xref: /optee_os/ldelf/ta_elf.c (revision ab49cb75f475662c42f7c8fbc06cc3c551734100)
1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3  * Copyright (c) 2019, Linaro Limited
4  */
5 
6 #include <assert.h>
7 #include <ctype.h>
8 #include <elf32.h>
9 #include <elf64.h>
10 #include <elf_common.h>
11 #include <ldelf.h>
12 #include <pta_system.h>
13 #include <stdio.h>
14 #include <stdlib.h>
15 #include <string_ext.h>
16 #include <string.h>
17 #include <tee_api_types.h>
18 #include <tee_internal_api_extensions.h>
19 #include <user_ta_header.h>
20 #include <utee_syscalls.h>
21 #include <util.h>
22 
23 #include "sys.h"
24 #include "ta_elf.h"
25 #include "unwind.h"
26 
27 static vaddr_t ta_stack;
28 static vaddr_t ta_stack_size;
29 
30 struct ta_elf_queue main_elf_queue = TAILQ_HEAD_INITIALIZER(main_elf_queue);
31 
32 static struct ta_elf *queue_elf_helper(const TEE_UUID *uuid)
33 {
34 	struct ta_elf *elf = calloc(1, sizeof(*elf));
35 
36 	if (!elf)
37 		return NULL;
38 
39 	TAILQ_INIT(&elf->segs);
40 
41 	elf->uuid = *uuid;
42 	TAILQ_INSERT_TAIL(&main_elf_queue, elf, link);
43 	return elf;
44 }
45 
46 static struct ta_elf *queue_elf(const TEE_UUID *uuid)
47 {
48 	struct ta_elf *elf = ta_elf_find_elf(uuid);
49 
50 	if (elf)
51 		return NULL;
52 
53 	elf = queue_elf_helper(uuid);
54 	if (!elf)
55 		err(TEE_ERROR_OUT_OF_MEMORY, "queue_elf_helper");
56 
57 	return elf;
58 }
59 
60 struct ta_elf *ta_elf_find_elf(const TEE_UUID *uuid)
61 {
62 	struct ta_elf *elf = NULL;
63 
64 	TAILQ_FOREACH(elf, &main_elf_queue, link)
65 		if (!memcmp(uuid, &elf->uuid, sizeof(*uuid)))
66 			return elf;
67 
68 	return NULL;
69 }
70 
71 static TEE_Result e32_parse_ehdr(struct ta_elf *elf, Elf32_Ehdr *ehdr)
72 {
73 	if (ehdr->e_ident[EI_VERSION] != EV_CURRENT ||
74 	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
75 	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
76 	    ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE ||
77 	    ehdr->e_type != ET_DYN || ehdr->e_machine != EM_ARM ||
78 	    (ehdr->e_flags & EF_ARM_ABIMASK) != EF_ARM_ABI_VERSION ||
79 #ifndef CFG_WITH_VFP
80 	    (ehdr->e_flags & EF_ARM_ABI_FLOAT_HARD) ||
81 #endif
82 	    ehdr->e_phentsize != sizeof(Elf32_Phdr) ||
83 	    ehdr->e_shentsize != sizeof(Elf32_Shdr))
84 		return TEE_ERROR_BAD_FORMAT;
85 
86 	elf->is_32bit = true;
87 	elf->e_entry = ehdr->e_entry;
88 	elf->e_phoff = ehdr->e_phoff;
89 	elf->e_shoff = ehdr->e_shoff;
90 	elf->e_phnum = ehdr->e_phnum;
91 	elf->e_shnum = ehdr->e_shnum;
92 	elf->e_phentsize = ehdr->e_phentsize;
93 	elf->e_shentsize = ehdr->e_shentsize;
94 
95 	return TEE_SUCCESS;
96 }
97 
98 #ifdef ARM64
99 static TEE_Result e64_parse_ehdr(struct ta_elf *elf, Elf64_Ehdr *ehdr)
100 {
101 	if (ehdr->e_ident[EI_VERSION] != EV_CURRENT ||
102 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
103 	    ehdr->e_ident[EI_DATA] != ELFDATA2LSB ||
104 	    ehdr->e_ident[EI_OSABI] != ELFOSABI_NONE ||
105 	    ehdr->e_type != ET_DYN || ehdr->e_machine != EM_AARCH64 ||
106 	    ehdr->e_flags || ehdr->e_phentsize != sizeof(Elf64_Phdr) ||
107 	    ehdr->e_shentsize != sizeof(Elf64_Shdr))
108 		return TEE_ERROR_BAD_FORMAT;
109 
110 
111 	elf->is_32bit = false;
112 	elf->e_entry = ehdr->e_entry;
113 	elf->e_phoff = ehdr->e_phoff;
114 	elf->e_shoff = ehdr->e_shoff;
115 	elf->e_phnum = ehdr->e_phnum;
116 	elf->e_shnum = ehdr->e_shnum;
117 	elf->e_phentsize = ehdr->e_phentsize;
118 	elf->e_shentsize = ehdr->e_shentsize;
119 
120 	return TEE_SUCCESS;
121 }
122 #else /*ARM64*/
123 static TEE_Result e64_parse_ehdr(struct ta_elf *elf __unused,
124 				 Elf64_Ehdr *ehdr __unused)
125 {
126 	return TEE_ERROR_NOT_SUPPORTED;
127 }
128 #endif /*ARM64*/
129 
130 static void check_phdr_in_range(struct ta_elf *elf, unsigned int type,
131 				vaddr_t addr, size_t memsz)
132 {
133 	vaddr_t max_addr = 0;
134 
135 	if (ADD_OVERFLOW(addr, memsz, &max_addr))
136 		err(TEE_ERROR_BAD_FORMAT, "Program header %#x overflow", type);
137 
138 	/*
139 	 * elf->load_addr and elf->max_addr are both using the
140 	 * final virtual addresses, while this program header is
141 	 * relative to 0.
142 	 */
143 	if (max_addr > elf->max_addr - elf->load_addr)
144 		err(TEE_ERROR_BAD_FORMAT, "Program header %#x out of bounds",
145 		    type);
146 }
147 
148 static void read_dyn(struct ta_elf *elf, vaddr_t addr,
149 		     size_t idx, unsigned int *tag, size_t *val)
150 {
151 	if (elf->is_32bit) {
152 		Elf32_Dyn *dyn = (Elf32_Dyn *)(addr + elf->load_addr);
153 
154 		*tag = dyn[idx].d_tag;
155 		*val = dyn[idx].d_un.d_val;
156 	} else {
157 		Elf64_Dyn *dyn = (Elf64_Dyn *)(addr + elf->load_addr);
158 
159 		*tag = dyn[idx].d_tag;
160 		*val = dyn[idx].d_un.d_val;
161 	}
162 }
163 
164 static void save_hashtab_from_segment(struct ta_elf *elf, unsigned int type,
165 				      vaddr_t addr, size_t memsz)
166 {
167 	size_t dyn_entsize = 0;
168 	size_t num_dyns = 0;
169 	size_t n = 0;
170 	unsigned int tag = 0;
171 	size_t val = 0;
172 
173 	if (type != PT_DYNAMIC)
174 		return;
175 
176 	check_phdr_in_range(elf, type, addr, memsz);
177 
178 	if (elf->is_32bit)
179 		dyn_entsize = sizeof(Elf32_Dyn);
180 	else
181 		dyn_entsize = sizeof(Elf64_Dyn);
182 
183 	assert(!(memsz % dyn_entsize));
184 	num_dyns = memsz / dyn_entsize;
185 
186 	for (n = 0; n < num_dyns; n++) {
187 		read_dyn(elf, addr, n, &tag, &val);
188 		if (tag == DT_HASH) {
189 			elf->hashtab = (void *)(val + elf->load_addr);
190 			break;
191 		}
192 	}
193 }
194 
195 static void check_range(struct ta_elf *elf, const char *name, const void *ptr,
196 			size_t sz)
197 {
198 	size_t max_addr = 0;
199 
200 	if ((vaddr_t)ptr < elf->load_addr)
201 		err(TEE_ERROR_GENERIC, "%s %p out of range", name, ptr);
202 
203 	if (ADD_OVERFLOW((vaddr_t)ptr, sz, &max_addr))
204 		err(TEE_ERROR_GENERIC, "%s range overflow", name);
205 
206 	if (max_addr > elf->max_addr)
207 		err(TEE_ERROR_GENERIC,
208 		    "%s %p..%#zx out of range", name, ptr, max_addr);
209 }
210 
211 static void check_hashtab(struct ta_elf *elf, void *ptr, size_t num_buckets,
212 			  size_t num_chains)
213 {
214 	/*
215 	 * Starting from 2 as the first two words are mandatory and hold
216 	 * num_buckets and num_chains. So this function is called twice,
217 	 * first to see that there's indeed room for num_buckets and
218 	 * num_chains and then to see that all of it fits.
