1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2020-2021, Arm Limited. 4 */ 5 #include <bench.h> 6 #include <crypto/crypto.h> 7 #include <initcall.h> 8 #include <kernel/embedded_ts.h> 9 #include <kernel/ldelf_loader.h> 10 #include <kernel/secure_partition.h> 11 #include <kernel/spinlock.h> 12 #include <kernel/spmc_sp_handler.h> 13 #include <kernel/thread_private.h> 14 #include <kernel/thread_spmc.h> 15 #include <kernel/ts_store.h> 16 #include <ldelf.h> 17 #include <mm/core_mmu.h> 18 #include <mm/fobj.h> 19 #include <mm/mobj.h> 20 #include <mm/vm.h> 21 #include <optee_ffa.h> 22 #include <stdio.h> 23 #include <string.h> 24 #include <tee_api_types.h> 25 #include <trace.h> 26 #include <types_ext.h> 27 #include <utee_defines.h> 28 #include <util.h> 29 #include <zlib.h> 30 31 const struct ts_ops sp_ops; 32 33 /* List that holds all of the loaded SP's */ 34 static struct sp_sessions_head open_sp_sessions = 35 TAILQ_HEAD_INITIALIZER(open_sp_sessions); 36 37 static const struct embedded_ts *find_secure_partition(const TEE_UUID *uuid) 38 { 39 const struct embedded_ts *sp = NULL; 40 41 for_each_secure_partition(sp) { 42 if (!memcmp(&sp->uuid, uuid, sizeof(*uuid))) 43 return sp; 44 } 45 return NULL; 46 } 47 48 bool is_sp_ctx(struct ts_ctx *ctx) 49 { 50 return ctx && (ctx->ops == &sp_ops); 51 } 52 53 static void set_sp_ctx_ops(struct ts_ctx *ctx) 54 { 55 ctx->ops = &sp_ops; 56 } 57 58 TEE_Result sp_find_session_id(const TEE_UUID *uuid, uint32_t *session_id) 59 { 60 struct sp_session *s = NULL; 61 62 TAILQ_FOREACH(s, &open_sp_sessions, link) { 63 if (!memcmp(&s->ts_sess.ctx->uuid, uuid, sizeof(*uuid))) { 64 if (s->state == sp_dead) 65 return TEE_ERROR_TARGET_DEAD; 66 67 *session_id = s->endpoint_id; 68 return TEE_SUCCESS; 69 } 70 } 71 72 return TEE_ERROR_ITEM_NOT_FOUND; 73 } 74 75 struct sp_session *sp_get_session(uint32_t session_id) 76 { 77 struct sp_session *s = NULL; 78 79 TAILQ_FOREACH(s, &open_sp_sessions, link) { 80 if (s->endpoint_id == session_id) 81 return s; 82 } 83 84 return NULL; 85 } 86 87 TEE_Result sp_partition_info_get_all(struct ffa_partition_info *fpi, 88 size_t *elem_count) 89 { 90 size_t in_count = *elem_count; 91 struct sp_session *s = NULL; 92 size_t count = 0; 93 94 TAILQ_FOREACH(s, &open_sp_sessions, link) { 95 if (s->state == sp_dead) 96 continue; 97 if (count < in_count) { 98 spmc_fill_partition_entry(fpi, s->endpoint_id, 1); 99 fpi++; 100 } 101 count++; 102 } 103 104 *elem_count = count; 105 if (count > in_count) 106 return TEE_ERROR_SHORT_BUFFER; 107 108 return TEE_SUCCESS; 109 } 110 111 bool sp_has_exclusive_access(struct sp_mem_map_region *mem, 112 struct user_mode_ctx *uctx) 113 { 114 /* 115 * Check that we have access to the region if it is supposed to be 116 * mapped to the current context. 117 */ 118 if (uctx) { 119 struct vm_region *region = NULL; 120 121 /* Make sure that each mobj belongs to the SP */ 122 TAILQ_FOREACH(region, &uctx->vm_info.regions, link) { 123 if (region->mobj == mem->mobj) 124 break; 125 } 126 127 if (!region) 128 return false; 129 } 130 131 /* Check that it is not shared with another SP */ 132 return !sp_mem_is_shared(mem); 133 } 134 135 static void sp_init_info(struct sp_ctx *ctx, struct thread_smc_args *args) 136 { 137 struct sp_ffa_init_info *info = NULL; 138 139 /* 140 * When starting the SP for the first time a init_info struct is passed. 