libutils: disable word-at-a-time for str* functions with ASan

The optimized versions of str* functions perform word-aligned reads
that may go slightly past the actual string boundary. The out-of-bou

libutils: disable word-at-a-time for str* functions with ASan

The optimized versions of str* functions perform word-aligned reads
that may go slightly past the actual string boundary. The out-of-bound
read accesses doesn't look dangerous, because in this case buffer start
address is always word-size aligned.

Disable the optimized versions when CFG_CORE_SANITIZE_KADDRESS is enabled
to avoid ASan errors.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: drop redundant IS_ENABLED checks

The functions asan_tag_access() and asan_tag_heap_free() are
always defined. When CFG_CORE_SANITIZE_KADDRESS is disabled, they
are compiled as no-ops. Thus

libutils: drop redundant IS_ENABLED checks

The functions asan_tag_access() and asan_tag_heap_free() are
always defined. When CFG_CORE_SANITIZE_KADDRESS is disabled, they
are compiled as no-ops. Thus, the surrounding IS_ENABLED() checks
are unnecessary and removed.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: tag only actual allocated size in ASan heap tagging

Tag exactly the requested allocation size (hdr_size + requested_size)
instead of the rounded-up buffer size. This ensures that ASan does

libutils: tag only actual allocated size in ASan heap tagging

Tag exactly the requested allocation size (hdr_size + requested_size)
instead of the rounded-up buffer size. This ensures that ASan does not
mark extra padding as valid memory.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core, libutils: unpoison stack on longjmp for ASan

Adds support for unpoisoning the stack when performing longjmp,
to ensure correct ASan behavior.

When a longjmp unwinds the stack, parts of the st

core, libutils: unpoison stack on longjmp for ASan

Adds support for unpoisoning the stack when performing longjmp,
to ensure correct ASan behavior.

When a longjmp unwinds the stack, parts of the stack that were
poisoned during deeper calls may remain marked as inaccessible.
This can lead to false ASan reports after longjmp, as the new
frame reuses that memory.

To avoid this, a call to asan_handle_longjmp() is added to
setjmp_a64.S, which unpoisons the stack range between the current
SP and the old SP (saved during setjmp).

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: add division routines from LLVM compiler-rt

Add division routines needed to provide __udivti3() needed for long long
divisions in mbedtls.

Selected files are imported from the compiler-rt

libutils: add division routines from LLVM compiler-rt

Add division routines needed to provide __udivti3() needed for long long
divisions in mbedtls.

Selected files are imported from the compiler-rt directory in LLVM
version 20.1.3, tag llvmorg-20.1, to lib/libutils/compiler-rt with no
local changes except for the added sub.mk files.

Link: https://github.com/OP-TEE/optee_os/pull/7359
Link: https://github.com/OP-TEE/optee_os/issues/7374
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: fix crash during syscall ftrace

Syscall ftrace collects data during a syscall. get_fbuf() checks if
thread_get_id_may_fail() != -1 to see if a function is called under
normal thread execution.

core: fix crash during syscall ftrace

Syscall ftrace collects data during a syscall. get_fbuf() checks if
thread_get_id_may_fail() != -1 to see if a function is called under
normal thread execution. This can lead to an inconsistent state if a
native interrupt occur while ftrace_enter() or ftrace_return() is
recording data in the ftrace buffer. So fix this by using
thread_is_in_normal_mode() to exclude ftrace during interrupt
processing.

Reported-by: Jerome Forissier <jerome.forissier@linaro.org>
Closes: https://github.com/OP-TEE/optee_os/issues/7216
Fixes: 099918f6744c ("ftrace: Add support for syscall function tracer")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)

show more ...

pta: stats: add field for fragmentation metric

Add the field free2sum to struct pta_stats_alloc to enable xtest to
calculate fragmenation metric for the heap.

