core: sparse fix: tmp_stack

Fixes the sparse warnings related to tmp_stack. The fix actually remove
some instructions from the assembly code initializing the temporary
stack pointer.

Reviewed-by: J

core: sparse fix: tmp_stack

Fixes the sparse warnings related to tmp_stack. The fix actually remove
some instructions from the assembly code initializing the temporary
stack pointer.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: sparse fix: almost entire thread.c

Fixes all sparse warnings in thread.c except the ones related to
stack_tmp and panic().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-o

core: sparse fix: almost entire thread.c

Fixes all sparse warnings in thread.c except the ones related to
stack_tmp and panic().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Sparse fix __HAVE_BUILTIN_OVERFLOW

Never define __HAVE_BUILTIN_OVERFLOW if __CHECKER__ is defined.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wi

Sparse fix __HAVE_BUILTIN_OVERFLOW

Never define __HAVE_BUILTIN_OVERFLOW if __CHECKER__ is defined.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: sparse fix: pm_panic

Removes __noreturn attribute from pm_panic() to avoid sparse warnings
when used to initialize struct thread_handlers.

Reviewed-by: Jerome Forissier <jerome.forissier@lina

core: sparse fix: pm_panic

Removes __noreturn attribute from pm_panic() to avoid sparse warnings
when used to initialize struct thread_handlers.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: keep.h: sparse fixes for KEEP_*() macros

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: remove __early_bss

Initialize the .bss section early from assembler before entering C
code. As a result, the __early_bss qualifier is not needed anymore.
Remove it, as well as the related symb

core: remove __early_bss

Initialize the .bss section early from assembler before entering C
code. As a result, the __early_bss qualifier is not needed anymore.
Remove it, as well as the related symbols (__early_bss_start and
__early_bss_end).

This makes the code simpler hence easier to maintain, at the expense
of initialization time, since .bss is cleared before CPU caches are
turned on (and doing it later would mean some C function have been
called already). Here are some performance numbers measured on HiKey.
The "memset" column measures the time it takes to clear .bss in C,
without this patch. The "assembly" column reports the time taken by the
clear_bss loop in this patch. Timings were performed using CNTPCT.
Worst case is a ~1 ms overhead in boot time.

memset(): | assembly:
ms (bytes) | ms (bytes)
--------------+--------------
Aarch64 0.30 (72824) | 0.08 (73528)
Aarch32 0.27 (65016) | 1.24 (65408)
Aarch32/pager 0.03 (11328) | 0.23 (11736)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey 32/64)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey/pager)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: make pager aliased paged not always writable

This change lower the attack surface of executable memory in
the pager by allowing write access to aliased virtual pages
related to read-only conte

core: make pager aliased paged not always writable

This change lower the attack surface of executable memory in
the pager by allowing write access to aliased virtual pages
related to read-only content (including executable content)
only when pager needs to update page content.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (qemu_virt)
Tested-by: Etienne Carriere <etienne.carriere@st.com> (b2260)

show more ...

core: tee_mmu_check_access_rights() use ADD_OVERFLOW()

Replaces the integer overflow check in tee_mmu_check_access_rights()
with ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linar

core: tee_mmu_check_access_rights() use ADD_OVERFLOW()

Replaces the integer overflow check in tee_mmu_check_access_rights()
with ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: set_invoke_timeout() use ADD_OVERFLOW()

Replaces the integer overflow checks in set_invoke_timeout() with
ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off

core: set_invoke_timeout() use ADD_OVERFLOW()

Replaces the integer overflow checks in set_invoke_timeout() with
ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tee_svc_copy_param() use ADD_OVERFLOW()

Replaces the integer overflow check in tee_svc_copy_param() with
ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-

core: tee_svc_copy_param() use ADD_OVERFLOW()

Replaces the integer overflow check in tee_svc_copy_param() with
ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: elf load: use overflow macros

Uses the overflow macros to test for integer overflows when loading an
ELF file.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens

core: elf load: use overflow macros

Uses the overflow macros to test for integer overflows when loading an
ELF file.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: factorize cpu support

Create core/arch/arm/cpu/<cpu-name>.mk to store CPU generic configurations
settings. Update supported platforms to rely on the generic CPU support.

Platform shall still

core: factorize cpu support

Create core/arch/arm/cpu/<cpu-name>.mk to store CPU generic configurations
settings. Update supported platforms to rely on the generic CPU support.

Platform shall still specify whether they support or not the NEON
extension.

Cortex-A53 and Cortex-A57 are all ARMv8.0 compliant. For ARMv8 core,
we will use ARMv8-A architecture minor version configuration files.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: enable write-implies-execute-never when applicable

HW may or may not support STCLR "WXN" configuration field.
CFG_HWSUPP_MEM_PERM_WXN reflects this state. AArch64 is assumed to
always support

core: enable write-implies-execute-never when applicable

HW may or may not support STCLR "WXN" configuration field.
CFG_HWSUPP_MEM_PERM_WXN reflects this state. AArch64 is assumed to
always support this field.

Enable the "WXN" (and UWXN) bits in STCLR upon configuration directive
CFG_CORE_RWDATA_NOEXEC.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: use only KEEP*() macros for dependencies

Replaces the last $(entries-unpaged) and $(entries-init) which are hard
coded in link.mk with KEEP_* annotations inside the source files
instead.

Revi

core: use only KEEP*() macros for dependencies

Replaces the last $(entries-unpaged) and $(entries-init) which are hard
coded in link.mk with KEEP_* annotations inside the source files
instead.

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (HiKey pager)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU pager)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: bugfix assembly KEEP_*() macros

Fixes two bugs in the assembly version of the KEEP_*() macros.

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.foris

core: bugfix assembly KEEP_*() macros

Fixes two bugs in the assembly version of the KEEP_*() macros.

