Experimental Clang support

Allows building with Clang with "make COMPILER=clang [other flags...]".
The clang command has to be in the $PATH, as well as the associated
tools (clang-cpp, ld.lld, llvm-

Experimental Clang support

Allows building with Clang with "make COMPILER=clang [other flags...]".
The clang command has to be in the $PATH, as well as the associated
tools (clang-cpp, ld.lld, llvm-ar, llvm-nm, llvm-objcopy and
llvm-readelf).

Tested with Clang built from the master branch of [1] (development
version for 9.0):

mkdir build; cd build
cmake -G Ninja -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=~/llvm-install \
-DLLVM_ENABLE_PROJECTS="clang;lld" \
-DLLVM_TARGETS_TO_BUILD="AArch64;ARM" \
~/llvm-project/llvm
ninja && ninja install

Limitations:

- CFG_CORE_SANITIZE_KADDRESS=y is not supported.
- CFG_WITH_PAGER is supported, but requires that the TEE core be
linked with the GNU linker. The reason is documented in
mk/clang.mk.

Bug:

- ldelf assertion failure in xtest 1019 when CFG_ULIBS_SHARED=y (QEMU)
E/LD: assertion 'maps[map_idx].sz == sz' failed at ldelf/ta_elf.c:1114 in ta_elf_print_mappings()
Prevents ldelf from displaying the TA mappings on abort or panic, but
does not seem to cause any other problem.

Link: [1] https://github.com/llvm/llvm-project/commits/8351c327647
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU pager/no pager)
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMUv8, pager/no pager)
Tested-by: Jerome Forissier <jerome@forissier.org> (HiKey960, 32/64, GP)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

plat/rcar: fix core numbering for M3 flavor

R-car Gen3 SoCs have consistent core numbering across all
variations: CA57 cluster have core numbers 0-3 and CA53 have
numbers 4-7.

M3 flavor have 6 core

plat/rcar: fix core numbering for M3 flavor

R-car Gen3 SoCs have consistent core numbering across all
variations: CA57 cluster have core numbers 0-3 and CA53 have
numbers 4-7.

M3 flavor have 6 cores: two CA57s and four CA53s. Taking
into account consistent numbering, M3 will have the following
core ids: 0, 1, 3, 5, 6, 7. To fix this, we need to set
CFG_CORE_CLUSTER_SHIFT to 1.

This somewhat abuses implementation of get_core_pos_mpidr(),
but it is not expected, that it will change in the future.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: cfg-depends-one, cfg-depends-all: disable variable with ':= n'

Update cfg-depends-one and cfg-depends-all to use ':= n' to disable a
variable instead of setting it to an empty string. Functio

build: cfg-depends-one, cfg-depends-all: disable variable with ':= n'

Update cfg-depends-one and cfg-depends-all to use ':= n' to disable a
variable instead of setting it to an empty string. Functionally
equivalent but looks better.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

build: make cfg-one-enabled return 'n' instead of an empty string

Modify cfg-one-enabled in the same way the parent commit modified
cfg-all-enabled.

Signed-off-by: Jerome Forissier <jerome@forissie

build: make cfg-one-enabled return 'n' instead of an empty string

Modify cfg-one-enabled in the same way the parent commit modified
cfg-all-enabled.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

build: make cfg-all-enabled return 'n' instead of an empty string

cfg-all-enabled returns either 'y' or an empty string. Since it is
often used to derive a configuration variable from other ones, it

build: make cfg-all-enabled return 'n' instead of an empty string

cfg-all-enabled returns either 'y' or an empty string. Since it is
often used to derive a configuration variable from other ones, it would
be better to return 'n' instead of an empty string for consistency
(most boolean variables in $O/conf.mk are either 'y' or 'n').

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

symbolize.py: fix exception when stdin is not a terminal

Commit 6b4fc6752b3c ("symbolize.py: disable terminal local echo") uses
termios functions on stdin unconditionally. Unfortunately, this will
c

symbolize.py: fix exception when stdin is not a terminal

Commit 6b4fc6752b3c ("symbolize.py: disable terminal local echo") uses
termios functions on stdin unconditionally. Unfortunately, this will
cause an exception when stdin is not a terminal, for instance:

$ echo Hello | ./script/symbolize.py
Traceback (most recent call last):
File "./scripts/symbolize.py", line 497, in <module>
main()
File "./scripts/symbolize.py", line 484, in main
old = termios.tcgetattr(fd)
termios.error: (25, 'Inappropriate ioctl for device')

Fix the issue by making sure stdin is a TTY before using the termios
functions.

