1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2020-2022, Arm Limited. 4 */ 5 #include <bench.h> 6 #include <crypto/crypto.h> 7 #include <initcall.h> 8 #include <kernel/embedded_ts.h> 9 #include <kernel/ldelf_loader.h> 10 #include <kernel/secure_partition.h> 11 #include <kernel/spinlock.h> 12 #include <kernel/spmc_sp_handler.h> 13 #include <kernel/thread_private.h> 14 #include <kernel/thread_spmc.h> 15 #include <kernel/tpm.h> 16 #include <kernel/ts_store.h> 17 #include <ldelf.h> 18 #include <libfdt.h> 19 #include <mm/core_mmu.h> 20 #include <mm/fobj.h> 21 #include <mm/mobj.h> 22 #include <mm/vm.h> 23 #include <optee_ffa.h> 24 #include <stdio.h> 25 #include <string.h> 26 #include <tee_api_types.h> 27 #include <tee/uuid.h> 28 #include <trace.h> 29 #include <types_ext.h> 30 #include <utee_defines.h> 31 #include <util.h> 32 #include <zlib.h> 33 34 #define SP_MANIFEST_ATTR_READ BIT(0) 35 #define SP_MANIFEST_ATTR_WRITE BIT(1) 36 #define SP_MANIFEST_ATTR_EXEC BIT(2) 37 #define SP_MANIFEST_ATTR_NSEC BIT(3) 38 39 #define SP_MANIFEST_ATTR_RO (SP_MANIFEST_ATTR_READ) 40 #define SP_MANIFEST_ATTR_RW (SP_MANIFEST_ATTR_READ | \ 41 SP_MANIFEST_ATTR_WRITE) 42 #define SP_MANIFEST_ATTR_RX (SP_MANIFEST_ATTR_READ | \ 43 SP_MANIFEST_ATTR_EXEC) 44 #define SP_MANIFEST_ATTR_RWX (SP_MANIFEST_ATTR_READ | \ 45 SP_MANIFEST_ATTR_WRITE | \ 46 SP_MANIFEST_ATTR_EXEC) 47 48 const struct ts_ops sp_ops; 49 50 /* List that holds all of the loaded SP's */ 51 static struct sp_sessions_head open_sp_sessions = 52 TAILQ_HEAD_INITIALIZER(open_sp_sessions); 53 54 static const struct embedded_ts *find_secure_partition(const TEE_UUID *uuid) 55 { 56 const struct sp_image *sp = NULL; 57 58 for_each_secure_partition(sp) { 59 if (!memcmp(&sp->image.uuid, uuid, sizeof(*uuid))) 60 return &sp->image; 61 } 62 return NULL; 63 } 64 65 bool is_sp_ctx(struct ts_ctx *ctx) 66 { 67 return ctx && (ctx->ops == &sp_ops); 68 } 69 70 static void set_sp_ctx_ops(struct ts_ctx *ctx) 71 { 72 ctx->ops = &sp_ops; 73 } 74 75 TEE_Result sp_find_session_id(const TEE_UUID *uuid, uint32_t *session_id) 76 { 77 struct sp_session *s = NULL; 78 79 TAILQ_FOREACH(s, &open_sp_sessions, link) { 80 if (!memcmp(&s->ts_sess.ctx->uuid, uuid, sizeof(*uuid))) { 81 if (s->state == sp_dead) 82 return TEE_ERROR_TARGET_DEAD; 83 84 *session_id = s->endpoint_id; 85 return TEE_SUCCESS; 86 } 87 } 88 89 return TEE_ERROR_ITEM_NOT_FOUND; 90 } 91 92 struct sp_session *sp_get_session(uint32_t session_id) 93 { 94 struct sp_session *s = NULL; 95 96 TAILQ_FOREACH(s, &open_sp_sessions, link) { 97 if (s->endpoint_id == session_id) 98 return s; 99 } 100 101 return NULL; 102 } 103 104 TEE_Result sp_partition_info_get_all(struct ffa_partition_info *fpi, 105 size_t *elem_count) 106 { 107 size_t in_count = *elem_count; 108 struct sp_session *s = NULL; 109 size_t count = 0; 110 111 TAILQ_FOREACH(s, &open_sp_sessions, link) { 112 if (s->state == sp_dead) 113 continue; 114 if (count < in_count) { 115 spmc_fill_partition_entry(fpi, s->endpoint_id, 1); 116 fpi++; 117 } 118 count++; 119 } 120 121 *elem_count = count; 122 if (count > in_count) 123 return TEE_ERROR_SHORT_BUFFER; 124 125 return TEE_SUCCESS; 126 } 127 128 bool sp_has_exclusive_access(struct sp_mem_map_region *mem, 129 struct user_mode_ctx *uctx) 130 { 131 /* 132 * Check that we have access to the region if it is supposed to be 133 * mapped to the current context. 