Signed-off-by: Jens Wiklander <jens.wi

pta: stats: add field for fragmentation metric

Add the field free2sum to struct pta_stats_alloc to enable xtest to
calculate fragmenation metric for the heap.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: bget: add free2_sum to struct bpoolset

Add the field free2_sum to struct bpoolset to be used to calculate a
metric for heap fragmentation. The value is calculated and kept up to
date when

libutils: bget: add free2_sum to struct bpoolset

Add the field free2_sum to struct bpoolset to be used to calculate a
metric for heap fragmentation. The value is calculated and kept up to
date when compiled with statistics (CFG_WITH_STATS=y) enabled. See
xtest and [1] for how to use the new field.

Link: https://asawicki.info/news_1757_a_metric_for_memory_fragmentation [1]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutils: avoid unneeded zero init in realloc()

In raw_malloc_flags(), remove the special case for user space where
memory is always zero initialized regardless of MAF_ZERO_INIT. This
removes a case

libutils: avoid unneeded zero init in realloc()

In raw_malloc_flags(), remove the special case for user space where
memory is always zero initialized regardless of MAF_ZERO_INIT. This
removes a case of unneeded zero init for realloc().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: add raw_malloc_flags()

Add raw_malloc_flags() as a counterpart to malloc_flags().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier

libutils: add raw_malloc_flags()

Add raw_malloc_flags() as a counterpart to malloc_flags().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: suppress duplicate ubsan reports

When ubsan panic mode is disabled, the same undefined behavior
may be reported multiple times from the same code location.
This change ensures that only the fi

core: suppress duplicate ubsan reports

When ubsan panic mode is disabled, the same undefined behavior
may be reported multiple times from the same code location.
This change ensures that only the first occurrence is logged.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: enable ubsan support for TAs

Introduce CFG_TA_SANITIZE_UNDEFINED config to sanitize trusted
applications. If CFG_TA_SANITIZE_UNDEFINED is set sanitize flags are
propagated to internal TAs (avb,

ta: enable ubsan support for TAs

Introduce CFG_TA_SANITIZE_UNDEFINED config to sanitize trusted
applications. If CFG_TA_SANITIZE_UNDEFINED is set sanitize flags are
propagated to internal TAs (avb, pkcs11, remoteproc, trusted_keys) and
external TAs, which are built with the devkit.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ldelf: enable ubsan support

Ubsan support was previously limited to core code. This commit moves the
ubsan runtime implementation to libutils, making it available for ldelf
and trusted applications.

ldelf: enable ubsan support

Ubsan support was previously limited to core code. This commit moves the
ubsan runtime implementation to libutils, making it available for ldelf
and trusted applications.

As a result, ldelf will now be built with ubsan support when
CFG_CORE_SANITIZE_UNDEFINED is enabled.

Additionally, to avoid potential infinite recursion, ubsan
instrumentation is explicitly disabled for ubsan.c.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: mm: add virt_page_alloc()

Add virt_page_alloc() to allocate memory from physical pool and map it
in a virtual address pool.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-

core: mm: add virt_page_alloc()

Add virt_page_alloc() to allocate memory from physical pool and map it
in a virtual address pool.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: mm: add phys_mem_alloc_flags()

Add phys_mem_alloc_flags() taking MAF_* flags to control memory
allocation. The new flag MAF_CORE_MEM behaves like
{nex_,}phys_mem_core_alloc(), if the flag is

core: mm: add phys_mem_alloc_flags()

Add phys_mem_alloc_flags() taking MAF_* flags to control memory
allocation. The new flag MAF_CORE_MEM behaves like
{nex_,}phys_mem_core_alloc(), if the flag is absent it becomes
{nex_,}phys_mem_ta_alloc().

