1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2019, Linaro Limited 4 * Copyright (c) 2020-2023, Arm Limited 5 */ 6 7 #include <asan.h> 8 #include <assert.h> 9 #include <config.h> 10 #include <confine_array_index.h> 11 #include <elf32.h> 12 #include <elf64.h> 13 #include <elf_common.h> 14 #include <ldelf.h> 15 #include <link.h> 16 #include <stdio.h> 17 #include <stdlib.h> 18 #include <string_ext.h> 19 #include <string.h> 20 #include <tee_api_types.h> 21 #include <tee_internal_api_extensions.h> 22 #include <unw/unwind.h> 23 #include <user_ta_header.h> 24 #include <util.h> 25 26 #include "sys.h" 27 #include "ta_elf.h" 28 29 /* 30 * Layout of a 32-bit struct dl_phdr_info for a 64-bit ldelf to access a 32-bit 31 * TA 32 */ 33 struct dl_phdr_info32 { 34 uint32_t dlpi_addr; 35 uint32_t dlpi_name; 36 uint32_t dlpi_phdr; 37 uint16_t dlpi_phnum; 38 uint64_t dlpi_adds; 39 uint64_t dlpi_subs; 40 uint32_t dlpi_tls_modid; 41 uint32_t dlpi_tls_data; 42 }; 43 44 static vaddr_t ta_stack; 45 static vaddr_t ta_stack_size; 46 47 struct ta_elf_queue main_elf_queue = TAILQ_HEAD_INITIALIZER(main_elf_queue); 48 49 /* 50 * Main application is always ID 1, shared libraries with TLS take IDs 2 and 51 * above 52 */ 53 static void assign_tls_mod_id(struct ta_elf *elf) 54 { 55 static size_t last_tls_mod_id = 1; 56 57 if (elf->is_main) 58 assert(last_tls_mod_id == 1); /* Main always comes first */ 59 elf->tls_mod_id = last_tls_mod_id++; 60 } 61 62 static struct ta_elf *queue_elf_helper(const TEE_UUID *uuid) 63 { 64 struct ta_elf *elf = calloc(1, sizeof(*elf)); 65 66 if (!elf) 67 return NULL; 68 69 TAILQ_INIT(&elf->segs); 70 71 elf->uuid = *uuid; 72 TAILQ_INSERT_TAIL(&main_elf_queue, elf, link); 73 return elf; 74 } 75 76 static struct ta_elf *queue_elf(const TEE_UUID *uuid) 77 { 78 struct ta_elf *elf = ta_elf_find_elf(uuid); 79 80 if (elf) 81 return NULL; 82 83 elf = queue_elf_helper(uuid); 84 if (!elf) 85 err(TEE_ERROR_OUT_OF_MEMORY, "queue_elf_helper"); 86 87 return elf; 88 } 89 90 struct ta_elf *ta_elf_find_elf(const TEE_UUID *uuid) 91 { 92 struct ta_elf *elf = NULL; 93 94 TAILQ_FOREACH(elf, &main_elf_queue, link) 95 if (!memcmp(uuid, &elf->uuid, sizeof(*uuid))) 96 return elf; 97 98 return NULL; 99 } 100 101 #if defined(ARM32) || defined(ARM64) 102 static TEE_Result e32_parse_ehdr(struct ta_elf *elf, Elf32_Ehdr *ehdr) 103 { 104 if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || 105 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 106 ehdr->e_ident[EI_DATA] != ELFDATA2LSB || 107 (ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE && 108 ehdr->e_ident[EI_OSABI] != ELFOSABI_ARM) || 109 ehdr->e_type != ET_DYN || ehdr->e_machine != EM_ARM || 110 #ifndef CFG_WITH_VFP 111 (ehdr->e_flags & EF_ARM_ABI_FLOAT_HARD) || 112 #endif 113 ehdr->e_phentsize != sizeof(Elf32_Phdr) || 114 ehdr->e_shentsize != sizeof(Elf32_Shdr)) 115 return TEE_ERROR_BAD_FORMAT; 116 117 if (ehdr->e_ident[EI_OSABI] == ELFOSABI_NONE && 118 (ehdr->e_flags & EF_ARM_ABIMASK) != EF_ARM_ABI_V5) 119 return TEE_ERROR_BAD_FORMAT; 120 121 if (ehdr->e_ident[EI_OSABI] == ELFOSABI_ARM && 122 (ehdr->e_flags & EF_ARM_ABIMASK) != EF_ARM_ABI_UNKNOWN) 123 return TEE_ERROR_BAD_FORMAT; 124 125 elf->is_32bit = true; 126 elf->e_entry = ehdr->e_entry; 127 elf->e_phoff = ehdr->e_phoff; 128 elf->e_shoff = ehdr->e_shoff; 129 elf->e_phnum = ehdr->e_phnum; 130 elf->e_shnum = ehdr->e_shnum; 131 elf->e_phentsize = ehdr->e_phentsize; 132 elf->e_shentsize = ehdr->e_shentsize; 133 134 return TEE_SUCCESS; 135 } 136 137 #ifdef ARM64 138 static TEE_Result e64_parse_ehdr(struct ta_elf *elf, Elf64_Ehdr *ehdr) 139 { 140 if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || 141 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 142 ehdr->e_ident[EI_DATA] != ELFDATA2LSB || 143 ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE || 144 ehdr->e_type != ET_DYN || ehdr->e_machine != EM_AARCH64 || 145 ehdr->e_flags || ehdr->e_phentsize != sizeof(Elf64_Phdr) || 146 ehdr->e_shentsize != sizeof(Elf64_Shdr)) 147 return TEE_ERROR_BAD_FORMAT; 148 149 150 elf->is_32bit = false; 151 elf->e_entry = ehdr->e_entry; 152 elf->e_phoff = ehdr->e_phoff; 153 elf->e_shoff = ehdr->e_shoff; 154 elf->e_phnum = ehdr->e_phnum; 155 elf->e_shnum = ehdr->e_shnum; 156 elf->e_phentsize = ehdr->e_phentsize; 157 elf->e_shentsize = ehdr->e_shentsize; 158 159 return TEE_SUCCESS; 160 } 161 #else /*ARM64*/ 162 static TEE_Result e64_parse_ehdr(struct ta_elf *elf __unused, 163 Elf64_Ehdr *ehdr __unused) 164 { 165 return TEE_ERROR_NOT_SUPPORTED; 166 } 167 #endif /*ARM64*/ 168 #endif /* ARM32 || ARM64 */ 169 170 #if defined(RV64) 171 static TEE_Result e32_parse_ehdr(struct ta_elf *elf __unused, 172 Elf32_Ehdr *ehdr __unused) 173 { 174 return TEE_ERROR_BAD_FORMAT; 175 } 176 177 static TEE_Result e64_parse_ehdr(struct ta_elf *elf, Elf64_Ehdr *ehdr) 178 { 179 if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || 180 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 181 ehdr->e_ident[EI_DATA] != ELFDATA2LSB || 182 ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE || 183 ehdr->e_type != ET_DYN || ehdr->e_machine != EM_RISCV || 184 ehdr->e_phentsize != sizeof(Elf64_Phdr) || 185 ehdr->e_shentsize != sizeof(Elf64_Shdr)) 186 return TEE_ERROR_BAD_FORMAT; 187 188 elf->is_32bit = false; 189 elf->e_entry = ehdr->e_entry; 190 elf->e_phoff = ehdr->e_phoff; 191 elf->e_shoff = ehdr->e_shoff; 192 elf->e_phnum = ehdr->e_phnum; 193 elf->e_shnum = ehdr->e_shnum; 194 elf->e_phentsize = ehdr->e_phentsize; 195 elf->e_shentsize = ehdr->e_shentsize; 196 197 return TEE_SUCCESS; 198 } 199 #endif /* RV64 */ 200 201 static void check_phdr_in_range(struct ta_elf *elf, unsigned int type, 202 vaddr_t addr, size_t memsz) 203 { 204 vaddr_t max_addr = 0; 205 206 if (ADD_OVERFLOW(addr, memsz, &max_addr)) 207 err(TEE_ERROR_BAD_FORMAT, "Program header %#x overflow", type); 208 209 /* 210 * elf->load_addr and elf->max_addr are both using the 211 * final virtual addresses, while this program header is 212 * relative to 0. 213 */ 214 if (max_addr > elf->max_addr - elf->load_addr) 215 err(TEE_ERROR_BAD_FORMAT, "Program header %#x out of bounds", 216 type); 217 } 218 219 static void read_dyn(struct ta_elf *elf, vaddr_t addr, 220 size_t idx, unsigned int *tag, size_t *val) 221 { 222 if (elf->is_32bit) { 223 Elf32_Dyn *dyn = (Elf32_Dyn *)(addr + elf->load_addr); 224 225 *tag = dyn[idx].d_tag; 226 *val = dyn[idx].d_un.d_val; 227 } else { 228 Elf64_Dyn *dyn = (Elf64_Dyn *)(addr + elf->load_addr); 229 230 *tag = dyn[idx].d_tag; 231 *val = dyn[idx].d_un.d_val; 232 } 233 } 234 235 static void check_range(struct ta_elf *elf, const char *name, const void *ptr, 236 size_t sz) 237 { 238 size_t max_addr = 0; 239 240 if ((vaddr_t)ptr < elf->load_addr) 241 err(TEE_ERROR_BAD_FORMAT, "%s %p out of range", name, ptr); 242 243 if (ADD_OVERFLOW((vaddr_t)ptr, sz, &max_addr)) 244 err(TEE_ERROR_BAD_FORMAT, "%s range overflow", name); 245 246 if (max_addr > elf->max_addr) 247 err(TEE_ERROR_BAD_FORMAT, 248 "%s %p..