1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright (C) 2018 Linaro Limited
4 */
5 #include <common.h>
6 #include <dm.h>
7 #include <sandboxtee.h>
8 #include <tee.h>
9 #include <tee/optee_ta_avb.h>
10 #include <tee/optee_ta_rpc_test.h>
11 #include <tee/optee_ta_scp03.h>
12
13 #include "optee/optee_msg.h"
14 #include "optee/optee_private.h"
15
16 /*
17 * The sandbox tee driver tries to emulate a generic Trusted Exectution
18 * Environment (TEE) with the Trusted Applications (TA) OPTEE_TA_AVB and
19 * OPTEE_TA_RPC_TEST available.
20 */
21
22 static const u32 pstorage_max = 16;
23 /**
24 * struct ta_entry - TA entries
25 * @uuid: UUID of an emulated TA
26 * @open_session Called when a session is openened to the TA
27 * @invoke_func Called when a function in the TA is to be invoked
28 *
29 * This struct is used to register TAs in this sandbox emulation of a TEE.
30 */
31 struct ta_entry {
32 struct tee_optee_ta_uuid uuid;
33 u32 (*open_session)(struct udevice *dev, uint num_params,
34 struct tee_param *params);
35 u32 (*invoke_func)(struct udevice *dev,
36 u32 func, uint num_params,
37 struct tee_param *params);
38 };
39
get_msg_arg(struct udevice * dev,uint num_params,struct tee_shm ** shmp,struct optee_msg_arg ** msg_arg)40 static int get_msg_arg(struct udevice *dev, uint num_params,
41 struct tee_shm **shmp, struct optee_msg_arg **msg_arg)
42 {
43 int rc;
44 struct optee_msg_arg *ma;
45
46 rc = __tee_shm_add(dev, OPTEE_MSG_NONCONTIG_PAGE_SIZE, NULL,
47 OPTEE_MSG_GET_ARG_SIZE(num_params), TEE_SHM_ALLOC,
48 shmp);
49 if (rc)
50 return rc;
51
52 ma = (*shmp)->addr;
53 memset(ma, 0, OPTEE_MSG_GET_ARG_SIZE(num_params));
54 ma->num_params = num_params;
55 *msg_arg = ma;
56
57 return 0;
58 }
59
optee_alloc_and_init_page_list(void * buf,ulong len,u64 * phys_buf_ptr)60 void *optee_alloc_and_init_page_list(void *buf, ulong len,
61 u64 *phys_buf_ptr)
62 {
63 /*
64 * An empty stub is added just to fix linking issues.
65 * This function isn't supposed to be called in sandbox
66 * setup, otherwise replace this with a proper
67 * implementation from optee/core.c
68 */
69 return NULL;
70 }
71
72 #if defined(CONFIG_OPTEE_TA_SCP03) || defined(CONFIG_OPTEE_TA_AVB)
get_attr(uint n,uint num_params,struct tee_param * params)73 static u32 get_attr(uint n, uint num_params, struct tee_param *params)
74 {
75 if (n >= num_params)
76 return TEE_PARAM_ATTR_TYPE_NONE;
77
78 return params[n].attr;
79 }
80
check_params(u8 p0,u8 p1,u8 p2,u8 p3,uint num_params,struct tee_param * params)81 static u32 check_params(u8 p0, u8 p1, u8 p2, u8 p3, uint num_params,
82 struct tee_param *params)
83 {
84 u8 p[] = { p0, p1, p2, p3 };
85 uint n;
86
87 for (n = 0; n < ARRAY_SIZE(p); n++)
88 if (p[n] != get_attr(n, num_params, params))
89 goto bad_params;
90
91 for (; n < num_params; n++)
92 if (get_attr(n, num_params, params))
93 goto bad_params;
94
95 return TEE_SUCCESS;
96
97 bad_params:
98 printf("Bad param attrs\n");
99
100 return TEE_ERROR_BAD_PARAMETERS;
101 }
102 #endif
103
104 #ifdef CONFIG_OPTEE_TA_SCP03
pta_scp03_open_session(struct udevice * dev,uint num_params,struct tee_param * params)105 static u32 pta_scp03_open_session(struct udevice *dev, uint num_params,
106 struct tee_param *params)
107 {
108 /*
109 * We don't expect additional parameters when opening a session to
110 * this TA.
