ta_bin_to_c.py: mark as python3 script

This commit marks the script as a python3 script and update
hex string conversion accordingly.

Moving to python3 requires a change in hex string conversion.
I

ta_bin_to_c.py: mark as python3 script

This commit marks the script as a python3 script and update
hex string conversion accordingly.

Moving to python3 requires a change in hex string conversion.
It causes by `zlib.compress()` behaving differently in python2
and python3. It returns a string in python2, and it returns
a bytes object in python3.

With python3 `zlib.compress()` behavior, we can use hex() to
convert bytes[i] of type int into a hex string.

Signed-off-by: Pipat Methavanitpong <pipat.methavanitpong@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>

show more ...

ldelf: accurate non-legacy TA check

Prior to this patch ldelf relied on e_entry in the ELF header to point
anywhere but at the lowest possible executable address to tell that it's
not a legacy TA. T

ldelf: accurate non-legacy TA check

Prior to this patch ldelf relied on e_entry in the ELF header to point
anywhere but at the lowest possible executable address to tell that it's
not a legacy TA. This isn't enough since all TAs can use this entry
address depending on compiler and linker. The only reliable indicator
that the TA is not a legacy TA is that the depr_entry field of the TA
header is UINT64_MAX. Unfortunately this means assuming that the ELF is
not a legacy TA at load time and that the process needs to be restarted
in case it turns out that it was a legacy TA.

With this patch we have reliable detection of non-legacy TAs, but with
increased load time for legacy TAs since the main ELF needs to be loaded
and verified twice due to the TA store interface.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: mmu: Update TCR_EL1 register when new physical address added

Suppose in init stage all physical memory registered is in 0-4G,
the IPS bits (bit34-32) is set 0. Later a physical address 0x10000

core: mmu: Update TCR_EL1 register when new physical address added

Suppose in init stage all physical memory registered is in 0-4G,
the IPS bits (bit34-32) is set 0. Later a physical address 0x100000000
is dynamically mapping with core_mmu_add_mapping, since 0x100000000
is higher than 4G, the IPS bits of TCR_EL1 register should be updated
to 0x1. Otherwise the below panic occurs:

E/TC:00 check_pa_matches_va:1805 va 0x82a00000 maps 0x100000000, expect 0x0

As currently TCR_EL1 register is only set in init stage, this patch
also updates the register in core_mmu_add_mapping.

Signed-off-by: Fangsuo Wu <fangsuowu@asrmicro.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_ree_fs: create dirfile only when it's not found

Currently there's no check of return value of tee_fs_dirfile_open,
it's reasonable to do this when dir file truely doesn't exist.
However, if tee_

tee_ree_fs: create dirfile only when it's not found

Currently there's no check of return value of tee_fs_dirfile_open,
it's reasonable to do this when dir file truely doesn't exist.
However, if tee_fs_dirfile_open fails with other reason, calling
tee_fs_dirfile_open(true..) will overlap the old dir file, thus
file access in the future will fail.

Signed-off-by: Fangsuo Wu <fangsuowu@asrmicro.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove useless .section directives

A few assembler files contain ".section .text.<something>" but these
sections do not appear to be used anywhere. In addition, the functions
defined in the fi

core: remove useless .section directives

A few assembler files contain ".section .text.<something>" but these
sections do not appear to be used anywhere. In addition, the functions
defined in the files are always put in their own section anyway,
(.text.<function_name>), because of the -ffunction-sections flag.
Therefore, let's remove the useless directives.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: import bcmp() from newlib

Recent versions of Clang (later than 8.0.0) may replace calls to
memcmp() by bcmp(). Therefore, provide an implementation of this
function to avoid unresolved sym

libutils: import bcmp() from newlib

Recent versions of Clang (later than 8.0.0) may replace calls to
memcmp() by bcmp(). Therefore, provide an implementation of this
function to avoid unresolved symbol errors.
The same issue was fixed in a similar way in the Linux kernel [1].

