1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2020-2021, Arm Limited. 4 */ 5 #include <bench.h> 6 #include <crypto/crypto.h> 7 #include <initcall.h> 8 #include <kernel/embedded_ts.h> 9 #include <kernel/ldelf_loader.h> 10 #include <kernel/secure_partition.h> 11 #include <kernel/spinlock.h> 12 #include <kernel/spmc_sp_handler.h> 13 #include <kernel/thread_spmc.h> 14 #include <kernel/ts_store.h> 15 #include <ldelf.h> 16 #include <mm/core_mmu.h> 17 #include <mm/fobj.h> 18 #include <mm/mobj.h> 19 #include <mm/vm.h> 20 #include <optee_ffa.h> 21 #include <stdio.h> 22 #include <string.h> 23 #include <tee_api_types.h> 24 #include <trace.h> 25 #include <types_ext.h> 26 #include <utee_defines.h> 27 #include <util.h> 28 #include <zlib.h> 29 30 #include "thread_private.h" 31 32 const struct ts_ops sp_ops; 33 34 /* List that holds all of the loaded SP's */ 35 static struct sp_sessions_head open_sp_sessions = 36 TAILQ_HEAD_INITIALIZER(open_sp_sessions); 37 38 static const struct embedded_ts *find_secure_partition(const TEE_UUID *uuid) 39 { 40 const struct embedded_ts *sp = NULL; 41 42 for_each_secure_partition(sp) { 43 if (!memcmp(&sp->uuid, uuid, sizeof(*uuid))) 44 return sp; 45 } 46 return NULL; 47 } 48 49 bool is_sp_ctx(struct ts_ctx *ctx) 50 { 51 return ctx && (ctx->ops == &sp_ops); 52 } 53 54 static void set_sp_ctx_ops(struct ts_ctx *ctx) 55 { 56 ctx->ops = &sp_ops; 57 } 58 59 struct sp_session *sp_get_session(uint32_t session_id) 60 { 61 struct sp_session *s = NULL; 62 63 TAILQ_FOREACH(s, &open_sp_sessions, link) { 64 if (s->endpoint_id == session_id) 65 return s; 66 } 67 68 return NULL; 69 } 70 71 static void sp_init_info(struct sp_ctx *ctx, struct thread_smc_args *args) 72 { 73 struct sp_ffa_init_info *info = NULL; 74 75 /* 76 * When starting the SP for the first time a init_info struct is passed. 77 * Store the struct on the stack and store the address in x0 78 */ 79 ctx->uctx.stack_ptr -= ROUNDUP(sizeof(*info), STACK_ALIGNMENT); 80 81 info = (struct sp_ffa_init_info *)ctx->uctx.stack_ptr; 82 83 info->magic = 0; 84 info->count = 0; 85 args->a0 = (vaddr_t)info; 86 } 87 88 static uint16_t new_session_id(struct sp_sessions_head *open_sessions) 89 { 90 struct sp_session *last = NULL; 91 uint16_t id = SPMC_ENDPOINT_ID + 1; 92 93 last = TAILQ_LAST(open_sessions, sp_sessions_head); 94 if (last) 95 id = last->endpoint_id + 1; 96 97 assert(id > SPMC_ENDPOINT_ID); 98 return id; 99 } 100 101 static TEE_Result sp_create_ctx(const TEE_UUID *uuid, struct sp_session *s) 102 { 103 TEE_Result res = TEE_SUCCESS; 104 struct sp_ctx *spc = NULL; 105 106 /* Register context */ 107 spc = calloc(1, sizeof(struct sp_ctx)); 108 if (!spc) 109 return TEE_ERROR_OUT_OF_MEMORY; 110 111 spc->uctx.ts_ctx = &spc->ts_ctx; 112 spc->open_session = s; 113 s->ts_sess.ctx = &spc->ts_ctx; 114 spc->ts_ctx.uuid = *uuid; 115 116 res = vm_info_init(&spc->uctx); 117 if (res) 118 goto err; 119 120 set_sp_ctx_ops(&spc->ts_ctx); 121 122 return TEE_SUCCESS; 123 124 err: 125 free(spc); 126 return res; 127 } 128 129 static TEE_Result sp_create_session(struct sp_sessions_head *open_sessions, 130 const TEE_UUID *uuid, 131 struct sp_session **sess) 132 { 133 TEE_Result res = TEE_SUCCESS; 134 struct sp_session *s = calloc(1, sizeof(struct sp_session)); 135 136 if (!s) 137 return TEE_ERROR_OUT_OF_MEMORY; 138 139 s->endpoint_id = new_session_id(open_sessions); 140 if (!s->endpoint_id) { 141 res = TEE_ERROR_OVERFLOW; 142 goto err; 143 } 144 145 DMSG("Loading Secure