141 * Store the struct on the stack and store the address in x0 142 */ 143 ctx->uctx.stack_ptr -= ROUNDUP(sizeof(*info), STACK_ALIGNMENT); 144 145 info = (struct sp_ffa_init_info *)ctx->uctx.stack_ptr; 146 147 info->magic = 0; 148 info->count = 0; 149 args->a0 = (vaddr_t)info; 150 } 151 152 static uint16_t new_session_id(struct sp_sessions_head *open_sessions) 153 { 154 struct sp_session *last = NULL; 155 uint16_t id = SPMC_ENDPOINT_ID + 1; 156 157 last = TAILQ_LAST(open_sessions, sp_sessions_head); 158 if (last) 159 id = last->endpoint_id + 1; 160 161 assert(id > SPMC_ENDPOINT_ID); 162 return id; 163 } 164 165 static TEE_Result sp_create_ctx(const TEE_UUID *uuid, struct sp_session *s) 166 { 167 TEE_Result res = TEE_SUCCESS; 168 struct sp_ctx *spc = NULL; 169 170 /* Register context */ 171 spc = calloc(1, sizeof(struct sp_ctx)); 172 if (!spc) 173 return TEE_ERROR_OUT_OF_MEMORY; 174 175 spc->uctx.ts_ctx = &spc->ts_ctx; 176 spc->open_session = s; 177 s->ts_sess.ctx = &spc->ts_ctx; 178 spc->ts_ctx.uuid = *uuid; 179 180 res = vm_info_init(&spc->uctx); 181 if (res) 182 goto err; 183 184 set_sp_ctx_ops(&spc->ts_ctx); 185 186 return TEE_SUCCESS; 187 188 err: 189 free(spc); 190 return res; 191 } 192 193 static TEE_Result sp_create_session(struct sp_sessions_head *open_sessions, 194 const TEE_UUID *uuid, 195 struct sp_session **sess) 196 { 197 TEE_Result res = TEE_SUCCESS; 198 struct sp_session *s = calloc(1, sizeof(struct sp_session)); 199 200 if (!s) 201 return TEE_ERROR_OUT_OF_MEMORY; 202 203 s->endpoint_id = new_session_id(open_sessions); 204 if (!s->endpoint_id) { 205 res = TEE_ERROR_OVERFLOW; 206 goto err; 207 } 208 209 DMSG("Loading Secure Partition %pUl", (void *)uuid); 210 res = sp_create_ctx(uuid, s); 211 if (res) 212 goto err; 213 214 TAILQ_INSERT_TAIL(open_sessions, s, link); 215 *sess = s; 216 return TEE_SUCCESS; 217 218 err: 219 free(s); 220 return res; 221 } 222 223 static TEE_Result sp_init_set_registers(struct sp_ctx *ctx) 224 { 225 struct thread_ctx_regs *sp_regs = &ctx->sp_regs; 226 227 memset(sp_regs, 0, sizeof(*sp_regs)); 228 sp_regs->sp = ctx->uctx.stack_ptr; 229 sp_regs->pc = ctx->uctx.entry_func; 230 231 return TEE_SUCCESS; 232 } 233 234 TEE_Result sp_map_shared(struct sp_session *s, 235 struct sp_mem_receiver *receiver, 236 struct sp_mem *smem, 237 uint64_t *va) 238 { 239 TEE_Result res = TEE_SUCCESS; 240 struct sp_ctx *ctx = NULL; 241 uint32_t perm = TEE_MATTR_UR; 242 struct sp_mem_map_region *reg = NULL; 243 244 ctx = to_sp_ctx(s->ts_sess.ctx); 245 246 /* Get the permission */ 247 if (receiver->perm.perm & FFA_MEM_ACC_EXE) 248 perm |= TEE_MATTR_UX; 249 250 if (receiver->perm.perm & FFA_MEM_ACC_RW) { 251 if (receiver->perm.perm & FFA_MEM_ACC_EXE) 252 return TEE_ERROR_ACCESS_CONFLICT; 253 254 perm |= TEE_MATTR_UW; 255 } 256 /* 257 * Currently we don't support passing a va. We can't guarantee that the 258 * full region will be mapped in a contiguous region. A smem->region can 259 * have multiple mobj for one share. Currently there doesn't seem to be 260 * an option to guarantee that these will be mapped in a contiguous va 261 * space. 