219 	 * See http://www.sco.com/developers/gabi/latest/ch5.dynamic.html#hash
220 	 */
221 	size_t num_words = 2;
222 	size_t sz = 0;
223 
224 	if (!ALIGNMENT_IS_OK(ptr, uint32_t))
225 		err(TEE_ERROR_GENERIC, "Bad alignment of hashtab %p", ptr);
226 
227 	if (ADD_OVERFLOW(num_words, num_buckets, &num_words) ||
228 	    ADD_OVERFLOW(num_words, num_chains, &num_words) ||
229 	    MUL_OVERFLOW(num_words, sizeof(uint32_t), &sz))
230 		err(TEE_ERROR_GENERIC, "Hashtab overflow");
231 
232 	check_range(elf, "Hashtab", ptr, sz);
233 }
234 
235 static void save_hashtab(struct ta_elf *elf)
236 {
237 	uint32_t *hashtab = NULL;
238 	size_t n = 0;
239 
240 	if (elf->is_32bit) {
241 		Elf32_Phdr *phdr = elf->phdr;
242 
243 		for (n = 0; n < elf->e_phnum; n++)
244 			save_hashtab_from_segment(elf, phdr[n].p_type,
245 						  phdr[n].p_vaddr,
246 						  phdr[n].p_memsz);
247 	} else {
248 		Elf64_Phdr *phdr = elf->phdr;
249 
250 		for (n = 0; n < elf->e_phnum; n++)
251 			save_hashtab_from_segment(elf, phdr[n].p_type,
252 						  phdr[n].p_vaddr,
253 						  phdr[n].p_memsz);
254 	}
255 
256 	check_hashtab(elf, elf->hashtab, 0, 0);
257 	hashtab = elf->hashtab;
258 	check_hashtab(elf, elf->hashtab, hashtab[0], hashtab[1]);
259 }
260 
261 static void e32_save_symtab(struct ta_elf *elf, size_t tab_idx)
262 {
263 	Elf32_Shdr *shdr = elf->shdr;
264 	size_t str_idx = shdr[tab_idx].sh_link;
265 
266 	elf->dynsymtab = (void *)(shdr[tab_idx].sh_addr + elf->load_addr);
267 	if (!ALIGNMENT_IS_OK(elf->dynsymtab, Elf32_Sym))
268 		err(TEE_ERROR_GENERIC, "Bad alignment of dynsymtab %p",
269 		    elf->dynsymtab);
270 	check_range(elf, "Dynsymtab", elf->dynsymtab, shdr[tab_idx].sh_size);
271 
272 	if (shdr[tab_idx].sh_size % sizeof(Elf32_Sym))
273 		err(TEE_ERROR_GENERIC,
274 		    "Size of dynsymtab not an even multiple of Elf32_Sym");
275 	elf->num_dynsyms = shdr[tab_idx].sh_size / sizeof(Elf32_Sym);
276 
277 	if (str_idx >= elf->e_shnum)
278 		err(TEE_ERROR_GENERIC, "Dynstr section index out of range");
279 	elf->dynstr = (void *)(shdr[str_idx].sh_addr + elf->load_addr);
280 	check_range(elf, "Dynstr", elf->dynstr, shdr[str_idx].sh_size);
281 
282 	elf->dynstr_size = shdr[str_idx].sh_size;
283 }
284 
285 static void e64_save_symtab(struct ta_elf *elf, size_t tab_idx)
286 {
287 	Elf64_Shdr *shdr = elf->shdr;
288 	size_t str_idx = shdr[tab_idx].sh_link;
289 
290 	elf->dynsymtab = (void *)(vaddr_t)(shdr[tab_idx].sh_addr +
291 					   elf->load_addr);
292 
293 	if (!ALIGNMENT_IS_OK(elf->dynsymtab, Elf64_Sym))
294 		err(TEE_ERROR_GENERIC, "Bad alignment of dynsymtab %p",
295 		    elf->dynsymtab);
296 	check_range(elf, "Dynsymtab", elf->dynsymtab, shdr[tab_idx].sh_size);
297 
298 	if (shdr[tab_idx].sh_size % sizeof(Elf64_Sym))
299 		err(TEE_ERROR_GENERIC,
300 		    "Size of dynsymtab not an even multiple of Elf64_Sym");
301 	elf->num_dynsyms = shdr[tab_idx].sh_size / sizeof(Elf64_Sym);
302 
303 	if (str_idx >= elf->e_shnum)
304 		err(TEE_ERROR_GENERIC, "Dynstr section index out of range");
305 	elf->dynstr = (void *)(vaddr_t)(shdr[str_idx].sh_addr + elf->load_addr);
306 	check_range(elf, "Dynstr", elf->dynstr, shdr[str_idx].sh_size);
307 
308 	elf->dynstr_size = shdr[str_idx].sh_size;
309 }
310 
311 static void save_symtab(struct ta_elf *elf)
312 {
313 	size_t n = 0;
314 
315 	if (elf->is_32bit) {
316 		Elf32_Shdr *shdr = elf->shdr;
317 
318 		for (n = 0; n < elf->e_shnum; n++) {
319 			if (shdr[n].sh_type == SHT_DYNSYM) {
320 				e32_save_symtab(elf, n);
321 				break;
322 			}
323 		}
324 	} else {
325 		Elf64_Shdr *shdr = elf->shdr;
326 
327 		for (n = 0; n < elf->e_shnum; n++) {
328 			if (shdr[n].sh_type == SHT_DYNSYM) {
329 				e64_save_symtab(elf, n);
330 				break;
331 			}
332 		}
333 
334 	}
335 
336 	save_hashtab(elf);
337 }
338 
339 static void init_elf(struct ta_elf *elf)
340 {
341 	TEE_Result res = TEE_SUCCESS;
342 	vaddr_t va = 0;
343 	uint32_t flags = PTA_SYSTEM_MAP_FLAG_SHAREABLE;
344 
345 	res = sys_open_ta_bin(&elf->uuid, &elf->handle);
346 	if (res)
347 		err(res, "sys_open_ta_bin(%pUl)", (void *)&elf->uuid);
348 
349 	/*
350 	 * Map it read-only executable when we're loading a library where
351 	 * the ELF header is included in a load segment.
