xref: /optee_os/core/arch/arm/kernel/secure_partition.c (revision 28710257ae7ba502c57a4cf26ba9bb17ceaeef77) 
1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3  * Copyright (c) 2020-2022, Arm Limited.
4  */
5 #include <bench.h>
6 #include <crypto/crypto.h>
7 #include <initcall.h>
8 #include <kernel/embedded_ts.h>
9 #include <kernel/ldelf_loader.h>
10 #include <kernel/secure_partition.h>
11 #include <kernel/spinlock.h>
12 #include <kernel/spmc_sp_handler.h>
13 #include <kernel/thread_private.h>
14 #include <kernel/thread_spmc.h>
15 #include <kernel/ts_store.h>
16 #include <ldelf.h>
17 #include <libfdt.h>
18 #include <mm/core_mmu.h>
19 #include <mm/fobj.h>
20 #include <mm/mobj.h>
21 #include <mm/vm.h>
22 #include <optee_ffa.h>
23 #include <stdio.h>
24 #include <string.h>
25 #include <tee_api_types.h>
26 #include <tee/uuid.h>
27 #include <trace.h>
28 #include <types_ext.h>
29 #include <utee_defines.h>
30 #include <util.h>
31 #include <zlib.h>
32 
33 const struct ts_ops sp_ops;
34 
35 /* List that holds all of the loaded SP's */
36 static struct sp_sessions_head open_sp_sessions =
37 	TAILQ_HEAD_INITIALIZER(open_sp_sessions);
38 
39 static const struct embedded_ts *find_secure_partition(const TEE_UUID *uuid)
40 {
41 	const struct sp_image *sp = NULL;
42 
43 	for_each_secure_partition(sp) {
44 		if (!memcmp(&sp->image.uuid, uuid, sizeof(*uuid)))
45 			return &sp->image;
46 	}
47 	return NULL;
48 }
49 
50 bool is_sp_ctx(struct ts_ctx *ctx)
51 {
52 	return ctx && (ctx->ops == &sp_ops);
53 }
54 
55 static void set_sp_ctx_ops(struct ts_ctx *ctx)
56 {
57 	ctx->ops = &sp_ops;
58 }
59 
60 TEE_Result sp_find_session_id(const TEE_UUID *uuid, uint32_t *session_id)
61 {
62 	struct sp_session *s = NULL;
63 
64 	TAILQ_FOREACH(s, &open_sp_sessions, link) {
65 		if (!memcmp(&s->ts_sess.ctx->uuid, uuid, sizeof(*uuid))) {
66 			if (s->state == sp_dead)
67 				return TEE_ERROR_TARGET_DEAD;
68 
69 			*session_id  = s->endpoint_id;
70 			return TEE_SUCCESS;
71 		}
72 	}
73 
74 	return TEE_ERROR_ITEM_NOT_FOUND;
75 }
76 
77 struct sp_session *sp_get_session(uint32_t session_id)
78 {
79 	struct sp_session *s = NULL;
80 
81 	TAILQ_FOREACH(s, &open_sp_sessions, link) {
82 		if (s->endpoint_id == session_id)
83 			return s;
84 	}
85 
86 	return NULL;
87 }
88 
89 TEE_Result sp_partition_info_get_all(struct ffa_partition_info *fpi,
90 				     size_t *elem_count)
91 {
92 	size_t in_count = *elem_count;
93 	struct sp_session *s = NULL;
94 	size_t count = 0;
95 
96 	TAILQ_FOREACH(s, &open_sp_sessions, link) {
97 		if (s->state == sp_dead)
98 			continue;
99 		if (count < in_count) {
100 			spmc_fill_partition_entry(fpi, s->endpoint_id, 1);
101 			fpi++;
102 		}
103 		count++;
104 	}
105 
106 	*elem_count = count;
107 	if (count > in_count)
108 		return TEE_ERROR_SHORT_BUFFER;
109 
110 	return TEE_SUCCESS;
111 }
112 
113 bool sp_has_exclusive_access(struct sp_mem_map_region *mem,
114 			     struct user_mode_ctx *uctx)
115 {
116 	/*
117 	 * Check that we have access to the region if it is supposed to be
118 	 * mapped to the current context.
