1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2019, Linaro Limited 4 */ 5 6 #include <assert.h> 7 #include <ctype.h> 8 #include <elf32.h> 9 #include <elf64.h> 10 #include <elf_common.h> 11 #include <ldelf.h> 12 #include <pta_system.h> 13 #include <stdio.h> 14 #include <stdlib.h> 15 #include <string_ext.h> 16 #include <string.h> 17 #include <tee_api_types.h> 18 #include <tee_internal_api_extensions.h> 19 #include <user_ta_header.h> 20 #include <utee_syscalls.h> 21 #include <util.h> 22 23 #include "sys.h" 24 #include "ta_elf.h" 25 #include "unwind.h" 26 27 static vaddr_t ta_stack; 28 static vaddr_t ta_stack_size; 29 30 struct ta_elf_queue main_elf_queue = TAILQ_HEAD_INITIALIZER(main_elf_queue); 31 32 static struct ta_elf *queue_elf_helper(const TEE_UUID *uuid) 33 { 34 struct ta_elf *elf = calloc(1, sizeof(*elf)); 35 36 if (!elf) 37 return NULL; 38 39 TAILQ_INIT(&elf->segs); 40 41 elf->uuid = *uuid; 42 TAILQ_INSERT_TAIL(&main_elf_queue, elf, link); 43 return elf; 44 } 45 46 static struct ta_elf *queue_elf(const TEE_UUID *uuid) 47 { 48 struct ta_elf *elf = ta_elf_find_elf(uuid); 49 50 if (elf) 51 return NULL; 52 53 elf = queue_elf_helper(uuid); 54 if (!elf) 55 err(TEE_ERROR_OUT_OF_MEMORY, "queue_elf_helper"); 56 57 return elf; 58 } 59 60 struct ta_elf *ta_elf_find_elf(const TEE_UUID *uuid) 61 { 62 struct ta_elf *elf = NULL; 63 64 TAILQ_FOREACH(elf, &main_elf_queue, link) 65 if (!memcmp(uuid, &elf->uuid, sizeof(*uuid))) 66 return elf; 67 68 return NULL; 69 } 70 71 static TEE_Result e32_parse_ehdr(struct ta_elf *elf, Elf32_Ehdr *ehdr) 72 { 73 if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || 74 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 75 ehdr->e_ident[EI_DATA] != ELFDATA2LSB || 76 ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE || 77 ehdr->e_type != ET_DYN || ehdr->e_machine != EM_ARM || 78 (ehdr->e_flags & EF_ARM_ABIMASK) != EF_ARM_ABI_VERSION || 79 #ifndef CFG_WITH_VFP 80 (ehdr->e_flags & EF_ARM_ABI_FLOAT_HARD) || 81 #endif 82 ehdr->e_phentsize != sizeof(Elf32_Phdr) || 83 ehdr->e_shentsize != sizeof(Elf32_Shdr)) 84 return TEE_ERROR_BAD_FORMAT; 85 86 elf->is_32bit = true; 87 elf->e_entry = ehdr->e_entry; 88 elf->e_phoff = ehdr->e_phoff; 89 elf->e_shoff = ehdr->e_shoff; 90 elf->e_phnum = ehdr->e_phnum; 91 elf->e_shnum = ehdr->e_shnum; 92 elf->e_phentsize = ehdr->e_phentsize; 93 elf->e_shentsize = ehdr->e_shentsize; 94 95 return TEE_SUCCESS; 96 } 97 98 #ifdef ARM64 99 static TEE_Result e64_parse_ehdr(struct ta_elf *elf, Elf64_Ehdr *ehdr) 100 { 101 if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || 102 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 103 ehdr->e_ident[EI_DATA] != ELFDATA2LSB || 104 ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE || 105 ehdr->e_type != ET_DYN || ehdr->e_machine != EM_AARCH64 || 106 ehdr->e_flags || ehdr->e_phentsize != sizeof(Elf64_Phdr) || 107 ehdr->e_shentsize != sizeof(Elf64_Shdr)) 108 return TEE_ERROR_BAD_FORMAT; 109 110 111 elf->is_32bit = false; 112 elf->e_entry = ehdr->e_entry; 113 elf->e_phoff = ehdr->e_phoff; 114 elf->e_shoff = ehdr->e_shoff; 115 elf->e_phnum = ehdr->e_phnum; 116 elf->e_shnum = ehdr->e_shnum; 117 elf->e_phentsize = ehdr->e_phentsize; 118 elf->e_shentsize = ehdr->e_shentsize; 119 120 return TEE_SUCCESS; 121 } 122 #else /*ARM64*/ 123 static TEE_Result e64_parse_ehdr(struct ta_elf *elf __unused, 124 Elf64_Ehdr *ehdr __unused) 125 { 126 return TEE_ERROR_NOT_SUPPORTED; 127 } 128 #endif /*ARM64*/ 129 130 static void check_phdr_in_range(struct ta_elf *elf, unsigned int type, 131 vaddr_t addr, size_t memsz) 132 { 133 vaddr_t max_addr = 0; 134 135 if (ADD_OVERFLOW(addr, memsz, &max_addr)) 136 err(TEE_ERROR_BAD_FORMAT, "Program header %#x overflow", type); 137 138 /* 139 * elf->load_addr and elf->max_addr are both using the 140 * final virtual addresses, while this program header is 141 * relative to 0. 142 */ 143 if (max_addr > elf->max_addr - elf->load_addr) 144 err(TEE_ERROR_BAD_FORMAT, "Program header %#x out of bounds", 145 type); 146 } 147 148 static void read_dyn(struct ta_elf *elf, vaddr_t addr, 149 size_t idx, unsigned int *tag, size_t *val) 150 { 151 if (elf->is_32bit) { 152 Elf32_Dyn *dyn = (Elf32_Dyn *)(addr + elf->load_addr); 153 154 *tag = dyn[idx].d_tag; 155 *val = dyn[idx].d_un.d_val; 156 } else { 157 Elf64_Dyn *dyn = (Elf64_Dyn *)(addr + elf->load_addr); 158 159 *tag = dyn[idx].d_tag; 160 *val = dyn[idx].d_un.d_val; 161 } 162 } 163 164 static void save_hashtab_from_segment(struct ta_elf *elf, unsigned int type, 165 vaddr_t addr, size_t memsz) 166 { 167 size_t dyn_entsize = 0; 168 size_t num_dyns = 0; 169 size_t n = 0; 170 unsigned int tag = 0; 171 size_t val = 0; 172 173 if (type != PT_DYNAMIC) 174 return; 175 176 check_phdr_in_range(elf, type, addr, memsz); 177 178 if (elf->is_32bit) 179 dyn_entsize = sizeof(Elf32_Dyn); 180 else 181 dyn_entsize = sizeof(Elf64_Dyn); 182 183 assert(!