ftrace: core: prepare support for syscall ftrace

Enable compilation of ftrace library code for TEE core.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@fori

ftrace: core: prepare support for syscall ftrace

Enable compilation of ftrace library code for TEE core.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ftrace: move ftrace code from libutee to libutils

Since TEE core and TA can share most of ftrace library code, so move
ftrace code from libutee to libutils library which is shared among TEE
core and

ftrace: move ftrace code from libutee to libutils

Since TEE core and TA can share most of ftrace library code, so move
ftrace code from libutee to libutils library which is shared among TEE
core and TA.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

Experimental Clang support

Allows building with Clang with "make COMPILER=clang [other flags...]".
The clang command has to be in the $PATH, as well as the associated
tools (clang-cpp, ld.lld, llvm-

Experimental Clang support

Allows building with Clang with "make COMPILER=clang [other flags...]".
The clang command has to be in the $PATH, as well as the associated
tools (clang-cpp, ld.lld, llvm-ar, llvm-nm, llvm-objcopy and
llvm-readelf).

Tested with Clang built from the master branch of [1] (development
version for 9.0):

mkdir build; cd build
cmake -G Ninja -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=~/llvm-install \
-DLLVM_ENABLE_PROJECTS="clang;lld" \
-DLLVM_TARGETS_TO_BUILD="AArch64;ARM" \
~/llvm-project/llvm
ninja && ninja install

Limitations:

- CFG_CORE_SANITIZE_KADDRESS=y is not supported.
- CFG_WITH_PAGER is supported, but requires that the TEE core be
linked with the GNU linker. The reason is documented in
mk/clang.mk.

Bug:

- ldelf assertion failure in xtest 1019 when CFG_ULIBS_SHARED=y (QEMU)
E/LD: assertion 'maps[map_idx].sz == sz' failed at ldelf/ta_elf.c:1114 in ta_elf_print_mappings()
Prevents ldelf from displaying the TA mappings on abort or panic, but
does not seem to cause any other problem.

Link: [1] https://github.com/llvm/llvm-project/commits/8351c327647
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU pager/no pager)
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMUv8, pager/no pager)
Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960, 32/64, GP)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: relax noreturn label

Replaces attribute label identifier noreturn with __noreturn__ to
prevent conflicts when importing code which defines label noreturn
itself as a macro. This change app

libutils: relax noreturn label

Replaces attribute label identifier noreturn with __noreturn__ to
prevent conflicts when importing code which defines label noreturn
itself as a macro. This change applies suggestion from the GCC
documentation [1], applicable even prio GCC 4.x.x, cited below.

> You may optionally specify attribute names with ‘__’ preceding
> and following the name. This allows you to use them in header
> files without being concerned about a possible macro of the same
> name. For example, you may use the attribute name __noreturn__
> instead of noreturn.

Link: [1] https://gcc.gnu.org/onlinedocs/gcc-8.3.0/gcc/Attribute-Syntax.html#Attribute-Syntax
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee,libdl: remove 0ms timeouts in TA invocations

TEE_OpenTASession(), TEE_InvokeTACommand() calls using 0ms timeout
are replaced with TEE_INFINITE_TIMEOUT to avoid risk of being cancelled.

Sign

libutee,libdl: remove 0ms timeouts in TA invocations

TEE_OpenTASession(), TEE_InvokeTACommand() calls using 0ms timeout
are replaced with TEE_INFINITE_TIMEOUT to avoid risk of being cancelled.

Signed-off-by: Cedric Auger <cauger@provenrun.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee: panic on null pointer on object opening

Change TEE_CreatePersistentObject() and TEE_OpenPersistentObject()
to panic when passed an null reference pointer.

According to the TEE Internal Cor

libutee: panic on null pointer on object opening

Change TEE_CreatePersistentObject() and TEE_OpenPersistentObject()
to panic when passed an null reference pointer.

According to the TEE Internal Core API Specification 1.1 and 1.2,
sections 5.7.1 and 5.7.2, passing NULL for object pointer should panic,
and not return an error.

Some harmonization has also been done in these two functions to use
the same conventions as surrounding code.

