xref: /optee_os/ldelf/ta_elf.c (revision 5f7f88c6b9d618d1e068166bbf2b07757350791d)
1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3  * Copyright (c) 2019, Linaro Limited
4  * Copyright (c) 2020-2023, Arm Limited
5  */
6 
7 #include <assert.h>
8 #include <config.h>
9 #include <confine_array_index.h>
10 #include <ctype.h>
11 #include <elf32.h>
12 #include <elf64.h>
13 #include <elf_common.h>
14 #include <ldelf.h>
15 #include <link.h>
16 #include <stdio.h>
17 #include <stdlib.h>
18 #include <string_ext.h>
19 #include <string.h>
20 #include <tee_api_types.h>
21 #include <tee_internal_api_extensions.h>
22 #include <unw/unwind.h>
23 #include <user_ta_header.h>
24 #include <util.h>
25 
26 #include "sys.h"
27 #include "ta_elf.h"
28 
29 /*
30  * Layout of a 32-bit struct dl_phdr_info for a 64-bit ldelf to access a 32-bit
31  * TA
32  */
33 struct dl_phdr_info32 {
34 	uint32_t dlpi_addr;
35 	uint32_t dlpi_name;
36 	uint32_t dlpi_phdr;
37 	uint16_t dlpi_phnum;
38 	uint64_t dlpi_adds;
39 	uint64_t dlpi_subs;
40 	uint32_t dlpi_tls_modid;
41 	uint32_t dlpi_tls_data;
42 };
43 
44 static vaddr_t ta_stack;
45 static vaddr_t ta_stack_size;
46 
47 struct ta_elf_queue main_elf_queue = TAILQ_HEAD_INITIALIZER(main_elf_queue);
48 
49 /*
50  * Main application is always ID 1, shared libraries with TLS take IDs 2 and
51  * above
52  */
53 static void assign_tls_mod_id(struct ta_elf *elf)
54 {
55 	static size_t last_tls_mod_id = 1;
56 
57 	if (elf->is_main)
58 		assert(last_tls_mod_id == 1); /* Main always comes first */
59 	elf->tls_mod_id = last_tls_mod_id++;
60 }
61 
62 static struct ta_elf *queue_elf_helper(const TEE_UUID *uuid)
63 {
64 	struct ta_elf *elf = calloc(1, sizeof(*elf));
65 
66 	if (!elf)
67 		return NULL;
68 
69 	TAILQ_INIT(&elf->segs);
70 
71 	elf->uuid = *uuid;
72 	TAILQ_INSERT_TAIL(&main_elf_queue, elf, link);
73 	return elf;
74 }
75 
76 static struct ta_elf *queue_elf(const TEE_UUID *uuid)
77 {
78 	struct ta_elf *elf = ta_elf_find_elf(uuid);
79 
80 	if (elf)
81 		return NULL;
82 
83 	elf = queue_elf_helper(uuid);
84 	if (!elf)
85 		err(TEE_ERROR_OUT_OF_MEMORY, "queue_elf_helper");
86 
87 	return elf;
88 }
89 
90 struct ta_elf *ta_elf_find_elf(const TEE_UUID *uuid)
91 {
92 	struct ta_elf *elf = NULL;
93 
94 	TAILQ_FOREACH(elf, &main_elf_queue, link)
95 		if (!memcmp(uuid, &elf->uuid, sizeof(*uuid)))
96 			return elf;
97 
98 	return NULL;
99 }
100 
101 #if defined(ARM32) || defined(ARM64)
102 static TEE_Result e32_parse_ehdr(struct ta_elf *elf, Elf32_Ehdr *ehdr)
103 {
104 	if (ehdr->e_ident[EI_VERSION] != EV_CURRENT ||
105 	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
106 	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
107 	    (ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE &&
108 	     ehdr->e_ident[EI_OSABI] != ELFOSABI_ARM) ||
109 	    ehdr->e_type != ET_DYN || ehdr->e_machine != EM_ARM ||
110 #ifndef CFG_WITH_VFP
111 	    (ehdr->e_flags & EF_ARM_ABI_FLOAT_HARD) ||
112 #endif
113 	    ehdr->e_phentsize != sizeof(Elf32_Phdr) ||
114 	    ehdr->e_shentsize != sizeof(Elf32_Shdr))
115 		return TEE_ERROR_BAD_FORMAT;
116 
117 	if (ehdr->e_ident[EI_OSABI] == ELFOSABI_NONE &&
118 	    (ehdr->e_flags & EF_ARM_ABIMASK) != EF_ARM_ABI_V5)
119 		return TEE_ERROR_BAD_FORMAT;
120 
121 	if (ehdr->e_ident[EI_OSABI] == ELFOSABI_ARM &&
122 	    (ehdr->e_flags & EF_ARM_ABIMASK) != EF_ARM_ABI_UNKNOWN)
123 		return TEE_ERROR_BAD_FORMAT;
124 
125 	elf->is_32bit = true;
126 	elf->e_entry = ehdr->e_entry;
127 	elf->e_phoff = ehdr->e_phoff;
128 	elf->e_shoff = ehdr->e_shoff;
129 	elf->e_phnum = ehdr->e_phnum;
130 	elf->e_shnum = ehdr->e_shnum;
131 	elf->e_phentsize = ehdr->e_phentsize;
132 	elf->e_shentsize = ehdr->e_shentsize;
133 
134 	return TEE_SUCCESS;
135 }
136 
137 #ifdef ARM64
138 static TEE_Result e64_parse_ehdr(struct ta_elf *elf, Elf64_Ehdr *ehdr)
139 {
140 	if (ehdr->e_ident[EI_VERSION] != EV_CURRENT ||
141 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
142 	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
143 	    ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE ||
144 	    ehdr->e_type != ET_DYN || ehdr->e_machine != EM_AARCH64 ||
145 	    ehdr->e_flags || ehdr->e_phentsize != sizeof(Elf64_Phdr) ||
146 	    ehdr->e_shentsize != sizeof(Elf64_Shdr))
147 		return TEE_ERROR_BAD_FORMAT;
148 
149 
150 	elf->is_32bit = false;
151 	elf->e_entry = ehdr->e_entry;
152 	elf->e_phoff = ehdr->e_phoff;
153 	elf->e_shoff = ehdr->e_shoff;
154 	elf->e_phnum = ehdr->e_phnum;
155 	elf->e_shnum = ehdr->e_shnum;
156 	elf->e_phentsize = ehdr->e_phentsize;
157 	elf->e_shentsize = ehdr->e_shentsize;
158 
159 	return TEE_SUCCESS;
160 }
161 #else /*ARM64*/
162 static TEE_Result e64_parse_ehdr(struct ta_elf *elf __unused,
163 				 Elf64_Ehdr *ehdr __unused)
164 {
165 	return TEE_ERROR_NOT_SUPPORTED;
166 }
167 #endif /*ARM64*/
168 #endif /* ARM32 || ARM64 */
169 
170 #if defined(RV64)
171 static TEE_Result e32_parse_ehdr(struct ta_elf *elf __unused,
172 				 Elf32_Ehdr *ehdr __unused)
173 {
174 		return TEE_ERROR_BAD_FORMAT;
175 }
176 
177 static TEE_Result e64_parse_ehdr(struct ta_elf *elf, Elf64_Ehdr *ehdr)
178 {
179 	if (ehdr->e_ident[EI_VERSION] != EV_CURRENT ||
180 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
181 	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
182 	    ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE ||
183 	    ehdr->e_type != ET_DYN || ehdr->e_machine != EM_RISCV ||
184 	    ehdr->e_phentsize != sizeof(Elf64_Phdr) ||
185 	    ehdr->e_shentsize != sizeof(Elf64_Shdr))
186 		return TEE_ERROR_BAD_FORMAT;
187 
188 	elf->is_32bit = false;
189 	elf->e_entry = ehdr->e_entry;
190 	elf->e_phoff = ehdr->e_phoff;
191 	elf->e_shoff = ehdr->e_shoff;
192 	elf->e_phnum = ehdr->e_phnum;
193 	elf->e_shnum = ehdr->e_shnum;
194 	elf->e_phentsize = ehdr->e_phentsize;
195 	elf->e_shentsize = ehdr->e_shentsize;
196 
197 	return TEE_SUCCESS;
198 }
199 #endif /* RV64 */
200 
201 static void check_phdr_in_range(struct ta_elf *elf, unsigned int type,
202 				vaddr_t addr, size_t memsz)
203 {
204 	vaddr_t max_addr = 0;
205 
206 	if (ADD_OVERFLOW(addr, memsz, &max_addr))
207 		err(TEE_ERROR_BAD_FORMAT, "Program header %#x overflow", type);
208 
209 	/*
210 	 * elf->load_addr and elf->max_addr are both using the
211 	 * final virtual addresses, while this program header is
212 	 * relative to 0.
213 	 */
214 	if (max_addr > elf->max_addr - elf->load_addr)
215 		err(TEE_ERROR_BAD_FORMAT, "Program header %#x out of bounds",
216 		    type);
217 }
218 
219 static void read_dyn(struct ta_elf *elf, vaddr_t addr,
220 		     size_t idx, unsigned int *tag, size_t *val)
221 {
222 	if (elf->is_32bit) {
223 		Elf32_Dyn *dyn = (Elf32_Dyn *)(addr + elf->load_addr);
224 
225 		*tag = dyn[idx].d_tag;
226 		*val = dyn[idx].d_un.d_val;
227 	} else {
228 		Elf64_Dyn *dyn = (Elf64_Dyn *)(addr + elf->load_addr);
229 
230 		*tag = dyn[idx].d_tag;
231 		*val = dyn[idx].d_un.d_val;
232 	}
233 }
234 
235 static void check_range(struct ta_elf *elf, const char *name, const void *ptr,
236 			size_t sz)
237 {
238 	size_t max_addr = 0;
239 
240 	if ((vaddr_t)ptr < elf->load_addr)
241 		err(TEE_ERROR_BAD_FORMAT, "%s %p out of range", name, ptr);
242 
243 	if (ADD_OVERFLOW((vaddr_t)ptr, sz, &max_addr))
244 		err(TEE_ERROR_BAD_FORMAT, "%s range overflow", name);
245 
246 	if (max_addr > elf->max_addr)
247 		err(TEE_ERROR_BAD_FORMAT,
248 		    "%s %p..%#zx out of range", name, ptr, max_addr);
249 }
250 
251 static void check_hashtab(struct ta_elf *elf, void *ptr, size_t num_buckets,
252 			  size_t num_chains)
253 {
254 	/*
255 	 * Starting from 2 as the first two words are mandatory and hold
256 	 * num_buckets and num_chains. So this function is called twice,
257 	 * first to see that there's indeed room for num_buckets and
258 	 * num_chains and then to see that all of it fits.