%#zx out of range", name, ptr, max_addr); 249 } 250 251 static void check_hashtab(struct ta_elf *elf, void *ptr, size_t num_buckets, 252 size_t num_chains) 253 { 254 /* 255 * Starting from 2 as the first two words are mandatory and hold 256 * num_buckets and num_chains. So this function is called twice, 257 * first to see that there's indeed room for num_buckets and 258 * num_chains and then to see that all of it fits. 259 * See http://www.sco.com/developers/gabi/latest/ch5.dynamic.html#hash 260 */ 261 size_t num_words = 2; 262 size_t sz = 0; 263 264 if (!IS_ALIGNED_WITH_TYPE(ptr, uint32_t)) 265 err(TEE_ERROR_BAD_FORMAT, "Bad alignment of DT_HASH %p", ptr); 266 267 if (ADD_OVERFLOW(num_words, num_buckets, &num_words) || 268 ADD_OVERFLOW(num_words, num_chains, &num_words) || 269 MUL_OVERFLOW(num_words, sizeof(uint32_t), &sz)) 270 err(TEE_ERROR_BAD_FORMAT, "DT_HASH overflow"); 271 272 check_range(elf, "DT_HASH", ptr, sz); 273 } 274 275 static void check_gnu_hashtab(struct ta_elf *elf, void *ptr) 276 { 277 struct gnu_hashtab *h = ptr; 278 size_t num_words = 4; /* nbuckets, symoffset, bloom_size, bloom_shift */ 279 size_t bloom_words = 0; 280 size_t sz = 0; 281 282 if (!IS_ALIGNED_WITH_TYPE(ptr, uint32_t)) 283 err(TEE_ERROR_BAD_FORMAT, "Bad alignment of DT_GNU_HASH %p", 284 ptr); 285 286 if (elf->gnu_hashtab_size < sizeof(*h)) 287 err(TEE_ERROR_BAD_FORMAT, "DT_GNU_HASH too small"); 288 289 /* Check validity of h->nbuckets and h->bloom_size */ 290 291 if (elf->is_32bit) 292 bloom_words = h->bloom_size; 293 else 294 bloom_words = h->bloom_size * 2; 295 if (ADD_OVERFLOW(num_words, h->nbuckets, &num_words) || 296 ADD_OVERFLOW(num_words, bloom_words, &num_words) || 297 MUL_OVERFLOW(num_words, sizeof(uint32_t), &sz) || 298 sz > elf->gnu_hashtab_size) 299 err(TEE_ERROR_BAD_FORMAT, "DT_GNU_HASH overflow"); 300 } 301 302 static void save_hashtab(struct ta_elf *elf) 303 { 304 uint32_t *hashtab = NULL; 305 size_t n = 0; 306 307 if (elf->is_32bit) { 308 Elf32_Shdr *shdr = elf->shdr; 309 310 for (n = 0; n < elf->e_shnum; n++) { 311 void *addr = (void *)(vaddr_t)(shdr[n].sh_addr + 312 elf->load_addr); 313 314 if (shdr[n].sh_type == SHT_HASH) { 315 elf->hashtab = addr; 316 } else if (shdr[n].sh_type == SHT_GNU_HASH) { 317 elf->gnu_hashtab = addr; 318 elf->gnu_hashtab_size = shdr[n].sh_size; 319 } 320 } 321 } else { 322 Elf64_Shdr *shdr = elf->shdr; 323 324 for (n = 0; n < elf->e_shnum; n++) { 325 void *addr = (void *)(vaddr_t)(shdr[n].sh_addr + 326 elf->load_addr); 327 328 if (shdr[n].sh_type == SHT_HASH) { 329 elf->hashtab = addr; 330 } else if (shdr[n].sh_type == SHT_GNU_HASH) { 331 elf->gnu_hashtab = addr; 332 elf->gnu_hashtab_size = shdr[n].sh_size; 333 } 334 } 335 } 336 337 if (elf->hashtab) { 338 check_hashtab(elf, elf->hashtab, 0, 0); 339 hashtab = elf->hashtab; 340 check_hashtab(elf, elf->hashtab, hashtab[0], hashtab[1]); 341 } 342 if (elf->gnu_hashtab) 343 check_gnu_hashtab(elf, elf->gnu_hashtab); 344 } 345 346 static void save_soname_from_segment(struct ta_elf *elf, unsigned int type, 347 vaddr_t addr, size_t memsz) 348 { 349 size_t dyn_entsize = 0; 350 size_t num_dyns = 0; 351 size_t n = 0; 352 unsigned int tag = 0; 353 size_t val = 0; 354 char *str_tab = NULL; 355 356 if (type != PT_DYNAMIC) 357 return; 358 359 if (elf->is_32bit) 360 dyn_entsize = sizeof(Elf32_Dyn); 361 else 362 dyn_entsize = sizeof(Elf64_Dyn); 363 364 assert(!(memsz % dyn_entsize)); 365 num_dyns = memsz / dyn_entsize; 366 367 for (n = 0; n < num_dyns; n++) { 368 read_dyn(elf, addr, n, &tag, &val); 369 if (tag == DT_STRTAB) { 370 str_tab = (char *)(val + elf->load_addr); 371 break; 372 } 373 } 374 for (n = 0; n < num_dyns; n++) { 375 read_dyn(elf, addr, n, &tag, &val); 376 if (tag == DT_SONAME) { 377 elf->soname = str_tab + val; 378 break; 379 } 380 } 381 } 382 383 static void save_soname(struct ta_elf *elf) 384 { 385 size_t n = 0; 386 387 if (elf->is_32bit) { 388 Elf32_Phdr *phdr = elf->phdr; 389 390 for (n = 0; n < elf->e_phnum; n++) 391 save_soname_from_segment(elf, phdr[n].p_type, 392 phdr[n].p_vaddr, 393 phdr[n].p_memsz); 394 } else { 395 Elf64_Phdr *phdr = elf->phdr; 396 397 for (n = 0; n < elf->e_phnum; n++) 398 save_soname_from_segment(elf, phdr[n].p_type, 399 phdr[n].p_vaddr, 400 phdr[n].p_memsz); 401 } 402 } 403 404 static void e32_save_symtab(struct ta_elf *elf, size_t tab_idx) 405 { 406 Elf32_Shdr *shdr = elf->shdr; 407 size_t str_idx = shdr[tab_idx].sh_link; 408 409 elf->dynsymtab = (void *)(shdr[tab_idx].sh_addr + elf->load_addr); 410 if (!IS_ALIGNED_WITH_TYPE(elf->dynsymtab, Elf32_Sym)) 411 err(TEE_ERROR_BAD_FORMAT, "Bad alignment of dynsymtab %p", 412 elf->dynsymtab); 413 check_range(elf, "Dynsymtab", elf->dynsymtab, shdr[tab_idx].sh_size); 414 415 if (shdr[tab_idx].sh_size % sizeof(Elf32_Sym)) 416 err(TEE_ERROR_BAD_FORMAT, 417 "Size of dynsymtab not an even multiple of Elf32_Sym"); 418 elf->num_dynsyms = shdr[tab_idx].sh_size / sizeof(Elf32_Sym); 419 420 if (str_idx >= elf->e_shnum) 421 err(TEE_ERROR_BAD_FORMAT, "Dynstr section index out of range"); 422 elf->dynstr = (void *)(shdr[str_idx].sh_addr + elf->load_addr); 423 check_range(elf, "Dynstr", elf->dynstr, shdr[str_idx].sh_size); 424 425 elf->dynstr_size = shdr[str_idx].sh_size; 426 } 427 428 static void e64_save_symtab(struct ta_elf *elf, size_t tab_idx) 429 { 430 Elf64_Shdr *shdr = elf->shdr; 431 size_t str_idx = shdr[tab_idx].sh_link; 432 433 elf->dynsymtab = (void *)(vaddr_t)(shdr[tab_idx].sh_addr + 434 elf->load_addr); 435 436 if (!IS_ALIGNED_WITH_TYPE(elf->dynsymtab, Elf64_Sym)) 437 err(TEE_ERROR_BAD_FORMAT, "Bad alignment of .dynsym/DYNSYM %p", 438 elf->dynsymtab); 439 check_range(elf, ".dynsym/DYNSYM", elf->dynsymtab, 440 shdr[tab_idx].sh_size); 441 442 if (shdr[tab_idx].sh_size % sizeof(Elf64_Sym)) 443 err(TEE_ERROR_BAD_FORMAT, 444 "Size of .dynsym/DYNSYM not an even multiple of Elf64_Sym"); 445 elf->num_dynsyms = shdr[tab_idx].sh_size / sizeof(Elf64_Sym); 446 447 if (str_idx >= elf->e_shnum) 448 err(TEE_ERROR_BAD_FORMAT, 449 ".dynstr/STRTAB section index out of range"); 450 elf->dynstr = (void *)(vaddr_t)(shdr[str_idx].sh_addr + elf->load_addr); 451 check_range(elf, ".dynstr/STRTAB", elf->dynstr, shdr[str_idx].sh_size); 452 453 elf->dynstr_size = shdr[str_idx].sh_size; 454 } 455 456 static void save_symtab(struct ta_elf *elf) 457 { 458 size_t n = 0; 459 460 if (elf->is_32bit) { 461 Elf32_Shdr *shdr = elf->shdr; 462 463 for (n = 0; n < elf->e_shnum; n++) { 464 if (shdr[n].sh_type == SHT_DYNSYM) { 465 e32_save_symtab(elf, n); 466 break; 467 } 468 } 469 } else { 470 Elf64_Shdr *shdr = elf->shdr; 471 472 for (n = 0; n < elf->e_shnum; n++) { 473 if (shdr[n].sh_type == SHT_DYNSYM) { 474 e64_save_symtab(elf, n); 475 break; 476 } 477 } 478 479 } 480 481 save_hashtab(elf); 482 save_soname(elf); 483 } 484 485 static void init_elf(struct ta_elf *elf) 486 { 487 TEE_Result res = TEE_SUCCESS; 488 vaddr_t va = 0; 489 uint32_t flags = LDELF_MAP_FLAG_SHAREABLE; 490 size_t sz = 0; 491 492 res = sys_open_ta_bin(&elf->uuid, &elf->handle); 493 if (res) 494 err(res, "sys_open_ta_bin(%pUl)", (void *)&elf->uuid); 495 496 /* 497 * Map it read-only executable when we're loading a library where 498 * the ELF header is included in a load segment. 