Add support for compiler stack protector

This change add support for CFG_CORE_STACK_PROTECTOR{,_STRONG,_ALL}
and CFG_TA_STACK_PROTECTOR{,_STRONG,_ALL}. This flag enable the
compiler stack overflow p

Add support for compiler stack protector

This change add support for CFG_CORE_STACK_PROTECTOR{,_STRONG,_ALL}
and CFG_TA_STACK_PROTECTOR{,_STRONG,_ALL}. This flag enable the
compiler stack overflow protection feature -fstack-protector* and
also generate random stack canary value on kernel boot and TA entry.

Weak function plat_get_random_stack_canary() can be override by
platform to provide random stack canary value for the core kernel.

Signed-off-by: Khoa Hoang <admin@khoahoang.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: confine_array_index: add support for RISC-V

Add a naive C implementation for RISC-V.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: liushiwei <liushiwei@eswincomputin

libutils: confine_array_index: add support for RISC-V

Add a naive C implementation for RISC-V.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: liushiwei <liushiwei@eswincomputing.com>
Reviewed-by: chenchaokai <chenchaokai@eswincomputing.com>

show more ...

Basic fault mitigation routines

Adds basic fault mitigation routines designed to help protecting from
fault injection attacks on the hardware. This is by no means bullet
proof, but it should at leas

Basic fault mitigation routines

Adds basic fault mitigation routines designed to help protecting from
fault injection attacks on the hardware. This is by no means bullet
proof, but it should at least improve the situation.

These routines focus on verifying that a function has been called and
that the returned value matches the result from the function. This is
done by having a handshake between the caller and the callee where also
the return value is transmitted in a separate channel.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: prefix system header guard with 2 underscore chars

Adds prefix "__" to standard header files implemented in libutils. This
is applicable as these header guards macro are system macros. Thi

libutils: prefix system header guard with 2 underscore chars

Adds prefix "__" to standard header files implemented in libutils. This
is applicable as these header guards macro are system macros. This
change prevents conflicts with external component as faced with
SCP-firmware [1] that implements wrapper headers with #include_next for
assert.h and stdlib.h using ASSERT_H [2] and STDLIB_H [3] as header
guards as in libutils.

Prior this change did stdint.h both define STDINT_H and _STDINT_H but
guards only upon STDINT_H. This change removes STDINT_H.

Link: [1] https://github.com/ARM-software/SCP-firmware.git
Link: [2] https://github.com/ARM-software/SCP-firmware/blob/v2.11.0/framework/include/assert.h#L8-L9
Link: [3] https://github.com/ARM-software/SCP-firmware/blob/v2.11.0/framework/include/stdlib.h#L8-L9
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: implement aligned_alloc()

Implements aligned_alloc() in bget_malloc.c based on memalign(). The
implementation also covers when ENABLE_MDBG is enabled, that is when
CFG_TEE_CORE_MALLOC_DEBU

libutils: implement aligned_alloc()

Implements aligned_alloc() in bget_malloc.c based on memalign(). The
implementation also covers when ENABLE_MDBG is enabled, that is when
CFG_TEE_CORE_MALLOC_DEBUG is enabled.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: compiler.h: introduce __alias(x)

Improve readability with an __alias definition.
Supports the __weak __alias("g") use case

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed

libutils: compiler.h: introduce __alias(x)

Improve readability with an __alias definition.
Supports the __weak __alias("g") use case

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: brel: bugfix memset scope larger than expected

In the case of wipe = true and previous buffer is free, memset
the current buffer, rather then current buffer with previous free
buffer.

Sig

libutils: brel: bugfix memset scope larger than expected

In the case of wipe = true and previous buffer is free, memset
the current buffer, rather then current buffer with previous free
buffer.

Signed-off-by: Zengxx <zengxiaoxu@huawei.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Guangwei Zhou <zhouguangwei5@huawei.com>

show more ...

libutils: util.h: fix the ROUNDUP_OVERFLOW() macro

Some parenthesis are missing in the ROUNDUP_OVERFLOW expression.
The macro can only return false.

Fixes: 2e48af989133 ("util.h: add the macro ROUN

libutils: util.h: fix the ROUNDUP_OVERFLOW() macro

Some parenthesis are missing in the ROUNDUP_OVERFLOW expression.
The macro can only return false.

Fixes: 2e48af989133 ("util.h: add the macro ROUNDUP_OVERFLOW()")
Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils:assert.h:add compiler check for static_assert

static_assert is belong to reserved word since C++11.
We only need this definition when not using C++ or
the C++ version less than C++11.

Sign

libutils:assert.h:add compiler check for static_assert

static_assert is belong to reserved word since C++11.
We only need this definition when not using C++ or
the C++ version less than C++11.