259 	 * See http://www.sco.com/developers/gabi/latest/ch5.dynamic.html#hash
260 	 */
261 	size_t num_words = 2;
262 	size_t sz = 0;
263 
264 	if (!IS_ALIGNED_WITH_TYPE(ptr, uint32_t))
265 		err(TEE_ERROR_BAD_FORMAT, "Bad alignment of DT_HASH %p", ptr);
266 
267 	if (ADD_OVERFLOW(num_words, num_buckets, &num_words) ||
268 	    ADD_OVERFLOW(num_words, num_chains, &num_words) ||
269 	    MUL_OVERFLOW(num_words, sizeof(uint32_t), &sz))
270 		err(TEE_ERROR_BAD_FORMAT, "DT_HASH overflow");
271 
272 	check_range(elf, "DT_HASH", ptr, sz);
273 }
274 
275 static void check_gnu_hashtab(struct ta_elf *elf, void *ptr)
276 {
277 	struct gnu_hashtab *h = ptr;
278 	size_t num_words = 4; /* nbuckets, symoffset, bloom_size, bloom_shift */
279 	size_t bloom_words = 0;
280 	size_t sz = 0;
281 
282 	if (!IS_ALIGNED_WITH_TYPE(ptr, uint32_t))
283 		err(TEE_ERROR_BAD_FORMAT, "Bad alignment of DT_GNU_HASH %p",
284 		    ptr);
285 
286 	if (elf->gnu_hashtab_size < sizeof(*h))
287 		err(TEE_ERROR_BAD_FORMAT, "DT_GNU_HASH too small");
288 
289 	/* Check validity of h->nbuckets and h->bloom_size */
290 
291 	if (elf->is_32bit)
292 		bloom_words = h->bloom_size;
293 	else
294 		bloom_words = h->bloom_size * 2;
295 	if (ADD_OVERFLOW(num_words, h->nbuckets, &num_words) ||
296 	    ADD_OVERFLOW(num_words, bloom_words, &num_words) ||
297 	    MUL_OVERFLOW(num_words, sizeof(uint32_t), &sz) ||
298 	    sz > elf->gnu_hashtab_size)
299 		err(TEE_ERROR_BAD_FORMAT, "DT_GNU_HASH overflow");
300 }
301 
302 static void save_hashtab(struct ta_elf *elf)
303 {
304 	uint32_t *hashtab = NULL;
305 	size_t n = 0;
306 
307 	if (elf->is_32bit) {
308 		Elf32_Shdr *shdr = elf->shdr;
309 
310 		for (n = 0; n < elf->e_shnum; n++) {
311 			void *addr = (void *)(vaddr_t)(shdr[n].sh_addr +
312 						       elf->load_addr);
313 
314 			if (shdr[n].sh_type == SHT_HASH) {
315 				elf->hashtab = addr;
316 			} else if (shdr[n].sh_type == SHT_GNU_HASH) {
317 				elf->gnu_hashtab = addr;
318 				elf->gnu_hashtab_size = shdr[n].sh_size;
319 			}
320 		}
321 	} else {
322 		Elf64_Shdr *shdr = elf->shdr;
323 
324 		for (n = 0; n < elf->e_shnum; n++) {
325 			void *addr = (void *)(vaddr_t)(shdr[n].sh_addr +
326 						       elf->load_addr);
327 
328 			if (shdr[n].sh_type == SHT_HASH) {
329 				elf->hashtab = addr;
330 			} else if (shdr[n].sh_type == SHT_GNU_HASH) {
331 				elf->gnu_hashtab = addr;
332 				elf->gnu_hashtab_size = shdr[n].sh_size;
333 			}
334 		}
335 	}
336 
337 	if (elf->hashtab) {
338 		check_hashtab(elf, elf->hashtab, 0, 0);
339 		hashtab = elf->hashtab;
340 		check_hashtab(elf, elf->hashtab, hashtab[0], hashtab[1]);
341 	}
342 	if (elf->gnu_hashtab)
343 		check_gnu_hashtab(elf, elf->gnu_hashtab);
344 }
345 
346 static void save_soname_from_segment(struct ta_elf *elf, unsigned int type,
347 				     vaddr_t addr, size_t memsz)
348 {
349 	size_t dyn_entsize = 0;
350 	size_t num_dyns = 0;
351 	size_t n = 0;
352 	unsigned int tag = 0;
353 	size_t val = 0;
354 	char *str_tab = NULL;
355 
356 	if (type != PT_DYNAMIC)
357 		return;
358 
359 	if (elf->is_32bit)
360 		dyn_entsize = sizeof(Elf32_Dyn);
361 	else
362 		dyn_entsize = sizeof(Elf64_Dyn);
363 
364 	assert(!(memsz % dyn_entsize));
365 	num_dyns = memsz / dyn_entsize;
366 
367 	for (n = 0; n < num_dyns; n++) {
368 		read_dyn(elf, addr, n, &tag, &val);
369 		if (tag == DT_STRTAB) {
370 			str_tab = (char *)(val + elf->load_addr);
371 			break;
372 		}
373 	}
374 	for (n = 0; n < num_dyns; n++) {
375 		read_dyn(elf, addr, n, &tag, &val);
376 		if (tag == DT_SONAME) {
377 			elf->soname = str_tab + val;
378 			break;
379 		}
380 	}
381 }
382 
383 static void save_soname(struct ta_elf *elf)
384 {
385 	size_t n = 0;
386 
387 	if (elf->is_32bit) {
388 		Elf32_Phdr *phdr = elf->phdr;
389 
390 		for (n = 0; n < elf->e_phnum; n++)
391 			save_soname_from_segment(elf, phdr[n].p_type,
392 						 phdr[n].p_vaddr,
393 						 phdr[n].p_memsz);
394 	} else {
395 		Elf64_Phdr *phdr = elf->phdr;
396 
397 		for (n = 0; n < elf->e_phnum; n++)
398 			save_soname_from_segment(elf, phdr[n].p_type,
399 						 phdr[n].p_vaddr,
400 						 phdr[n].p_memsz);
401 	}
402 }
403 
404 static void e32_save_symtab(struct ta_elf *elf, size_t tab_idx)
405 {
406 	Elf32_Shdr *shdr = elf->shdr;
407 	size_t str_idx = shdr[tab_idx].sh_link;
408 
409 	elf->dynsymtab = (void *)(shdr[tab_idx].sh_addr + elf->load_addr);
410 	if (!IS_ALIGNED_WITH_TYPE(elf->dynsymtab, Elf32_Sym))
411 		err(TEE_ERROR_BAD_FORMAT, "Bad alignment of dynsymtab %p",
412 		    elf->dynsymtab);
413 	check_range(elf, "Dynsymtab", elf->dynsymtab, shdr[tab_idx].sh_size);
414 
415 	if (shdr[tab_idx].sh_size % sizeof(Elf32_Sym))
416 		err(TEE_ERROR_BAD_FORMAT,
417 		    "Size of dynsymtab not an even multiple of Elf32_Sym");
418 	elf->num_dynsyms = shdr[tab_idx].sh_size / sizeof(Elf32_Sym);
419 
420 	if (str_idx >= elf->e_shnum)
421 		err(TEE_ERROR_BAD_FORMAT, "Dynstr section index out of range");
422 	elf->dynstr = (void *)(shdr[str_idx].sh_addr + elf->load_addr);
423 	check_range(elf, "Dynstr", elf->dynstr, shdr[str_idx].sh_size);
424 
425 	elf->dynstr_size = shdr[str_idx].sh_size;
426 }
427 
428 static void e64_save_symtab(struct ta_elf *elf, size_t tab_idx)
429 {
430 	Elf64_Shdr *shdr = elf->shdr;
431 	size_t str_idx = shdr[tab_idx].sh_link;
432 
433 	elf->dynsymtab = (void *)(vaddr_t)(shdr[tab_idx].sh_addr +
434 					   elf->load_addr);
435 
436 	if (!IS_ALIGNED_WITH_TYPE(elf->dynsymtab, Elf64_Sym))
437 		err(TEE_ERROR_BAD_FORMAT, "Bad alignment of .dynsym/DYNSYM %p",
438 		    elf->dynsymtab);
439 	check_range(elf, ".dynsym/DYNSYM", elf->dynsymtab,
440 		    shdr[tab_idx].sh_size);
441 
442 	if (shdr[tab_idx].sh_size % sizeof(Elf64_Sym))
443 		err(TEE_ERROR_BAD_FORMAT,
444 		    "Size of .dynsym/DYNSYM not an even multiple of Elf64_Sym");
445 	elf->num_dynsyms = shdr[tab_idx].sh_size / sizeof(Elf64_Sym);
446 
447 	if (str_idx >= elf->e_shnum)
448 		err(TEE_ERROR_BAD_FORMAT,
449 		    ".dynstr/STRTAB section index out of range");
450 	elf->dynstr = (void *)(vaddr_t)(shdr[str_idx].sh_addr + elf->load_addr);
451 	check_range(elf, ".dynstr/STRTAB", elf->dynstr, shdr[str_idx].sh_size);
452 
453 	elf->dynstr_size = shdr[str_idx].sh_size;
454 }
455 
456 static void save_symtab(struct ta_elf *elf)
457 {
458 	size_t n = 0;
459 
460 	if (elf->is_32bit) {
461 		Elf32_Shdr *shdr = elf->shdr;
462 
463 		for (n = 0; n < elf->e_shnum; n++) {
464 			if (shdr[n].sh_type == SHT_DYNSYM) {
465 				e32_save_symtab(elf, n);
466 				break;
467 			}
468 		}
469 	} else {
470 		Elf64_Shdr *shdr = elf->shdr;
471 
472 		for (n = 0; n < elf->e_shnum; n++) {
473 			if (shdr[n].sh_type == SHT_DYNSYM) {
474 				e64_save_symtab(elf, n);
475 				break;
476 			}
477 		}
478 
479 	}
480 
481 	save_hashtab(elf);
482 	save_soname(elf);
483 }
484 
485 static void init_elf(struct ta_elf *elf)
486 {
487 	TEE_Result res = TEE_SUCCESS;
488 	vaddr_t va = 0;
489 	uint32_t flags = LDELF_MAP_FLAG_SHAREABLE;
490 	size_t sz = 0;
491 
492 	res = sys_open_ta_bin(&elf->uuid, &elf->handle);
493 	if (res)
494 		err(res, "sys_open_ta_bin(%pUl)", (void *)&elf->uuid);
495 
496 	/*
497 	 * Map it read-only executable when we're loading a library where
498 	 * the ELF header is included in a load segment.