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove KEEP_*() macro workaround

Now that the AArch64 linking problem has be sorted out remove the
temporary workaround introduced in:
commit c3d13c95da89 ("core: workaround KEEP_*() macro pro

core: remove KEEP_*() macro workaround

Now that the AArch64 linking problem has be sorted out remove the
temporary workaround introduced in:
commit c3d13c95da89 ("core: workaround KEEP_*() macro problem")

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: avoid incremental linking with -gc

The AArch64 linkers seems to have occasional problems with incremental
linking (-i) in combination with garbage collect of sections (-gc). The
way we're orga

core: avoid incremental linking with -gc

The AArch64 linkers seems to have occasional problems with incremental
linking (-i) in combination with garbage collect of sections (-gc). The
way we're organizing the layout of the binary used for paging depends on
-gc to build the different dependency trees for unpaged and
initialization code.

The problem in the linker is tracked in
https://bugs.linaro.org/show_bug.cgi?id=3006 and
https://sourceware.org/bugzilla/show_bug.cgi?id=21524

The problem typically manifests itself by:
aarch64-toolchain/gcc-linaro-6.3.1-2017.02-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-ld: BFD (Linaro_Binutils-2017.02) 2.27.0.20161019 assertion fail /home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/aarch64-linux-gnu/snapshots/binutils-gdb.git~linaro_binutils-2_27-branch/bfd/elflink.c:8380
core/arch/arm/kernel/link.mk:90: recipe for target 'out/arm-plat-vexpress/core/init.o' failed
make: *** [out/arm-plat-vexpress/core/init.o] Error 1

With this patch we replace the incremental linking with a full link
using a special link script. With a full link we can't have undefined
symbols so some dummy symbols are provided by the link script when some
object files are skipped when reducing the dependency tree. To
completely get rid of those dummy symbols the script that gathers the
sections is replaced by a python script that skips listed sections (if
provided).

In terms of features in the resulting binary, nothing is changed in this
commit.

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

util: add macros for arithmetics with overflow checking

Compiler builtin support for checking overflow of addition, subtraction
and multiplication is used if available. If unavailable a fallback
imp

util: add macros for arithmetics with overflow checking

Compiler builtin support for checking overflow of addition, subtraction
and multiplication is used if available. If unavailable a fallback
implementation using macros is used instead.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey 32/64)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm: Rework i.MX6 source files

Add a CFG_MX6xxx variable for every i.MX6 SoC variants and get register
addresses and values based on these variables instead of relying on
board names.

Signed-

core: arm: Rework i.MX6 source files

Add a CFG_MX6xxx variable for every i.MX6 SoC variants and get register
addresses and values based on these variables instead of relying on
board names.

Signed-off-by: Mathieu Briand <mbriand@witekio.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Peng Fan <peng.fan@nxp.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: allow CFG_TEE_LOAD_ADDR to not be page aligned

Fixes: https://github.com/OP-TEE/optee_os/issues/1556
Fixes: 10d13b28c22a ("core: exclusive writable/executable attribute in core mapping")
Signe

core: allow CFG_TEE_LOAD_ADDR to not be page aligned

Fixes: https://github.com/OP-TEE/optee_os/issues/1556
Fixes: 10d13b28c22a ("core: exclusive writable/executable attribute in core mapping")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: add symbolize.py

Add a helper script to decode call stacks shown in abort messages. The
script relies on addr2line to convert virtual addresses to debug
information: 'function at file:line'

scripts: add symbolize.py

Add a helper script to decode call stacks shown in abort messages. The
script relies on addr2line to convert virtual addresses to debug
information: 'function at file:line'.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

core: show user TA architecture on abort

In the TA abort message that is sent to the console when a user-mode
TA crashes, there is currently no clear indication of whether the TA
was running in 32-b

core: show user TA architecture on abort

In the TA abort message that is sent to the console when a user-mode
TA crashes, there is currently no clear indication of whether the TA
was running in 32-bit or 64-bit mode. Add it since it will be useful to
develop parsing tools.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: cosmetic updates to the abort dumps for better consistency

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

core: dump call stack of user TAs on abort

Update the abort handling code in the TEE core to support unwinding
the user mode stack in addition to the kernel stack. unwind_arm32.c is
modified slightl

core: dump call stack of user TAs on abort

Update the abort handling code in the TEE core to support unwinding
the user mode stack in addition to the kernel stack. unwind_arm32.c is
modified slightly so that it can be built for AArch64. This allows a
64-bit TEE core to dump both 32- and 64-bit TAs.

Paged TAs (CFG_PAGED_USER_TA=y) cannot currently be unwound, because
the code is not ready to handle the page faults that might occur as
the unwinding tables are accessed.

CFG_CORE_UNWIND is renamed to CFG_UNWIND since it enables both the
kernel and user TA stack dumps. It is still set automatically when
CFG_TEE_CORE_DEBUG=y.

32-bit user TAs have to be compiled with `-funwind-tables`, otherwise
the call stack can't be unwound and the abort reports will not show a
call stack .The TA dev kit takes care of adding this flag automatically
when CFG_UNWIND=y.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: elf_load.c: do not require first segment to be PT_LOAD

There is no obvious reason for requiring the first program header in a
user TA to be of type PT_LOAD. It is usually the case, due to the

core: elf_load.c: do not require first segment to be PT_LOAD

There is no obvious reason for requiring the first program header in a
user TA to be of type PT_LOAD. It is usually the case, due to the way
our linker script is written (ta/arch/arm/ta.ld.S). Still, it may occur
that other segments are inserted first by the linker. For example, when
linking a 32-bit binary built with unwind tables (-funwind-tables), the
first PHDR is PT_ARM_EXIDX. Such a TA won't load unless this patch is
applied.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...