134 */ 135 if (uctx) { 136 struct vm_region *region = NULL; 137 138 /* Make sure that each mobj belongs to the SP */ 139 TAILQ_FOREACH(region, &uctx->vm_info.regions, link) { 140 if (region->mobj == mem->mobj) 141 break; 142 } 143 144 if (!region) 145 return false; 146 } 147 148 /* Check that it is not shared with another SP */ 149 return !sp_mem_is_shared(mem); 150 } 151 152 static uint16_t new_session_id(struct sp_sessions_head *open_sessions) 153 { 154 struct sp_session *last = NULL; 155 uint16_t id = SPMC_ENDPOINT_ID + 1; 156 157 last = TAILQ_LAST(open_sessions, sp_sessions_head); 158 if (last) 159 id = last->endpoint_id + 1; 160 161 assert(id > SPMC_ENDPOINT_ID); 162 return id; 163 } 164 165 static TEE_Result sp_create_ctx(const TEE_UUID *uuid, struct sp_session *s) 166 { 167 TEE_Result res = TEE_SUCCESS; 168 struct sp_ctx *spc = NULL; 169 170 /* Register context */ 171 spc = calloc(1, sizeof(struct sp_ctx)); 172 if (!spc) 173 return TEE_ERROR_OUT_OF_MEMORY; 174 175 spc->uctx.ts_ctx = &spc->ts_ctx; 176 spc->open_session = s; 177 s->ts_sess.ctx = &spc->ts_ctx; 178 spc->ts_ctx.uuid = *uuid; 179 180 res = vm_info_init(&spc->uctx); 181 if (res) 182 goto err; 183 184 set_sp_ctx_ops(&spc->ts_ctx); 185 186 return TEE_SUCCESS; 187 188 err: 189 free(spc); 190 return res; 191 } 192 193 static TEE_Result sp_create_session(struct sp_sessions_head *open_sessions, 194 const TEE_UUID *uuid, 195 struct sp_session **sess) 196 { 197 TEE_Result res = TEE_SUCCESS; 198 struct sp_session *s = calloc(1, sizeof(struct sp_session)); 199 200 if (!s) 201 return TEE_ERROR_OUT_OF_MEMORY; 202 203 s->endpoint_id = new_session_id(open_sessions); 204 if (!s->endpoint_id) { 205 res = TEE_ERROR_OVERFLOW; 206 goto err; 207 } 208 209 DMSG("Loading Secure Partition %pUl", (void *)uuid); 210 res = sp_create_ctx(uuid, s); 211 if (res) 212 goto err; 213 214 TAILQ_INSERT_TAIL(open_sessions, s, link); 215 *sess = s; 216 return TEE_SUCCESS; 217 218 err: 219 free(s); 220 return res; 221 } 222 223 static TEE_Result sp_init_set_registers(struct sp_ctx *ctx) 224 { 225 struct thread_ctx_regs *sp_regs = &ctx->sp_regs; 226 227 memset(sp_regs, 0, sizeof(*sp_regs)); 228 sp_regs->sp = ctx->uctx.stack_ptr; 229 sp_regs->pc = ctx->uctx.entry_func; 230 231 return TEE_SUCCESS; 232 } 233 234 TEE_Result sp_map_shared(struct sp_session *s, 235 struct sp_mem_receiver *receiver, 236 struct sp_mem *smem, 237 uint64_t *va) 238 { 239 TEE_Result res = TEE_SUCCESS; 240 struct sp_ctx *ctx = NULL; 241 uint32_t perm = TEE_MATTR_UR; 242 struct sp_mem_map_region *reg = NULL; 243 244 ctx = to_sp_ctx(s->ts_sess.ctx); 245 246 /* Get the permission */ 247 if (receiver->perm.perm & FFA_MEM_ACC_EXE) 248 perm |= TEE_MATTR_UX; 249 250 if (receiver->perm.perm & FFA_MEM_ACC_RW) { 251 if (receiver->perm.perm & FFA_MEM_ACC_EXE) 252 return TEE_ERROR_ACCESS_CONFLICT; 253 254 perm |= TEE_MATTR_UW; 255 } 256 /* 257 * Currently we don't support passing a va. We can't guarantee that the 258 * full region will be mapped in a contiguous region. A smem->region can 259 * have multiple mobj for one share. Currently there doesn't seem to be 260 * an option to guarantee that these will be mapped in a contiguous va 261 * space. 