.o] Error 1

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: confine_array_index: fix clang build trace for Thumb2

Avoid trace 'deprecated instruction in IT block [-Werror,-Winline-asm]'
when building with CLang. The message states performance issue

libutils: confine_array_index: fix clang build trace for Thumb2

Avoid trace 'deprecated instruction in IT block [-Werror,-Winline-asm]'
when building with CLang. The message states performance issue which
is true but prefer the performance cost over the security flaw hence
warning trace is removed without embedded code changed.

Fixes: 2b6dd0df52b4 ("confine_array_index.h: add A32 and T32 versions of confine_array_index()")
Suggested-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: confine_array_index: fix 32bit modes implementation

Fix implementation of confine_array_index() for 32bit Arm and Thumb2
modes as previous implementation did not set the return value
expli

libutils: confine_array_index: fix 32bit modes implementation

Fix implementation of confine_array_index() for 32bit Arm and Thumb2
modes as previous implementation did not set the return value
explicitly and relied on luck with the layout of the machine code
to return the correct value.

Fixes: https://github.com/OP-TEE/optee_os/issues/3799
Fixes: 2b6dd0df52b4 ("confine_array_index.h: add A32 and T32 versions of confine_array_index()")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (qemu,qemu_v8)
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

libutee: optimize memcpy() for speed

Overrides the -Os flag with -O2 in order to compile a speed optimized
version of memcpy().

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-b

libutee: optimize memcpy() for speed

Overrides the -Os flag with -O2 in order to compile a speed optimized
version of memcpy().

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove '.section .text.<name>' and use function macros instead

Assembler functions are normally defined using the FUNC/LOCAL_FUNC
macros from <asm.S>. The macros takes care of several things, includ

Remove '.section .text.<name>' and use function macros instead

Assembler functions are normally defined using the FUNC/LOCAL_FUNC
macros from <asm.S>. The macros takes care of several things, including
putting the function in a specific section for later garbage collection
by the linker (--gc-sections).

A few files do not follow this convention, let's fix them. Two
functions in ghash-ce-core_a64.S (pmull_gcm_load_round_keys() and
pmull_gcm_aes_sub()) totally lack a .section directive, which I think
is a mistake. Fix them at the same time.

No functional change is expected.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

util.h: add ROUNDUP_DIV(x, y) macro

Adds the ROUNDUP_DIV(x, y) macro which Rounds up to the nearest multiple
of y and then divides by y. Safe against overflow, y has to be a
multiple of 2 just as in

util.h: add ROUNDUP_DIV(x, y) macro

Adds the ROUNDUP_DIV(x, y) macro which Rounds up to the nearest multiple
of y and then divides by y. Safe against overflow, y has to be a
multiple of 2 just as in the other two ROUNDUP*() macros.

This macro is intended to be used to convert from "number of bytes" to
"number of pages" or similar units. Example:
num_pages = ROUNDUP_DIV(num_bytes, SMALL_PAGE_SIZE);

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: add __noreturn to longjmp() prototype

The longjmp() function does not return, therefore it should have the
__noreturn attribute. Avoids compiler warnings.

Signed-off-by: Jerome Forissier

libutils: add __noreturn to longjmp() prototype

The longjmp() function does not return, therefore it should have the
__noreturn attribute. Avoids compiler warnings.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

confine_array_index.h: add A32 and T32 versions of confine_array_index()

Adds inline assembly implementations for the A32 and T32 instruction
sets. The implementation is based on __load_no_speculate

confine_array_index.h: add A32 and T32 versions of confine_array_index()

Adds inline assembly implementations for the A32 and T32 instruction
sets. The implementation is based on __load_no_speculate1() in
<speculation_barrier.h>.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: import confine_array_index.h from Fuchsia

Imports confine_array_index.h from [1].

Replaced include statements to suit OP-TEE and removed the namespace
directive. Added content from [2] as

libutils: import confine_array_index.h from Fuchsia

Imports confine_array_index.h from [1].