111 */
112 return check_params(TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
113 TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
114 num_params, params);
115 }
116
pta_scp03_invoke_func(struct udevice * dev,u32 func,uint num_params,struct tee_param * params)117 static u32 pta_scp03_invoke_func(struct udevice *dev, u32 func, uint num_params,
118 struct tee_param *params)
119 {
120 u32 res;
121 static bool enabled;
122
123 switch (func) {
124 case PTA_CMD_ENABLE_SCP03:
125 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
126 TEE_PARAM_ATTR_TYPE_NONE,
127 TEE_PARAM_ATTR_TYPE_NONE,
128 TEE_PARAM_ATTR_TYPE_NONE,
129 num_params, params);
130 if (res)
131 return res;
132
133 if (!enabled) {
134 enabled = true;
135 } else {
136 }
137
138 if (params[0].u.value.a)
139
140 return TEE_SUCCESS;
141 default:
142 return TEE_ERROR_NOT_SUPPORTED;
143 }
144 }
145 #endif
146
147 #ifdef CONFIG_OPTEE_TA_AVB
ta_avb_open_session(struct udevice * dev,uint num_params,struct tee_param * params)148 static u32 ta_avb_open_session(struct udevice *dev, uint num_params,
149 struct tee_param *params)
150 {
151 /*
152 * We don't expect additional parameters when opening a session to
153 * this TA.
154 */
155 return check_params(TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
156 TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
157 num_params, params);
158 }
159
ta_avb_invoke_func(struct udevice * dev,u32 func,uint num_params,struct tee_param * params)160 static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
161 struct tee_param *params)
162 {
163 struct sandbox_tee_state *state = dev_get_priv(dev);
164 struct env_entry e, *ep;
165 char *name;
166 u32 res;
167 uint slot;
168 u64 val;
169 char *value;
170 u32 value_sz;
171
172 switch (func) {
173 case TA_AVB_CMD_READ_ROLLBACK_INDEX:
174 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
175 TEE_PARAM_ATTR_TYPE_VALUE_OUTPUT,
176 TEE_PARAM_ATTR_TYPE_NONE,
177 TEE_PARAM_ATTR_TYPE_NONE,
178 num_params, params);
179 if (res)
180 return res;
181
182 slot = params[0].u.value.a;
183 if (slot >= ARRAY_SIZE(state->ta_avb_rollback_indexes)) {
184 printf("Rollback index slot out of bounds %u\n", slot);
185 return TEE_ERROR_BAD_PARAMETERS;
186 }
187
188 val = state->ta_avb_rollback_indexes[slot];
189 params[1].u.value.a = val >> 32;
190 params[1].u.value.b = val;
191 return TEE_SUCCESS;
192
193 case TA_AVB_CMD_WRITE_ROLLBACK_INDEX:
194 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
195 TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
196 TEE_PARAM_ATTR_TYPE_NONE,
197 TEE_PARAM_ATTR_TYPE_NONE,
198 num_params, params);
199 if (res)
200 return res;
201
202 slot = params[0].u.value.a;
203 if (slot >= ARRAY_SIZE(state->ta_avb_rollback_indexes)) {
204 printf("Rollback index slot out of bounds %u\n", slot);
205 return TEE_ERROR_BAD_PARAMETERS;
206 }
207
