core: support fault mitigations in non-threaded code

Fault mitigation won't work in non-threaded code due to the following
error:
assertion 'ct >= 0 && ct < CFG_NUM_THREADS' failed at core/arch/arm/

core: support fault mitigations in non-threaded code

Fault mitigation won't work in non-threaded code due to the following
error:
assertion 'ct >= 0 && ct < CFG_NUM_THREADS' failed at core/arch/arm/kernel
/thread.c:799 <thread_get_id>

The problem is in __ftmn_get_tsd_func_arg_pp which calls thread_get_tsd
which thread_get_id. The reason is that the interrupt handler is not
associated with any thread, so the ct (current_thread_id) value is -1 which
would cause an assert problem.

The fix is to add ftmn_arg to thread_core_local and the new variable would
be used when the current thread is < 0.

Signed-off-by: Sichun Qin <sichun.qin@amlogic.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: add runtime_assert()

Adds runtime_assert() as a version of assert() that can be used instead
of assert() when evaluating constant expressions to avoid the warning:
error: function might be

libutils: add runtime_assert()

Adds runtime_assert() as a version of assert() that can be used instead
of assert() when evaluating constant expressions to avoid the warning:
error: function might be candidate for attribute ‘noreturn’

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Leisen <leisen1@huawei.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: mempool: fix unbalanced put_pool()

Prior to this patch mempool_free() unconditionally called put_pool(),
but if the "ptr" argument is NULL it means that there hasn't been a
corresponding c

libutils: mempool: fix unbalanced put_pool()

Prior to this patch mempool_free() unconditionally called put_pool(),
but if the "ptr" argument is NULL it means that there hasn't been a
corresponding call to get_pool(). Fix this only calling put_pool() for
non-NULL pointers.

Fixes: a51d45b52503 ("libutils: mempool based raw malloc functions")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

compiler.h: add __inhibit_loop_to_libcall

Introduce __inhibit_loop_to_libcall which allows to disable a specific
compiler optimization that detects and replaces some open coded loops
with standard l

compiler.h: add __inhibit_loop_to_libcall

Introduce __inhibit_loop_to_libcall which allows to disable a specific
compiler optimization that detects and replaces some open coded loops
with standard library calls (typically: memcpy() and memset()).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: asan: raw_realloc(): use unchecked memset() and memcpy()

When raw_realloc() invokes memset() and memcpy() the destination buffer
is not yet tagged for ASAN. Therefore use the unchecked ver

libutils: asan: raw_realloc(): use unchecked memset() and memcpy()

When raw_realloc() invokes memset() and memcpy() the destination buffer
is not yet tagged for ASAN. Therefore use the unchecked versions of
these functions.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: add {high,low}32_from_64() helper

Adds two helper functions high32_from_64() and low32_from_64() used for
retrieving the upper and lower halves of a uint64_t.

Signed-off-by: Jens Wiklande

libutils: add {high,low}32_from_64() helper

Adds two helper functions high32_from_64() and low32_from_64() used for
retrieving the upper and lower halves of a uint64_t.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ftrace: change implementation to use binary circular buffer

The current implementation of function tracing (CFG_FTRACE_SUPPORT)
produces human-readable text into the output buffer that is passed to

ftrace: change implementation to use binary circular buffer

The current implementation of function tracing (CFG_FTRACE_SUPPORT)
produces human-readable text into the output buffer that is passed to
tee-supplicant and ultimately saved to the Linux filesystem. Two main
issues with that:

1. The string formatting code is somewhat complex. It introduces
significant overhead in the execution time of the instrumented
functions.
2. The various policies about how to handle a buffer full condition
(CFG_FTRACE_BUF_WHEN_FULL) are not very convenient. In particular,
"shift" is typically the most desirable option because it always
keeps the most recent entries, but it is very inefficient to the
point of not being usable in practice.

This commit addresses the above concerns by making the ftrace buffer
circular one, each entry being 64-bit value. The formatting code is
offloaded to a new Python script: scripts/ftrace_format.py. The
output is unchanged except for an added field showing the current
depth in the call stack.

