ldelf: arm64: do not unwind past end of stack

unwind_arm64() currently does not check the value of the frame pointer
after it has done its job unwinding one frame. A NULL value indicates
the end of

ldelf: arm64: do not unwind past end of stack

unwind_arm64() currently does not check the value of the frame pointer
after it has done its job unwinding one frame. A NULL value indicates
the end of the call stack, and therefore the function should return
false to stop the caller from unwinding further (a do .. while loop is
used in print_stack_arm64()). Instead invalid values for FP and PC are
returned which causes an erroneous display and the unwind stops one
step too late, when the FP is found to be outside the stack.

Fixes the invalid last line in call stacks such as xtest 1019:

E/TC:? 0 TA panicked with code 0x0
E/LD: Status of TA 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b
E/LD: arch: aarch64
[...]
E/LD: Call stack:
E/LD: 0x0000000080062a50
E/LD: 0x00000000801df848
E/LD: 0x00000000800631a8
E/LD: 0xfffffffffffffffc

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

link.mk: add missing $libgcc to ldargs

Add missing $libgcc arg to ldargs for ldelf, ta link.mk and ta
link_shlib.mk. This is required for the AOSP clang build to fix compile
errors like below:

ld.l

link.mk: add missing $libgcc to ldargs

Add missing $libgcc arg to ldargs for ldelf, ta link.mk and ta
link_shlib.mk. This is required for the AOSP clang build to fix compile
errors like below:

ld.lld: error: undefined symbol: __aeabi_mem*

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ldelf: ldelf.ld.S: make sure _ldelf_start() is first

Makes sure that _ldelf_start() which is the entry point of ldelf is
first in the binary. _ldelf_start() depends on this to perform
relocation.

A

ldelf: ldelf.ld.S: make sure _ldelf_start() is first

Makes sure that _ldelf_start() which is the entry point of ldelf is
first in the binary. _ldelf_start() depends on this to perform
relocation.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: prints consistent with readelf

Prints names of sections consistent with names used in the readelf
utility.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander

ldelf: prints consistent with readelf

Prints names of sections consistent with names used in the readelf
utility.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: consistent error codes

Changes error codes related to bad format or values in ELF to
TEE_ERROR_BAD_FORMAT. This includes overflowing multiplications and
addresses outside the range of the cur

ldelf: consistent error codes

Changes error codes related to bad format or values in ELF to
TEE_ERROR_BAD_FORMAT. This includes overflowing multiplications and
addresses outside the range of the current ELF being parsed.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: use confine_array_index() to cap speculation

Uses confine_array_index() to limit speculation on different indexes into
the ELF.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Ac

ldelf: use confine_array_index() to cap speculation

Uses confine_array_index() to limit speculation on different indexes into
the ELF.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: check ranges in __resolve_sym()

Adds checks in __resolve_sym() to see that the offset of the name and
location of a symbol is in range.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
A

ldelf: check ranges in __resolve_sym()

Adds checks in __resolve_sym() to see that the offset of the name and
location of a symbol is in range.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: calculate correct elf->max_addr

Prior to this patch when the different load sections are mapped
elf->max_addr is inceased as appropriate, except in one case, when memsz
is larger than filesz.

ldelf: calculate correct elf->max_addr

Prior to this patch when the different load sections are mapped
elf->max_addr is inceased as appropriate, except in one case, when memsz
is larger than filesz. With this patch use memsz instead to calculate
elf->max_addr in order to also cover .bss and friends.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: strict checks during relocation

Adds strict check of symbol index, string table index and destination
location when relocating an ELF. This fixes an error where a malformed
ELF may cause the

ldelf: strict checks during relocation

Adds strict check of symbol index, string table index and destination
location when relocating an ELF. This fixes an error where a malformed
ELF may cause the loader to read/write data from/in other ELF or from
the loader itself.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: check dynsym index is in range