208 val = (u64)params[1].u.value.a << 32 | params[1].u.value.b;
209 if (val < state->ta_avb_rollback_indexes[slot])
210 return TEE_ERROR_SECURITY;
211
212 state->ta_avb_rollback_indexes[slot] = val;
213 return TEE_SUCCESS;
214
215 case TA_AVB_CMD_READ_LOCK_STATE:
216 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_OUTPUT,
217 TEE_PARAM_ATTR_TYPE_NONE,
218 TEE_PARAM_ATTR_TYPE_NONE,
219 TEE_PARAM_ATTR_TYPE_NONE,
220 num_params, params);
221 if (res)
222 return res;
223
224 params[0].u.value.a = state->ta_avb_lock_state;
225 return TEE_SUCCESS;
226
227 case TA_AVB_CMD_WRITE_LOCK_STATE:
228 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
229 TEE_PARAM_ATTR_TYPE_NONE,
230 TEE_PARAM_ATTR_TYPE_NONE,
231 TEE_PARAM_ATTR_TYPE_NONE,
232 num_params, params);
233 if (res)
234 return res;
235
236 if (state->ta_avb_lock_state != params[0].u.value.a) {
237 state->ta_avb_lock_state = params[0].u.value.a;
238 memset(state->ta_avb_rollback_indexes, 0,
239 sizeof(state->ta_avb_rollback_indexes));
240 }
241
242 return TEE_SUCCESS;
243 case TA_AVB_CMD_READ_PERSIST_VALUE:
244 res = check_params(TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
245 TEE_PARAM_ATTR_TYPE_MEMREF_INOUT,
246 TEE_PARAM_ATTR_TYPE_NONE,
247 TEE_PARAM_ATTR_TYPE_NONE,
248 num_params, params);
249 if (res)
250 return res;
251
252 name = params[0].u.memref.shm->addr;
253
254 value = params[1].u.memref.shm->addr;
255 value_sz = params[1].u.memref.size;
256
257 e.key = name;
258 e.data = NULL;
259 hsearch_r(e, ENV_FIND, &ep, &state->pstorage_htab, 0);
260 if (!ep)
261 return TEE_ERROR_ITEM_NOT_FOUND;
262
263 value_sz = strlen(ep->data) + 1;
264 memcpy(value, ep->data, value_sz);
265
266 return TEE_SUCCESS;
267 case TA_AVB_CMD_WRITE_PERSIST_VALUE:
268 res = check_params(TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
269 TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
270 TEE_PARAM_ATTR_TYPE_NONE,
271 TEE_PARAM_ATTR_TYPE_NONE,
272 num_params, params);
273 if (res)
274 return res;
275
276 name = params[0].u.memref.shm->addr;
277
278 value = params[1].u.memref.shm->addr;
279 value_sz = params[1].u.memref.size;
280
281 e.key = name;
282 e.data = NULL;
283 hsearch_r(e, ENV_FIND, &ep, &state->pstorage_htab, 0);
284 if (ep)
285 hdelete_r(e.key, &state->pstorage_htab, 0);
286
287 e.key = name;
288 e.data = value;
289 hsearch_r(e, ENV_ENTER, &ep, &state->pstorage_htab, 0);
290 if (!ep)
291 return TEE_ERROR_OUT_OF_MEMORY;
292
293 return TEE_SUCCESS;
294
295 default:
296 return TEE_ERROR_NOT_SUPPORTED;
297 }
298 }
299 #endif /* OPTEE_TA_AVB */
300
301 #ifdef CONFIG_OPTEE_TA_RPC_TEST
ta_rpc_test_open_session(struct udevice * dev,uint num_params,struct tee_param * params)302 static u32 ta_rpc_test_open_session(struct udevice *dev, uint num_params,
303 struct tee_param *params)
304 {
305 /*
306 * We don't expect additional parameters when opening a session to
307 * this TA.
