Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workar

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workaround. I tried 4.9, 6.2,
8.2, and 8.3 from various sources (Linaro or Ubuntu). If
__SECTION_FLAGS_RODATA is empty, this warning is always present:

CC out/arm-plat-vexpress/core/mm/fobj.o
{standard input}: Assembler messages:
{standard input}:402: Warning: setting incorrect section attributes for .rodata.__unpaged

The generated assembler file contains the "aw" flags:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"aw",%progbits

By reverting the above commit, we have:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"a",%progbits //,"aw",%progbits

...and the assembler does not warn anymore.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should d

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should depend on __GCC_VERSION. This prepares for Clang.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

util.h: add the macro ROUNDUP_OVERFLOW()

Adds the macro ROUNDUP_OVERFLOW() which rounds up like ROUNDUP() but also
checks the result for overflow and returns true on overflow.

Reviewed-by: Etienne

util.h: add the macro ROUNDUP_OVERFLOW()

Adds the macro ROUNDUP_OVERFLOW() which rounds up like ROUNDUP() but also
checks the result for overflow and returns true on overflow.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: bget_malloc.c: copy statistics using memcpy_unckecked()

When CFG_CORE_SANITIZE_KADDRESS=y, most OP-TEE files are built with
address sanitizer flags except bget_malloc.c. As a result, the m

libutils: bget_malloc.c: copy statistics using memcpy_unckecked()

When CFG_CORE_SANITIZE_KADDRESS=y, most OP-TEE files are built with
address sanitizer flags except bget_malloc.c. As a result, the memcpy()
function in memcpy.c is instrumented, whereas the malloc context
structure (malloc_ctx) in bget_malloc.c is not. This causes the
following panic:

$ xtest --stats --alloc

E/TC:0 0 Panic at core/kernel/asan.c:189 <check_access>
E/TC:0 0 Call stack:
E/TC:0 0 0x0e125c3d print_kernel_stack at optee_os/core/arch/arm/kernel/unwind_arm32.c:450
E/TC:0 0 0x0e13fcfb __do_panic at optee_os/core/kernel/panic.c:32 (discriminator 1)
E/TC:0 0 0x0e13e099 check_access at optee_os/core/kernel/asan.c:187 (discriminator 2)
E/TC:0 0 0x0e13e10f check_load at optee_os/core/kernel/asan.c:199
E/TC:0 0 0x0e13e187 __asan_load4_noabort at optee_os/core/kernel/asan.c:231
E/TC:0 0 0x0e185d15 memcpy at optee_os/lib/libutils/isoc/newlib/memcpy.c:112
E/TC:0 0 0x0e184a3f gen_malloc_get_stats at optee_os/lib/libutils/isoc/bget_malloc.c:234
[...]

Introduce memcpy_unchecked() (which evaluates to asan_memcpy_unchecked()
when ASAN is enabled and memcpy() otherwise) to fix the issue.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: don't use __bss and __data attributes

Manual placement in .data or .bss section breaks GCC Address
Sanitizer, because it refuses to track variables, that are stored in
user sections. Even if t

core: don't use __bss and __data attributes

Manual placement in .data or .bss section breaks GCC Address
Sanitizer, because it refuses to track variables, that are stored in
user sections. Even if those sections are actually not user-defined,
but generic .bss and .data.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960, ASAN)
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, GP, ASAN)

show more ...

ftrace: allow display of larger durations

Currently the ftrace buffer shows durations in microseconds and modulo
1000000 us. It is problematic if values larger than one second are
measured.

This pa

ftrace: allow display of larger durations

Currently the ftrace buffer shows durations in microseconds and modulo
1000000 us. It is problematic if values larger than one second are
measured.

This patch makes sure that no invalid value is ever displayed when an
overflow occurs. Instead, the trace will contain dashes, such as
"--------- us".

In addition, the unit is changed from microseconds (us) to milliseconds
(ms) when the duration exceeds a predefined value set by CFG_FTRACE_US_MS
(default: 10000 us).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

ftrace: allow tracing of syscall wrappers only

Introduces a new configuration flag: CFG_SYSCALL_WRAPPERS_MCOUNT to
control the instrumentation of the system call wrapper functions
(utee_*) with -pg,

ftrace: allow tracing of syscall wrappers only

Introduces a new configuration flag: CFG_SYSCALL_WRAPPERS_MCOUNT to
control the instrumentation of the system call wrapper functions
(utee_*) with -pg, for function tracing and gprof.
The default value is taken from CFG_ULIBS_MCOUNT.
The main use case is to trace only the system calls in a TA:
CFG_TA_FTRACE_SUPPORT=y CFG_SYSCALL_WRAPPERS_MCOUNT=y

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

Do not let CFG_CRYPTO_SIZE_OPTIMIZATION set -Os

Compiler optimization flags -O0 or -Os are selected globally by the
config variable CFG_CC_OPTIMIZE_FOR_SIZE, but crypto code
(lib/libmbedtls and core

Do not let CFG_CRYPTO_SIZE_OPTIMIZATION set -Os

Compiler optimization flags -O0 or -Os are selected globally by the
config variable CFG_CC_OPTIMIZE_FOR_SIZE, but crypto code
(lib/libmbedtls and core/lib/libtomcrypt) is always built with -Os
when CFG_CRYPTO_SIZE_OPTIMIZATION=y. This is a bit inconvenient
when debugging crypto code because two flags have to be set, and it
is not obvious why CFG_CC_OPTIMIZE_FOR_SIZE would not influence crypto.