(memsz % dyn_entsize)); 184 num_dyns = memsz / dyn_entsize; 185 186 for (n = 0; n < num_dyns; n++) { 187 read_dyn(elf, addr, n, &tag, &val); 188 if (tag == DT_HASH) { 189 elf->hashtab = (void *)(val + elf->load_addr); 190 break; 191 } 192 } 193 } 194 195 static void check_range(struct ta_elf *elf, const char *name, const void *ptr, 196 size_t sz) 197 { 198 size_t max_addr = 0; 199 200 if ((vaddr_t)ptr < elf->load_addr) 201 err(TEE_ERROR_GENERIC, "%s %p out of range", name, ptr); 202 203 if (ADD_OVERFLOW((vaddr_t)ptr, sz, &max_addr)) 204 err(TEE_ERROR_GENERIC, "%s range overflow", name); 205 206 if (max_addr > elf->max_addr) 207 err(TEE_ERROR_GENERIC, 208 "%s %p..%#zx out of range", name, ptr, max_addr); 209 } 210 211 static void check_hashtab(struct ta_elf *elf, void *ptr, size_t num_buckets, 212 size_t num_chains) 213 { 214 /* 215 * Starting from 2 as the first two words are mandatory and hold 216 * num_buckets and num_chains. So this function is called twice, 217 * first to see that there's indeed room for num_buckets and 218 * num_chains and then to see that all of it fits. 219 * See http://www.sco.com/developers/gabi/latest/ch5.dynamic.html#hash 220 */ 221 size_t num_words = 2; 222 size_t sz = 0; 223 224 if (!ALIGNMENT_IS_OK(ptr, uint32_t)) 225 err(TEE_ERROR_GENERIC, "Bad alignment of hashtab %p", ptr); 226 227 if (ADD_OVERFLOW(num_words, num_buckets, &num_words) || 228 ADD_OVERFLOW(num_words, num_chains, &num_words) || 229 MUL_OVERFLOW(num_words, sizeof(uint32_t), &sz)) 230 err(TEE_ERROR_GENERIC, "Hashtab overflow"); 231 232 check_range(elf, "Hashtab", ptr, sz); 233 } 234 235 static void save_hashtab(struct ta_elf *elf) 236 { 237 uint32_t *hashtab = NULL; 238 size_t n = 0; 239 240 if (elf->is_32bit) { 241 Elf32_Phdr *phdr = elf->phdr; 242 243 for (n = 0; n < elf->e_phnum; n++) 244 save_hashtab_from_segment(elf, phdr[n].p_type, 245 phdr[n].p_vaddr, 246 phdr[n].p_memsz); 247 } else { 248 Elf64_Phdr *phdr = elf->phdr; 249 250 for (n = 0; n < elf->e_phnum; n++) 251 save_hashtab_from_segment(elf, phdr[n].p_type, 252 phdr[n].p_vaddr, 253 phdr[n].p_memsz); 254 } 255 256 check_hashtab(elf, elf->hashtab, 0, 0); 257 hashtab = elf->hashtab; 258 check_hashtab(elf, elf->hashtab, hashtab[0], hashtab[1]); 259 } 260 261 static void e32_save_symtab(struct ta_elf *elf, size_t tab_idx) 262 { 263 Elf32_Shdr *shdr = elf->shdr; 264 size_t str_idx = shdr[tab_idx].sh_link; 265 266 elf->dynsymtab = (void *)(shdr[tab_idx].sh_addr + elf->load_addr); 267 if (!ALIGNMENT_IS_OK(elf->dynsymtab, Elf32_Sym)) 268 err(TEE_ERROR_GENERIC, "Bad alignment of dynsymtab %p", 269 elf->dynsymtab); 270 check_range(elf, "Dynsymtab", elf->dynsymtab, shdr[tab_idx].sh_size); 271 272 if (shdr[tab_idx].sh_size % sizeof(Elf32_Sym)) 273 err(TEE_ERROR_GENERIC, 274 "Size of dynsymtab not an even multiple of Elf32_Sym"); 275 elf->num_dynsyms = shdr[tab_idx].sh_size / sizeof(Elf32_Sym); 276 277 if (str_idx >= elf->e_shnum) 278 err(TEE_ERROR_GENERIC, "Dynstr section index out of range"); 279 elf->dynstr = (void *)(shdr[str_idx].sh_addr + elf->load_addr); 280 check_range(elf, "Dynstr", elf->dynstr, shdr[str_idx].sh_size); 281 282 elf->dynstr_size = shdr[str_idx].sh_size; 283 } 284 285 static void e64_save_symtab(struct ta_elf *elf, size_t tab_idx) 286 { 287 Elf64_Shdr *shdr = elf->shdr; 288 size_t str_idx = shdr[tab_idx].sh_link; 289 290 elf->dynsymtab = (void *)(vaddr_t)(shdr[tab_idx].sh_addr + 291 elf->load_addr); 292 293 if (!ALIGNMENT_IS_OK(elf->dynsymtab, Elf64_Sym)) 294 err(TEE_ERROR_GENERIC, "Bad alignment of dynsymtab %p", 295 elf->dynsymtab); 296 check_range(elf, "Dynsymtab", elf->dynsymtab, shdr[tab_idx].sh_size); 297 298 if (shdr[tab_idx].sh_size % sizeof(Elf64_Sym)) 299 err(TEE_ERROR_GENERIC, 300 "Size of dynsymtab not an even multiple of Elf64_Sym"); 301 elf->num_dynsyms = shdr[tab_idx].sh_size / sizeof(Elf64_Sym); 302 303 if (str_idx >= elf->e_shnum) 304 err(TEE_ERROR_GENERIC, "Dynstr section index out of range"); 305 elf->dynstr = (void *)(vaddr_t)(shdr[str_idx].sh_addr + elf->load_addr); 306 check_range(elf, "Dynstr", elf->dynstr, shdr[str_idx].sh_size); 307 308 elf->dynstr_size = shdr[str_idx].sh_size; 309 } 310 311 static void save_symtab(struct ta_elf *elf) 312 { 313 size_t n = 0; 314 315 if (elf->is_32bit) { 316 Elf32_Shdr *shdr = elf->shdr; 317 318 for (n = 0; n < elf->e_shnum; n++) { 319 if (shdr[n].sh_type == SHT_DYNSYM) { 320 e32_save_symtab(elf, n); 321 break; 322 } 323 } 324 } else { 325 Elf64_Shdr *shdr = elf->shdr; 326 327 for (n = 0; n < elf->e_shnum; n++) { 328 if (shdr[n].sh_type == SHT_DYNSYM) { 329 e64_save_symtab(elf, n); 330 break; 331 } 332 } 333 334 } 335 336 save_hashtab(elf); 337 } 338 339 static void init_elf(struct ta_elf *elf) 340 { 341 TEE_Result res = TEE_SUCCESS; 342 vaddr_t va = 0; 343 uint32_t flags = PTA_SYSTEM_MAP_FLAG_SHAREABLE; 344 size_t sz = 0; 345 346 res = sys_open_ta_bin(&elf->uuid, &elf->handle); 347 if (res) 348 err(res, "sys_open_ta_bin(%pUl)", (void *)&elf->uuid); 349 350 /* 351 * Map it read-only executable when we're loading a library where 352 * the ELF header is included in a load segment. 