262 */ 263 if (*va) 264 return TEE_ERROR_NOT_SUPPORTED; 265 266 SLIST_FOREACH(reg, &smem->regions, link) { 267 res = vm_map(&ctx->uctx, va, reg->page_count * SMALL_PAGE_SIZE, 268 perm, 0, reg->mobj, reg->page_offset); 269 270 if (res != TEE_SUCCESS) { 271 EMSG("Failed to map memory region %#"PRIx32, res); 272 return res; 273 } 274 } 275 return TEE_SUCCESS; 276 } 277 278 TEE_Result sp_unmap_ffa_regions(struct sp_session *s, struct sp_mem *smem) 279 { 280 TEE_Result res = TEE_SUCCESS; 281 vaddr_t vaddr = 0; 282 size_t len = 0; 283 struct sp_ctx *ctx = to_sp_ctx(s->ts_sess.ctx); 284 struct sp_mem_map_region *reg = NULL; 285 286 SLIST_FOREACH(reg, &smem->regions, link) { 287 vaddr = (vaddr_t)sp_mem_get_va(&ctx->uctx, reg->page_offset, 288 reg->mobj); 289 len = reg->page_count * SMALL_PAGE_SIZE; 290 291 res = vm_unmap(&ctx->uctx, vaddr, len); 292 if (res != TEE_SUCCESS) 293 return res; 294 } 295 296 return TEE_SUCCESS; 297 } 298 299 static TEE_Result sp_open_session(struct sp_session **sess, 300 struct sp_sessions_head *open_sessions, 301 const TEE_UUID *uuid) 302 { 303 TEE_Result res = TEE_SUCCESS; 304 struct sp_session *s = NULL; 305 struct sp_ctx *ctx = NULL; 306 307 if (!find_secure_partition(uuid)) 308 return TEE_ERROR_ITEM_NOT_FOUND; 309 310 res = sp_create_session(open_sessions, uuid, &s); 311 if (res != TEE_SUCCESS) { 312 DMSG("sp_create_session failed %#"PRIx32, res); 313 return res; 314 } 315 316 ctx = to_sp_ctx(s->ts_sess.ctx); 317 assert(ctx); 318 if (!ctx) 319 return TEE_ERROR_TARGET_DEAD; 320 *sess = s; 321 322 ts_push_current_session(&s->ts_sess); 323 /* Load the SP using ldelf. */ 324 ldelf_load_ldelf(&ctx->uctx); 325 res = ldelf_init_with_ldelf(&s->ts_sess, &ctx->uctx); 326 327 if (res != TEE_SUCCESS) { 328 EMSG("Failed. loading SP using ldelf %#"PRIx32, res); 329 ts_pop_current_session(); 330 return TEE_ERROR_TARGET_DEAD; 331 } 332 333 /* Make the SP ready for its first run */ 334 s->state = sp_idle; 335 s->caller_id = 0; 336 sp_init_set_registers(ctx); 337 ts_pop_current_session(); 338 339 return TEE_SUCCESS; 340 } 341 342 static TEE_Result sp_init_uuid(const TEE_UUID *uuid) 343 { 344 TEE_Result res = TEE_SUCCESS; 345 struct sp_session *sess = NULL; 346 struct thread_smc_args args = { }; 347 348 res = sp_open_session(&sess, 349 &open_sp_sessions, 350 uuid); 351 if (res) 352 return res; 353 354 ts_push_current_session(&sess->ts_sess); 355 sp_init_info(to_sp_ctx(sess->ts_sess.ctx), &args); 356 ts_pop_current_session(); 357 358 if (sp_enter(&args, sess)) 359 return FFA_ABORTED; 360 361 spmc_sp_msg_handler(&args, sess); 362 363 return TEE_SUCCESS; 364 } 365 366 TEE_Result sp_enter(struct thread_smc_args *args, struct sp_session *sp) 367 { 368 TEE_Result res = FFA_OK; 369 struct sp_ctx *ctx = to_sp_ctx(sp->ts_sess.ctx); 370 371 ctx->sp_regs.x[0] = args->a0; 372 ctx->sp_regs.x[1] = args->a1; 373 ctx->sp_regs.x[2] = args->a2; 374 ctx->sp_regs.x[3] = args->a3; 375 ctx->sp_regs.x[4] = args->a4; 376 ctx->sp_regs.x[5] = args->a5; 377 ctx->sp_regs.x[6] = args->a6; 378 ctx->sp_regs.x[7] = args->a7; 379 380 res = sp->ts_sess.ctx->ops->enter_invoke_cmd(&sp->ts_sess, 0); 381 382 args->a0 = ctx->sp_regs.x[0]; 383 args->a1 = ctx->sp_regs.x[1]; 384 args->a2 = ctx->sp_regs.x[2]; 385 args->a3 = ctx->sp_regs.x[3]; 386 args->a4 = ctx->sp_regs.x[4]; 387 args->a5 = ctx->sp_regs.x[5]; 388 args->a6 = ctx->sp_regs.x[6]; 389 args->a7 = ctx->sp_regs.x[7]; 390 391 return res; 392 } 393 394 static TEE_Result sp_enter_invoke_cmd(struct ts_session *s, 395 uint32_t cmd __unused) 396 { 397 struct sp_ctx *ctx = to_sp_ctx(s->ctx); 398 TEE_Result res = TEE_SUCCESS; 399 uint32_t exceptions = 0; 400 uint64_t cpsr = 0; 401 struct sp_session *sp_s = to_sp_session(s); 402 struct ts_session *sess = NULL; 403 struct thread_ctx_regs *sp_regs = NULL; 404 uint32_t panicked = false; 405 uint32_t panic_code = 0; 406 407 bm_timestamp(); 408 409 sp_regs = &ctx->sp_regs; 410 