Signed-off-by: Gavin Liu <Gavin.Liu@mediatek.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: libutils, libutee, ta: add .note.GNU-stack section to .S files

When building for arm32 with GNU binutils 2.39, the linker outputs
warnings when linking Trusted Applications:

arm-unknown-lin

arm32: libutils, libutee, ta: add .note.GNU-stack section to .S files

When building for arm32 with GNU binutils 2.39, the linker outputs
warnings when linking Trusted Applications:

arm-unknown-linux-uclibcgnueabihf-ld.bfd: warning: utee_syscalls_a32.o: missing .note.GNU-stack section implies executable stack
arm-unknown-linux-uclibcgnueabihf-ld.bfd: NOTE: This behaviour is deprecated and will be removed in a future version of the linker

We could silence the warning by adding the '--no-warn-execstack' option
to the TA link flags, like we did in the parent commit for the TEE core
and ldelf. Indeed, ldelf always allocates a non-executable piece of
memory for the TA to use as a stack.

However it seems preferable to comply with the common ELF practices in
this case. A better fix is therefore to add the missing .note.GNU-stack
sections in the assembler files.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: util.h: add get_field_u{32,64}() and set_field_u{32,64}()

This commit defines macros for getting and setting bit fields.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Revie

libutils: util.h: add get_field_u{32,64}() and set_field_u{32,64}()

This commit defines macros for getting and setting bit fields.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutils: Import strtok_r() from newlib

Import strtok_r() from newlib.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jer

libutils: Import strtok_r() from newlib

Import strtok_r() from newlib.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

riscv: create makefiles and directories tree for riscv

This commits creates the very first makefiles, directories and
subdirectories for RISC-V port. It also creates a new platform flavor
named plat

riscv: create makefiles and directories tree for riscv

This commits creates the very first makefiles, directories and
subdirectories for RISC-V port. It also creates a new platform flavor
named plat-spike. Spike is a reference functional RISC-V ISA simulator
which provides full system emulation and it is developed alongside the
RISC-V toolchain.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutils: fix MTE error in realloc()

With memory tagging realloc() should only untag the old buffer if the
allocation of a new buffer is successful.

The implementation of realloc() prior to this pa

libutils: fix MTE error in realloc()

With memory tagging realloc() should only untag the old buffer if the
allocation of a new buffer is successful.

The implementation of realloc() prior to this patch is based on bgetr().
This is not so convenient with MTE enabled since the old buffer must be
untagged before calling bgetr(). If realloc() fails the memory tags must
be restored, but this was not done.

Restoring the tags is made somewhat more complicated by the fact that
the size reported by bget_buf_size() may actually be larger than the
size of the tagged buffer. Memalign() is sometimes forced to allocate
buffers larger than requested in order to honor the requested alignment.

So instead of using bgetr(), realloc() is implemented using bget(),
memcpy(), memset() and brel() as needed. This is the same thing that
bgetr() did, except that the old buffer is not untagged until a new
buffer has been successfully allocated.

Fixes: 08a5c4f9ae42 ("libutils: add MTE support in malloc() and friends")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a gp_20056)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: add MTE support in malloc() and friends

Adds support for memory tagging using the hardware assisted Armv8.5-A
Memory Tagging Extension in malloc() and friends.

When allocating memory the

libutils: add MTE support in malloc() and friends

Adds support for memory tagging using the hardware assisted Armv8.5-A
Memory Tagging Extension in malloc() and friends.

When allocating memory the acquired memory range in tagged a special
pointer with the tag coded in the top bits of the pointer. Accessing
this memory without the coded tag will result in a Tag Check Exception.

MTE is enabled for both OP-TEE core and TAs at the same time with
CFG_MEMTAG=y.

When the memory is freed it's untagged again. All accesses to heap
memory using old/stale pointers will be caught. This is an efficient
method to catch use-after-free and buffer overruns on the heap. The
buffer overruns are limited in granularity to blocks of 16 bytes.
However, the heap itself is also managed in blocks of 16 bytes so
smaller buffer overruns will not damage the heap.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add support for MTE

Adds support for the Armv8.5-A Memory Tagging Extension with
CFG_MEMTAG=y.

A memtag.h API is introduced to handle this extension. If CFG_MEMTAG=n
the API doesn't add any o

core: add support for MTE

Adds support for the Armv8.5-A Memory Tagging Extension with
CFG_MEMTAG=y.

A memtag.h API is introduced to handle this extension. If CFG_MEMTAG=n
the API doesn't add any overhead and the behaviour is unchanged. With
CFG_MEMTAG=y a check is performed to see if the platform can support MTE
and the API is dynamically configured accordingly. This means that it's
safe to have CFG_MEMTAG=y even for platforms not supporting MTE. There
will be some minimal overhead then, but likely not noticeable.

An entry is also added in the TEE_PROPSET_TEE_IMPLEMENTATION for a u32
property "org.trustedfirmware.optee.cpu.feat_memtag_implemented". The
property is set to a non-zero value only if CFG_CORE_MEMTAG is
configured and the underlying CPU supports FEAT_MTE.