Signed-off-by: Cedric Auger <cauger@provenrun.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workar

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workaround. I tried 4.9, 6.2,
8.2, and 8.3 from various sources (Linaro or Ubuntu). If
__SECTION_FLAGS_RODATA is empty, this warning is always present:

CC out/arm-plat-vexpress/core/mm/fobj.o
{standard input}: Assembler messages:
{standard input}:402: Warning: setting incorrect section attributes for .rodata.__unpaged

The generated assembler file contains the "aw" flags:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"aw",%progbits

By reverting the above commit, we have:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"a",%progbits //,"aw",%progbits

...and the assembler does not warn anymore.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should d

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should depend on __GCC_VERSION. This prepares for Clang.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

util.h: add the macro ROUNDUP_OVERFLOW()

Adds the macro ROUNDUP_OVERFLOW() which rounds up like ROUNDUP() but also
checks the result for overflow and returns true on overflow.

Reviewed-by: Etienne

util.h: add the macro ROUNDUP_OVERFLOW()

Adds the macro ROUNDUP_OVERFLOW() which rounds up like ROUNDUP() but also
checks the result for overflow and returns true on overflow.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: bget_malloc.c: copy statistics using memcpy_unckecked()

When CFG_CORE_SANITIZE_KADDRESS=y, most OP-TEE files are built with
address sanitizer flags except bget_malloc.c. As a result, the m

libutils: bget_malloc.c: copy statistics using memcpy_unckecked()

When CFG_CORE_SANITIZE_KADDRESS=y, most OP-TEE files are built with
address sanitizer flags except bget_malloc.c. As a result, the memcpy()
function in memcpy.c is instrumented, whereas the malloc context
structure (malloc_ctx) in bget_malloc.c is not. This causes the
following panic:

$ xtest --stats --alloc

E/TC:0 0 Panic at core/kernel/asan.c:189 <check_access>
E/TC:0 0 Call stack:
E/TC:0 0 0x0e125c3d print_kernel_stack at optee_os/core/arch/arm/kernel/unwind_arm32.c:450
E/TC:0 0 0x0e13fcfb __do_panic at optee_os/core/kernel/panic.c:32 (discriminator 1)
E/TC:0 0 0x0e13e099 check_access at optee_os/core/kernel/asan.c:187 (discriminator 2)
E/TC:0 0 0x0e13e10f check_load at optee_os/core/kernel/asan.c:199
E/TC:0 0 0x0e13e187 __asan_load4_noabort at optee_os/core/kernel/asan.c:231
E/TC:0 0 0x0e185d15 memcpy at optee_os/lib/libutils/isoc/newlib/memcpy.c:112
E/TC:0 0 0x0e184a3f gen_malloc_get_stats at optee_os/lib/libutils/isoc/bget_malloc.c:234
[...]

Introduce memcpy_unchecked() (which evaluates to asan_memcpy_unchecked()
when ASAN is enabled and memcpy() otherwise) to fix the issue.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: don't use __bss and __data attributes

Manual placement in .data or .bss section breaks GCC Address
Sanitizer, because it refuses to track variables, that are stored in
user sections. Even if t

core: don't use __bss and __data attributes

Manual placement in .data or .bss section breaks GCC Address
Sanitizer, because it refuses to track variables, that are stored in
user sections. Even if those sections are actually not user-defined,
but generic .bss and .data.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960, ASAN)
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, GP, ASAN)

show more ...

ftrace: allow display of larger durations

Currently the ftrace buffer shows durations in microseconds and modulo
1000000 us. It is problematic if values larger than one second are
measured.

This pa

ftrace: allow display of larger durations

Currently the ftrace buffer shows durations in microseconds and modulo
1000000 us. It is problematic if values larger than one second are
measured.

This patch makes sure that no invalid value is ever displayed when an
overflow occurs. Instead, the trace will contain dashes, such as
"--------- us".