499 */ 500 if (!elf->is_main) 501 flags |= LDELF_MAP_FLAG_EXECUTABLE; 502 res = sys_map_ta_bin(&va, SMALL_PAGE_SIZE, flags, elf->handle, 0, 0, 0); 503 if (res) 504 err(res, "sys_map_ta_bin"); 505 elf->ehdr_addr = va; 506 if (!elf->is_main) { 507 elf->load_addr = va; 508 elf->max_addr = va + SMALL_PAGE_SIZE; 509 elf->max_offs = SMALL_PAGE_SIZE; 510 } 511 512 if (!IS_ELF(*(Elf32_Ehdr *)va)) 513 err(TEE_ERROR_BAD_FORMAT, "TA is not an ELF"); 514 515 res = e32_parse_ehdr(elf, (void *)va); 516 if (res == TEE_ERROR_BAD_FORMAT) 517 res = e64_parse_ehdr(elf, (void *)va); 518 if (res) 519 err(res, "Cannot parse ELF"); 520 521 if (MUL_OVERFLOW(elf->e_phnum, elf->e_phentsize, &sz) || 522 ADD_OVERFLOW(sz, elf->e_phoff, &sz)) 523 err(TEE_ERROR_BAD_FORMAT, "Program headers size overflow"); 524 525 if (sz > SMALL_PAGE_SIZE) 526 err(TEE_ERROR_NOT_SUPPORTED, "Cannot read program headers"); 527 528 elf->phdr = (void *)(va + elf->e_phoff); 529 } 530 531 static size_t roundup(size_t v) 532 { 533 return ROUNDUP(v, SMALL_PAGE_SIZE); 534 } 535 536 static size_t rounddown(size_t v) 537 { 538 return ROUNDDOWN(v, SMALL_PAGE_SIZE); 539 } 540 541 static void add_segment(struct ta_elf *elf, size_t offset, size_t vaddr, 542 size_t filesz, size_t memsz, size_t flags, size_t align) 543 { 544 struct segment *seg = calloc(1, sizeof(*seg)); 545 546 if (!seg) 547 err(TEE_ERROR_OUT_OF_MEMORY, "calloc"); 548 549 if (memsz < filesz) 550 err(TEE_ERROR_BAD_FORMAT, "Memsz smaller than filesz"); 551 552 seg->offset = offset; 553 seg->vaddr = vaddr; 554 seg->filesz = filesz; 555 seg->memsz = memsz; 556 seg->flags = flags; 557 seg->align = align; 558 559 TAILQ_INSERT_TAIL(&elf->segs, seg, link); 560 } 561 562 static void parse_load_segments(struct ta_elf *elf) 563 { 564 size_t n = 0; 565 566 if (elf->is_32bit) { 567 Elf32_Phdr *phdr = elf->phdr; 568 569 for (n = 0; n < elf->e_phnum; n++) 570 if (phdr[n].p_type == PT_LOAD) { 571 add_segment(elf, phdr[n].p_offset, 572 phdr[n].p_vaddr, phdr[n].p_filesz, 573 phdr[n].p_memsz, phdr[n].p_flags, 574 phdr[n].p_align); 575 } else if (phdr[n].p_type == PT_ARM_EXIDX) { 576 elf->exidx_start = phdr[n].p_vaddr; 577 elf->exidx_size = phdr[n].p_filesz; 578 } else if (phdr[n].p_type == PT_TLS) { 579 assign_tls_mod_id(elf); 580 } 581 } else { 582 Elf64_Phdr *phdr = elf->phdr; 583 584 for (n = 0; n < elf->e_phnum; n++) 585 if (phdr[n].p_type == PT_LOAD) { 586 add_segment(elf, phdr[n].p_offset, 587 phdr[n].p_vaddr, phdr[n].p_filesz, 588 phdr[n].p_memsz, phdr[n].p_flags, 589 phdr[n].p_align); 590 } else if (phdr[n].p_type == PT_TLS) { 591 elf->tls_start = phdr[n].p_vaddr; 592 elf->tls_filesz = phdr[n].p_filesz; 593 elf->tls_memsz = phdr[n].p_memsz; 594 } else if (IS_ENABLED(CFG_TA_BTI) && 595 phdr[n].p_type == PT_GNU_PROPERTY) { 596 elf->prop_start = phdr[n].p_vaddr; 597 elf->prop_align = phdr[n].p_align; 598 elf->prop_memsz = phdr[n].p_memsz; 599 } 600 } 601 } 602 603 static void copy_remapped_to(struct ta_elf *elf, const struct segment *seg) 604 { 605 uint8_t *dst = (void *)(seg->vaddr + elf->load_addr); 606 size_t n = 0; 607 size_t offs = seg->offset; 608 size_t num_bytes = seg->filesz; 609 610 if (offs < elf->max_offs) { 611 n = MIN(elf->max_offs - offs, num_bytes); 612 memcpy(dst, (void *)(elf->max_addr + offs - elf->max_offs), n); 613 dst += n; 614 offs += n; 615 num_bytes -= n; 616 } 617 618 if (num_bytes) { 619 TEE_Result res = sys_copy_from_ta_bin(dst, num_bytes, 620 elf->handle, offs); 621 622 if (res) 623 err(res, "sys_copy_from_ta_bin"); 624 elf->max_offs += offs; 625 } 626 } 627 628 static void adjust_segments(struct ta_elf *elf) 629 { 630 struct segment *seg = NULL; 631 struct segment *prev_seg = NULL; 632 size_t prev_end_addr = 0; 633 size_t align = 0; 634 size_t mask = 0; 635 636 /* Sanity check */ 637 TAILQ_FOREACH(seg, &elf->segs, link) { 638 size_t dummy __maybe_unused = 0; 639 640 assert(seg->align >= SMALL_PAGE_SIZE); 641 assert(!ADD_OVERFLOW(seg->vaddr, seg->memsz, &dummy)); 642 assert(seg->filesz <= seg->memsz); 643 assert((seg->offset & SMALL_PAGE_MASK) == 644 (seg->vaddr & SMALL_PAGE_MASK)); 645 646 prev_seg = TAILQ_PREV(seg, segment_head, link); 647 if (prev_seg) { 648 assert(seg->vaddr >= prev_seg->vaddr + prev_seg->memsz); 649 assert(seg->offset >= 650 prev_seg->offset + prev_seg->filesz); 651 } 652 if (!align) 653 align = seg->align; 654 assert(align == seg->align); 655 } 656 657 mask = align - 1; 658 659 seg = TAILQ_FIRST(&elf->segs); 660 if (seg) 661 seg = TAILQ_NEXT(seg, link); 662 while (seg) { 663 prev_seg = TAILQ_PREV(seg, segment_head, link); 664 prev_end_addr = prev_seg->vaddr + prev_seg->memsz; 665 666 /* 667 * This segment may overlap with the last "page" in the 668 * previous segment in two different ways: 669 * 1. Virtual address (and offset) overlaps => 670 * Permissions needs to be merged. The offset must have 671 * the SMALL_PAGE_MASK bits set as vaddr and offset must 672 * add up with prevsion segment. 673 * 674 * 2. Only offset overlaps => 675 * The same page in the ELF is mapped at two different 676 * virtual addresses. As a limitation this segment must 677 * be mapped as writeable. 678 */ 679 680 /* Case 1. */ 681 if (rounddown(seg->vaddr) < prev_end_addr) { 682 assert((seg->vaddr & mask) == (seg->offset & mask)); 683 assert(prev_seg->memsz == prev_seg->filesz); 684 685 /* 686 * Merge the segments and their permissions. 687 * Note that the may be a small hole between the 688 * two sections. 689 */ 690 prev_seg->filesz = seg->vaddr + seg->filesz - 691 prev_seg->vaddr; 692 prev_seg->memsz = seg->vaddr + seg->memsz - 693 prev_seg->vaddr; 694 prev_seg->flags |= seg->flags; 695 696 TAILQ_REMOVE(&elf->segs, seg, link); 697 free(seg); 698 seg = TAILQ_NEXT(prev_seg, link); 699 continue; 700 } 701 702 /* Case 2. */ 703 if ((seg->offset & mask) && 704 rounddown(seg->offset) < 705 (prev_seg->offset + prev_seg->filesz)) { 706 707 assert(seg->flags & PF_W); 708 seg->remapped_writeable = true; 709 } 710 711 /* 712 * No overlap, but we may need to align address, offset and 713 * size. 714 */ 715 seg->filesz += seg->vaddr - rounddown(seg->vaddr); 716 seg->memsz += seg->vaddr - rounddown(seg->vaddr); 717 seg->vaddr = rounddown(seg->vaddr); 718 seg->offset = rounddown(seg->offset); 719 seg = TAILQ_NEXT(seg, link); 720 } 721 722 } 723 724 static void populate_segments_legacy(struct ta_elf *elf) 725 { 726 TEE_Result res = TEE_SUCCESS; 727 struct segment *seg = NULL; 728 vaddr_t va = 0; 729 730 assert(elf->is_legacy); 731 TAILQ_FOREACH(seg, &elf->segs, link) { 732 struct segment *last_seg = TAILQ_LAST(&elf->segs, segment_head); 733 size_t pad_end = roundup(last_seg->vaddr + last_seg->memsz - 734 seg->vaddr - seg->memsz); 735 size_t num_bytes = roundup(seg->memsz); 736 737 if (!elf->load_addr) 738 va = 0; 739 else 740 va = seg->vaddr + elf->load_addr; 741 742 743 if (!