1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2014, STMicroelectronics International N.V. 4 * Copyright (c) 2020, Arm Limited 5 * Copyright (c) 2025, NVIDIA Corporation & AFFILIATES. 6 */ 7 8 #include <assert.h> 9 #include <kernel/mutex.h> 10 #include <kernel/panic.h> 11 #include <kernel/pseudo_ta.h> 12 #include <kernel/stmm_sp.h> 13 #include <kernel/tee_common.h> 14 #include <kernel/tee_misc.h> 15 #include <kernel/tee_ta_manager.h> 16 #include <kernel/tee_time.h> 17 #include <kernel/thread.h> 18 #include <kernel/user_mode_ctx.h> 19 #include <kernel/user_ta.h> 20 #include <malloc.h> 21 #include <mm/core_memprot.h> 22 #include <mm/core_mmu.h> 23 #include <mm/mobj.h> 24 #include <mm/vm.h> 25 #include <pta_stats.h> 26 #include <stdlib.h> 27 #include <string.h> 28 #include <tee_api_types.h> 29 #include <tee/entry_std.h> 30 #include <tee/tee_obj.h> 31 #include <trace.h> 32 #include <types_ext.h> 33 #include <user_ta_header.h> 34 #include <utee_types.h> 35 #include <util.h> 36 37 #if defined(CFG_TA_STATS) 38 #define MAX_DUMP_SESS_NUM (16) 39 40 struct tee_ta_dump_ctx { 41 TEE_UUID uuid; 42 uint32_t panicked; 43 bool is_user_ta; 44 uint32_t sess_num; 45 uint32_t sess_id[MAX_DUMP_SESS_NUM]; 46 }; 47 #endif 48 49 /* This mutex protects the critical section in tee_ta_init_session */ 50 struct mutex tee_ta_mutex = MUTEX_INITIALIZER; 51 /* This condvar is used when waiting for a TA context to become initialized */ 52 struct condvar tee_ta_init_cv = CONDVAR_INITIALIZER; 53 struct tee_ta_ctx_head tee_ctxes = TAILQ_HEAD_INITIALIZER(tee_ctxes); 54 55 #ifndef CFG_CONCURRENT_SINGLE_INSTANCE_TA 56 static struct condvar tee_ta_cv = CONDVAR_INITIALIZER; 57 static short int tee_ta_single_instance_thread = THREAD_ID_INVALID; 58 static size_t tee_ta_single_instance_count; 59 #endif 60 61 #ifdef CFG_CONCURRENT_SINGLE_INSTANCE_TA 62 static void lock_single_instance(void) 63 { 64 } 65 66 static void unlock_single_instance(void) 67 { 68 } 69 70 static bool has_single_instance_lock(void) 71 { 72 return false; 73 } 74 #else 75 static void lock_single_instance(void) 76 { 77 /* Requires tee_ta_mutex to be held */ 78 if (tee_ta_single_instance_thread != thread_get_id()) { 79 /* Wait until the single-instance lock is available. */ 80 while (tee_ta_single_instance_thread != THREAD_ID_INVALID) 81 condvar_wait(&tee_ta_cv, &tee_ta_mutex); 82 83 tee_ta_single_instance_thread = thread_get_id(); 84 assert(tee_ta_single_instance_count == 0); 85 } 86 87 tee_ta_single_instance_count++; 88 } 89 90 static void unlock_single_instance(void) 91 { 92 /* Requires tee_ta_mutex to be held */ 93 assert(tee_ta_single_instance_thread == thread_get_id()); 94 assert(tee_ta_single_instance_count > 0); 95 96 tee_ta_single_instance_count--; 97 if (tee_ta_single_instance_count == 0) { 98 tee_ta_single_instance_thread = THREAD_ID_INVALID; 99 condvar_signal(&tee_ta_cv); 100 } 101 } 102 103 static bool has_single_instance_lock(void) 104 { 105 /* Requires tee_ta_mutex to be held */ 106 return tee_ta_single_instance_thread == thread_get_id(); 107 } 108 #endif 109 110 struct tee_ta_session *__noprof to_ta_session(struct ts_session *sess) 111 { 112 assert(is_ta_ctx(sess->ctx) || is_stmm_ctx(sess->ctx)); 113 return container_of(sess, struct tee_ta_session, ts_sess); 114 } 115 116 static struct tee_ta_ctx *ts_to_ta_ctx(struct ts_ctx *ctx) 117 { 118 if (is_ta_ctx(ctx)) 119 return to_ta_ctx(ctx); 120 121 if (is_stmm_ctx(ctx)) 122 return &(to_stmm_ctx(ctx)->ta_ctx); 123 124 panic("bad context"); 125 } 126 127 static bool tee_ta_try_set_busy(struct tee_ta_ctx *ctx) 128 { 129 bool rc = true; 130 131 if (ctx->flags & TA_FLAG_CONCURRENT) 132 return true; 133 134 mutex_lock(&tee_ta_mutex); 135 136 if (ctx->flags & TA_FLAG_SINGLE_INSTANCE) 137 lock_single_instance(); 138 139 if (has_single_instance_lock()) { 140 if (ctx->busy) { 141 /* 142 * We're holding the single-instance lock and the 143 * TA is busy, as waiting now would only cause a 144 * dead-lock, we release the lock and return false. 