1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2020-2021, Arm Limited. 4 */ 5 #include <bench.h> 6 #include <crypto/crypto.h> 7 #include <initcall.h> 8 #include <kernel/embedded_ts.h> 9 #include <kernel/ldelf_loader.h> 10 #include <kernel/secure_partition.h> 11 #include <kernel/spinlock.h> 12 #include <kernel/spmc_sp_handler.h> 13 #include <kernel/thread_spmc.h> 14 #include <kernel/ts_store.h> 15 #include <ldelf.h> 16 #include <mm/core_mmu.h> 17 #include <mm/fobj.h> 18 #include <mm/mobj.h> 19 #include <mm/vm.h> 20 #include <optee_ffa.h> 21 #include <stdio.h> 22 #include <string.h> 23 #include <tee_api_types.h> 24 #include <trace.h> 25 #include <types_ext.h> 26 #include <utee_defines.h> 27 #include <util.h> 28 #include <zlib.h> 29 30 #include "thread_private.h" 31 32 const struct ts_ops sp_ops; 33 34 /* List that holds all of the loaded SP's */ 35 static struct sp_sessions_head open_sp_sessions = 36 TAILQ_HEAD_INITIALIZER(open_sp_sessions); 37 38 static const struct embedded_ts *find_secure_partition(const TEE_UUID *uuid) 39 { 40 const struct embedded_ts *sp = NULL; 41 42 for_each_secure_partition(sp) { 43 if (!memcmp(&sp->uuid, uuid, sizeof(*uuid))) 44 return sp; 45 } 46 return NULL; 47 } 48 49 bool is_sp_ctx(struct ts_ctx *ctx) 50 { 51 return ctx && (ctx->ops == &sp_ops); 52 } 53 54 static void set_sp_ctx_ops(struct ts_ctx *ctx) 55 { 56 ctx->ops = &sp_ops; 57 } 58 59 TEE_Result sp_find_session_id(const TEE_UUID *uuid, uint32_t *session_id) 60 { 61 struct sp_session *s = NULL; 62 63 TAILQ_FOREACH(s, &open_sp_sessions, link) { 64 if (!memcmp(&s->ts_sess.ctx->uuid, uuid, sizeof(*uuid))) { 65 if (s->state == sp_dead) 66 return TEE_ERROR_TARGET_DEAD; 67 68 *session_id = s->endpoint_id; 69 return TEE_SUCCESS; 70 } 71 } 72 73 return TEE_ERROR_ITEM_NOT_FOUND; 74 } 75 76 struct sp_session *sp_get_session(uint32_t session_id) 77 { 78 struct sp_session *s = NULL; 79 80 TAILQ_FOREACH(s, &open_sp_sessions, link) { 81 if (s->endpoint_id == session_id) 82 return s; 83 } 84 85 return NULL; 86 } 87 88 TEE_Result sp_partition_info_get_all(struct ffa_partition_info *fpi, 89 size_t *elem_count) 90 { 91 size_t in_count = *elem_count; 92 struct sp_session *s = NULL; 93 size_t count = 0; 94 95 TAILQ_FOREACH(s, &open_sp_sessions, link) { 96 if (s->state == sp_dead) 97 continue; 98 if (count < in_count) { 99 spmc_fill_partition_entry(fpi, s->endpoint_id, 1); 100 fpi++; 101 } 102 count++; 103 } 104 105 *elem_count = count; 106 if (count > in_count) 107 return TEE_ERROR_SHORT_BUFFER; 108 109 return TEE_SUCCESS; 110 } 111 112 bool sp_has_exclusive_access(struct sp_mem_map_region *mem, 113 struct user_mode_ctx *uctx) 114 { 115 /* 116 * Check that we have access to the region if it is supposed to be 117 * mapped to the current context. 