262 */ 263 if (*va) 264 return TEE_ERROR_NOT_SUPPORTED; 265 266 SLIST_FOREACH(reg, &smem->regions, link) { 267 res = vm_map(&ctx->uctx, va, reg->page_count * SMALL_PAGE_SIZE, 268 perm, 0, reg->mobj, reg->page_offset); 269 270 if (res != TEE_SUCCESS) { 271 EMSG("Failed to map memory region %#"PRIx32, res); 272 return res; 273 } 274 } 275 return TEE_SUCCESS; 276 } 277 278 TEE_Result sp_unmap_ffa_regions(struct sp_session *s, struct sp_mem *smem) 279 { 280 TEE_Result res = TEE_SUCCESS; 281 vaddr_t vaddr = 0; 282 size_t len = 0; 283 struct sp_ctx *ctx = to_sp_ctx(s->ts_sess.ctx); 284 struct sp_mem_map_region *reg = NULL; 285 286 SLIST_FOREACH(reg, &smem->regions, link) { 287 vaddr = (vaddr_t)sp_mem_get_va(&ctx->uctx, reg->page_offset, 288 reg->mobj); 289 len = reg->page_count * SMALL_PAGE_SIZE; 290 291 res = vm_unmap(&ctx->uctx, vaddr, len); 292 if (res != TEE_SUCCESS) 293 return res; 294 } 295 296 return TEE_SUCCESS; 297 } 298 299 static TEE_Result sp_open_session(struct sp_session **sess, 300 struct sp_sessions_head *open_sessions, 301 const TEE_UUID *uuid) 302 { 303 TEE_Result res = TEE_SUCCESS; 304 struct sp_session *s = NULL; 305 struct sp_ctx *ctx = NULL; 306 307 if (!find_secure_partition(uuid)) 308 return TEE_ERROR_ITEM_NOT_FOUND; 309 310 res = sp_create_session(open_sessions, uuid, &s); 311 if (res != TEE_SUCCESS) { 312 DMSG("sp_create_session failed %#"PRIx32, res); 313 return res; 314 } 315 316 ctx = to_sp_ctx(s->ts_sess.ctx); 317 assert(ctx); 318 if (!ctx) 319 return TEE_ERROR_TARGET_DEAD; 320 *sess = s; 321 322 ts_push_current_session(&s->ts_sess); 323 /* Load the SP using ldelf. */ 324 ldelf_load_ldelf(&ctx->uctx); 325 res = ldelf_init_with_ldelf(&s->ts_sess, &ctx->uctx); 326 327 if (res != TEE_SUCCESS) { 328 EMSG("Failed. loading SP using ldelf %#"PRIx32, res); 329 ts_pop_current_session(); 330 return TEE_ERROR_TARGET_DEAD; 331 } 332 333 /* Make the SP ready for its first run */ 334 s->state = sp_idle; 335 s->caller_id = 0; 336 sp_init_set_registers(ctx); 337 ts_pop_current_session(); 338 339 return TEE_SUCCESS; 340 } 341 342 static TEE_Result sp_dt_get_u64(const void *fdt, int node, const char *property, 343 uint64_t *value) 344 { 345 const fdt64_t *p = NULL; 346 int len = 0; 347 348 p = fdt_getprop(fdt, node, property, &len); 349 if (!p || len != sizeof(*p)) 350 return TEE_ERROR_ITEM_NOT_FOUND; 351 352 *value = fdt64_ld(p); 353 354 return TEE_SUCCESS; 355 } 356 357 static TEE_Result sp_dt_get_u32(const void *fdt, int node, const char *property, 358 uint32_t *value) 359 { 360 const fdt32_t *p = NULL; 361 int len = 0; 362 363 p = fdt_getprop(fdt, node, property, &len); 364 if (!p || len != sizeof(*p)) 365 return TEE_ERROR_ITEM_NOT_FOUND; 366 367 *value = fdt32_to_cpu(*p); 368 369 return TEE_SUCCESS; 370 } 371 372 static TEE_Result sp_dt_get_uuid(const void *fdt, int node, 373 const char *property, TEE_UUID *uuid) 374 { 375 uint32_t uuid_array[4] = { 0 }; 376 const fdt32_t *p = NULL; 377 int len = 0; 378 int i = 0; 379 380 p = fdt_getprop(fdt, node, property, &len); 381 if (!p || len != sizeof(TEE_UUID)) 382 return TEE_ERROR_ITEM_NOT_FOUND; 383 384 for (i = 0; i < 4; i++) 385 uuid_array[i] = fdt32_to_cpu(p[i]); 386 387 tee_uuid_from_octets(uuid, (uint8_t *)uuid_array); 388 389 return TEE_SUCCESS; 390 } 391 392 static TEE_Result check_fdt(const void * const fdt, const TEE_UUID *uuid) 393 { 394 const struct fdt_property *description = NULL; 395 int description_name_len = 0; 396 TEE_UUID fdt_uuid = { }; 397 398 if (fdt_node_check_compatible(fdt, 0, "arm,ffa-manifest-1.0")) { 399 EMSG("Failed loading SP, manifest not found"); 400 return TEE_ERROR_BAD_PARAMETERS; 401 } 402 403 description = fdt_get_property(fdt, 0, "description", 404 &description_name_len); 405 if (description) 406 DMSG("Loading SP: %s", description->data); 407 408 if (sp_dt_get_uuid(fdt, 0, "uuid", &fdt_uuid)) { 409 EMSG("Missing or invalid UUID in SP manifest"); 410 return TEE_ERROR_BAD_FORMAT; 411 } 412 413 if (memcmp(uuid, &fdt_uuid, sizeof(fdt_uuid))) { 414 