1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2019-2021, Linaro Limited 4 */ 5 6 #include <config.h> 7 #include <crypto/crypto.h> 8 #include <crypto/internal_aes-gcm.h> 9 #include <initcall.h> 10 #include <kernel/boot.h> 11 #include <kernel/panic.h> 12 #include <mm/core_memprot.h> 13 #include <mm/core_mmu.h> 14 #include <mm/fobj.h> 15 #include <mm/tee_mm.h> 16 #include <stdlib.h> 17 #include <string.h> 18 #include <tee_api_types.h> 19 #include <types_ext.h> 20 #include <util.h> 21 22 #ifdef CFG_WITH_PAGER 23 24 #define RWP_AE_KEY_BITS 256 25 26 struct rwp_aes_gcm_iv { 27 uint32_t iv[3]; 28 }; 29 30 #define RWP_AES_GCM_TAG_LEN 16 31 32 struct rwp_state { 33 uint64_t iv; 34 uint8_t tag[RWP_AES_GCM_TAG_LEN]; 35 }; 36 37 /* 38 * Note that this struct is padded to a size which is a power of 2, this 39 * guarantees that this state will not span two pages. This avoids a corner 40 * case in the pager when making the state available. 41 */ 42 struct rwp_state_padded { 43 struct rwp_state state; 44 uint64_t pad; 45 }; 46 47 struct fobj_rwp_unpaged_iv { 48 uint8_t *store; 49 struct rwp_state *state; 50 struct fobj fobj; 51 }; 52 53 struct fobj_rwp_paged_iv { 54 size_t idx; 55 struct fobj fobj; 56 }; 57 58 static const struct fobj_ops ops_rwp_paged_iv; 59 static const struct fobj_ops ops_rwp_unpaged_iv; 60 61 static struct internal_aes_gcm_key rwp_ae_key; 62 63 static struct rwp_state_padded *rwp_state_base; 64 static uint8_t *rwp_store_base; 65 66 static void fobj_init(struct fobj *fobj, const struct fobj_ops *ops, 67 unsigned int num_pages) 68 { 69 fobj->ops = ops; 70 fobj->num_pages = num_pages; 71 refcount_set(&fobj->refc, 1); 72 TAILQ_INIT(&fobj->regions); 73 } 74 75 static void fobj_uninit(struct fobj *fobj) 76 { 77 assert(!refcount_val(&fobj->refc)); 78 assert(TAILQ_EMPTY(&fobj->regions)); 79 tee_pager_invalidate_fobj(fobj); 80 } 81 82 static TEE_Result rwp_load_page(void *va, struct rwp_state *state, 83 const uint8_t *src) 84 { 85 struct rwp_aes_gcm_iv iv = { 86 .iv = { (vaddr_t)state, state->iv >> 32, state->iv } 87 }; 88 89 if (!state->iv) { 90 /* 91 * IV still zero which means that this is previously unused 92 * page. 93 */ 94 memset(va, 0, SMALL_PAGE_SIZE); 95 return TEE_SUCCESS; 96 } 97 98 return internal_aes_gcm_dec(&rwp_ae_key, &iv, sizeof(iv), 99 NULL, 0, src, SMALL_PAGE_SIZE, va, 100 state->tag, sizeof(state->tag)); 101 } 102 103 static TEE_Result rwp_save_page(const void *va, struct rwp_state *state, 104 uint8_t *dst) 105 { 106 size_t tag_len = sizeof(state->tag); 107 struct rwp_aes_gcm_iv iv = { }; 108 109 assert(state->iv + 1 > state->iv); 110 111 state->iv++; 112 113 /* 114 * IV is constructed as recommended in section "8.2.1 Deterministic 115 * Construction" of "Recommendation for Block Cipher Modes of 116 * Operation: Galois/Counter Mode (GCM) and GMAC", 117 * http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf 118 */ 119 iv.iv[0] = (vaddr_t)state; 120 iv.iv[1] = state->iv >> 32; 121 iv.iv[2] = state->iv; 122 123 return internal_aes_gcm_enc(&rwp_ae_key, &iv, sizeof(iv), 124 NULL, 0, va, SMALL_PAGE_SIZE, dst, 125 state->tag, &tag_len); 126 } 127 128 static struct rwp_state_padded *idx_to_state_padded(size_t idx) 129 { 130 assert(rwp_state_base); 131 return rwp_state_base + idx; 132 } 133 134 static uint8_t *idx_to_store(size_t idx) 135 { 136 assert(rwp_store_base); 137 return rwp_store_base + idx * SMALL_PAGE_SIZE; 138 } 139 140 static struct fobj *rwp_paged_iv_alloc(unsigned int num_pages) 141 { 142 struct fobj_rwp_paged_iv *rwp = NULL; 143 tee_mm_entry_t *mm = NULL; 144 size_t size = 0; 145 146 COMPILE_TIME_ASSERT(IS_POWER_OF_TWO(sizeof(struct rwp_state_padded))); 147 148 rwp = calloc(1, sizeof(*rwp)); 149 if (!rwp) 150 return NULL; 151 152 if (MUL_OVERFLOW(num_pages, SMALL_PAGE_SIZE, &size)) 153 goto err; 154 mm = tee_mm_alloc(&tee_mm_sec_ddr, size); 155 if (!mm) 156 goto err; 157 rwp->idx = (tee_mm_get_smem(mm) - tee_mm_sec_ddr.lo) / SMALL_PAGE_SIZE; 158 159 memset(idx_to_state_padded(rwp->idx), 0, 160 num_pages * sizeof(struct rwp_state_padded)); 161 162 fobj_init(&rwp->fobj, &ops_rwp_paged_iv, num_pages); 163 164 return &rwp->fobj; 165 err: 166 tee_mm_free(mm); 167 free(rwp); 168 169 return NULL; 170 } 171 172 static struct fobj_rwp_paged_iv *to_rwp_paged_iv(struct fobj *fobj) 173 { 174 assert(fobj->ops == &ops_rwp_paged_iv); 175 176 return container_of(fobj, struct fobj_rwp_paged_iv, fobj); 177 } 178 179 static TEE_Result rwp_paged_iv_load_page(struct fobj *fobj, 180 unsigned int page_idx, void *va) 181 { 182 struct fobj_rwp_paged_iv *rwp = to_rwp_paged_iv(fobj); 183 uint8_t *src = idx_to_store(rwp->idx) + page_idx * SMALL_PAGE_SIZE; 184 struct rwp_state_padded *st = idx_to_state_padded(rwp->idx + page_idx); 185 186 assert(refcount_val(&fobj->refc)); 187 assert(page_idx < fobj->num_pages); 188 189 return rwp_load_page(va, &st->state, src); 190 } 191 DECLARE_KEEP_PAGER(rwp_paged_iv_load_page); 192 193 static TEE_Result rwp_paged_iv_save_page(struct fobj *fobj, 194 unsigned int page_idx, const void *va) 195 { 196 struct fobj_rwp_paged_iv *rwp = to_rwp_paged_iv(fobj); 197 uint8_t *dst = idx_to_store(rwp->idx) + page_idx * SMALL_PAGE_SIZE; 198 struct rwp_state_padded *st = idx_to_state_padded(rwp->idx + page_idx); 199 200 assert(page_idx < fobj->num_pages); 201 202 if (!refcount_val(&fobj->refc)) { 203 /* 204 * This fobj is being teared down, it just hasn't had the time 205 * to call tee_pager_invalidate_fobj() yet. 206 */ 207 assert(TAILQ_EMPTY(&fobj->regions)); 208 return TEE_SUCCESS; 209 } 210 211 return rwp_save_page(va, &st->state, dst); 212 } 213 DECLARE_KEEP_PAGER(rwp_paged_iv_save_page); 214 215 static void rwp_paged_iv_free(struct fobj *fobj) 216 { 217 struct fobj_rwp_paged_iv *rwp = to_rwp_paged_iv(fobj); 218 paddr_t pa = rwp->idx * SMALL_PAGE_SIZE + tee_mm_sec_ddr.lo; 219 tee_mm_entry_t *mm = tee_mm_find(&tee_mm_sec_ddr, pa); 220 221 assert(mm); 222 223 fobj_uninit(fobj); 224 tee_mm_free(mm); 225 free(rwp); 226 } 227 228 static vaddr_t rwp_paged_iv_get_iv_vaddr(struct fobj *fobj, 229 unsigned int page_idx) 230 { 231 struct fobj_rwp_paged_iv *rwp = to_rwp_paged_iv(fobj); 232 struct rwp_state_padded *st = idx_to_state_padded(rwp->idx + page_idx); 233 234 assert(page_idx < fobj->num_pages); 