353 */ 354 if (!elf->is_main) 355 flags |= PTA_SYSTEM_MAP_FLAG_EXECUTABLE; 356 res = sys_map_ta_bin(&va, SMALL_PAGE_SIZE, flags, elf->handle, 0, 0, 0); 357 if (res) 358 err(res, "sys_map_ta_bin"); 359 elf->ehdr_addr = va; 360 if (!elf->is_main) { 361 elf->load_addr = va; 362 elf->max_addr = va + SMALL_PAGE_SIZE; 363 elf->max_offs = SMALL_PAGE_SIZE; 364 } 365 366 if (!IS_ELF(*(Elf32_Ehdr *)va)) 367 err(TEE_ERROR_BAD_FORMAT, "TA is not an ELF"); 368 369 res = e32_parse_ehdr(elf, (void *)va); 370 if (res == TEE_ERROR_BAD_FORMAT) 371 res = e64_parse_ehdr(elf, (void *)va); 372 if (res) 373 err(res, "Cannot parse ELF"); 374 375 if (MUL_OVERFLOW(elf->e_phnum, elf->e_phentsize, &sz) || 376 ADD_OVERFLOW(sz, elf->e_phoff, &sz)) 377 err(TEE_ERROR_BAD_FORMAT, "Program headers size overflow"); 378 379 if (sz > SMALL_PAGE_SIZE) 380 err(TEE_ERROR_NOT_SUPPORTED, "Cannot read program headers"); 381 382 elf->phdr = (void *)(va + elf->e_phoff); 383 } 384 385 static size_t roundup(size_t v) 386 { 387 return ROUNDUP(v, SMALL_PAGE_SIZE); 388 } 389 390 static size_t rounddown(size_t v) 391 { 392 return ROUNDDOWN(v, SMALL_PAGE_SIZE); 393 } 394 395 static void add_segment(struct ta_elf *elf, size_t offset, size_t vaddr, 396 size_t filesz, size_t memsz, size_t flags, size_t align) 397 { 398 struct segment *seg = calloc(1, sizeof(*seg)); 399 400 if (!seg) 401 err(TEE_ERROR_OUT_OF_MEMORY, "calloc"); 402 403 seg->offset = offset; 404 seg->vaddr = vaddr; 405 seg->filesz = filesz; 406 seg->memsz = memsz; 407 seg->flags = flags; 408 seg->align = align; 409 410 TAILQ_INSERT_TAIL(&elf->segs, seg, link); 411 } 412 413 static void parse_load_segments(struct ta_elf *elf) 414 { 415 size_t n = 0; 416 417 if (elf->is_32bit) { 418 Elf32_Phdr *phdr = elf->phdr; 419 420 for (n = 0; n < elf->e_phnum; n++) 421 if (phdr[n].p_type == PT_LOAD) { 422 add_segment(elf, phdr[n].p_offset, 423 phdr[n].p_vaddr, phdr[n].p_filesz, 424 phdr[n].p_memsz, phdr[n].p_flags, 425 phdr[n].p_align); 426 } else if (phdr[n].p_type == PT_ARM_EXIDX) { 427 elf->exidx_start = phdr[n].p_vaddr; 428 elf->exidx_size = phdr[n].p_filesz; 429 } 430 } else { 431 Elf64_Phdr *phdr = elf->phdr; 432 433 for (n = 0; n < elf->e_phnum; n++) 434 if (phdr[n].p_type == PT_LOAD) 435 add_segment(elf, phdr[n].p_offset, 436 phdr[n].p_vaddr, phdr[n].p_filesz, 437 phdr[n].p_memsz, phdr[n].p_flags, 438 phdr[n].p_align); 439 } 440 } 441 442 static void copy_remapped_to(struct ta_elf *elf, const struct segment *seg) 443 { 444 uint8_t *dst = (void *)(seg->vaddr + elf->load_addr); 445 size_t n = 0; 446 size_t offs = seg->offset; 447 size_t num_bytes = seg->filesz; 448 449 if (offs < elf->max_offs) { 450 n = MIN(elf->max_offs - offs, num_bytes); 451 memcpy(dst, (void *)(elf->max_addr + offs - elf->max_offs), n); 452 dst += n; 453 offs += n; 454 num_bytes -= n; 455 } 456 457 if (num_bytes) { 458 TEE_Result res = sys_copy_from_ta_bin(dst, num_bytes, 459 elf->handle, offs); 460 461 if (res) 462 err(res, "sys_copy_from_ta_bin"); 463 elf->max_offs += offs; 464 } 465 } 466 467 static void adjust_segments(struct ta_elf *elf) 468 { 469 struct segment *seg = NULL; 470 struct segment *prev_seg = NULL; 471 size_t prev_end_addr = 0; 472 size_t align = 0; 473 size_t mask = 0; 474 475 /* Sanity check */ 476 TAILQ_FOREACH(seg, &elf->segs, link) { 477 size_t dummy __maybe_unused = 0; 478 479 assert(seg->align >= SMALL_PAGE_SIZE); 480 assert(!ADD_OVERFLOW(seg->vaddr, seg->memsz, &dummy)); 481 assert(seg->filesz <= seg->memsz); 482 assert((seg->offset & SMALL_PAGE_MASK) == 483 (seg->vaddr & SMALL_PAGE_MASK)); 484 485 prev_seg = TAILQ_PREV(seg, segment_head, link); 486 if (prev_seg) { 487 assert(seg->vaddr >= prev_seg->vaddr + prev_seg->memsz); 488 assert(seg->offset >= 489 prev_seg->offset + prev_seg->filesz); 490 } 491 if (!align) 492 align = seg->align; 493 assert(align == seg->align); 494 } 495 496 mask = align - 1; 497 498 seg = TAILQ_FIRST(&elf->segs); 499 if (seg) 500 seg = TAILQ_NEXT(seg, link); 501 while (seg) { 502 prev_seg = TAILQ_PREV(seg, segment_head, link); 503 prev_end_addr = prev_seg->vaddr + prev_seg->memsz; 504 505 /* 506 * This segment may overlap with the last "page" in the 507 * previous segment in two different ways: 508 * 1. Virtual address (and offset) overlaps => 509 * Permissions needs to be merged. The offset must have 510 * the SMALL_PAGE_MASK bits set as vaddr and offset must 511 * add up with prevsion segment. 512 * 513 * 2. Only offset overlaps => 514 * The same page in the ELF is mapped at two different 515 * virtual addresses. As a limitation this segment must 516 * be mapped as writeable. 517 */ 518 519 /* Case 1. */ 520 if (rounddown(seg->vaddr) < prev_end_addr) { 521 assert((seg->vaddr & mask) == (seg->offset & mask)); 522 assert(prev_seg->memsz == prev_seg->filesz); 523 524 /* 525 * Merge the segments and their permissions. 526 * Note that the may be a small hole between the 527 * two sections. 