352 	 */
353 	if (!elf->is_main)
354 		flags |= PTA_SYSTEM_MAP_FLAG_EXECUTABLE;
355 	res = sys_map_ta_bin(&va, SMALL_PAGE_SIZE, flags, elf->handle, 0, 0, 0);
356 	if (res)
357 		err(res, "sys_map_ta_bin");
358 	elf->ehdr_addr = va;
359 	if (!elf->is_main) {
360 		elf->load_addr = va;
361 		elf->max_addr = va + SMALL_PAGE_SIZE;
362 		elf->max_offs = SMALL_PAGE_SIZE;
363 	}
364 
365 	if (!IS_ELF(*(Elf32_Ehdr *)va))
366 		err(TEE_ERROR_BAD_FORMAT, "TA is not an ELF");
367 
368 	res = e32_parse_ehdr(elf, (void *)va);
369 	if (res == TEE_ERROR_BAD_FORMAT)
370 		res = e64_parse_ehdr(elf, (void *)va);
371 	if (res)
372 		err(res, "Cannot parse ELF");
373 
374 	if (elf->e_phoff + elf->e_phnum * elf->e_phentsize > SMALL_PAGE_SIZE)
375 		err(TEE_ERROR_NOT_SUPPORTED, "Cannot read program headers");
376 
377 	elf->phdr = (void *)(va + elf->e_phoff);
378 }
379 
380 static size_t roundup(size_t v)
381 {
382 	return ROUNDUP(v, SMALL_PAGE_SIZE);
383 }
384 
385 static size_t rounddown(size_t v)
386 {
387 	return ROUNDDOWN(v, SMALL_PAGE_SIZE);
388 }
389 
390 static void add_segment(struct ta_elf *elf, size_t offset, size_t vaddr,
391 			size_t filesz, size_t memsz, size_t flags, size_t align)
392 {
393 	struct segment *seg = calloc(1, sizeof(*seg));
394 
395 	if (!seg)
396 		err(TEE_ERROR_OUT_OF_MEMORY, "calloc");
397 
398 	seg->offset = offset;
399 	seg->vaddr = vaddr;
400 	seg->filesz = filesz;
401 	seg->memsz = memsz;
402 	seg->flags = flags;
403 	seg->align = align;
404 
405 	TAILQ_INSERT_TAIL(&elf->segs, seg, link);
406 }
407 
408 static void parse_load_segments(struct ta_elf *elf)
409 {
410 	size_t n = 0;
411 
412 	if (elf->is_32bit) {
413 		Elf32_Phdr *phdr = elf->phdr;
414 
415 		for (n = 0; n < elf->e_phnum; n++)
416 			if (phdr[n].p_type == PT_LOAD) {
417 				add_segment(elf, phdr[n].p_offset,
418 					    phdr[n].p_vaddr, phdr[n].p_filesz,
419 					    phdr[n].p_memsz, phdr[n].p_flags,
420 					    phdr[n].p_align);
421 			} else if (phdr[n].p_type == PT_ARM_EXIDX) {
422 				elf->exidx_start = phdr[n].p_vaddr;
423 				elf->exidx_size = phdr[n].p_filesz;
424 			}
425 	} else {
426 		Elf64_Phdr *phdr = elf->phdr;
427 
428 		for (n = 0; n < elf->e_phnum; n++)
429 			if (phdr[n].p_type == PT_LOAD)
430 				add_segment(elf, phdr[n].p_offset,
431 					    phdr[n].p_vaddr, phdr[n].p_filesz,
432 					    phdr[n].p_memsz, phdr[n].p_flags,
433 					    phdr[n].p_align);
434 	}
435 }
436 
437 static void copy_remapped_to(struct ta_elf *elf, const struct segment *seg)
438 {
439 	uint8_t *dst = (void *)(seg->vaddr + elf->load_addr);
440 	size_t n = 0;
441 	size_t offs = seg->offset;
442 	size_t num_bytes = seg->filesz;
443 
444 	if (offs < elf->max_offs) {
445 		n = MIN(elf->max_offs - offs, num_bytes);
446 		memcpy(dst, (void *)(elf->max_addr + offs - elf->max_offs), n);
447 		dst += n;
448 		offs += n;
449 		num_bytes -= n;
450 	}
451 
452 	if (num_bytes) {
453 		TEE_Result res = sys_copy_from_ta_bin(dst, num_bytes,
454 						      elf->handle, offs);
455 
456 		if (res)
457 			err(res, "sys_copy_from_ta_bin");
458 		elf->max_offs += offs;
459 	}
460 }
461 
462 static void adjust_segments(struct ta_elf *elf)
463 {
464 	struct segment *seg = NULL;
465 	struct segment *prev_seg = NULL;
466 	size_t prev_end_addr = 0;
467 	size_t align = 0;
468 	size_t mask = 0;
469 
470 	/* Sanity check */
471 	TAILQ_FOREACH(seg, &elf->segs, link) {
472 		size_t dummy __maybe_unused = 0;
473 
474 		assert(seg->align >= SMALL_PAGE_SIZE);
475 		assert(!ADD_OVERFLOW(seg->vaddr, seg->memsz, &dummy));
476 		assert(seg->filesz <= seg->memsz);
477 		assert((seg->offset & SMALL_PAGE_MASK) ==
478 		       (seg->vaddr & SMALL_PAGE_MASK));
479 
480 		prev_seg = TAILQ_PREV(seg, segment_head, link);
481 		if (prev_seg) {
482 			assert(seg->vaddr >= prev_seg->vaddr + prev_seg->memsz);
483 			assert(seg->offset >=
484 			       prev_seg->offset + prev_seg->filesz);
485 		}
486 		if (!align)
487 			align = seg->align;
488 		assert(align == seg->align);
489 	}
490 
491 	mask = align - 1;
492 
493 	seg = TAILQ_FIRST(&elf->segs);
494 	if (seg)
495 		seg = TAILQ_NEXT(seg, link);
496 	while (seg) {
497 		prev_seg = TAILQ_PREV(seg, segment_head, link);
498 		prev_end_addr = prev_seg->vaddr + prev_seg->memsz;
499 
500 		/*
501 		 * This segment may overlap with the last "page" in the
502 		 * previous segment in two different ways:
503 		 * 1. Virtual address (and offset) overlaps =>
504 		 *    Permissions needs to be merged. The offset must have
505 		 *    the SMALL_PAGE_MASK bits set as vaddr and offset must
506 		 *    add up with prevsion segment.
507 		 *
508 		 * 2. Only offset overlaps =>
509 		 *    The same page in the ELF is mapped at two different
510 		 *    virtual addresses. As a limitation this segment must
511 		 *    be mapped as writeable.
512 		 */
513 
514 		/* Case 1. */
515 		if (rounddown(seg->vaddr) < prev_end_addr) {
516 			assert((seg->vaddr & mask) == (seg->offset & mask));
517 			assert(prev_seg->memsz == prev_seg->filesz);
518 
519 			/*
520 			 * Merge the segments and their permissions.
521 			 * Note that the may be a small hole between the
522 			 * two sections.
523 			 */
524 			prev_seg->filesz = seg->vaddr + seg->filesz -
525 					   prev_seg->vaddr;
526 			prev_seg->memsz = seg->vaddr + seg->memsz -
527 					   prev_seg->vaddr;
528 			prev_seg->flags |= seg->flags;
529 
530 			TAILQ_REMOVE(&elf->segs, seg, link);
531 			free(seg);
532 			seg = TAILQ_NEXT(prev_seg, link);
533 			continue;
534 		}
535 
536 		/* Case 2. */
537 		if ((seg->offset & mask) &&
538 		    rounddown(seg->offset) <
539 		    (prev_seg->offset + prev_seg->filesz)) {
540 
541 			assert(seg->flags & PF_W);
542 			seg->remapped_writeable = true;
543 		}
544 
545 		/*
546 		 * No overlap, but we may need to align address, offset and
547 		 * size.
