core: fix crash during syscall ftrace

Syscall ftrace collects data during a syscall. get_fbuf() checks if
thread_get_id_may_fail() != -1 to see if a function is called under
normal thread execution.

core: fix crash during syscall ftrace

Syscall ftrace collects data during a syscall. get_fbuf() checks if
thread_get_id_may_fail() != -1 to see if a function is called under
normal thread execution. This can lead to an inconsistent state if a
native interrupt occur while ftrace_enter() or ftrace_return() is
recording data in the ftrace buffer. So fix this by using
thread_is_in_normal_mode() to exclude ftrace during interrupt
processing.

Reported-by: Jerome Forissier <jerome.forissier@linaro.org>
Closes: https://github.com/OP-TEE/optee_os/issues/7216
Fixes: 099918f6744c ("ftrace: Add support for syscall function tracer")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_armv8a)

show more ...

core: suppress duplicate ubsan reports

When ubsan panic mode is disabled, the same undefined behavior
may be reported multiple times from the same code location.
This change ensures that only the fi

core: suppress duplicate ubsan reports

When ubsan panic mode is disabled, the same undefined behavior
may be reported multiple times from the same code location.
This change ensures that only the first occurrence is logged.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ta: enable ubsan support for TAs

Introduce CFG_TA_SANITIZE_UNDEFINED config to sanitize trusted
applications. If CFG_TA_SANITIZE_UNDEFINED is set sanitize flags are
propagated to internal TAs (avb,

ta: enable ubsan support for TAs

Introduce CFG_TA_SANITIZE_UNDEFINED config to sanitize trusted
applications. If CFG_TA_SANITIZE_UNDEFINED is set sanitize flags are
propagated to internal TAs (avb, pkcs11, remoteproc, trusted_keys) and
external TAs, which are built with the devkit.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

ldelf: enable ubsan support

Ubsan support was previously limited to core code. This commit moves the
ubsan runtime implementation to libutils, making it available for ldelf
and trusted applications.

ldelf: enable ubsan support

Ubsan support was previously limited to core code. This commit moves the
ubsan runtime implementation to libutils, making it available for ldelf
and trusted applications.

As a result, ldelf will now be built with ubsan support when
CFG_CORE_SANITIZE_UNDEFINED is enabled.

Additionally, to avoid potential infinite recursion, ubsan
instrumentation is explicitly disabled for ubsan.c.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: asm.S: fix BTI() macro

The BTI() macro conditionally emits assembly instructions or directives
depending on CFG_CORE_BTI and CFG_TA_BTI configuration, but it doesn't
take ldelf into consid

libutils: asm.S: fix BTI() macro

The BTI() macro conditionally emits assembly instructions or directives
depending on CFG_CORE_BTI and CFG_TA_BTI configuration, but it doesn't
take ldelf into consideration. ldelf depends on CFG_CORE_BTI just as
OP-TEE core. Fix this by adding __LDELF__ to the mix.

Fixes: af432c48741c ("libutils: asm.S : Introduce BTI in macros for functions")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutils: util.h: add usage description to {get,set}_field_u{32,64}()

Add inline description comments to get_bitfield_u32(),
get_bitfield_u64(), set_bitfield_u32() and set_bitfield_u64() to improve

libutils: util.h: add usage description to {get,set}_field_u{32,64}()

Add inline description comments to get_bitfield_u32(),
get_bitfield_u64(), set_bitfield_u32() and set_bitfield_u64() to improve
understanding and reduce errors.

Signed-off-by: Maxime Méré <maxime.mere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

libutils: util.h: fix indentation of ROUNDDOWN() macro

Fix indentation of the value defined for ROUNDDOWN() macro
and add inline comment to better highlight the surrounded
macros are defined for ass

libutils: util.h: fix indentation of ROUNDDOWN() macro

Fix indentation of the value defined for ROUNDDOWN() macro
and add inline comment to better highlight the surrounded
macros are defined for assembler and like source files.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: util.h: fix DIV_ROUND_UP() inline description

Remove trailing space char in inline description comment of
DIV_ROUND_UP() macro.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.c

libutils: util.h: fix DIV_ROUND_UP() inline description

Remove trailing space char in inline description comment of
DIV_ROUND_UP() macro.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: util.h: Relax ROUNDDOWN() and add ROUNDDOWN2()

Remove constraint on ROUNDDOWN() to have its size argument being a power
of 2 and add new ROUNDDOWN2() macro with that constraint.

The previ

libutils: util.h: Relax ROUNDDOWN() and add ROUNDDOWN2()

Remove constraint on ROUNDDOWN() to have its size argument being a power
of 2 and add new ROUNDDOWN2() macro with that constraint.

The previous implementation of ROUNDDOWN(), optimized for when size
argument is a power of 2, is now used for ROUNDDOWN2() but this latter
also asserts (in debug build mode) that the size argument conforms to
this condition.

The new implementation of ROUNDDOWN() is less optimal but modern
compilers produce the same optimized assembly code with this macro when
the size argument is a constant value known from the compiler so all
use of ROUNDDOWN() with a known constant value do not need move to
ROUNDDOWN2().