528 */ 529 prev_seg->filesz = seg->vaddr + seg->filesz - 530 prev_seg->vaddr; 531 prev_seg->memsz = seg->vaddr + seg->memsz - 532 prev_seg->vaddr; 533 prev_seg->flags |= seg->flags; 534 535 TAILQ_REMOVE(&elf->segs, seg, link); 536 free(seg); 537 seg = TAILQ_NEXT(prev_seg, link); 538 continue; 539 } 540 541 /* Case 2. */ 542 if ((seg->offset & mask) && 543 rounddown(seg->offset) < 544 (prev_seg->offset + prev_seg->filesz)) { 545 546 assert(seg->flags & PF_W); 547 seg->remapped_writeable = true; 548 } 549 550 /* 551 * No overlap, but we may need to align address, offset and 552 * size. 553 */ 554 seg->filesz += seg->vaddr - rounddown(seg->vaddr); 555 seg->memsz += seg->vaddr - rounddown(seg->vaddr); 556 seg->vaddr = rounddown(seg->vaddr); 557 seg->offset = rounddown(seg->offset); 558 seg = TAILQ_NEXT(seg, link); 559 } 560 561 } 562 563 static void populate_segments_legacy(struct ta_elf *elf) 564 { 565 TEE_Result res = TEE_SUCCESS; 566 struct segment *seg = NULL; 567 vaddr_t va = 0; 568 569 assert(elf->is_legacy); 570 TAILQ_FOREACH(seg, &elf->segs, link) { 571 struct segment *last_seg = TAILQ_LAST(&elf->segs, segment_head); 572 size_t pad_end = roundup(last_seg->vaddr + last_seg->memsz - 573 seg->vaddr - seg->memsz); 574 size_t num_bytes = roundup(seg->memsz); 575 576 if (!elf->load_addr) 577 va = 0; 578 else 579 va = seg->vaddr + elf->load_addr; 580 581 582 if (!(seg->flags & PF_R)) 583 err(TEE_ERROR_NOT_SUPPORTED, 584 "Segment must be readable"); 585 586 res = sys_map_zi(num_bytes, 0, &va, 0, pad_end); 587 if (res) 588 err(res, "sys_map_zi"); 589 res = sys_copy_from_ta_bin((void *)va, seg->filesz, 590 elf->handle, seg->offset); 591 if (res) 592 err(res, "sys_copy_from_ta_bin"); 593 594 if (!elf->load_addr) 595 elf->load_addr = va; 596 elf->max_addr = va + num_bytes; 597 elf->max_offs = seg->offset + seg->filesz; 598 } 599 } 600 601 static size_t get_pad_begin(void) 602 { 603 #ifdef CFG_TA_ASLR 604 size_t min = CFG_TA_ASLR_MIN_OFFSET_PAGES; 605 size_t max = CFG_TA_ASLR_MAX_OFFSET_PAGES; 606 TEE_Result res = TEE_SUCCESS; 607 uint32_t rnd32 = 0; 608 size_t rnd = 0; 609 610 COMPILE_TIME_ASSERT(CFG_TA_ASLR_MIN_OFFSET_PAGES < 611 CFG_TA_ASLR_MAX_OFFSET_PAGES); 612 if (max > min) { 613 res = utee_cryp_random_number_generate(&rnd32, sizeof(rnd32)); 614 if (res) { 615 DMSG("Random read failed: %#"PRIx32, res); 616 return min * SMALL_PAGE_SIZE; 617 } 618 rnd = rnd32 % (max - min); 619 } 620 621 return (min + rnd) * SMALL_PAGE_SIZE; 622 #else /*!CFG_TA_ASLR*/ 623 return 0; 624 #endif /*!CFG_TA_ASLR*/ 625 } 626 627 static void populate_segments(struct ta_elf *elf) 628 { 629 TEE_Result res = TEE_SUCCESS; 630 struct segment *seg = NULL; 631 vaddr_t va = 0; 632 size_t pad_begin = 0; 633 634 assert(!elf->is_legacy); 635 TAILQ_FOREACH(seg, &elf->segs, link) { 636 struct segment *last_seg = TAILQ_LAST(&elf->segs, segment_head); 637 size_t pad_end = roundup(last_seg->vaddr + last_seg->memsz - 638 seg->vaddr - seg->memsz); 639 640 if (seg->remapped_writeable) { 641 size_t num_bytes = roundup(seg->vaddr + seg->memsz) - 642 rounddown(seg->vaddr); 643 644 assert(elf->load_addr); 645 va = rounddown(elf->load_addr + seg->vaddr); 646 assert(va >= elf->max_addr); 647 res = sys_map_zi(num_bytes, 0, &va, 0, pad_end); 648 if (res) 649 err(res, "sys_map_zi"); 650 651 copy_remapped_to(elf, seg); 652 elf->max_addr = va + num_bytes; 653 } else { 654 uint32_t flags = 0; 655 size_t filesz = seg->filesz; 656 size_t memsz = seg->memsz; 657 size_t offset = seg->offset; 658 size_t vaddr = seg->vaddr; 659 660 if (offset < elf->max_offs) { 661 /* 662 * We're in a load segment which overlaps 663 * with (or is covered by) the first page 664 * of a shared library. 665 */ 666 if (vaddr + filesz < SMALL_PAGE_SIZE) { 667 size_t num_bytes = 0; 668 669 /* 670 * If this segment is completely 671 * covered, take next. 672 */ 673 if (vaddr + memsz <= SMALL_PAGE_SIZE) 674 continue; 675 676 /* 677 * All data of the segment is 678 * loaded, but we need to zero 679 * extend it. 680 */ 681 va = elf->max_addr; 682 num_bytes = roundup(vaddr + memsz) - 683 roundup(vaddr) - 684 SMALL_PAGE_SIZE; 685 assert(num_bytes); 686 res = sys_map_zi(num_bytes, 0, &va, 0, 687 0); 688 if (res) 689 err(res, "sys_map_zi"); 690 elf->max_addr = roundup(va + num_bytes); 691 continue; 692 } 693 694 /* Partial overlap, remove the first page. */ 695 vaddr += SMALL_PAGE_SIZE; 696 filesz -= SMALL_PAGE_SIZE; 697 memsz -= SMALL_PAGE_SIZE; 698 offset += SMALL_PAGE_SIZE; 699 } 700 701 if (!elf->load_addr) { 702 va = 0; 703 pad_begin = get_pad_begin(); 704 /* 705 * If mapping with pad_begin fails we'll 706 * retry without pad_begin, effectively 707 * disabling ASLR for the current ELF file. 708 */ 709 } else { 710 va = vaddr + elf->load_addr; 711 pad_begin = 0; 712 } 713 714 if (seg->flags & PF_W) 715 flags |= PTA_SYSTEM_MAP_FLAG_WRITEABLE; 716 else 717 flags |= PTA_SYSTEM_MAP_FLAG_SHAREABLE; 718 if (seg->flags & PF_X) 719 flags |= PTA_SYSTEM_MAP_FLAG_EXECUTABLE; 720 if (!