1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright (C) 2018 Linaro Limited
4 */
5 #include <common.h>
6 #include <dm.h>
7 #include <sandboxtee.h>
8 #include <tee.h>
9 #include <tee/optee_ta_avb.h>
10 #include <tee/optee_ta_rpc_test.h>
11
12 #include "optee/optee_msg.h"
13 #include "optee/optee_private.h"
14
15 /*
16 * The sandbox tee driver tries to emulate a generic Trusted Exectution
17 * Environment (TEE) with the Trusted Applications (TA) OPTEE_TA_AVB and
18 * OPTEE_TA_RPC_TEST available.
19 */
20
21 static const u32 pstorage_max = 16;
22 /**
23 * struct ta_entry - TA entries
24 * @uuid: UUID of an emulated TA
25 * @open_session Called when a session is openened to the TA
26 * @invoke_func Called when a function in the TA is to be invoked
27 *
28 * This struct is used to register TAs in this sandbox emulation of a TEE.
29 */
30 struct ta_entry {
31 struct tee_optee_ta_uuid uuid;
32 u32 (*open_session)(struct udevice *dev, uint num_params,
33 struct tee_param *params);
34 u32 (*invoke_func)(struct udevice *dev,
35 u32 func, uint num_params,
36 struct tee_param *params);
37 };
38
get_msg_arg(struct udevice * dev,uint num_params,struct tee_shm ** shmp,struct optee_msg_arg ** msg_arg)39 static int get_msg_arg(struct udevice *dev, uint num_params,
40 struct tee_shm **shmp, struct optee_msg_arg **msg_arg)
41 {
42 int rc;
43 struct optee_msg_arg *ma;
44
45 rc = __tee_shm_add(dev, OPTEE_MSG_NONCONTIG_PAGE_SIZE, NULL,
46 OPTEE_MSG_GET_ARG_SIZE(num_params), TEE_SHM_ALLOC,
47 shmp);
48 if (rc)
49 return rc;
50
51 ma = (*shmp)->addr;
52 memset(ma, 0, OPTEE_MSG_GET_ARG_SIZE(num_params));
53 ma->num_params = num_params;
54 *msg_arg = ma;
55
56 return 0;
57 }
58
optee_alloc_and_init_page_list(void * buf,ulong len,u64 * phys_buf_ptr)59 void *optee_alloc_and_init_page_list(void *buf, ulong len,
60 u64 *phys_buf_ptr)
61 {
62 /*
63 * An empty stub is added just to fix linking issues.
64 * This function isn't supposed to be called in sandbox
65 * setup, otherwise replace this with a proper
66 * implementation from optee/core.c
67 */
68 return NULL;
69 }
70
get_attr(uint n,uint num_params,struct tee_param * params)71 static u32 get_attr(uint n, uint num_params, struct tee_param *params)
72 {
73 if (n >= num_params)
74 return TEE_PARAM_ATTR_TYPE_NONE;
75
76 return params[n].attr;
77 }
78
check_params(u8 p0,u8 p1,u8 p2,u8 p3,uint num_params,struct tee_param * params)79 static u32 check_params(u8 p0, u8 p1, u8 p2, u8 p3, uint num_params,
80 struct tee_param *params)
81 {
82 u8 p[] = { p0, p1, p2, p3};
83 uint n;
84
85 for (n = 0; n < ARRAY_SIZE(p); n++)
86 if (p[n] != get_attr(n, num_params, params))
87 goto bad_params;
88
89 for (; n < num_params; n++)
90 if (get_attr(n, num_params, params))
91 goto bad_params;
92
93 return TEE_SUCCESS;
94
95 bad_params:
96 printf("Bad param attrs\n");
97
98 return TEE_ERROR_BAD_PARAMETERS;
99 }
100
101 #ifdef CONFIG_OPTEE_TA_AVB
ta_avb_open_session(struct udevice * dev,uint num_params,struct tee_param * params)102 static u32 ta_avb_open_session(struct udevice *dev, uint num_params,
103 struct tee_param *params)
104 {
105 /*
106 * We don't expect additional parameters when opening a session to
107 * this TA.