Performance sensitive routines should now on use ROUNDDOWN2() to
leverage the power-of-2 rounding optimization.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: util.h: Relax ROUNDUP() and add ROUNDUP2()

Remove constraint on ROUNDUP() to have its size argument being a power
of 2 and add new ROUNDUP2() macro with that constraint.

The previous impl

libutils: util.h: Relax ROUNDUP() and add ROUNDUP2()

Remove constraint on ROUNDUP() to have its size argument being a power
of 2 and add new ROUNDUP2() macro with that constraint.

The previous implementation of ROUNDUP(), optimized for when size
argument is a power of 2, is now used for ROUNDUP2() but this latter
also asserts (in debug build mode) that the size argument conforms to
this condition.

The new implementation of ROUNDUP() is less optimal but modern
compilers produce the same optimized assembly code with this macro
when the size argument is a constant value known from the compiler
so all use of ROUNDUP() with a known constant value do not need
move to ROUNDUP2().

Performance sensitive routines should now on use ROUNDUP2() to
leverage the power-of-2 rounding optimization.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: util.h: Relax ROUNDUP_OVERFLOW() and add ROUNDUP2_OVERFLOW()

Remove constraint on ROUNDUP_OVERFLOW() to have its size argument being
a power of 2 and add new ROUNDUP2_OVERFLOW() macro with

libutils: util.h: Relax ROUNDUP_OVERFLOW() and add ROUNDUP2_OVERFLOW()

Remove constraint on ROUNDUP_OVERFLOW() to have its size argument being
a power of 2 and add new ROUNDUP2_OVERFLOW() macro with that constraint.

The previous implementation of ROUNDUP_OVERFLOW(), optimized for when
size argument is a power of 2, is now used for ROUNDUP2_OVERFLOW() but
this latter also asserts (in debug build mode) that the size argument
conforms to this condition.

Performance sensitive routines should now on use ROUNDUP2_OVERFLOW() to
leverage the power-of-2 rounding optimization.

The new implementation of ROUNDUP_OVERFLOW() is less optimal but modern
compilers produce the same optimized assembly code with this macro
when the size argument is a constant value known from the compiler
so all use of ROUNDUP_OVERFLOW() with a known constant value do not need
move to ROUNDUP2_OVERFLOW().

By the way, fix the indentation in the macro implementation for
consistency of the header file implementation and extend the inline
description comment.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: util.h: Relax ROUNDUP_DIV() and add ROUNDUP2_DIV()

Remove constraint on ROUNDUP_DIV() to have its size argument being a
power of 2 and add new ROUNDUP2_DIV() macro with that constraint.

T

libutils: util.h: Relax ROUNDUP_DIV() and add ROUNDUP2_DIV()

Remove constraint on ROUNDUP_DIV() to have its size argument being a
power of 2 and add new ROUNDUP2_DIV() macro with that constraint.

The previous implementation of ROUNDUP_DIV(), optimized for when size
argument is a power of 2, is now used for ROUNDUP2_DIV() but this latter
also asserts (in debug build mode) that the size argument conforms to
this condition.

Performance sensitive routines should now on use ROUNDUP2_DIV() to
leverage the power-of-2 rounding optimization.

The new implementation of ROUNDUP_DIV() is less optimal but modern
compilers produce the same optimized assembly code with this macro
when the size argument is a constant value known from the compiler
so all use of ROUNDUP_DIV() with a known constant value do not need
move to ROUNDUP2_DIV().

By the way, fix the indentation in the macro implementation for
consistency of the header file implementation.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: util.h: fix ROUND*() macros description argument constraint

Correct inline description comment for ROUNDUP(), ROUNDUP_OVERFLOW(),
ROUNDDOWN() where the second argument is expected to be a

libutils: util.h: fix ROUND*() macros description argument constraint

Correct inline description comment for ROUNDUP(), ROUNDUP_OVERFLOW(),
ROUNDDOWN() where the second argument is expected to be a power of 2,
not a multiple of 2.

Add an inline description comment to ROUNDUP_OVERFLOW() to state
this requirement.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

compiler.h: only use __no_stack_protector if supported by the compiler

The __attribute__((no_stack_protector)) was introduced in GCC 11.
Building a TA with a version of GCC older than that would tri

compiler.h: only use __no_stack_protector if supported by the compiler

The __attribute__((no_stack_protector)) was introduced in GCC 11.
Building a TA with a version of GCC older than that would trigger a
-Wattributes warning on the ta/user_ta_header.c file.

Use __has_attribute() to check support of the no_stack_protector
attribute before using it. If not supported, define the
__no_stack_protector alias as a NOP.