This commit still only uses the default tag with the value 0 resulting
in unchanged pointers when accessing memory. However, all plumbing is in
place allowing for instance tagging of the heap in a later commit.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: refactor heap tagging

Refactors the heap tagging with CFG_CORE_SANITIZE_KADDRESS to use two new
hooks maybe_tag_buf() and maybe_untag_buf().

maybe_tag_buf() is called from raw_malloc_retu

libutils: refactor heap tagging

Refactors the heap tagging with CFG_CORE_SANITIZE_KADDRESS to use two new
hooks maybe_tag_buf() and maybe_untag_buf().

maybe_tag_buf() is called from raw_malloc_return_hook() which is called
after bget(). maybe_untag_buf() is called before brel() is called.

This removes some of the local modifications to bget.c.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: Refactor ftrace buffer dump implementation

Current implementation does a lot of tricky bits with ftrace buffer
pointer. It also leads to false positive -Warray-bounds warnings with
GCC 11.2

ftrace: Refactor ftrace buffer dump implementation

Current implementation does a lot of tricky bits with ftrace buffer
pointer. It also leads to false positive -Warray-bounds warnings with
GCC 11.2 toolchain as well. So refactor it to use array indexes instead.
Also, move hardcoded ftrace line sizes to macros instead for better
understanding.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)

show more ...

core: compiler.h: introduce __relrodata_unpaged(x)

Introduce macro __relrodata_unpaged(x) to mark data that need to be
unpaged and are essentially read-only but may contain relocations when
ASLR is

core: compiler.h: introduce __relrodata_unpaged(x)

Introduce macro __relrodata_unpaged(x) to mark data that need to be
unpaged and are essentially read-only but may contain relocations when
ASLR is enabled, hence "relocatable read-only". When ASLR is turned off,
the macro is identical to __rodata_unpaged(x). When ASLR is on however,
the data is emitted in section .data.rel.ro.__unpaged.x which is later
gathered by the linker file into the output section .data.rel.ro which
is mapped read only at runtime (after relocations are processed) and
is also unpaged (when pager is enabled).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

assert.h: add static_assert

Adds the static_assert macro from C11.

Acked-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens W

assert.h: add static_assert

Adds the static_assert macro from C11.

Acked-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

lib: libutils: compiler.h: set trailing comment according to target

In GNU assembler the comment character is target specific. GNU AS for
risc-v complains about '/' not recognized as character, ther

lib: libutils: compiler.h: set trailing comment according to target

In GNU assembler the comment character is target specific. GNU AS for
risc-v complains about '/' not recognized as character, therefore,
replace it with '#' to avoid errors.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

lib: libutils: isoc: remove unused thread.h from bget_malloc.c

This commit removes thread.h from lib/libutils/isoc/bget_malloc.c since
it is not used, but also to eliminate the dependency between ge

lib: libutils: isoc: remove unused thread.h from bget_malloc.c

This commit removes thread.h from lib/libutils/isoc/bget_malloc.c since
it is not used, but also to eliminate the dependency between generic
libraries code and architecture-specific core functions.

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

libutils: mempool based raw malloc functions

Instead of the old stack like internal memory allocator, use the raw
malloc functions instead for more efficient memory usage.

CFG_WITH_STATS is enabled

libutils: mempool based raw malloc functions

Instead of the old stack like internal memory allocator, use the raw
malloc functions instead for more efficient memory usage.

CFG_WITH_STATS is enabled automatically if
CFG_MEMPOOL_REPORT_LAST_OFFSET is enabled to secure a new dependency in
the code.

Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: export raw malloc functions

Exports raw_{memalign,malloc,free,calloc,realloc}() and also adds
raw_malloc_get_ctx_size(), raw_malloc_init_ctx(),
raw_malloc_add_pool() and raw_malloc_get_sta

libutils: export raw malloc functions

Exports raw_{memalign,malloc,free,calloc,realloc}() and also adds
raw_malloc_get_ctx_size(), raw_malloc_init_ctx(),
raw_malloc_add_pool() and raw_malloc_get_stats().

This allows using the malloc functions to allocate with a independent
memory pool.

Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: provide __sprintf_chk implementation

While building optee_test CXX test-cases natively on aarch64, OP-TEE
build relies on toolchain provided by buildroot. The buildroot toolchain
is built

libutils: provide __sprintf_chk implementation

While building optee_test CXX test-cases natively on aarch64, OP-TEE
build relies on toolchain provided by buildroot. The buildroot toolchain
is built with flag: -fstack-protector-strong which requires
__sprintf_chk symbol provided by standard glibc. For OP-TEE we use a
customized libc which leads to below error:

...
CC out/init.o
CC out/os_test.o
CC out/ta_entry.o
CXX out/cxx_tests.o
CC out/user_ta_header.o
CPP out/ta.lds
LD out/5b9e0e40-2636-11e1-ad9e-0002a5d5c51b.elf
/home/sumit/optee_br/build/../toolchains/aarch64/bin/aarch64-linux-ld.bfd: /home/sumit/optee_br/toolchains/aarch64/bin/../lib/gcc/aarch64-buildroot-linux-gnu/10.3.0/../../../../aarch64-buildroot-linux-gnu/lib/../lib64/libstdc++.a(cp-demangle.o): in function d_append_num': cp-demangle.c:(.text+0x830): undefined reference to __sprintf_chk'
...

Fix this issue by providing __sprintf_chk implementation.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...