Fixes: 6b4fc6752b3c ("symbolize.py: disable terminal local echo")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Revert "hikey: increase core heap size to 192 kB"

This reverts commit 28c75dbebc49 ("hikey: increase core heap size to
192 kB") which increased the core heap size in order to pass the AOSP
VTS. Unfo

Revert "hikey: increase core heap size to 192 kB"

This reverts commit 28c75dbebc49 ("hikey: increase core heap size to
192 kB") which increased the core heap size in order to pass the AOSP
VTS. Unfortunately, this bigger value does not work well when the pager
is enabled: it causes lots of page faults and a massive slowdown (for
instance, 'xtest 1013' on HiKey620 completes in ~ 1.7 s with the
default heap size of 64 kB but takes ~ 53 s with 192 kB).

Therefore, revert to the previous configuration. A bigger value can
always be set on the command line or by other means when building for
AOSP.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: REE FS TAs: disable CFG_REE_FS_TA_BUFFERED by default

Now that the TA loader is in user space [1], the main reason why we had
introduced CFG_REE_FS_TA_BUFFERED [2] does not exist anymore. Ther

core: REE FS TAs: disable CFG_REE_FS_TA_BUFFERED by default

Now that the TA loader is in user space [1], the main reason why we had
introduced CFG_REE_FS_TA_BUFFERED [2] does not exist anymore. Therefore
we can set it to 'n' by default, thus saving some time and memory.

[1] commit d1911a85142d ("core: load TAs using ldelf")
[2] commit 7db24ad625b9 ("core: REE FS TAs: add option to verify
signature before processing")

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

symbolize.py: disable terminal local echo

When scripts/symbolize.py is used interactively and the input data is
copied and pasted into the terminal, both the input and output text are
displayed on t

symbolize.py: disable terminal local echo

When scripts/symbolize.py is used interactively and the input data is
copied and pasted into the terminal, both the input and output text are
displayed on the same screen. There is nothing preventing both text
streams from mixing up because it depends on buffering and how Python
reads and flushes its buffers.

Things usually go well with Python 2, but I have observed that Python 3
is more problematic. So the issue needs to be properly addressed. This
patch temporarily disables local echo so that only the processed text is
shown.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix configuration check for CFG_PAGED_USER_TA

The cfg-depends-all function from mk/checkconf.mk has to be enclosed
in a $(eval ...) statement. Fix core/core.mk accordingly.

Signed-off-by: Jer

core: fix configuration check for CFG_PAGED_USER_TA

The cfg-depends-all function from mk/checkconf.mk has to be enclosed
in a $(eval ...) statement. Fix core/core.mk accordingly.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: convert remainging scripts to python3

Convert the remaining scripts to python3. Mostly done with 2to3 and
manual adjustements to the code afterwards.

Signed-off-by: Rouven Czerwinski <r.cz

scripts: convert remainging scripts to python3

Convert the remaining scripts to python3. Mostly done with 2to3 and
manual adjustements to the code afterwards.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, QEMUv8)

show more ...

libutils: relax noreturn label

Replaces attribute label identifier noreturn with __noreturn__ to
prevent conflicts when importing code which defines label noreturn
itself as a macro. This change app

libutils: relax noreturn label

Replaces attribute label identifier noreturn with __noreturn__ to
prevent conflicts when importing code which defines label noreturn
itself as a macro. This change applies suggestion from the GCC
documentation [1], applicable even prio GCC 4.x.x, cited below.

> You may optionally specify attribute names with ‘__’ preceding
> and following the name. This allows you to use them in header
> files without being concerned about a possible macro of the same
> name. For example, you may use the attribute name __noreturn__
> instead of noreturn.

Link: [1] https://gcc.gnu.org/onlinedocs/gcc-8.3.0/gcc/Attribute-Syntax.html#Attribute-Syntax
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

hikey: increase core heap size to 192 kB

To pass VTS in AOSP builds.

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

libutee,libdl: remove 0ms timeouts in TA invocations

TEE_OpenTASession(), TEE_InvokeTACommand() calls using 0ms timeout
are replaced with TEE_INFINITE_TIMEOUT to avoid risk of being cancelled.

Sign

libutee,libdl: remove 0ms timeouts in TA invocations

TEE_OpenTASession(), TEE_InvokeTACommand() calls using 0ms timeout
are replaced with TEE_INFINITE_TIMEOUT to avoid risk of being cancelled.