308 */
309 return check_params(TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
310 TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
311 num_params, params);
312 }
313
fill_i2c_rpc_params(struct optee_msg_arg * msg_arg,u64 bus_num,u64 chip_addr,u64 xfer_flags,u64 op,struct tee_param_memref memref)314 static void fill_i2c_rpc_params(struct optee_msg_arg *msg_arg, u64 bus_num,
315 u64 chip_addr, u64 xfer_flags, u64 op,
316 struct tee_param_memref memref)
317 {
318 msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
319 msg_arg->params[1].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
320 msg_arg->params[2].attr = OPTEE_MSG_ATTR_TYPE_RMEM_INOUT;
321 msg_arg->params[3].attr = OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT;
322
323 /* trigger I2C services of TEE supplicant */
324 msg_arg->cmd = OPTEE_MSG_RPC_CMD_I2C_TRANSFER;
325
326 msg_arg->params[0].u.value.a = op;
327 msg_arg->params[0].u.value.b = bus_num;
328 msg_arg->params[0].u.value.c = chip_addr;
329 msg_arg->params[1].u.value.a = xfer_flags;
330
331 /* buffer to read/write data */
332 msg_arg->params[2].u.rmem.shm_ref = (ulong)memref.shm;
333 msg_arg->params[2].u.rmem.size = memref.size;
334 msg_arg->params[2].u.rmem.offs = memref.shm_offs;
335
336 msg_arg->num_params = 4;
337 }
338
ta_rpc_test_invoke_func(struct udevice * dev,u32 func,uint num_params,struct tee_param * params)339 static u32 ta_rpc_test_invoke_func(struct udevice *dev, u32 func,
340 uint num_params,
341 struct tee_param *params)
342 {
343 struct tee_shm *shm;
344 struct tee_param_memref memref_data;
345 struct optee_msg_arg *msg_arg;
346 int chip_addr, bus_num, op, xfer_flags;
347 int res;
348
349 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
350 TEE_PARAM_ATTR_TYPE_MEMREF_INOUT,
351 TEE_PARAM_ATTR_TYPE_NONE,
352 TEE_PARAM_ATTR_TYPE_NONE,
353 num_params, params);
354 if (res)
355 return TEE_ERROR_BAD_PARAMETERS;
356
357 bus_num = params[0].u.value.a;
358 chip_addr = params[0].u.value.b;
359 xfer_flags = params[0].u.value.c;
360 memref_data = params[1].u.memref;
361
362 switch (func) {
363 case TA_RPC_TEST_CMD_I2C_READ:
364 op = OPTEE_MSG_RPC_CMD_I2C_TRANSFER_RD;
365 break;
366 case TA_RPC_TEST_CMD_I2C_WRITE:
367 op = OPTEE_MSG_RPC_CMD_I2C_TRANSFER_WR;
368 break;
369 default:
370 return TEE_ERROR_NOT_SUPPORTED;
371 }
372
373 /*
374 * Fill params for an RPC call to tee supplicant
375 */
376 res = get_msg_arg(dev, 4, &shm, &msg_arg);
377 if (res)
378 goto out;
379
380 fill_i2c_rpc_params(msg_arg, bus_num, chip_addr, xfer_flags, op,
381 memref_data);
382
383 /* Make an RPC call to tee supplicant */
384 optee_suppl_cmd(dev, shm, 0);
385 res = msg_arg->ret;
386 out:
387 tee_shm_free(shm);
388
389 return res;
390 }
391 #endif /* CONFIG_OPTEE_TA_RPC_TEST */
392
393 static const struct ta_entry ta_entries[] = {
394 #ifdef CONFIG_OPTEE_TA_AVB
395 { .uuid = TA_AVB_UUID,
396 .open_session = ta_avb_open_session,
397 .invoke_func = ta_avb_invoke_func,
398 },
399 #endif
400 #ifdef CONFIG_OPTEE_TA_RPC_TEST
401 { .uuid = TA_RPC_TEST_UUID,
402 .open_session = ta_rpc_test_open_session,
403 .invoke_func = ta_rpc_test_invoke_func,
404 },
405 #endif
406 #ifdef CONFIG_OPTEE_TA_SCP03
407 { .uuid = PTA_SCP03_UUID,
408 .open_session = pta_scp03_open_session,
409 .invoke_func = pta_scp03_invoke_func,
410 },
411 #endif
412 };
413
sandbox_tee_get_version(struct udevice * dev,struct tee_version_data * vers)414 static void sandbox_tee_get_version(struct udevice *dev,
