xref: /optee_os/core/arch/arm/kernel/secure_partition.c (revision 876826f3a204dbde7e56b8e10f97f8bc7ad977ec) 
1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3  * Copyright (c) 2020-2022, Arm Limited.
4  */
5 #include <bench.h>
6 #include <crypto/crypto.h>
7 #include <initcall.h>
8 #include <kernel/embedded_ts.h>
9 #include <kernel/ldelf_loader.h>
10 #include <kernel/secure_partition.h>
11 #include <kernel/spinlock.h>
12 #include <kernel/spmc_sp_handler.h>
13 #include <kernel/thread_private.h>
14 #include <kernel/thread_spmc.h>
15 #include <kernel/ts_store.h>
16 #include <ldelf.h>
17 #include <libfdt.h>
18 #include <mm/core_mmu.h>
19 #include <mm/fobj.h>
20 #include <mm/mobj.h>
21 #include <mm/vm.h>
22 #include <optee_ffa.h>
23 #include <stdio.h>
24 #include <string.h>
25 #include <tee_api_types.h>
26 #include <tee/uuid.h>
27 #include <trace.h>
28 #include <types_ext.h>
29 #include <utee_defines.h>
30 #include <util.h>
31 #include <zlib.h>
32 
33 const struct ts_ops sp_ops;
34 
35 /* List that holds all of the loaded SP's */
36 static struct sp_sessions_head open_sp_sessions =
37 	TAILQ_HEAD_INITIALIZER(open_sp_sessions);
38 
39 static const struct embedded_ts *find_secure_partition(const TEE_UUID *uuid)
40 {
41 	const struct sp_image *sp = NULL;
42 
43 	for_each_secure_partition(sp) {
44 		if (!memcmp(&sp->image.uuid, uuid, sizeof(*uuid)))
45 			return &sp->image;
46 	}
47 	return NULL;
48 }
49 
50 bool is_sp_ctx(struct ts_ctx *ctx)
51 {
52 	return ctx && (ctx->ops == &sp_ops);
53 }
54 
55 static void set_sp_ctx_ops(struct ts_ctx *ctx)
56 {
57 	ctx->ops = &sp_ops;
58 }
59 
60 TEE_Result sp_find_session_id(const TEE_UUID *uuid, uint32_t *session_id)
61 {
62 	struct sp_session *s = NULL;
63 
64 	TAILQ_FOREACH(s, &open_sp_sessions, link) {
65 		if (!memcmp(&s->ts_sess.ctx->uuid, uuid, sizeof(*uuid))) {
66 			if (s->state == sp_dead)
67 				return TEE_ERROR_TARGET_DEAD;
68 
69 			*session_id  = s->endpoint_id;
70 			return TEE_SUCCESS;
71 		}
72 	}
73 
74 	return TEE_ERROR_ITEM_NOT_FOUND;
75 }
76 
77 struct sp_session *sp_get_session(uint32_t session_id)
78 {
79 	struct sp_session *s = NULL;
80 
81 	TAILQ_FOREACH(s, &open_sp_sessions, link) {
82 		if (s->endpoint_id == session_id)
83 			return s;
84 	}
85 
86 	return NULL;
87 }
88 
89 TEE_Result sp_partition_info_get_all(struct ffa_partition_info *fpi,
90 				     size_t *elem_count)
91 {
92 	size_t in_count = *elem_count;
93 	struct sp_session *s = NULL;
94 	size_t count = 0;
95 
96 	TAILQ_FOREACH(s, &open_sp_sessions, link) {
97 		if (s->state == sp_dead)
98 			continue;
99 		if (count < in_count) {
100 			spmc_fill_partition_entry(fpi, s->endpoint_id, 1);
101 			fpi++;
102 		}
103 		count++;
104 	}
105 
106 	*elem_count = count;
107 	if (count > in_count)
108 		return TEE_ERROR_SHORT_BUFFER;
109 
110 	return TEE_SUCCESS;
111 }
112 
113 bool sp_has_exclusive_access(struct sp_mem_map_region *mem,
114 			     struct user_mode_ctx *uctx)
115 {
116 	/*
117 	 * Check that we have access to the region if it is supposed to be
118 	 * mapped to the current context.