499 	 */
500 	if (!elf->is_main)
501 		flags |= LDELF_MAP_FLAG_EXECUTABLE;
502 	res = sys_map_ta_bin(&va, SMALL_PAGE_SIZE, flags, elf->handle, 0, 0, 0);
503 	if (res)
504 		err(res, "sys_map_ta_bin");
505 	elf->ehdr_addr = va;
506 	if (!elf->is_main) {
507 		elf->load_addr = va;
508 		elf->max_addr = va + SMALL_PAGE_SIZE;
509 		elf->max_offs = SMALL_PAGE_SIZE;
510 	}
511 
512 	if (!IS_ELF(*(Elf32_Ehdr *)va))
513 		err(TEE_ERROR_BAD_FORMAT, "TA is not an ELF");
514 
515 	res = e32_parse_ehdr(elf, (void *)va);
516 	if (res == TEE_ERROR_BAD_FORMAT)
517 		res = e64_parse_ehdr(elf, (void *)va);
518 	if (res)
519 		err(res, "Cannot parse ELF");
520 
521 	if (MUL_OVERFLOW(elf->e_phnum, elf->e_phentsize, &sz) ||
522 	    ADD_OVERFLOW(sz, elf->e_phoff, &sz))
523 		err(TEE_ERROR_BAD_FORMAT, "Program headers size overflow");
524 
525 	if (sz > SMALL_PAGE_SIZE)
526 		err(TEE_ERROR_NOT_SUPPORTED, "Cannot read program headers");
527 
528 	elf->phdr = (void *)(va + elf->e_phoff);
529 }
530 
531 static size_t roundup(size_t v)
532 {
533 	return ROUNDUP(v, SMALL_PAGE_SIZE);
534 }
535 
536 static size_t rounddown(size_t v)
537 {
538 	return ROUNDDOWN(v, SMALL_PAGE_SIZE);
539 }
540 
541 static void add_segment(struct ta_elf *elf, size_t offset, size_t vaddr,
542 			size_t filesz, size_t memsz, size_t flags, size_t align)
543 {
544 	struct segment *seg = calloc(1, sizeof(*seg));
545 
546 	if (!seg)
547 		err(TEE_ERROR_OUT_OF_MEMORY, "calloc");
548 
549 	if (memsz < filesz)
550 		err(TEE_ERROR_BAD_FORMAT, "Memsz smaller than filesz");
551 
552 	seg->offset = offset;
553 	seg->vaddr = vaddr;
554 	seg->filesz = filesz;
555 	seg->memsz = memsz;
556 	seg->flags = flags;
557 	seg->align = align;
558 
559 	TAILQ_INSERT_TAIL(&elf->segs, seg, link);
560 }
561 
562 static void parse_load_segments(struct ta_elf *elf)
563 {
564 	size_t n = 0;
565 
566 	if (elf->is_32bit) {
567 		Elf32_Phdr *phdr = elf->phdr;
568 
569 		for (n = 0; n < elf->e_phnum; n++)
570 			if (phdr[n].p_type == PT_LOAD) {
571 				add_segment(elf, phdr[n].p_offset,
572 					    phdr[n].p_vaddr, phdr[n].p_filesz,
573 					    phdr[n].p_memsz, phdr[n].p_flags,
574 					    phdr[n].p_align);
575 			} else if (phdr[n].p_type == PT_ARM_EXIDX) {
576 				elf->exidx_start = phdr[n].p_vaddr;
577 				elf->exidx_size = phdr[n].p_filesz;
578 			} else if (phdr[n].p_type == PT_TLS) {
579 				assign_tls_mod_id(elf);
580 			}
581 	} else {
582 		Elf64_Phdr *phdr = elf->phdr;
583 
584 		for (n = 0; n < elf->e_phnum; n++)
585 			if (phdr[n].p_type == PT_LOAD) {
586 				add_segment(elf, phdr[n].p_offset,
587 					    phdr[n].p_vaddr, phdr[n].p_filesz,
588 					    phdr[n].p_memsz, phdr[n].p_flags,
589 					    phdr[n].p_align);
590 			} else if (phdr[n].p_type == PT_TLS) {
591 				elf->tls_start = phdr[n].p_vaddr;
592 				elf->tls_filesz = phdr[n].p_filesz;
593 				elf->tls_memsz = phdr[n].p_memsz;
594 			} else if (IS_ENABLED(CFG_TA_BTI) &&
595 				   phdr[n].p_type == PT_GNU_PROPERTY) {
596 				elf->prop_start = phdr[n].p_vaddr;
597 				elf->prop_align = phdr[n].p_align;
598 				elf->prop_memsz = phdr[n].p_memsz;
599 			}
600 	}
601 }
602 
603 static void copy_remapped_to(struct ta_elf *elf, const struct segment *seg)
604 {
605 	uint8_t *dst = (void *)(seg->vaddr + elf->load_addr);
606 	size_t n = 0;
607 	size_t offs = seg->offset;
608 	size_t num_bytes = seg->filesz;
609 
610 	if (offs < elf->max_offs) {
611 		n = MIN(elf->max_offs - offs, num_bytes);
612 		memcpy(dst, (void *)(elf->max_addr + offs - elf->max_offs), n);
613 		dst += n;
614 		offs += n;
615 		num_bytes -= n;
616 	}
617 
618 	if (num_bytes) {
619 		TEE_Result res = sys_copy_from_ta_bin(dst, num_bytes,
620 						      elf->handle, offs);
621 
622 		if (res)
623 			err(res, "sys_copy_from_ta_bin");
624 		elf->max_offs += offs;
625 	}
626 }
627 
628 static void adjust_segments(struct ta_elf *elf)
629 {
630 	struct segment *seg = NULL;
631 	struct segment *prev_seg = NULL;
632 	size_t prev_end_addr = 0;
633 	size_t align = 0;
634 	size_t mask = 0;
635 
636 	/* Sanity check */
637 	TAILQ_FOREACH(seg, &elf->segs, link) {
638 		size_t dummy __maybe_unused = 0;
639 
640 		assert(seg->align >= SMALL_PAGE_SIZE);
641 		assert(!ADD_OVERFLOW(seg->vaddr, seg->memsz, &dummy));
642 		assert(seg->filesz <= seg->memsz);
643 		assert((seg->offset & SMALL_PAGE_MASK) ==
644 		       (seg->vaddr & SMALL_PAGE_MASK));
645 
646 		prev_seg = TAILQ_PREV(seg, segment_head, link);
647 		if (prev_seg) {
648 			assert(seg->vaddr >= prev_seg->vaddr + prev_seg->memsz);
649 			assert(seg->offset >=
650 			       prev_seg->offset + prev_seg->filesz);
651 		}
652 		if (!align)
653 			align = seg->align;
654 		assert(align == seg->align);
655 	}
656 
657 	mask = align - 1;
658 
659 	seg = TAILQ_FIRST(&elf->segs);
660 	if (seg)
661 		seg = TAILQ_NEXT(seg, link);
662 	while (seg) {
663 		prev_seg = TAILQ_PREV(seg, segment_head, link);
664 		prev_end_addr = prev_seg->vaddr + prev_seg->memsz;
665 
666 		/*
667 		 * This segment may overlap with the last "page" in the
668 		 * previous segment in two different ways:
669 		 * 1. Virtual address (and offset) overlaps =>
670 		 *    Permissions needs to be merged. The offset must have
671 		 *    the SMALL_PAGE_MASK bits set as vaddr and offset must
672 		 *    add up with prevsion segment.
673 		 *
674 		 * 2. Only offset overlaps =>
675 		 *    The same page in the ELF is mapped at two different
676 		 *    virtual addresses. As a limitation this segment must
677 		 *    be mapped as writeable.
678 		 */
679 
680 		/* Case 1. */
681 		if (rounddown(seg->vaddr) < prev_end_addr) {
682 			assert((seg->vaddr & mask) == (seg->offset & mask));
683 			assert(prev_seg->memsz == prev_seg->filesz);
684 
685 			/*
686 			 * Merge the segments and their permissions.
687 			 * Note that the may be a small hole between the
688 			 * two sections.
689 			 */
690 			prev_seg->filesz = seg->vaddr + seg->filesz -
691 					   prev_seg->vaddr;
692 			prev_seg->memsz = seg->vaddr + seg->memsz -
693 					   prev_seg->vaddr;
694 			prev_seg->flags |= seg->flags;
695 
696 			TAILQ_REMOVE(&elf->segs, seg, link);
697 			free(seg);
698 			seg = TAILQ_NEXT(prev_seg, link);
699 			continue;
700 		}
701 
702 		/* Case 2. */
703 		if ((seg->offset & mask) &&
704 		    rounddown(seg->offset) <
705 		    (prev_seg->offset + prev_seg->filesz)) {
706 
707 			assert(seg->flags & PF_W);
708 			seg->remapped_writeable = true;
709 		}
710 
711 		/*
712 		 * No overlap, but we may need to align address, offset and
713 		 * size.