Since performance does not matter much when debugging, and -Os/-O0
does not make a huge difference anyway, it is wiser to keep the purpose
of the two CFG_ variables separated: CFG_CC_OPTIMIZE_FOR_SIZE should
control the -O flag for all sources, while CFG_CRYPTO_SIZE_OPTIMIZATION
should deal with other size-related settings in the crypto code
(namely: set -DLTC_SMALL_CODE for LibTomCrypt).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core, ldelf: add support for runtime loading of shared libraries

This commit prepares the introduction of libdl, a dynamic linking
library which will allow TAs to load shared libraries at run time,

core, ldelf: add support for runtime loading of shared libraries

This commit prepares the introduction of libdl, a dynamic linking
library which will allow TAs to load shared libraries at run time,
and resolve symbols on demand. It adds the following function to the
system PTA, inspired from the POSIX dlopen() and dlsym():

- system_dlopen(): takes a UUID and flags. Performs an upcall into
ldelf which then uses the usual system PTA functions to load an map the
requested library into the address space of the calling TA.
- system_dlsym(): takes a UUID and a symbol name. The symbol is
looked up in the library specified by UUID by calling into ldelf. If
UUID is all zeros, all the mapped binaries are searched.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee: add tee_uuid_from_str()

Moves internal function parse_uuid() from ldelf/ta_elf.c to libutee so
that it may be used by TAs or other user-space libraries such as the
upcoming libdl. The funct

libutee: add tee_uuid_from_str()

Moves internal function parse_uuid() from ldelf/ta_elf.c to libutee so
that it may be used by TAs or other user-space libraries such as the
upcoming libdl. The function is renamed to tee_uuid_from_str() and
declared in tee_internal_api_extensions.h.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Replace ASM with compiler-builtin __ASSEMBLER__

The C preprocessor predefines __ASSEMBLER__ with value 1 when when
preprocessing assembly language, see [1]. Instead of using a special
defines, let's

Replace ASM with compiler-builtin __ASSEMBLER__

The C preprocessor predefines __ASSEMBLER__ with value 1 when when
preprocessing assembly language, see [1]. Instead of using a special
defines, let's use the define already provided.

Link: [1] https://gcc.gnu.org/onlinedocs/cpp/Standard-Predefined-Macros.html

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: enable trace for utee_* assembly APIs

Enable function trace for utee_* syscall assembly APIs for better view
of user-space to kernel switching.

Suggested-by: Jerome Forissier <jerome.foriss

ftrace: enable trace for utee_* assembly APIs

Enable function trace for utee_* syscall assembly APIs for better view
of user-space to kernel switching.

Suggested-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

ftrace: Add function execution time support

Add support to dump function execution time at corresponding function
exit points in output ftrace buffer.

To achieve proper function execution time we n

ftrace: Add function execution time support

Add support to dump function execution time at corresponding function
exit points in output ftrace buffer.

To achieve proper function execution time we need to exclude TA suspend
time from timestamps, so add corresponding support in TEE core.

Also user mapping must be active to access ftrace buffer, so do that
during TA resume.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: add headers for user-space to access sysregs

User space may require to access system registers like generic timer
registers in case function tracing is enabled etc. So provide headers
for u

libutee: add headers for user-space to access sysregs

User space may require to access system registers like generic timer
registers in case function tracing is enabled etc. So provide headers
for user space to access sysregs.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove unnecessary __aeabi functions

Some of the aeabi functions provided are undocumented and are not called
from anywhere. This patch removes them entirely.

Reviewed-by: Jens Wiklander <jens.wikl

Remove unnecessary __aeabi functions

Some of the aeabi functions provided are undocumented and are not called
from anywhere. This patch removes them entirely.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>

show more ...

libutils: import bcmp() from newlib

Recent versions of Clang (later than 8.0.0) may replace calls to
memcmp() by bcmp(). Therefore, provide an implementation of this
function to avoid unresolved sym

libutils: import bcmp() from newlib

Recent versions of Clang (later than 8.0.0) may replace calls to
memcmp() by bcmp(). Therefore, provide an implementation of this
function to avoid unresolved symbol errors.
The same issue was fixed in a similar way in the Linux kernel [1].