Link: [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f074f3e192f10c9fade898b9b3b8812e3d83342
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive

arm32: make __ta_entry() an assembler wrapper

Clang errors out when asm(".cantunwind") is used in a C function:

user_ta_header.c:44:6: error: .fnstart must precede .cantunwind directive
asm(".cantunwind");
^
Fix this by turning __ta_entry() into an assembler wrapper.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm64: update register accessor macros to support Clang

Clang complains about ASM operand width:

core/arch/arm/include/arm64.h:295:1: warning: value size does not match register size specifi

core: arm64: update register accessor macros to support Clang

Clang complains about ASM operand width:

core/arch/arm/include/arm64.h:295:1: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths]
DEFINE_U32_REG_READWRITE_FUNCS(cpacr_el1)
^
core/arch/arm/include/arm64.h:278:3: note: expanded from macro 'DEFINE_U32_REG_READWRITE_FUNCS'
DEFINE_U32_REG_READ_FUNC(reg) \
^
core/arch/arm/include/arm64.h:272:3: note: expanded from macro 'DEFINE_U32_REG_READ_FUNC'
DEFINE_REG_READ_FUNC_(reg, uint32_t, reg)
^
core/arch/arm/include/arm64.h:261:42: note: expanded from macro 'DEFINE_REG_READ_FUNC_'
asm volatile("mrs %0, " #asmreg : "=r" (val)); \
^
core/arch/arm/include/arm64.h:295:1: note: use constraint modifier "w"
core/arch/arm/include/arm64.h:278:3: note: expanded from macro 'DEFINE_U32_REG_READWRITE_FUNCS'
DEFINE_U32_REG_READ_FUNC(reg) \
^
core/arch/arm/include/arm64.h:272:3: note: expanded from macro 'DEFINE_U32_REG_READ_FUNC'
DEFINE_REG_READ_FUNC_(reg, uint32_t, reg)
^
core/arch/arm/include/arm64.h:261:20: note: expanded from macro 'DEFINE_REG_READ_FUNC_'
asm volatile("mrs %0, " #asmreg : "=r" (val)); \
^

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Force alignment of assembler functions (FUNC and LOCAL_FUNC) to 4 bytes

The Clang assembler will not align all the functions containing arm32
code (as opposed to thumb) on 4-byte boundaries, contrar

Force alignment of assembler functions (FUNC and LOCAL_FUNC) to 4 bytes

The Clang assembler will not align all the functions containing arm32
code (as opposed to thumb) on 4-byte boundaries, contrary to GCC. For
example, with the current code, the syscall wrappers in libutee are
like so:

# GCC 8.2.1
$ arm-linux-gnueabihf-objdump -x utee_syscalls_a32.o | \
grep '\.text\.utee_.*\*\*' | head -3
3 .text.utee_panic 00000014 00000000 00000000 00000034 2**2
6 .text.utee_return 00000014 00000000 00000000 0000005c 2**2
9 .text.utee_log 00000014 00000000 00000000 00000078 2**2

# Clang 8.0.0
$ arm-linux-gnueabihf-objdump -x utee_syscalls_a32.o | \
grep '\.text\.utee_.*\*\*' | head -3
1 .text.utee_panic 00000014 00000000 00000000 00000034 2**0
4 .text.utee_return 00000014 00000000 00000000 0000005c 2**0
6 .text.utee_log 00000014 00000000 00000000 00000078 2**0

The bad alignment constraint can cause run time exceptions. Add a
".balign 4" to FUNC and LOCAL_FUNC to fix that.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Move .weak directive after the symbol definition

Clang ignores the .weak directive if it appears before the symbol is
defined. Fix the few places where it happens.