In addition, the unit is changed from microseconds (us) to milliseconds
(ms) when the duration exceeds a predefined value set by CFG_FTRACE_US_MS
(default: 10000 us).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

ftrace: allow tracing of syscall wrappers only

Introduces a new configuration flag: CFG_SYSCALL_WRAPPERS_MCOUNT to
control the instrumentation of the system call wrapper functions
(utee_*) with -pg,

ftrace: allow tracing of syscall wrappers only

Introduces a new configuration flag: CFG_SYSCALL_WRAPPERS_MCOUNT to
control the instrumentation of the system call wrapper functions
(utee_*) with -pg, for function tracing and gprof.
The default value is taken from CFG_ULIBS_MCOUNT.
The main use case is to trace only the system calls in a TA:
CFG_TA_FTRACE_SUPPORT=y CFG_SYSCALL_WRAPPERS_MCOUNT=y

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

Do not let CFG_CRYPTO_SIZE_OPTIMIZATION set -Os

Compiler optimization flags -O0 or -Os are selected globally by the
config variable CFG_CC_OPTIMIZE_FOR_SIZE, but crypto code
(lib/libmbedtls and core

Do not let CFG_CRYPTO_SIZE_OPTIMIZATION set -Os

Compiler optimization flags -O0 or -Os are selected globally by the
config variable CFG_CC_OPTIMIZE_FOR_SIZE, but crypto code
(lib/libmbedtls and core/lib/libtomcrypt) is always built with -Os
when CFG_CRYPTO_SIZE_OPTIMIZATION=y. This is a bit inconvenient
when debugging crypto code because two flags have to be set, and it
is not obvious why CFG_CC_OPTIMIZE_FOR_SIZE would not influence crypto.

Since performance does not matter much when debugging, and -Os/-O0
does not make a huge difference anyway, it is wiser to keep the purpose
of the two CFG_ variables separated: CFG_CC_OPTIMIZE_FOR_SIZE should
control the -O flag for all sources, while CFG_CRYPTO_SIZE_OPTIMIZATION
should deal with other size-related settings in the crypto code
(namely: set -DLTC_SMALL_CODE for LibTomCrypt).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Add libdl for TAs

Adds basic support for dlopen(), dlsym() and dlclose(). The flags passed
to dlopen() must be (RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE); other
values are not supported at the moment.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core, ldelf: add support for runtime loading of shared libraries

This commit prepares the introduction of libdl, a dynamic linking
library which will allow TAs to load shared libraries at run time,

core, ldelf: add support for runtime loading of shared libraries

This commit prepares the introduction of libdl, a dynamic linking
library which will allow TAs to load shared libraries at run time,
and resolve symbols on demand. It adds the following function to the
system PTA, inspired from the POSIX dlopen() and dlsym():

- system_dlopen(): takes a UUID and flags. Performs an upcall into
ldelf which then uses the usual system PTA functions to load an map the
requested library into the address space of the calling TA.
- system_dlsym(): takes a UUID and a symbol name. The symbol is
looked up in the library specified by UUID by calling into ldelf. If
UUID is all zeros, all the mapped binaries are searched.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

libutee: add tee_uuid_from_str()

Moves internal function parse_uuid() from ldelf/ta_elf.c to libutee so
that it may be used by TAs or other user-space libraries such as the
upcoming libdl. The funct

libutee: add tee_uuid_from_str()

Moves internal function parse_uuid() from ldelf/ta_elf.c to libutee so
that it may be used by TAs or other user-space libraries such as the
upcoming libdl. The function is renamed to tee_uuid_from_str() and
declared in tee_internal_api_extensions.h.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Replace ASM with compiler-builtin __ASSEMBLER__

The C preprocessor predefines __ASSEMBLER__ with value 1 when when
preprocessing assembly language, see [1]. Instead of using a special
defines, let's

Replace ASM with compiler-builtin __ASSEMBLER__

The C preprocessor predefines __ASSEMBLER__ with value 1 when when
preprocessing assembly language, see [1]. Instead of using a special
defines, let's use the define already provided.

Link: [1] https://gcc.gnu.org/onlinedocs/cpp/Standard-Predefined-Macros.html

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: enable trace for utee_* assembly APIs

Enable function trace for utee_* syscall assembly APIs for better view
of user-space to kernel switching.

Suggested-by: Jerome Forissier <jerome.foriss

ftrace: enable trace for utee_* assembly APIs

Enable function trace for utee_* syscall assembly APIs for better view
of user-space to kernel switching.

Suggested-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

ftrace: Add function execution time support

Add support to dump function execution time at corresponding function
exit points in output ftrace buffer.