145 */ 146 rc = false; 147 if (ctx->flags & TA_FLAG_SINGLE_INSTANCE) 148 unlock_single_instance(); 149 } 150 } else { 151 /* 152 * We're not holding the single-instance lock, we're free to 153 * wait for the TA to become available. 154 */ 155 while (ctx->busy) 156 condvar_wait(&ctx->busy_cv, &tee_ta_mutex); 157 } 158 159 /* Either it's already true or we should set it to true */ 160 ctx->busy = true; 161 162 mutex_unlock(&tee_ta_mutex); 163 return rc; 164 } 165 166 static void tee_ta_set_busy(struct tee_ta_ctx *ctx) 167 { 168 if (!tee_ta_try_set_busy(ctx)) 169 panic(); 170 } 171 172 static void tee_ta_clear_busy(struct tee_ta_ctx *ctx) 173 { 174 if (ctx->flags & TA_FLAG_CONCURRENT) 175 return; 176 177 mutex_lock(&tee_ta_mutex); 178 179 assert(ctx->busy); 180 ctx->busy = false; 181 condvar_signal(&ctx->busy_cv); 182 183 if (ctx->flags & TA_FLAG_SINGLE_INSTANCE) 184 unlock_single_instance(); 185 186 mutex_unlock(&tee_ta_mutex); 187 } 188 189 static void dec_session_ref_count(struct tee_ta_session *s) 190 { 191 assert(s->ref_count > 0); 192 s->ref_count--; 193 if (s->ref_count == 1) 194 condvar_signal(&s->refc_cv); 195 } 196 197 void tee_ta_put_session(struct tee_ta_session *s) 198 { 199 mutex_lock(&tee_ta_mutex); 200 201 if (s->lock_thread == thread_get_id()) { 202 s->lock_thread = THREAD_ID_INVALID; 203 condvar_signal(&s->lock_cv); 204 } 205 dec_session_ref_count(s); 206 207 mutex_unlock(&tee_ta_mutex); 208 } 209 210 static struct tee_ta_session *tee_ta_find_session_nolock(uint32_t id, 211 struct tee_ta_session_head *open_sessions) 212 { 213 struct tee_ta_session *s = NULL; 214 struct tee_ta_session *found = NULL; 215 216 TAILQ_FOREACH(s, open_sessions, link) { 217 if (s->id == id) { 218 found = s; 219 break; 220 } 221 } 222 223 return found; 224 } 225 226 struct tee_ta_session *tee_ta_find_session(uint32_t id, 227 struct tee_ta_session_head *open_sessions) 228 { 229 struct tee_ta_session *s = NULL; 230 231 mutex_lock(&tee_ta_mutex); 232 233 s = tee_ta_find_session_nolock(id, open_sessions); 234 235 mutex_unlock(&tee_ta_mutex); 236 237 return s; 238 } 239 240 struct tee_ta_session *tee_ta_get_session(uint32_t id, bool exclusive, 241 struct tee_ta_session_head *open_sessions) 242 { 243 struct tee_ta_session *s; 244 245 mutex_lock(&tee_ta_mutex); 246 247 while (true) { 248 s = tee_ta_find_session_nolock(id, open_sessions); 249 if (!s) 250 break; 251 if (s->unlink) { 252 s = NULL; 253 break; 254 } 255 s->ref_count++; 256 if (!exclusive) 257 break; 258 259 assert(s->lock_thread != thread_get_id()); 260 261 while (s->lock_thread != THREAD_ID_INVALID && !s->unlink) 262 condvar_wait(&s->lock_cv, &tee_ta_mutex); 263 264 if (s->unlink) { 265 dec_session_ref_count(s); 266 s = NULL; 267 break; 268 } 269 270 s->lock_thread = thread_get_id(); 271 break; 272 } 273 274 mutex_unlock(&tee_ta_mutex); 275 return s; 276 } 277 278 static void tee_ta_unlink_session(struct tee_ta_session *s, 279 struct tee_ta_session_head *open_sessions) 280 { 281 mutex_lock(&tee_ta_mutex); 282 283 assert(s->ref_count >= 1); 284 assert(s->lock_thread == thread_get_id()); 285 assert(!s->unlink); 286 287 s->unlink = true; 288 condvar_broadcast(&s->lock_cv); 289 290 while (s->ref_count != 1) 291 condvar_wait(&s->refc_cv, &tee_ta_mutex); 292 293 TAILQ_REMOVE(open_sessions, s, link); 294 295 mutex_unlock(&tee_ta_mutex); 296 } 297 298 static void dump_ftrace(struct tee_ta_session *s __maybe_unused) 299 { 300 #if defined(CFG_FTRACE_SUPPORT) 301 struct ts_ctx *ts_ctx = s->ts_sess.ctx; 302 303 if (ts_ctx && ts_ctx->ops->dump_ftrace && 304 core_mmu_user_mapping_is_active()) { 305 ts_push_current_session(&s->ts_sess); 306 ts_ctx->ops->dump_ftrace(ts_ctx); 307 ts_pop_current_session(); 308 } 309 #endif 310 } 311 312 static void destroy_session(struct tee_ta_session *s, 313 struct tee_ta_session_head *open_sessions) 314 { 315 dump_ftrace(s); 316 317 tee_ta_unlink_session(s, open_sessions); 318 #if defined(CFG_TA_GPROF_SUPPORT) 319 free(s->ts_sess.sbuf); 320 #endif 321 free(s); 322 } 323 324 static void destroy_context(struct tee_ta_ctx *ctx) 325 { 326 DMSG("Destroy TA ctx (0x%" PRIxVA ")", (vaddr_t)ctx); 327 328 condvar_destroy(&ctx->busy_cv); 329 ctx->ts_ctx.ops->destroy(&ctx->ts_ctx); 330 } 331 332 /* 333 * tee_ta_context_find - Find TA in session list based on a UUID (input) 334 * Returns a pointer to the session 335 */ 336 static struct tee_ta_ctx *tee_ta_context_find(const TEE_UUID *uuid) 337 { 338 struct tee_ta_ctx *ctx; 339 340 TAILQ_FOREACH(ctx, &tee_ctxes, link) { 341 if (memcmp(&ctx->ts_ctx.uuid, uuid, sizeof(TEE_UUID)) == 0) 342 return ctx; 343 } 344 345 return NULL; 346 } 347 348 /* check if requester (client ID) matches session initial client */ 349 static TEE_Result check_client(struct tee_ta_session *s, const TEE_Identity *id) 350 { 351 if (id == KERN_IDENTITY) 352 return TEE_SUCCESS; 353 354 if (id == NSAPP_IDENTITY) { 355 if (s->clnt_id.login == TEE_LOGIN_TRUSTED_APP) { 356 DMSG("nsec tries to hijack TA session"); 357 return TEE_ERROR_ACCESS_DENIED; 358 } 359 return TEE_SUCCESS; 360 } 361 362 if (memcmp(&s->clnt_id, id, sizeof(TEE_Identity)) != 0) { 363 DMSG("client id mismatch"); 364 return TEE_ERROR_ACCESS_DENIED; 365 } 366 return TEE_SUCCESS; 367 } 368 369 /* 370 * Check if invocation parameters matches TA properties 371 * 372 * @s - current session handle 373 * @param - already identified memory references hold a valid 'mobj'. 374 * 375 * Policy: 376 * - All TAs can access 'non-secure' shared memory. 377 * - All TAs can access TEE private memory (seccpy) 378 * - Only SDP flagged TAs can accept SDP memory references. 379 */ 380 #ifndef CFG_SECURE_DATA_PATH 381 static bool check_params(struct tee_ta_session *sess __unused, 382 struct tee_ta_param *param __unused) 383 { 384 /* 385 * When CFG_SECURE_DATA_PATH is not enabled, SDP memory references 386 * are rejected at OP-TEE core entry. Hence here all TAs have same 387 * permissions regarding memory reference parameters. 388 */ 389 return true; 390 } 391 #else 392 static bool check_params(struct tee_ta_session *sess, 393 struct tee_ta_param *param) 394 { 395 int n; 396 397 /* 398 * When CFG_SECURE_DATA_PATH is enabled, OP-TEE entry allows SHM and 399 * SDP memory references. Only TAs flagged SDP can access SDP memory. 400 */ 401 if (sess->ts_sess.ctx && 402 ts_to_ta_ctx(sess->ts_sess.ctx)->flags & TA_FLAG_SECURE_DATA_PATH) 403 return true; 404 405 for (n = 0; n < TEE_NUM_PARAMS; n++) { 406 uint32_t param_type = TEE_PARAM_TYPE_GET(param->types, n); 407 struct param_mem *mem = ¶m->u[n].mem; 408 409 if (param_type != TEE_PARAM_TYPE_MEMREF_INPUT && 410 param_type != TEE_PARAM_TYPE_MEMREF_OUTPUT && 411 param_type != TEE_PARAM_TYPE_MEMREF_INOUT) 412 continue; 413 if (!mem->size) 414 continue; 415 if (mobj_is_sdp_mem(mem->mobj)) 416 return false; 417 } 418 return true; 419 } 420 #endif 421 422 static void set_invoke_timeout(struct tee_ta_session *sess, 423 uint32_t cancel_req_to) 424 { 425 TEE_Time current_time; 426 TEE_Time cancel_time; 427 428 if (cancel_req_to == TEE_TIMEOUT_INFINITE) 429 goto infinite; 430 431 if (tee_time_get_sys_time(¤t_time) != TEE_SUCCESS) 432 goto infinite; 433 434 if (ADD_OVERFLOW(current_time.seconds, cancel_req_to / 1000, 435 &cancel_time.seconds)) 436 goto infinite; 437 438 cancel_time.millis = current_time.millis + cancel_req_to % 1000; 439 if (cancel_time.millis > 1000) { 440 if (ADD_OVERFLOW(current_time.seconds, 1, 441 &cancel_time.seconds)) 442 goto infinite; 443 444 cancel_time.seconds++; 445 cancel_time.millis -= 1000; 446 } 447 448 sess->cancel_time = cancel_time; 449 return; 450 451 infinite: 452 sess->cancel_time.seconds = UINT32_MAX; 453 sess->cancel_time.millis = UINT32_MAX; 