108 */
109 return check_params(TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
110 TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
111 num_params, params);
112 }
113
ta_avb_invoke_func(struct udevice * dev,u32 func,uint num_params,struct tee_param * params)114 static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
115 struct tee_param *params)
116 {
117 struct sandbox_tee_state *state = dev_get_priv(dev);
118 struct env_entry e, *ep;
119 char *name;
120 u32 res;
121 uint slot;
122 u64 val;
123 char *value;
124 u32 value_sz;
125
126 switch (func) {
127 case TA_AVB_CMD_READ_ROLLBACK_INDEX:
128 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
129 TEE_PARAM_ATTR_TYPE_VALUE_OUTPUT,
130 TEE_PARAM_ATTR_TYPE_NONE,
131 TEE_PARAM_ATTR_TYPE_NONE,
132 num_params, params);
133 if (res)
134 return res;
135
136 slot = params[0].u.value.a;
137 if (slot >= ARRAY_SIZE(state->ta_avb_rollback_indexes)) {
138 printf("Rollback index slot out of bounds %u\n", slot);
139 return TEE_ERROR_BAD_PARAMETERS;
140 }
141
142 val = state->ta_avb_rollback_indexes[slot];
143 params[1].u.value.a = val >> 32;
144 params[1].u.value.b = val;
145 return TEE_SUCCESS;
146
147 case TA_AVB_CMD_WRITE_ROLLBACK_INDEX:
148 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
149 TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
150 TEE_PARAM_ATTR_TYPE_NONE,
151 TEE_PARAM_ATTR_TYPE_NONE,
152 num_params, params);
153 if (res)
154 return res;
155
156 slot = params[0].u.value.a;
157 if (slot >= ARRAY_SIZE(state->ta_avb_rollback_indexes)) {
158 printf("Rollback index slot out of bounds %u\n", slot);
159 return TEE_ERROR_BAD_PARAMETERS;
160 }
161
162 val = (u64)params[1].u.value.a << 32 | params[1].u.value.b;
163 if (val < state->ta_avb_rollback_indexes[slot])
164 return TEE_ERROR_SECURITY;
165
166 state->ta_avb_rollback_indexes[slot] = val;
167 return TEE_SUCCESS;
168
169 case TA_AVB_CMD_READ_LOCK_STATE:
170 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_OUTPUT,
171 TEE_PARAM_ATTR_TYPE_NONE,
172 TEE_PARAM_ATTR_TYPE_NONE,
173 TEE_PARAM_ATTR_TYPE_NONE,
174 num_params, params);
175 if (res)
176 return res;
177
178 params[0].u.value.a = state->ta_avb_lock_state;
179 return TEE_SUCCESS;
180
181 case TA_AVB_CMD_WRITE_LOCK_STATE:
182 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
183 TEE_PARAM_ATTR_TYPE_NONE,
184 TEE_PARAM_ATTR_TYPE_NONE,
185 TEE_PARAM_ATTR_TYPE_NONE,
186 num_params, params);
187 if (res)
188 return res;
189
190 if (state->ta_avb_lock_state != params[0].u.value.a) {
191 state->ta_avb_lock_state = params[0].u.value.a;
192 memset(state->ta_avb_rollback_indexes, 0,
193 sizeof(state->ta_avb_rollback_indexes));
194 }
195
196 return TEE_SUCCESS;
197 case TA_AVB_CMD_READ_PERSIST_VALUE:
198 res = check_params(TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
199 TEE_PARAM_ATTR_TYPE_MEMREF_INOUT,
200 TEE_PARAM_ATTR_TYPE_NONE,
201 TEE_PARAM_ATTR_TYPE_NONE,
202 num_params, params);
203 if (res)
204 return res;
205
206 name = params[0].u.memref.shm->addr;
207
208 value = params[1].u.memref.shm->addr;
209 value_sz = params[1].u.memref.size;
210
211 e.key = name;