(seg->flags & PF_R)) 721 err(TEE_ERROR_NOT_SUPPORTED, 722 "Segment must be readable"); 723 if (flags & PTA_SYSTEM_MAP_FLAG_WRITEABLE) { 724 res = sys_map_zi(memsz, 0, &va, pad_begin, 725 pad_end); 726 if (pad_begin && res == TEE_ERROR_OUT_OF_MEMORY) 727 res = sys_map_zi(memsz, 0, &va, 0, 728 pad_end); 729 if (res) 730 err(res, "sys_map_zi"); 731 res = sys_copy_from_ta_bin((void *)va, filesz, 732 elf->handle, offset); 733 if (res) 734 err(res, "sys_copy_from_ta_bin"); 735 } else { 736 res = sys_map_ta_bin(&va, filesz, flags, 737 elf->handle, offset, 738 pad_begin, pad_end); 739 if (pad_begin && res == TEE_ERROR_OUT_OF_MEMORY) 740 res = sys_map_ta_bin(&va, filesz, flags, 741 elf->handle, 742 offset, 0, 743 pad_end); 744 if (res) 745 err(res, "sys_map_ta_bin"); 746 } 747 748 if (!elf->load_addr) 749 elf->load_addr = va; 750 elf->max_addr = roundup(va + filesz); 751 elf->max_offs += filesz; 752 } 753 } 754 } 755 756 static void map_segments(struct ta_elf *elf) 757 { 758 TEE_Result res = TEE_SUCCESS; 759 760 parse_load_segments(elf); 761 adjust_segments(elf); 762 if (TAILQ_FIRST(&elf->segs)->offset < SMALL_PAGE_SIZE) { 763 vaddr_t va = 0; 764 size_t sz = elf->max_addr - elf->load_addr; 765 struct segment *seg = TAILQ_LAST(&elf->segs, segment_head); 766 size_t pad_begin = get_pad_begin(); 767 768 /* 769 * We're loading a library, if not other parts of the code 770 * need to be updated too. 771 */ 772 assert(!elf->is_main); 773 774 /* 775 * Now that we know how much virtual memory is needed move 776 * the already mapped part to a location which can 777 * accommodate us. 778 */ 779 res = sys_remap(elf->load_addr, &va, sz, pad_begin, 780 roundup(seg->vaddr + seg->memsz)); 781 if (res == TEE_ERROR_OUT_OF_MEMORY) 782 res = sys_remap(elf->load_addr, &va, sz, 0, 783 roundup(seg->vaddr + seg->memsz)); 784 if (res) 785 err(res, "sys_remap"); 786 elf->ehdr_addr = va; 787 elf->load_addr = va; 788 elf->max_addr = va + sz; 789 elf->phdr = (void *)(va + elf->e_phoff); 790 } 791 } 792 793 static void add_deps_from_segment(struct ta_elf *elf, unsigned int type, 794 vaddr_t addr, size_t memsz) 795 { 796 size_t dyn_entsize = 0; 797 size_t num_dyns = 0; 798 size_t n = 0; 799 unsigned int tag = 0; 800 size_t val = 0; 801 TEE_UUID uuid = { }; 802 char *str_tab = NULL; 803 size_t str_tab_sz = 0; 804 805 if (type != PT_DYNAMIC) 806 return; 807 808 check_phdr_in_range(elf, type, addr, memsz); 809 810 if (elf->is_32bit) 811 dyn_entsize = sizeof(Elf32_Dyn); 812 else 813 dyn_entsize = sizeof(Elf64_Dyn); 814 815 assert(!(memsz % dyn_entsize)); 816 num_dyns = memsz / dyn_entsize; 817 818 for (n = 0; n < num_dyns && !(str_tab && str_tab_sz); n++) { 819 read_dyn(elf, addr, n, &tag, &val); 820 if (tag == DT_STRTAB) 821 str_tab = (char *)(val + elf->load_addr); 822 else if (tag == DT_STRSZ) 823 str_tab_sz = val; 824 } 825 check_range(elf, "Strtab", str_tab, str_tab_sz); 826 827 for (n = 0; n < num_dyns; n++) { 828 read_dyn(elf, addr, n, &tag, &val); 829 if (tag != DT_NEEDED) 830 continue; 831 if (val >= str_tab_sz) 832 err(TEE_ERROR_GENERIC, 833 "Offset into strtab out of range"); 834 tee_uuid_from_str(&uuid, str_tab + val); 835 queue_elf(&uuid); 836 } 837 } 838 839 static void add_dependencies(struct ta_elf *elf) 840 { 841 size_t n = 0; 842 843 if (elf->is_32bit) { 844 Elf32_Phdr *phdr = elf->phdr; 845 846 for (n = 0; n < elf->e_phnum; n++) 847 add_deps_from_segment(elf, phdr[n].p_type, 848 phdr[n].p_vaddr, phdr[n].p_memsz); 849 } else { 850 Elf64_Phdr *phdr = elf->phdr; 851 852 for (n = 0; n < elf->e_phnum; n++) 853 add_deps_from_segment(elf, phdr[n].p_type, 854 phdr[n].p_vaddr, phdr[n].p_memsz); 855 } 856 } 857 858 static void copy_section_headers(struct ta_elf *elf) 859 { 860 TEE_Result res = TEE_SUCCESS; 861 size_t sz = 0; 862 size_t offs = 0; 863 864 if (MUL_OVERFLOW(elf->e_shnum, elf->e_shentsize, &sz)) 865 err(TEE_ERROR_BAD_FORMAT, "Shdr size overflow"); 866 867 elf->shdr = malloc(sz); 868 if (!elf->shdr) 869 err(TEE_ERROR_OUT_OF_MEMORY, "malloc"); 870 871 /* 872 * We're assuming that section headers comes after the load segments, 873 * but if it's a very small dynamically linked library the section 874 * headers can still end up (partially?) in the first mapped page. 875 */ 876 if (elf->e_shoff < SMALL_PAGE_SIZE) { 877 assert(!elf->is_main); 878 offs = MIN(SMALL_PAGE_SIZE - elf->e_shoff, sz); 879 memcpy(elf->shdr, (void *)(elf->load_addr + elf->e_shoff), 880 offs); 881 } 882 883 if (offs < sz) { 884 res = sys_copy_from_ta_bin((uint8_t *)elf->shdr + offs, 885 sz - offs, elf->handle, 886 elf->e_shoff + offs); 887 if (res) 888 err(res, "sys_copy_from_ta_bin"); 889 } 890 } 891 892 static void close_handle(struct ta_elf *elf) 893 { 894 TEE_Result res = sys_close_ta_bin(elf->handle); 895 896 if (res) 897 err(res, "sys_close_ta_bin"); 898 elf->handle = -1; 899 } 900 901 static void clean_elf_load_main(struct ta_elf *elf) 902 { 903 TEE_Result res = TEE_SUCCESS; 904 905 /* 906 * Clean up from last attempt to load 907 */ 908 res = sys_unmap(elf->ehdr_addr, SMALL_PAGE_SIZE); 909 if (res) 910 err(res, "sys_unmap"); 911 912 while (!TAILQ_EMPTY(&elf->segs)) { 913 struct segment *seg = TAILQ_FIRST(&elf->segs); 914 vaddr_t va = 0; 915 size_t num_bytes = 0; 916 917 va = rounddown(elf->load_addr + seg->vaddr); 918 if (seg->remapped_writeable) 919 num_bytes = roundup(seg->vaddr + seg->memsz) - 920 rounddown(seg->vaddr); 921 else 922 num_bytes = seg->memsz; 923 924 res = sys_unmap(va, num_bytes); 925 if (res) 926 err(res, "sys_unmap"); 927 928 TAILQ_REMOVE(&elf->segs, seg, link); 929 free(seg); 930 } 931 932 free(elf->shdr); 933 memset(&elf->is_32bit, 0, 934 (vaddr_t)&elf->uuid - (vaddr_t)&elf->is_32bit); 935 936 TAILQ_INIT(&elf->segs); 937 } 938 939 static void load_main(struct ta_elf *elf) 940 { 941 init_elf(elf); 942 map_segments(elf); 943 populate_segments(elf); 944 add_dependencies(elf); 945 copy_section_headers(elf); 946 save_symtab(elf); 947 close_handle(elf); 948 949 elf->head = (struct ta_head *)elf->load_addr; 950 if (elf->head->depr_entry != UINT64_MAX) { 951 /* 952 * Legacy TAs sets their entry point in ta_head. For 953 * non-legacy TAs the entry point of the ELF is set instead 954 * and leaving the ta_head entry point set to UINT64_MAX to 955 * indicate that it's not used. 956 * 957 * NB, everything before the commit a73b5878c89d ("Replace 958 * ta_head.entry with elf entry") is considered legacy TAs 959 * for ldelf. 