(seg->flags & PF_R)) 744 err(TEE_ERROR_NOT_SUPPORTED, 745 "Segment must be readable"); 746 747 res = sys_map_zi(num_bytes, 0, &va, 0, pad_end); 748 if (res) 749 err(res, "sys_map_zi"); 750 res = sys_copy_from_ta_bin((void *)va, seg->filesz, 751 elf->handle, seg->offset); 752 if (res) 753 err(res, "sys_copy_from_ta_bin"); 754 755 if (!elf->load_addr) 756 elf->load_addr = va; 757 elf->max_addr = va + num_bytes; 758 elf->max_offs = seg->offset + seg->filesz; 759 } 760 } 761 762 static size_t get_pad_begin(void) 763 { 764 #ifdef CFG_TA_ASLR 765 size_t min = CFG_TA_ASLR_MIN_OFFSET_PAGES; 766 size_t max = CFG_TA_ASLR_MAX_OFFSET_PAGES; 767 TEE_Result res = TEE_SUCCESS; 768 uint32_t rnd32 = 0; 769 size_t rnd = 0; 770 771 COMPILE_TIME_ASSERT(CFG_TA_ASLR_MIN_OFFSET_PAGES < 772 CFG_TA_ASLR_MAX_OFFSET_PAGES); 773 if (max > min) { 774 res = sys_gen_random_num(&rnd32, sizeof(rnd32)); 775 if (res) { 776 DMSG("Random read failed: %#"PRIx32, res); 777 return min * SMALL_PAGE_SIZE; 778 } 779 rnd = rnd32 % (max - min); 780 } 781 782 return (min + rnd) * SMALL_PAGE_SIZE; 783 #else /*!CFG_TA_ASLR*/ 784 return 0; 785 #endif /*!CFG_TA_ASLR*/ 786 } 787 788 static void populate_segments(struct ta_elf *elf) 789 { 790 TEE_Result res = TEE_SUCCESS; 791 struct segment *seg = NULL; 792 vaddr_t va = 0; 793 size_t pad_begin = 0; 794 795 assert(!elf->is_legacy); 796 TAILQ_FOREACH(seg, &elf->segs, link) { 797 struct segment *last_seg = TAILQ_LAST(&elf->segs, segment_head); 798 size_t pad_end = roundup(last_seg->vaddr + last_seg->memsz - 799 seg->vaddr - seg->memsz); 800 801 if (seg->remapped_writeable) { 802 size_t num_bytes = roundup(seg->vaddr + seg->memsz) - 803 rounddown(seg->vaddr); 804 805 assert(elf->load_addr); 806 va = rounddown(elf->load_addr + seg->vaddr); 807 assert(va >= elf->max_addr); 808 res = sys_map_zi(num_bytes, 0, &va, 0, pad_end); 809 if (res) 810 err(res, "sys_map_zi"); 811 812 copy_remapped_to(elf, seg); 813 elf->max_addr = va + num_bytes; 814 } else { 815 uint32_t flags = 0; 816 size_t filesz = seg->filesz; 817 size_t memsz = seg->memsz; 818 size_t offset = seg->offset; 819 size_t vaddr = seg->vaddr; 820 821 if (offset < elf->max_offs) { 822 /* 823 * We're in a load segment which overlaps 824 * with (or is covered by) the first page 825 * of a shared library. 826 */ 827 if (vaddr + filesz < SMALL_PAGE_SIZE) { 828 size_t num_bytes = 0; 829 830 /* 831 * If this segment is completely 832 * covered, take next. 833 */ 834 if (vaddr + memsz <= SMALL_PAGE_SIZE) 835 continue; 836 837 /* 838 * All data of the segment is 839 * loaded, but we need to zero 840 * extend it. 841 */ 842 va = elf->max_addr; 843 num_bytes = roundup(vaddr + memsz) - 844 roundup(vaddr) - 845 SMALL_PAGE_SIZE; 846 assert(num_bytes); 847 res = sys_map_zi(num_bytes, 0, &va, 0, 848 0); 849 if (res) 850 err(res, "sys_map_zi"); 851 elf->max_addr = roundup(va + num_bytes); 852 continue; 853 } 854 855 /* Partial overlap, remove the first page. */ 856 vaddr += SMALL_PAGE_SIZE; 857 filesz -= SMALL_PAGE_SIZE; 858 memsz -= SMALL_PAGE_SIZE; 859 offset += SMALL_PAGE_SIZE; 860 } 861 862 if (!elf->load_addr) { 863 va = 0; 864 pad_begin = get_pad_begin(); 865 /* 866 * If mapping with pad_begin fails we'll 867 * retry without pad_begin, effectively 868 * disabling ASLR for the current ELF file. 869 */ 870 } else { 871 va = vaddr + elf->load_addr; 872 pad_begin = 0; 873 } 874 875 if (seg->flags & PF_W) 876 flags |= LDELF_MAP_FLAG_WRITEABLE; 877 else 878 flags |= LDELF_MAP_FLAG_SHAREABLE; 879 if (seg->flags & PF_X) 880 flags |= LDELF_MAP_FLAG_EXECUTABLE; 881 if (!(seg->flags & PF_R)) 882 err(TEE_ERROR_NOT_SUPPORTED, 883 "Segment must be readable"); 884 if (flags & LDELF_MAP_FLAG_WRITEABLE) { 885 res = sys_map_zi(memsz, 0, &va, pad_begin, 886 pad_end); 887 if (pad_begin && res == TEE_ERROR_OUT_OF_MEMORY) 888 res = sys_map_zi(memsz, 0, &va, 0, 889 pad_end); 890 if (res) 891 err(res, "sys_map_zi"); 892 res = sys_copy_from_ta_bin((void *)va, filesz, 893 elf->handle, offset); 894 if (res) 895 err(res, "sys_copy_from_ta_bin"); 896 } else { 897 if (filesz != memsz) 898 err(TEE_ERROR_BAD_FORMAT, 899 "Filesz and memsz mismatch"); 900 res = sys_map_ta_bin(&va, filesz, flags, 901 elf->handle, offset, 902 pad_begin, pad_end); 903 if (pad_begin && res == TEE_ERROR_OUT_OF_MEMORY) 904 res = sys_map_ta_bin(&va, filesz, flags, 905 elf->handle, 906 offset, 0, 907 pad_end); 908 if (res) 909 err(res, "sys_map_ta_bin"); 910 } 911 912 if (!elf->load_addr) 913 elf->load_addr = va; 914 elf->max_addr = roundup(va + memsz); 915 elf->max_offs += filesz; 916 } 917 } 918 } 919 920 static void ta_elf_add_bti(struct ta_elf *elf) 921 { 922 TEE_Result res = TEE_SUCCESS; 923 struct segment *seg = NULL; 924 uint32_t flags = LDELF_MAP_FLAG_EXECUTABLE | LDELF_MAP_FLAG_BTI; 925 926 TAILQ_FOREACH(seg, &elf->segs, link) { 927 vaddr_t va = elf->load_addr + seg->vaddr; 928 929 if (seg->flags & PF_X) { 930 res = sys_set_prot(va, seg->memsz, flags); 931 if (res) 932 err(res, "sys_set_prot"); 933 } 934 } 935 } 936 937 static void parse_property_segment(struct ta_elf *elf) 938 { 939 char *desc = NULL; 940 size_t align = elf->prop_align; 941 size_t desc_offset = 0; 942 size_t prop_offset = 0; 943 vaddr_t va = 0; 944 Elf_Note *note = NULL; 945 char *name = NULL; 946 947 if (!IS_ENABLED(CFG_TA_BTI) || !elf->prop_start) 948 return; 949 950 check_phdr_in_range(elf, PT_GNU_PROPERTY, elf->prop_start, 951 elf->prop_memsz); 952 953 va = elf->load_addr + elf->prop_start; 954 note = (void *)va; 955 name = (char *)(note + 1); 956 957 if (elf->prop_memsz < sizeof(*note) + sizeof(ELF_NOTE_GNU)) 958 return; 959 960 if (note->n_type != NT_GNU_PROPERTY_TYPE_0 || 961 note->n_namesz != sizeof(ELF_NOTE_GNU) || 962 memcmp(name, ELF_NOTE_GNU, sizeof(ELF_NOTE_GNU)) || 963 !IS_POWER_OF_TWO(align)) 964 return; 965 966 desc_offset = ROUNDUP2(sizeof(*note) + sizeof(ELF_NOTE_GNU), align); 967 968 if (desc_offset > elf->prop_memsz || 969 ROUNDUP2(desc_offset + note->n_descsz, align) > elf->prop_memsz) 970 return; 971 972 desc = (char *)(va + desc_offset); 973 974 do { 975 Elf_Prop *prop = (void *)(desc + prop_offset); 976 size_t data_offset = prop_offset + sizeof(*prop); 977 978 if (note->n_descsz < data_offset) 979 return; 980 981 data_offset = confine_array_index(data_offset, note->n_descsz); 982 983 if (prop->pr_type == GNU_PROPERTY_AARCH64_FEATURE_1_AND) { 984 uint32_t *pr_data = (void *)(desc + data_offset); 985 986 if (note->n_descsz < (data_offset + sizeof(*pr_data)) && 987 prop->pr_datasz != sizeof(*pr_data)) 988 return; 989 990 if (*pr_data & GNU_PROPERTY_AARCH64_FEATURE_1_BTI) { 991 DMSG("BTI Feature present in note property"); 992 elf->bti_enabled = true; 993 } 994 } 995 996 prop_offset += ROUNDUP2(sizeof(*prop) + prop->pr_datasz, align); 997 } while (prop_offset < note->n_descsz); 998 } 999 1000 static void map_segments(struct ta_elf *elf) 1001 { 1002 TEE_Result res = TEE_SUCCESS; 1003 1004 parse_load_segments(elf); 1005 adjust_segments(elf); 1006 if (TAILQ_FIRST(&elf->segs)->offset < SMALL_PAGE_SIZE) { 1007 vaddr_t va = 0; 1008 size_t sz = elf->max_addr - elf->load_addr; 1009 struct segment *seg = TAILQ_LAST(&elf->segs, segment_head); 