Signed-off-by: Cedric Auger <cauger@provenrun.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

build: prevent produce-* from being forced built before current submodule

Problem:

$ make -s out/arm-plat-vexpress/core/mm/fobj.o
$ rm out/arm-plat-vexpress/ldelf/ldelf.elf
$ rm out/arm-plat-vex

build: prevent produce-* from being forced built before current submodule

Problem:

$ make -s out/arm-plat-vexpress/core/mm/fobj.o
$ rm out/arm-plat-vexpress/ldelf/ldelf.elf
$ rm out/arm-plat-vexpress/core/mm/fobj.o
$ make out/arm-plat-vexpress/core/mm/fobj.o
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
LD out/arm-plat-vexpress/ldelf/ldelf.elf
GEN out/arm-plat-vexpress/core/ldelf_hex.c
CC out/arm-plat-vexpress/core/mm/fobj.o

Why would fobj.o depend on ldelf.elf and ldelf_hex.c? Answer is: it
shouldn't. This behavior is caused by FORCE-GENSRC$(sm) depending on
all the produce-<something> targets. In fact, such a dependency is
rarely needed. It makes sense for include files for instance; but
certainly not for C source files which are pulled in the build by other
means.

This patch introduces force-gensrc-<something> to prevent the generated
file $(produce-<something>) from being added to FORCE-GENSRC$(sm)
unless $(force-gensrcs-<something>) is "y". The test case above works
as expected:

$ make -s out/arm-plat-vexpress/core/mm/fobj.o
$ rm out/arm-plat-vexpress/ldelf/ldelf.elf
$ rm out/arm-plat-vexpress/core/mm/fobj.o
$ make out/arm-plat-vexpress/core/mm/fobj.o
CHK out/arm-plat-vexpress/conf.mk
CHK out/arm-plat-vexpress/include/generated/conf.h
CC out/arm-plat-vexpress/core/mm/fobj.o

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: move sockets PTA to core/tee

The sockets pseudo-TA is architecture-independent. Move it to
core/tee and drop the pta_ prefix which is not really useful.

Signed-off-by: Jerome Forissier <jerom

core: move sockets PTA to core/tee

The sockets pseudo-TA is architecture-independent. Move it to
core/tee and drop the pta_ prefix which is not really useful.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: move PTAs from core/arch/arm/pta to core/pta

All pseudo-TAs in core/arch/arm/pta are not architecture-
specific so move them out of the arch directory.

sdp_pta.c is renamed sdp.c since _pta i

core: move PTAs from core/arch/arm/pta to core/pta

All pseudo-TAs in core/arch/arm/pta are not architecture-
specific so move them out of the arch directory.

sdp_pta.c is renamed sdp.c since _pta is redundant.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: move test PTAs to core/pta/tests

Moves the test PTAs out of the arch-dependent tree into core/pta/tests.
File names are shortened a bit since the full paths make the purpose
clear.

Signed-off

core: move test PTAs to core/pta/tests

Moves the test PTAs out of the arch-dependent tree into core/pta/tests.
File names are shortened a bit since the full paths make the purpose
clear.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: prepare to move PTAs under core/pta and core/pta/tests

Most pseudo-TAs are currently under core/arch/arm/pta. This is wrong
since none of those are architecture-dependent. This patch creates
c

core: prepare to move PTAs under core/pta and core/pta/tests

Most pseudo-TAs are currently under core/arch/arm/pta. This is wrong
since none of those are architecture-dependent. This patch creates
core/pta and core/pta/tests to prepare for the following scheme:
- PTAs that implement a GP TEE API (sockets, for example) should be in
core/tee
- PTAs that implement other system services should be in /core/pta
- Test PTAs should be in core/pta/tests
- Platform-specific PTAs belong in the platform's directory
- Architecture-specific (but not platform-specific) PTAs should go
in core/arch/$(ARCH)/pta (there are none currently)

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pta/gprof.c: remove <arm.h> include

The gprof pseudo-TA does not need <arm.h> so remove it.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@

core: pta/gprof.c: remove <arm.h> include

The gprof pseudo-TA does not need <arm.h> so remove it.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutee: panic on null pointer on object opening

Change TEE_CreatePersistentObject() and TEE_OpenPersistentObject()
to panic when passed an null reference pointer.

According to the TEE Internal Cor

libutee: panic on null pointer on object opening

Change TEE_CreatePersistentObject() and TEE_OpenPersistentObject()
to panic when passed an null reference pointer.

According to the TEE Internal Core API Specification 1.1 and 1.2,
sections 5.7.1 and 5.7.2, passing NULL for object pointer should panic,
and not return an error.

Some harmonization has also been done in these two functions to use
the same conventions as surrounding code.