548 		 */
549 		seg->filesz += seg->vaddr - rounddown(seg->vaddr);
550 		seg->memsz += seg->vaddr - rounddown(seg->vaddr);
551 		seg->vaddr = rounddown(seg->vaddr);
552 		seg->offset = rounddown(seg->offset);
553 		seg = TAILQ_NEXT(seg, link);
554 	}
555 
556 }
557 
558 static void populate_segments_legacy(struct ta_elf *elf)
559 {
560 	TEE_Result res = TEE_SUCCESS;
561 	struct segment *seg = NULL;
562 	vaddr_t va = 0;
563 
564 	assert(elf->is_legacy);
565 	TAILQ_FOREACH(seg, &elf->segs, link) {
566 		struct segment *last_seg = TAILQ_LAST(&elf->segs, segment_head);
567 		size_t pad_end = roundup(last_seg->vaddr + last_seg->memsz -
568 					 seg->vaddr - seg->memsz);
569 		size_t num_bytes = roundup(seg->memsz);
570 
571 		if (!elf->load_addr)
572 			va = 0;
573 		else
574 			va = seg->vaddr + elf->load_addr;
575 
576 
577 		if (!(seg->flags & PF_R))
578 			err(TEE_ERROR_NOT_SUPPORTED,
579 			    "Segment must be readable");
580 
581 		res = sys_map_zi(num_bytes, 0, &va, 0, pad_end);
582 		if (res)
583 			err(res, "sys_map_zi");
584 		res = sys_copy_from_ta_bin((void *)va, seg->filesz,
585 					   elf->handle, seg->offset);
586 		if (res)
587 			err(res, "sys_copy_from_ta_bin");
588 
589 		if (!elf->load_addr)
590 			elf->load_addr = va;
591 		elf->max_addr = va + num_bytes;
592 		elf->max_offs = seg->offset + seg->filesz;
593 	}
594 }
595 
596 static size_t get_pad_begin(void)
597 {
598 #ifdef CFG_TA_ASLR
599 	size_t min = CFG_TA_ASLR_MIN_OFFSET_PAGES;
600 	size_t max = CFG_TA_ASLR_MAX_OFFSET_PAGES;
601 	TEE_Result res = TEE_SUCCESS;
602 	uint32_t rnd32 = 0;
603 	size_t rnd = 0;
604 
605 	COMPILE_TIME_ASSERT(CFG_TA_ASLR_MIN_OFFSET_PAGES <
606 			    CFG_TA_ASLR_MAX_OFFSET_PAGES);
607 	if (max > min) {
608 		res = utee_cryp_random_number_generate(&rnd32, sizeof(rnd32));
609 		if (res) {
610 			DMSG("Random read failed: %#"PRIx32, res);
611 			return min * SMALL_PAGE_SIZE;
612 		}
613 		rnd = rnd32 % (max - min);
614 	}
615 
616 	return (min + rnd) * SMALL_PAGE_SIZE;
617 #else /*!CFG_TA_ASLR*/
618 	return 0;
619 #endif /*!CFG_TA_ASLR*/
620 }
621 
622 static void populate_segments(struct ta_elf *elf)
623 {
624 	TEE_Result res = TEE_SUCCESS;
625 	struct segment *seg = NULL;
626 	vaddr_t va = 0;
627 	size_t pad_begin = 0;
628 
629 	assert(!elf->is_legacy);
630 	TAILQ_FOREACH(seg, &elf->segs, link) {
631 		struct segment *last_seg = TAILQ_LAST(&elf->segs, segment_head);
632 		size_t pad_end = roundup(last_seg->vaddr + last_seg->memsz -
633 					 seg->vaddr - seg->memsz);
634 
635 		if (seg->remapped_writeable) {
636 			size_t num_bytes = roundup(seg->vaddr + seg->memsz) -
637 					   rounddown(seg->vaddr);
638 
639 			assert(elf->load_addr);
640 			va = rounddown(elf->load_addr + seg->vaddr);
641 			assert(va >= elf->max_addr);
642 			res = sys_map_zi(num_bytes, 0, &va, 0, pad_end);
643 			if (res)
644 				err(res, "sys_map_zi");
645 
646 			copy_remapped_to(elf, seg);
647 			elf->max_addr = va + num_bytes;
648 		} else {
649 			uint32_t flags =  0;
650 			size_t filesz = seg->filesz;
651 			size_t memsz = seg->memsz;
652 			size_t offset = seg->offset;
653 			size_t vaddr = seg->vaddr;
654 
655 			if (offset < elf->max_offs) {
656 				/*
657 				 * We're in a load segment which overlaps
658 				 * with (or is covered by) the first page
659 				 * of a shared library.
660 				 */
661 				if (vaddr + filesz < SMALL_PAGE_SIZE) {
662 					size_t num_bytes = 0;
663 
664 					/*
665 					 * If this segment is completely
666 					 * covered, take next.
667 					 */
668 					if (vaddr + memsz <= SMALL_PAGE_SIZE)
669 						continue;
670 
671 					/*
672 					 * All data of the segment is
673 					 * loaded, but we need to zero
674 					 * extend it.
675 					 */
676 					va = elf->max_addr;
677 					num_bytes = roundup(vaddr + memsz) -
678 						    roundup(vaddr) -
679 						    SMALL_PAGE_SIZE;
680 					assert(num_bytes);
681 					res = sys_map_zi(num_bytes, 0, &va, 0,
682 							 0);
683 					if (res)
684 						err(res, "sys_map_zi");
685 					elf->max_addr = roundup(va + num_bytes);
686 					continue;
687 				}
688 
689 				/* Partial overlap, remove the first page. */
690 				vaddr += SMALL_PAGE_SIZE;
691 				filesz -= SMALL_PAGE_SIZE;
692 				memsz -= SMALL_PAGE_SIZE;
693 				offset += SMALL_PAGE_SIZE;
694 			}
695 
696 			if (!elf->load_addr) {
697 				va = 0;
698 				pad_begin = get_pad_begin();
699 				/*
700 				 * If mapping with pad_begin fails we'll
701 				 * retry without pad_begin, effectively
702 				 * disabling ASLR for the current ELF file.
703 				 */
704 			} else {
705 				va = vaddr + elf->load_addr;
706 				pad_begin = 0;
707 			}
708 
709 			if (seg->flags & PF_W)
710 				flags |= PTA_SYSTEM_MAP_FLAG_WRITEABLE;
711 			else
712 				flags |= PTA_SYSTEM_MAP_FLAG_SHAREABLE;
713 			if (seg->flags & PF_X)
714 				flags |= PTA_SYSTEM_MAP_FLAG_EXECUTABLE;
715 			if (!(seg->flags & PF_R))
716 				err(TEE_ERROR_NOT_SUPPORTED,
717 				    "Segment must be readable");
718 			if (flags & PTA_SYSTEM_MAP_FLAG_WRITEABLE) {
719 				res = sys_map_zi(memsz, 0, &va, pad_begin,
720 						 pad_end);
721 				if (pad_begin && res == TEE_ERROR_OUT_OF_MEMORY)
722 					res = sys_map_zi(memsz, 0, &va, 0,
723 							 pad_end);
724 				if (res)
725 					err(res, "sys_map_zi");
726 				res = sys_copy_from_ta_bin((void *)va, filesz,
727 							   elf->handle, offset);
728 				if (res)
729 					err(res, "sys_copy_from_ta_bin");
730 			} else {
731 				res = sys_map_ta_bin(&va, filesz, flags,
732 						     elf->handle, offset,
733 						     pad_begin, pad_end);
734 				if (pad_begin && res == TEE_ERROR_OUT_OF_MEMORY)
735 					res = sys_map_ta_bin(&va, filesz, flags,
736 							     elf->handle,
737 							     offset, 0,
738 							     pad_end);
739 				if (res)
740 					err(res, "sys_map_ta_bin");
741 			}
742 
743 			if (!elf->load_addr)
744 				elf->load_addr = va;
745 			elf->max_addr = roundup(va + filesz);
746 			elf->max_offs += filesz;
747 		}
748 	}
749 }
750 
751 static void map_segments(struct ta_elf *elf)
752 {
753 	TEE_Result res = TEE_SUCCESS;
754 
755 	parse_load_segments(elf);
756 	adjust_segments(elf);
757 	if (TAILQ_FIRST(&elf->segs)->offset < SMALL_PAGE_SIZE) {
758 		vaddr_t va = 0;
759 		size_t sz = elf->max_addr - elf->load_addr;
760 		struct segment *seg = TAILQ_LAST(&elf->segs, segment_head);
761 		size_t pad_begin = get_pad_begin();
762 
763 		/*
764 		 * We're loading a library, if not other parts of the code
765 		 * need to be updated too.