1010 size_t pad_begin = get_pad_begin(); 1011 1012 /* 1013 * We're loading a library, if not other parts of the code 1014 * need to be updated too. 1015 */ 1016 assert(!elf->is_main); 1017 1018 /* 1019 * Now that we know how much virtual memory is needed move 1020 * the already mapped part to a location which can 1021 * accommodate us. 1022 */ 1023 res = sys_remap(elf->load_addr, &va, sz, pad_begin, 1024 roundup(seg->vaddr + seg->memsz)); 1025 if (res == TEE_ERROR_OUT_OF_MEMORY) 1026 res = sys_remap(elf->load_addr, &va, sz, 0, 1027 roundup(seg->vaddr + seg->memsz)); 1028 if (res) 1029 err(res, "sys_remap"); 1030 elf->ehdr_addr = va; 1031 elf->load_addr = va; 1032 elf->max_addr = va + sz; 1033 elf->phdr = (void *)(va + elf->e_phoff); 1034 } 1035 } 1036 1037 static void add_deps_from_segment(struct ta_elf *elf, unsigned int type, 1038 vaddr_t addr, size_t memsz) 1039 { 1040 size_t dyn_entsize = 0; 1041 size_t num_dyns = 0; 1042 size_t n = 0; 1043 unsigned int tag = 0; 1044 size_t val = 0; 1045 TEE_UUID uuid = { }; 1046 char *str_tab = NULL; 1047 size_t str_tab_sz = 0; 1048 1049 if (type != PT_DYNAMIC) 1050 return; 1051 1052 check_phdr_in_range(elf, type, addr, memsz); 1053 1054 if (elf->is_32bit) 1055 dyn_entsize = sizeof(Elf32_Dyn); 1056 else 1057 dyn_entsize = sizeof(Elf64_Dyn); 1058 1059 assert(!(memsz % dyn_entsize)); 1060 num_dyns = memsz / dyn_entsize; 1061 1062 for (n = 0; n < num_dyns && !(str_tab && str_tab_sz); n++) { 1063 read_dyn(elf, addr, n, &tag, &val); 1064 if (tag == DT_STRTAB) 1065 str_tab = (char *)(val + elf->load_addr); 1066 else if (tag == DT_STRSZ) 1067 str_tab_sz = val; 1068 } 1069 check_range(elf, ".dynstr/STRTAB", str_tab, str_tab_sz); 1070 1071 for (n = 0; n < num_dyns; n++) { 1072 TEE_Result res = TEE_SUCCESS; 1073 1074 read_dyn(elf, addr, n, &tag, &val); 1075 if (tag != DT_NEEDED) 1076 continue; 1077 if (val >= str_tab_sz) 1078 err(TEE_ERROR_BAD_FORMAT, 1079 "Offset into .dynstr/STRTAB out of range"); 1080 res = tee_uuid_from_str(&uuid, str_tab + val); 1081 if (res) 1082 err(res, "Fail to get UUID from string"); 1083 queue_elf(&uuid); 1084 } 1085 } 1086 1087 static void add_dependencies(struct ta_elf *elf) 1088 { 1089 size_t n = 0; 1090 1091 if (elf->is_32bit) { 1092 Elf32_Phdr *phdr = elf->phdr; 1093 1094 for (n = 0; n < elf->e_phnum; n++) 1095 add_deps_from_segment(elf, phdr[n].p_type, 1096 phdr[n].p_vaddr, phdr[n].p_memsz); 1097 } else { 1098 Elf64_Phdr *phdr = elf->phdr; 1099 1100 for (n = 0; n < elf->e_phnum; n++) 1101 add_deps_from_segment(elf, phdr[n].p_type, 1102 phdr[n].p_vaddr, phdr[n].p_memsz); 1103 } 1104 } 1105 1106 static void copy_section_headers(struct ta_elf *elf) 1107 { 1108 TEE_Result res = TEE_SUCCESS; 1109 size_t sz = 0; 1110 size_t offs = 0; 1111 1112 if (MUL_OVERFLOW(elf->e_shnum, elf->e_shentsize, &sz)) 1113 err(TEE_ERROR_BAD_FORMAT, "Section headers size overflow"); 1114 1115 elf->shdr = malloc(sz); 1116 if (!elf->shdr) 1117 err(TEE_ERROR_OUT_OF_MEMORY, "malloc"); 1118 1119 /* 1120 * We're assuming that section headers comes after the load segments, 1121 * but if it's a very small dynamically linked library the section 1122 * headers can still end up (partially?) in the first mapped page. 1123 */ 1124 if (elf->e_shoff < SMALL_PAGE_SIZE) { 1125 assert(!elf->is_main); 1126 offs = MIN(SMALL_PAGE_SIZE - elf->e_shoff, sz); 1127 memcpy(elf->shdr, (void *)(elf->load_addr + elf->e_shoff), 1128 offs); 1129 } 1130 1131 if (offs < sz) { 1132 res = sys_copy_from_ta_bin((uint8_t *)elf->shdr + offs, 1133 sz - offs, elf->handle, 1134 elf->e_shoff + offs); 1135 if (res) 1136 err(res, "sys_copy_from_ta_bin"); 1137 } 1138 } 1139 1140 static void close_handle(struct ta_elf *elf) 1141 { 1142 TEE_Result res = sys_close_ta_bin(elf->handle); 1143 1144 if (res) 1145 err(res, "sys_close_ta_bin"); 1146 elf->handle = -1; 1147 } 1148 1149 static void clean_elf_load_main(struct ta_elf *elf) 1150 { 1151 TEE_Result res = TEE_SUCCESS; 1152 1153 /* 1154 * Clean up from last attempt to load 1155 */ 1156 res = sys_unmap(elf->ehdr_addr, SMALL_PAGE_SIZE); 1157 if (res) 1158 err(res, "sys_unmap"); 1159 1160 while (!TAILQ_EMPTY(&elf->segs)) { 1161 struct segment *seg = TAILQ_FIRST(&elf->segs); 1162 vaddr_t va = 0; 1163 size_t num_bytes = 0; 1164 1165 va = rounddown(elf->load_addr + seg->vaddr); 1166 if (seg->remapped_writeable) 1167 num_bytes = roundup(seg->vaddr + seg->memsz) - 1168 rounddown(seg->vaddr); 1169 else 1170 num_bytes = seg->memsz; 1171 1172 res = sys_unmap(va, num_bytes); 1173 if (res) 1174 err(res, "sys_unmap"); 1175 1176 TAILQ_REMOVE(&elf->segs, seg, link); 1177 free(seg); 1178 } 1179 1180 free(elf->shdr); 1181 memset(&elf->is_32bit, 0, 1182 (vaddr_t)&elf->uuid - (vaddr_t)&elf->is_32bit); 1183 1184 TAILQ_INIT(&elf->segs); 1185 } 1186 1187 #ifdef ARM64 1188 /* 1189 * Allocates an offset in the TA's Thread Control Block for the TLS segment of 1190 * the @elf module. 1191 */ 1192 #define TCB_HEAD_SIZE (2 * sizeof(long)) 1193 static void set_tls_offset(struct ta_elf *elf) 1194 { 1195 static size_t next_offs = TCB_HEAD_SIZE; 1196 1197 if (!elf->tls_start) 1198 return; 1199 1200 /* Module has a TLS segment */ 1201 elf->tls_tcb_offs = next_offs; 1202 next_offs += elf->tls_memsz; 1203 } 1204 #else 1205 static void set_tls_offset(struct ta_elf *elf __unused) {} 1206 #endif 1207 1208 static void load_main(struct ta_elf *elf) 1209 { 1210 vaddr_t va = 0; 1211 1212 init_elf(elf); 1213 map_segments(elf); 1214 populate_segments(elf); 1215 add_dependencies(elf); 1216 copy_section_headers(elf); 1217 save_symtab(elf); 1218 close_handle(elf); 1219 set_tls_offset(elf); 1220 parse_property_segment(elf); 1221 if (elf->bti_enabled) 1222 ta_elf_add_bti(elf); 1223 1224 if (!ta_elf_resolve_sym("ta_head", &va, NULL, elf)) 1225 elf->head = (struct ta_head *)va; 1226 else 1227 elf->head = (struct ta_head *)elf->load_addr; 1228 if (elf->head->depr_entry != UINT64_MAX) { 1229 /* 1230 * Legacy TAs sets their entry point in ta_head. For 1231 * non-legacy TAs the entry point of the ELF is set instead 1232 * and leaving the ta_head entry point set to UINT64_MAX to 1233 * indicate that it's not used. 1234 * 1235 * NB, everything before the commit a73b5878c89d ("Replace 1236 * ta_head.entry with elf entry") is considered legacy TAs 1237 * for ldelf. 1238 * 1239 * Legacy TAs cannot be mapped with shared memory segments 1240 * so restart the mapping if it turned out we're loading a 1241 * legacy TA. 1242 */ 1243 1244 DMSG("Reloading TA %pUl as legacy TA", (void *)&elf->uuid); 1245 clean_elf_load_main(elf); 1246 elf->is_legacy = true; 1247 init_elf(elf); 1248 map_segments(elf); 1249 populate_segments_legacy(elf); 1250 add_dependencies(elf); 1251 copy_section_headers(elf); 1252 save_symtab(elf); 1253 close_handle(elf); 1254 elf->head = (struct ta_head *)elf->load_addr; 1255 /* 1256 * Check that the TA is still a legacy TA, if it isn't give 1257 * up now since we're likely under attack. 