Typical usage (captured on QEMUv8):

build$ mkdir -p ../tmp
build$ chmod a+w ../tmp
build$ make CFG_FTRACE_SUPPORT=y CFG_FTRACE_BUF_SIZE=15000 \
CFG_TA_MCOUNT=y CFG_ULIBS_MCOUNT=y CFG_SYSCALL_FTRACE=y \
QEMU_VIRTFS_AUTOMOUNT=y run
$ xtest regression_1004
...
$ cp /tmp/ftrace-cb3e5ba0-adf1-11e0-998b-0002a5d5c51b.out /mnt/host/tmp
build$ cd ..
optee$ optee_os/scripts/ftrace_format.py \
tmp/ftrace-cb3e5ba0-adf1-11e0-998b-0002a5d5c51b.out |
optee_os/scripts/symbolize.py \
-d optee_os/out/arm/core \
-d out-br/build/optee_test_ext-1.0/ta/*/out | less
TEE load address @ 0x5ab04000
Function graph for TA: cb3e5ba0-adf1-11e0-998b-0002a5d5c51b @ 80085000
| 1 | __ta_entry() {
| 2 | __utee_entry() {
43.840 us | 3 | ta_header_get_session()
7.216 us | 3 | tahead_get_trace_level()
14.480 us | 3 | trace_set_level()
| 3 | malloc_add_pool() {
| 4 | raw_malloc_add_pool() {
46.032 us | 5 | bpool()
| 5 | raw_realloc() {
166.256 us | 6 | bget()
23.056 us | 6 | raw_malloc_return_hook()
267.952 us | 5 | }
398.720 us | 4 | }
426.992 us | 3 | }
| 3 | TEE_GetPropertyAsU32() {
23.600 us | 4 | is_propset_pseudo_handle()
| 4 | __utee_check_instring_annotation() {
26.416 us | 5 | strlen()
| 5 | check_access() {
| 6 | TEE_CheckMemoryAccessRights() {
| 7 | _utee_check_access_rights() {
| 8 | syscall_check_access_rights() {
| 9 | ts_get_current_session() {
4.304 us | 10 | ts_get_current_session_may_fail()
10.976 us | 9 | }
| 9 | to_user_ta_ctx() {
2.496 us | 10 | is_user_ta_ctx()
8.096 us | 9 | }
| 9 | vm_check_access_rights() {
| 10 | vm_buf_is_inside_um_private() {
| 11 | core_is_buffer_inside() {
...

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: ftrace: Add definitions for separating architectural headers

Add definitions for separating architectural headers. In kernel mode,
risc-v may include riscv.h to have the timer related func

libutils: ftrace: Add definitions for separating architectural headers

Add definitions for separating architectural headers. In kernel mode,
risc-v may include riscv.h to have the timer related functions. In TA
libraries, risc-v may include riscv_user_sysreg.h to have those
functions.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

libutils: riscv: Update setjmp() and longjmp() for ftrace support

Fix the registers saving/restoring conventions. The length of jump
buffer is increased with one more slot to restore ftrace return s

libutils: riscv: Update setjmp() and longjmp() for ftrace support

Fix the registers saving/restoring conventions. The length of jump
buffer is increased with one more slot to restore ftrace return stack.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

libutils: riscv: Implement _mount() and __ftrace_return()

When the core and TA are compiled with the -pg option, the compiler
inserts a call to _mcount() into every function prologue. It can be used

libutils: riscv: Implement _mount() and __ftrace_return()

When the core and TA are compiled with the -pg option, the compiler
inserts a call to _mcount() into every function prologue. It can be used
to trace the function calls such as ftrace.

Implement the _mount() to prepare the necessary parameters for ftrace.
The __ftrace_return() is also implemented for returning from ftrace.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

libutils: Add riscv.S to make it available for core and TA libs

Some assembly macros are necessary for both OP-TEE core and TA
libraries. Therefore, we add riscv specific assembly file into libutils

libutils: Add riscv.S to make it available for core and TA libs

Some assembly macros are necessary for both OP-TEE core and TA
libraries. Therefore, we add riscv specific assembly file into libutils
and move some assembly related macros from riscv.h to riscv.S.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Marouene Boubakri <marouene.boubakri@nxp.com>

show more ...

libutils: malloc: fix raw_malloc_buffer_overlaps_heap()

When checking if there's an overlap between allocated buffer and
heap, raw_malloc_buffer_overlaps_heap() considers two cases: when
buffer come

libutils: malloc: fix raw_malloc_buffer_overlaps_heap()

When checking if there's an overlap between allocated buffer and
heap, raw_malloc_buffer_overlaps_heap() considers two cases: when
buffer comes before the pool and the opposite. On the first case,
overlap will happen if the buffer end after the loop start.
Since buf_end is computed as buf_start + len, it will point to
the address of the first byte after the memory region allocated to
the buffer.