212 e.data = NULL;
213 hsearch_r(e, ENV_FIND, &ep, &state->pstorage_htab, 0);
214 if (!ep)
215 return TEE_ERROR_ITEM_NOT_FOUND;
216
217 value_sz = strlen(ep->data) + 1;
218 memcpy(value, ep->data, value_sz);
219
220 return TEE_SUCCESS;
221 case TA_AVB_CMD_WRITE_PERSIST_VALUE:
222 res = check_params(TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
223 TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
224 TEE_PARAM_ATTR_TYPE_NONE,
225 TEE_PARAM_ATTR_TYPE_NONE,
226 num_params, params);
227 if (res)
228 return res;
229
230 name = params[0].u.memref.shm->addr;
231
232 value = params[1].u.memref.shm->addr;
233 value_sz = params[1].u.memref.size;
234
235 e.key = name;
236 e.data = NULL;
237 hsearch_r(e, ENV_FIND, &ep, &state->pstorage_htab, 0);
238 if (ep)
239 hdelete_r(e.key, &state->pstorage_htab, 0);
240
241 e.key = name;
242 e.data = value;
243 hsearch_r(e, ENV_ENTER, &ep, &state->pstorage_htab, 0);
244 if (!ep)
245 return TEE_ERROR_OUT_OF_MEMORY;
246
247 return TEE_SUCCESS;
248
249 default:
250 return TEE_ERROR_NOT_SUPPORTED;
251 }
252 }
253 #endif /* OPTEE_TA_AVB */
254
255 #ifdef CONFIG_OPTEE_TA_RPC_TEST
ta_rpc_test_open_session(struct udevice * dev,uint num_params,struct tee_param * params)256 static u32 ta_rpc_test_open_session(struct udevice *dev, uint num_params,
257 struct tee_param *params)
258 {
259 /*
260 * We don't expect additional parameters when opening a session to
261 * this TA.
262 */
263 return check_params(TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
264 TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
265 num_params, params);
266 }
267
fill_i2c_rpc_params(struct optee_msg_arg * msg_arg,u64 bus_num,u64 chip_addr,u64 xfer_flags,u64 op,struct tee_param_memref memref)268 static void fill_i2c_rpc_params(struct optee_msg_arg *msg_arg, u64 bus_num,
269 u64 chip_addr, u64 xfer_flags, u64 op,
270 struct tee_param_memref memref)
271 {
272 msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
273 msg_arg->params[1].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
274 msg_arg->params[2].attr = OPTEE_MSG_ATTR_TYPE_RMEM_INOUT;
275 msg_arg->params[3].attr = OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT;
276
277 /* trigger I2C services of TEE supplicant */
278 msg_arg->cmd = OPTEE_MSG_RPC_CMD_I2C_TRANSFER;
279
280 msg_arg->params[0].u.value.a = op;
281 msg_arg->params[0].u.value.b = bus_num;
282 msg_arg->params[0].u.value.c = chip_addr;
283 msg_arg->params[1].u.value.a = xfer_flags;
284
285 /* buffer to read/write data */
286 msg_arg->params[2].u.rmem.shm_ref = (ulong)memref.shm;
287 msg_arg->params[2].u.rmem.size = memref.size;
288 msg_arg->params[2].u.rmem.offs = memref.shm_offs;
289
290 msg_arg->num_params = 4;
291 }
292
ta_rpc_test_invoke_func(struct udevice * dev,u32 func,uint num_params,struct tee_param * params)293 static u32 ta_rpc_test_invoke_func(struct udevice *dev, u32 func,
294 uint num_params,
295 struct tee_param *params)
296 {
297 struct tee_shm *shm;
298 struct tee_param_memref memref_data;
299 struct optee_msg_arg *msg_arg;
300 int chip_addr, bus_num, op, xfer_flags;
301 int res;