Checks that a dynsym index found in hashtab is in the valid range of
dynsyms before indexing into the dynsym table. This fixes an error where
a malformed ELF ma

ldelf: check dynsym index is in range

Checks that a dynsym index found in hashtab is in the valid range of
dynsyms before indexing into the dynsym table. This fixes an error where
a malformed ELF may cause the loader to read data from other ELF or from
the loader itself.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: check string table ranges

Checks that the string table is in the range of the ELF and also checks
that offsets into the string table are indeed inside the string table.
This fixes an error wh

ldelf: check string table ranges

Checks that the string table is in the range of the ELF and also checks
that offsets into the string table are indeed inside the string table.
This fixes an error where a malformed ELF may cause the loader to read
data from other ELF or from the loader itself.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: fix possible integer overflow in init_elf()

The size of the program headers is calculated as:
e_phoff + e_phnum * e_phentsize
This can overflow for large values leading to the 4k size check t

ldelf: fix possible integer overflow in init_elf()

The size of the program headers is calculated as:
e_phoff + e_phnum * e_phentsize
This can overflow for large values leading to the 4k size check to fail.
Fix this by using MUL_OVERFLOW() and ADD_OVERFLOW() instead.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: check dynsymtab and dynstr ranges

Checks the ranges of dynsymtab and dynstr. Also checks that the dynstr
index in section headers isn't out of range. This fixes an error where a
malformed ELF

ldelf: check dynsymtab and dynstr ranges

Checks the ranges of dynsymtab and dynstr. Also checks that the dynstr
index in section headers isn't out of range. This fixes an error where a
malformed ELF may cause the loader to read data from other ELF or from
the loader itself.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: check against section headers size overflow

Adds a check in copy_section_headers() to guard against overflow in
the e_shnum * e_shentsize multiplication.

Reviewed-by: Etienne Carriere <etien

ldelf: check against section headers size overflow

Adds a check in copy_section_headers() to guard against overflow in
the e_shnum * e_shentsize multiplication.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: check that hashtab entries are in range

Adds checks that each looked up entry in the hashtab is in the range of
the hashtab. This fixes an error where a malformed ELF may cause the
loader to

ldelf: check that hashtab entries are in range

Adds checks that each looked up entry in the hashtab is in the range of
the hashtab. This fixes an error where a malformed ELF may cause the
loader to read data from other ELF or from the loader itself.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: check that hashtab is in range before use

Adds checks that the hashtab found via the dynamic section is in range
of the loaded ELF before they are used. This fixes an error where a
malformed

ldelf: check that hashtab is in range before use

Adds checks that the hashtab found via the dynamic section is in range
of the loaded ELF before they are used. This fixes an error where a
malformed ELF may cause the loader to read data from other ELF or from
the loader itself.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: check that PT_DYNAMIC is in range before use

Adds checks that the ELF program header PT_DYNAMIC is in range of the
loaded ELF before they are used. This fixes an error where a malformed
ELF m

ldelf: check that PT_DYNAMIC is in range before use

Adds checks that the ELF program header PT_DYNAMIC is in range of the
loaded ELF before they are used. This fixes an error where a malformed
ELF may cause the loader to read data from other ELF or from the loader
itself.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reported-by: Martijn Bogaard <martijn@riscure.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf, ta: add support for DT_INIT_ARRAY and DT_FINI_ARRAY

Adds support for running initialization and finalization functions in
TA ELF files. Such functions are used, for instance, by C++ compilers

ldelf, ta: add support for DT_INIT_ARRAY and DT_FINI_ARRAY

Adds support for running initialization and finalization functions in
TA ELF files. Such functions are used, for instance, by C++ compilers
to construct and destruct global objects. They can also be used in C
thanks to __attribute__((constructor)) and __attribute__((destructor)).

A global structure is added to libutee. ldelf is responsible for
filling it with the addresses of the functions pointer arrays present
in the ELF files whenever such a file is loaded. Since the number of
arrays is unknown at compile time (it depends on how many ELF files are
loaded, and whether they have constructors or destructors), memory is
allocated on the TA heap.

Two helper functions are introduced: __utee_call_elf_init_fn() and
__utee_call_elf_fini_fn(). They are used when the TA instance is
created and torn down, as well as by dlopen().