454 } 455 456 /*----------------------------------------------------------------------------- 457 * Close a Trusted Application and free available resources 458 *---------------------------------------------------------------------------*/ 459 TEE_Result tee_ta_close_session(uint32_t id, 460 struct tee_ta_session_head *open_sessions, 461 const TEE_Identity *clnt_id) 462 { 463 struct tee_ta_session *sess = NULL; 464 struct tee_ta_ctx *ctx = NULL; 465 struct ts_ctx *ts_ctx = NULL; 466 bool keep_crashed = false; 467 bool keep_alive = false; 468 469 DMSG("id %"PRIu32, id); 470 471 sess = tee_ta_get_session(id, true, open_sessions); 472 473 if (!sess) { 474 EMSG("session id %"PRIu32" to be removed is not found", id); 475 return TEE_ERROR_ITEM_NOT_FOUND; 476 } 477 478 if (check_client(sess, clnt_id) != TEE_SUCCESS) { 479 tee_ta_put_session(sess); 480 return TEE_ERROR_BAD_PARAMETERS; /* intentional generic error */ 481 } 482 483 DMSG("Destroy session"); 484 485 ts_ctx = sess->ts_sess.ctx; 486 if (!ts_ctx) { 487 destroy_session(sess, open_sessions); 488 return TEE_SUCCESS; 489 } 490 491 ctx = ts_to_ta_ctx(ts_ctx); 492 if (ctx->panicked) { 493 destroy_session(sess, open_sessions); 494 } else { 495 tee_ta_set_busy(ctx); 496 set_invoke_timeout(sess, TEE_TIMEOUT_INFINITE); 497 ts_ctx->ops->enter_close_session(&sess->ts_sess); 498 destroy_session(sess, open_sessions); 499 tee_ta_clear_busy(ctx); 500 } 501 502 mutex_lock(&tee_ta_mutex); 503 504 if (ctx->ref_count <= 0) 505 panic(); 506 507 ctx->ref_count--; 508 if (ctx->flags & TA_FLAG_SINGLE_INSTANCE) 509 keep_alive = ctx->flags & TA_FLAG_INSTANCE_KEEP_ALIVE; 510 if (keep_alive) 511 keep_crashed = ctx->flags & TA_FLAG_INSTANCE_KEEP_CRASHED; 512 if (!ctx->ref_count && 513 ((ctx->panicked && !keep_crashed) || !keep_alive)) { 514 if (!ctx->is_releasing) { 515 TAILQ_REMOVE(&tee_ctxes, ctx, link); 516 ctx->is_releasing = true; 517 } 518 mutex_unlock(&tee_ta_mutex); 519 520 destroy_context(ctx); 521 } else 522 mutex_unlock(&tee_ta_mutex); 523 524 return TEE_SUCCESS; 525 } 526 527 static TEE_Result tee_ta_init_session_with_context(struct tee_ta_session *s, 528 const TEE_UUID *uuid) 529 { 530 struct tee_ta_ctx *ctx = NULL; 531 532 while (true) { 533 ctx = tee_ta_context_find(uuid); 534 if (!ctx) 535 return TEE_ERROR_ITEM_NOT_FOUND; 536 537 if (!ctx->is_initializing) 538 break; 539 /* 540 * Context is still initializing, wait here until it's 541 * fully initialized. Note that we're searching for the 542 * context again since it may have been removed while we 543 * where sleeping. 544 */ 545 condvar_wait(&tee_ta_init_cv, &tee_ta_mutex); 546 } 547 548 /* 549 * If the trusted service is not a single instance service (e.g. is 550 * a multi-instance TA) it should be loaded as a new instance instead 551 * of doing anything with this instance. So tell the caller that we 552 * didn't find the TA it the caller will load a new instance. 553 */ 554 if ((ctx->flags & TA_FLAG_SINGLE_INSTANCE) == 0) 555 return TEE_ERROR_ITEM_NOT_FOUND; 556 557 /* 558 * The trusted service is single instance, if it isn't multi session we 559 * can't create another session unless its reference is zero 560 */ 561 if (!(ctx->flags & TA_FLAG_MULTI_SESSION) && ctx->ref_count) 562 return TEE_ERROR_BUSY; 563 564 DMSG("Re-open trusted service %pUl", (void *)&ctx->ts_ctx.uuid); 565 566 ctx->ref_count++; 567 s->ts_sess.ctx = &ctx->ts_ctx; 568 s->ts_sess.handle_scall = s->ts_sess.ctx->ops->handle_scall; 569 return TEE_SUCCESS; 570 } 571 572 static uint32_t new_session_id(struct tee_ta_session_head *open_sessions) 573 { 574 struct tee_ta_session *last = NULL; 575 uint32_t saved = 0; 576 uint32_t id = 1; 577 578 last = TAILQ_LAST(open_sessions, tee_ta_session_head); 579 if (last) { 580 /* This value is less likely to be already used */ 581 id = last->id + 1; 582 if (!id) 583 id++; /* 0 is not valid */ 584 } 585 586 saved = id; 587 do { 588 if (!tee_ta_find_session_nolock(id, open_sessions)) 589 return id; 590 id++; 591 if (!id) 592 id++; 593 } while (id != saved); 594 595 return 0; 596 } 597 598 static TEE_Result tee_ta_init_session(TEE_ErrorOrigin *err, 599 struct tee_ta_session_head *open_sessions, 600 const TEE_UUID *uuid, 601 struct tee_ta_session **sess) 602 { 603 TEE_Result res; 604 struct tee_ta_session *s = calloc(1, sizeof(struct tee_ta_session)); 605 606 *err = TEE_ORIGIN_TEE; 607 if (!s) 608 return TEE_ERROR_OUT_OF_MEMORY; 609 610 s->cancel_mask = true; 611 condvar_init(&s->refc_cv); 612 condvar_init(&s->lock_cv); 613 s->lock_thread = THREAD_ID_INVALID; 614 s->ref_count = 1; 615 616 mutex_lock(&tee_ta_mutex); 617 s->id = new_session_id(open_sessions); 618 if (!s->id) { 619 res = TEE_ERROR_OVERFLOW; 620 goto err_mutex_unlock; 621 } 622 623 TAILQ_INSERT_TAIL(open_sessions, s, link); 624 625 /* Look for already loaded TA */ 626 res = tee_ta_init_session_with_context(s, uuid); 627 if (res == TEE_SUCCESS || res != TEE_ERROR_ITEM_NOT_FOUND) { 628 mutex_unlock(&tee_ta_mutex); 629 goto out; 630 } 631 632 /* Look for secure partition */ 633 res = stmm_init_session(uuid, s); 634 if (res == TEE_SUCCESS || res != TEE_ERROR_ITEM_NOT_FOUND) { 635 mutex_unlock(&tee_ta_mutex); 636 if (res == TEE_SUCCESS) 637 res = stmm_complete_session(s); 638 639 goto out; 640 } 641 642 /* Look for pseudo TA */ 643 res = tee_ta_init_pseudo_ta_session(uuid, s); 644 if (res == TEE_SUCCESS || res != TEE_ERROR_ITEM_NOT_FOUND) { 645 mutex_unlock(&tee_ta_mutex); 646 goto out; 647 } 648 649 /* Look for user TA */ 650 res = tee_ta_init_user_ta_session(uuid, s); 651 mutex_unlock(&tee_ta_mutex); 652 if (res == TEE_SUCCESS) 653 res = tee_ta_complete_user_ta_session(s); 654 655 out: 656 if (!res) { 657 *sess = s; 658 return TEE_SUCCESS; 659 } 660 661 mutex_lock(&tee_ta_mutex); 662 TAILQ_REMOVE(open_sessions, s, link); 663 err_mutex_unlock: 664 mutex_unlock(&tee_ta_mutex); 665 free(s); 666 return res; 667 } 668 669 static void maybe_release_ta_ctx(struct tee_ta_ctx *ctx) 670 { 671 bool was_releasing = false; 672 bool keep_crashed = false; 673 bool keep_alive = false; 674 675 if (ctx->flags & TA_FLAG_SINGLE_INSTANCE) 676 keep_alive = ctx->flags & TA_FLAG_INSTANCE_KEEP_ALIVE; 677 if (keep_alive) 678 keep_crashed = ctx->flags & TA_FLAG_INSTANCE_KEEP_CRASHED; 679 680 /* 681 * Keep panicked TAs with SINGLE_INSTANCE, KEEP_ALIVE, and KEEP_CRASHED 682 * flags in the context list to maintain their panicked status and 683 * prevent respawning. 684 */ 685 if (!keep_crashed) { 686 mutex_lock(&tee_ta_mutex); 687 was_releasing = ctx->is_releasing; 688 ctx->is_releasing = true; 689 if (!was_releasing) { 690 DMSG("Releasing panicked TA ctx"); 691 TAILQ_REMOVE(&tee_ctxes, ctx, link); 692 } 693 mutex_unlock(&tee_ta_mutex); 694 695 if (!was_releasing) 696 ctx->ts_ctx.ops->release_state(&ctx->ts_ctx); 697 } 698 } 699 700 TEE_Result tee_ta_open_session(TEE_ErrorOrigin *err, 701 struct tee_ta_session **sess, 702 struct tee_ta_session_head *open_sessions, 703 const TEE_UUID *uuid, 704 const TEE_Identity *clnt_id, 705 uint32_t cancel_req_to, 706 struct tee_ta_param *param) 707 { 708 TEE_Result res = TEE_SUCCESS; 709 struct tee_ta_session *s = NULL; 710 struct tee_ta_ctx *ctx = NULL; 711 struct ts_ctx *ts_ctx = NULL; 712 bool panicked = false; 713 bool was_busy = false; 714 uint32_t id = 0; 715 716 res = tee_ta_init_session(err, open_sessions, uuid, &s); 717 if (res != TEE_SUCCESS) { 718 DMSG("init session failed 0x%x", res); 719 return res; 720 } 721 722 if (!check_params(s, param)) 723 return TEE_ERROR_BAD_PARAMETERS; 724 725 ts_ctx = s->ts_sess.ctx; 726 ctx = ts_to_ta_ctx(ts_ctx); 727 728 if (tee_ta_try_set_busy(ctx)) { 729 if (!ctx->panicked) { 730 /* Save identity of the owner of the session */ 731 s->clnt_id = *clnt_id; 732 s->param = param; 733 set_invoke_timeout(s, cancel_req_to); 734 res = ts_ctx->ops->enter_open_session(&s->ts_sess); 735 s->param = NULL; 736 } 737 738 panicked = ctx->panicked; 739 if (panicked) { 740 maybe_release_ta_ctx(ctx); 741 res = TEE_ERROR_TARGET_DEAD; 742 } else { 743 if (IS_ENABLED(CFG_FTRACE_DUMP_EVERY_ENTRY)) 744 dump_ftrace(s); 745 } 746 747 tee_ta_clear_busy(ctx); 748 } else { 749 /* Deadlock avoided */ 750 res = TEE_ERROR_BUSY; 751 was_busy = true; 752 } 753 754 /* 755 * Origin error equal to TEE_ORIGIN_TRUSTED_APP for "regular" error, 756 * apart from panicking. 