302
303 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
304 TEE_PARAM_ATTR_TYPE_MEMREF_INOUT,
305 TEE_PARAM_ATTR_TYPE_NONE,
306 TEE_PARAM_ATTR_TYPE_NONE,
307 num_params, params);
308 if (res)
309 return TEE_ERROR_BAD_PARAMETERS;
310
311 bus_num = params[0].u.value.a;
312 chip_addr = params[0].u.value.b;
313 xfer_flags = params[0].u.value.c;
314 memref_data = params[1].u.memref;
315
316 switch (func) {
317 case TA_RPC_TEST_CMD_I2C_READ:
318 op = OPTEE_MSG_RPC_CMD_I2C_TRANSFER_RD;
319 break;
320 case TA_RPC_TEST_CMD_I2C_WRITE:
321 op = OPTEE_MSG_RPC_CMD_I2C_TRANSFER_WR;
322 break;
323 default:
324 return TEE_ERROR_NOT_SUPPORTED;
325 }
326
327 /*
328 * Fill params for an RPC call to tee supplicant
329 */
330 res = get_msg_arg(dev, 4, &shm, &msg_arg);
331 if (res)
332 goto out;
333
334 fill_i2c_rpc_params(msg_arg, bus_num, chip_addr, xfer_flags, op,
335 memref_data);
336
337 /* Make an RPC call to tee supplicant */
338 optee_suppl_cmd(dev, shm, 0);
339 res = msg_arg->ret;
340 out:
341 tee_shm_free(shm);
342
343 return res;
344 }
345 #endif /* CONFIG_OPTEE_TA_RPC_TEST */
346
347 static const struct ta_entry ta_entries[] = {
348 #ifdef CONFIG_OPTEE_TA_AVB
349 { .uuid = TA_AVB_UUID,
350 .open_session = ta_avb_open_session,
351 .invoke_func = ta_avb_invoke_func,
352 },
353 #endif
354 #ifdef CONFIG_OPTEE_TA_RPC_TEST
355 { .uuid = TA_RPC_TEST_UUID,
356 .open_session = ta_rpc_test_open_session,
357 .invoke_func = ta_rpc_test_invoke_func,
358 },
359 #endif
360 };
361
sandbox_tee_get_version(struct udevice * dev,struct tee_version_data * vers)362 static void sandbox_tee_get_version(struct udevice *dev,
363 struct tee_version_data *vers)
364 {
365 struct tee_version_data v = {
366 .gen_caps = TEE_GEN_CAP_GP | TEE_GEN_CAP_REG_MEM,
367 };
368
369 *vers = v;
370 }
371
sandbox_tee_close_session(struct udevice * dev,u32 session)372 static int sandbox_tee_close_session(struct udevice *dev, u32 session)
373 {
374 struct sandbox_tee_state *state = dev_get_priv(dev);
375
376 if (!state->ta || state->session != session)
377 return -EINVAL;
378
379 state->session = 0;
380 state->ta = NULL;
381
382 return 0;
383 }
384
find_ta_entry(u8 uuid[TEE_UUID_LEN])385 static const struct ta_entry *find_ta_entry(u8 uuid[TEE_UUID_LEN])
386 {
387 struct tee_optee_ta_uuid u;
388 uint n;
389
390 tee_optee_ta_uuid_from_octets(&u, uuid);
391
392 for (n = 0; n < ARRAY_SIZE(ta_entries); n++)
393 if (!memcmp(&u, &ta_entries[n].uuid, sizeof(u)))
394 return ta_entries + n;
395
396 return NULL;
397 }
398
sandbox_tee_open_session(struct udevice * dev,struct tee_open_session_arg * arg,uint num_params,struct tee_param * params)399 static int sandbox_tee_open_session(struct udevice *dev,
400 struct tee_open_session_arg *arg,
401 uint num_params, struct tee_param *params)
402 {
403 struct sandbox_tee_state *state = dev_get_priv(dev);
404 const struct ta_entry *ta;
405
406 if (state->ta) {
407 printf("A session is already open\n");
408 return -EBUSY;
409 }
410
411 ta = find_ta_entry(arg->uuid);
412 if (!ta) {
413 printf("Cannot find TA\n");
414 arg->ret = TEE_ERROR_ITEM_NOT_FOUND;