Partition %pUl", (void *)uuid); 146 res = sp_create_ctx(uuid, s); 147 if (res) 148 goto err; 149 150 TAILQ_INSERT_TAIL(open_sessions, s, link); 151 *sess = s; 152 return TEE_SUCCESS; 153 154 err: 155 free(s); 156 return res; 157 } 158 159 static TEE_Result sp_init_set_registers(struct sp_ctx *ctx) 160 { 161 struct thread_ctx_regs *sp_regs = &ctx->sp_regs; 162 163 memset(sp_regs, 0, sizeof(*sp_regs)); 164 sp_regs->sp = ctx->uctx.stack_ptr; 165 sp_regs->pc = ctx->uctx.entry_func; 166 167 return TEE_SUCCESS; 168 } 169 170 static TEE_Result sp_open_session(struct sp_session **sess, 171 struct sp_sessions_head *open_sessions, 172 const TEE_UUID *uuid) 173 { 174 TEE_Result res = TEE_SUCCESS; 175 struct sp_session *s = NULL; 176 struct sp_ctx *ctx = NULL; 177 178 if (!find_secure_partition(uuid)) 179 return TEE_ERROR_ITEM_NOT_FOUND; 180 181 res = sp_create_session(open_sessions, uuid, &s); 182 if (res != TEE_SUCCESS) { 183 DMSG("sp_create_session failed %#"PRIx32, res); 184 return res; 185 } 186 187 ctx = to_sp_ctx(s->ts_sess.ctx); 188 assert(ctx); 189 if (!ctx) 190 return TEE_ERROR_TARGET_DEAD; 191 *sess = s; 192 193 ts_push_current_session(&s->ts_sess); 194 /* Load the SP using ldelf. */ 195 ldelf_load_ldelf(&ctx->uctx); 196 res = ldelf_init_with_ldelf(&s->ts_sess, &ctx->uctx); 197 198 if (res != TEE_SUCCESS) { 199 EMSG("Failed. loading SP using ldelf %#"PRIx32, res); 200 ts_pop_current_session(); 201 return TEE_ERROR_TARGET_DEAD; 202 } 203 204 /* Make the SP ready for its first run */ 205 s->state = sp_idle; 206 s->caller_id = 0; 207 sp_init_set_registers(ctx); 208 ts_pop_current_session(); 209 210 return TEE_SUCCESS; 211 } 212 213 static TEE_Result sp_init_uuid(const TEE_UUID *uuid) 214 { 215 TEE_Result res = TEE_SUCCESS; 216 struct sp_session *sess = NULL; 217 struct thread_smc_args args = { }; 218 219 res = sp_open_session(&sess, 220 &open_sp_sessions, 221 uuid); 222 if (res) 223 return res; 224 225 ts_push_current_session(&sess->ts_sess); 226 sp_init_info(to_sp_ctx(sess->ts_sess.ctx), &args); 227 ts_pop_current_session(); 228 229 if (sp_enter(&args, sess)) 230 return FFA_ABORTED; 231 232 spmc_sp_msg_handler(&args, sess); 233 234 return TEE_SUCCESS; 235 } 236 237 TEE_Result sp_enter(struct thread_smc_args *args, struct sp_session *sp) 238 { 239 TEE_Result res = FFA_OK; 240 struct sp_ctx *ctx = to_sp_ctx(sp->ts_sess.ctx); 241 242 ctx->sp_regs.x[0] = args->a0; 243 ctx->sp_regs.x[1] = args->a1; 244 ctx->sp_regs.x[2] = args->a2; 245 ctx->sp_regs.x[3] = args->a3; 246 ctx->sp_regs.x[4] = args->a4; 247 ctx->sp_regs.x[5] = args->a5; 248 ctx->sp_regs.x[6] = args->a6; 249 ctx->sp_regs.x[7] = args->a7; 250 251 res = sp->ts_sess.ctx->ops->enter_invoke_cmd(&sp->ts_sess, 0); 252 253 args->a0 = ctx->sp_regs.x[0]; 254 args->a1 = ctx->sp_regs.x[1]; 255 args->a2 = ctx->sp_regs.x[2]; 256 args->a3 = ctx->sp_regs.x[3]; 257 args->a4 = ctx->sp_regs.x[4]; 258 args->a5 = ctx->sp_regs.x[5]; 259 args->a6 = ctx->sp_regs.x[6]; 260 args->a7 = ctx->sp_regs.x[7]; 261 262 return res; 263 } 264 265 static TEE_Result sp_enter_invoke_cmd(struct ts_session *s, 266 uint32_t cmd __unused) 267 { 268 struct sp_ctx *ctx = to_sp_ctx(s->ctx); 269 TEE_Result res = TEE_SUCCESS; 270 uint32_t exceptions = 0; 271 uint64_t cpsr = 0; 272 struct sp_session *sp_s = to_sp_session(s); 273 struct ts_session *sess = NULL; 274 struct thread_ctx_regs *sp_regs = NULL; 275 uint32_t panicked = false; 276 uint32_t panic_code = 0; 277 278 bm_timestamp(); 279 280 sp_regs = &ctx->sp_regs; 281 ts_push_current_session(s); 282 283 cpsr = sp_regs->cpsr; 284 sp_regs->cpsr = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT); 285 286 exceptions = thread_mask_exceptions(THREAD_EXCP_ALL); 287 __thread_enter_user_mode(sp_regs, &panicked, &panic_code); 288 sp_regs->cpsr = cpsr; 289 thread_unmask_exceptions(exceptions); 290 291 thread_user_clear_vfp(&ctx->uctx); 292 293 if (panicked) { 294 DMSG("SP panicked with code %#"PRIx32, panic_code); 295 abort_print_current_ts(); 296 297 sess = ts_pop_current_session(); 298 cpu_spin_lock(&sp_s->spinlock); 299 sp_s->state = sp_dead; 300 cpu_spin_unlock(&sp_s->spinlock); 301 302 return TEE_ERROR_TARGET_DEAD; 303 } 304 305 sess = ts_pop_current_session(); 306 assert(sess == s); 307 308 bm_timestamp(); 309 310 return res; 311 } 312 313 /* We currently don't support 32 bits */ 314 #ifdef ARM64 315 static void sp_svc_store_registers(struct thread_svc_regs *regs, 316 struct thread_ctx_regs *sp_regs) 317 { 318 COMPILE_TIME_ASSERT(sizeof(sp_regs->x[0]) == sizeof(regs->x0)); 319 memcpy(sp_regs->x, ®s->x0, 31 * sizeof(regs->x0)); 320 sp_regs->pc = regs->elr; 321 sp_regs->sp = regs->sp_el0; 322 } 323 #endif 324 325 static bool sp_handle_svc(struct thread_svc_regs *regs) 326 { 327 struct ts_session *ts = ts_get_current_session(); 328 struct sp_ctx *uctx = to_sp_ctx(ts->ctx); 329 struct sp_session *s = uctx->open_session; 330 331 assert(s); 332 333 sp_svc_store_registers(regs, &uctx->sp_regs); 334 335 regs->x0 = 0; 336 regs->x1 = 0; /* panic */ 337 regs->x2 = 0; /* panic code */ 338 339 /* 340 * All the registers of the SP are saved in the SP session by the SVC 341 * handler. 342 * We always return to S-El1 after handling the SVC. We will continue 343 * in sp_enter_invoke_cmd() (return from __thread_enter_user_mode). 344 * The sp_enter() function copies the FF-A parameters (a0-a7) from the 345 * saved registers to the thread_smc_args. The thread_smc_args object is 346 * afterward used by the spmc_sp_msg_handler() to handle the 347 * FF-A message send by the SP. 348 */ 349 return false; 350 } 351 352 /* 353 * Note: this variable is weak just to ease breaking its dependency chain 354 * when added to the unpaged area. 355 */ 356 const struct ts_ops sp_ops __weak __rodata_unpaged("sp_ops") = { 357 .enter_invoke_cmd = sp_enter_invoke_cmd, 358 .handle_svc = sp_handle_svc, 359 }; 360 361 static TEE_Result sp_init_all(void) 362 { 363 TEE_Result res = TEE_SUCCESS; 364 const struct embedded_ts *sp = NULL; 365 char __maybe_unused msg[60] = { '\0', }; 366 367 for_each_secure_partition(sp) { 368 if (sp->uncompressed_size) 369 snprintf(msg, sizeof(msg), 370 " (compressed, uncompressed %u)", 371 sp->uncompressed_size); 372 else 373 msg[0] = '\0'; 374 DMSG("SP %pUl size %u%s", (void *)&sp->uuid, sp->size, msg); 375 376 res = sp_init_uuid(&sp->uuid); 377 378 if (res != TEE_SUCCESS) { 379 EMSG("Failed initializing SP(%pUl) err:%#"PRIx32, 380 &sp->uuid, res); 381 if (!IS_ENABLED(CFG_SP_SKIP_FAILED)) 382 panic(); 383 } 384 } 385 386 return TEE_SUCCESS; 387 } 388 389 boot_final(sp_init_all); 390 391 static TEE_Result secure_partition_open(const TEE_UUID *uuid, 392 struct ts_store_handle **h) 393 { 394 return emb_ts_open(uuid, h, find_secure_partition); 395 } 396 397 REGISTER_SP_STORE(2) = { 398 .description = "SP store", 399 .open = secure_partition_open, 400 .get_size = emb_ts_get_size, 401 .get_tag = emb_ts_get_tag, 402 .read = emb_ts_read, 403 .close = emb_ts_close, 404 }; 405