118 */ 119 if (uctx) { 120 struct vm_region *region = NULL; 121 122 /* Make sure that each mobj belongs to the SP */ 123 TAILQ_FOREACH(region, &uctx->vm_info.regions, link) { 124 if (region->mobj == mem->mobj) 125 break; 126 } 127 128 if (!region) 129 return false; 130 } 131 132 /* Check that it is not shared with another SP */ 133 return !sp_mem_is_shared(mem); 134 } 135 136 static void sp_init_info(struct sp_ctx *ctx, struct thread_smc_args *args) 137 { 138 struct sp_ffa_init_info *info = NULL; 139 140 /* 141 * When starting the SP for the first time a init_info struct is passed. 142 * Store the struct on the stack and store the address in x0 143 */ 144 ctx->uctx.stack_ptr -= ROUNDUP(sizeof(*info), STACK_ALIGNMENT); 145 146 info = (struct sp_ffa_init_info *)ctx->uctx.stack_ptr; 147 148 info->magic = 0; 149 info->count = 0; 150 args->a0 = (vaddr_t)info; 151 } 152 153 static uint16_t new_session_id(struct sp_sessions_head *open_sessions) 154 { 155 struct sp_session *last = NULL; 156 uint16_t id = SPMC_ENDPOINT_ID + 1; 157 158 last = TAILQ_LAST(open_sessions, sp_sessions_head); 159 if (last) 160 id = last->endpoint_id + 1; 161 162 assert(id > SPMC_ENDPOINT_ID); 163 return id; 164 } 165 166 static TEE_Result sp_create_ctx(const TEE_UUID *uuid, struct sp_session *s) 167 { 168 TEE_Result res = TEE_SUCCESS; 169 struct sp_ctx *spc = NULL; 170 171 /* Register context */ 172 spc = calloc(1, sizeof(struct sp_ctx)); 173 if (!spc) 174 return TEE_ERROR_OUT_OF_MEMORY; 175 176 spc->uctx.ts_ctx = &spc->ts_ctx; 177 spc->open_session = s; 178 s->ts_sess.ctx = &spc->ts_ctx; 179 spc->ts_ctx.uuid = *uuid; 180 181 res = vm_info_init(&spc->uctx); 182 if (res) 183 goto err; 184 185 set_sp_ctx_ops(&spc->ts_ctx); 186 187 return TEE_SUCCESS; 188 189 err: 190 free(spc); 191 return res; 192 } 193 194 static TEE_Result sp_create_session(struct sp_sessions_head *open_sessions, 195 const TEE_UUID *uuid, 196 struct sp_session **sess) 197 { 198 TEE_Result res = TEE_SUCCESS; 199 struct sp_session *s = calloc(1, sizeof(struct sp_session)); 200 201 if (!s) 202 return TEE_ERROR_OUT_OF_MEMORY; 203 204 s->endpoint_id = new_session_id(open_sessions); 205 if (!s->endpoint_id) { 206 res = TEE_ERROR_OVERFLOW; 207 goto err; 208 } 209 210 DMSG("Loading Secure Partition %pUl", (void *)uuid); 211 res = sp_create_ctx(uuid, s); 212 if (res) 213 goto err; 214 215 TAILQ_INSERT_TAIL(open_sessions, s, link); 216 *sess = s; 217 return TEE_SUCCESS; 218 219 err: 220 free(s); 221 return res; 222 } 223 224 static TEE_Result sp_init_set_registers(struct sp_ctx *ctx) 225 { 226 struct thread_ctx_regs *sp_regs = &ctx->sp_regs; 227 228 memset(sp_regs, 0, sizeof(*sp_regs)); 229 sp_regs->sp = ctx->uctx.stack_ptr; 230 sp_regs->pc = ctx->uctx.entry_func; 231 232 return TEE_SUCCESS; 233 } 234 235 static TEE_Result sp_open_session(struct sp_session **sess, 236 struct sp_sessions_head *open_sessions, 237 const TEE_UUID *uuid) 238 { 239 TEE_Result res = TEE_SUCCESS; 240 struct sp_session *s = NULL; 241 struct sp_ctx *ctx = NULL; 242 243 if (!find_secure_partition(uuid)) 244 return TEE_ERROR_ITEM_NOT_FOUND; 245 246 res = sp_create_session(open_sessions, uuid, &s); 247 if (res != TEE_SUCCESS) { 248 DMSG("sp_create_session failed %#"PRIx32, res); 249 return res; 250 } 251 252 ctx = to_sp_ctx(s->ts_sess.ctx); 253 assert(ctx); 254 if (!ctx) 255 return TEE_ERROR_TARGET_DEAD; 256 *sess = s; 257 258 ts_push_current_session(&s->ts_sess); 259 /* Load the SP using ldelf. */ 260 ldelf_load_ldelf(&ctx->uctx); 261 res = ldelf_init_with_ldelf(&s->ts_sess, &ctx->uctx); 262 263 if (res != TEE_SUCCESS) { 264 EMSG("Failed. loading SP using ldelf %#"PRIx32, res); 265 ts_pop_current_session(); 266 return TEE_ERROR_TARGET_DEAD; 267 } 268 269 /* Make the SP ready for its first run */ 270 s->state = sp_idle; 271 s->caller_id = 0; 272 sp_init_set_registers(ctx); 273 ts_pop_current_session(); 274 275 return TEE_SUCCESS; 276 } 277 278 static TEE_Result sp_init_uuid(const TEE_UUID *uuid) 279 { 280 TEE_Result res = TEE_SUCCESS; 281 struct sp_session *sess = NULL; 282 struct thread_smc_args args = { }; 283 284 res = sp_open_session(&sess, 285 &open_sp_sessions, 286 uuid); 287 if (res) 288 return res; 289 290 ts_push_current_session(&sess->ts_sess); 291 sp_init_info(to_sp_ctx(sess->ts_sess.ctx), &args); 292 ts_pop_current_session(); 293 294 if (sp_enter(&args, sess)) 295 return FFA_ABORTED; 296 297 spmc_sp_msg_handler(&args, sess); 298 299 return TEE_SUCCESS; 300 } 301 302 TEE_Result sp_enter(struct thread_smc_args *args, struct sp_session *sp) 303 { 304 TEE_Result res = FFA_OK; 305 struct sp_ctx *ctx = to_sp_ctx(sp->ts_sess.ctx); 306 307 ctx->sp_regs.x[0] = args->a0; 308 ctx->sp_regs.x[1] = args->a1; 309 ctx->sp_regs.x[2] = args->a2; 310 ctx->sp_regs.x[3] = args->a3; 311 ctx->sp_regs.x[4] = args->a4; 312 ctx->sp_regs.x[5] = args->a5; 313 ctx->sp_regs.x[6] = args->a6; 314 ctx->sp_regs.x[7] = args->a7; 315 316 res = sp->ts_sess.ctx->ops->enter_invoke_cmd(&sp->ts_sess, 0); 317 318 args->a0 = ctx->sp_regs.x[0]; 319 args->a1 = ctx->sp_regs.x[1]; 320 args->a2 = ctx->sp_regs.x[2]; 321 args->a3 = ctx->sp_regs.x[3]; 322 args->a4 = ctx->sp_regs.x[4]; 323 args->a5 = ctx->sp_regs.x[5]; 324 args->a6 = ctx->sp_regs.x[6]; 325 args->a7 = ctx->sp_regs.x[7]; 326 327 return res; 328 } 329 330 static TEE_Result sp_enter_invoke_cmd(struct ts_session *s, 331 uint32_t cmd __unused) 332 { 333 struct sp_ctx *ctx = to_sp_ctx(s->ctx); 334 TEE_Result res = TEE_SUCCESS; 335 uint32_t exceptions = 0; 336 uint64_t cpsr = 0; 337 struct sp_session *sp_s = to_sp_session(s); 338 struct ts_session *sess = NULL; 339 struct thread_ctx_regs *sp_regs = NULL; 340 uint32_t panicked = false; 341 uint32_t panic_code = 0; 342 343 bm_timestamp(); 344 345 sp_regs = &ctx->sp_regs; 346 ts_push_current_session(s); 347 348 cpsr = sp_regs->cpsr; 349 sp_regs->cpsr = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT); 350 351 exceptions = thread_mask_exceptions(THREAD_EXCP_ALL); 352 __thread_enter_user_mode(sp_regs, &panicked, &panic_code); 353 sp_regs->cpsr = cpsr; 354 thread_unmask_exceptions(exceptions); 355 356 thread_user_clear_vfp(&ctx->uctx); 357 358 if (panicked) { 359 DMSG("SP panicked with code %#"PRIx32, panic_code); 360 