1258 */ 1259 if (elf->head->depr_entry == UINT64_MAX) 1260 err(TEE_ERROR_GENERIC, 1261 "TA %pUl was changed on disk to non-legacy", 1262 (void *)&elf->uuid); 1263 } 1264 1265 } 1266 1267 void ta_elf_load_main(const TEE_UUID *uuid, uint32_t *is_32bit, uint64_t *sp, 1268 uint32_t *ta_flags) 1269 { 1270 struct ta_elf *elf = queue_elf(uuid); 1271 vaddr_t va = 0; 1272 TEE_Result res = TEE_SUCCESS; 1273 1274 assert(elf); 1275 elf->is_main = true; 1276 1277 load_main(elf); 1278 1279 *is_32bit = elf->is_32bit; 1280 res = sys_map_zi(elf->head->stack_size, 0, &va, 0, 0); 1281 if (res) 1282 err(res, "sys_map_zi stack"); 1283 1284 if (elf->head->flags & ~TA_FLAGS_MASK) 1285 err(TEE_ERROR_BAD_FORMAT, "Invalid TA flags(s) %#"PRIx32, 1286 elf->head->flags & ~TA_FLAGS_MASK); 1287 1288 *ta_flags = elf->head->flags; 1289 *sp = va + elf->head->stack_size; 1290 ta_stack = va; 1291 ta_stack_size = elf->head->stack_size; 1292 1293 if (IS_ENABLED(CFG_TA_SANITIZE_KADDRESS)) { 1294 res = asan_user_map_shadow((void *)ta_stack, 1295 (void *)(ta_stack + 1296 roundup(ta_stack_size)), 1297 ASAN_REG_STACK); 1298 if (res) { 1299 EMSG("Failed to map shadow stack for ELF (%pUl)", 1300 (void *)&elf->uuid); 1301 panic(); 1302 } 1303 } 1304 } 1305 1306 void ta_elf_finalize_load_main(uint64_t *entry, uint64_t *load_addr) 1307 { 1308 struct ta_elf *elf = TAILQ_FIRST(&main_elf_queue); 1309 TEE_Result res = TEE_SUCCESS; 1310 1311 assert(elf->is_main); 1312 1313 res = ta_elf_set_init_fini_info_compat(elf->is_32bit); 1314 if (res) 1315 err(res, "ta_elf_set_init_fini_info_compat"); 1316 res = ta_elf_set_elf_phdr_info(elf->is_32bit); 1317 if (res) 1318 err(res, "ta_elf_set_elf_phdr_info"); 1319 1320 if (elf->is_legacy) 1321 *entry = elf->head->depr_entry; 1322 else 1323 *entry = elf->e_entry + elf->load_addr; 1324 1325 *load_addr = elf->load_addr; 1326 } 1327 1328 1329 void ta_elf_load_dependency(struct ta_elf *elf, bool is_32bit) 1330 { 1331 if (elf->is_main) 1332 return; 1333 1334 init_elf(elf); 1335 if (elf->is_32bit != is_32bit) 1336 err(TEE_ERROR_BAD_FORMAT, "ELF %pUl is %sbit (expected %sbit)", 1337 (void *)&elf->uuid, elf->is_32bit ? "32" : "64", 1338 is_32bit ? "32" : "64"); 1339 1340 map_segments(elf); 1341 populate_segments(elf); 1342 add_dependencies(elf); 1343 copy_section_headers(elf); 1344 save_symtab(elf); 1345 close_handle(elf); 1346 set_tls_offset(elf); 1347 parse_property_segment(elf); 1348 if (elf->bti_enabled) 1349 ta_elf_add_bti(elf); 1350 } 1351 1352 void ta_elf_finalize_mappings(struct ta_elf *elf) 1353 { 1354 TEE_Result res = TEE_SUCCESS; 1355 struct segment *seg = NULL; 1356 1357 if (!elf->is_legacy) 1358 return; 1359 1360 TAILQ_FOREACH(seg, &elf->segs, link) { 1361 vaddr_t va = elf->load_addr + seg->vaddr; 1362 uint32_t flags = 0; 1363 1364 if (seg->flags & PF_W) 1365 flags |= LDELF_MAP_FLAG_WRITEABLE; 1366 if (seg->flags & PF_X) 1367 flags |= LDELF_MAP_FLAG_EXECUTABLE; 1368 1369 res = sys_set_prot(va, seg->memsz, flags); 1370 if (res) 1371 err(res, "sys_set_prot"); 1372 } 1373 } 1374 1375 static void __printf(3, 4) print_wrapper(void *pctx, print_func_t print_func, 1376 const char *fmt, ...) 1377 { 1378 va_list ap; 1379 1380 va_start(ap, fmt); 1381 print_func(pctx, fmt, ap); 1382 va_end(ap); 1383 } 1384 1385 static void print_seg(void *pctx, print_func_t print_func, 1386 size_t idx __maybe_unused, int elf_idx __maybe_unused, 1387 vaddr_t va __maybe_unused, paddr_t pa __maybe_unused, 1388 size_t sz __maybe_unused, uint32_t flags) 1389 { 1390 int rc __maybe_unused = 0; 1391 int width __maybe_unused = 8; 1392 char desc[14] __maybe_unused = ""; 1393 char flags_str[] __maybe_unused = "----"; 1394 1395 if (elf_idx > -1) { 1396 rc = snprintf(desc, sizeof(desc), " [%d]", elf_idx); 1397 assert(rc >= 0); 1398 } else { 1399 if (flags & DUMP_MAP_EPHEM) { 1400 rc = snprintf(desc, sizeof(desc), " (param)"); 1401 assert(rc >= 0); 1402 } 1403 if (flags & DUMP_MAP_LDELF) { 1404 rc = snprintf(desc, sizeof(desc), " (ldelf)"); 1405 assert(rc >= 0); 1406 } 1407 if (va == ta_stack) { 1408 rc = snprintf(desc, sizeof(desc), " (stack)"); 1409 assert(rc >= 0); 1410 } 1411 } 1412 1413 if (flags & DUMP_MAP_READ) 1414 flags_str[0] = 'r'; 1415 if (flags & DUMP_MAP_WRITE) 1416 flags_str[1] = 'w'; 1417 if (flags & DUMP_MAP_EXEC) 1418 flags_str[2] = 'x'; 1419 if (flags & DUMP_MAP_SECURE) 1420 flags_str[3] = 's'; 1421 1422 print_wrapper(pctx, print_func, 1423 "region %2zu: va 0x%0*"PRIxVA" pa 0x%0*"PRIxPA" size 0x%06zx flags %s%s\n", 1424 idx, width, va, width, pa, sz, flags_str, desc); 1425 } 1426 1427 static bool get_next_in_order(struct ta_elf_queue *elf_queue, 1428 struct ta_elf **elf, struct segment **seg, 1429 size_t *elf_idx) 1430 { 1431 struct ta_elf *e = NULL; 1432 struct segment *s = NULL; 1433 size_t idx = 0; 1434 vaddr_t va = 0; 1435 struct ta_elf *e2 = NULL; 1436 size_t i2 = 0; 1437 1438 assert(elf && seg && elf_idx); 1439 e = *elf; 1440 s = *seg; 1441 assert((e == NULL && s == NULL) || (e != NULL && s != NULL)); 1442 1443 if (s) { 1444 s = TAILQ_NEXT(s, link); 1445 if (s) { 1446 *seg = s; 1447 return true; 1448 } 1449 } 1450 1451 if (e) 1452 va = e->load_addr; 1453 1454 /* Find the ELF with next load address */ 1455 e = NULL; 1456 TAILQ_FOREACH(e2, elf_queue, link) { 1457 if (e2->load_addr > va) { 1458 if (!e || e2->load_addr < e->load_addr) { 1459 e = e2; 1460 idx = i2; 1461 } 1462 } 1463 i2++; 1464 } 1465 if (!e) 1466 return false; 1467 1468 *elf = e; 1469 *seg = TAILQ_FIRST(&e->segs); 1470 *elf_idx = idx; 1471 return true; 1472 } 1473 1474 void ta_elf_print_mappings(void *pctx, print_func_t print_func, 1475 struct ta_elf_queue *elf_queue, size_t num_maps, 1476 struct dump_map *maps, vaddr_t mpool_base) 1477 { 1478 struct segment *seg = NULL; 1479 struct ta_elf *elf = NULL; 1480 size_t elf_idx = 0; 1481 size_t idx = 0; 1482 size_t map_idx = 0; 1483 1484 /* 1485 * Loop over all segments and maps, printing virtual address in 1486 * order. Segment has priority if the virtual address is present 1487 * in both map and segment. 1488 */ 1489 get_next_in_order(elf_queue, &elf, &seg, &elf_idx); 1490 while (true) { 1491 vaddr_t va = -1; 1492 paddr_t pa = -1; 1493 size_t sz = 0; 1494 uint32_t flags = DUMP_MAP_SECURE; 1495 1496 if (seg) { 1497 va = rounddown(seg->vaddr + elf->load_addr); 1498 sz = roundup(seg->vaddr + seg->memsz) - 1499 rounddown(seg->vaddr); 1500 } 1501 1502 while (map_idx < num_maps && maps[map_idx].va <= va) { 1503 uint32_t f = 0; 1504 1505 /* If there's a match, it should be the same map */ 1506 if (maps[map_idx].va == va) { 1507 pa = maps[map_idx].pa; 1508 /* 1509 * In shared libraries the first page is 1510 * mapped separately with the rest of that 1511 * segment following back to back in a 1512 * separate entry. 