Signed-off-by: Cedric Auger <cauger@provenrun.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Squashed commit upgrading to libtomcrypt-1.18.2-develop-20180819

Squash merging branch import/libtomcrypt-1.18.2-develop-20180819

5ecac6e9227c ("core: ltc: adapt to new version of LibTomCrypt")
54d

Squashed commit upgrading to libtomcrypt-1.18.2-develop-20180819

Squash merging branch import/libtomcrypt-1.18.2-develop-20180819

5ecac6e9227c ("core: ltc: adapt to new version of LibTomCrypt")
54d7f2f10c33 ("core: ltc: aes_modes_armv8a_ce_a64.S: get rid of literal load of addend vector")
68b1adf4c3db ("core: ltc: aes_modes_armv8a_ce_a64.S: fix incorrect assembly syntax")
b73cfbef058f ("core: ltc: make key in accel_ecb_encrypt() and accel_ecb_decrypt() const")
7160452f6698 ("core: ltc: fix 'switch case misses default'")
05313fd03df1 ("core: ltc: move AES CE files under aes/")
00ed54001f7d ("core: ltc: add custom DH key generation function dh_make_key()")
279e09ee4c7c ("core: ltc: tomcrypt_custom.h: OP-TEE thread support")
e61adb1a2203 ("core: crypto: libtomcrypt: fix LTC_CLEAN_STACK bug")
5c75c2d02f13 ("core: LTC use only _CFG_CORE_LTC_ variables")
5decfe20864a ("core: crypto: arm64 ce: update AES CBC routines")
c54b6344cc4e ("core: crypto: cleanup and fix CE accelerated AES CTR")
3f4d78d04eef ("core: crypto: arm32: add counter increment in ce_aes_ctr_encrypt()")
a85a4f88e39d ("Remove 'All rights reserved' from Linaro files")
14ec45d62762 ("Remove license notice from Linaro files")
084691667db2 ("Add SPDX license identifiers")
48de810896b8 ("LTC: add GHASH acceleration")
9f4ecf2ea898 ("arm32: AES using ARMv8-A cryptographic extensions")
a360627e4130 ("arm64: libtomcrypt: rename AES CE files")
48dab9f6464b ("arm64: libtomcrypt: move inline assembly to .S file")
7479ed2a4be9 ("ltc: bugfix find_prng()")
271db0fe9309 ("ltc: make cipher_descriptor a pointer to descriptors")
cbf6e51b6086 ("ltc: make hash_descriptor a pointer to descriptors")
6982b2b65910 ("ltc: make prng_descriptor a pointer to descriptors")
034ed64a6bb2 ("arm: Fix SHA-1 with cryptographic extensions")
468fcca20d8b ("arm64: SHA-224/SHA-256 using ARMv8-A cryptographic extensions")
a55567f8611c ("arm: update SHA-256 32-bit CE implementation to process multiple blocks")
ee62ece8ecf4 ("arm: update SHA-1 32-bit CE implementation to process multiple blocks")
4287faa43c7c ("arm64: SHA-1 using ARMv8-A cryptographic extensions")
0c6c51d33f05 ("ECC: optimize the pool of temporary variables")
f79f07210b95 ("arm64: AES XTS using ARMv8-A cryptographic extensions")
dc3e64eee4af ("arm64: AES using ARMv8-A cryptographic extensions")
fcad408195d8 ("SHA-1 ARMv8 crypto extension implementation")
e9fa8daa66ed ("SHA-256 ARMv8 crypto extension implementation")
36c11ddb0f2f ("Import LibTomCrypt v1.18.2 branch "develop" (Aug 19, 2019)")
01c7a0fe164c ("Remove LibTomCrypt")

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workar

Revert "compiler.h: introduce GCC version check"

This reverts commit fc78b3ffc59ef03e599ae952b4345f03f466f11c and
updates the comment in <compiler.h>.

It turns out not only GCC 8.x needs the workaround. I tried 4.9, 6.2,
8.2, and 8.3 from various sources (Linaro or Ubuntu). If
__SECTION_FLAGS_RODATA is empty, this warning is always present:

CC out/arm-plat-vexpress/core/mm/fobj.o
{standard input}: Assembler messages:
{standard input}:402: Warning: setting incorrect section attributes for .rodata.__unpaged

The generated assembler file contains the "aw" flags:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"aw",%progbits

By reverting the above commit, we have:

$ grep '\.section.*\.rodata\.__unpaged' out/arm-plat-vexpress/core/mm/fobj.s
.section .rodata.__unpaged,"a",%progbits //,"aw",%progbits

...and the assembler does not warn anymore.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: add __noreturn

The 32-bit variant of e64_relocate() deserves a __noreturn attribute
because it calls utee_return() unconditionally. Fixes a Clang warning.

Signed-off-by: Jerome Forissier <je

ldelf: add __noreturn

The 32-bit variant of e64_relocate() deserves a __noreturn attribute
because it calls utee_return() unconditionally. Fixes a Clang warning.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should d

compiler.h: introduce GCC version check

The macro __SECTION_FLAGS_RODATA introduced by commit fd1187725939 ("core:
force read-only flag on .rodata.* sections") is needed for GCC >= 8, so
it should depend on __GCC_VERSION. This prepares for Clang.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...