Fix raw_malloc_buffer_overlaps_heap() by considering overlap only
when buffer end is bigger than the pool start.

Fixes: 12d739bd5028 ("libutils: use raw_malloc_*() as more primitive bget wrappers")
Signed-off-by: Vitor Sato Eschholz <vsatoes@baylibre.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: Disable stack protector for __aeabi_uidivmod/__aeabi_idivmod

Some toolchain build optee_os with "-fstack-protector-strong",
But the generated codes add "check stack" operations after the
"

libutils: Disable stack protector for __aeabi_uidivmod/__aeabi_idivmod

Some toolchain build optee_os with "-fstack-protector-strong",
But the generated codes add "check stack" operations after the
"ret_idivmod_values", which overwrite the r1 value.

So __aeabi_uidivmod/__aeabi_idivmod will got error value,

Link: https://github.com/OP-TEE/optee_os/issues/6007
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Yuegui He <yuegui.he@amlogic.com>

show more ...

libutils: add bit_ffs_from()

Adds bitstring function bit_ffs_from() that mimics bit_ffs() but looks
from a start bit position given as argument, and defines bit_ffs()
based on bit_ffs_from().

Revie

libutils: add bit_ffs_from()

Adds bitstring function bit_ffs_from() that mimics bit_ffs() but looks
from a start bit position given as argument, and defines bit_ffs()
based on bit_ffs_from().

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: add stubs for pthread functions

When building with GCC 11.3.1 [1], the linker reports undefined symbols
in the C++ test TA:

$ make 2>&1 | grep -E "(in function|undefined reference)" | se

libutils: add stubs for pthread functions

When building with GCC 11.3.1 [1], the linker reports undefined symbols
in the C++ test TA:

$ make 2>&1 | grep -E "(in function|undefined reference)" | sed 's@.*/@@'
libstdc++.a(eh_alloc.o): in function `(anonymous namespace)::pool::free(void*) [clone .constprop.0]':
gthr-default.h:749: undefined reference to `pthread_mutex_lock'
gthr-default.h:779: undefined reference to `pthread_mutex_unlock'
libstdc++.a(eh_alloc.o): in function `(anonymous namespace)::pool::allocate(unsigned long) [clone .constprop.0]':
gthr-default.h:749: undefined reference to `pthread_mutex_lock'
gthr-default.h:779: undefined reference to `pthread_mutex_unlock'
libgcc_eh.a(unwind-dw2-fde-dip.o): in function `__gthread_mutex_lock':
gthr-default.h:749: undefined reference to `pthread_mutex_lock'
libgcc_eh.a(unwind-dw2-fde-dip.o): in function `__gthread_mutex_unlock':
gthr-default.h:779: undefined reference to `pthread_mutex_unlock'
[more of the same follow]

To fix that issue, introduce no-op stubs as weak symbols in libutils.
Doing so is valid because TAs are single threaded and non-reentrant.

Link: [1] https://developer.arm.com/-/media/Files/downloads/gnu/11.3.rel1/binrel/arm-gnu-toolchain-11.3.rel1-x86_64-aarch64-none-linux-gnu.tar.xz
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

virt: rename CFG_VIRTUALIZATION to CFG_NS_VIRTUALIZATION

With the advent of virtualization support at S-EL2 in the Armv8.4-A
architecture, CFG_VIRTUALIZATION has become ambiguous. Let's rename
it to

virt: rename CFG_VIRTUALIZATION to CFG_NS_VIRTUALIZATION

With the advent of virtualization support at S-EL2 in the Armv8.4-A
architecture, CFG_VIRTUALIZATION has become ambiguous. Let's rename
it to CFG_NS_VIRTUALIZATION to indicate more clearly that it is about
supporting virtualization on the non-secure side.