960 * 961 * Legacy TAs cannot be mapped with shared memory segments 962 * so restart the mapping if it turned out we're loading a 963 * legacy TA. 964 */ 965 966 DMSG("Reloading TA %pUl as legacy TA", (void *)&elf->uuid); 967 clean_elf_load_main(elf); 968 elf->is_legacy = true; 969 init_elf(elf); 970 map_segments(elf); 971 populate_segments_legacy(elf); 972 add_dependencies(elf); 973 copy_section_headers(elf); 974 save_symtab(elf); 975 close_handle(elf); 976 elf->head = (struct ta_head *)elf->load_addr; 977 /* 978 * Check that the TA is still a legacy TA, if it isn't give 979 * up now since we're likely under attack. 980 */ 981 if (elf->head->depr_entry == UINT64_MAX) 982 err(TEE_ERROR_GENERIC, 983 "TA %pUl was changed on disk to non-legacy", 984 (void *)&elf->uuid); 985 } 986 987 } 988 989 void ta_elf_load_main(const TEE_UUID *uuid, uint32_t *is_32bit, uint64_t *sp, 990 uint32_t *ta_flags) 991 { 992 struct ta_elf *elf = queue_elf(uuid); 993 vaddr_t va = 0; 994 TEE_Result res = TEE_SUCCESS; 995 996 assert(elf); 997 elf->is_main = true; 998 999 load_main(elf); 1000 1001 *is_32bit = elf->is_32bit; 1002 res = sys_map_zi(elf->head->stack_size, 0, &va, 0, 0); 1003 if (res) 1004 err(res, "sys_map_zi stack"); 1005 1006 if (elf->head->flags & ~TA_FLAGS_MASK) 1007 err(TEE_ERROR_BAD_FORMAT, "Invalid TA flags(s) %#"PRIx32, 1008 elf->head->flags & ~TA_FLAGS_MASK); 1009 1010 *ta_flags = elf->head->flags; 1011 *sp = va + elf->head->stack_size; 1012 ta_stack = va; 1013 ta_stack_size = elf->head->stack_size; 1014 } 1015 1016 void ta_elf_finalize_load_main(uint64_t *entry) 1017 { 1018 struct ta_elf *elf = TAILQ_FIRST(&main_elf_queue); 1019 TEE_Result res = TEE_SUCCESS; 1020 1021 assert(elf->is_main); 1022 1023 res = ta_elf_set_init_fini_info(elf->is_32bit); 1024 if (res) 1025 err(res, "ta_elf_set_init_fini_info"); 1026 1027 if (elf->is_legacy) 1028 *entry = elf->head->depr_entry; 1029 else 1030 *entry = elf->e_entry + elf->load_addr; 1031 } 1032 1033 1034 void ta_elf_load_dependency(struct ta_elf *elf, bool is_32bit) 1035 { 1036 if (elf->is_main) 1037 return; 1038 1039 init_elf(elf); 1040 if (elf->is_32bit != is_32bit) 1041 err(TEE_ERROR_BAD_FORMAT, "ELF %pUl is %sbit (expected %sbit)", 1042 (void *)&elf->uuid, elf->is_32bit ? "32" : "64", 1043 is_32bit ? "32" : "64"); 1044 1045 map_segments(elf); 1046 populate_segments(elf); 1047 add_dependencies(elf); 1048 copy_section_headers(elf); 1049 save_symtab(elf); 1050 close_handle(elf); 1051 } 1052 1053 void ta_elf_finalize_mappings(struct ta_elf *elf) 1054 { 1055 TEE_Result res = TEE_SUCCESS; 1056 struct segment *seg = NULL; 1057 1058 if (!elf->is_legacy) 1059 return; 1060 1061 TAILQ_FOREACH(seg, &elf->segs, link) { 1062 vaddr_t va = elf->load_addr + seg->vaddr; 1063 uint32_t flags = 0; 1064 1065 if (seg->flags & PF_W) 1066 flags |= PTA_SYSTEM_MAP_FLAG_WRITEABLE; 1067 if (seg->flags & PF_X) 1068 flags |= PTA_SYSTEM_MAP_FLAG_EXECUTABLE; 1069 1070 res = sys_set_prot(va, seg->memsz, flags); 1071 if (res) 1072 err(res, "sys_set_prot"); 1073 } 1074 } 1075 1076 static void __printf(3, 4) print_wrapper(void *pctx, print_func_t print_func, 1077 const char *fmt, ...) 1078 { 1079 va_list ap; 1080 1081 va_start(ap, fmt); 1082 print_func(pctx, fmt, ap); 1083 va_end(ap); 1084 } 1085 1086 static void print_seg(void *pctx, print_func_t print_func, 1087 size_t idx __maybe_unused, int elf_idx __maybe_unused, 1088 vaddr_t va __maybe_unused, paddr_t pa __maybe_unused, 1089 size_t sz __maybe_unused, uint32_t flags) 1090 { 1091 int width __maybe_unused = 8; 1092 char desc[14] __maybe_unused = ""; 1093 char flags_str[] __maybe_unused = "----"; 1094 1095 if (elf_idx > -1) { 1096 snprintf(desc, sizeof(desc), " [%d]", elf_idx); 1097 } else { 1098 if (flags & DUMP_MAP_EPHEM) 1099 snprintf(desc, sizeof(desc), " (param)"); 1100 if (flags & DUMP_MAP_LDELF) 1101 snprintf(desc, sizeof(desc), " (ldelf)"); 1102 if (va == ta_stack) 1103 snprintf(desc, sizeof(desc), " (stack)"); 1104 } 1105 1106 if (flags & DUMP_MAP_READ) 1107 flags_str[0] = 'r'; 1108 if (flags & DUMP_MAP_WRITE) 1109 flags_str[1] = 'w'; 1110 if (flags & DUMP_MAP_EXEC) 1111 flags_str[2] = 'x'; 1112 if (flags & DUMP_MAP_SECURE) 1113 flags_str[3] = 's'; 1114 1115 print_wrapper(pctx, print_func, 1116 "region %2zu: va 0x%0*"PRIxVA" pa 0x%0*"PRIxPA" size 0x%06zx flags %s%s\n", 1117 idx, width, va, width, pa, sz, flags_str, desc); 1118 } 1119 1120 static bool get_next_in_order(struct ta_elf_queue *elf_queue, 1121 struct ta_elf **elf, struct segment **seg, 