Replaced include statements to suit OP-TEE and removed the namespace
directive. Added content from [2] as a comment to clarify the license.

The speculation safe function confine_array_index() is provided with
this.

Note that only AArch64 and x86_64 versions of the function is implemented
in this commit.

Link: [1] https://fuchsia.googlesource.com/fuchsia/+/39d9b8c2dbb0f6133a835676f8f669b07aca6b30/zircon/system/ulib/fbl/include/fbl/confine_array_index.h
Link: [2] https://fuchsia.googlesource.com/fuchsia/+/39d9b8c2dbb0f6133a835676f8f669b07aca6b30/LICENSE

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: introduce CFG_FTRACE_BUF_WHEN_FULL

Function tracing can become extremely slow in case a big buffer size is
used (say, CFG_FTRACE_BUF_SIZE=6000000 instead of the default 2048
bytes). This is

ftrace: introduce CFG_FTRACE_BUF_WHEN_FULL

Function tracing can become extremely slow in case a big buffer size is
used (say, CFG_FTRACE_BUF_SIZE=6000000 instead of the default 2048
bytes). This is because of the "shifting" algorithm used when the buffer
is full, which copies almost the full buffer before inserting a new
line.

In order to mitigate this problem, this patch introduces two new
methods to handle the buffer full condition:

1. Discard existing data and write new lines to the beginning of the
buffer.
2. Stop adding new lines.

The method can be selected at build time with CFG_FTRACE_BUF_WHEN_FULL.
Supported values are "shift", "wrap" and "stop".

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Move core/include/config.h to lib/libutils/ext/include

In order to be able to use the IS_ENABLED() macro in user space
libraries, move config.h from core to libutils.

Signed-off-by: Jerome Forissie

Move core/include/config.h to lib/libutils/ext/include

In order to be able to use the IS_ENABLED() macro in user space
libraries, move config.h from core to libutils.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

stdint.h: add U() ULL() L() LL() macros

Adds U() ULL() L() and LL() macros with a separate implementation for
assembly. Brushes up {,U}INT{8,16,32,64}_C() macros to use the new
primitive macros inst

stdint.h: add U() ULL() L() LL() macros

Adds U() ULL() L() and LL() macros with a separate implementation for
assembly. Brushes up {,U}INT{8,16,32,64}_C() macros to use the new
primitive macros instead.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

trace: Add weak platform tracer function

Add weak platform tracer function
This would allow each platform to carry out
plat specific logging, possibly to some media
for post-mortem analysis

Signed-

trace: Add weak platform tracer function

Add weak platform tracer function
This would allow each platform to carry out
plat specific logging, possibly to some media
for post-mortem analysis

Signed-off-by: Sheetal Tigadoli <sheetal.tigadoli@broadcom.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

stdint.h: add UL macro

This macro helps to define unsigned values such as addresses for C
compilers and ld.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jens Wiklander <jens.wikla

stdint.h: add UL macro

This macro helps to define unsigned values such as addresses for C
compilers and ld.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

Assembly FUNC macros take optional section

Adds an optional section parameter to the macros FUNC() and LOCAL_FUNC()

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklande

Assembly FUNC macros take optional section

Adds an optional section parameter to the macros FUNC() and LOCAL_FUNC()

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Fix warning in fallback SUB_OVERFLOW() macro

Fixes two warnings for 'comparison of integers of different signs' in
the __INTOF_SUB() helper macro used by the fallback SUB_OVERFLOW()
macro.

Fixes: e

Fix warning in fallback SUB_OVERFLOW() macro

Fixes two warnings for 'comparison of integers of different signs' in
the __INTOF_SUB() helper macro used by the fallback SUB_OVERFLOW()
macro.

Fixes: ecdedc94e720 ("util: update fallback SUB_OVERFLOW() macro")
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are in

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are invoked by user TAs into the TEE core.