This commit is the result of the following command:

$ for f in $(git grep -l -w CFG_VIRTUALIZATION); do \
sed -i -e 's/CFG_VIRTUALIZATION/CFG_NS_VIRTUALIZATION/g' $f; \
done

...plus the compatibility line in mk/config.mk:

CFG_NS_VIRTUALIZATION ?= $(CFG_VIRTUALIZATION)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>

show more ...

libutils: mte: add missing calls to strip_tag()

Add missing calls to strip_tag() in raw_malloc_buffer_overlaps_heap()
and raw_malloc_buffer_is_within_alloced(). Without them pointer
arithmetic canno

libutils: mte: add missing calls to strip_tag()

Add missing calls to strip_tag() in raw_malloc_buffer_overlaps_heap()
and raw_malloc_buffer_is_within_alloced(). Without them pointer
arithmetic cannot work. Fixes xtest 1001.1 (make check MEMTAG=y).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: riscv: provide atomic_rv.S

Implement atomic_inc32() and atomic_dec32() in atomic_rv.S.
The implementation is based on atomic addition instruction
with acquire and release suffix to add add

libutils: riscv: provide atomic_rv.S

Implement atomic_inc32() and atomic_dec32() in atomic_rv.S.
The implementation is based on atomic addition instruction
with acquire and release suffix to add additional memory
order constraints.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: malloc: fix MDBG combined with MEMTAG

Fixes problems with MDBG when combined with memory tagging. MDBG uses an
extra header which wasn't taken into account when tagging the allocated
memor

libutils: malloc: fix MDBG combined with MEMTAG

Fixes problems with MDBG when combined with memory tagging. MDBG uses an
extra header which wasn't taken into account when tagging the allocated
memory. This leads to tag check fault. So fix it by adding the size of
the extra header when tagging the allocated memory.

Fixes: 08a5c4f9ae42 ("libutils: add MTE support in malloc() and friends")
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: riscv: provide setjmp_rv.S

Implement setjmp() and longjmp() in setjmp_rv.S

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

libutils: setjmp.h: add defines for RISC-V

Add jmp buffer size and type for RISC-V.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

libutils: IS_ENABLED2() for _CFG_* switches

Adds macro IS_ENABLED2() to be used for OP-TEE OS internal _CFG_*
configuration switches to not conflict with IS_ENABLED() coding style
rules inherited fr

libutils: IS_ENABLED2() for _CFG_* switches

Adds macro IS_ENABLED2() to be used for OP-TEE OS internal _CFG_*
configuration switches to not conflict with IS_ENABLED() coding style
rules inherited from Linux kernel coding style.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: change assert() to conform with stdlib implementation

Changes assert() definition to return a (dummy) value when expression
to true. This change allows to integrate external libraries whic

libutils: change assert() to conform with stdlib implementation

Changes assert() definition to return a (dummy) value when expression
to true. This change allows to integrate external libraries which
assume assert() conforms to such implementation, as found in GCC
or LLVM toolchains.

Removes inline description comment that could be confusing.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: use raw_malloc_*() as more primitive bget wrappers

The malloc implementation is layered on top of BGET, where the
raw_malloc_*() layer is the most primitive layer on top of BGET. This
lay

libutils: use raw_malloc_*() as more primitive bget wrappers

The malloc implementation is layered on top of BGET, where the
raw_malloc_*() layer is the most primitive layer on top of BGET. This
layer is unlocked so it's up to the caller to handle eventual
synchronization.

Until now this rule hasn't been followed completely by letting
raw_malloc_get_stats() call gen_malloc_get_stats() and not the other way
around. So fix this and also provide raw_malloc_buffer_overlaps_heap()
and raw_malloc_buffer_is_within_alloced().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: fix gen_malloc_buffer_overlaps_heap()

Fixes invalid range check in gen_malloc_buffer_overlaps_heap().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wikla

libutils: fix gen_malloc_buffer_overlaps_heap()

Fixes invalid range check in gen_malloc_buffer_overlaps_heap().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...