757 */ 758 if (panicked || was_busy) 759 *err = TEE_ORIGIN_TEE; 760 else 761 *err = s->err_origin; 762 763 id = s->id; 764 tee_ta_put_session(s); 765 if (panicked || res != TEE_SUCCESS) 766 tee_ta_close_session(id, open_sessions, KERN_IDENTITY); 767 768 if (!res) 769 *sess = s; 770 else 771 EMSG("Failed for TA %pUl. Return error %#"PRIx32, uuid, res); 772 773 return res; 774 } 775 776 TEE_Result tee_ta_invoke_command(TEE_ErrorOrigin *err, 777 struct tee_ta_session *sess, 778 const TEE_Identity *clnt_id, 779 uint32_t cancel_req_to, uint32_t cmd, 780 struct tee_ta_param *param) 781 { 782 struct tee_ta_ctx *ta_ctx = NULL; 783 struct ts_ctx *ts_ctx = NULL; 784 TEE_Result res = TEE_SUCCESS; 785 bool panicked = false; 786 787 if (check_client(sess, clnt_id) != TEE_SUCCESS) 788 return TEE_ERROR_BAD_PARAMETERS; /* intentional generic error */ 789 790 if (!check_params(sess, param)) 791 return TEE_ERROR_BAD_PARAMETERS; 792 793 ts_ctx = sess->ts_sess.ctx; 794 ta_ctx = ts_to_ta_ctx(ts_ctx); 795 796 tee_ta_set_busy(ta_ctx); 797 798 if (!ta_ctx->panicked) { 799 sess->param = param; 800 set_invoke_timeout(sess, cancel_req_to); 801 res = ts_ctx->ops->enter_invoke_cmd(&sess->ts_sess, cmd); 802 sess->param = NULL; 803 } 804 805 panicked = ta_ctx->panicked; 806 if (panicked) { 807 maybe_release_ta_ctx(ta_ctx); 808 res = TEE_ERROR_TARGET_DEAD; 809 } else { 810 if (IS_ENABLED(CFG_FTRACE_DUMP_EVERY_ENTRY)) 811 dump_ftrace(sess); 812 } 813 814 tee_ta_clear_busy(ta_ctx); 815 816 /* 817 * Origin error equal to TEE_ORIGIN_TRUSTED_APP for "regular" error, 818 * apart from panicking. 819 */ 820 if (panicked) 821 *err = TEE_ORIGIN_TEE; 822 else 823 *err = sess->err_origin; 824 825 /* Short buffer is not an effective error case */ 826 if (res != TEE_SUCCESS && res != TEE_ERROR_SHORT_BUFFER) 827 DMSG("Error: %x of %d", res, *err); 828 829 return res; 830 } 831 832 #if defined(CFG_TA_STATS) 833 static TEE_Result dump_ta_memstats(struct tee_ta_session *s, 834 struct tee_ta_param *param) 835 { 836 TEE_Result res = TEE_SUCCESS; 837 struct tee_ta_ctx *ctx = NULL; 838 struct ts_ctx *ts_ctx = NULL; 839 bool panicked = false; 840 841 ts_ctx = s->ts_sess.ctx; 842 if (!ts_ctx) 843 return TEE_ERROR_ITEM_NOT_FOUND; 844 845 ctx = ts_to_ta_ctx(ts_ctx); 846 847 if (ctx->is_initializing) 848 return TEE_ERROR_BAD_STATE; 849 850 if (tee_ta_try_set_busy(ctx)) { 851 if (!ctx->panicked) { 852 s->param = param; 853 set_invoke_timeout(s, TEE_TIMEOUT_INFINITE); 854 res = ts_ctx->ops->dump_mem_stats(&s->ts_sess); 855 s->param = NULL; 856 } 857 858 panicked = ctx->panicked; 859 if (panicked) { 860 maybe_release_ta_ctx(ctx); 861 res = TEE_ERROR_TARGET_DEAD; 862 } 863 864 tee_ta_clear_busy(ctx); 865 } else { 866 /* Deadlock avoided */ 867 res = TEE_ERROR_BUSY; 868 } 869 870 return res; 871 } 872 873 static void init_dump_ctx(struct tee_ta_dump_ctx *dump_ctx) 874 { 875 struct tee_ta_session *sess = NULL; 876 struct tee_ta_session_head *open_sessions = NULL; 877 struct tee_ta_ctx *ctx = NULL; 878 unsigned int n = 0; 879 880 nsec_sessions_list_head(&open_sessions); 881 /* 882 * Scan all sessions opened from secure side by searching through 883 * all available TA instances and for each context, scan all opened 884 * sessions. 