And after this patch ftrace will cover both TA and TEE core code. So lets
rename config option from CFG_TA_FTRACE_SUPPORT to CFG_FTRACE_SUPPORT.

It is optional to enable syscall trace via CFG_SYSCALL_FTRACE=y config
option in addition to CFG_FTRACE_SUPPORT=y config option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ftrace: core: prepare support for syscall ftrace

Enable compilation of ftrace library code for TEE core.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@fori

ftrace: core: prepare support for syscall ftrace

Enable compilation of ftrace library code for TEE core.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ftrace: move ftrace code from libutee to libutils

Since TEE core and TA can share most of ftrace library code, so move
ftrace code from libutee to libutils library which is shared among TEE
core and

ftrace: move ftrace code from libutee to libutils

Since TEE core and TA can share most of ftrace library code, so move
ftrace code from libutee to libutils library which is shared among TEE
core and TA.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

Experimental Clang support

Allows building with Clang with "make COMPILER=clang [other flags...]".
The clang command has to be in the $PATH, as well as the associated
tools (clang-cpp, ld.lld, llvm-

Experimental Clang support

Allows building with Clang with "make COMPILER=clang [other flags...]".
The clang command has to be in the $PATH, as well as the associated
tools (clang-cpp, ld.lld, llvm-ar, llvm-nm, llvm-objcopy and
llvm-readelf).

Tested with Clang built from the master branch of [1] (development
version for 9.0):

mkdir build; cd build
cmake -G Ninja -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=~/llvm-install \
-DLLVM_ENABLE_PROJECTS="clang;lld" \
-DLLVM_TARGETS_TO_BUILD="AArch64;ARM" \
~/llvm-project/llvm
ninja && ninja install

Limitations:

- CFG_CORE_SANITIZE_KADDRESS=y is not supported.
- CFG_WITH_PAGER is supported, but requires that the TEE core be
linked with the GNU linker. The reason is documented in
mk/clang.mk.

Bug:

- ldelf assertion failure in xtest 1019 when CFG_ULIBS_SHARED=y (QEMU)
E/LD: assertion 'maps[map_idx].sz == sz' failed at ldelf/ta_elf.c:1114 in ta_elf_print_mappings()
Prevents ldelf from displaying the TA mappings on abort or panic, but
does not seem to cause any other problem.

Link: [1] https://github.com/llvm/llvm-project/commits/8351c327647
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU pager/no pager)
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMUv8, pager/no pager)
Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960, 32/64, GP)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: relax noreturn label

Replaces attribute label identifier noreturn with __noreturn__ to
prevent conflicts when importing code which defines label noreturn
itself as a macro. This change app

libutils: relax noreturn label

Replaces attribute label identifier noreturn with __noreturn__ to
prevent conflicts when importing code which defines label noreturn
itself as a macro. This change applies suggestion from the GCC
documentation [1], applicable even prio GCC 4.x.x, cited below.

> You may optionally specify attribute names with ‘__’ preceding
> and following the name. This allows you to use them in header
> files without being concerned about a possible macro of the same
> name. For example, you may use the attribute name __noreturn__
> instead of noreturn.

Link: [1] https://gcc.gnu.org/onlinedocs/gcc-8.3.0/gcc/Attribute-Syntax.html#Attribute-Syntax
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workar

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workaround. I tried 4.9, 6.2,
8.2, and 8.3 from various sources (Linaro or Ubuntu). If
__SECTION_FLAGS_RODATA is empty, this warning is always present:

CC out/arm-plat-vexpress/core/mm/fobj.o
{standard input}: Assembler messages:
{standard input}:402: Warning: setting incorrect section attributes for .rodata.__unpaged

The generated assembler file contains the "aw" flags:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"aw",%progbits

By reverting the above commit, we have:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"a",%progbits //,"aw",%progbits

...and the assembler does not warn anymore.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should d

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should depend on __GCC_VERSION. This prepares for Clang.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...