119 	 */
120 	if (uctx) {
121 		struct vm_region *region = NULL;
122 
123 		/* Make sure that each mobj belongs to the SP */
124 		TAILQ_FOREACH(region, &uctx->vm_info.regions, link) {
125 			if (region->mobj == mem->mobj)
126 				break;
127 		}
128 
129 		if (!region)
130 			return false;
131 	}
132 
133 	/* Check that it is not shared with another SP */
134 	return !sp_mem_is_shared(mem);
135 }
136 
137 static void sp_init_info(struct sp_ctx *ctx, struct thread_smc_args *args)
138 {
139 	struct sp_ffa_init_info *info = NULL;
140 
141 	/*
142 	 * When starting the SP for the first time a init_info struct is passed.
143 	 * Store the struct on the stack and store the address in x0
144 	 */
145 	ctx->uctx.stack_ptr -= ROUNDUP(sizeof(*info), STACK_ALIGNMENT);
146 
147 	info = (struct sp_ffa_init_info *)ctx->uctx.stack_ptr;
148 
149 	info->magic = 0;
150 	info->count = 0;
151 	args->a0 = (vaddr_t)info;
152 }
153 
154 static uint16_t new_session_id(struct sp_sessions_head *open_sessions)
155 {
156 	struct sp_session *last = NULL;
157 	uint16_t id = SPMC_ENDPOINT_ID + 1;
158 
159 	last = TAILQ_LAST(open_sessions, sp_sessions_head);
160 	if (last)
161 		id = last->endpoint_id + 1;
162 
163 	assert(id > SPMC_ENDPOINT_ID);
164 	return id;
165 }
166 
167 static TEE_Result sp_create_ctx(const TEE_UUID *uuid, struct sp_session *s)
168 {
169 	TEE_Result res = TEE_SUCCESS;
170 	struct sp_ctx *spc = NULL;
171 
172 	/* Register context */
173 	spc = calloc(1, sizeof(struct sp_ctx));
174 	if (!spc)
175 		return TEE_ERROR_OUT_OF_MEMORY;
176 
177 	spc->uctx.ts_ctx = &spc->ts_ctx;
178 	spc->open_session = s;
179 	s->ts_sess.ctx = &spc->ts_ctx;
180 	spc->ts_ctx.uuid = *uuid;
181 
182 	res = vm_info_init(&spc->uctx);
183 	if (res)
184 		goto err;
185 
186 	set_sp_ctx_ops(&spc->ts_ctx);
187 
188 	return TEE_SUCCESS;
189 
190 err:
191 	free(spc);
192 	return res;
193 }
194 
195 static TEE_Result sp_create_session(struct sp_sessions_head *open_sessions,
196 				    const TEE_UUID *uuid,
197 				    struct sp_session **sess)
198 {
199 	TEE_Result res = TEE_SUCCESS;
200 	struct sp_session *s = calloc(1, sizeof(struct sp_session));
201 
202 	if (!s)
203 		return TEE_ERROR_OUT_OF_MEMORY;
204 
205 	s->endpoint_id = new_session_id(open_sessions);
206 	if (!s->endpoint_id) {
207 		res = TEE_ERROR_OVERFLOW;
208 		goto err;
209 	}
210 
211 	DMSG("Loading Secure Partition %pUl", (void *)uuid);
212 	res = sp_create_ctx(uuid, s);
213 	if (res)
214 		goto err;
215 
216 	TAILQ_INSERT_TAIL(open_sessions, s, link);
217 	*sess = s;
218 	return TEE_SUCCESS;
219 
220 err:
221 	free(s);
222 	return res;
223 }
224 
225 static TEE_Result sp_init_set_registers(struct sp_ctx *ctx)
226 {
227 	struct thread_ctx_regs *sp_regs = &ctx->sp_regs;
228 
229 	memset(sp_regs, 0, sizeof(*sp_regs));
230 	sp_regs->sp = ctx->uctx.stack_ptr;
231 	sp_regs->pc = ctx->uctx.entry_func;
232 
233 	return TEE_SUCCESS;
234 }
235 
236 TEE_Result sp_map_shared(struct sp_session *s,
237 			 struct sp_mem_receiver *receiver,
238 			 struct sp_mem *smem,
239 			 uint64_t *va)
240 {
241 	TEE_Result res = TEE_SUCCESS;
242 	struct sp_ctx *ctx = NULL;
243 	uint32_t perm = TEE_MATTR_UR;
244 	struct sp_mem_map_region *reg = NULL;
245 
246 	ctx = to_sp_ctx(s->ts_sess.ctx);
247 
248 	/* Get the permission */
249 	if (receiver->perm.perm & FFA_MEM_ACC_EXE)
250 		perm |= TEE_MATTR_UX;
251 
252 	if (receiver->perm.perm & FFA_MEM_ACC_RW) {
253 		if (receiver->perm.perm & FFA_MEM_ACC_EXE)
254 			return TEE_ERROR_ACCESS_CONFLICT;
255 
256 		perm |= TEE_MATTR_UW;
257 	}
258 	/*
259 	 * Currently we don't support passing a va. We can't guarantee that the
260 	 * full region will be mapped in a contiguous region. A smem->region can
261 	 * have multiple mobj for one share. Currently there doesn't seem to be
262 	 * an option to guarantee that these will be mapped in a contiguous va
263 	 * space.