235 return (vaddr_t)&st->state & ~SMALL_PAGE_MASK; 236 } 237 DECLARE_KEEP_PAGER(rwp_paged_iv_get_iv_vaddr); 238 239 static const struct fobj_ops ops_rwp_paged_iv 240 __rodata_unpaged("ops_rwp_paged_iv") = { 241 .free = rwp_paged_iv_free, 242 .load_page = rwp_paged_iv_load_page, 243 .save_page = rwp_paged_iv_save_page, 244 .get_iv_vaddr = rwp_paged_iv_get_iv_vaddr, 245 }; 246 247 static struct fobj *rwp_unpaged_iv_alloc(unsigned int num_pages) 248 { 249 struct fobj_rwp_unpaged_iv *rwp = NULL; 250 tee_mm_entry_t *mm = NULL; 251 size_t size = 0; 252 253 rwp = calloc(1, sizeof(*rwp)); 254 if (!rwp) 255 return NULL; 256 257 rwp->state = calloc(num_pages, sizeof(*rwp->state)); 258 if (!rwp->state) 259 goto err_free_rwp; 260 261 if (MUL_OVERFLOW(num_pages, SMALL_PAGE_SIZE, &size)) 262 goto err_free_state; 263 mm = tee_mm_alloc(&tee_mm_sec_ddr, size); 264 if (!mm) 265 goto err_free_state; 266 rwp->store = phys_to_virt(tee_mm_get_smem(mm), MEM_AREA_TA_RAM); 267 assert(rwp->store); 268 269 fobj_init(&rwp->fobj, &ops_rwp_unpaged_iv, num_pages); 270 271 return &rwp->fobj; 272 273 err_free_state: 274 free(rwp->state); 275 err_free_rwp: 276 free(rwp); 277 return NULL; 278 } 279 280 static struct fobj_rwp_unpaged_iv *to_rwp_unpaged_iv(struct fobj *fobj) 281 { 282 assert(fobj->ops == &ops_rwp_unpaged_iv); 283 284 return container_of(fobj, struct fobj_rwp_unpaged_iv, fobj); 285 } 286 287 static TEE_Result rwp_unpaged_iv_load_page(struct fobj *fobj, 288 unsigned int page_idx, void *va) 289 { 290 struct fobj_rwp_unpaged_iv *rwp = to_rwp_unpaged_iv(fobj); 291 uint8_t *src = rwp->store + page_idx * SMALL_PAGE_SIZE; 292 293 assert(refcount_val(&fobj->refc)); 294 assert(page_idx < fobj->num_pages); 295 296 return rwp_load_page(va, rwp->state + page_idx, src); 297 } 298 DECLARE_KEEP_PAGER(rwp_unpaged_iv_load_page); 299 300 static TEE_Result rwp_unpaged_iv_save_page(struct fobj *fobj, 301 unsigned int page_idx, 302 const void *va) 303 { 304 struct fobj_rwp_unpaged_iv *rwp = to_rwp_unpaged_iv(fobj); 305 uint8_t *dst = rwp->store + page_idx * SMALL_PAGE_SIZE; 306 307 assert(page_idx < fobj->num_pages); 308 309 if (!refcount_val(&fobj->refc)) { 310 /* 311 * This fobj is being teared down, it just hasn't had the time 312 * to call tee_pager_invalidate_fobj() yet. 313 */ 314 assert(TAILQ_EMPTY(&fobj->regions)); 315 return TEE_SUCCESS; 316 } 317 318 return rwp_save_page(va, rwp->state + page_idx, dst); 319 } 320 DECLARE_KEEP_PAGER(rwp_unpaged_iv_save_page); 321 322 static void rwp_unpaged_iv_free(struct fobj *fobj) 323 { 324 struct fobj_rwp_unpaged_iv *rwp = NULL; 325 tee_mm_entry_t *mm = NULL; 326 327 if (IS_ENABLED(CFG_CORE_PAGE_TAG_AND_IV)) 328 panic(); 329 330 rwp = to_rwp_unpaged_iv(fobj); 331 mm = tee_mm_find(&tee_mm_sec_ddr, virt_to_phys(rwp->store)); 332 333 assert(mm); 334 335 fobj_uninit(fobj); 336 tee_mm_free(mm); 337 free(rwp->state); 338 free(rwp); 339 } 340 341 static const struct fobj_ops ops_rwp_unpaged_iv 342 __rodata_unpaged("ops_rwp_unpaged_iv") = { 343 .free = rwp_unpaged_iv_free, 344 .load_page = rwp_unpaged_iv_load_page, 345 .save_page = rwp_unpaged_iv_save_page, 346 }; 347 348 static TEE_Result rwp_init(void) 349 { 350 uint8_t key[RWP_AE_KEY_BITS / 8] = { 0 }; 351 struct fobj *fobj = NULL; 352 size_t num_pool_pages = 0; 353 size_t num_fobj_pages = 0; 354 size_t sz = 0; 355 356 if (crypto_rng_read(key, sizeof(key)) != TEE_SUCCESS) 357 panic("failed to generate random"); 358 if (crypto_aes_expand_enc_key(key, sizeof(key), rwp_ae_key.data, 359 sizeof(rwp_ae_key.data), 360 &rwp_ae_key.rounds)) 361 panic("failed to expand key"); 362 363 if (!IS_ENABLED(CFG_CORE_PAGE_TAG_AND_IV)) 364 return TEE_SUCCESS; 365 366 assert(tee_mm_sec_ddr.hi > tee_mm_sec_ddr.lo); 367 sz = tee_mm_sec_ddr.hi - tee_mm_sec_ddr.lo; 368 assert(!(sz & SMALL_PAGE_SIZE)); 369 370 num_pool_pages = sz / SMALL_PAGE_SIZE; 371 num_fobj_pages = ROUNDUP(num_pool_pages * sizeof(*rwp_state_base), 372 SMALL_PAGE_SIZE) / SMALL_PAGE_SIZE; 373 374 /* 375 * Each page in the pool needs a struct rwp_state. 376 * 377 * This isn't entirely true, the pages not used by 378 * fobj_rw_paged_alloc() don't need any. A future optimization 379 * may try to avoid allocating for such pages. 380 */ 381 fobj = rwp_unpaged_iv_alloc(num_fobj_pages); 382 if (!fobj) 383 panic(); 384 385 rwp_state_base = (void *)tee_pager_init_iv_region(fobj); 386 assert(rwp_state_base); 387 388 rwp_store_base = phys_to_virt(tee_mm_sec_ddr.lo, MEM_AREA_TA_RAM); 389 assert(rwp_store_base); 390 391 return TEE_SUCCESS; 392 } 393 driver_init_late(rwp_init); 394 395 struct fobj *fobj_rw_paged_alloc(unsigned int num_pages) 396 { 397 assert(num_pages); 398 399 if (IS_ENABLED(CFG_CORE_PAGE_TAG_AND_IV)) 400 return rwp_paged_iv_alloc(num_pages); 401 else 402 return rwp_unpaged_iv_alloc(num_pages); 403 } 404 405 struct fobj_rop { 406 uint8_t *hashes; 407 uint8_t *store; 408 struct fobj fobj; 409 }; 410 411 static const struct fobj_ops ops_ro_paged; 412 413 static void rop_init(struct fobj_rop *rop, const struct fobj_ops *ops, 414 unsigned int num_pages, void *hashes, void *store) 415 { 416 rop->hashes = hashes; 417 rop->store = store; 418 fobj_init(&rop->fobj, ops, num_pages); 419 } 420 421 struct fobj *fobj_ro_paged_alloc(unsigned int num_pages, void *hashes, 422 void *store) 423 { 424 struct fobj_rop *rop = NULL; 425 426 assert(num_pages && hashes && store); 427 428 rop = calloc(1, sizeof(*rop)); 429 if (!rop) 430 return NULL; 431 432 rop_init(rop, &ops_ro_paged, num_pages, hashes, store); 433 434 return &rop->fobj; 435 } 436 437 static struct fobj_rop *to_rop(struct fobj *fobj) 438 { 439 assert(fobj->ops == &ops_ro_paged); 440 441 return container_of(fobj, struct fobj_rop, fobj); 442 } 443 444 static void rop_uninit(struct fobj_rop *rop) 445 { 446 fobj_uninit(&rop->fobj); 447 tee_mm_free(tee_mm_find(&tee_mm_sec_ddr, virt_to_phys(rop->store))); 448 free(rop->hashes); 449 } 450 451 static void rop_free(struct fobj *fobj) 452 { 453 struct fobj_rop *rop = to_rop(fobj); 454 455 rop_uninit(rop); 456 free(rop); 457 } 458 459 static TEE_Result rop_load_page_helper(struct fobj_rop *rop, 460 unsigned int page_idx, void *va) 461 { 462 const uint8_t *hash = rop->hashes + page_idx * TEE_SHA256_HASH_SIZE; 463 const uint8_t *src = rop->store + page_idx * SMALL_PAGE_SIZE; 464 465 assert(refcount_val(&rop->fobj.refc)); 466 assert(page_idx < rop->fobj.num_pages); 467 memcpy(va, src, SMALL_PAGE_SIZE); 468 469 return hash_sha256_check(hash, va, SMALL_PAGE_SIZE); 470 } 471 472 static TEE_Result rop_load_page(struct fobj *fobj, unsigned int page_idx, 473 void *va) 474 { 475 return rop_load_page_helper(to_rop(fobj), page_idx, va); 476 } 477 DECLARE_KEEP_PAGER(rop_load_page); 478 479 static TEE_Result rop_save_page(struct fobj *fobj __unused, 480 unsigned int page_idx __unused, 481 const void *va __unused) 482 { 483 return TEE_ERROR_GENERIC; 484 } 485 DECLARE_KEEP_PAGER(rop_save_page); 486 487 static const struct fobj_ops ops_ro_paged __rodata_unpaged("ops_ro_paged") = { 488 .free = rop_free, 489 .load_page = rop_load_page, 490 .save_page = rop_save_page, 491 }; 492 493 #ifdef CFG_CORE_ASLR 494 /* 495 * When using relocated pages the relocation information must be applied 496 * before the pages can be used. With read-only paging the content is only 497 * integrity protected so relocation cannot be applied on pages in the less 498 * secure "store" or the load_address selected by ASLR could be given away. 499 * This means that each time a page has been loaded and verified it has to 500 * have its relocation information applied before it can be used. 501 * 502 * Only the relative relocations are supported, this allows a rather compact 503 * represenation of the needed relocation information in this struct. 504 * r_offset is replaced with the offset into the page that need to be updated, 505 * this number can never be larger than SMALL_PAGE_SIZE so a uint16_t can be 506 * used to represent it. 507 * 508 * All relocations are converted and stored in @relocs. @page_reloc_idx is 509 * an array of length @rop.fobj.num_pages with an entry for each page. If 510 * @page_reloc_idx[page_idx] isn't UINT16_MAX it's an index into @relocs. 511 */ 512 struct fobj_ro_reloc_paged { 513 uint16_t *page_reloc_idx; 514 uint16_t *relocs; 515 unsigned int num_relocs; 516 struct fobj_rop rop; 517 }; 518 519 static const struct fobj_ops ops_ro_reloc_paged; 520 521 static unsigned int get_num_rels(unsigned int num_pages, 522 unsigned int reloc_offs, 523 const uint32_t *reloc, unsigned int num_relocs) 524 { 525 const unsigned int align_mask __maybe_unused = sizeof(long) - 1; 526 unsigned int nrels = 0; 527 unsigned int n = 0; 528 vaddr_t offs = 0; 529 530 /* 531 * Count the number of relocations which are needed for these 532 * pages. Also check that the data is well formed, only expected 533 * relocations and sorted in order of address which it applies to. 534 */ 535 for (; n < num_relocs; n++) { 536 assert(ALIGNMENT_IS_OK(reloc[n], unsigned long)); 537 assert(offs < reloc[n]); /* check that it's sorted */ 538 offs = reloc[n]; 539 if (offs >= reloc_offs && 540 offs <= reloc_offs + num_pages * SMALL_PAGE_SIZE) 541 nrels++; 542 } 543 544 return nrels; 545 } 546 547 static void init_rels(struct fobj_ro_reloc_paged *rrp, unsigned int reloc_offs, 548 const uint32_t *reloc, unsigned int num_relocs) 549 { 550 unsigned int npg = rrp->rop.fobj.num_pages; 551 unsigned int pg_idx = 0; 552 unsigned int reln = 0; 553 unsigned int n = 0; 554 uint32_t r = 0; 555 556 for (n = 0; n < npg; n++) 557 rrp->page_reloc_idx[n] = UINT16_MAX; 558 559 for (n = 0; n < num_relocs ; n++) { 560 if (reloc[n] < reloc_offs) 561 continue; 562 563 /* r is the offset from beginning of this fobj */ 564 r = reloc[n] - reloc_offs; 565 566 pg_idx = r / SMALL_PAGE_SIZE; 567 if (pg_idx >= npg) 568 break; 569 570 if (rrp->page_reloc_idx[pg_idx] == UINT16_MAX) 571 rrp->page_reloc_idx[pg_idx] = reln; 572 rrp->relocs[reln] = r - pg_idx * SMALL_PAGE_SIZE; 573 reln++; 574 } 575 576 assert(reln == rrp->num_relocs); 577 } 578 579 struct fobj *fobj_ro_reloc_paged_alloc(unsigned int num_pages, void *hashes, 580 unsigned int reloc_offs, 581 const void *reloc, 582 unsigned int reloc_len, void *store) 583 { 584 struct fobj_ro_reloc_paged *rrp = NULL; 585 const unsigned int num_relocs = reloc_len / sizeof(uint32_t); 586 unsigned int nrels = 0; 587 588 assert(ALIGNMENT_IS_OK(reloc, uint32_t)); 589 assert(ALIGNMENT_IS_OK(reloc_len, uint32_t)); 590 assert(num_pages && hashes && store); 591 if (!reloc_len) { 592 assert(!reloc); 593 return fobj_ro_paged_alloc(num_pages, hashes, store); 594 } 595 assert(reloc); 596 597 nrels = get_num_rels(num_pages, reloc_offs, reloc, num_relocs); 598 if (!nrels) 599 return fobj_ro_paged_alloc(num_pages, hashes, store); 600 601 rrp = calloc(1, sizeof(*rrp) + num_pages * sizeof(uint16_t) + 602 nrels * sizeof(uint16_t)); 603 if (!rrp) 604 return NULL; 605 rop_init(&rrp->rop, &ops_ro_reloc_paged, num_pages, hashes, store); 606 rrp->page_reloc_idx = (uint16_t *)(rrp + 1); 607 rrp->relocs = rrp->page_reloc_idx + num_pages; 608 rrp->num_relocs = nrels; 609 init_rels(rrp, reloc_offs, reloc, num_relocs); 610 611 return &rrp->rop.fobj; 612 } 613 614 static struct fobj_ro_reloc_paged *to_rrp(struct fobj *fobj) 615 { 616 assert(fobj->ops == &ops_ro_reloc_paged); 617 618 return container_of(fobj, struct fobj_ro_reloc_paged, rop.fobj); 619 } 620 621 static void rrp_free(struct fobj *fobj) 622 { 623 struct fobj_ro_reloc_paged *rrp = to_rrp(fobj); 624 625 rop_uninit(&rrp->rop); 626 free(rrp); 627 } 628 629 static TEE_Result rrp_load_page(struct fobj *fobj, unsigned int page_idx, 630 void *va) 631 { 632 struct fobj_ro_reloc_paged *rrp = to_rrp(fobj); 633 unsigned int end_rel = rrp->num_relocs; 634 TEE_Result res = TEE_SUCCESS; 635 unsigned long *where = NULL; 636 unsigned int n = 0; 637 638 res = rop_load_page_helper(&rrp->rop, page_idx, va); 639 if (res) 640 return res; 641 642 /* Find the reloc index of the next page to tell when we're done */ 643 for (n = page_idx + 1; n < fobj->num_pages; n++) { 644 if (rrp->page_reloc_idx[n] != UINT16_MAX) { 645 end_rel = rrp->page_reloc_idx[n]; 646 break; 647 } 648 } 649 650 for (n = rrp->page_reloc_idx[page_idx]; n < end_rel; n++) { 651 where = (void *)((vaddr_t)va + rrp->relocs[n]); 652 *where += boot_mmu_config.load_offset; 653 } 654 655 return TEE_SUCCESS; 656 } 657 DECLARE_KEEP_PAGER(rrp_load_page); 658 659 static const struct fobj_ops ops_ro_reloc_paged 660 __rodata_unpaged("ops_ro_reloc_paged") = { 