119 	 */
120 	if (uctx) {
121 		struct vm_region *region = NULL;
122 
123 		/* Make sure that each mobj belongs to the SP */
124 		TAILQ_FOREACH(region, &uctx->vm_info.regions, link) {
125 			if (region->mobj == mem->mobj)
126 				break;
127 		}
128 
129 		if (!region)
130 			return false;
131 	}
132 
133 	/* Check that it is not shared with another SP */
134 	return !sp_mem_is_shared(mem);
135 }
136 
137 static TEE_Result sp_init_info(struct sp_ctx *ctx, struct thread_smc_args *args,
138 			       const void * const fdt, vaddr_t *va,
139 			       size_t *num_pgs)
140 {
141 	struct sp_ffa_init_info *info = NULL;
142 	int nvp_count = 1;
143 	size_t nvp_size = sizeof(struct sp_name_value_pair) * nvp_count;
144 	size_t info_size = sizeof(*info) + nvp_size;
145 	size_t fdt_size = fdt_totalsize(fdt);
146 	TEE_Result res = TEE_SUCCESS;
147 	uint32_t perm = TEE_MATTR_URW | TEE_MATTR_PRW;
148 	struct fobj *fo = NULL;
149 	struct mobj *m = NULL;
150 	static const char fdt_name[16] = "TYPE_DT\0\0\0\0\0\0\0\0";
151 
152 	*num_pgs = ROUNDUP(fdt_size + info_size, SMALL_PAGE_SIZE) /
153 		   SMALL_PAGE_SIZE;
154 
155 	fo = fobj_sec_mem_alloc(*num_pgs);
156 	m = mobj_with_fobj_alloc(fo, NULL);
157 
158 	fobj_put(fo);
159 	if (!m)
160 		return TEE_ERROR_OUT_OF_MEMORY;
161 
162 	res = vm_map(&ctx->uctx, va, fdt_size + info_size,
163 		     perm, 0, m, 0);
164 	mobj_put(m);
165 	if (res)
166 		return res;
167 
168 	info = (struct sp_ffa_init_info *)*va;
169 
170 	/* magic field is 4 bytes, we don't copy /0 byte. */
171 	memcpy(&info->magic, "FF-A", 4);
172 	info->count = nvp_count;
173 	args->a0 = (vaddr_t)info;
174 
175 	/*
176 	 * Store the fdt after the boot_info and store the pointer in the
177 	 * first element.
178 	 */
179 	COMPILE_TIME_ASSERT(sizeof(info->nvp[0].name) == sizeof(fdt_name));
180 	memcpy(info->nvp[0].name, fdt_name, sizeof(fdt_name));
181 	info->nvp[0].value = *va + info_size;
182 	info->nvp[0].size = fdt_size;
183 	memcpy((void *)info->nvp[0].value, fdt, fdt_size);
184 
185 	return TEE_SUCCESS;
186 }
187 
188 static uint16_t new_session_id(struct sp_sessions_head *open_sessions)
189 {
190 	struct sp_session *last = NULL;
191 	uint16_t id = SPMC_ENDPOINT_ID + 1;
192 
193 	last = TAILQ_LAST(open_sessions, sp_sessions_head);
194 	if (last)
195 		id = last->endpoint_id + 1;
196 
197 	assert(id > SPMC_ENDPOINT_ID);
198 	return id;
199 }
200 
201 static TEE_Result sp_create_ctx(const TEE_UUID *uuid, struct sp_session *s)
202 {
203 	TEE_Result res = TEE_SUCCESS;