766 		 */
767 		assert(!elf->is_main);
768 
769 		/*
770 		 * Now that we know how much virtual memory is needed move
771 		 * the already mapped part to a location which can
772 		 * accommodate us.
773 		 */
774 		res = sys_remap(elf->load_addr, &va, sz, pad_begin,
775 				roundup(seg->vaddr + seg->memsz));
776 		if (res == TEE_ERROR_OUT_OF_MEMORY)
777 			res = sys_remap(elf->load_addr, &va, sz, 0,
778 					roundup(seg->vaddr + seg->memsz));
779 		if (res)
780 			err(res, "sys_remap");
781 		elf->ehdr_addr = va;
782 		elf->load_addr = va;
783 		elf->max_addr = va + sz;
784 		elf->phdr = (void *)(va + elf->e_phoff);
785 	}
786 }
787 
788 static void add_deps_from_segment(struct ta_elf *elf, unsigned int type,
789 				  vaddr_t addr, size_t memsz)
790 {
791 	size_t dyn_entsize = 0;
792 	size_t num_dyns = 0;
793 	size_t n = 0;
794 	unsigned int tag = 0;
795 	size_t val = 0;
796 	TEE_UUID uuid = { };
797 	char *str_tab = NULL;
798 
799 	if (type != PT_DYNAMIC)
800 		return;
801 
802 	check_phdr_in_range(elf, type, addr, memsz);
803 
804 	if (elf->is_32bit)
805 		dyn_entsize = sizeof(Elf32_Dyn);
806 	else
807 		dyn_entsize = sizeof(Elf64_Dyn);
808 
809 	assert(!(memsz % dyn_entsize));
810 	num_dyns = memsz / dyn_entsize;
811 
812 	for (n = 0; n < num_dyns; n++) {
813 		read_dyn(elf, addr, n, &tag, &val);
814 		if (tag == DT_STRTAB) {
815 			str_tab = (char *)(val + elf->load_addr);
816 			break;
817 		}
818 	}
819 
820 	for (n = 0; n < num_dyns; n++) {
821 		read_dyn(elf, addr, n, &tag, &val);
822 		if (tag != DT_NEEDED)
823 			continue;
824 		tee_uuid_from_str(&uuid, str_tab + val);
825 		queue_elf(&uuid);
826 	}
827 }
828 
829 static void add_dependencies(struct ta_elf *elf)
830 {
831 	size_t n = 0;
832 
833 	if (elf->is_32bit) {
834 		Elf32_Phdr *phdr = elf->phdr;
835 
836 		for (n = 0; n < elf->e_phnum; n++)
837 			add_deps_from_segment(elf, phdr[n].p_type,
838 					      phdr[n].p_vaddr, phdr[n].p_memsz);
839 	} else {
840 		Elf64_Phdr *phdr = elf->phdr;
841 
842 		for (n = 0; n < elf->e_phnum; n++)
843 			add_deps_from_segment(elf, phdr[n].p_type,
844 					      phdr[n].p_vaddr, phdr[n].p_memsz);
845 	}
846 }
847 
848 static void copy_section_headers(struct ta_elf *elf)
849 {
850 	TEE_Result res = TEE_SUCCESS;
851 	size_t sz = 0;
852 	size_t offs = 0;
853 
854 	if (MUL_OVERFLOW(elf->e_shnum, elf->e_shentsize, &sz))
855 		err(TEE_ERROR_BAD_FORMAT, "Shdr size overflow");
856 
857 	elf->shdr = malloc(sz);
858 	if (!elf->shdr)
859 		err(TEE_ERROR_OUT_OF_MEMORY, "malloc");
860 
861 	/*
862 	 * We're assuming that section headers comes after the load segments,
863 	 * but if it's a very small dynamically linked library the section
864 	 * headers can still end up (partially?) in the first mapped page.
865 	 */
866 	if (elf->e_shoff < SMALL_PAGE_SIZE) {
867 		assert(!elf->is_main);
868 		offs = MIN(SMALL_PAGE_SIZE - elf->e_shoff, sz);
869 		memcpy(elf->shdr, (void *)(elf->load_addr + elf->e_shoff),
870 		       offs);
871 	}
872 
873 	if (offs < sz) {
874 		res = sys_copy_from_ta_bin((uint8_t *)elf->shdr + offs,
875 					   sz - offs, elf->handle,
876 					   elf->e_shoff + offs);
877 		if (res)
878 			err(res, "sys_copy_from_ta_bin");
879 	}
880 }
881 
882 static void close_handle(struct ta_elf *elf)
883 {
884 	TEE_Result res = sys_close_ta_bin(elf->handle);
885 
886 	if (res)
887 		err(res, "sys_close_ta_bin");
888 	elf->handle = -1;
889 }
890 
891 static void clean_elf_load_main(struct ta_elf *elf)
892 {
893 	TEE_Result res = TEE_SUCCESS;
894 
895 	/*
896 	 * Clean up from last attempt to load
897 	 */
898 	res = sys_unmap(elf->ehdr_addr, SMALL_PAGE_SIZE);
899 	if (res)
900 		err(res, "sys_unmap");
901 
902 	while (!TAILQ_EMPTY(&elf->segs)) {
903 		struct segment *seg = TAILQ_FIRST(&elf->segs);
904 		vaddr_t va = 0;
905 		size_t num_bytes = 0;
906 
907 		va = rounddown(elf->load_addr + seg->vaddr);
908 		if (seg->remapped_writeable)
909 			num_bytes = roundup(seg->vaddr + seg->memsz) -
910 				    rounddown(seg->vaddr);
911 		else
912 			num_bytes = seg->memsz;
913 
914 		res = sys_unmap(va, num_bytes);
915 		if (res)
916 			err(res, "sys_unmap");
917 
918 		TAILQ_REMOVE(&elf->segs, seg, link);
919 		free(seg);
920 	}
921 
922 	free(elf->shdr);
923 	memset(&elf->is_32bit, 0,
924 	       (vaddr_t)&elf->uuid - (vaddr_t)&elf->is_32bit);
925 
926 	TAILQ_INIT(&elf->segs);
927 }
928 
929 static void load_main(struct ta_elf *elf)
930 {
931 	init_elf(elf);
932 	map_segments(elf);
933 	populate_segments(elf);
934 	add_dependencies(elf);
935 	copy_section_headers(elf);
936 	save_symtab(elf);
937 	close_handle(elf);
938 
939 	elf->head = (struct ta_head *)elf->load_addr;
940 	if (elf->head->depr_entry != UINT64_MAX) {
941 		/*
942 		 * Legacy TAs sets their entry point in ta_head. For
943 		 * non-legacy TAs the entry point of the ELF is set instead
944 		 * and leaving the ta_head entry point set to UINT64_MAX to
945 		 * indicate that it's not used.