EMSG("Failed loading SP, UUID mismatch"); 415 return TEE_ERROR_BAD_FORMAT; 416 } 417 418 return TEE_SUCCESS; 419 } 420 421 /* 422 * sp_init_info allocates and maps the sp_ffa_init_info for the SP. It will copy 423 * the fdt into the allocated page(s) and return a pointer to the new location 424 * of the fdt. This pointer can be used to update data inside the fdt. 425 */ 426 static TEE_Result sp_init_info(struct sp_ctx *ctx, struct thread_smc_args *args, 427 const void * const input_fdt, vaddr_t *va, 428 size_t *num_pgs, void **fdt_copy) 429 { 430 struct sp_ffa_init_info *info = NULL; 431 int nvp_count = 1; 432 size_t total_size = ROUNDUP(CFG_SP_INIT_INFO_MAX_SIZE, SMALL_PAGE_SIZE); 433 size_t nvp_size = sizeof(struct sp_name_value_pair) * nvp_count; 434 size_t info_size = sizeof(*info) + nvp_size; 435 size_t fdt_size = total_size - info_size; 436 TEE_Result res = TEE_SUCCESS; 437 uint32_t perm = TEE_MATTR_URW | TEE_MATTR_PRW; 438 struct fobj *f = NULL; 439 struct mobj *m = NULL; 440 static const char fdt_name[16] = "TYPE_DT\0\0\0\0\0\0\0\0"; 441 442 *num_pgs = total_size / SMALL_PAGE_SIZE; 443 444 f = fobj_sec_mem_alloc(*num_pgs); 445 m = mobj_with_fobj_alloc(f, NULL, TEE_MATTR_MEM_TYPE_TAGGED); 446 447 fobj_put(f); 448 if (!m) 449 return TEE_ERROR_OUT_OF_MEMORY; 450 451 res = vm_map(&ctx->uctx, va, total_size, perm, 0, m, 0); 452 mobj_put(m); 453 if (res) 454 return res; 455 456 info = (struct sp_ffa_init_info *)*va; 457 458 /* magic field is 4 bytes, we don't copy /0 byte. */ 459 memcpy(&info->magic, "FF-A", 4); 460 info->count = nvp_count; 461 args->a0 = (vaddr_t)info; 462 463 /* 464 * Store the fdt after the boot_info and store the pointer in the 465 * first element. 466 */ 467 COMPILE_TIME_ASSERT(sizeof(info->nvp[0].name) == sizeof(fdt_name)); 468 memcpy(info->nvp[0].name, fdt_name, sizeof(fdt_name)); 469 info->nvp[0].value = *va + info_size; 470 info->nvp[0].size = fdt_size; 471 *fdt_copy = (void *)info->nvp[0].value; 472 473 if (fdt_open_into(input_fdt, *fdt_copy, fdt_size)) 474 return TEE_ERROR_GENERIC; 475 476 return TEE_SUCCESS; 477 } 478 479 static TEE_Result handle_fdt_dev_regions(struct sp_ctx *ctx, void *fdt) 480 { 481 int node = 0; 482 int subnode = 0; 483 TEE_Result res = TEE_SUCCESS; 484 const char *dt_device_match_table = { 485 "arm,ffa-manifest-device-regions", 486 }; 487 488 /* 489 * Device regions are optional in the SP manifest, it's not an error if 490 * we don't find any 491 */ 492 node = fdt_node_offset_by_compatible(fdt, 0, dt_device_match_table); 493 if (node < 0) 494 return TEE_SUCCESS; 495 496 fdt_for_each_subnode(subnode, fdt, node) { 497 uint64_t base_addr = 0; 498 uint32_t pages_cnt = 0; 499 uint32_t attributes = 0; 500 struct mobj *m = NULL; 501 bool is_secure = true; 502 uint32_t perm = 0; 503 vaddr_t va = 0; 504 unsigned int idx = 0; 505 506 /* 507 * Physical base address of a device MMIO region. 508 * Currently only physically contiguous region is supported. 509 */ 510 if (sp_dt_get_u64(fdt, subnode, "base-address", &base_addr)) { 511 EMSG("Mandatory field is missing: base-address"); 512 return TEE_ERROR_BAD_FORMAT; 513 } 514 515 /* Total size of MMIO region as count of 4K pages */ 516 if (sp_dt_get_u32(fdt, subnode, "pages-count", &pages_cnt)) { 517 EMSG("Mandatory field is missing: pages-count"); 518 return TEE_ERROR_BAD_FORMAT; 519 } 520 521 /* Data access, instruction access and security attributes */ 522 if (sp_dt_get_u32(fdt, subnode, "attributes", &attributes)) { 523 EMSG("Mandatory field is missing: attributes"); 524 return