1513 */ 1514 if (map_idx + 1 < num_maps && 1515 maps[map_idx].sz == SMALL_PAGE_SIZE) { 1516 vaddr_t next_va = maps[map_idx].va + 1517 maps[map_idx].sz; 1518 size_t comb_sz = maps[map_idx].sz + 1519 maps[map_idx + 1].sz; 1520 1521 if (next_va == maps[map_idx + 1].va && 1522 comb_sz == sz && 1523 maps[map_idx].flags == 1524 maps[map_idx + 1].flags) { 1525 /* Skip this and next entry */ 1526 map_idx += 2; 1527 continue; 1528 } 1529 } 1530 assert(maps[map_idx].sz == sz); 1531 } else if (maps[map_idx].va < va) { 1532 if (maps[map_idx].va == mpool_base) 1533 f |= DUMP_MAP_LDELF; 1534 print_seg(pctx, print_func, idx, -1, 1535 maps[map_idx].va, maps[map_idx].pa, 1536 maps[map_idx].sz, 1537 maps[map_idx].flags | f); 1538 idx++; 1539 } 1540 map_idx++; 1541 } 1542 1543 if (!seg) 1544 break; 1545 1546 if (seg->flags & PF_R) 1547 flags |= DUMP_MAP_READ; 1548 if (seg->flags & PF_W) 1549 flags |= DUMP_MAP_WRITE; 1550 if (seg->flags & PF_X) 1551 flags |= DUMP_MAP_EXEC; 1552 1553 print_seg(pctx, print_func, idx, elf_idx, va, pa, sz, flags); 1554 idx++; 1555 1556 if (!get_next_in_order(elf_queue, &elf, &seg, &elf_idx)) 1557 seg = NULL; 1558 } 1559 1560 elf_idx = 0; 1561 TAILQ_FOREACH(elf, elf_queue, link) { 1562 print_wrapper(pctx, print_func, 1563 " [%zu] %pUl @ 0x%0*"PRIxVA"\n", 1564 elf_idx, (void *)&elf->uuid, 8, elf->load_addr); 1565 elf_idx++; 1566 } 1567 } 1568 1569 #ifdef CFG_UNWIND 1570 1571 #if defined(ARM32) || defined(ARM64) 1572 /* Called by libunw */ 1573 bool find_exidx(vaddr_t addr, vaddr_t *idx_start, vaddr_t *idx_end) 1574 { 1575 struct segment *seg = NULL; 1576 struct ta_elf *elf = NULL; 1577 vaddr_t a = 0; 1578 1579 TAILQ_FOREACH(elf, &main_elf_queue, link) { 1580 if (addr < elf->load_addr) 1581 continue; 1582 a = addr - elf->load_addr; 1583 TAILQ_FOREACH(seg, &elf->segs, link) { 1584 if (a < seg->vaddr) 1585 continue; 1586 if (a - seg->vaddr < seg->filesz) { 1587 *idx_start = elf->exidx_start + elf->load_addr; 1588 *idx_end = elf->exidx_start + elf->load_addr + 1589 elf->exidx_size; 1590 return true; 1591 } 1592 } 1593 } 1594 1595 return false; 1596 } 1597 1598 void ta_elf_stack_trace_a32(uint32_t regs[16]) 1599 { 1600 struct unwind_state_arm32 state = { }; 1601 1602 memcpy(state.registers, regs, sizeof(state.registers)); 1603 print_stack_arm32(&state, ta_stack, ta_stack_size); 1604 } 1605 1606 void ta_elf_stack_trace_a64(uint64_t fp, uint64_t sp, uint64_t pc) 1607 { 1608 struct unwind_state_arm64 state = { .fp = fp, .sp = sp, .pc = pc }; 1609 1610 print_stack_arm64(&state, ta_stack, ta_stack_size); 1611 } 1612 #elif defined(RV32) || defined(RV64) 1613 void ta_elf_stack_trace_riscv(uint64_t fp, uint64_t pc) 1614 { 1615 struct unwind_state_riscv state = { .fp = fp, .pc = pc }; 1616 1617 print_stack_riscv(&state, ta_stack, ta_stack_size); 1618 } 1619 #endif 1620 1621 #endif /* CFG_UNWIND */ 1622 1623 TEE_Result ta_elf_add_library(const TEE_UUID *uuid) 1624 { 1625 TEE_Result res = TEE_ERROR_GENERIC; 1626 struct ta_elf *ta = TAILQ_FIRST(&main_elf_queue); 1627 struct ta_elf *lib = ta_elf_find_elf(uuid); 1628 struct ta_elf *elf = NULL; 1629 1630 if (lib) 1631 return TEE_SUCCESS; /* Already mapped */ 1632 1633 lib = queue_elf_helper(uuid); 1634 if (!lib) 1635 return TEE_ERROR_OUT_OF_MEMORY; 1636 1637 for (elf = lib; elf; elf = TAILQ_NEXT(elf, link)) 1638 ta_elf_load_dependency(elf, ta->is_32bit); 1639 1640 for (elf = lib; elf; elf = TAILQ_NEXT(elf, link)) { 1641 ta_elf_relocate(elf); 1642 ta_elf_finalize_mappings(elf); 1643 } 1644 1645 for (elf = lib; elf; elf = TAILQ_NEXT(elf, link)) { 1646 if (IS_ENABLED(CFG_TA_SANITIZE_KADDRESS)) { 1647 int rc; 1648 1649 rc = asan_user_map_shadow((void *)elf->load_addr, 1650 (void *)elf->max_addr, 1651 ASAN_REG_ELF); 1652 if (rc) { 1653 EMSG("Failed to map shadow for ELF (%pUl)", 1654 (void *)&elf->uuid); 1655 panic(); 1656 } 1657 } 1658 DMSG("ELF (%pUl) at %#"PRIxVA, 1659 (void *)&elf->uuid, elf->load_addr); 1660 } 1661 1662 res = ta_elf_set_init_fini_info_compat(ta->is_32bit); 1663 if (res) 1664 return res; 1665 1666 return ta_elf_set_elf_phdr_info(ta->is_32bit); 1667 } 1668 1669 /* Get address/size of .init_array and .fini_array from the dynamic segment */ 1670 static void get_init_fini_array(struct ta_elf *elf, unsigned int type, 1671 vaddr_t addr, size_t memsz, vaddr_t *init, 1672 size_t *init_cnt, vaddr_t *fini, 1673 size_t *fini_cnt) 1674 { 1675 size_t addrsz = 0; 1676 size_t dyn_entsize = 0; 1677 size_t num_dyns = 0; 1678 size_t n = 0; 1679 unsigned int tag = 0; 1680 size_t val = 0; 1681 1682 assert(type == PT_DYNAMIC); 1683 1684 check_phdr_in_range(elf, type, addr, memsz); 1685 1686 if (elf->is_32bit) { 1687 dyn_entsize = sizeof(Elf32_Dyn); 1688 addrsz = 4; 1689 } else { 1690 dyn_entsize = sizeof(Elf64_Dyn); 1691 addrsz = 8; 1692 } 1693 1694 assert(!(memsz % dyn_entsize)); 1695 num_dyns = memsz / dyn_entsize; 1696 1697 for (n = 0; n < num_dyns; n++) { 1698 read_dyn(elf, addr, n, &tag, &val); 1699 if (tag == DT_INIT_ARRAY) 1700 *init = val + elf->load_addr; 1701 else if (tag == DT_FINI_ARRAY) 1702 *fini = val + elf->load_addr; 1703 else if (tag == DT_INIT_ARRAYSZ) 1704 *init_cnt = val / addrsz; 1705 else if (tag == DT_FINI_ARRAYSZ) 1706 *fini_cnt = val / addrsz; 1707 } 1708 } 1709 1710 /* Get address/size of .init_array and .fini_array in @elf (if present) */ 1711 static void elf_get_init_fini_array(struct ta_elf *elf, vaddr_t *init, 1712 size_t *init_cnt, vaddr_t *fini, 1713 size_t *fini_cnt) 1714 { 1715 size_t n = 0; 1716 1717 if (elf->is_32bit) { 1718 Elf32_Phdr *phdr = elf->phdr; 1719 1720 for (n = 0; n < elf->e_phnum; n++) { 1721 if (phdr[n].p_type == PT_DYNAMIC) { 1722 get_init_fini_array(elf, phdr[n].p_type, 1723 phdr[n].p_vaddr, 1724 phdr[n].p_memsz, 1725 init, init_cnt, fini, 1726 fini_cnt); 1727 return; 1728 } 1729 } 1730 } else { 1731 Elf64_Phdr *phdr = elf->phdr; 1732 1733 for (n = 0; n < elf->e_phnum; n++) { 1734 if (phdr[n].p_type == PT_DYNAMIC) { 1735 get_init_fini_array(elf, phdr[n].p_type, 1736 phdr[n].p_vaddr, 1737 phdr[n].p_memsz, 1738 init, init_cnt, fini, 1739 fini_cnt); 1740 return; 1741 } 1742 } 1743 } 1744 } 1745 1746 /* 1747 * Deprecated by __elf_phdr_info below. Kept for compatibility. 1748 * 1749 * Pointers to ELF initialization and finalization functions are extracted by 1750 * ldelf and stored on the TA heap, then exported to the TA via the global 1751 * symbol __init_fini_info. libutee in OP-TEE 3.9.0 uses this mechanism. 