204 	struct sp_ctx *spc = NULL;
205 
206 	/* Register context */
207 	spc = calloc(1, sizeof(struct sp_ctx));
208 	if (!spc)
209 		return TEE_ERROR_OUT_OF_MEMORY;
210 
211 	spc->uctx.ts_ctx = &spc->ts_ctx;
212 	spc->open_session = s;
213 	s->ts_sess.ctx = &spc->ts_ctx;
214 	spc->ts_ctx.uuid = *uuid;
215 
216 	res = vm_info_init(&spc->uctx);
217 	if (res)
218 		goto err;
219 
220 	set_sp_ctx_ops(&spc->ts_ctx);
221 
222 	return TEE_SUCCESS;
223 
224 err:
225 	free(spc);
226 	return res;
227 }
228 
229 static TEE_Result sp_create_session(struct sp_sessions_head *open_sessions,
230 				    const TEE_UUID *uuid,
231 				    struct sp_session **sess)
232 {
233 	TEE_Result res = TEE_SUCCESS;
234 	struct sp_session *s = calloc(1, sizeof(struct sp_session));
235 
236 	if (!s)
237 		return TEE_ERROR_OUT_OF_MEMORY;
238 
239 	s->endpoint_id = new_session_id(open_sessions);
240 	if (!s->endpoint_id) {
241 		res = TEE_ERROR_OVERFLOW;
242 		goto err;
243 	}
244 
245 	DMSG("Loading Secure Partition %pUl", (void *)uuid);
246 	res = sp_create_ctx(uuid, s);
247 	if (res)
248 		goto err;
249 
250 	TAILQ_INSERT_TAIL(open_sessions, s, link);
251 	*sess = s;
252 	return TEE_SUCCESS;
253 
254 err:
255 	free(s);
256 	return res;
257 }
258 
259 static TEE_Result sp_init_set_registers(struct sp_ctx *ctx)
260 {
261 	struct thread_ctx_regs *sp_regs = &ctx->sp_regs;
262 
263 	memset(sp_regs, 0, sizeof(*sp_regs));
264 	sp_regs->sp = ctx->uctx.stack_ptr;
265 	sp_regs->pc = ctx->uctx.entry_func;
266 
267 	return TEE_SUCCESS;
268 }
269 
270 TEE_Result sp_map_shared(struct sp_session *s,
271 			 struct sp_mem_receiver *receiver,
272 			 struct sp_mem *smem,
273 			 uint64_t *va)
274 {
275 	TEE_Result res = TEE_SUCCESS;
276 	struct sp_ctx *ctx = NULL;
277 	uint32_t perm = TEE_MATTR_UR;
278 	struct sp_mem_map_region *reg = NULL;
279 
280 	ctx = to_sp_ctx(s->ts_sess.ctx);
281 
282 	/* Get the permission */
283 	if (receiver->perm.perm & FFA_MEM_ACC_EXE)
284 		perm |= TEE_MATTR_UX;
285 
286 	if (receiver->perm.perm & FFA_MEM_ACC_RW) {
287 		if (receiver->perm.perm & FFA_MEM_ACC_EXE)
288 			return TEE_ERROR_ACCESS_CONFLICT;
289 
290 		perm |= TEE_MATTR_UW;
291 	}
292 	/*
293 	 * Currently we don't support passing a va. We can't guarantee that the
294 	 * full region will be mapped in a contiguous region. A smem->region can
295 	 * have multiple mobj for one share. Currently there doesn't seem to be
296 	 * an option to guarantee that these will be mapped in a contiguous va
297 	 * space.