TEE_ERROR_BAD_FORMAT; 525 } 526 527 /* Check instruction and data access permissions */ 528 switch (attributes & SP_MANIFEST_ATTR_RWX) { 529 case SP_MANIFEST_ATTR_RO: 530 perm = TEE_MATTR_UR; 531 break; 532 case SP_MANIFEST_ATTR_RW: 533 perm = TEE_MATTR_URW; 534 break; 535 default: 536 EMSG("Invalid memory access permissions"); 537 return TEE_ERROR_BAD_FORMAT; 538 } 539 540 /* 541 * The SP is a secure endpoint, security attribute can be 542 * secure or non-secure 543 */ 544 if (attributes & SP_MANIFEST_ATTR_NSEC) 545 is_secure = false; 546 547 /* Memory attributes must be Device-nGnRnE */ 548 m = sp_mem_new_mobj(pages_cnt, TEE_MATTR_MEM_TYPE_STRONGLY_O, 549 is_secure); 550 if (!m) 551 return TEE_ERROR_OUT_OF_MEMORY; 552 553 res = sp_mem_add_pages(m, &idx, (paddr_t)base_addr, pages_cnt); 554 if (res) { 555 mobj_put(m); 556 return res; 557 } 558 559 res = vm_map(&ctx->uctx, &va, pages_cnt * SMALL_PAGE_SIZE, 560 perm, 0, m, 0); 561 mobj_put(m); 562 if (res) 563 return res; 564 565 /* 566 * Overwrite the device region's PA in the fdt with the VA. This 567 * fdt will be passed to the SP. 568 */ 569 res = fdt_setprop_u64(fdt, subnode, "base-address", va); 570 571 /* 572 * Unmap the region if the overwrite failed since the SP won't 573 * be able to access it without knowing the VA. 574 */ 575 if (res) { 576 vm_unmap(&ctx->uctx, va, pages_cnt * SMALL_PAGE_SIZE); 577 return res; 578 } 579 } 580 581 return TEE_SUCCESS; 582 } 583 584 static TEE_Result handle_fdt_mem_regions(struct sp_ctx *ctx, void *fdt) 585 { 586 int node = 0; 587 int subnode = 0; 588 tee_mm_entry_t *mm = NULL; 589 TEE_Result res = TEE_SUCCESS; 590 591 /* 592 * Memory regions are optional in the SP manifest, it's not an error if 593 * we don't find any. 594 */ 595 node = fdt_node_offset_by_compatible(fdt, 0, 596 "arm,ffa-manifest-memory-regions"); 597 if (node < 0) 598 return TEE_SUCCESS; 599 600 fdt_for_each_subnode(subnode, fdt, node) { 601 bool alloc_needed = false; 602 uint32_t attributes = 0; 603 uint64_t base_addr = 0; 604 uint32_t pages_cnt = 0; 605 bool is_secure = true; 606 struct mobj *m = NULL; 607 unsigned int idx = 0; 608 uint32_t perm = 0; 609 size_t size = 0; 610 vaddr_t va = 0; 611 612 mm = NULL; 613 614 /* 615 * Base address of a memory region. 616 * If not present, we have to allocate the specified memory. 617 * If present, this field could specify a PA or VA. Currently 618 * only a PA is supported. 619 */ 620 if (sp_dt_get_u64(fdt, subnode, "base-address", &base_addr)) 621 alloc_needed = true; 622 623 /* Size of memory region as count of 4K pages */ 624 if (sp_dt_get_u32(fdt, subnode, "pages-count", &pages_cnt)) { 625 EMSG("Mandatory field is missing: pages-count"); 626 return TEE_ERROR_BAD_FORMAT; 627 } 628 629 if (MUL_OVERFLOW(pages_cnt, SMALL_PAGE_SIZE, &size)) 630 return TEE_ERROR_OVERFLOW; 631 632 /* 633 * Memory region attributes: 634 * - Instruction/data access permissions 635 * - Cacheability/shareability attributes 636 * - Security attributes 637 * 638 * Cacheability/shareability attributes can be ignored for now. 639 * OP-TEE only supports a single type for normal cached memory 640 * and currently there is no use case that would require to 641 * change this. 642 */ 643 if (sp_dt_get_u32(fdt, subnode, "attributes", &attributes)) { 644 EMSG("Mandatory field is missing: attributes"); 645 return TEE_ERROR_BAD_FORMAT; 646 } 647 648 /* Check instruction and data access permissions */ 649 switch (attributes & SP_MANIFEST_ATTR_RWX) { 650 case SP_MANIFEST_ATTR_RO: 651 perm = TEE_MATTR_UR; 652 break; 653 case SP_MANIFEST_ATTR_RW: 654 perm = TEE_MATTR_URW; 655 break; 656 case SP_MANIFEST_ATTR_RX: 657 perm = TEE_MATTR_URX; 658 break; 659 default: 660 EMSG("Invalid memory access permissions"); 661 return TEE_ERROR_BAD_FORMAT; 662 } 663 664 /* 665 * The SP is a secure endpoint, security attribute can be 666 * secure or non-secure. 