To achieve proper function execution time we n

ftrace: Add function execution time support

Add support to dump function execution time at corresponding function
exit points in output ftrace buffer.

To achieve proper function execution time we need to exclude TA suspend
time from timestamps, so add corresponding support in TEE core.

Also user mapping must be active to access ftrace buffer, so do that
during TA resume.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: add headers for user-space to access sysregs

User space may require to access system registers like generic timer
registers in case function tracing is enabled etc. So provide headers
for u

libutee: add headers for user-space to access sysregs

User space may require to access system registers like generic timer
registers in case function tracing is enabled etc. So provide headers
for user space to access sysregs.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove unnecessary __aeabi functions

Some of the aeabi functions provided are undocumented and are not called
from anywhere. This patch removes them entirely.

Reviewed-by: Jens Wiklander <jens.wikl

Remove unnecessary __aeabi functions

Some of the aeabi functions provided are undocumented and are not called
from anywhere. This patch removes them entirely.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>

show more ...

libutils: import bcmp() from newlib

Recent versions of Clang (later than 8.0.0) may replace calls to
memcmp() by bcmp(). Therefore, provide an implementation of this
function to avoid unresolved sym

libutils: import bcmp() from newlib

Recent versions of Clang (later than 8.0.0) may replace calls to
memcmp() by bcmp(). Therefore, provide an implementation of this
function to avoid unresolved symbol errors.
The same issue was fixed in a similar way in the Linux kernel [1].

Link: [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f074f3e192f10c9fade898b9b3b8812e3d83342
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Force alignment of assembler functions (FUNC and LOCAL_FUNC) to 4 bytes

The Clang assembler will not align all the functions containing arm32
code (as opposed to thumb) on 4-byte boundaries, contrar

Force alignment of assembler functions (FUNC and LOCAL_FUNC) to 4 bytes

The Clang assembler will not align all the functions containing arm32
code (as opposed to thumb) on 4-byte boundaries, contrary to GCC. For
example, with the current code, the syscall wrappers in libutee are
like so:

# GCC 8.2.1
$ arm-linux-gnueabihf-objdump -x utee_syscalls_a32.o | \
grep '\.text\.utee_.*\*\*' | head -3
3 .text.utee_panic 00000014 00000000 00000000 00000034 2**2
6 .text.utee_return 00000014 00000000 00000000 0000005c 2**2
9 .text.utee_log 00000014 00000000 00000000 00000078 2**2

# Clang 8.0.0
$ arm-linux-gnueabihf-objdump -x utee_syscalls_a32.o | \
grep '\.text\.utee_.*\*\*' | head -3
1 .text.utee_panic 00000014 00000000 00000000 00000034 2**0
4 .text.utee_return 00000014 00000000 00000000 0000005c 2**0
6 .text.utee_log 00000014 00000000 00000000 00000078 2**0

The bad alignment constraint can cause run time exceptions. Add a
".balign 4" to FUNC and LOCAL_FUNC to fix that.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove deprecated ldm/stm instructions

Some uses of SP, PC and LR in the register list of Load/Store Multiple
instructions is forbidden (Thumb) or deprecated (ARM) as per the ARM
ARM DDI 0406 C.d. F

Remove deprecated ldm/stm instructions

Some uses of SP, PC and LR in the register list of Load/Store Multiple
instructions is forbidden (Thumb) or deprecated (ARM) as per the ARM
ARM DDI 0406 C.d. For the LDM instructions, SP should not be in the
list, and the list should not contain both PC and LR. See sections:

[A8.8.58] LDM/LDMIA/LDMFD (Thumb)
[A8.8.59] LDM/LDMIA/LDMFD (ARM)
[A8.8.60] LDMDA/LDMFA
[A8.8.61] LDMDB/LDMEA
[A8.8.62] LDMIB/LDMED

For the STM instructions, neither SP nor PC should be in the list. See
sections:

[A8.8.200] STM (STMIA, STMEA)
[A8.8.201] STMDA (STMED)
[A8.8.202] STMDB (STMFD)
[A8.8.203] STMIB (STMFA)

Clang warns on the deprecated constructs. Use ldr/str instead.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...