1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2020-2021, Arm Limited. 4 */ 5 #include <bench.h> 6 #include <crypto/crypto.h> 7 #include <initcall.h> 8 #include <kernel/embedded_ts.h> 9 #include <kernel/ldelf_loader.h> 10 #include <kernel/secure_partition.h> 11 #include <kernel/spinlock.h> 12 #include <kernel/spmc_sp_handler.h> 13 #include <kernel/thread_spmc.h> 14 #include <kernel/ts_store.h> 15 #include <ldelf.h> 16 #include <mm/core_mmu.h> 17 #include <mm/fobj.h> 18 #include <mm/mobj.h> 19 #include <mm/vm.h> 20 #include <optee_ffa.h> 21 #include <stdio.h> 22 #include <string.h> 23 #include <tee_api_types.h> 24 #include <trace.h> 25 #include <types_ext.h> 26 #include <utee_defines.h> 27 #include <util.h> 28 #include <zlib.h> 29 30 #include "thread_private.h" 31 32 const struct ts_ops sp_ops; 33 34 /* List that holds all of the loaded SP's */ 35 static struct sp_sessions_head open_sp_sessions = 36 TAILQ_HEAD_INITIALIZER(open_sp_sessions); 37 38 static const struct embedded_ts *find_secure_partition(const TEE_UUID *uuid) 39 { 40 const struct embedded_ts *sp = NULL; 41 42 for_each_secure_partition(sp) { 43 if (!memcmp(&sp->uuid, uuid, sizeof(*uuid))) 44 return sp; 45 } 46 return NULL; 47 } 48 49 bool is_sp_ctx(struct ts_ctx *ctx) 50 { 51 return ctx && (ctx->ops == &sp_ops); 52 } 53 54 static void set_sp_ctx_ops(struct ts_ctx *ctx) 55 { 56 ctx->ops = &sp_ops; 57 } 58 59 TEE_Result sp_find_session_id(const TEE_UUID *uuid, uint32_t *session_id) 60 { 61 struct sp_session *s = NULL; 62 63 TAILQ_FOREACH(s, &open_sp_sessions, link) { 64 if (!memcmp(&s->ts_sess.ctx->uuid, uuid, sizeof(*uuid))) { 65 if (s->state == sp_dead) 66 return TEE_ERROR_TARGET_DEAD; 67 68 *session_id = s->endpoint_id; 69 return TEE_SUCCESS; 70 } 71 } 72 73 return TEE_ERROR_ITEM_NOT_FOUND; 74 } 75 76 struct sp_session *sp_get_session(uint32_t session_id) 77 { 78 struct sp_session *s = NULL; 79 80 TAILQ_FOREACH(s, &open_sp_sessions, link) { 81 if (s->endpoint_id == session_id) 82 return s; 83 } 84 85 return NULL; 86 } 87 88 TEE_Result sp_partition_info_get_all(struct ffa_partition_info *fpi, 89 size_t *elem_count) 90 { 91 size_t in_count = *elem_count; 92 struct sp_session *s = NULL; 93 size_t count = 0; 94 95 TAILQ_FOREACH(s, &open_sp_sessions, link) { 96 if (s->state == sp_dead) 97 continue; 98 if (count < in_count) { 99 spmc_fill_partition_entry(fpi, s->endpoint_id, 1); 100 fpi++; 101 } 102 count++; 103 } 104 105 *elem_count = count; 106 if (count > in_count) 107 return TEE_ERROR_SHORT_BUFFER; 108 109 return TEE_SUCCESS; 110 } 111 112 static void sp_init_info(struct sp_ctx *ctx, struct thread_smc_args *args) 113 { 114 struct sp_ffa_init_info *info = NULL; 115 116 /* 117 * When starting the SP for the first time a init_info struct is passed. 