667 * The SPMC cannot allocate non-secure memory, i.e. if the base 668 * address is missing this attribute must be secure. 669 */ 670 if (attributes & SP_MANIFEST_ATTR_NSEC) { 671 if (alloc_needed) { 672 EMSG("Invalid memory security attribute"); 673 return TEE_ERROR_BAD_FORMAT; 674 } 675 is_secure = false; 676 } 677 678 if (alloc_needed) { 679 /* Base address is missing, we have to allocate */ 680 mm = tee_mm_alloc(&tee_mm_sec_ddr, size); 681 if (!mm) 682 return TEE_ERROR_OUT_OF_MEMORY; 683 684 base_addr = tee_mm_get_smem(mm); 685 } 686 687 m = sp_mem_new_mobj(pages_cnt, TEE_MATTR_MEM_TYPE_CACHED, 688 is_secure); 689 if (!m) { 690 res = TEE_ERROR_OUT_OF_MEMORY; 691 goto err_mm_free; 692 } 693 694 res = sp_mem_add_pages(m, &idx, base_addr, pages_cnt); 695 if (res) { 696 mobj_put(m); 697 goto err_mm_free; 698 } 699 700 res = vm_map(&ctx->uctx, &va, size, perm, 0, m, 0); 701 mobj_put(m); 702 if (res) 703 goto err_mm_free; 704 705 /* 706 * Overwrite the memory region's base address in the fdt with 707 * the VA. This fdt will be passed to the SP. 708 * If the base-address field was not present in the original 709 * fdt, this function will create it. This doesn't cause issues 710 * since the necessary extra space has been allocated when 711 * opening the fdt. 712 */ 713 res = fdt_setprop_u64(fdt, subnode, "base-address", va); 714 715 /* 716 * Unmap the region if the overwrite failed since the SP won't 717 * be able to access it without knowing the VA. 718 */ 719 if (res) { 720 vm_unmap(&ctx->uctx, va, size); 721 goto err_mm_free; 722 } 723 } 724 725 return TEE_SUCCESS; 726 727 err_mm_free: 728 tee_mm_free(mm); 729 return res; 730 } 731 732 static TEE_Result handle_tpm_event_log(struct sp_ctx *ctx, void *fdt) 733 { 734 uint32_t perm = TEE_MATTR_URW | TEE_MATTR_PRW; 735 uint32_t dummy_size __maybe_unused = 0; 736 TEE_Result res = TEE_SUCCESS; 737 size_t page_count = 0; 738 struct fobj *f = NULL; 739 struct mobj *m = NULL; 740 vaddr_t log_addr = 0; 741 size_t log_size = 0; 742 int node = 0; 743 744 node = fdt_node_offset_by_compatible(fdt, 0, "arm,tpm_event_log"); 745 if (node < 0) 746 return TEE_SUCCESS; 747 748 /* Checking the existence and size of the event log properties */ 749 if (sp_dt_get_u64(fdt, node, "tpm_event_log_addr", &log_addr)) { 750 EMSG("tpm_event_log_addr not found or has invalid size"); 751 return TEE_ERROR_BAD_FORMAT; 752 } 753 754 if (sp_dt_get_u32(fdt, node, "tpm_event_log_size", &dummy_size)) { 755 EMSG("tpm_event_log_size not found or has invalid size"); 756 return TEE_ERROR_BAD_FORMAT; 757 } 758 759 /* Validating event log */ 760 res = tpm_get_event_log_size(&log_size); 761 if (res) 762 return res; 763 764 if (!log_size) { 765 EMSG("Empty TPM event log was provided"); 766 return TEE_ERROR_ITEM_NOT_FOUND; 767 } 768 769 /* Allocating memory area for the event log to share with the SP */ 770 page_count = ROUNDUP_DIV(log_size, SMALL_PAGE_SIZE); 771 772 f = fobj_sec_mem_alloc(page_count); 773 m = mobj_with_fobj_alloc(f, NULL, TEE_MATTR_MEM_TYPE_TAGGED); 774 fobj_put(f); 775 if (!m) 776 return TEE_ERROR_OUT_OF_MEMORY; 777 778 res = vm_map(&ctx->uctx, &log_addr, log_size, perm, 0, m, 0); 779 mobj_put(m); 780 if (res) 781 return res; 782 783 /* Copy event log */ 784 res = tpm_get_event_log((void *)log_addr, &log_size); 785 if (res) 786 goto err_unmap; 787 788 /* Setting event log details in the manifest */ 789 res = fdt_setprop_u64(fdt, node, "tpm_event_log_addr", log_addr); 790 if (res) 791 goto err_unmap; 792 793 res = fdt_setprop_u32(fdt, node, "tpm_event_log_size", log_size); 794 if (res) 795 goto err_unmap; 796 797 return TEE_SUCCESS; 798 799 err_unmap: 800 vm_unmap(&ctx->uctx, log_addr, log_size); 801 802 return res; 803 } 804 805 static TEE_Result sp_init_uuid(const TEE_UUID *uuid, const void * const fdt) 806 { 807 TEE_Result res = TEE_SUCCESS; 808 struct sp_session *sess = NULL; 809 struct thread_smc_args args = { }; 810 vaddr_t va = 0; 811 size_t num_pgs = 0; 812 struct sp_ctx *ctx = NULL; 813 void *fdt_copy = NULL; 814 815 res = sp_open_session(&sess, 816 &open_sp_sessions, 817 uuid); 818 if (res) 819 return res; 820 821 res = check_fdt(fdt, uuid); 822 if (res) 823 return res; 824 825 ctx = to_sp_ctx(sess->ts_sess.ctx); 826 ts_push_current_session(&sess->ts_sess); 827 828 res = sp_init_info(ctx, &args, fdt, &va, &num_pgs, &fdt_copy); 829 if (res) 830 goto out; 831 832 res = handle_fdt_dev_regions(ctx, fdt_copy); 833 if (res) 834 goto out; 835 836 res = handle_fdt_mem_regions(ctx, fdt_copy); 837 if (res) 838 goto out; 839 840 if (IS_ENABLED(CFG_CORE_TPM_EVENT_LOG)) { 841 res = handle_tpm_event_log(ctx, fdt_copy); 842 if (res) 843 goto out; 844 } 845 846 ts_pop_current_session(); 847 848 if (sp_enter(&args, sess)) { 849 vm_unmap(&ctx->uctx, va, num_pgs); 850 return FFA_ABORTED; 851 } 852 853 spmc_sp_msg_handler(&args, sess); 854 855 ts_push_current_session(&sess->ts_sess); 856 out: 857 /* Free the boot info page from the SP memory */ 858 vm_unmap(&ctx->uctx, va, num_pgs); 859 ts_pop_current_session(); 860 861 return res; 862 } 863 864 TEE_Result sp_enter(struct thread_smc_args *args, struct sp_session *sp) 865 { 866 TEE_Result res = FFA_OK; 867 struct sp_ctx *ctx = to_sp_ctx(sp->ts_sess.ctx); 868 869 ctx->sp_regs.x[0] = args->a0; 870 ctx->sp_regs.x[1] = args->a1; 871 ctx->sp_regs.x[2] = args->a2; 872 ctx->sp_regs.x[3] = args->a3; 873 ctx->sp_regs.x[4] = args->a4; 874 ctx->sp_regs.x[5] = args->a5; 875 ctx->sp_regs.x[6] = args->a6; 876 ctx->sp_regs.x[7] = args->a7; 877 878 res = sp->ts_sess.ctx->ops->enter_invoke_cmd(&sp->ts_sess, 0); 879 880 args->a0 = ctx->sp_regs.x[0]; 881 args->a1 = ctx->sp_regs.x[1]; 882 args->a2 = ctx->sp_regs.x[2]; 883 args->a3 = ctx->sp_regs.x[3]; 884 args->a4 = ctx->sp_regs.x[4]; 885 args->a5 = ctx->sp_regs.x[5]; 886 args->a6 = ctx->sp_regs.x[6]; 887 args->a7 = ctx->sp_regs.x[7]; 888 889 return res; 890 } 891 892 static TEE_Result sp_enter_invoke_cmd(struct ts_session *s, 893 uint32_t cmd __unused) 894 { 895 struct sp_ctx *ctx = to_sp_ctx(s->ctx); 896 TEE_Result res = TEE_SUCCESS; 897 uint32_t exceptions = 0; 898 uint64_t cpsr = 0; 899 struct sp_session *sp_s = to_sp_session(s); 900 struct ts_session *sess = NULL; 901 struct thread_ctx_regs *sp_regs = NULL; 902 uint32_t panicked = false; 903 uint32_t panic_code = 0; 904 905 bm_timestamp(); 906 907 sp_regs = &ctx->sp_regs; 908 ts_push_current_session(s); 909 910 cpsr = sp_regs->cpsr; 911 sp_regs->cpsr = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT); 912 913 exceptions = thread_mask_exceptions(THREAD_EXCP_ALL); 914 __thread_enter_user_mode(sp_regs, &panicked, &panic_code); 915 sp_regs->cpsr = cpsr; 916 thread_unmask_exceptions(exceptions); 917 918 thread_user_clear_vfp(&ctx->uctx); 919 