Fixes: e3fb2bd005f0 ("compiler.h: add __no_stack_protector")
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

compiler.h: add __no_stack_protector

Add the __no_stack_protector macro as an alias for
__attribute__((no_stack_protector)), which prevents the generation by
the compiler of the stack protection cod

compiler.h: add __no_stack_protector

Add the __no_stack_protector macro as an alias for
__attribute__((no_stack_protector)), which prevents the generation by
the compiler of the stack protection code.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Khoa Hoang <admin@khoahoang.com>

show more ...

libutils: add PADDR_MAX and PADDR_SIZE_MAX

Add defines for the maximum values of paddr_t and paddr_size_t.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <j

libutils: add PADDR_MAX and PADDR_SIZE_MAX

Add defines for the maximum values of paddr_t and paddr_size_t.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

Move base64.{c,h} from libutee to libutils

Make the base64 routines publicly available by moving them from libutee
to libutils. The _ prefix is removed from the public functions since
they aren't in

Move base64.{c,h} from libutee to libutils

Make the base64 routines publicly available by moving them from libutee
to libutils. The _ prefix is removed from the public functions since
they aren't internal to libutee any longer.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutils: add array helpers

Add helper function() to insert and remove an element from an array. The
helper functions shifts the elements in the array as needed to make room
or fill a room of an ele

libutils: add array helpers

Add helper function() to insert and remove an element from an array. The
helper functions shifts the elements in the array as needed to make room
or fill a room of an element at a certain position.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

libutils: qsort helper for standard types

Add qsort_int(), qsort_uint(), qsort_u32() and friends as qsort() helper
functions to sort standard typed arrays.

Signed-off-by: Etienne Carriere <etienne.

libutils: qsort helper for standard types

Add qsort_int(), qsort_uint(), qsort_u32() and friends as qsort() helper
functions to sort standard typed arrays.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: compiler friendly 32-bit FTMN_FUNC_HASH() version

Add a more compiler friendly 32-bit implementation of FTMN_FUNC_HASH().
This gives the same output as the previous 64-bit based implementation

core: compiler friendly 32-bit FTMN_FUNC_HASH() version

Add a more compiler friendly 32-bit implementation of FTMN_FUNC_HASH().
This gives the same output as the previous 64-bit based implementation,
but base the computation on 32-bit values.

This patch reduces stack usage when compiling with
arm-linux-gnueabihf-gcc version 11.3.1 using -O0 optimization. For
example, sw_crypto_acipher_rsassa_verify() is reduced from 3616 bytes to
284 bytes.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (vexpress-qemu_virt)

show more ...

libutils: util.h: fix the GENMASK_32(h, l) macro

The macro has a problem when it is used in an assembly file:
.e.g ".word GENMASK_32(15, 8)" will be compiled to ".word 0xffffff00"

The issue is caus

libutils: util.h: fix the GENMASK_32(h, l) macro

The macro has a problem when it is used in an assembly file:
.e.g ".word GENMASK_32(15, 8)" will be compiled to ".word 0xffffff00"

The issue is caused by the compiler always treating ~0 as a 64-bit
value. Fix it by replacing '~UINT32_C(0)' with 'UINT32_C(0xffffffff)'.

Signed-off-by: Tony Han <tony.han@microchip.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

libutils: Implement speculation barrier for RISC-V

Implement load_no_speculate() with implementation consists of RISC-V
fence instructions which are used to preserve the memory order.

- Data barrie

libutils: Implement speculation barrier for RISC-V

Implement load_no_speculate() with implementation consists of RISC-V
fence instructions which are used to preserve the memory order.

- Data barrier: fence rw, rw
- Instruction barrier: fence.i; fence r, r

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Yu Chien Peter Lin <peterlin@andestech.com>

show more ...

tree wide: clarify PTA ABI

Explicitly describe the statistics PTA ABI using dedicated inline
comments and moving struct pta_stats_ta and struct pta_stats_alloc
from respectively tee_ta_manager.c and

tree wide: clarify PTA ABI

Explicitly describe the statistics PTA ABI using dedicated inline
comments and moving struct pta_stats_ta and struct pta_stats_alloc
from respectively tee_ta_manager.c and malloc.h to pta_stats.h
header file.

For that purpose, define ALLOC_ID_* macros to identify each allocator
one can query information from through the statistics PTA API.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

tree wide: rename struct malloc_stats

Rename struct malloc_stats to struct pta_stats_alloc to prepare
the creation of pta_stats.h header file that will define the
whole statistics PTA API and ABI, l

tree wide: rename struct malloc_stats

Rename struct malloc_stats to struct pta_stats_alloc to prepare
the creation of pta_stats.h header file that will define the
whole statistics PTA API and ABI, located in libutee/include/
as already done for all other PTAs.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: print current guest ID in logs

If CFG_NS_VIRTUALIZATION is enabled include the current guest ID on each
log line. A number is added before the core number identifying the
currently set guest I

core: print current guest ID in logs

If CFG_NS_VIRTUALIZATION is enabled include the current guest ID on each
log line. A number is added before the core number identifying the
currently set guest ID, for example:
D/TC:2 0 0 call_initcalls:40 level 1 teecore_init_pub_ram()

Where the "2" indicates that this is done with guest ID 2 active.

Update the symbolize.py script accordingly to recognize and ignore an
eventual guest ID in a log entry.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...