946 		 *
947 		 * NB, everything before the commit a73b5878c89d ("Replace
948 		 * ta_head.entry with elf entry") is considered legacy TAs
949 		 * for ldelf.
950 		 *
951 		 * Legacy TAs cannot be mapped with shared memory segments
952 		 * so restart the mapping if it turned out we're loading a
953 		 * legacy TA.
954 		 */
955 
956 		DMSG("Reloading TA %pUl as legacy TA", (void *)&elf->uuid);
957 		clean_elf_load_main(elf);
958 		elf->is_legacy = true;
959 		init_elf(elf);
960 		map_segments(elf);
961 		populate_segments_legacy(elf);
962 		add_dependencies(elf);
963 		copy_section_headers(elf);
964 		save_symtab(elf);
965 		close_handle(elf);
966 		elf->head = (struct ta_head *)elf->load_addr;
967 		/*
968 		 * Check that the TA is still a legacy TA, if it isn't give
969 		 * up now since we're likely under attack.
970 		 */
971 		if (elf->head->depr_entry == UINT64_MAX)
972 			err(TEE_ERROR_GENERIC,
973 			    "TA %pUl was changed on disk to non-legacy",
974 			    (void *)&elf->uuid);
975 	}
976 
977 }
978 
979 void ta_elf_load_main(const TEE_UUID *uuid, uint32_t *is_32bit, uint64_t *sp,
980 		      uint32_t *ta_flags)
981 {
982 	struct ta_elf *elf = queue_elf(uuid);
983 	vaddr_t va = 0;
984 	TEE_Result res = TEE_SUCCESS;
985 
986 	assert(elf);
987 	elf->is_main = true;
988 
989 	load_main(elf);
990 
991 	*is_32bit = elf->is_32bit;
992 	res = sys_map_zi(elf->head->stack_size, 0, &va, 0, 0);
993 	if (res)
994 		err(res, "sys_map_zi stack");
995 
996 	if (elf->head->flags & ~TA_FLAGS_MASK)
997 		err(TEE_ERROR_BAD_FORMAT, "Invalid TA flags(s) %#"PRIx32,
998 		    elf->head->flags & ~TA_FLAGS_MASK);
999 
1000 	*ta_flags = elf->head->flags;
1001 	*sp = va + elf->head->stack_size;
1002 	ta_stack = va;
1003 	ta_stack_size = elf->head->stack_size;
1004 }
1005 
1006 void ta_elf_finalize_load_main(uint64_t *entry)
1007 {
1008 	struct ta_elf *elf = TAILQ_FIRST(&main_elf_queue);
1009 	TEE_Result res = TEE_SUCCESS;
1010 
1011 	assert(elf->is_main);
1012 
1013 	res = ta_elf_set_init_fini_info(elf->is_32bit);
1014 	if (res)
1015 		err(res, "ta_elf_set_init_fini_info");
1016 
1017 	if (elf->is_legacy)
1018 		*entry = elf->head->depr_entry;
1019 	else
1020 		*entry = elf->e_entry + elf->load_addr;
1021 }
1022 
1023 
1024 void ta_elf_load_dependency(struct ta_elf *elf, bool is_32bit)
1025 {
1026 	if (elf->is_main)
1027 		return;
1028 
1029 	init_elf(elf);
1030 	if (elf->is_32bit != is_32bit)
1031 		err(TEE_ERROR_BAD_FORMAT, "ELF %pUl is %sbit (expected %sbit)",
1032 		    (void *)&elf->uuid, elf->is_32bit ? "32" : "64",
1033 		    is_32bit ? "32" : "64");
1034 
1035 	map_segments(elf);
1036 	populate_segments(elf);
1037 	add_dependencies(elf);
1038 	copy_section_headers(elf);
1039 	save_symtab(elf);
1040 	close_handle(elf);
1041 }
1042 
1043 void ta_elf_finalize_mappings(struct ta_elf *elf)
1044 {
1045 	TEE_Result res = TEE_SUCCESS;
1046 	struct segment *seg = NULL;
1047 
1048 	if (!elf->is_legacy)
1049 		return;
1050 
1051 	TAILQ_FOREACH(seg, &elf->segs, link) {
1052 		vaddr_t va = elf->load_addr + seg->vaddr;
1053 		uint32_t flags =  0;
1054 
1055 		if (seg->flags & PF_W)
1056 			flags |= PTA_SYSTEM_MAP_FLAG_WRITEABLE;
1057 		if (seg->flags & PF_X)
1058 			flags |= PTA_SYSTEM_MAP_FLAG_EXECUTABLE;
1059 
1060 		res = sys_set_prot(va, seg->memsz, flags);
1061 		if (res)
1062 			err(res, "sys_set_prot");
1063 	}
1064 }
1065 
1066 static void __printf(3, 4) print_wrapper(void *pctx, print_func_t print_func,
1067 					 const char *fmt, ...)
1068 {
1069 	va_list ap;
1070 
1071 	va_start(ap, fmt);
1072 	print_func(pctx, fmt, ap);
1073 	va_end(ap);
1074 }
1075 
1076 static void print_seg(void *pctx, print_func_t print_func,
1077 		      size_t idx __maybe_unused, int elf_idx __maybe_unused,
1078 		      vaddr_t va __maybe_unused, paddr_t pa __maybe_unused,
1079 		      size_t sz __maybe_unused, uint32_t flags)
1080 {
1081 	int width __maybe_unused = 8;
1082 	char desc[14] __maybe_unused = "";
1083 	char flags_str[] __maybe_unused = "----";
1084 
1085 	if (elf_idx > -1) {
1086 		snprintf(desc, sizeof(desc), " [%d]", elf_idx);
1087 	} else {
1088 		if (flags & DUMP_MAP_EPHEM)
1089 			snprintf(desc, sizeof(desc), " (param)");
1090 		if (flags & DUMP_MAP_LDELF)
1091 			snprintf(desc, sizeof(desc), " (ldelf)");
1092 		if (va == ta_stack)
1093 			snprintf(desc, sizeof(desc), " (stack)");
1094 	}
1095 
1096 	if (flags & DUMP_MAP_READ)
1097 		flags_str[0] = 'r';
1098 	if (flags & DUMP_MAP_WRITE)
1099 		flags_str[1] = 'w';
1100 	if (flags & DUMP_MAP_EXEC)
1101 		flags_str[2] = 'x';
1102 	if (flags & DUMP_MAP_SECURE)
1103 		flags_str[3] = 's';
1104 
1105 	print_wrapper(pctx, print_func,
1106 		      "region %2zu: va 0x%0*"PRIxVA" pa 0x%0*"PRIxPA" size 0x%06zx flags %s%s\n",
1107 		      idx, width, va, width, pa, sz, flags_str, desc);
1108 }
1109 
1110 static bool get_next_in_order(struct ta_elf_queue *elf_queue,
1111 			      struct ta_elf **elf, struct segment **seg,
1112 			      size_t *elf_idx)
1113 {
1114 	struct ta_elf *e = NULL;
1115 	struct segment *s = NULL;
1116 	size_t idx = 0;
1117 	vaddr_t va = 0;
1118 	struct ta_elf *e2 = NULL;
1119 	size_t i2 = 0;
1120 
1121 	assert(elf && seg && elf_idx);
1122 	e = *elf;
1123 	s = *seg;
1124 	assert((e == NULL && s == NULL) || (e != NULL && s != NULL));
1125 
1126 	if (s) {
1127 		s = TAILQ_NEXT(s, link);
1128 		if (s) {
1129 			*seg = s;
1130 			return true;
1131 		}
1132 	}
1133 
1134 	if (e)
1135 		va = e->load_addr;
1136 
1137 	/* Find the ELF with next load address */
1138 	e = NULL;
1139 	TAILQ_FOREACH(e2, elf_queue, link) {
1140 		if (e2->load_addr > va) {
1141 			if (!e || e2->load_addr < e->load_addr) {
1142 				e = e2;
1143 				idx = i2;
1144 			}
1145 		}
1146 		i2++;
1147 	}
1148 	if (!e)
1149 		return false;
1150 
1151 	*elf = e;
1152 	*seg = TAILQ_FIRST(&e->segs);
1153 	*elf_idx = idx;
1154 	return true;
1155 }
1156 
1157 void ta_elf_print_mappings(void *pctx, print_func_t print_func,
1158 			   struct ta_elf_queue *elf_queue, size_t num_maps,
1159 			   struct dump_map *maps, vaddr_t mpool_base)
1160 {
1161 	struct segment *seg = NULL;
1162 	struct ta_elf *elf = NULL;
1163 	size_t elf_idx = 0;
1164 	size_t idx = 0;
1165 	size_t map_idx = 0;
1166 
1167 	/*
1168 	 * Loop over all segments and maps, printing virtual address in
1169 	 * order. Segment has priority if the virtual address is present
1170 	 * in both map and segment.