264 	 */
265 	if (*va)
266 		return TEE_ERROR_NOT_SUPPORTED;
267 
268 	SLIST_FOREACH(reg, &smem->regions, link) {
269 		res = vm_map(&ctx->uctx, va, reg->page_count * SMALL_PAGE_SIZE,
270 			     perm, 0, reg->mobj, reg->page_offset);
271 
272 		if (res != TEE_SUCCESS) {
273 			EMSG("Failed to map memory region %#"PRIx32, res);
274 			return res;
275 		}
276 	}
277 	return TEE_SUCCESS;
278 }
279 
280 TEE_Result sp_unmap_ffa_regions(struct sp_session *s, struct sp_mem *smem)
281 {
282 	TEE_Result res = TEE_SUCCESS;
283 	vaddr_t vaddr = 0;
284 	size_t len = 0;
285 	struct sp_ctx *ctx = to_sp_ctx(s->ts_sess.ctx);
286 	struct sp_mem_map_region *reg = NULL;
287 
288 	SLIST_FOREACH(reg, &smem->regions, link) {
289 		vaddr = (vaddr_t)sp_mem_get_va(&ctx->uctx, reg->page_offset,
290 					       reg->mobj);
291 		len = reg->page_count * SMALL_PAGE_SIZE;
292 
293 		res = vm_unmap(&ctx->uctx, vaddr, len);
294 		if (res != TEE_SUCCESS)
295 			return res;
296 	}
297 
298 	return TEE_SUCCESS;
299 }
300 
301 static TEE_Result sp_open_session(struct sp_session **sess,
302 				  struct sp_sessions_head *open_sessions,
303 				  const TEE_UUID *uuid)
304 {
305 	TEE_Result res = TEE_SUCCESS;
306 	struct sp_session *s = NULL;
307 	struct sp_ctx *ctx = NULL;
308 
309 	if (!find_secure_partition(uuid))
310 		return TEE_ERROR_ITEM_NOT_FOUND;
311 
312 	res = sp_create_session(open_sessions, uuid, &s);
313 	if (res != TEE_SUCCESS) {
314 		DMSG("sp_create_session failed %#"PRIx32, res);
315 		return res;
316 	}
317 
318 	ctx = to_sp_ctx(s->ts_sess.ctx);
319 	assert(ctx);
320 	if (!ctx)
321 		return TEE_ERROR_TARGET_DEAD;
322 	*sess = s;
323 
324 	ts_push_current_session(&s->ts_sess);
325 	/* Load the SP using ldelf. */
326 	ldelf_load_ldelf(&ctx->uctx);
327 	res = ldelf_init_with_ldelf(&s->ts_sess, &ctx->uctx);
328 
329 	if (res != TEE_SUCCESS) {
330 		EMSG("Failed. loading SP using ldelf %#"PRIx32, res);
331 		ts_pop_current_session();
332 		return TEE_ERROR_TARGET_DEAD;
333 	}
334 
335 	/* Make the SP ready for its first run */
336 	s->state = sp_idle;
337 	s->caller_id = 0;
338 	sp_init_set_registers(ctx);
339 	ts_pop_current_session();
340 
341 	return TEE_SUCCESS;
342 }
343 
344 static TEE_Result handle_fdt(const void * const fdt, const TEE_UUID *uuid)
345 {
346 	TEE_Result res = TEE_SUCCESS;
347 	int len = 0;
348 	const fdt32_t *prop = NULL;
349 	int i = 0;
350 	const struct fdt_property *description = NULL;
351 	int description_name_len = 0;
352 	uint32_t uuid_array[4] = { 0 };
353 	TEE_UUID fdt_uuid = {};
354 
355 	res = fdt_node_check_compatible(fdt, 0, "arm,ffa-manifest-1.0");
356 	if (res) {
357 		EMSG("Failed loading SP, manifest not found");
358 		return res;
359 	}
360 
361 	description = fdt_get_property(fdt, 0, "description",
362 				       &description_name_len);
363 	if (description)
364 		DMSG("Loading SP: %s", description->data);
365 
366 	prop = fdt_getprop(fdt, 0, "uuid", &len);
367 	if (!prop || len != 16) {
368 		EMSG("Missing or invalid UUID in SP manifest");