Signed-off-by: Jerome Forissier <

Move .weak directive after the symbol definition

Clang ignores the .weak directive if it appears before the symbol is
defined. Fix the few places where it happens.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove deprecated ldm/stm instructions

Some uses of SP, PC and LR in the register list of Load/Store Multiple
instructions is forbidden (Thumb) or deprecated (ARM) as per the ARM
ARM DDI 0406 C.d. F

Remove deprecated ldm/stm instructions

Some uses of SP, PC and LR in the register list of Load/Store Multiple
instructions is forbidden (Thumb) or deprecated (ARM) as per the ARM
ARM DDI 0406 C.d. For the LDM instructions, SP should not be in the
list, and the list should not contain both PC and LR. See sections:

[A8.8.58] LDM/LDMIA/LDMFD (Thumb)
[A8.8.59] LDM/LDMIA/LDMFD (ARM)
[A8.8.60] LDMDA/LDMFA
[A8.8.61] LDMDB/LDMEA
[A8.8.62] LDMIB/LDMED

For the STM instructions, neither SP nor PC should be in the list. See
sections:

[A8.8.200] STM (STMIA, STMEA)
[A8.8.201] STMDA (STMED)
[A8.8.202] STMDB (STMFD)
[A8.8.203] STMIB (STMFA)

Clang warns on the deprecated constructs. Use ldr/str instead.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: ctype.h: do not define functions as builtins

Our <ctype.h> defines a number of functions as macros that evaluate to
the builtin function of the same name, for instance:

#define isalpha(_

libutils: ctype.h: do not define functions as builtins

Our <ctype.h> defines a number of functions as macros that evaluate to
the builtin function of the same name, for instance:

#define isalpha(__c) __builtin_isalpha(__c)

There are two problems with this:

1. It gets in the way of the application developer and makes some
compiler flags irrelevant (-fno-builtin*, [1]).
2. Different compilers do not support the same set of builtin functions
so having the defines can result in build errors.

Therefore, user regular prototypes in <ctype.h>. Also build libutils
without the -ffreestanding flag because it implies -fno-builtin and
therefore may needlessly disable optimizations. The libutils
environment cannot be considered "free standing" since it implements
the standard header files with the expected semantics.

Our implementations of the <ctypes.h> functions (isalnum(), isalpha(),
etc.) are defined with the __builtin_ prefix. This is not needed and
is arguably wrong. Indeed, we want the functions in libutils to be
present without the prefix, which GCC happens to be doing regardless.
However, this __builtin_ prefix in the .c files makes things more
complicated to support Clang. Therefore, remove it.

Link: [1] https://gcc.gnu.org/onlinedocs/gcc/C-Dialect-Options.html (-fno-builtin)
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core_mmu: fix "outside of array bounds" warning

Newest versions of GCC (v9.1.0 at least) are unhappy about subtraction
from array pointer:

core/arch/arm/mm/core_mmu.c: In function 'core_init_mmu_ma

core_mmu: fix "outside of array bounds" warning

Newest versions of GCC (v9.1.0 at least) are unhappy about subtraction
from array pointer:

core/arch/arm/mm/core_mmu.c: In function 'core_init_mmu_map':
core/arch/arm/mm/core_mmu.c:523:30: warning: array subscript -1 is outside array bounds of 'const struct core_mmu_phys_mem[]' [-Warray-bounds]
523 | for (mem = start; mem < end - 1; mem++) {
| ~~~~^~~
In file included from core/include/initcall.h:9,
from core/arch/arm/include/kernel/generic_boot.h:8,
from core/arch/arm/mm/core_mmu.c:11:
core/include/scattered_array.h:100:29: note: while referencing '__scattered_array_end'
100 | static const element_type __scattered_array_end[0] __unused \
| ^~~~~~~~~~~~~~~~~~~~~

This is valid warning, as such pointer arithmetic produces undefined
behavior according to paragraph 5.6.5.8 of C99 standard. On other hand
the standard allows pointers that point past the last element of
array, so expression "mem + 1" is valid.

Suggested-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

ldelf: fix warning in ftrace_init()

Fixes warning in ftrace_init():

ldelf/ftrace.c: In function ‘ftrace_init’:
ldelf/ftrace.c:47:9: warning: cast to pointer from integer of different size [-Wint-to

ldelf: fix warning in ftrace_init()

Fixes warning in ftrace_init():

ldelf/ftrace.c: In function ‘ftrace_init’:
ldelf/ftrace.c:47:9: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
fbuf = (struct ftrace_buf *)finfo->buf_start.ptr64;
^
Fixes: c96d7091b566 ("ftrace: Enable support for 32 bit apps")
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils/newlib: sort sub.mk in alphabetical order