1171 	 */
1172 	get_next_in_order(elf_queue, &elf, &seg, &elf_idx);
1173 	while (true) {
1174 		vaddr_t va = -1;
1175 		size_t sz = 0;
1176 		uint32_t flags = DUMP_MAP_SECURE;
1177 		size_t offs = 0;
1178 
1179 		if (seg) {
1180 			va = rounddown(seg->vaddr + elf->load_addr);
1181 			sz = roundup(seg->vaddr + seg->memsz) -
1182 				     rounddown(seg->vaddr);
1183 		}
1184 
1185 		while (map_idx < num_maps && maps[map_idx].va <= va) {
1186 			uint32_t f = 0;
1187 
1188 			/* If there's a match, it should be the same map */
1189 			if (maps[map_idx].va == va) {
1190 				/*
1191 				 * In shared libraries the first page is
1192 				 * mapped separately with the rest of that
1193 				 * segment following back to back in a
1194 				 * separate entry.
1195 				 */
1196 				if (map_idx + 1 < num_maps &&
1197 				    maps[map_idx].sz == SMALL_PAGE_SIZE) {
1198 					vaddr_t next_va = maps[map_idx].va +
1199 							  maps[map_idx].sz;
1200 					size_t comb_sz = maps[map_idx].sz +
1201 							 maps[map_idx + 1].sz;
1202 
1203 					if (next_va == maps[map_idx + 1].va &&
1204 					    comb_sz == sz &&
1205 					    maps[map_idx].flags ==
1206 					    maps[map_idx + 1].flags) {
1207 						/* Skip this and next entry */
1208 						map_idx += 2;
1209 						continue;
1210 					}
1211 				}
1212 				assert(maps[map_idx].sz == sz);
1213 			} else if (maps[map_idx].va < va) {
1214 				if (maps[map_idx].va == mpool_base)
1215 					f |= DUMP_MAP_LDELF;
1216 				print_seg(pctx, print_func, idx, -1,
1217 					  maps[map_idx].va, maps[map_idx].pa,
1218 					  maps[map_idx].sz,
1219 					  maps[map_idx].flags | f);
1220 				idx++;
1221 			}
1222 			map_idx++;
1223 		}
1224 
1225 		if (!seg)
1226 			break;
1227 
1228 		offs = rounddown(seg->offset);
1229 		if (seg->flags & PF_R)
1230 			flags |= DUMP_MAP_READ;
1231 		if (seg->flags & PF_W)
1232 			flags |= DUMP_MAP_WRITE;
1233 		if (seg->flags & PF_X)
1234 			flags |= DUMP_MAP_EXEC;
1235 
1236 		print_seg(pctx, print_func, idx, elf_idx, va, offs, sz, flags);
1237 		idx++;
1238 
1239 		if (!get_next_in_order(elf_queue, &elf, &seg, &elf_idx))
1240 			seg = NULL;
1241 	}
1242 
1243 	elf_idx = 0;
1244 	TAILQ_FOREACH(elf, elf_queue, link) {
1245 		print_wrapper(pctx, print_func,
1246 			      " [%zu] %pUl @ 0x%0*"PRIxVA"\n",
1247 			      elf_idx, (void *)&elf->uuid, 8, elf->load_addr);
1248 		elf_idx++;
1249 	}
1250 }
1251 
1252 #ifdef CFG_UNWIND
1253 void ta_elf_stack_trace_a32(uint32_t regs[16])
1254 {
1255 	struct unwind_state_arm32 state = { };
1256 
1257 	memcpy(state.registers, regs, sizeof(state.registers));
1258 	print_stack_arm32(&state, ta_stack, ta_stack_size);
1259 }
1260 
1261 void ta_elf_stack_trace_a64(uint64_t fp, uint64_t sp, uint64_t pc)
1262 {
1263 	struct unwind_state_arm64 state = { .fp = fp, .sp = sp, .pc = pc };
1264 
1265 	print_stack_arm64(&state, ta_stack, ta_stack_size);
1266 }
1267 #endif
1268 
1269 TEE_Result ta_elf_add_library(const TEE_UUID *uuid)
1270 {
1271 	struct ta_elf *ta = TAILQ_FIRST(&main_elf_queue);
1272 	struct ta_elf *lib = ta_elf_find_elf(uuid);
1273 	struct ta_elf *elf = NULL;
1274 
1275 	if (lib)
1276 		return TEE_SUCCESS; /* Already mapped */
1277 
1278 	lib = queue_elf_helper(uuid);
1279 	if (!lib)
1280 		return TEE_ERROR_OUT_OF_MEMORY;
1281 
1282 	for (elf = lib; elf; elf = TAILQ_NEXT(elf, link))
1283 		ta_elf_load_dependency(elf, ta->is_32bit);
1284 
1285 	for (elf = lib; elf; elf = TAILQ_NEXT(elf, link)) {
1286 		ta_elf_relocate(elf);
1287 		ta_elf_finalize_mappings(elf);
1288 	}
1289 
1290 	for (elf = lib; elf; elf = TAILQ_NEXT(elf, link))
1291 		DMSG("ELF (%pUl) at %#"PRIxVA,
1292 		     (void *)&elf->uuid, elf->load_addr);
1293 
1294 	return ta_elf_set_init_fini_info(ta->is_32bit);
1295 }
1296 
1297 /* Get address/size of .init_array and .fini_array from the dynamic segment */
1298 static void get_init_fini_array(struct ta_elf *elf, unsigned int type,
1299 				vaddr_t addr, size_t memsz, vaddr_t *init,
1300 				size_t *init_cnt, vaddr_t *fini,
1301 				size_t *fini_cnt)
1302 {
1303 	size_t addrsz = 0;
1304 	size_t dyn_entsize = 0;
1305 	size_t num_dyns = 0;
1306 	size_t n = 0;
1307 	unsigned int tag = 0;
1308 	size_t val = 0;
1309 
1310 	assert(type == PT_DYNAMIC);
1311 
1312 	check_phdr_in_range(elf, type, addr, memsz);
1313 
1314 	if (elf->is_32bit) {
1315 		dyn_entsize = sizeof(Elf32_Dyn);
1316 		addrsz = 4;
1317 	} else {
1318 		dyn_entsize = sizeof(Elf64_Dyn);
1319 		addrsz = 8;
1320 	}
1321 
1322 	assert(!(memsz % dyn_entsize));
1323 	num_dyns = memsz / dyn_entsize;
1324 
1325 	for (n = 0; n < num_dyns; n++) {
1326 		read_dyn(elf, addr, n, &tag, &val);
1327 		if (tag == DT_INIT_ARRAY)
1328 			*init = val + elf->load_addr;
1329 		else if (tag == DT_FINI_ARRAY)
1330 			*fini = val + elf->load_addr;
1331 		else if (tag == DT_INIT_ARRAYSZ)
1332 			*init_cnt = val / addrsz;