abort_print_current_ts(); 361 362 sess = ts_pop_current_session(); 363 cpu_spin_lock(&sp_s->spinlock); 364 sp_s->state = sp_dead; 365 cpu_spin_unlock(&sp_s->spinlock); 366 367 return TEE_ERROR_TARGET_DEAD; 368 } 369 370 sess = ts_pop_current_session(); 371 assert(sess == s); 372 373 bm_timestamp(); 374 375 return res; 376 } 377 378 /* We currently don't support 32 bits */ 379 #ifdef ARM64 380 static void sp_svc_store_registers(struct thread_svc_regs *regs, 381 struct thread_ctx_regs *sp_regs) 382 { 383 COMPILE_TIME_ASSERT(sizeof(sp_regs->x[0]) == sizeof(regs->x0)); 384 memcpy(sp_regs->x, ®s->x0, 31 * sizeof(regs->x0)); 385 sp_regs->pc = regs->elr; 386 sp_regs->sp = regs->sp_el0; 387 } 388 #endif 389 390 static bool sp_handle_svc(struct thread_svc_regs *regs) 391 { 392 struct ts_session *ts = ts_get_current_session(); 393 struct sp_ctx *uctx = to_sp_ctx(ts->ctx); 394 struct sp_session *s = uctx->open_session; 395 396 assert(s); 397 398 sp_svc_store_registers(regs, &uctx->sp_regs); 399 400 regs->x0 = 0; 401 regs->x1 = 0; /* panic */ 402 regs->x2 = 0; /* panic code */ 403 404 /* 405 * All the registers of the SP are saved in the SP session by the SVC 406 * handler. 407 * We always return to S-El1 after handling the SVC. We will continue 408 * in sp_enter_invoke_cmd() (return from __thread_enter_user_mode). 409 * The sp_enter() function copies the FF-A parameters (a0-a7) from the 410 * saved registers to the thread_smc_args. The thread_smc_args object is 411 * afterward used by the spmc_sp_msg_handler() to handle the 412 * FF-A message send by the SP. 413 */ 414 return false; 415 } 416 417 /* 418 * Note: this variable is weak just to ease breaking its dependency chain 419 * when added to the unpaged area. 420 */ 421 const struct ts_ops sp_ops __weak __rodata_unpaged("sp_ops") = { 422 .enter_invoke_cmd = sp_enter_invoke_cmd, 423 .handle_svc = sp_handle_svc, 424 }; 425 426 static TEE_Result sp_init_all(void) 427 { 428 TEE_Result res = TEE_SUCCESS; 429 const struct embedded_ts *sp = NULL; 430 char __maybe_unused msg[60] = { '\0', }; 431 432 for_each_secure_partition(sp) { 433 if (sp->uncompressed_size) 434 snprintf(msg, sizeof(msg), 435 " (compressed, uncompressed %u)", 436 sp->uncompressed_size); 437 else 438 msg[0] = '\0'; 439 DMSG("SP %pUl size %u%s", (void *)&sp->uuid, sp->size, msg); 440 441 res = sp_init_uuid(&sp->uuid); 442 443 if (res != TEE_SUCCESS) { 444 EMSG("Failed initializing SP(%pUl) err:%#"PRIx32, 445 &sp->uuid, res); 446 if (!IS_ENABLED(CFG_SP_SKIP_FAILED)) 447 panic(); 448 } 449 } 450 451 return TEE_SUCCESS; 452 } 453 454 boot_final(sp_init_all); 455 456 static TEE_Result secure_partition_open(const TEE_UUID *uuid, 457 struct ts_store_handle **h) 458 { 459 return emb_ts_open(uuid, h, find_secure_partition); 460 } 461 462 REGISTER_SP_STORE(2) = { 463 .description = "SP store", 464 .open = secure_partition_open, 465 .get_size = emb_ts_get_size, 466 .get_tag = emb_ts_get_tag, 467 .read = emb_ts_read, 468 .close = emb_ts_close, 469 }; 470