714 		 */
715 		seg->filesz += seg->vaddr - rounddown(seg->vaddr);
716 		seg->memsz += seg->vaddr - rounddown(seg->vaddr);
717 		seg->vaddr = rounddown(seg->vaddr);
718 		seg->offset = rounddown(seg->offset);
719 		seg = TAILQ_NEXT(seg, link);
720 	}
721 
722 }
723 
724 static void populate_segments_legacy(struct ta_elf *elf)
725 {
726 	TEE_Result res = TEE_SUCCESS;
727 	struct segment *seg = NULL;
728 	vaddr_t va = 0;
729 
730 	assert(elf->is_legacy);
731 	TAILQ_FOREACH(seg, &elf->segs, link) {
732 		struct segment *last_seg = TAILQ_LAST(&elf->segs, segment_head);
733 		size_t pad_end = roundup(last_seg->vaddr + last_seg->memsz -
734 					 seg->vaddr - seg->memsz);
735 		size_t num_bytes = roundup(seg->memsz);
736 
737 		if (!elf->load_addr)
738 			va = 0;
739 		else
740 			va = seg->vaddr + elf->load_addr;
741 
742 
743 		if (!(seg->flags & PF_R))
744 			err(TEE_ERROR_NOT_SUPPORTED,
745 			    "Segment must be readable");
746 
747 		res = sys_map_zi(num_bytes, 0, &va, 0, pad_end);
748 		if (res)
749 			err(res, "sys_map_zi");
750 		res = sys_copy_from_ta_bin((void *)va, seg->filesz,
751 					   elf->handle, seg->offset);
752 		if (res)
753 			err(res, "sys_copy_from_ta_bin");
754 
755 		if (!elf->load_addr)
756 			elf->load_addr = va;
757 		elf->max_addr = va + num_bytes;
758 		elf->max_offs = seg->offset + seg->filesz;
759 	}
760 }
761 
762 static size_t get_pad_begin(void)
763 {
764 #ifdef CFG_TA_ASLR
765 	size_t min = CFG_TA_ASLR_MIN_OFFSET_PAGES;
766 	size_t max = CFG_TA_ASLR_MAX_OFFSET_PAGES;
767 	TEE_Result res = TEE_SUCCESS;
768 	uint32_t rnd32 = 0;
769 	size_t rnd = 0;
770 
771 	COMPILE_TIME_ASSERT(CFG_TA_ASLR_MIN_OFFSET_PAGES <
772 			    CFG_TA_ASLR_MAX_OFFSET_PAGES);
773 	if (max > min) {
774 		res = sys_gen_random_num(&rnd32, sizeof(rnd32));
775 		if (res) {
776 			DMSG("Random read failed: %#"PRIx32, res);
777 			return min * SMALL_PAGE_SIZE;
778 		}
779 		rnd = rnd32 % (max - min);
780 	}
781 
782 	return (min + rnd) * SMALL_PAGE_SIZE;
783 #else /*!CFG_TA_ASLR*/
784 	return 0;
785 #endif /*!CFG_TA_ASLR*/
786 }
787 
788 static void populate_segments(struct ta_elf *elf)
789 {
790 	TEE_Result res = TEE_SUCCESS;
791 	struct segment *seg = NULL;
792 	vaddr_t va = 0;
793 	size_t pad_begin = 0;
794 
795 	assert(!elf->is_legacy);
796 	TAILQ_FOREACH(seg, &elf->segs, link) {
797 		struct segment *last_seg = TAILQ_LAST(&elf->segs, segment_head);
798 		size_t pad_end = roundup(last_seg->vaddr + last_seg->memsz -
799 					 seg->vaddr - seg->memsz);
800 
801 		if (seg->remapped_writeable) {
802 			size_t num_bytes = roundup(seg->vaddr + seg->memsz) -
803 					   rounddown(seg->vaddr);
804 
805 			assert(elf->load_addr);
806 			va = rounddown(elf->load_addr + seg->vaddr);
807 			assert(va >= elf->max_addr);
808 			res = sys_map_zi(num_bytes, 0, &va, 0, pad_end);
809 			if (res)
810 				err(res, "sys_map_zi");
811 
812 			copy_remapped_to(elf, seg);
813 			elf->max_addr = va + num_bytes;
814 		} else {
815 			uint32_t flags =  0;
816 			size_t filesz = seg->filesz;
817 			size_t memsz = seg->memsz;
818 			size_t offset = seg->offset;
819 			size_t vaddr = seg->vaddr;
820 
821 			if (offset < elf->max_offs) {
822 				/*
823 				 * We're in a load segment which overlaps
824 				 * with (or is covered by) the first page
825 				 * of a shared library.
826 				 */
827 				if (vaddr + filesz < SMALL_PAGE_SIZE) {
828 					size_t num_bytes = 0;
829 
830 					/*
831 					 * If this segment is completely
832 					 * covered, take next.
833 					 */
834 					if (vaddr + memsz <= SMALL_PAGE_SIZE)
835 						continue;
836 
837 					/*
838 					 * All data of the segment is
839 					 * loaded, but we need to zero
840 					 * extend it.
841 					 */
842 					va = elf->max_addr;
843 					num_bytes = roundup(vaddr + memsz) -
844 						    roundup(vaddr) -
845 						    SMALL_PAGE_SIZE;
846 					assert(num_bytes);
847 					res = sys_map_zi(num_bytes, 0, &va, 0,
848 							 0);
849 					if (res)
850 						err(res, "sys_map_zi");
851 					elf->max_addr = roundup(va + num_bytes);
852 					continue;
853 				}
854 
855 				/* Partial overlap, remove the first page. */
856 				vaddr += SMALL_PAGE_SIZE;
857 				filesz -= SMALL_PAGE_SIZE;
858 				memsz -= SMALL_PAGE_SIZE;
859 				offset += SMALL_PAGE_SIZE;
860 			}
861 
862 			if (!elf->load_addr) {
863 				va = 0;
864 				pad_begin = get_pad_begin();
865 				/*
866 				 * If mapping with pad_begin fails we'll
867 				 * retry without pad_begin, effectively
868 				 * disabling ASLR for the current ELF file.
869 				 */
870 			} else {
871 				va = vaddr + elf->load_addr;
872 				pad_begin = 0;
873 			}
874 
875 			if (seg->flags & PF_W)
876 				flags |= LDELF_MAP_FLAG_WRITEABLE;
877 			else
878 				flags |= LDELF_MAP_FLAG_SHAREABLE;
879 			if (seg->flags & PF_X)
880 				flags |= LDELF_MAP_FLAG_EXECUTABLE;
881 			if (!(seg->flags & PF_R))
882 				err(TEE_ERROR_NOT_SUPPORTED,
883 				    "Segment must be readable");
884 			if (flags & LDELF_MAP_FLAG_WRITEABLE) {
885 				res = sys_map_zi(memsz, 0, &va, pad_begin,
886 						 pad_end);
887 				if (pad_begin && res == TEE_ERROR_OUT_OF_MEMORY)
888 					res = sys_map_zi(memsz, 0, &va, 0,
889 							 pad_end);
890 				if (res)
891 					err(res, "sys_map_zi");
892 				res = sys_copy_from_ta_bin((void *)va, filesz,
893 							   elf->handle, offset);
894 				if (res)
895 					err(res, "sys_copy_from_ta_bin");
896 			} else {
897 				if (filesz != memsz)
898 					err(TEE_ERROR_BAD_FORMAT,
899 					    "Filesz and memsz mismatch");
900 				res = sys_map_ta_bin(&va, filesz, flags,
901 						     elf->handle, offset,
902 						     pad_begin, pad_end);
903 				if (pad_begin && res == TEE_ERROR_OUT_OF_MEMORY)
904 					res = sys_map_ta_bin(&va, filesz, flags,
905 							     elf->handle,
906 							     offset, 0,
907 							     pad_end);
908 				if (res)
909 					err(res, "sys_map_ta_bin");
910 			}
911 
912 			if (!elf->load_addr)
913 				elf->load_addr = va;
914 			elf->max_addr = roundup(va + memsz);
915 			elf->max_offs += filesz;
916 		}
917 	}
918 }
919 
920 static void ta_elf_add_bti(struct ta_elf *elf)
921 {
922 	TEE_Result res = TEE_SUCCESS;
923 	struct segment *seg = NULL;
924 	uint32_t flags = LDELF_MAP_FLAG_EXECUTABLE | LDELF_MAP_FLAG_BTI;
925 
926 	TAILQ_FOREACH(seg, &elf->segs, link) {
927 		vaddr_t va = elf->load_addr + seg->vaddr;
928 
929 		if (seg->flags & PF_X) {
930 			res = sys_set_prot(va, seg->memsz, flags);
931 			if (res)
932 				err(res, "sys_set_prot");
933 		}
934 	}
935 }
936 
937 static void parse_property_segment(struct ta_elf *elf)
938 {
939 	char *desc = NULL;
940 	size_t align = elf->prop_align;
941 	size_t desc_offset = 0;
942 	size_t prop_offset = 0;
943 	vaddr_t va = 0;
944 	Elf_Note *note = NULL;
945 	char *name = NULL;
946 
947 	if (!IS_ENABLED(CFG_TA_BTI) || !elf->prop_start)
948 		return;
949 
950 	check_phdr_in_range(elf, PT_GNU_PROPERTY, elf->prop_start,
951 			    elf->prop_memsz);
952 
953 	va = elf->load_addr + elf->prop_start;
954 	note = (void *)va;
955 	name = (char *)(note + 1);
956 
957 	if (elf->prop_memsz < sizeof(*note) + sizeof(ELF_NOTE_GNU))
958 		return;
959 
960 	if (note->n_type != NT_GNU_PROPERTY_TYPE_0 ||
961 	    note->n_namesz != sizeof(ELF_NOTE_GNU) ||
962 	    memcmp(name, ELF_NOTE_GNU, sizeof(ELF_NOTE_GNU)) ||
963 	    !IS_POWER_OF_TWO(align))
964 		return;
965 
966 	desc_offset = ROUNDUP(sizeof(*note) + sizeof(ELF_NOTE_GNU), align);
967 
968 	if (desc_offset > elf->prop_memsz ||
969 	    ROUNDUP(desc_offset + note->n_descsz, align) > elf->prop_memsz)
970 		return;
971 
972 	desc = (char *)(va + desc_offset);
973 
974 	do {
975 		Elf_Prop *prop = (void *)(desc + prop_offset);
976 		size_t data_offset = prop_offset + sizeof(*prop);
977 
978 		if (note->n_descsz < data_offset)
979 			return;
980 
981 		data_offset = confine_array_index(data_offset, note->n_descsz);
982 
983 		if (prop->pr_type == GNU_PROPERTY_AARCH64_FEATURE_1_AND) {
984 			uint32_t *pr_data = (void *)(desc + data_offset);
985 
986 			if (note->n_descsz < (data_offset + sizeof(*pr_data)) &&
987 			    prop->pr_datasz != sizeof(*pr_data))
988 				return;
989 
990 			if (*pr_data & GNU_PROPERTY_AARCH64_FEATURE_1_BTI) {
991 				DMSG("BTI Feature present in note property");
992 				elf->bti_enabled = true;
993 			}
994 		}
995 
996 		prop_offset += ROUNDUP(sizeof(*prop) + prop->pr_datasz, align);
997 	} while (prop_offset < note->n_descsz);
998 }
999 
1000 static void map_segments(struct ta_elf *elf)
1001 {
1002 	TEE_Result res = TEE_SUCCESS;
1003 
1004 	parse_load_segments(elf);
1005 	adjust_segments(elf);
1006 	if (TAILQ_FIRST(&elf->segs)->offset < SMALL_PAGE_SIZE) {
1007 		vaddr_t va = 0;
1008 		size_t sz = elf->max_addr - elf->load_addr;
1009 		struct segment *seg = TAILQ_LAST(&elf->segs, segment_head);
1010 		size_t pad_begin = get_pad_begin();
1011 
1012 		/*
1013 		 * We're loading a library, if not other parts of the code
1014 		 * need to be updated too.