118 * Store the struct on the stack and store the address in x0 119 */ 120 ctx->uctx.stack_ptr -= ROUNDUP(sizeof(*info), STACK_ALIGNMENT); 121 122 info = (struct sp_ffa_init_info *)ctx->uctx.stack_ptr; 123 124 info->magic = 0; 125 info->count = 0; 126 args->a0 = (vaddr_t)info; 127 } 128 129 static uint16_t new_session_id(struct sp_sessions_head *open_sessions) 130 { 131 struct sp_session *last = NULL; 132 uint16_t id = SPMC_ENDPOINT_ID + 1; 133 134 last = TAILQ_LAST(open_sessions, sp_sessions_head); 135 if (last) 136 id = last->endpoint_id + 1; 137 138 assert(id > SPMC_ENDPOINT_ID); 139 return id; 140 } 141 142 static TEE_Result sp_create_ctx(const TEE_UUID *uuid, struct sp_session *s) 143 { 144 TEE_Result res = TEE_SUCCESS; 145 struct sp_ctx *spc = NULL; 146 147 /* Register context */ 148 spc = calloc(1, sizeof(struct sp_ctx)); 149 if (!spc) 150 return TEE_ERROR_OUT_OF_MEMORY; 151 152 spc->uctx.ts_ctx = &spc->ts_ctx; 153 spc->open_session = s; 154 s->ts_sess.ctx = &spc->ts_ctx; 155 spc->ts_ctx.uuid = *uuid; 156 157 res = vm_info_init(&spc->uctx); 158 if (res) 159 goto err; 160 161 set_sp_ctx_ops(&spc->ts_ctx); 162 163 return TEE_SUCCESS; 164 165 err: 166 free(spc); 167 return res; 168 } 169 170 static TEE_Result sp_create_session(struct sp_sessions_head *open_sessions, 171 const TEE_UUID *uuid, 172 struct sp_session **sess) 173 { 174 TEE_Result res = TEE_SUCCESS; 175 struct sp_session *s = calloc(1, sizeof(struct sp_session)); 176 177 if (!s) 178 return TEE_ERROR_OUT_OF_MEMORY; 179 180 s->endpoint_id = new_session_id(open_sessions); 181 if (!s->endpoint_id) { 182 res = TEE_ERROR_OVERFLOW; 183 goto err; 184 } 185 186 DMSG("Loading Secure Partition %pUl", (void *)uuid); 187 res = sp_create_ctx(uuid, s); 188 if (res) 189 goto err; 190 191 TAILQ_INSERT_TAIL(open_sessions, s, link); 192 *sess = s; 193 return TEE_SUCCESS; 194 195 err: 196 free(s); 197 return res; 198 } 199 200 static TEE_Result sp_init_set_registers(struct sp_ctx *ctx) 201 { 202 struct thread_ctx_regs *sp_regs = &ctx->sp_regs; 203 204 memset(sp_regs, 0, sizeof(*sp_regs)); 205 sp_regs->sp = ctx->uctx.stack_ptr; 206 sp_regs->pc = ctx->uctx.entry_func; 207 208 return TEE_SUCCESS; 209 } 210 211 static TEE_Result sp_open_session(struct sp_session **sess, 212 struct sp_sessions_head *open_sessions, 213 const TEE_UUID *uuid) 214 { 215 TEE_Result res = TEE_SUCCESS; 216 struct sp_session *s = NULL; 217 struct sp_ctx *ctx = NULL; 218 219 if (!find_secure_partition(uuid)) 220 return TEE_ERROR_ITEM_NOT_FOUND; 221 222 res = sp_create_session(open_sessions, uuid, &s); 223 if (res != TEE_SUCCESS) { 224 DMSG("sp_create_session failed %#"PRIx32, res); 225 return res; 226 } 227 228 ctx = to_sp_ctx(s->ts_sess.ctx); 229 assert(ctx); 230 if (!ctx) 231 return TEE_ERROR_TARGET_DEAD; 232 *sess = s; 233 234 ts_push_current_session(&s->ts_sess); 235 /* Load the SP using ldelf. */ 236 ldelf_load_ldelf(&ctx->uctx); 237 res = ldelf_init_with_ldelf(&s->ts_sess, &ctx->uctx); 238 239 if (res != TEE_SUCCESS) { 240 EMSG("Failed. loading SP using ldelf %#"PRIx32, res); 241 ts_pop_current_session(); 242 return TEE_ERROR_TARGET_DEAD; 243 } 244 245 /* Make the SP ready for its first run */ 246 s->state = sp_idle; 247 s->caller_id = 0; 248 sp_init_set_registers(ctx); 249 ts_pop_current_session(); 250 251 return TEE_SUCCESS; 252 } 253 254 static TEE_Result sp_init_uuid(const TEE_UUID *uuid) 255 { 256 TEE_Result res = TEE_SUCCESS; 257 struct sp_session *sess = NULL; 258 struct thread_smc_args args = { }; 259 260 res = sp_open_session(&sess, 261 &open_sp_sessions, 262 uuid); 263 if (res) 264 return res; 265 266 ts_push_current_session(&sess->ts_sess); 267 sp_init_info(to_sp_ctx(sess->ts_sess.ctx), &args); 268 ts_pop_current_session(); 269 270 if (sp_enter(&args, sess)) 271 return FFA_ABORTED; 272 273 spmc_sp_msg_handler(&args, sess); 274 275 return TEE_SUCCESS; 276 } 277 278 TEE_Result sp_enter(struct thread_smc_args *args, struct sp_session *sp) 279 { 280 TEE_Result res = FFA_OK; 281 struct sp_ctx *ctx = to_sp_ctx(sp->ts_sess.ctx); 282 283 ctx->sp_regs.x[0] = args->a0; 284 ctx->sp_regs.x[1] = args->a1; 285 ctx->sp_regs.x[2] = args->a2; 286 ctx->sp_regs.x[3] = args->a3; 287 ctx->sp_regs.x[4] = args->a4; 288 ctx->sp_regs.x[5] = args->a5; 289 ctx->sp_regs.x[6] = args->a6; 290 ctx->sp_regs.x[7] = args->a7; 291 292 res = sp->ts_sess.ctx->ops->enter_invoke_cmd(&sp->ts_sess, 0); 293 294 args->a0 = ctx->sp_regs.x[0]; 295 args->a1 = ctx->sp_regs.x[1]; 296 args->a2 = ctx->sp_regs.x[2]; 297 args->a3 = ctx->sp_regs.x[3]; 298 args->a4 = ctx->sp_regs.x[4]; 299 args->a5 = ctx->sp_regs.x[5]; 300 args->a6 = ctx->sp_regs.x[6]; 301 args->a7 = ctx->sp_regs.x[7]; 302 303 return res; 304 } 305 306 static TEE_Result sp_enter_invoke_cmd(struct ts_session *s, 307 uint32_t cmd __unused) 308 { 309 struct sp_ctx *ctx = to_sp_ctx(s->ctx); 310 TEE_Result res = TEE_SUCCESS; 311 uint32_t exceptions = 0; 312 uint64_t cpsr = 0; 313 struct sp_session *sp_s = to_sp_session(s); 314 struct ts_session *sess = NULL; 315 struct thread_ctx_regs *sp_regs = NULL; 316 uint32_t panicked = false; 317 uint32_t panic_code = 0; 318 319 bm_timestamp(); 320 321 sp_regs = &ctx->sp_regs; 322 ts_push_current_session(s); 323 324 cpsr = sp_regs->cpsr; 325 sp_regs->cpsr = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT); 326 327 exceptions = thread_mask_exceptions(THREAD_EXCP_ALL); 328 __thread_enter_user_mode(sp_regs, &panicked, &panic_code); 329 sp_regs->cpsr = cpsr; 330 thread_unmask_exceptions(exceptions); 331 332 thread_user_clear_vfp(&ctx->uctx); 333 334 if (panicked) { 335 DMSG("SP panicked with code %#"PRIx32, panic_code); 336 abort_print_current_ts(); 337 338 sess = ts_pop_current_session(); 339 cpu_spin_lock(&sp_s->spinlock); 340 sp_s->state = sp_dead; 341 cpu_spin_unlock(&sp_s->spinlock); 