1752 */ 1753 1754 struct __init_fini { 1755 uint32_t flags; 1756 uint16_t init_size; 1757 uint16_t fini_size; 1758 1759 void (**init)(void); /* @init_size entries */ 1760 void (**fini)(void); /* @fini_size entries */ 1761 }; 1762 1763 #define __IFS_VALID BIT(0) 1764 #define __IFS_INIT_HAS_RUN BIT(1) 1765 #define __IFS_FINI_HAS_RUN BIT(2) 1766 1767 struct __init_fini_info { 1768 uint32_t reserved; 1769 uint16_t size; 1770 uint16_t pad; 1771 struct __init_fini *ifs; /* @size entries */ 1772 }; 1773 1774 /* 32-bit variants for a 64-bit ldelf to access a 32-bit TA */ 1775 1776 struct __init_fini32 { 1777 uint32_t flags; 1778 uint16_t init_size; 1779 uint16_t fini_size; 1780 uint32_t init; 1781 uint32_t fini; 1782 }; 1783 1784 struct __init_fini_info32 { 1785 uint32_t reserved; 1786 uint16_t size; 1787 uint16_t pad; 1788 uint32_t ifs; 1789 }; 1790 1791 static TEE_Result realloc_ifs(vaddr_t va, size_t cnt, bool is_32bit) 1792 { 1793 struct __init_fini_info32 *info32 = (struct __init_fini_info32 *)va; 1794 struct __init_fini_info *info = (struct __init_fini_info *)va; 1795 struct __init_fini32 *ifs32 = NULL; 1796 struct __init_fini *ifs = NULL; 1797 size_t prev_cnt = 0; 1798 void *ptr = NULL; 1799 1800 if (is_32bit) { 1801 ptr = (void *)(vaddr_t)info32->ifs; 1802 ptr = realloc(ptr, cnt * sizeof(struct __init_fini32)); 1803 if (!ptr) 1804 return TEE_ERROR_OUT_OF_MEMORY; 1805 ifs32 = ptr; 1806 prev_cnt = info32->size; 1807 if (cnt > prev_cnt) 1808 memset(ifs32 + prev_cnt, 0, 1809 (cnt - prev_cnt) * sizeof(*ifs32)); 1810 info32->ifs = (uint32_t)(vaddr_t)ifs32; 1811 info32->size = cnt; 1812 } else { 1813 ptr = realloc(info->ifs, cnt * sizeof(struct __init_fini)); 1814 if (!ptr) 1815 return TEE_ERROR_OUT_OF_MEMORY; 1816 ifs = ptr; 1817 prev_cnt = info->size; 1818 if (cnt > prev_cnt) 1819 memset(ifs + prev_cnt, 0, 1820 (cnt - prev_cnt) * sizeof(*ifs)); 1821 info->ifs = ifs; 1822 info->size = cnt; 1823 } 1824 1825 return TEE_SUCCESS; 1826 } 1827 1828 static void fill_ifs(vaddr_t va, size_t idx, struct ta_elf *elf, bool is_32bit) 1829 { 1830 struct __init_fini_info32 *info32 = (struct __init_fini_info32 *)va; 1831 struct __init_fini_info *info = (struct __init_fini_info *)va; 1832 struct __init_fini32 *ifs32 = NULL; 1833 struct __init_fini *ifs = NULL; 1834 size_t init_cnt = 0; 1835 size_t fini_cnt = 0; 1836 vaddr_t init = 0; 1837 vaddr_t fini = 0; 1838 1839 if (is_32bit) { 1840 assert(idx < info32->size); 1841 ifs32 = &((struct __init_fini32 *)(vaddr_t)info32->ifs)[idx]; 1842 1843 if (ifs32->flags & __IFS_VALID) 1844 return; 1845 1846 elf_get_init_fini_array(elf, &init, &init_cnt, &fini, 1847 &fini_cnt); 1848 1849 ifs32->init = (uint32_t)init; 1850 ifs32->init_size = init_cnt; 1851 1852 ifs32->fini = (uint32_t)fini; 1853 ifs32->fini_size = fini_cnt; 1854 1855 ifs32->flags |= __IFS_VALID; 1856 } else { 1857 assert(idx < info->size); 1858 ifs = &info->ifs[idx]; 1859 1860 if (ifs->flags & __IFS_VALID) 1861 return; 1862 1863 elf_get_init_fini_array(elf, &init, &init_cnt, &fini, 1864 &fini_cnt); 1865 1866 ifs->init = (void (**)(void))init; 1867 ifs->init_size = init_cnt; 1868 1869 ifs->fini = (void (**)(void))fini; 1870 ifs->fini_size = fini_cnt; 1871 1872 ifs->flags |= __IFS_VALID; 1873 } 1874 } 1875 1876 /* 1877 * Set or update __init_fini_info in the TA with information from the ELF 1878 * queue 1879 */ 1880 TEE_Result ta_elf_set_init_fini_info_compat(bool is_32bit) 1881 { 1882 struct __init_fini_info *info = NULL; 1883 TEE_Result res = TEE_SUCCESS; 1884 struct ta_elf *elf = NULL; 1885 vaddr_t info_va = 0; 1886 size_t cnt = 0; 1887 1888 res = ta_elf_resolve_sym("__init_fini_info", &info_va, NULL, NULL); 1889 if (res) { 1890 if (res == TEE_ERROR_ITEM_NOT_FOUND) { 1891 /* 1892 * Not an error, only TAs linked against libutee from 1893 * OP-TEE 3.9.0 have this symbol. 1894 */ 1895 return TEE_SUCCESS; 1896 } 1897 return res; 1898 } 1899 assert(info_va); 1900 1901 info = (struct __init_fini_info *)info_va; 1902 if (info->reserved) 1903 return TEE_ERROR_NOT_SUPPORTED; 1904 1905 TAILQ_FOREACH(elf, &main_elf_queue, link) 1906 cnt++; 1907 1908 /* Queue has at least one file (main) */ 1909 assert(cnt); 1910 1911 res = realloc_ifs(info_va, cnt, is_32bit); 1912 if (res) 1913 goto err; 1914 1915 cnt = 0; 1916 TAILQ_FOREACH(elf, &main_elf_queue, link) { 1917 fill_ifs(info_va, cnt, elf, is_32bit); 1918 cnt++; 1919 } 1920 1921 return TEE_SUCCESS; 1922 err: 1923 free(info); 1924 return res; 1925 } 1926 1927 static TEE_Result realloc_elf_phdr_info(vaddr_t va, size_t cnt, bool is_32bit) 1928 { 1929 struct __elf_phdr_info32 *info32 = (struct __elf_phdr_info32 *)va; 1930 struct __elf_phdr_info *info = (struct __elf_phdr_info *)va; 1931 struct dl_phdr_info32 *dlpi32 = NULL; 1932 struct dl_phdr_info *dlpi = NULL; 1933 size_t prev_cnt = 0; 1934 void *ptr = NULL; 1935 1936 if (is_32bit) { 1937 ptr = (void *)(vaddr_t)info32->dlpi; 1938 ptr = realloc(ptr, cnt * sizeof(*dlpi32)); 1939 if (!ptr) 1940 return TEE_ERROR_OUT_OF_MEMORY; 1941 dlpi32 = ptr; 1942 prev_cnt = info32->count; 1943 if (cnt > prev_cnt) 1944 memset(dlpi32 + prev_cnt, 0, 1945 (cnt - prev_cnt) * sizeof(*dlpi32)); 1946 info32->dlpi = (uint32_t)(vaddr_t)dlpi32; 1947 info32->count = cnt; 1948 } else { 1949 ptr = realloc(info->dlpi, cnt * sizeof(*dlpi)); 1950 if (!ptr) 1951 return TEE_ERROR_OUT_OF_MEMORY; 1952 dlpi = ptr; 1953 prev_cnt = info->count; 1954 if (cnt > prev_cnt) 1955 memset(dlpi + prev_cnt, 0, 1956 (cnt - prev_cnt) * sizeof(*dlpi)); 1957 info->dlpi = dlpi; 1958 info->count = cnt; 1959 } 1960 1961 return TEE_SUCCESS; 1962 } 1963 1964 static void fill_elf_phdr_info(vaddr_t va, size_t idx, struct ta_elf *elf, 1965 bool is_32bit) 1966 { 1967 struct __elf_phdr_info32 *info32 = (struct __elf_phdr_info32 *)va; 1968 struct __elf_phdr_info *info = (struct __elf_phdr_info *)va; 1969 struct dl_phdr_info32 *dlpi32 = NULL; 1970 struct dl_phdr_info *dlpi = NULL; 1971 1972 if (is_32bit) { 1973 assert(idx < info32->count); 1974 dlpi32 = (struct dl_phdr_info32 *)(vaddr_t)info32->dlpi + idx; 1975 1976 dlpi32->dlpi_addr = elf->load_addr; 1977 if (elf->soname) 1978 dlpi32->dlpi_name = (vaddr_t)elf->soname; 1979 else 1980 dlpi32->dlpi_name = (vaddr_t)&info32->zero; 1981 dlpi32->dlpi_phdr = (vaddr_t)elf->phdr; 1982 dlpi32->dlpi_phnum = elf->e_phnum; 1983 dlpi32->dlpi_adds = 1; /* No unloading on dlclose() currently */ 1984 dlpi32->dlpi_subs = 0; /* No unloading on dlclose() currently */ 1985 dlpi32->dlpi_tls_modid = elf->tls_mod_id; 1986 dlpi32->dlpi_tls_data = elf->tls_start; 1987 } else { 1988 assert(idx < info->count); 1989 dlpi = info->dlpi + idx; 1990 1991 dlpi->dlpi_addr = elf->load_addr; 1992 if (elf->soname) 1993 dlpi->dlpi_name = elf->soname; 1994 else 1995 dlpi->dlpi_name = &info32->zero; 1996 dlpi->dlpi_phdr = elf->phdr; 1997 dlpi->dlpi_phnum = elf->e_phnum; 1998 dlpi->dlpi_adds = 1; /* No unloading on dlclose() currently */ 1999 dlpi->dlpi_subs = 0; /* No unloading on dlclose() currently */ 2000 dlpi->dlpi_tls_modid = elf->tls_mod_id; 2001 dlpi->dlpi_tls_data = (void *)elf->tls_start; 2002 } 2003 } 2004 2005 /* Set or update __elf_hdr_info in the TA with information from the ELF queue */ 2006 TEE_Result ta_elf_set_elf_phdr_info(bool is_32bit) 2007 { 2008 struct __elf_phdr_info *info = NULL; 2009 TEE_Result res = TEE_SUCCESS; 2010 struct ta_elf *elf = NULL; 2011 vaddr_t info_va = 0; 2012 size_t cnt = 0; 2013 2014 res = ta_elf_resolve_sym("__elf_phdr_info", &info_va, NULL, NULL); 2015 if (res) { 2016 if (res == TEE_ERROR_ITEM_NOT_FOUND) { 2017 /* Older TA */ 2018 return TEE_SUCCESS; 2019 } 2020 return res; 2021 } 2022 assert(info_va); 2023 2024 info = (struct __elf_phdr_info *)info_va; 2025 if (info->reserved) 2026 return TEE_ERROR_NOT_SUPPORTED; 2027 2028 TAILQ_FOREACH(elf, &main_elf_queue, link) 2029 cnt++; 2030 2031 res = realloc_elf_phdr_info(info_va, cnt, is_32bit); 2032 if (res) 2033 return res; 2034 2035 cnt = 0; 2036 TAILQ_FOREACH(elf, &main_elf_queue, link) { 2037 fill_elf_phdr_info(info_va, cnt, elf, is_32bit); 2038 cnt++; 2039 } 2040 2041 return TEE_SUCCESS; 2042 } 2043