The MAF_NEX flag selects Nexus memory.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

Use malloc flags MAF_* in tee_mm.h

Switch to use the malloc flags MAF_* in tee_mm.h replacing the previous
TEE_MM_POOL_* flags. TEE_MM_POOL_* flags are kept defined using MAF_*
flags to for easier t

Use malloc flags MAF_* in tee_mm.h

Switch to use the malloc flags MAF_* in tee_mm.h replacing the previous
TEE_MM_POOL_* flags. TEE_MM_POOL_* flags are kept defined using MAF_*
flags to for easier transition. The TEE_MM_POOL_* flags can be moved
gradually after this commit.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: asm.S: fix BTI() macro

The BTI() macro conditionally emits assembly instructions or directives
depending on CFG_CORE_BTI and CFG_TA_BTI configuration, but it doesn't
take ldelf into consid

libutils: asm.S: fix BTI() macro

The BTI() macro conditionally emits assembly instructions or directives
depending on CFG_CORE_BTI and CFG_TA_BTI configuration, but it doesn't
take ldelf into consideration. ldelf depends on CFG_CORE_BTI just as
OP-TEE core. Fix this by adding __LDELF__ to the mix.

Fixes: af432c48741c ("libutils: asm.S : Introduce BTI in macros for functions")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutils: add malloc_flags() and free_flags()

Add malloc_flags() and free_flags() for generic and flexible memory
allocations based on a passed flags field.

Signed-off-by: Jens Wiklander <jens.wikl

libutils: add malloc_flags() and free_flags()

Add malloc_flags() and free_flags() for generic and flexible memory
allocations based on a passed flags field.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: refactor the MDBG malloc functions

Replace the MDBG malloc functions and macros with a new function
__mdbg_alloc() handling all the memory allocations similar to
mem_alloc(). The old MDBG

libutils: refactor the MDBG malloc functions

Replace the MDBG malloc functions and macros with a new function
__mdbg_alloc() handling all the memory allocations similar to
mem_alloc(). The old MDBG macros are replace by new macros calling
__mdbg_alloc().

mem_alloc(), mem_alloc_unlocked(), and mem_free() are updated to handle
configuration with and without MDBG, removing the all the ENABLE_MDBG
ifdefs in the C file.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: refactor the nexus malloc functions

Refactor the malloc functions operating on the nexus heap as simple
wrappers around the recently added internal function mem_alloc().

Signed-off-by: Je

libutils: refactor the nexus malloc functions

Refactor the malloc functions operating on the nexus heap as simple
wrappers around the recently added internal function mem_alloc().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: refactor the default malloc functions

Refactor the malloc functions operating on the default heap as simple
wrappers around the new internal function mem_alloc() similar to the
recently ad

libutils: refactor the default malloc functions

Refactor the malloc functions operating on the default heap as simple
wrappers around the new internal function mem_alloc() similar to the
recently added raw_mem_alloc().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: refactor raw malloc functions

Refactor the raw malloc functions as simple wrappers around the new
internal function raw_mem_alloc(). raw_mem_alloc() takes a flags field
to control whether

libutils: refactor raw malloc functions

Refactor the raw malloc functions as simple wrappers around the new
internal function raw_mem_alloc(). raw_mem_alloc() takes a flags field
to control whether the allocated buffer should be cleared before it's
returned.

The flags are defined in <malloc.h> since they will be needed there in
later patches.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: add malloc_flags.h

Add malloc_flags.h defining flags to control how buffers are allocated.
The flags will be used in later patches.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.or

libutils: add malloc_flags.h

Add malloc_flags.h defining flags to control how buffers are allocated.
The flags will be used in later patches.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: util.h: add usage description to {get,set}_field_u{32,64}()

Add inline description comments to get_bitfield_u32(),
get_bitfield_u64(), set_bitfield_u32() and set_bitfield_u64() to improve

libutils: util.h: add usage description to {get,set}_field_u{32,64}()

Add inline description comments to get_bitfield_u32(),
get_bitfield_u64(), set_bitfield_u32() and set_bitfield_u64() to improve
understanding and reduce errors.

Signed-off-by: Maxime Méré <maxime.mere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: util.h: fix indentation of ROUNDDOWN() macro

Fix indentation of the value defined for ROUNDDOWN() macro
and add inline comment to better highlight the surrounded
macros are defined for ass

libutils: util.h: fix indentation of ROUNDDOWN() macro

Fix indentation of the value defined for ROUNDDOWN() macro
and add inline comment to better highlight the surrounded
macros are defined for assembler and like source files.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...