1015 		 */
1016 		assert(!elf->is_main);
1017 
1018 		/*
1019 		 * Now that we know how much virtual memory is needed move
1020 		 * the already mapped part to a location which can
1021 		 * accommodate us.
1022 		 */
1023 		res = sys_remap(elf->load_addr, &va, sz, pad_begin,
1024 				roundup(seg->vaddr + seg->memsz));
1025 		if (res == TEE_ERROR_OUT_OF_MEMORY)
1026 			res = sys_remap(elf->load_addr, &va, sz, 0,
1027 					roundup(seg->vaddr + seg->memsz));
1028 		if (res)
1029 			err(res, "sys_remap");
1030 		elf->ehdr_addr = va;
1031 		elf->load_addr = va;
1032 		elf->max_addr = va + sz;
1033 		elf->phdr = (void *)(va + elf->e_phoff);
1034 	}
1035 }
1036 
1037 static void add_deps_from_segment(struct ta_elf *elf, unsigned int type,
1038 				  vaddr_t addr, size_t memsz)
1039 {
1040 	size_t dyn_entsize = 0;
1041 	size_t num_dyns = 0;
1042 	size_t n = 0;
1043 	unsigned int tag = 0;
1044 	size_t val = 0;
1045 	TEE_UUID uuid = { };
1046 	char *str_tab = NULL;
1047 	size_t str_tab_sz = 0;
1048 
1049 	if (type != PT_DYNAMIC)
1050 		return;
1051 
1052 	check_phdr_in_range(elf, type, addr, memsz);
1053 
1054 	if (elf->is_32bit)
1055 		dyn_entsize = sizeof(Elf32_Dyn);
1056 	else
1057 		dyn_entsize = sizeof(Elf64_Dyn);
1058 
1059 	assert(!(memsz % dyn_entsize));
1060 	num_dyns = memsz / dyn_entsize;
1061 
1062 	for (n = 0; n < num_dyns && !(str_tab && str_tab_sz); n++) {
1063 		read_dyn(elf, addr, n, &tag, &val);
1064 		if (tag == DT_STRTAB)
1065 			str_tab = (char *)(val + elf->load_addr);
1066 		else if (tag == DT_STRSZ)
1067 			str_tab_sz = val;
1068 	}
1069 	check_range(elf, ".dynstr/STRTAB", str_tab, str_tab_sz);
1070 
1071 	for (n = 0; n < num_dyns; n++) {
1072 		read_dyn(elf, addr, n, &tag, &val);
1073 		if (tag != DT_NEEDED)
1074 			continue;
1075 		if (val >= str_tab_sz)
1076 			err(TEE_ERROR_BAD_FORMAT,
1077 			    "Offset into .dynstr/STRTAB out of range");
1078 		tee_uuid_from_str(&uuid, str_tab + val);
1079 		queue_elf(&uuid);
1080 	}
1081 }
1082 
1083 static void add_dependencies(struct ta_elf *elf)
1084 {
1085 	size_t n = 0;
1086 
1087 	if (elf->is_32bit) {
1088 		Elf32_Phdr *phdr = elf->phdr;
1089 
1090 		for (n = 0; n < elf->e_phnum; n++)
1091 			add_deps_from_segment(elf, phdr[n].p_type,
1092 					      phdr[n].p_vaddr, phdr[n].p_memsz);
1093 	} else {
1094 		Elf64_Phdr *phdr = elf->phdr;
1095 
1096 		for (n = 0; n < elf->e_phnum; n++)
1097 			add_deps_from_segment(elf, phdr[n].p_type,
1098 					      phdr[n].p_vaddr, phdr[n].p_memsz);
1099 	}
1100 }
1101 
1102 static void copy_section_headers(struct ta_elf *elf)
1103 {
1104 	TEE_Result res = TEE_SUCCESS;
1105 	size_t sz = 0;
1106 	size_t offs = 0;
1107 
1108 	if (MUL_OVERFLOW(elf->e_shnum, elf->e_shentsize, &sz))
1109 		err(TEE_ERROR_BAD_FORMAT, "Section headers size overflow");
1110 
1111 	elf->shdr = malloc(sz);
1112 	if (!elf->shdr)
1113 		err(TEE_ERROR_OUT_OF_MEMORY, "malloc");
1114 
1115 	/*
1116 	 * We're assuming that section headers comes after the load segments,
1117 	 * but if it's a very small dynamically linked library the section
1118 	 * headers can still end up (partially?) in the first mapped page.
1119 	 */
1120 	if (elf->e_shoff < SMALL_PAGE_SIZE) {
1121 		assert(!elf->is_main);
1122 		offs = MIN(SMALL_PAGE_SIZE - elf->e_shoff, sz);
1123 		memcpy(elf->shdr, (void *)(elf->load_addr + elf->e_shoff),
1124 		       offs);
1125 	}
1126 
1127 	if (offs < sz) {
1128 		res = sys_copy_from_ta_bin((uint8_t *)elf->shdr + offs,
1129 					   sz - offs, elf->handle,
1130 					   elf->e_shoff + offs);
1131 		if (res)
1132 			err(res, "sys_copy_from_ta_bin");
1133 	}
1134 }
1135 
1136 static void close_handle(struct ta_elf *elf)
1137 {
1138 	TEE_Result res = sys_close_ta_bin(elf->handle);
1139 
1140 	if (res)
1141 		err(res, "sys_close_ta_bin");
1142 	elf->handle = -1;
1143 }
1144 
1145 static void clean_elf_load_main(struct ta_elf *elf)
1146 {
1147 	TEE_Result res = TEE_SUCCESS;
1148 
1149 	/*
1150 	 * Clean up from last attempt to load
1151 	 */
1152 	res = sys_unmap(elf->ehdr_addr, SMALL_PAGE_SIZE);
1153 	if (res)
1154 		err(res, "sys_unmap");
1155 
1156 	while (!TAILQ_EMPTY(&elf->segs)) {
1157 		struct segment *seg = TAILQ_FIRST(&elf->segs);
1158 		vaddr_t va = 0;
1159 		size_t num_bytes = 0;
1160 
1161 		va = rounddown(elf->load_addr + seg->vaddr);
1162 		if (seg->remapped_writeable)
1163 			num_bytes = roundup(seg->vaddr + seg->memsz) -
1164 				    rounddown(seg->vaddr);
1165 		else
1166 			num_bytes = seg->memsz;
1167 
1168 		res = sys_unmap(va, num_bytes);
1169 		if (res)
1170 			err(res, "sys_unmap");
1171 
1172 		TAILQ_REMOVE(&elf->segs, seg, link);
1173 		free(seg);
1174 	}
1175 
1176 	free(elf->shdr);
1177 	memset(&elf->is_32bit, 0,
1178 	       (vaddr_t)&elf->uuid - (vaddr_t)&elf->is_32bit);
1179 
1180 	TAILQ_INIT(&elf->segs);
1181 }
1182 
1183 #ifdef ARM64
1184 /*
1185  * Allocates an offset in the TA's Thread Control Block for the TLS segment of
1186  * the @elf module.
1187  */
1188 #define TCB_HEAD_SIZE (2 * sizeof(long))
1189 static void set_tls_offset(struct ta_elf *elf)
1190 {
1191 	static size_t next_offs = TCB_HEAD_SIZE;
1192 
1193 	if (!elf->tls_start)
1194 		return;
1195 
1196 	/* Module has a TLS segment */
1197 	elf->tls_tcb_offs = next_offs;
1198 	next_offs += elf->tls_memsz;
1199 }
1200 #else
1201 static void set_tls_offset(struct ta_elf *elf __unused) {}
1202 #endif
1203 
1204 static void load_main(struct ta_elf *elf)
1205 {
1206 	vaddr_t va = 0;
1207 
1208 	init_elf(elf);
1209 	map_segments(elf);
1210 	populate_segments(elf);
1211 	add_dependencies(elf);
1212 	copy_section_headers(elf);
1213 	save_symtab(elf);
1214 	close_handle(elf);
1215 	set_tls_offset(elf);
1216 	parse_property_segment(elf);
1217 	if (elf->bti_enabled)
1218 		ta_elf_add_bti(elf);
1219 
1220 	if (!ta_elf_resolve_sym("ta_head", &va, NULL, elf))
1221 		elf->head = (struct ta_head *)va;
1222 	else
1223 		elf->head = (struct ta_head *)elf->load_addr;
1224 	if (elf->head->depr_entry != UINT64_MAX) {
1225 		/*
1226 		 * Legacy TAs sets their entry point in ta_head. For
1227 		 * non-legacy TAs the entry point of the ELF is set instead
1228 		 * and leaving the ta_head entry point set to UINT64_MAX to
1229 		 * indicate that it's not used.
1230 		 *
1231 		 * NB, everything before the commit a73b5878c89d ("Replace
1232 		 * ta_head.entry with elf entry") is considered legacy TAs
1233 		 * for ldelf.
1234 		 *
1235 		 * Legacy TAs cannot be mapped with shared memory segments
1236 		 * so restart the mapping if it turned out we're loading a
1237 		 * legacy TA.
1238 		 */
1239 
1240 		DMSG("Reloading TA %pUl as legacy TA", (void *)&elf->uuid);
1241 		clean_elf_load_main(elf);
1242 		elf->is_legacy = true;
1243 		init_elf(elf);
1244 		map_segments(elf);
1245 		populate_segments_legacy(elf);
1246 		add_dependencies(elf);
1247 		copy_section_headers(elf);
1248 		save_symtab(elf);
1249 		close_handle(elf);
1250 		elf->head = (struct ta_head *)elf->load_addr;
1251 		/*
1252 		 * Check that the TA is still a legacy TA, if it isn't give
1253 		 * up now since we're likely under attack.