298 	 */
299 	if (*va)
300 		return TEE_ERROR_NOT_SUPPORTED;
301 
302 	SLIST_FOREACH(reg, &smem->regions, link) {
303 		res = vm_map(&ctx->uctx, va, reg->page_count * SMALL_PAGE_SIZE,
304 			     perm, 0, reg->mobj, reg->page_offset);
305 
306 		if (res != TEE_SUCCESS) {
307 			EMSG("Failed to map memory region %#"PRIx32, res);
308 			return res;
309 		}
310 	}
311 	return TEE_SUCCESS;
312 }
313 
314 TEE_Result sp_unmap_ffa_regions(struct sp_session *s, struct sp_mem *smem)
315 {
316 	TEE_Result res = TEE_SUCCESS;
317 	vaddr_t vaddr = 0;
318 	size_t len = 0;
319 	struct sp_ctx *ctx = to_sp_ctx(s->ts_sess.ctx);
320 	struct sp_mem_map_region *reg = NULL;
321 
322 	SLIST_FOREACH(reg, &smem->regions, link) {
323 		vaddr = (vaddr_t)sp_mem_get_va(&ctx->uctx, reg->page_offset,
324 					       reg->mobj);
325 		len = reg->page_count * SMALL_PAGE_SIZE;
326 
327 		res = vm_unmap(&ctx->uctx, vaddr, len);
328 		if (res != TEE_SUCCESS)
329 			return res;
330 	}
331 
332 	return TEE_SUCCESS;
333 }
334 
335 static TEE_Result sp_open_session(struct sp_session **sess,
336 				  struct sp_sessions_head *open_sessions,
337 				  const TEE_UUID *uuid)
338 {
339 	TEE_Result res = TEE_SUCCESS;
340 	struct sp_session *s = NULL;
341 	struct sp_ctx *ctx = NULL;
342 
343 	if (!find_secure_partition(uuid))
344 		return TEE_ERROR_ITEM_NOT_FOUND;
345 
346 	res = sp_create_session(open_sessions, uuid, &s);
347 	if (res != TEE_SUCCESS) {
348 		DMSG("sp_create_session failed %#"PRIx32, res);
349 		return res;
350 	}
351 
352 	ctx = to_sp_ctx(s->ts_sess.ctx);
353 	assert(ctx);
354 	if (!ctx)
355 		return TEE_ERROR_TARGET_DEAD;
356 	*sess = s;
357 
358 	ts_push_current_session(&s->ts_sess);
359 	/* Load the SP using ldelf. */
360 	ldelf_load_ldelf(&ctx->uctx);
361 	res = ldelf_init_with_ldelf(&s->ts_sess, &ctx->uctx);
362 
363 	if (res != TEE_SUCCESS) {
364 		EMSG("Failed. loading SP using ldelf %#"PRIx32, res);
365 		ts_pop_current_session();
366 		return TEE_ERROR_TARGET_DEAD;
367 	}
368 
369 	/* Make the SP ready for its first run */
370 	s->state = sp_idle;
371 	s->caller_id = 0;
372 	sp_init_set_registers(ctx);
373 	ts_pop_current_session();
374 
375 	return TEE_SUCCESS;
376 }
377 
378 static TEE_Result handle_fdt(const void * const fdt, const TEE_UUID *uuid)
379 {
380 	int len = 0;
381 	const fdt32_t *prop = NULL;
382 	int i = 0;
383 	const struct fdt_property *description = NULL;
384 	int description_name_len = 0;
385 	uint32_t uuid_array[4] = { 0 };
386 	TEE_UUID fdt_uuid = { };
387 
388 	if (fdt_node_check_compatible(fdt, 0, "arm,ffa-manifest-1.0")) {
389 		EMSG("Failed loading SP, manifest not found");
390 		return TEE_ERROR_BAD_PARAMETERS;
391 	}
392 
393 	description = fdt_get_property(fdt, 0, "description",
394 				       &description_name_len);
395 	if (description)
396 		DMSG("Loading SP: %s", description->data);
397 
398 	prop = fdt_getprop(fdt, 0, "uuid", &len);
399 	if (!prop || len != 16) {
400 		EMSG("Missing or invalid UUID in SP manifest");
401 		return TEE_ERROR_BAD_FORMAT;
402 	}
403 
404 	for (i = 0; i < 4; i++)
405 		uuid_array[i] = fdt32_to_cpu(prop[i]);