661 .free = rrp_free, 662 .load_page = rrp_load_page, 663 .save_page = rop_save_page, /* Direct reuse */ 664 }; 665 #endif /*CFG_CORE_ASLR*/ 666 667 static const struct fobj_ops ops_locked_paged; 668 669 struct fobj *fobj_locked_paged_alloc(unsigned int num_pages) 670 { 671 struct fobj *f = NULL; 672 673 assert(num_pages); 674 675 f = calloc(1, sizeof(*f)); 676 if (!f) 677 return NULL; 678 679 fobj_init(f, &ops_locked_paged, num_pages); 680 681 return f; 682 } 683 684 static void lop_free(struct fobj *fobj) 685 { 686 assert(fobj->ops == &ops_locked_paged); 687 fobj_uninit(fobj); 688 free(fobj); 689 } 690 691 static TEE_Result lop_load_page(struct fobj *fobj __maybe_unused, 692 unsigned int page_idx __maybe_unused, 693 void *va) 694 { 695 assert(fobj->ops == &ops_locked_paged); 696 assert(refcount_val(&fobj->refc)); 697 assert(page_idx < fobj->num_pages); 698 699 memset(va, 0, SMALL_PAGE_SIZE); 700 701 return TEE_SUCCESS; 702 } 703 DECLARE_KEEP_PAGER(lop_load_page); 704 705 static TEE_Result lop_save_page(struct fobj *fobj __unused, 706 unsigned int page_idx __unused, 707 const void *va __unused) 708 { 709 return TEE_ERROR_GENERIC; 710 } 711 DECLARE_KEEP_PAGER(lop_save_page); 712 713 static const struct fobj_ops ops_locked_paged 714 __rodata_unpaged("ops_locked_paged") = { 715 .free = lop_free, 716 .load_page = lop_load_page, 717 .save_page = lop_save_page, 718 }; 719 #endif /*CFG_WITH_PAGER*/ 720 721 #ifndef CFG_PAGED_USER_TA 722 723 struct fobj_sec_mem { 724 tee_mm_entry_t *mm; 725 struct fobj fobj; 726 }; 727 728 static const struct fobj_ops ops_sec_mem; 729 730 struct fobj *fobj_sec_mem_alloc(unsigned int num_pages) 731 { 732 struct fobj_sec_mem *f = calloc(1, sizeof(*f)); 733 size_t size = 0; 734 void *va = NULL; 735 736 if (!f) 737 return NULL; 738 739 if (MUL_OVERFLOW(num_pages, SMALL_PAGE_SIZE, &size)) 740 goto err; 741 742 f->mm = tee_mm_alloc(&tee_mm_sec_ddr, size); 743 if (!f->mm) 744 goto err; 745 746 va = phys_to_virt(tee_mm_get_smem(f->mm), MEM_AREA_TA_RAM); 747 if (!va) 748 goto err; 749 750 memset(va, 0, size); 751 f->fobj.ops = &ops_sec_mem; 752 f->fobj.num_pages = num_pages; 753 refcount_set(&f->fobj.refc, 1); 754 755 return &f->fobj; 756 err: 757 tee_mm_free(f->mm); 758 free(f); 759 760 return NULL; 761 } 762 763 static struct fobj_sec_mem *to_sec_mem(struct fobj *fobj) 764 { 765 assert(fobj->ops == &ops_sec_mem); 766 767 return container_of(fobj, struct fobj_sec_mem, fobj); 768 } 769 770 static void sec_mem_free(struct fobj *fobj) 771 { 772 struct fobj_sec_mem *f = to_sec_mem(fobj); 773 774 assert(!refcount_val(&fobj->refc)); 775 tee_mm_free(f->mm); 776 free(f); 777 } 778 779 static paddr_t sec_mem_get_pa(struct fobj *fobj, unsigned int page_idx) 780 { 781 struct fobj_sec_mem *f = to_sec_mem(fobj); 782 783 assert(refcount_val(&fobj->refc)); 784 assert(page_idx < fobj->num_pages); 785 786 return tee_mm_get_smem(f->mm) + page_idx * SMALL_PAGE_SIZE; 787 } 788 789 static const struct fobj_ops ops_sec_mem __rodata_unpaged("ops_sec_mem") = { 790 .free = sec_mem_free, 791 .get_pa = sec_mem_get_pa, 792 }; 793 794 #endif /*PAGED_USER_TA*/ 795