885 */ 886 TAILQ_FOREACH(ctx, &tee_ctxes, link) { 887 unsigned int cnt = 0; 888 889 if (!is_user_ta_ctx(&ctx->ts_ctx)) 890 continue; 891 892 memcpy(&dump_ctx[n].uuid, &ctx->ts_ctx.uuid, 893 sizeof(ctx->ts_ctx.uuid)); 894 dump_ctx[n].panicked = ctx->panicked; 895 dump_ctx[n].is_user_ta = is_user_ta_ctx(&ctx->ts_ctx); 896 TAILQ_FOREACH(sess, open_sessions, link) { 897 if (sess->ts_sess.ctx == &ctx->ts_ctx) { 898 if (cnt == MAX_DUMP_SESS_NUM) 899 break; 900 901 dump_ctx[n].sess_id[cnt] = sess->id; 902 cnt++; 903 } 904 } 905 906 dump_ctx[n].sess_num = cnt; 907 n++; 908 } 909 } 910 911 static TEE_Result dump_ta_stats(struct tee_ta_dump_ctx *dump_ctx, 912 struct pta_stats_ta *dump_stats, 913 size_t ta_count) 914 { 915 TEE_Result res = TEE_SUCCESS; 916 struct tee_ta_session *sess = NULL; 917 struct tee_ta_session_head *open_sessions = NULL; 918 struct tee_ta_param param = { }; 919 unsigned int i = 0; 920 unsigned int j = 0; 921 922 nsec_sessions_list_head(&open_sessions); 923 924 for (i = 0; i < ta_count; i++) { 925 struct pta_stats_ta *stats = &dump_stats[i]; 926 927 memcpy(&stats->uuid, &dump_ctx[i].uuid, 928 sizeof(dump_ctx[i].uuid)); 929 stats->panicked = dump_ctx[i].panicked; 930 stats->sess_num = dump_ctx[i].sess_num; 931 932 /* Find a session from dump context */ 933 for (j = 0, sess = NULL; j < dump_ctx[i].sess_num && !sess; j++) 934 sess = tee_ta_get_session(dump_ctx[i].sess_id[j], true, 935 open_sessions); 936 937 if (!sess) 938 continue; 939 /* If session is existing, get its heap stats */ 940 memset(¶m, 0, sizeof(struct tee_ta_param)); 941 param.types = TEE_PARAM_TYPES(TEE_PARAM_TYPE_VALUE_OUTPUT, 942 TEE_PARAM_TYPE_VALUE_OUTPUT, 943 TEE_PARAM_TYPE_VALUE_OUTPUT, 944 TEE_PARAM_TYPE_NONE); 945 res = dump_ta_memstats(sess, ¶m); 946 if (res == TEE_SUCCESS) { 947 stats->heap.allocated = param.u[0].val.a; 948 stats->heap.max_allocated = param.u[0].val.b; 949 stats->heap.size = param.u[1].val.a; 950 stats->heap.num_alloc_fail = param.u[1].val.b; 951 stats->heap.biggest_alloc_fail = param.u[2].val.a; 952 stats->heap.biggest_alloc_fail_used = param.u[2].val.b; 953 } else { 954 memset(&stats->heap, 0, sizeof(stats->heap)); 955 } 956 tee_ta_put_session(sess); 957 } 958 959 return TEE_SUCCESS; 960 } 961 962 TEE_Result tee_ta_instance_stats(void *buf, size_t *buf_size) 963 { 964 TEE_Result res = TEE_SUCCESS; 965 struct pta_stats_ta *dump_stats = NULL; 966 struct tee_ta_dump_ctx *dump_ctx = NULL; 967 struct tee_ta_ctx *ctx = NULL; 968 size_t sz = 0; 969 size_t ta_count = 0; 970 971 if (!buf_size) 972 return TEE_ERROR_BAD_PARAMETERS; 973 974 mutex_lock(&tee_ta_mutex); 975 976 /* Go through all available TA and calc out the actual buffer size. */ 977 TAILQ_FOREACH(ctx, &tee_ctxes, link) 978 if (is_user_ta_ctx(&ctx->ts_ctx)) 979 ta_count++; 980 981 sz = sizeof(struct pta_stats_ta) * ta_count; 982 if (!sz) { 983 /* sz = 0 means there is no UTA, return no item found. */ 984 res = TEE_ERROR_ITEM_NOT_FOUND; 985 } else if (!buf || *buf_size < sz) { 986 /* 987 * buf is null or pass size less than actual size 988 * means caller try to query the buffer size. 989 * update *buf_size. 990 */ 991 *buf_size = sz; 992 res = TEE_ERROR_SHORT_BUFFER; 993 } else if (!IS_ALIGNED_WITH_TYPE(buf, uint32_t)) { 994 DMSG("Data alignment"); 995 res = TEE_ERROR_BAD_PARAMETERS; 996 } else { 997 dump_stats = (struct pta_stats_ta *)buf; 998 dump_ctx = malloc(sizeof(struct tee_ta_dump_ctx) * ta_count); 999 if (!dump_ctx) 1000 res = TEE_ERROR_OUT_OF_MEMORY; 1001 else 1002 init_dump_ctx(dump_ctx); 1003 } 1004 mutex_unlock(&tee_ta_mutex); 1005 1006 if (res != TEE_SUCCESS) 1007 return res; 1008 1009 /* Dump user ta stats by iterating dump_ctx[] */ 1010 res = dump_ta_stats(dump_ctx, dump_stats, ta_count); 1011 if (res == TEE_SUCCESS) 1012 *buf_size = sz; 1013 1014 free(dump_ctx); 1015 return res; 1016 } 1017 #endif 1018 1019 TEE_Result tee_ta_cancel_command(TEE_ErrorOrigin *err, 1020 struct tee_ta_session *sess, 1021 const TEE_Identity *clnt_id) 1022 { 1023 *err = TEE_ORIGIN_TEE; 1024 1025 if (check_client(sess, clnt_id) != TEE_SUCCESS) 