ts_push_current_session(s); 411 412 cpsr = sp_regs->cpsr; 413 sp_regs->cpsr = read_daif() & (SPSR_64_DAIF_MASK << SPSR_64_DAIF_SHIFT); 414 415 exceptions = thread_mask_exceptions(THREAD_EXCP_ALL); 416 __thread_enter_user_mode(sp_regs, &panicked, &panic_code); 417 sp_regs->cpsr = cpsr; 418 thread_unmask_exceptions(exceptions); 419 420 thread_user_clear_vfp(&ctx->uctx); 421 422 if (panicked) { 423 DMSG("SP panicked with code %#"PRIx32, panic_code); 424 abort_print_current_ts(); 425 426 sess = ts_pop_current_session(); 427 cpu_spin_lock(&sp_s->spinlock); 428 sp_s->state = sp_dead; 429 cpu_spin_unlock(&sp_s->spinlock); 430 431 return TEE_ERROR_TARGET_DEAD; 432 } 433 434 sess = ts_pop_current_session(); 435 assert(sess == s); 436 437 bm_timestamp(); 438 439 return res; 440 } 441 442 /* We currently don't support 32 bits */ 443 #ifdef ARM64 444 static void sp_svc_store_registers(struct thread_svc_regs *regs, 445 struct thread_ctx_regs *sp_regs) 446 { 447 COMPILE_TIME_ASSERT(sizeof(sp_regs->x[0]) == sizeof(regs->x0)); 448 memcpy(sp_regs->x, ®s->x0, 31 * sizeof(regs->x0)); 449 sp_regs->pc = regs->elr; 450 sp_regs->sp = regs->sp_el0; 451 } 452 #endif 453 454 static bool sp_handle_svc(struct thread_svc_regs *regs) 455 { 456 struct ts_session *ts = ts_get_current_session(); 457 struct sp_ctx *uctx = to_sp_ctx(ts->ctx); 458 struct sp_session *s = uctx->open_session; 459 460 assert(s); 461 462 sp_svc_store_registers(regs, &uctx->sp_regs); 463 464 regs->x0 = 0; 465 regs->x1 = 0; /* panic */ 466 regs->x2 = 0; /* panic code */ 467 468 /* 469 * All the registers of the SP are saved in the SP session by the SVC 470 * handler. 471 * We always return to S-El1 after handling the SVC. We will continue 472 * in sp_enter_invoke_cmd() (return from __thread_enter_user_mode). 473 * The sp_enter() function copies the FF-A parameters (a0-a7) from the 474 * saved registers to the thread_smc_args. The thread_smc_args object is 475 * afterward used by the spmc_sp_msg_handler() to handle the 476 * FF-A message send by the SP. 477 */ 478 return false; 479 } 480 481 /* 482 * Note: this variable is weak just to ease breaking its dependency chain 483 * when added to the unpaged area. 484 */ 485 const struct ts_ops sp_ops __weak __relrodata_unpaged("sp_ops") = { 486 .enter_invoke_cmd = sp_enter_invoke_cmd, 487 .handle_svc = sp_handle_svc, 488 }; 489 490 static TEE_Result sp_init_all(void) 491 { 492 TEE_Result res = TEE_SUCCESS; 493 const struct embedded_ts *sp = NULL; 494 char __maybe_unused msg[60] = { '\0', }; 495 496 for_each_secure_partition(sp) { 497 if (sp->uncompressed_size) 498 snprintf(msg, sizeof(msg), 499 " (compressed, uncompressed %u)", 500 sp->uncompressed_size); 501 else 502 msg[0] = '\0'; 503 DMSG("SP %pUl size %u%s", (void *)&sp->uuid, sp->size, msg); 504 505 res = sp_init_uuid(&sp->uuid); 506 507 if (res != TEE_SUCCESS) { 508 EMSG("Failed initializing SP(%pUl) err:%#"PRIx32, 509 &sp->uuid, res); 510 if (!IS_ENABLED(CFG_SP_SKIP_FAILED)) 511 panic(); 512 } 513 } 514 515 return TEE_SUCCESS; 516 } 517 518 boot_final(sp_init_all); 519 520 static TEE_Result secure_partition_open(const TEE_UUID *uuid, 521 struct ts_store_handle **h) 522 { 523 return emb_ts_open(uuid, h, find_secure_partition); 524 } 525 526 REGISTER_SP_STORE(2) = { 527 .description = "SP store", 528 .open = secure_partition_open, 529 .get_size = emb_ts_get_size, 530 .get_tag = emb_ts_get_tag, 531 .read = emb_ts_read, 532 .close = emb_ts_close, 533 }; 534