920 if (panicked) { 921 DMSG("SP panicked with code %#"PRIx32, panic_code); 922 abort_print_current_ts(); 923 924 sess = ts_pop_current_session(); 925 cpu_spin_lock(&sp_s->spinlock); 926 sp_s->state = sp_dead; 927 cpu_spin_unlock(&sp_s->spinlock); 928 929 return TEE_ERROR_TARGET_DEAD; 930 } 931 932 sess = ts_pop_current_session(); 933 assert(sess == s); 934 935 bm_timestamp(); 936 937 return res; 938 } 939 940 /* We currently don't support 32 bits */ 941 #ifdef ARM64 942 static void sp_svc_store_registers(struct thread_svc_regs *regs, 943 struct thread_ctx_regs *sp_regs) 944 { 945 COMPILE_TIME_ASSERT(sizeof(sp_regs->x[0]) == sizeof(regs->x0)); 946 memcpy(sp_regs->x, ®s->x0, 31 * sizeof(regs->x0)); 947 sp_regs->pc = regs->elr; 948 sp_regs->sp = regs->sp_el0; 949 } 950 #endif 951 952 static bool sp_handle_svc(struct thread_svc_regs *regs) 953 { 954 struct ts_session *ts = ts_get_current_session(); 955 struct sp_ctx *uctx = to_sp_ctx(ts->ctx); 956 struct sp_session *s = uctx->open_session; 957 958 assert(s); 959 960 sp_svc_store_registers(regs, &uctx->sp_regs); 961 962 regs->x0 = 0; 963 regs->x1 = 0; /* panic */ 964 regs->x2 = 0; /* panic code */ 965 966 /* 967 * All the registers of the SP are saved in the SP session by the SVC 968 * handler. 969 * We always return to S-El1 after handling the SVC. We will continue 970 * in sp_enter_invoke_cmd() (return from __thread_enter_user_mode). 971 * The sp_enter() function copies the FF-A parameters (a0-a7) from the 972 * saved registers to the thread_smc_args. The thread_smc_args object is 973 * afterward used by the spmc_sp_msg_handler() to handle the 974 * FF-A message send by the SP. 975 */ 976 return false; 977 } 978 979 static void sp_dump_state(struct ts_ctx *ctx) 980 { 981 struct sp_ctx *utc = to_sp_ctx(ctx); 982 983 if (utc->uctx.dump_entry_func) { 984 TEE_Result res = ldelf_dump_state(&utc->uctx); 985 986 if (!res || res == TEE_ERROR_TARGET_DEAD) 987 return; 988 } 989 990 user_mode_ctx_print_mappings(&utc->uctx); 991 } 992 993 /* 994 * Note: this variable is weak just to ease breaking its dependency chain 995 * when added to the unpaged area. 996 */ 997 const struct ts_ops sp_ops __weak __relrodata_unpaged("sp_ops") = { 998 .enter_invoke_cmd = sp_enter_invoke_cmd, 999 .handle_svc = sp_handle_svc, 1000 .dump_state = sp_dump_state, 1001 }; 1002 1003 static TEE_Result sp_init_all(void) 1004 { 1005 TEE_Result res = TEE_SUCCESS; 1006 const struct sp_image *sp = NULL; 1007 char __maybe_unused msg[60] = { '\0', }; 1008 1009 for_each_secure_partition(sp) { 1010 if (sp->image.uncompressed_size) 1011 snprintf(msg, sizeof(msg), 1012 " (compressed, uncompressed %u)", 1013 sp->image.uncompressed_size); 1014 else 1015 msg[0] = '\0'; 1016 DMSG("SP %pUl size %u%s", (void *)&sp->image.uuid, 1017 sp->image.size, msg); 1018 1019 res = sp_init_uuid(&sp->image.uuid, sp->fdt); 1020 1021 if (res != TEE_SUCCESS) { 1022 EMSG("Failed initializing SP(%pUl) err:%#"PRIx32, 1023 &sp->image.uuid, res); 1024 if (!IS_ENABLED(CFG_SP_SKIP_FAILED)) 1025 panic(); 1026 } 1027 } 1028 1029 return TEE_SUCCESS; 1030 } 1031 1032 boot_final(sp_init_all); 1033 1034 static TEE_Result secure_partition_open(const TEE_UUID *uuid, 1035 struct ts_store_handle **h) 1036 { 1037 return emb_ts_open(uuid, h, find_secure_partition); 1038 } 1039 1040 REGISTER_SP_STORE(2) = { 1041 .description = "SP store", 1042 .open = secure_partition_open, 1043 .get_size = emb_ts_get_size, 1044 .get_tag = emb_ts_get_tag, 1045 .read = emb_ts_read, 1046 .close = emb_ts_close, 1047 }; 1048