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, QEMUv8, HiKey960 32/64)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

elf_common.h: Add relocation type R_AARCH64_NONE

Adds the relocation type R_AARCH64_NONE.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.o

elf_common.h: Add relocation type R_AARCH64_NONE

Adds the relocation type R_AARCH64_NONE.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: link.mk: add generated ldelf.map to $(cleanfiles)

Commit 7509ff7ce5e5 ("Add user mode ELF loader") omitted to add the
generated file $(O)/ldelf/ldelf.map to $(cleanfiles) and therefore
'make

ldelf: link.mk: add generated ldelf.map to $(cleanfiles)

Commit 7509ff7ce5e5 ("Add user mode ELF loader") omitted to add the
generated file $(O)/ldelf/ldelf.map to $(cleanfiles) and therefore
'make clean' leaves it intact. Fix that.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are in

ftrace: Add support for syscall function tracer

This patch adds support for syscall tracing in TEE core. It complements
existing ftrace support for user TAs via adding trace for syscalls that
are invoked by user TAs into the TEE core.

And after this patch ftrace will cover both TA and TEE core code. So lets
rename config option from CFG_TA_FTRACE_SUPPORT to CFG_FTRACE_SUPPORT.

It is optional to enable syscall trace via CFG_SYSCALL_FTRACE=y config
option in addition to CFG_FTRACE_SUPPORT=y config option.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

ldelf: increase heap size from 8 to 12 KiB

The ldelf heap is not big enough to load some 64-bit TAs with several
shared libraries such as xtest 1006 when CFG_ULIBS_SHARED=y:

* regression_1006 Test

ldelf: increase heap size from 8 to 12 KiB

The ldelf heap is not big enough to load some 64-bit TAs with several
shared libraries such as xtest 1006 when CFG_ULIBS_SHARED=y:

* regression_1006 Test Basic OS features
E/LD: copy_section_headers:766 malloc
E/TC:? 0 init_with_ldelf:229 ldelf failed with res: 0xffff000c
E/TC:? 0 tee_ta_open_session:727 Failed. Return error 0xffff000c
regression_1006 FAILED

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ldelf: add __noreturn

The 32-bit variant of e64_relocate() deserves a __noreturn attribute
because it calls utee_return() unconditionally. Fixes a Clang warning.

Signed-off-by: Jerome Forissier <je

ldelf: add __noreturn

The 32-bit variant of e64_relocate() deserves a __noreturn attribute
because it calls utee_return() unconditionally. Fixes a Clang warning.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ta: ldelf.ld.S: align __reloc_begin on 8 bytes

__reloc_begin is currently defined as "__reloc_begin = ." just before
the various .rel.* output sections. The problem is, there is no
guarantee that th

ta: ldelf.ld.S: align __reloc_begin on 8 bytes

__reloc_begin is currently defined as "__reloc_begin = ." just before
the various .rel.* output sections. The problem is, there is no
guarantee that the symbol will actually point to the first relocation
entry due to the alignment constraints on relocation sections. For
instance for Aarch64 relocations, alignment is 8 bytes, but
__reloc_begin has no alignment constraint, so it might end before the
first relocation (this issue was observed with the Clang linker,
ld.lld).

The patch forces the alignment of __reloc_begin on 8 bytes so that
there can be no unwanted padding.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

build: do not use -Wp with the preprocessor and use -o instead of a redirection

This patch cleans up the command line where we use the C preprocessor
to better reflect the documented usage in the GC

build: do not use -Wp with the preprocessor and use -o instead of a redirection

This patch cleans up the command line where we use the C preprocessor
to better reflect the documented usage in the GCC man page, thus
preparing for Clang support.

1. When invoking the C preprocessor, there is no need for -Wp to pass
arguments, so remove it.

2. -MD is not supposed to take a file name when passed to cpp. The
dependency output file name is overridden with -MF.

3. Lastly, it is better to use -o to specify the output file instead
of redirecting standard output, because if an error occurs during
preprocessing we don't want the output file to be created.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...