1122 size_t *elf_idx) 1123 { 1124 struct ta_elf *e = NULL; 1125 struct segment *s = NULL; 1126 size_t idx = 0; 1127 vaddr_t va = 0; 1128 struct ta_elf *e2 = NULL; 1129 size_t i2 = 0; 1130 1131 assert(elf && seg && elf_idx); 1132 e = *elf; 1133 s = *seg; 1134 assert((e == NULL && s == NULL) || (e != NULL && s != NULL)); 1135 1136 if (s) { 1137 s = TAILQ_NEXT(s, link); 1138 if (s) { 1139 *seg = s; 1140 return true; 1141 } 1142 } 1143 1144 if (e) 1145 va = e->load_addr; 1146 1147 /* Find the ELF with next load address */ 1148 e = NULL; 1149 TAILQ_FOREACH(e2, elf_queue, link) { 1150 if (e2->load_addr > va) { 1151 if (!e || e2->load_addr < e->load_addr) { 1152 e = e2; 1153 idx = i2; 1154 } 1155 } 1156 i2++; 1157 } 1158 if (!e) 1159 return false; 1160 1161 *elf = e; 1162 *seg = TAILQ_FIRST(&e->segs); 1163 *elf_idx = idx; 1164 return true; 1165 } 1166 1167 void ta_elf_print_mappings(void *pctx, print_func_t print_func, 1168 struct ta_elf_queue *elf_queue, size_t num_maps, 1169 struct dump_map *maps, vaddr_t mpool_base) 1170 { 1171 struct segment *seg = NULL; 1172 struct ta_elf *elf = NULL; 1173 size_t elf_idx = 0; 1174 size_t idx = 0; 1175 size_t map_idx = 0; 1176 1177 /* 1178 * Loop over all segments and maps, printing virtual address in 1179 * order. Segment has priority if the virtual address is present 1180 * in both map and segment. 1181 */ 1182 get_next_in_order(elf_queue, &elf, &seg, &elf_idx); 1183 while (true) { 1184 vaddr_t va = -1; 1185 size_t sz = 0; 1186 uint32_t flags = DUMP_MAP_SECURE; 1187 size_t offs = 0; 1188 1189 if (seg) { 1190 va = rounddown(seg->vaddr + elf->load_addr); 1191 sz = roundup(seg->vaddr + seg->memsz) - 1192 rounddown(seg->vaddr); 1193 } 1194 1195 while (map_idx < num_maps && maps[map_idx].va <= va) { 1196 uint32_t f = 0; 1197 1198 /* If there's a match, it should be the same map */ 1199 if (maps[map_idx].va == va) { 1200 /* 1201 * In shared libraries the first page is 1202 * mapped separately with the rest of that 1203 * segment following back to back in a 1204 * separate entry. 1205 */ 1206 if (map_idx + 1 < num_maps && 1207 maps[map_idx].sz == SMALL_PAGE_SIZE) { 1208 vaddr_t next_va = maps[map_idx].va + 1209 maps[map_idx].sz; 1210 size_t comb_sz = maps[map_idx].sz + 1211 maps[map_idx + 1].sz; 1212 1213 if (next_va == maps[map_idx + 1].va && 1214 comb_sz == sz && 1215 maps[map_idx].flags == 1216 maps[map_idx + 1].flags) { 1217 /* Skip this and next entry */ 1218 map_idx += 2; 1219 continue; 1220 } 1221 } 1222 assert(maps[map_idx].sz == sz); 1223 } else if (maps[map_idx].va < va) { 1224 if (maps[map_idx].va == mpool_base) 1225 f |= DUMP_MAP_LDELF; 1226 print_seg(pctx, print_func, idx, -1, 1227 maps[map_idx].va, maps[map_idx].pa, 1228 maps[map_idx].sz, 1229 maps[map_idx].flags | f); 1230 idx++; 1231 } 1232 map_idx++; 1233 } 1234 1235 if (!seg) 1236 break; 1237 1238 offs = rounddown(seg->offset); 1239 if (seg->flags & PF_R) 1240 flags |= DUMP_MAP_READ; 1241 if (seg->flags & PF_W) 1242 flags |= DUMP_MAP_WRITE; 1243 if (seg->flags & PF_X) 1244 flags |= DUMP_MAP_EXEC; 1245 1246 print_seg(pctx, print_func, idx, elf_idx, va, offs, sz, flags); 1247 idx++; 1248 1249 if (!get_next_in_order(elf_queue, &elf, &seg, &elf_idx)) 1250 seg = NULL; 1251 } 1252 1253 elf_idx = 0; 1254 TAILQ_FOREACH(elf, elf_queue, link) { 1255 print_wrapper(pctx, print_func, 1256 " [%zu] %pUl @ 0x%0*"PRIxVA"\n", 1257 elf_idx, (void *)&elf->uuid, 8, elf->load_addr); 1258 elf_idx++; 1259 } 1260 } 1261 1262 #ifdef CFG_UNWIND 1263 void ta_elf_stack_trace_a32(uint32_t regs[16]) 1264 { 1265 struct unwind_state_arm32 state = { }; 1266 1267 memcpy(state.registers, regs, sizeof(state.registers)); 1268 print_stack_arm32(&state, ta_stack, ta_stack_size); 1269 } 1270 1271 void ta_elf_stack_trace_a64(uint64_t fp, uint64_t sp, uint64_t pc) 1272 { 1273 struct unwind_state_arm64 state = { .fp = fp, .sp = sp, .pc = pc }; 1274 1275 print_stack_arm64(&state, ta_stack, ta_stack_size); 1276 } 1277 #endif 1278 1279 TEE_Result ta_elf_add_library(const TEE_UUID *uuid) 1280 { 1281 struct ta_elf *ta = TAILQ_FIRST(&main_elf_queue); 1282 struct ta_elf *lib = ta_elf_find_elf(uuid); 1283 struct ta_elf *elf = NULL; 1284 1285 if (lib) 1286 return TEE_SUCCESS; /* Already mapped */ 1287 1288 lib = queue_elf_helper(uuid); 1289 if (!lib) 1290 return TEE_ERROR_OUT_OF_MEMORY; 1291 1292 for (elf = lib; elf; elf = TAILQ_NEXT(elf, link)) 1293 ta_elf_load_dependency(elf, ta->is_32bit); 1294 1295 for (elf = lib; elf; elf = TAILQ_NEXT(elf, link)) { 1296 ta_elf_relocate(elf); 1297 ta_elf_finalize_mappings(elf); 1298 } 1299 1300 for (elf = lib; elf; elf = TAILQ_NEXT(elf, link)) 1301 DMSG("ELF (%pUl) at %#"PRIxVA, 1302 (void *)&elf->uuid, elf->load_addr); 1303 1304 return ta_elf_set_init_fini_info(ta->is_32bit); 1305 } 1306 1307 /* Get address/size of .init_array and .fini_array from the dynamic segment */ 1308 static void get_init_fini_array(struct ta_elf *elf, unsigned int type, 1309 vaddr_t addr, size_t memsz, vaddr_t *init, 1310 size_t *init_cnt, vaddr_t *fini, 1311 size_t *fini_cnt) 1312 { 1313 size_t addrsz = 0; 1314 size_t dyn_entsize = 0; 1315 size_t num_dyns = 0; 1316 size_t n = 0; 1317 unsigned int tag = 0; 1318 size_t val = 0; 1319 1320 assert(type == PT_DYNAMIC); 1321 1322 check_phdr_in_range(elf, type, addr, memsz); 1323 1324 if (elf->is_32bit) { 1325 dyn_entsize = sizeof(Elf32_Dyn); 1326 addrsz = 4; 1327 } else { 1328 dyn_entsize = sizeof(Elf64_Dyn); 1329 addrsz = 8; 1330 } 1331 1332 assert(!