369 		return TEE_ERROR_BAD_FORMAT;
370 	}
371 
372 	for (i = 0; i < 4; i++)
373 		uuid_array[i] = fdt32_to_cpu(prop[i]);
374 	tee_uuid_from_octets(&fdt_uuid, (uint8_t *)uuid_array);
375 
376 	if (memcmp(uuid, &fdt_uuid, sizeof(fdt_uuid))) {
377 		EMSG("Failed loading SP, UUID mismatch");
378 		return TEE_ERROR_BAD_FORMAT;
379 	}
380 
381 	return TEE_SUCCESS;
382 }
383 
384 static TEE_Result sp_init_uuid(const TEE_UUID *uuid, const void * const fdt)
385 {
386 	TEE_Result res = TEE_SUCCESS;
387 	struct sp_session *sess = NULL;
388 	struct thread_smc_args args = { };
389 
390 	res = handle_fdt(fdt, uuid);
391 
392 	if (res)
393 		return res;
394 
395 	res = sp_open_session(&sess,
396 			      &open_sp_sessions,
397 			      uuid);
398 	if (res)
399 		return res;
400 
401 	ts_push_current_session(&sess->ts_sess);
402 	sp_init_info(to_sp_ctx(sess->ts_sess.ctx), &args);
403 	ts_pop_current_session();
404 
405 	if (sp_enter(&args, sess))
406 		return FFA_ABORTED;
407 
408 	spmc_sp_msg_handler(&args, sess);
409 
410 	return TEE_SUCCESS;
411 }
412 
413 TEE_Result sp_enter(struct thread_smc_args *args, struct sp_session *sp)
414 {
415 	TEE_Result res = FFA_OK;
416 	struct sp_ctx *ctx = to_sp_ctx(sp->ts_sess.ctx);
417 
418 	ctx->sp_regs.x[0] = args->a0;
419 	ctx->sp_regs.x[1] = args->a1;
420 	ctx->sp_regs.x[2] = args->a2;
421 	ctx->sp_regs.x[3] = args->a3;
422 	ctx->sp_regs.x[4] = args->a4;
423 	ctx->sp_regs.x[5] = args->a5;
424 	ctx->sp_regs.x[6] = args->a6;
425 	ctx->sp_regs.x[7] = args->a7;
426 
427 	res = sp->ts_sess.ctx->ops->enter_invoke_cmd(&sp->ts_sess, 0);
428 
429 	args->a0 = ctx->sp_regs.x[0];
430 	args->a1 = ctx->sp_regs.x[1];
431 	args->a2 = ctx->sp_regs.x[2];
432 	args->a3 = ctx->sp_regs.x[3];
433 	args->a4 = ctx->sp_regs.x[4];
434 	args->a5 = ctx->sp_regs.x[5];
435 	args->a6 = ctx->sp_regs.x[6];
436 	args->a7 = ctx->sp_regs.x[7];
437 
438 	return res;
439 }
440 
441 static TEE_Result sp_enter_invoke_cmd(struct ts_session *s,
442 				      uint32_t cmd __unused)
443 {
444 	struct sp_ctx *ctx = to_sp_ctx(s->ctx);
445 	TEE_Result res = TEE_SUCCESS;
446 	uint32_t exceptions = 0;
447 	uint64_t cpsr = 0;
448 	struct sp_session *sp_s = to_sp_session(s);
449 	struct ts_session *sess = NULL;
450 	struct thread_ctx_regs *sp_regs = NULL;
451 	uint32_t panicked = false;
452 	uint32_t panic_code = 0;
453 
454 	bm_timestamp();
455 
456 	sp_regs = &ctx->sp_regs;
457 	ts_push_current_session(s);
458 
459 	cpsr = sp_regs->cpsr;
460 	sp_regs->cpsr = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT);
461 
462 	exceptions = thread_mask_exceptions(THREAD_EXCP_ALL);
463 	__thread_enter_user_mode(sp_regs, &panicked, &panic_code);
464 	sp_regs->cpsr = cpsr;
465 	thread_unmask_exceptions(exceptions);
466 
467 	thread_user_clear_vfp(&ctx->uctx);
468 
469 	if (panicked) {
470 		DMSG("SP panicked with code  %#"PRIx32, panic_code);
471 		abort_print_current_ts();
472 
473 		sess = ts_pop_current_session();
474 		cpu_spin_lock(&sp_s->spinlock);
475 		sp_s->state = sp_dead;
476 		cpu_spin_unlock(&sp_s->spinlock);