415 arg->ret_origin = TEE_ORIGIN_TEE;
416
417 return 0;
418 }
419
420 arg->ret = ta->open_session(dev, num_params, params);
421 arg->ret_origin = TEE_ORIGIN_TRUSTED_APP;
422
423 if (!arg->ret) {
424 state->ta = (void *)ta;
425 state->session = 1;
426 arg->session = state->session;
427 } else {
428 printf("Cannot open session, TA returns error\n");
429 }
430
431 return 0;
432 }
433
sandbox_tee_invoke_func(struct udevice * dev,struct tee_invoke_arg * arg,uint num_params,struct tee_param * params)434 static int sandbox_tee_invoke_func(struct udevice *dev,
435 struct tee_invoke_arg *arg,
436 uint num_params, struct tee_param *params)
437 {
438 struct sandbox_tee_state *state = dev_get_priv(dev);
439 struct ta_entry *ta = state->ta;
440
441 if (!arg->session) {
442 printf("Missing session\n");
443 return -EINVAL;
444 }
445
446 if (!ta) {
447 printf("TA session not available\n");
448 return -EINVAL;
449 }
450
451 if (arg->session != state->session) {
452 printf("Session mismatch\n");
453 return -EINVAL;
454 }
455
456 arg->ret = ta->invoke_func(dev, arg->func, num_params, params);
457 arg->ret_origin = TEE_ORIGIN_TRUSTED_APP;
458
459 return 0;
460 }
461
sandbox_tee_shm_register(struct udevice * dev,struct tee_shm * shm)462 static int sandbox_tee_shm_register(struct udevice *dev, struct tee_shm *shm)
463 {
464 struct sandbox_tee_state *state = dev_get_priv(dev);
465
466 state->num_shms++;
467
468 return 0;
469 }
470
sandbox_tee_shm_unregister(struct udevice * dev,struct tee_shm * shm)471 static int sandbox_tee_shm_unregister(struct udevice *dev, struct tee_shm *shm)
472 {
473 struct sandbox_tee_state *state = dev_get_priv(dev);
474
475 state->num_shms--;
476
477 return 0;
478 }
479
sandbox_tee_remove(struct udevice * dev)480 static int sandbox_tee_remove(struct udevice *dev)
481 {
482 struct sandbox_tee_state *state = dev_get_priv(dev);
483
484 hdestroy_r(&state->pstorage_htab);
485
486 return 0;
487 }
488
sandbox_tee_probe(struct udevice * dev)489 static int sandbox_tee_probe(struct udevice *dev)
490 {
491 struct sandbox_tee_state *state = dev_get_priv(dev);
492 /*
493 * With this hastable we emulate persistent storage,
494 * which should contain persistent values
495 * between different sessions/command invocations.
496 */
497 if (!hcreate_r(pstorage_max, &state->pstorage_htab))
498 return TEE_ERROR_OUT_OF_MEMORY;
499
500 return 0;
501 }
502
503 static const struct tee_driver_ops sandbox_tee_ops = {
504 .get_version = sandbox_tee_get_version,
505 .open_session = sandbox_tee_open_session,
506 .close_session = sandbox_tee_close_session,
507 .invoke_func = sandbox_tee_invoke_func,
508 .shm_register = sandbox_tee_shm_register,
509 .shm_unregister = sandbox_tee_shm_unregister,
510 };
511
512 static const struct udevice_id sandbox_tee_match[] = {
513 { .compatible = "sandbox,tee" },
514 {},
515 };
516
517 U_BOOT_DRIVER(sandbox_tee) = {
518 .name = "sandbox_tee",
519 .id = UCLASS_TEE,
520 .of_match = sandbox_tee_match,
521 .ops = &sandbox_tee_ops,
522 .priv_auto = sizeof(struct sandbox_tee_state),
523 .probe = sandbox_tee_probe,
524 .remove = sandbox_tee_remove,
525 };
526