342 343 return TEE_ERROR_TARGET_DEAD; 344 } 345 346 sess = ts_pop_current_session(); 347 assert(sess == s); 348 349 bm_timestamp(); 350 351 return res; 352 } 353 354 /* We currently don't support 32 bits */ 355 #ifdef ARM64 356 static void sp_svc_store_registers(struct thread_svc_regs *regs, 357 struct thread_ctx_regs *sp_regs) 358 { 359 COMPILE_TIME_ASSERT(sizeof(sp_regs->x[0]) == sizeof(regs->x0)); 360 memcpy(sp_regs->x, ®s->x0, 31 * sizeof(regs->x0)); 361 sp_regs->pc = regs->elr; 362 sp_regs->sp = regs->sp_el0; 363 } 364 #endif 365 366 static bool sp_handle_svc(struct thread_svc_regs *regs) 367 { 368 struct ts_session *ts = ts_get_current_session(); 369 struct sp_ctx *uctx = to_sp_ctx(ts->ctx); 370 struct sp_session *s = uctx->open_session; 371 372 assert(s); 373 374 sp_svc_store_registers(regs, &uctx->sp_regs); 375 376 regs->x0 = 0; 377 regs->x1 = 0; /* panic */ 378 regs->x2 = 0; /* panic code */ 379 380 /* 381 * All the registers of the SP are saved in the SP session by the SVC 382 * handler. 383 * We always return to S-El1 after handling the SVC. We will continue 384 * in sp_enter_invoke_cmd() (return from __thread_enter_user_mode). 385 * The sp_enter() function copies the FF-A parameters (a0-a7) from the 386 * saved registers to the thread_smc_args. The thread_smc_args object is 387 * afterward used by the spmc_sp_msg_handler() to handle the 388 * FF-A message send by the SP. 389 */ 390 return false; 391 } 392 393 /* 394 * Note: this variable is weak just to ease breaking its dependency chain 395 * when added to the unpaged area. 396 */ 397 const struct ts_ops sp_ops __weak __rodata_unpaged("sp_ops") = { 398 .enter_invoke_cmd = sp_enter_invoke_cmd, 399 .handle_svc = sp_handle_svc, 400 }; 401 402 static TEE_Result sp_init_all(void) 403 { 404 TEE_Result res = TEE_SUCCESS; 405 const struct embedded_ts *sp = NULL; 406 char __maybe_unused msg[60] = { '\0', }; 407 408 for_each_secure_partition(sp) { 409 if (sp->uncompressed_size) 410 snprintf(msg, sizeof(msg), 411 " (compressed, uncompressed %u)", 412 sp->uncompressed_size); 413 else 414 msg[0] = '\0'; 415 DMSG("SP %pUl size %u%s", (void *)&sp->uuid, sp->size, msg); 416 417 res = sp_init_uuid(&sp->uuid); 418 419 if (res != TEE_SUCCESS) { 420 EMSG("Failed initializing SP(%pUl) err:%#"PRIx32, 421 &sp->uuid, res); 422 if (!IS_ENABLED(CFG_SP_SKIP_FAILED)) 423 panic(); 424 } 425 } 426 427 return TEE_SUCCESS; 428 } 429 430 boot_final(sp_init_all); 431 432 static TEE_Result secure_partition_open(const TEE_UUID *uuid, 433 struct ts_store_handle **h) 434 { 435 return emb_ts_open(uuid, h, find_secure_partition); 436 } 437 438 REGISTER_SP_STORE(2) = { 439 .description = "SP store", 440 .open = secure_partition_open, 441 .get_size = emb_ts_get_size, 442 .get_tag = emb_ts_get_tag, 443 .read = emb_ts_read, 444 .close = emb_ts_close, 445 }; 446