406 	tee_uuid_from_octets(&fdt_uuid, (uint8_t *)uuid_array);
407 
408 	if (memcmp(uuid, &fdt_uuid, sizeof(fdt_uuid))) {
409 		EMSG("Failed loading SP, UUID mismatch");
410 		return TEE_ERROR_BAD_FORMAT;
411 	}
412 
413 	return TEE_SUCCESS;
414 }
415 
416 static TEE_Result sp_init_uuid(const TEE_UUID *uuid, const void * const fdt)
417 {
418 	TEE_Result res = TEE_SUCCESS;
419 	struct sp_session *sess = NULL;
420 	struct thread_smc_args args = { };
421 	vaddr_t va = 0;
422 	size_t num_pgs = 0;
423 	struct sp_ctx *ctx = NULL;
424 
425 	res = handle_fdt(fdt, uuid);
426 
427 	if (res)
428 		return res;
429 
430 	res = sp_open_session(&sess,
431 			      &open_sp_sessions,
432 			      uuid);
433 	if (res)
434 		return res;
435 
436 	ctx = to_sp_ctx(sess->ts_sess.ctx);
437 	ts_push_current_session(&sess->ts_sess);
438 	res = sp_init_info(ctx, &args, fdt, &va, &num_pgs);
439 	ts_pop_current_session();
440 	if (res)
441 		return res;
442 
443 	if (sp_enter(&args, sess))
444 		return FFA_ABORTED;
445 
446 	spmc_sp_msg_handler(&args, sess);
447 
448 	/* Free the boot info page from the SP memory.*/
449 	ts_push_current_session(&sess->ts_sess);
450 	res = vm_unmap(&ctx->uctx, va, num_pgs);
451 	ts_pop_current_session();
452 
453 	return res;
454 }
455 
456 TEE_Result sp_enter(struct thread_smc_args *args, struct sp_session *sp)
457 {
458 	TEE_Result res = FFA_OK;
459 	struct sp_ctx *ctx = to_sp_ctx(sp->ts_sess.ctx);
460 
461 	ctx->sp_regs.x[0] = args->a0;
462 	ctx->sp_regs.x[1] = args->a1;
463 	ctx->sp_regs.x[2] = args->a2;
464 	ctx->sp_regs.x[3] = args->a3;
465 	ctx->sp_regs.x[4] = args->a4;
466 	ctx->sp_regs.x[5] = args->a5;
467 	ctx->sp_regs.x[6] = args->a6;
468 	ctx->sp_regs.x[7] = args->a7;
469 
470 	res = sp->ts_sess.ctx->ops->enter_invoke_cmd(&sp->ts_sess, 0);
471 
472 	args->a0 = ctx->sp_regs.x[0];
473 	args->a1 = ctx->sp_regs.x[1];
474 	args->a2 = ctx->sp_regs.x[2];
475 	args->a3 = ctx->sp_regs.x[3];
476 	args->a4 = ctx->sp_regs.x[4];
477 	args->a5 = ctx->sp_regs.x[5];
478 	args->a6 = ctx->sp_regs.x[6];
479 	args->a7 = ctx->sp_regs.x[7];
480 
481 	return res;
482 }
483 
484 static TEE_Result sp_enter_invoke_cmd(struct ts_session *s,
485 				      uint32_t cmd __unused)
486 {
487 	struct sp_ctx *ctx = to_sp_ctx(s->ctx);
488 	TEE_Result res = TEE_SUCCESS;
489 	uint32_t exceptions = 0;
490 	uint64_t cpsr = 0;
491 	struct sp_session *sp_s = to_sp_session(s);
492 	struct ts_session *sess = NULL;
493 	struct thread_ctx_regs *sp_regs = NULL;
494 	uint32_t panicked = false;
495 	uint32_t panic_code = 0;
496 
497 	bm_timestamp();
498 
499 	sp_regs = &ctx->sp_regs;
500 	ts_push_current_session(s);
501 
502 	cpsr = sp_regs->cpsr;
503 	sp_regs->cpsr = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT);
504 
505 	exceptions = thread_mask_exceptions(THREAD_EXCP_ALL);
506 	__thread_enter_user_mode(sp_regs, &panicked, &panic_code);
507 	sp_regs->cpsr = cpsr;
508 	thread_unmask_exceptions(exceptions);
509 
510 	thread_user_clear_vfp(&ctx->uctx);
511 
512 	if (panicked) {
513 		DMSG("SP panicked with code  %#"PRIx32, panic_code);
514 		abort_print_current_ts();
515 
516 		sess = ts_pop_current_session();