1333 		else if (tag == DT_FINI_ARRAYSZ)
1334 			*fini_cnt = val / addrsz;
1335 	}
1336 }
1337 
1338 /* Get address/size of .init_array and .fini_array in @elf (if present) */
1339 static void elf_get_init_fini_array(struct ta_elf *elf, vaddr_t *init,
1340 				    size_t *init_cnt, vaddr_t *fini,
1341 				    size_t *fini_cnt)
1342 {
1343 	size_t n = 0;
1344 
1345 	if (elf->is_32bit) {
1346 		Elf32_Phdr *phdr = elf->phdr;
1347 
1348 		for (n = 0; n < elf->e_phnum; n++) {
1349 			if (phdr[n].p_type == PT_DYNAMIC) {
1350 				get_init_fini_array(elf, phdr[n].p_type,
1351 						    phdr[n].p_vaddr,
1352 						    phdr[n].p_memsz,
1353 						    init, init_cnt, fini,
1354 						    fini_cnt);
1355 				return;
1356 			}
1357 		}
1358 	} else {
1359 		Elf64_Phdr *phdr = elf->phdr;
1360 
1361 		for (n = 0; n < elf->e_phnum; n++) {
1362 			if (phdr[n].p_type == PT_DYNAMIC) {
1363 				get_init_fini_array(elf, phdr[n].p_type,
1364 						    phdr[n].p_vaddr,
1365 						    phdr[n].p_memsz,
1366 						    init, init_cnt, fini,
1367 						    fini_cnt);
1368 				return;
1369 			}
1370 		}
1371 	}
1372 }
1373 
1374 static TEE_Result realloc_ifs(vaddr_t va, size_t cnt, bool is_32bit)
1375 {
1376 	struct __init_fini_info32 *info32 = (struct __init_fini_info32 *)va;
1377 	struct __init_fini_info *info = (struct __init_fini_info *)va;
1378 	struct __init_fini32 *ifs32 = NULL;
1379 	struct __init_fini *ifs = NULL;
1380 	size_t prev_cnt = 0;
1381 	void *ptr = NULL;
1382 
1383 	if (is_32bit) {
1384 		ptr = (void *)(vaddr_t)info32->ifs;
1385 		ptr = realloc(ptr, cnt * sizeof(struct __init_fini32));
1386 		if (!ptr)
1387 			return TEE_ERROR_OUT_OF_MEMORY;
1388 		ifs32 = ptr;
1389 		prev_cnt = info32->size;
1390 		if (cnt > prev_cnt)
1391 			memset(ifs32 + prev_cnt, 0,
1392 			       (cnt - prev_cnt) * sizeof(*ifs32));
1393 		info32->ifs = (uint32_t)(vaddr_t)ifs32;
1394 		info32->size = cnt;
1395 	} else {
1396 		ptr = realloc(info->ifs, cnt * sizeof(struct __init_fini));
1397 		if (!ptr)
1398 			return TEE_ERROR_OUT_OF_MEMORY;
1399 		ifs = ptr;
1400 		prev_cnt = info->size;
1401 		if (cnt > prev_cnt)
1402 			memset(ifs + prev_cnt, 0,
1403 			       (cnt - prev_cnt) * sizeof(*ifs));
1404 		info->ifs = ifs;
1405 		info->size = cnt;
1406 	}
1407 
1408 	return TEE_SUCCESS;
1409 }
1410 
1411 static void fill_ifs(vaddr_t va, size_t idx, struct ta_elf *elf, bool is_32bit)
1412 {
1413 	struct __init_fini_info32 *info32 = (struct __init_fini_info32 *)va;
1414 	struct __init_fini_info *info = (struct __init_fini_info *)va;
1415 	struct __init_fini32 *ifs32 = NULL;
1416 	struct __init_fini *ifs = NULL;
1417 	size_t init_cnt = 0;
1418 	size_t fini_cnt = 0;
1419 	vaddr_t init = 0;
1420 	vaddr_t fini = 0;
1421 
1422 	if (is_32bit) {
1423 		assert(idx < info32->size);
1424 		ifs32 = &((struct __init_fini32 *)(vaddr_t)info32->ifs)[idx];
1425 
1426 		if (ifs32->flags & __IFS_VALID)
1427 			return;
1428 
1429 		elf_get_init_fini_array(elf, &init, &init_cnt, &fini,
1430 					&fini_cnt);
1431 
1432 		ifs32->init = (uint32_t)init;
1433 		ifs32->init_size = init_cnt;
1434 
1435 		ifs32->fini = (uint32_t)fini;
1436 		ifs32->fini_size = fini_cnt;
1437 
1438 		ifs32->flags |= __IFS_VALID;
1439 	} else {
1440 		assert(idx < info->size);
1441 		ifs = &info->ifs[idx];
1442 
1443 		if (ifs->flags & __IFS_VALID)
1444 			return;
1445 
1446 		elf_get_init_fini_array(elf, &init, &init_cnt, &fini,
1447 					&fini_cnt);
1448 
1449 		ifs->init = (void (**)(void))init;
1450 		ifs->init_size = init_cnt;
1451 
1452 		ifs->fini = (void (**)(void))fini;
1453 		ifs->fini_size = fini_cnt;
1454 
1455 		ifs->flags |= __IFS_VALID;
1456 	}
1457 }
1458 
1459 /*
1460  * Set or update __init_fini_info in the TA with information from the ELF
1461  * queue
1462  */
1463 TEE_Result ta_elf_set_init_fini_info(bool is_32bit)
1464 {
1465 	struct __init_fini_info *info = NULL;
1466 	TEE_Result res = TEE_SUCCESS;
1467 	struct ta_elf *elf = NULL;
1468 	vaddr_t info_va = 0;
1469 	size_t cnt = 0;
1470 
1471 	res = ta_elf_resolve_sym("__init_fini_info", &info_va, NULL);
1472 	if (res) {
1473 		if (res == TEE_ERROR_ITEM_NOT_FOUND) {
1474 			/* Older TA */
1475 			return TEE_SUCCESS;
1476 		}
1477 		return res;
1478 	}
1479 	assert(info_va);
1480 
1481 	info = (struct __init_fini_info *)info_va;
1482 	if (info->reserved)
1483 		return TEE_ERROR_NOT_SUPPORTED;
1484 
1485 	TAILQ_FOREACH(elf, &main_elf_queue, link)
1486 		cnt++;
1487 
1488 	/* Queue has at least one file (main) */
1489 	assert(cnt);
1490 
1491 	res = realloc_ifs(info_va, cnt, is_32bit);
1492 	if (res)
1493 		goto err;
1494 
1495 	cnt = 0;
1496 	TAILQ_FOREACH(elf, &main_elf_queue, link) {
1497 		fill_ifs(info_va, cnt, elf, is_32bit);
1498 		cnt++;
1499 	}
1500 
1501 	return TEE_SUCCESS;
1502 err:
1503 	free(info);
1504 	return res;
1505 }
1506