1254 		 */
1255 		if (elf->head->depr_entry == UINT64_MAX)
1256 			err(TEE_ERROR_GENERIC,
1257 			    "TA %pUl was changed on disk to non-legacy",
1258 			    (void *)&elf->uuid);
1259 	}
1260 
1261 }
1262 
1263 void ta_elf_load_main(const TEE_UUID *uuid, uint32_t *is_32bit, uint64_t *sp,
1264 		      uint32_t *ta_flags)
1265 {
1266 	struct ta_elf *elf = queue_elf(uuid);
1267 	vaddr_t va = 0;
1268 	TEE_Result res = TEE_SUCCESS;
1269 
1270 	assert(elf);
1271 	elf->is_main = true;
1272 
1273 	load_main(elf);
1274 
1275 	*is_32bit = elf->is_32bit;
1276 	res = sys_map_zi(elf->head->stack_size, 0, &va, 0, 0);
1277 	if (res)
1278 		err(res, "sys_map_zi stack");
1279 
1280 	if (elf->head->flags & ~TA_FLAGS_MASK)
1281 		err(TEE_ERROR_BAD_FORMAT, "Invalid TA flags(s) %#"PRIx32,
1282 		    elf->head->flags & ~TA_FLAGS_MASK);
1283 
1284 	*ta_flags = elf->head->flags;
1285 	*sp = va + elf->head->stack_size;
1286 	ta_stack = va;
1287 	ta_stack_size = elf->head->stack_size;
1288 }
1289 
1290 void ta_elf_finalize_load_main(uint64_t *entry, uint64_t *load_addr)
1291 {
1292 	struct ta_elf *elf = TAILQ_FIRST(&main_elf_queue);
1293 	TEE_Result res = TEE_SUCCESS;
1294 
1295 	assert(elf->is_main);
1296 
1297 	res = ta_elf_set_init_fini_info_compat(elf->is_32bit);
1298 	if (res)
1299 		err(res, "ta_elf_set_init_fini_info_compat");
1300 	res = ta_elf_set_elf_phdr_info(elf->is_32bit);
1301 	if (res)
1302 		err(res, "ta_elf_set_elf_phdr_info");
1303 
1304 	if (elf->is_legacy)
1305 		*entry = elf->head->depr_entry;
1306 	else
1307 		*entry = elf->e_entry + elf->load_addr;
1308 
1309 	*load_addr = elf->load_addr;
1310 }
1311 
1312 
1313 void ta_elf_load_dependency(struct ta_elf *elf, bool is_32bit)
1314 {
1315 	if (elf->is_main)
1316 		return;
1317 
1318 	init_elf(elf);
1319 	if (elf->is_32bit != is_32bit)
1320 		err(TEE_ERROR_BAD_FORMAT, "ELF %pUl is %sbit (expected %sbit)",
1321 		    (void *)&elf->uuid, elf->is_32bit ? "32" : "64",
1322 		    is_32bit ? "32" : "64");
1323 
1324 	map_segments(elf);
1325 	populate_segments(elf);
1326 	add_dependencies(elf);
1327 	copy_section_headers(elf);
1328 	save_symtab(elf);
1329 	close_handle(elf);
1330 	set_tls_offset(elf);
1331 	parse_property_segment(elf);
1332 	if (elf->bti_enabled)
1333 		ta_elf_add_bti(elf);
1334 }
1335 
1336 void ta_elf_finalize_mappings(struct ta_elf *elf)
1337 {
1338 	TEE_Result res = TEE_SUCCESS;
1339 	struct segment *seg = NULL;
1340 
1341 	if (!elf->is_legacy)
1342 		return;
1343 
1344 	TAILQ_FOREACH(seg, &elf->segs, link) {
1345 		vaddr_t va = elf->load_addr + seg->vaddr;
1346 		uint32_t flags =  0;
1347 
1348 		if (seg->flags & PF_W)
1349 			flags |= LDELF_MAP_FLAG_WRITEABLE;
1350 		if (seg->flags & PF_X)
1351 			flags |= LDELF_MAP_FLAG_EXECUTABLE;
1352 
1353 		res = sys_set_prot(va, seg->memsz, flags);
1354 		if (res)
1355 			err(res, "sys_set_prot");
1356 	}
1357 }
1358 
1359 static void __printf(3, 4) print_wrapper(void *pctx, print_func_t print_func,
1360 					 const char *fmt, ...)
1361 {
1362 	va_list ap;
1363 
1364 	va_start(ap, fmt);
1365 	print_func(pctx, fmt, ap);
1366 	va_end(ap);
1367 }
1368 
1369 static void print_seg(void *pctx, print_func_t print_func,
1370 		      size_t idx __maybe_unused, int elf_idx __maybe_unused,
1371 		      vaddr_t va __maybe_unused, paddr_t pa __maybe_unused,
1372 		      size_t sz __maybe_unused, uint32_t flags)
1373 {
1374 	int rc __maybe_unused = 0;
1375 	int width __maybe_unused = 8;
1376 	char desc[14] __maybe_unused = "";
1377 	char flags_str[] __maybe_unused = "----";
1378 
1379 	if (elf_idx > -1) {
1380 		rc = snprintf(desc, sizeof(desc), " [%d]", elf_idx);
1381 		assert(rc >= 0);
1382 	} else {
1383 		if (flags & DUMP_MAP_EPHEM) {
1384 			rc = snprintf(desc, sizeof(desc), " (param)");
1385 			assert(rc >= 0);
1386 		}
1387 		if (flags & DUMP_MAP_LDELF) {
1388 			rc = snprintf(desc, sizeof(desc), " (ldelf)");
1389 			assert(rc >= 0);
1390 		}
1391 		if (va == ta_stack) {
1392 			rc = snprintf(desc, sizeof(desc), " (stack)");
1393 			assert(rc >= 0);
1394 		}
1395 	}
1396 
1397 	if (flags & DUMP_MAP_READ)
1398 		flags_str[0] = 'r';
1399 	if (flags & DUMP_MAP_WRITE)
1400 		flags_str[1] = 'w';
1401 	if (flags & DUMP_MAP_EXEC)
1402 		flags_str[2] = 'x';
1403 	if (flags & DUMP_MAP_SECURE)
1404 		flags_str[3] = 's';
1405 
1406 	print_wrapper(pctx, print_func,
1407 		      "region %2zu: va 0x%0*"PRIxVA" pa 0x%0*"PRIxPA" size 0x%06zx flags %s%s\n",
1408 		      idx, width, va, width, pa, sz, flags_str, desc);
1409 }
1410 
1411 static bool get_next_in_order(struct ta_elf_queue *elf_queue,
1412 			      struct ta_elf **elf, struct segment **seg,
1413 			      size_t *elf_idx)
1414 {
1415 	struct ta_elf *e = NULL;
1416 	struct segment *s = NULL;
1417 	size_t idx = 0;
1418 	vaddr_t va = 0;
1419 	struct ta_elf *e2 = NULL;
1420 	size_t i2 = 0;
1421 
1422 	assert(elf && seg && elf_idx);
1423 	e = *elf;
1424 	s = *seg;
1425 	assert((e == NULL && s == NULL) || (e != NULL && s != NULL));
1426 
1427 	if (s) {
1428 		s = TAILQ_NEXT(s, link);
1429 		if (s) {
1430 			*seg = s;
1431 			return true;
1432 		}
1433 	}
1434 
1435 	if (e)
1436 		va = e->load_addr;
1437 
1438 	/* Find the ELF with next load address */
1439 	e = NULL;
1440 	TAILQ_FOREACH(e2, elf_queue, link) {
1441 		if (e2->load_addr > va) {
1442 			if (!e || e2->load_addr < e->load_addr) {
1443 				e = e2;
1444 				idx = i2;
1445 			}
1446 		}
1447 		i2++;
1448 	}
1449 	if (!e)
1450 		return false;
1451 
1452 	*elf = e;
1453 	*seg = TAILQ_FIRST(&e->segs);
1454 	*elf_idx = idx;
1455 	return true;
1456 }
1457 
1458 void ta_elf_print_mappings(void *pctx, print_func_t print_func,
1459 			   struct ta_elf_queue *elf_queue, size_t num_maps,
1460 			   struct dump_map *maps, vaddr_t mpool_base)
1461 {
1462 	struct segment *seg = NULL;
1463 	struct ta_elf *elf = NULL;
1464 	size_t elf_idx = 0;
1465 	size_t idx = 0;
1466 	size_t map_idx = 0;
1467 
1468 	/*
1469 	 * Loop over all segments and maps, printing virtual address in
1470 	 * order. Segment has priority if the virtual address is present
1471 	 * in both map and segment.
1472 	 */
1473 	get_next_in_order(elf_queue, &elf, &seg, &elf_idx);
1474 	while (true) {
1475 		vaddr_t va = -1;
1476 		size_t sz = 0;
1477 		uint32_t flags = DUMP_MAP_SECURE;
1478 		size_t offs = 0;
1479 
1480 		if (seg) {
1481 			va = rounddown(seg->vaddr + elf->load_addr);
1482 			sz = roundup(seg->vaddr + seg->memsz) -
1483 				     rounddown(seg->vaddr);
1484 		}
1485 
1486 		while (map_idx < num_maps && maps[map_idx].va <= va) {
1487 			uint32_t f = 0;
1488 
1489 			/* If there's a match, it should be the same map */
1490 			if (maps[map_idx].va == va) {
1491 				/*
1492 				 * In shared libraries the first page is
1493 				 * mapped separately with the rest of that
1494 				 * segment following back to back in a
1495 				 * separate entry.