Link: [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f074f3e192f10c9fade898b9b3b8812e3d83342
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Force alignment of assembler functions (FUNC and LOCAL_FUNC) to 4 bytes

The Clang assembler will not align all the functions containing arm32
code (as opposed to thumb) on 4-byte boundaries, contrar

Force alignment of assembler functions (FUNC and LOCAL_FUNC) to 4 bytes

The Clang assembler will not align all the functions containing arm32
code (as opposed to thumb) on 4-byte boundaries, contrary to GCC. For
example, with the current code, the syscall wrappers in libutee are
like so:

# GCC 8.2.1
$ arm-linux-gnueabihf-objdump -x utee_syscalls_a32.o | \
grep '\.text\.utee_.*\*\*' | head -3
3 .text.utee_panic 00000014 00000000 00000000 00000034 2**2
6 .text.utee_return 00000014 00000000 00000000 0000005c 2**2
9 .text.utee_log 00000014 00000000 00000000 00000078 2**2

# Clang 8.0.0
$ arm-linux-gnueabihf-objdump -x utee_syscalls_a32.o | \
grep '\.text\.utee_.*\*\*' | head -3
1 .text.utee_panic 00000014 00000000 00000000 00000034 2**0
4 .text.utee_return 00000014 00000000 00000000 0000005c 2**0
6 .text.utee_log 00000014 00000000 00000000 00000078 2**0

The bad alignment constraint can cause run time exceptions. Add a
".balign 4" to FUNC and LOCAL_FUNC to fix that.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove deprecated ldm/stm instructions

Some uses of SP, PC and LR in the register list of Load/Store Multiple
instructions is forbidden (Thumb) or deprecated (ARM) as per the ARM
ARM DDI 0406 C.d. F

Remove deprecated ldm/stm instructions

Some uses of SP, PC and LR in the register list of Load/Store Multiple
instructions is forbidden (Thumb) or deprecated (ARM) as per the ARM
ARM DDI 0406 C.d. For the LDM instructions, SP should not be in the
list, and the list should not contain both PC and LR. See sections:

[A8.8.58] LDM/LDMIA/LDMFD (Thumb)
[A8.8.59] LDM/LDMIA/LDMFD (ARM)
[A8.8.60] LDMDA/LDMFA
[A8.8.61] LDMDB/LDMEA
[A8.8.62] LDMIB/LDMED

For the STM instructions, neither SP nor PC should be in the list. See
sections:

[A8.8.200] STM (STMIA, STMEA)
[A8.8.201] STMDA (STMED)
[A8.8.202] STMDB (STMFD)
[A8.8.203] STMIB (STMFA)

Clang warns on the deprecated constructs. Use ldr/str instead.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: ctype.h: do not define functions as builtins

Our <ctype.h> defines a number of functions as macros that evaluate to
the builtin function of the same name, for instance:

#define isalpha(_

libutils: ctype.h: do not define functions as builtins

Our <ctype.h> defines a number of functions as macros that evaluate to
the builtin function of the same name, for instance:

#define isalpha(__c) __builtin_isalpha(__c)

There are two problems with this:

1. It gets in the way of the application developer and makes some
compiler flags irrelevant (-fno-builtin*, [1]).
2. Different compilers do not support the same set of builtin functions
so having the defines can result in build errors.

Therefore, user regular prototypes in <ctype.h>. Also build libutils
without the -ffreestanding flag because it implies -fno-builtin and
therefore may needlessly disable optimizations. The libutils
environment cannot be considered "free standing" since it implements
the standard header files with the expected semantics.

Our implementations of the <ctypes.h> functions (isalnum(), isalpha(),
etc.) are defined with the __builtin_ prefix. This is not needed and
is arguably wrong. Indeed, we want the functions in libutils to be
present without the prefix, which GCC happens to be doing regardless.
However, this __builtin_ prefix in the .c files makes things more
complicated to support Clang. Therefore, remove it.

Link: [1] https://gcc.gnu.org/onlinedocs/gcc/C-Dialect-Options.html (-fno-builtin)
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils/newlib: sort sub.mk in alphabetical order

Sort "src-y" lines by alphabetical order.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@l

libutils/newlib: sort sub.mk in alphabetical order

Sort "src-y" lines by alphabetical order.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: asm.S: remove .func/.endfunc directives

The .func and .endfunc directives are ignored unless the file is
compiled with debugging enabled and --gstabs. Since we do not use
this debugging fo

libutils: asm.S: remove .func/.endfunc directives

The .func and .endfunc directives are ignored unless the file is
compiled with debugging enabled and --gstabs. Since we do not use
this debugging format, .func and .endfunc are effectively no-ops.

The Clang compiler does not recognize these directives. Therefore,
in preparation for Clang support, remove them.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: Enable support for 32 bit apps

By default 32 bit trusted applications are compiled in thumb mode but
thumb mode doesn't support function graph tracing due to missing frame
pointer support re

ftrace: Enable support for 32 bit apps

By default 32 bit trusted applications are compiled in thumb mode but
thumb mode doesn't support function graph tracing due to missing frame
pointer support required to trace function call chain. So rather compile
trusted applications in ARM mode in case function tracing is enabled.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutils: add trace_vprintf()

Adds the trace_vprintf() helper function.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: pta_system: support memory remap

Adds PTA_SYSTEM_REMAP to support changing virtual address of an already
established mapping in a TA.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.or

core: pta_system: support memory remap

Adds PTA_SYSTEM_REMAP to support changing virtual address of an already
established mapping in a TA.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...