Sort "src-y" lines by alphabetical order.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@l

libutils/newlib: sort sub.mk in alphabetical order

Sort "src-y" lines by alphabetical order.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: scripts/gen_ldelf_hex.py: allow multiple RW load segments

Allow multiple read/write load segments as long as they are contiguous.
This is to support Clang > 8.0.0 which generates this:

Prog

ldelf: scripts/gen_ldelf_hex.py: allow multiple RW load segments

Allow multiple read/write load segments as long as they are contiguous.
This is to support Clang > 8.0.0 which generates this:

Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x001000 0x00000000 0x00000000 0x0a50c 0x0a50c R E 0x1000
LOAD 0x00c000 0x0000b000 0x0000b000 0x0006c 0x0006c RW 0x1000
LOAD 0x00c06c 0x0000b06c 0x0000b06c 0x0006c 0x0007c RW 0x1000
DYNAMIC 0x00c000 0x0000b000 0x0000b000 0x00060 0x00060 RW 0x4
GNU_RELRO 0x00c000 0x0000b000 0x0000b000 0x0006c 0x01000 R 0x1
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0
EXIDX 0x00b134 0x0000a134 0x0000a134 0x00258 0x00258 R 0x4

Section to Segment mapping:
Segment Sections...
00 .text .rodata .ARM.exidx .gnu.hash .ARM.extab .dynsym .dynstr .hash .rel.dyn
01 .dynamic .got
02 .data .bss
03 .dynamic
04 .dynamic .got .bss
05
06 .ARM.exidx

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ldelf.ld.S: move .dynamic section next to .got

Updates the ldelf linker script in the same way the TA linker script
was updated in commit "ta: arm: ta.ld.S: move .dynamic section next to
.got".

ta: ldelf.ld.S: move .dynamic section next to .got

Updates the ldelf linker script in the same way the TA linker script
was updated in commit "ta: arm: ta.ld.S: move .dynamic section next to
.got".

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ta.ld.S: move .dynamic section next to .got

Changes the TA linker script so that the .dynamic section is adjacent
to the .got section. This prepares for using the Clang compiler (more
precisely:

ta: ta.ld.S: move .dynamic section next to .got

Changes the TA linker script so that the .dynamic section is adjacent
to the .got section. This prepares for using the Clang compiler (more
precisely: the LLVM linker, ld.lld).

Contrary to GCC, Clang enables the "RELRO" feature (RELocations Read-
Only) by default. In a nutshell: RELRO causes the linker to emit an
additional segment called RELRO, which tells the program loader that
a part of the binary may be turned to read-only mode once the
relocations are done. The goal is to increase protection against
arbitrary code execution attacks. The sections that are concerned are
.got and .dynamic, among others. Since there is only one RELRO segment,
the sections that are supposed to be covered have to be contiguous. If
they are not (which is currently the case in ta.ld.S), ld.lld shows an
error:

ld.lld: error: section: .dynamic is not contiguous with other relro sections

Therefore, move .dynamic next to .got so that all the RELRO-eligible
sections are contiguous.

Note: another option to fix this issue is to pass '-z norelro' to the
linker, but that would obviously prevent future support of RELRO in the
TA loader.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core_self_tests.c: build with -fno-builtin

The memory tests in core_self_tests.c call the malloc()/calloc() API
without doing anything meaningful with the output. It turns out that a
clever compiler

core_self_tests.c: build with -fno-builtin

The memory tests in core_self_tests.c call the malloc()/calloc() API
without doing anything meaningful with the output. It turns out that a
clever compiler (read: Clang) will detect this and aggressively
optimize the code, to the point that a call to calloc() is removed
entirely. Here is a reduced test case for the record:

$ cat test.c
#include <stdlib.h>

int main(int argc, char *argv[])
{
return calloc(1000000, 1) ? 1 : 0;
}
$ clang --target=arm-linux-gnueabihf -Os -c test.c
$ llvm-objdump -d test.o

test.o: file format ELF32-arm-little

Disassembly of section .text:
0000000000000000 main:
0: 01 00 a0 e3 mov r0, #1
4: 1e ff 2f e1 bx lr

No call to calloc() in the generated code! As strange as it may seem,
this is reportedly a valid behavior for the compiler [1].