1496 				 */
1497 				if (map_idx + 1 < num_maps &&
1498 				    maps[map_idx].sz == SMALL_PAGE_SIZE) {
1499 					vaddr_t next_va = maps[map_idx].va +
1500 							  maps[map_idx].sz;
1501 					size_t comb_sz = maps[map_idx].sz +
1502 							 maps[map_idx + 1].sz;
1503 
1504 					if (next_va == maps[map_idx + 1].va &&
1505 					    comb_sz == sz &&
1506 					    maps[map_idx].flags ==
1507 					    maps[map_idx + 1].flags) {
1508 						/* Skip this and next entry */
1509 						map_idx += 2;
1510 						continue;
1511 					}
1512 				}
1513 				assert(maps[map_idx].sz == sz);
1514 			} else if (maps[map_idx].va < va) {
1515 				if (maps[map_idx].va == mpool_base)
1516 					f |= DUMP_MAP_LDELF;
1517 				print_seg(pctx, print_func, idx, -1,
1518 					  maps[map_idx].va, maps[map_idx].pa,
1519 					  maps[map_idx].sz,
1520 					  maps[map_idx].flags | f);
1521 				idx++;
1522 			}
1523 			map_idx++;
1524 		}
1525 
1526 		if (!seg)
1527 			break;
1528 
1529 		offs = rounddown(seg->offset);
1530 		if (seg->flags & PF_R)
1531 			flags |= DUMP_MAP_READ;
1532 		if (seg->flags & PF_W)
1533 			flags |= DUMP_MAP_WRITE;
1534 		if (seg->flags & PF_X)
1535 			flags |= DUMP_MAP_EXEC;
1536 
1537 		print_seg(pctx, print_func, idx, elf_idx, va, offs, sz, flags);
1538 		idx++;
1539 
1540 		if (!get_next_in_order(elf_queue, &elf, &seg, &elf_idx))
1541 			seg = NULL;
1542 	}
1543 
1544 	elf_idx = 0;
1545 	TAILQ_FOREACH(elf, elf_queue, link) {
1546 		print_wrapper(pctx, print_func,
1547 			      " [%zu] %pUl @ 0x%0*"PRIxVA"\n",
1548 			      elf_idx, (void *)&elf->uuid, 8, elf->load_addr);
1549 		elf_idx++;
1550 	}
1551 }
1552 
1553 #ifdef CFG_UNWIND
1554 
1555 #if defined(ARM32) || defined(ARM64)
1556 /* Called by libunw */
1557 bool find_exidx(vaddr_t addr, vaddr_t *idx_start, vaddr_t *idx_end)
1558 {
1559 	struct segment *seg = NULL;
1560 	struct ta_elf *elf = NULL;
1561 	vaddr_t a = 0;
1562 
1563 	TAILQ_FOREACH(elf, &main_elf_queue, link) {
1564 		if (addr < elf->load_addr)
1565 			continue;
1566 		a = addr - elf->load_addr;
1567 		TAILQ_FOREACH(seg, &elf->segs, link) {
1568 			if (a < seg->vaddr)
1569 				continue;
1570 			if (a - seg->vaddr < seg->filesz) {
1571 				*idx_start = elf->exidx_start + elf->load_addr;
1572 				*idx_end = elf->exidx_start + elf->load_addr +
1573 					   elf->exidx_size;
1574 				return true;
1575 			}
1576 		}
1577 	}
1578 
1579 	return false;
1580 }
1581 
1582 void ta_elf_stack_trace_a32(uint32_t regs[16])
1583 {
1584 	struct unwind_state_arm32 state = { };
1585 
1586 	memcpy(state.registers, regs, sizeof(state.registers));
1587 	print_stack_arm32(&state, ta_stack, ta_stack_size);
1588 }
1589 
1590 void ta_elf_stack_trace_a64(uint64_t fp, uint64_t sp, uint64_t pc)
1591 {
1592 	struct unwind_state_arm64 state = { .fp = fp, .sp = sp, .pc = pc };
1593 
1594 	print_stack_arm64(&state, ta_stack, ta_stack_size);
1595 }
1596 #elif defined(RV32) || defined(RV64)
1597 void ta_elf_stack_trace_riscv(uint64_t fp, uint64_t pc)
1598 {
1599 	struct unwind_state_riscv state = { .fp = fp, .pc = pc };
1600 
1601 	print_stack_riscv(&state, ta_stack, ta_stack_size);
1602 }
1603 #endif
1604 
1605 #endif /* CFG_UNWIND */
1606 
1607 TEE_Result ta_elf_add_library(const TEE_UUID *uuid)
1608 {
1609 	TEE_Result res = TEE_ERROR_GENERIC;
1610 	struct ta_elf *ta = TAILQ_FIRST(&main_elf_queue);
1611 	struct ta_elf *lib = ta_elf_find_elf(uuid);
1612 	struct ta_elf *elf = NULL;
1613 
1614 	if (lib)
1615 		return TEE_SUCCESS; /* Already mapped */
1616 
1617 	lib = queue_elf_helper(uuid);
1618 	if (!lib)
1619 		return TEE_ERROR_OUT_OF_MEMORY;
1620 
1621 	for (elf = lib; elf; elf = TAILQ_NEXT(elf, link))
1622 		ta_elf_load_dependency(elf, ta->is_32bit);
1623 
1624 	for (elf = lib; elf; elf = TAILQ_NEXT(elf, link)) {
1625 		ta_elf_relocate(elf);
1626 		ta_elf_finalize_mappings(elf);
1627 	}
1628 
1629 	for (elf = lib; elf; elf = TAILQ_NEXT(elf, link))
1630 		DMSG("ELF (%pUl) at %#"PRIxVA,
1631 		     (void *)&elf->uuid, elf->load_addr);
1632 
1633 	res = ta_elf_set_init_fini_info_compat(ta->is_32bit);
1634 	if (res)
1635 		return res;
1636 
1637 	return ta_elf_set_elf_phdr_info(ta->is_32bit);
1638 }
1639 
1640 /* Get address/size of .init_array and .fini_array from the dynamic segment */
1641 static void get_init_fini_array(struct ta_elf *elf, unsigned int type,
1642 				vaddr_t addr, size_t memsz, vaddr_t *init,
1643 				size_t *init_cnt, vaddr_t *fini,
1644 				size_t *fini_cnt)
1645 {
1646 	size_t addrsz = 0;
1647 	size_t dyn_entsize = 0;
1648 	size_t num_dyns = 0;
1649 	size_t n = 0;
1650 	unsigned int tag = 0;
1651 	size_t val = 0;
1652 
1653 	assert(type == PT_DYNAMIC);
1654 
1655 	check_phdr_in_range(elf, type, addr, memsz);
1656 
1657 	if (elf->is_32bit) {
1658 		dyn_entsize = sizeof(Elf32_Dyn);
1659 		addrsz = 4;
1660 	} else {
1661 		dyn_entsize = sizeof(Elf64_Dyn);
1662 		addrsz = 8;
1663 	}
1664 
1665 	assert(!(memsz % dyn_entsize));
1666 	num_dyns = memsz / dyn_entsize;
1667 
1668 	for (n = 0; n < num_dyns; n++) {
1669 		read_dyn(elf, addr, n, &tag, &val);
1670 		if (tag == DT_INIT_ARRAY)
1671 			*init = val + elf->load_addr;
1672 		else if (tag == DT_FINI_ARRAY)
1673 			*fini = val + elf->load_addr;
1674 		else if (tag == DT_INIT_ARRAYSZ)
1675 			*init_cnt = val / addrsz;
1676 		else if (tag == DT_FINI_ARRAYSZ)
1677 			*fini_cnt = val / addrsz;
1678 	}
1679 }
1680 
1681 /* Get address/size of .init_array and .fini_array in @elf (if present) */
1682 static void elf_get_init_fini_array(struct ta_elf *elf, vaddr_t *init,
1683 				    size_t *init_cnt, vaddr_t *fini,
1684 				    size_t *fini_cnt)
1685 {
1686 	size_t n = 0;
1687 
1688 	if (elf->is_32bit) {
1689 		Elf32_Phdr *phdr = elf->phdr;
1690 
1691 		for (n = 0; n < elf->e_phnum; n++) {
1692 			if (phdr[n].p_type == PT_DYNAMIC) {
1693 				get_init_fini_array(elf, phdr[n].p_type,
1694 						    phdr[n].p_vaddr,
1695 						    phdr[n].p_memsz,
1696 						    init, init_cnt, fini,
1697 						    fini_cnt);
1698 				return;
1699 			}
1700 		}
1701 	} else {
1702 		Elf64_Phdr *phdr = elf->phdr;
1703 
1704 		for (n = 0; n < elf->e_phnum; n++) {
1705 			if (phdr[n].p_type == PT_DYNAMIC) {
1706 				get_init_fini_array(elf, phdr[n].p_type,
1707 						    phdr[n].p_vaddr,
1708 						    phdr[n].p_memsz,
1709 						    init, init_cnt, fini,
1710 						    fini_cnt);
1711 				return;
1712 			}
1713 		}
1714 	}
1715 }
1716 
1717 /*
1718  * Deprecated by __elf_phdr_info below. Kept for compatibility.
1719  *
1720  * Pointers to ELF initialization and finalization functions are extracted by
1721  * ldelf and stored on the TA heap, then exported to the TA via the global
1722  * symbol __init_fini_info. libutee in OP-TEE 3.9.0 uses this mechanism.