517 		cpu_spin_lock(&sp_s->spinlock);
518 		sp_s->state = sp_dead;
519 		cpu_spin_unlock(&sp_s->spinlock);
520 
521 		return TEE_ERROR_TARGET_DEAD;
522 	}
523 
524 	sess = ts_pop_current_session();
525 	assert(sess == s);
526 
527 	bm_timestamp();
528 
529 	return res;
530 }
531 
532 /* We currently don't support 32 bits */
533 #ifdef ARM64
534 static void sp_svc_store_registers(struct thread_svc_regs *regs,
535 				   struct thread_ctx_regs *sp_regs)
536 {
537 	COMPILE_TIME_ASSERT(sizeof(sp_regs->x[0]) == sizeof(regs->x0));
538 	memcpy(sp_regs->x, &regs->x0, 31 * sizeof(regs->x0));
539 	sp_regs->pc = regs->elr;
540 	sp_regs->sp = regs->sp_el0;
541 }
542 #endif
543 
544 static bool sp_handle_svc(struct thread_svc_regs *regs)
545 {
546 	struct ts_session *ts = ts_get_current_session();
547 	struct sp_ctx *uctx = to_sp_ctx(ts->ctx);
548 	struct sp_session *s = uctx->open_session;
549 
550 	assert(s);
551 
552 	sp_svc_store_registers(regs, &uctx->sp_regs);
553 
554 	regs->x0 = 0;
555 	regs->x1 = 0; /* panic */
556 	regs->x2 = 0; /* panic code */
557 
558 	/*
559 	 * All the registers of the SP are saved in the SP session by the SVC
560 	 * handler.
561 	 * We always return to S-El1 after handling the SVC. We will continue
562 	 * in sp_enter_invoke_cmd() (return from __thread_enter_user_mode).
563 	 * The sp_enter() function copies the FF-A parameters (a0-a7) from the
564 	 * saved registers to the thread_smc_args. The thread_smc_args object is
565 	 * afterward used by the spmc_sp_msg_handler() to handle the
566 	 * FF-A message send by the SP.
567 	 */
568 	return false;
569 }
570 
571 /*
572  * Note: this variable is weak just to ease breaking its dependency chain
573  * when added to the unpaged area.
574  */
575 const struct ts_ops sp_ops __weak __relrodata_unpaged("sp_ops") = {
576 	.enter_invoke_cmd = sp_enter_invoke_cmd,
577 	.handle_svc = sp_handle_svc,
578 };
579 
580 static TEE_Result sp_init_all(void)
581 {
582 	TEE_Result res = TEE_SUCCESS;
583 	const struct sp_image *sp = NULL;
584 	char __maybe_unused msg[60] = { '\0', };
585 
586 	for_each_secure_partition(sp) {
587 		if (sp->image.uncompressed_size)
588 			snprintf(msg, sizeof(msg),
589 				 " (compressed, uncompressed %u)",
590 				 sp->image.uncompressed_size);
591 		else
592 			msg[0] = '\0';
593 		DMSG("SP %pUl size %u%s", (void *)&sp->image.uuid,
594 		     sp->image.size, msg);
595 
596 		res = sp_init_uuid(&sp->image.uuid, sp->fdt);
597 
598 		if (res != TEE_SUCCESS) {
599 			EMSG("Failed initializing SP(%pUl) err:%#"PRIx32,
600 			     &sp->image.uuid, res);
601 			if (!IS_ENABLED(CFG_SP_SKIP_FAILED))
602 				panic();
603 		}
604 	}
605 
606 	return TEE_SUCCESS;
607 }
608 
609 boot_final(sp_init_all);
610 
611 static TEE_Result secure_partition_open(const TEE_UUID *uuid,
612 					struct ts_store_handle **h)
613 {
614 	return emb_ts_open(uuid, h, find_secure_partition);
615 }
616 
617 REGISTER_SP_STORE(2) = {
618 	.description = "SP store",
619 	.open = secure_partition_open,
620 	.get_size = emb_ts_get_size,
621 	.get_tag = emb_ts_get_tag,
622 	.read = emb_ts_read,
623 	.close = emb_ts_close,
624 };
625