477 
478 		return TEE_ERROR_TARGET_DEAD;
479 	}
480 
481 	sess = ts_pop_current_session();
482 	assert(sess == s);
483 
484 	bm_timestamp();
485 
486 	return res;
487 }
488 
489 /* We currently don't support 32 bits */
490 #ifdef ARM64
491 static void sp_svc_store_registers(struct thread_svc_regs *regs,
492 				   struct thread_ctx_regs *sp_regs)
493 {
494 	COMPILE_TIME_ASSERT(sizeof(sp_regs->x[0]) == sizeof(regs->x0));
495 	memcpy(sp_regs->x, &regs->x0, 31 * sizeof(regs->x0));
496 	sp_regs->pc = regs->elr;
497 	sp_regs->sp = regs->sp_el0;
498 }
499 #endif
500 
501 static bool sp_handle_svc(struct thread_svc_regs *regs)
502 {
503 	struct ts_session *ts = ts_get_current_session();
504 	struct sp_ctx *uctx = to_sp_ctx(ts->ctx);
505 	struct sp_session *s = uctx->open_session;
506 
507 	assert(s);
508 
509 	sp_svc_store_registers(regs, &uctx->sp_regs);
510 
511 	regs->x0 = 0;
512 	regs->x1 = 0; /* panic */
513 	regs->x2 = 0; /* panic code */
514 
515 	/*
516 	 * All the registers of the SP are saved in the SP session by the SVC
517 	 * handler.
518 	 * We always return to S-El1 after handling the SVC. We will continue
519 	 * in sp_enter_invoke_cmd() (return from __thread_enter_user_mode).
520 	 * The sp_enter() function copies the FF-A parameters (a0-a7) from the
521 	 * saved registers to the thread_smc_args. The thread_smc_args object is
522 	 * afterward used by the spmc_sp_msg_handler() to handle the
523 	 * FF-A message send by the SP.
524 	 */
525 	return false;
526 }
527 
528 /*
529  * Note: this variable is weak just to ease breaking its dependency chain
530  * when added to the unpaged area.
531  */
532 const struct ts_ops sp_ops __weak __relrodata_unpaged("sp_ops") = {
533 	.enter_invoke_cmd = sp_enter_invoke_cmd,
534 	.handle_svc = sp_handle_svc,
535 };
536 
537 static TEE_Result sp_init_all(void)
538 {
539 	TEE_Result res = TEE_SUCCESS;
540 	const struct sp_image *sp = NULL;
541 	char __maybe_unused msg[60] = { '\0', };
542 
543 	for_each_secure_partition(sp) {
544 		if (sp->image.uncompressed_size)
545 			snprintf(msg, sizeof(msg),
546 				 " (compressed, uncompressed %u)",
547 				 sp->image.uncompressed_size);
548 		else
549 			msg[0] = '\0';
550 		DMSG("SP %pUl size %u%s", (void *)&sp->image.uuid,
551 		     sp->image.size, msg);
552 
553 		res = sp_init_uuid(&sp->image.uuid, sp->fdt);
554 
555 		if (res != TEE_SUCCESS) {
556 			EMSG("Failed initializing SP(%pUl) err:%#"PRIx32,
557 			     &sp->image.uuid, res);
558 			if (!IS_ENABLED(CFG_SP_SKIP_FAILED))
559 				panic();
560 		}
561 	}
562 
563 	return TEE_SUCCESS;
564 }
565 
566 boot_final(sp_init_all);
567 
568 static TEE_Result secure_partition_open(const TEE_UUID *uuid,
569 					struct ts_store_handle **h)
570 {
571 	return emb_ts_open(uuid, h, find_secure_partition);
572 }
573 
574 REGISTER_SP_STORE(2) = {
575 	.description = "SP store",
576 	.open = secure_partition_open,
577 	.get_size = emb_ts_get_size,
578 	.get_tag = emb_ts_get_tag,
579 	.read = emb_ts_read,
580 	.close = emb_ts_close,
581 };
582