This optimization is obviously not wanted for the test that tries to
check that allocation of a very large buffer fails in OP-TEE.

This commit adds the -fno-builtins flag to the compiler command for that
particular source file, thus preventing the optimization and making the
test pass.

Link: [1] https://bugs.llvm.org/show_bug.cgi?id=37304
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: cast parameter to (void *) when using %p in EMSG()

Fixes the following Clang warning:

core/arch/arm/kernel/generic_boot.c:395:12: warning: format specifies type 'void *' but the argument

core: cast parameter to (void *) when using %p in EMSG()

Fixes the following Clang warning:

core/arch/arm/kernel/generic_boot.c:395:12: warning: format specifies type 'void *' but the argument
has type 'const uint8_t *' (aka 'const unsigned char *') [-Wformat-pedantic]
n, page, res);
^~~~

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm: thread.c: increase stack_tmp size from 1.5 to to 2KiB

We get a dead canary error when booting QEMU with OP-TEE compiled with
Clang. Increase stack size a bit to fix the issue.

Signed-off

core: arm: thread.c: increase stack_tmp size from 1.5 to to 2KiB

We get a dead canary error when booting QEMU with OP-TEE compiled with
Clang. Increase stack size a bit to fix the issue.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: link.mk: generate empty tee-pageable.bin when pager is disabled

When CFG_WITH_PAGER != y, there is no need to call $(OBJCOPY) to
generate tee-pageable.bin, since we know it will be empty. Use

core: link.mk: generate empty tee-pageable.bin when pager is disabled

When CFG_WITH_PAGER != y, there is no need to call $(OBJCOPY) to
generate tee-pageable.bin, since we know it will be empty. Use 'touch'
instead.

This fixes an error with Clang, caused by the fact that llvm-objcopy
cannot generate an empty file:

llvm-objcopy: error: failed to open out/arm-plat-vexpress/core/tee-pageable.bin: Invalid argument.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm32: initialize struct with = { }

The proper way to initialize structures is with = { }. Fixes a Clang
warning:

core/arch/arm/kernel/unwind_arm32.c:497:38: warning: suggest braces around i

core: arm32: initialize struct with = { }

The proper way to initialize structures is with = { }. Fixes a Clang
warning:

core/arch/arm/kernel/unwind_arm32.c:497:38: warning: suggest braces around initialization of subobject [-Wmissing-braces]
struct unwind_state_arm32 state = { 0 };
^
{}

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: thread_a32.S: use assembler unified syntax (UAL)

The movnes instruction causes a compilation warning with Clang:

core/arch/arm/kernel/thread_a32.S:250:2: error: instruction 'movne' can not s

core: thread_a32.S: use assembler unified syntax (UAL)

The movnes instruction causes a compilation warning with Clang:

core/arch/arm/kernel/thread_a32.S:250:2: error: instruction 'movne' can not set flags, but 's' suffix specified
movnes pc, lr
^

This is because Clang supports only Unified Assembler Language syntax
(UAL). GCC also supports this syntax, and there are two ways to enable
it: either use the -masm-syntax-unified flag, or the ".syntax unified"
directive. Unfortunately, the first option does not work with GCC 8.2
[1]. Therefore, use the second option.

This modification results in identical code being generated with GCC
for the whole thread_a32.o file. And Clang generates the same code as
GCC for the the 'movsne pc, lr' instruction.

Link: [1] https://github.com/gcc-mirror/gcc/commit/2fd2b9b8425f
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: asm.S: remove .func/.endfunc directives

The .func and .endfunc directives are ignored unless the file is
compiled with debugging enabled and --gstabs. Since we do not use
this debugging fo

libutils: asm.S: remove .func/.endfunc directives

The .func and .endfunc directives are ignored unless the file is
compiled with debugging enabled and --gstabs. Since we do not use
this debugging format, .func and .endfunc are effectively no-ops.

The Clang compiler does not recognize these directives. Therefore,
in preparation for Clang support, remove them.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...