(memsz % dyn_entsize)); 1333 num_dyns = memsz / dyn_entsize; 1334 1335 for (n = 0; n < num_dyns; n++) { 1336 read_dyn(elf, addr, n, &tag, &val); 1337 if (tag == DT_INIT_ARRAY) 1338 *init = val + elf->load_addr; 1339 else if (tag == DT_FINI_ARRAY) 1340 *fini = val + elf->load_addr; 1341 else if (tag == DT_INIT_ARRAYSZ) 1342 *init_cnt = val / addrsz; 1343 else if (tag == DT_FINI_ARRAYSZ) 1344 *fini_cnt = val / addrsz; 1345 } 1346 } 1347 1348 /* Get address/size of .init_array and .fini_array in @elf (if present) */ 1349 static void elf_get_init_fini_array(struct ta_elf *elf, vaddr_t *init, 1350 size_t *init_cnt, vaddr_t *fini, 1351 size_t *fini_cnt) 1352 { 1353 size_t n = 0; 1354 1355 if (elf->is_32bit) { 1356 Elf32_Phdr *phdr = elf->phdr; 1357 1358 for (n = 0; n < elf->e_phnum; n++) { 1359 if (phdr[n].p_type == PT_DYNAMIC) { 1360 get_init_fini_array(elf, phdr[n].p_type, 1361 phdr[n].p_vaddr, 1362 phdr[n].p_memsz, 1363 init, init_cnt, fini, 1364 fini_cnt); 1365 return; 1366 } 1367 } 1368 } else { 1369 Elf64_Phdr *phdr = elf->phdr; 1370 1371 for (n = 0; n < elf->e_phnum; n++) { 1372 if (phdr[n].p_type == PT_DYNAMIC) { 1373 get_init_fini_array(elf, phdr[n].p_type, 1374 phdr[n].p_vaddr, 1375 phdr[n].p_memsz, 1376 init, init_cnt, fini, 1377 fini_cnt); 1378 return; 1379 } 1380 } 1381 } 1382 } 1383 1384 static TEE_Result realloc_ifs(vaddr_t va, size_t cnt, bool is_32bit) 1385 { 1386 struct __init_fini_info32 *info32 = (struct __init_fini_info32 *)va; 1387 struct __init_fini_info *info = (struct __init_fini_info *)va; 1388 struct __init_fini32 *ifs32 = NULL; 1389 struct __init_fini *ifs = NULL; 1390 size_t prev_cnt = 0; 1391 void *ptr = NULL; 1392 1393 if (is_32bit) { 1394 ptr = (void *)(vaddr_t)info32->ifs; 1395 ptr = realloc(ptr, cnt * sizeof(struct __init_fini32)); 1396 if (!ptr) 1397 return TEE_ERROR_OUT_OF_MEMORY; 1398 ifs32 = ptr; 1399 prev_cnt = info32->size; 1400 if (cnt > prev_cnt) 1401 memset(ifs32 + prev_cnt, 0, 1402 (cnt - prev_cnt) * sizeof(*ifs32)); 1403 info32->ifs = (uint32_t)(vaddr_t)ifs32; 1404 info32->size = cnt; 1405 } else { 1406 ptr = realloc(info->ifs, cnt * sizeof(struct __init_fini)); 1407 if (!ptr) 1408 return TEE_ERROR_OUT_OF_MEMORY; 1409 ifs = ptr; 1410 prev_cnt = info->size; 1411 if (cnt > prev_cnt) 1412 memset(ifs + prev_cnt, 0, 1413 (cnt - prev_cnt) * sizeof(*ifs)); 1414 info->ifs = ifs; 1415 info->size = cnt; 1416 } 1417 1418 return TEE_SUCCESS; 1419 } 1420 1421 static void fill_ifs(vaddr_t va, size_t idx, struct ta_elf *elf, bool is_32bit) 1422 { 1423 struct __init_fini_info32 *info32 = (struct __init_fini_info32 *)va; 1424 struct __init_fini_info *info = (struct __init_fini_info *)va; 1425 struct __init_fini32 *ifs32 = NULL; 1426 struct __init_fini *ifs = NULL; 1427 size_t init_cnt = 0; 1428 size_t fini_cnt = 0; 1429 vaddr_t init = 0; 1430 vaddr_t fini = 0; 1431 1432 if (is_32bit) { 1433 assert(idx < info32->size); 1434 ifs32 = &((struct __init_fini32 *)(vaddr_t)info32->ifs)[idx]; 1435 1436 if (ifs32->flags & __IFS_VALID) 1437 return; 1438 1439 elf_get_init_fini_array(elf, &init, &init_cnt, &fini, 1440 &fini_cnt); 1441 1442 ifs32->init = (uint32_t)init; 1443 ifs32->init_size = init_cnt; 1444 1445 ifs32->fini = (uint32_t)fini; 1446 ifs32->fini_size = fini_cnt; 1447 1448 ifs32->flags |= __IFS_VALID; 1449 } else { 1450 assert(idx < info->size); 1451 ifs = &info->ifs[idx]; 1452 1453 if (ifs->flags & __IFS_VALID) 1454 return; 1455 1456 elf_get_init_fini_array(elf, &init, &init_cnt, &fini, 1457 &fini_cnt); 1458 1459 ifs->init = (void (**)(void))init; 1460 ifs->init_size = init_cnt; 1461 1462 ifs->fini = (void (**)(void))fini; 1463 ifs->fini_size = fini_cnt; 1464 1465 ifs->flags |= __IFS_VALID; 1466 } 1467 } 1468 1469 /* 1470 * Set or update __init_fini_info in the TA with information from the ELF 1471 * queue 1472 */ 1473 TEE_Result ta_elf_set_init_fini_info(bool is_32bit) 1474 { 1475 struct __init_fini_info *info = NULL; 1476 TEE_Result res = TEE_SUCCESS; 1477 struct ta_elf *elf = NULL; 1478 vaddr_t info_va = 0; 1479 size_t cnt = 0; 1480 1481 res = ta_elf_resolve_sym("__init_fini_info", &info_va, NULL); 1482 if (res) { 1483 if (res == TEE_ERROR_ITEM_NOT_FOUND) { 1484 /* Older TA */ 1485 return TEE_SUCCESS; 1486 } 1487 return res; 1488 } 1489 assert(info_va); 1490 1491 info = (struct __init_fini_info *)info_va; 1492 if (info->reserved) 1493 return TEE_ERROR_NOT_SUPPORTED; 1494 1495 TAILQ_FOREACH(elf, &main_elf_queue, link) 1496 cnt++; 1497 1498 /* Queue has at least one file (main) */ 1499 assert(cnt); 1500 1501 res = realloc_ifs(info_va, cnt, is_32bit); 1502 if (res) 1503 goto err; 1504 1505 cnt = 0; 1506 TAILQ_FOREACH(elf, &main_elf_queue, link) { 1507 fill_ifs(info_va, cnt, elf, is_32bit); 1508 cnt++; 1509 } 1510 1511 return TEE_SUCCESS; 1512 err: 1513 free(info); 1514 return res; 1515 } 1516