1723  */
1724 
1725 struct __init_fini {
1726 	uint32_t flags;
1727 	uint16_t init_size;
1728 	uint16_t fini_size;
1729 
1730 	void (**init)(void); /* @init_size entries */
1731 	void (**fini)(void); /* @fini_size entries */
1732 };
1733 
1734 #define __IFS_VALID            BIT(0)
1735 #define __IFS_INIT_HAS_RUN     BIT(1)
1736 #define __IFS_FINI_HAS_RUN     BIT(2)
1737 
1738 struct __init_fini_info {
1739 	uint32_t reserved;
1740 	uint16_t size;
1741 	uint16_t pad;
1742 	struct __init_fini *ifs; /* @size entries */
1743 };
1744 
1745 /* 32-bit variants for a 64-bit ldelf to access a 32-bit TA */
1746 
1747 struct __init_fini32 {
1748 	uint32_t flags;
1749 	uint16_t init_size;
1750 	uint16_t fini_size;
1751 	uint32_t init;
1752 	uint32_t fini;
1753 };
1754 
1755 struct __init_fini_info32 {
1756 	uint32_t reserved;
1757 	uint16_t size;
1758 	uint16_t pad;
1759 	uint32_t ifs;
1760 };
1761 
1762 static TEE_Result realloc_ifs(vaddr_t va, size_t cnt, bool is_32bit)
1763 {
1764 	struct __init_fini_info32 *info32 = (struct __init_fini_info32 *)va;
1765 	struct __init_fini_info *info = (struct __init_fini_info *)va;
1766 	struct __init_fini32 *ifs32 = NULL;
1767 	struct __init_fini *ifs = NULL;
1768 	size_t prev_cnt = 0;
1769 	void *ptr = NULL;
1770 
1771 	if (is_32bit) {
1772 		ptr = (void *)(vaddr_t)info32->ifs;
1773 		ptr = realloc(ptr, cnt * sizeof(struct __init_fini32));
1774 		if (!ptr)
1775 			return TEE_ERROR_OUT_OF_MEMORY;
1776 		ifs32 = ptr;
1777 		prev_cnt = info32->size;
1778 		if (cnt > prev_cnt)
1779 			memset(ifs32 + prev_cnt, 0,
1780 			       (cnt - prev_cnt) * sizeof(*ifs32));
1781 		info32->ifs = (uint32_t)(vaddr_t)ifs32;
1782 		info32->size = cnt;
1783 	} else {
1784 		ptr = realloc(info->ifs, cnt * sizeof(struct __init_fini));
1785 		if (!ptr)
1786 			return TEE_ERROR_OUT_OF_MEMORY;
1787 		ifs = ptr;
1788 		prev_cnt = info->size;
1789 		if (cnt > prev_cnt)
1790 			memset(ifs + prev_cnt, 0,
1791 			       (cnt - prev_cnt) * sizeof(*ifs));
1792 		info->ifs = ifs;
1793 		info->size = cnt;
1794 	}
1795 
1796 	return TEE_SUCCESS;
1797 }
1798 
1799 static void fill_ifs(vaddr_t va, size_t idx, struct ta_elf *elf, bool is_32bit)
1800 {
1801 	struct __init_fini_info32 *info32 = (struct __init_fini_info32 *)va;
1802 	struct __init_fini_info *info = (struct __init_fini_info *)va;
1803 	struct __init_fini32 *ifs32 = NULL;
1804 	struct __init_fini *ifs = NULL;
1805 	size_t init_cnt = 0;
1806 	size_t fini_cnt = 0;
1807 	vaddr_t init = 0;
1808 	vaddr_t fini = 0;
1809 
1810 	if (is_32bit) {
1811 		assert(idx < info32->size);
1812 		ifs32 = &((struct __init_fini32 *)(vaddr_t)info32->ifs)[idx];
1813 
1814 		if (ifs32->flags & __IFS_VALID)
1815 			return;
1816 
1817 		elf_get_init_fini_array(elf, &init, &init_cnt, &fini,
1818 					&fini_cnt);
1819 
1820 		ifs32->init = (uint32_t)init;
1821 		ifs32->init_size = init_cnt;
1822 
1823 		ifs32->fini = (uint32_t)fini;
1824 		ifs32->fini_size = fini_cnt;
1825 
1826 		ifs32->flags |= __IFS_VALID;
1827 	} else {
1828 		assert(idx < info->size);
1829 		ifs = &info->ifs[idx];
1830 
1831 		if (ifs->flags & __IFS_VALID)
1832 			return;
1833 
1834 		elf_get_init_fini_array(elf, &init, &init_cnt, &fini,
1835 					&fini_cnt);
1836 
1837 		ifs->init = (void (**)(void))init;
1838 		ifs->init_size = init_cnt;
1839 
1840 		ifs->fini = (void (**)(void))fini;
1841 		ifs->fini_size = fini_cnt;
1842 
1843 		ifs->flags |= __IFS_VALID;
1844 	}
1845 }
1846 
1847 /*
1848  * Set or update __init_fini_info in the TA with information from the ELF
1849  * queue
1850  */
1851 TEE_Result ta_elf_set_init_fini_info_compat(bool is_32bit)
1852 {
1853 	struct __init_fini_info *info = NULL;
1854 	TEE_Result res = TEE_SUCCESS;
1855 	struct ta_elf *elf = NULL;
1856 	vaddr_t info_va = 0;
1857 	size_t cnt = 0;
1858 
1859 	res = ta_elf_resolve_sym("__init_fini_info", &info_va, NULL, NULL);
1860 	if (res) {
1861 		if (res == TEE_ERROR_ITEM_NOT_FOUND) {
1862 			/*
1863 			 * Not an error, only TAs linked against libutee from
1864 			 * OP-TEE 3.9.0 have this symbol.
1865 			 */
1866 			return TEE_SUCCESS;
1867 		}
1868 		return res;
1869 	}
1870 	assert(info_va);
1871 
1872 	info = (struct __init_fini_info *)info_va;
1873 	if (info->reserved)
1874 		return TEE_ERROR_NOT_SUPPORTED;
1875 
1876 	TAILQ_FOREACH(elf, &main_elf_queue, link)
1877 		cnt++;
1878 
1879 	/* Queue has at least one file (main) */
1880 	assert(cnt);
1881 
1882 	res = realloc_ifs(info_va, cnt, is_32bit);
1883 	if (res)
1884 		goto err;
1885 
1886 	cnt = 0;
1887 	TAILQ_FOREACH(elf, &main_elf_queue, link) {
1888 		fill_ifs(info_va, cnt, elf, is_32bit);
1889 		cnt++;
1890 	}
1891 
1892 	return TEE_SUCCESS;
1893 err:
1894 	free(info);
1895 	return res;
1896 }
1897 
1898 static TEE_Result realloc_elf_phdr_info(vaddr_t va, size_t cnt, bool is_32bit)
1899 {
1900 	struct __elf_phdr_info32 *info32 = (struct __elf_phdr_info32 *)va;
1901 	struct __elf_phdr_info *info = (struct __elf_phdr_info *)va;
1902 	struct dl_phdr_info32 *dlpi32 = NULL;
1903 	struct dl_phdr_info *dlpi = NULL;
1904 	size_t prev_cnt = 0;
1905 	void *ptr = NULL;
1906 
1907 	if (is_32bit) {
1908 		ptr = (void *)(vaddr_t)info32->dlpi;
1909 		ptr = realloc(ptr, cnt * sizeof(*dlpi32));
1910 		if (!ptr)
1911 			return TEE_ERROR_OUT_OF_MEMORY;
1912 		dlpi32 = ptr;
1913 		prev_cnt = info32->count;
1914 		if (cnt > prev_cnt)
1915 			memset(dlpi32 + prev_cnt, 0,
1916 			       (cnt - prev_cnt) * sizeof(*dlpi32));
1917 		info32->dlpi = (uint32_t)(vaddr_t)dlpi32;
1918 		info32->count = cnt;
1919 	} else {
1920 		ptr = realloc(info->dlpi, cnt * sizeof(*dlpi));
1921 		if (!ptr)
1922 			return TEE_ERROR_OUT_OF_MEMORY;
1923 		dlpi = ptr;
1924 		prev_cnt = info->count;
1925 		if (cnt > prev_cnt)
1926 			memset(dlpi + prev_cnt, 0,
1927 			       (cnt - prev_cnt) * sizeof(*dlpi));
1928 		info->dlpi = dlpi;
1929 		info->count = cnt;
1930 	}
1931 
1932 	return TEE_SUCCESS;
1933 }
1934 
1935 static void fill_elf_phdr_info(vaddr_t va, size_t idx, struct ta_elf *elf,
1936 			       bool is_32bit)
1937 {
1938 	struct __elf_phdr_info32 *info32 = (struct __elf_phdr_info32 *)va;
1939 	struct __elf_phdr_info *info = (struct __elf_phdr_info *)va;
1940 	struct dl_phdr_info32 *dlpi32 = NULL;
1941 	struct dl_phdr_info *dlpi = NULL;
1942 
1943 	if (is_32bit) {
1944 		assert(idx < info32->count);
1945 		dlpi32 = (struct dl_phdr_info32 *)(vaddr_t)info32->dlpi + idx;
1946 
1947 		dlpi32->dlpi_addr = elf->load_addr;
1948 		if (elf->soname)
1949 			dlpi32->dlpi_name = (vaddr_t)elf->soname;
1950 		else
1951 			dlpi32->dlpi_name = (vaddr_t)&info32->zero;
1952 		dlpi32->dlpi_phdr = (vaddr_t)elf->phdr;
1953 		dlpi32->dlpi_phnum = elf->e_phnum;
1954 		dlpi32->dlpi_adds = 1; /* No unloading on dlclose() currently */
1955 		dlpi32->dlpi_subs = 0; /* No unloading on dlclose() currently */
1956 		dlpi32->dlpi_tls_modid = elf->tls_mod_id;
1957 		dlpi32->dlpi_tls_data = elf->tls_start;
1958 	} else {
1959 		assert(idx < info->count);
1960 		dlpi = info->dlpi + idx;
1961 
1962 		dlpi->dlpi_addr = elf->load_addr;
1963 		if (elf->soname)
1964 			dlpi->dlpi_name = elf->soname;
1965 		else
1966 			dlpi->dlpi_name = &info32->zero;
1967 		dlpi->dlpi_phdr = elf->phdr;
1968 		dlpi->dlpi_phnum = elf->e_phnum;
1969 		dlpi->dlpi_adds = 1; /* No unloading on dlclose() currently */
1970 		dlpi->dlpi_subs = 0; /* No unloading on dlclose() currently */
1971 		dlpi->dlpi_tls_modid = elf->tls_mod_id;
1972 		dlpi->dlpi_tls_data = (void *)elf->tls_start;
1973 	}
1974 }
1975 
1976 /* Set or update __elf_hdr_info in the TA with information from the ELF queue */
1977 TEE_Result ta_elf_set_elf_phdr_info(bool is_32bit)
1978 {
1979 	struct __elf_phdr_info *info = NULL;
1980 	TEE_Result res = TEE_SUCCESS;
1981 	struct ta_elf *elf = NULL;
1982 	vaddr_t info_va = 0;
1983 	size_t cnt = 0;
1984 
1985 	res = ta_elf_resolve_sym("__elf_phdr_info", &info_va, NULL, NULL);
1986 	if (res) {
1987 		if (res == TEE_ERROR_ITEM_NOT_FOUND) {
1988 			/* Older TA */
1989 			return TEE_SUCCESS;
1990 		}
1991 		return res;
1992 	}
1993 	assert(info_va);
1994 
1995 	info = (struct __elf_phdr_info *)info_va;
1996 	if (info->reserved)
1997 		return TEE_ERROR_NOT_SUPPORTED;
1998 
1999 	TAILQ_FOREACH(elf, &main_elf_queue, link)
2000 		cnt++;
2001 
2002 	res = realloc_elf_phdr_info(info_va, cnt, is_32bit);
2003 	if (res)
2004 		return res;
2005 
2006 	cnt = 0;
2007 	TAILQ_FOREACH(elf, &main_elf_queue, link) {
2008 		fill_elf_phdr_info(info_va, cnt, elf, is_32bit);
2009 		cnt++;
2010 	}
2011 
2012 	return TEE_SUCCESS;
2013 }
2014