1026 return TEE_ERROR_BAD_PARAMETERS; /* intentional generic error */ 1027 1028 sess->cancel = true; 1029 return TEE_SUCCESS; 1030 } 1031 1032 bool tee_ta_session_is_cancelled(struct tee_ta_session *s, TEE_Time *curr_time) 1033 { 1034 TEE_Time current_time; 1035 1036 if (s->cancel_mask) 1037 return false; 1038 1039 if (s->cancel) 1040 return true; 1041 1042 if (s->cancel_time.seconds == UINT32_MAX) 1043 return false; 1044 1045 if (curr_time != NULL) 1046 current_time = *curr_time; 1047 else if (tee_time_get_sys_time(¤t_time) != TEE_SUCCESS) 1048 return false; 1049 1050 if (current_time.seconds > s->cancel_time.seconds || 1051 (current_time.seconds == s->cancel_time.seconds && 1052 current_time.millis >= s->cancel_time.millis)) { 1053 return true; 1054 } 1055 1056 return false; 1057 } 1058 1059 #if defined(CFG_TA_GPROF_SUPPORT) 1060 void tee_ta_gprof_sample_pc(vaddr_t pc) 1061 { 1062 struct ts_session *s = ts_get_current_session(); 1063 struct user_ta_ctx *utc = NULL; 1064 struct sample_buf *sbuf = NULL; 1065 TEE_Result res = 0; 1066 size_t idx = 0; 1067 1068 sbuf = s->sbuf; 1069 if (!sbuf || !sbuf->enabled) 1070 return; /* PC sampling is not enabled */ 1071 1072 idx = (((uint64_t)pc - sbuf->offset)/2 * sbuf->scale)/65536; 1073 if (idx < sbuf->nsamples) { 1074 utc = to_user_ta_ctx(s->ctx); 1075 res = vm_check_access_rights(&utc->uctx, 1076 TEE_MEMORY_ACCESS_READ | 1077 TEE_MEMORY_ACCESS_WRITE | 1078 TEE_MEMORY_ACCESS_ANY_OWNER, 1079 (uaddr_t)&sbuf->samples[idx], 1080 sizeof(*sbuf->samples)); 1081 if (res != TEE_SUCCESS) 1082 return; 1083 sbuf->samples[idx]++; 1084 } 1085 sbuf->count++; 1086 } 1087 1088 static void gprof_update_session_utime(bool suspend, struct ts_session *s, 1089 uint64_t now) 1090 { 1091 struct sample_buf *sbuf = s->sbuf; 1092 1093 if (!sbuf) 1094 return; 1095 1096 if (suspend) { 1097 assert(sbuf->usr_entered); 1098 sbuf->usr += now - sbuf->usr_entered; 1099 sbuf->usr_entered = 0; 1100 } else { 1101 assert(!sbuf->usr_entered); 1102 if (!now) 1103 now++; /* 0 is reserved */ 1104 sbuf->usr_entered = now; 1105 } 1106 } 1107 1108 /* 1109 * Update user-mode CPU time for the current session 1110 * @suspend: true if session is being suspended (leaving user mode), false if 1111 * it is resumed (entering user mode) 1112 */ 1113 static void tee_ta_update_session_utime(bool suspend) 1114 { 1115 struct ts_session *s = ts_get_current_session(); 1116 uint64_t now = barrier_read_counter_timer(); 1117 1118 gprof_update_session_utime(suspend, s, now); 1119 } 1120 1121 void tee_ta_update_session_utime_suspend(void) 1122 { 1123 tee_ta_update_session_utime(true); 1124 } 1125 1126 void tee_ta_update_session_utime_resume(void) 1127 { 1128 tee_ta_update_session_utime(false); 1129 } 1130 #endif 1131 1132 #if defined(CFG_FTRACE_SUPPORT) 1133 static void ftrace_update_times(bool suspend) 1134 { 1135 struct ts_session *s = ts_get_current_session_may_fail(); 1136 struct ftrace_buf *fbuf = NULL; 1137 TEE_Result res = TEE_SUCCESS; 1138 uint64_t now = 0; 1139 uint32_t i = 0; 1140 1141 if (!s) 1142 return; 1143 1144 now = barrier_read_counter_timer(); 1145 1146 fbuf = s->fbuf; 1147 if (!fbuf) 1148 return; 1149 1150 res = vm_check_access_rights(to_user_mode_ctx(s->ctx), 1151 TEE_MEMORY_ACCESS_WRITE | 1152 TEE_MEMORY_ACCESS_ANY_OWNER, 1153 (uaddr_t)fbuf, sizeof(*fbuf)); 1154 if (res) 1155 return; 1156 1157 if (suspend) { 1158 fbuf->suspend_time = now; 1159 } else { 1160 for (i = 0; i <= fbuf->ret_idx; i++) 1161 fbuf->begin_time[i] += now - fbuf->suspend_time; 1162 } 1163 } 1164 1165 void tee_ta_ftrace_update_times_suspend(void) 1166 { 1167 ftrace_update_times(true); 1168 } 1169 1170 void tee_ta_ftrace_update_times_resume(void) 1171 { 1172 ftrace_update_times(false); 1173 } 1174 #endif 1175 1176 bool __noprof is_ta_ctx(struct ts_ctx *ctx) 1177 { 1178 return is_user_ta_ctx(ctx) || is_pseudo_ta_ctx(ctx); 1179 } 1180