415 struct tee_version_data *vers)
416 {
417 struct tee_version_data v = {
418 .gen_caps = TEE_GEN_CAP_GP | TEE_GEN_CAP_REG_MEM,
419 };
420
421 *vers = v;
422 }
423
sandbox_tee_close_session(struct udevice * dev,u32 session)424 static int sandbox_tee_close_session(struct udevice *dev, u32 session)
425 {
426 struct sandbox_tee_state *state = dev_get_priv(dev);
427
428 if (!state->ta || state->session != session)
429 return -EINVAL;
430
431 state->session = 0;
432 state->ta = NULL;
433
434 return 0;
435 }
436
find_ta_entry(u8 uuid[TEE_UUID_LEN])437 static const struct ta_entry *find_ta_entry(u8 uuid[TEE_UUID_LEN])
438 {
439 struct tee_optee_ta_uuid u;
440 uint n;
441
442 tee_optee_ta_uuid_from_octets(&u, uuid);
443
444 for (n = 0; n < ARRAY_SIZE(ta_entries); n++)
445 if (!memcmp(&u, &ta_entries[n].uuid, sizeof(u)))
446 return ta_entries + n;
447
448 return NULL;
449 }
450
sandbox_tee_open_session(struct udevice * dev,struct tee_open_session_arg * arg,uint num_params,struct tee_param * params)451 static int sandbox_tee_open_session(struct udevice *dev,
452 struct tee_open_session_arg *arg,
453 uint num_params, struct tee_param *params)
454 {
455 struct sandbox_tee_state *state = dev_get_priv(dev);
456 const struct ta_entry *ta;
457
458 if (state->ta) {
459 printf("A session is already open\n");
460 return -EBUSY;
461 }
462
463 ta = find_ta_entry(arg->uuid);
464 if (!ta) {
465 printf("Cannot find TA\n");
466 arg->ret = TEE_ERROR_ITEM_NOT_FOUND;
467 arg->ret_origin = TEE_ORIGIN_TEE;
468
469 return 0;
470 }
471
472 arg->ret = ta->open_session(dev, num_params, params);
473 arg->ret_origin = TEE_ORIGIN_TRUSTED_APP;
474
475 if (!arg->ret) {
476 state->ta = (void *)ta;
477 state->session = 1;
478 arg->session = state->session;
479 } else {
480 printf("Cannot open session, TA returns error\n");
481 }
482
483 return 0;
484 }
485
sandbox_tee_invoke_func(struct udevice * dev,struct tee_invoke_arg * arg,uint num_params,struct tee_param * params)486 static int sandbox_tee_invoke_func(struct udevice *dev,
487 struct tee_invoke_arg *arg,
488 uint num_params, struct tee_param *params)
489 {
490 struct sandbox_tee_state *state = dev_get_priv(dev);
491 struct ta_entry *ta = state->ta;
492
493 if (!arg->session) {
494 printf("Missing session\n");
495 return -EINVAL;
496 }
497
498 if (!ta) {
499 printf("TA session not available\n");
500 return -EINVAL;
501 }
502
503 if (arg->session != state->session) {
504 printf("Session mismatch\n");
505 return -EINVAL;
506 }
507
508 arg->ret = ta->invoke_func(dev, arg->func, num_params, params);
509 arg->ret_origin = TEE_ORIGIN_TRUSTED_APP;
510
511 return 0;
512 }
513
sandbox_tee_shm_register(struct udevice * dev,struct tee_shm * shm)514 static int sandbox_tee_shm_register(struct udevice *dev, struct tee_shm *shm)
515 {
516 struct sandbox_tee_state *state = dev_get_priv(dev);
517
518 state->num_shms++;
519
520 return 0;
521 }
522
sandbox_tee_shm_unregister(struct udevice * dev,struct tee_shm * shm)523 static int sandbox_tee_shm_unregister(struct udevice *dev, struct tee_shm *shm)
524 {
525 struct sandbox_tee_state *state = dev_get_priv(dev);
526
527 state->num_shms--;
528
529 return 0;
530 }
531
sandbox_tee_remove(struct udevice * dev)532 static int sandbox_tee_remove(struct udevice *dev)
533 {
534 struct sandbox_tee_state *state = dev_get_priv(dev);
535
536 hdestroy_r(&state->pstorage_htab);
537
538 return 0;
539 }
540
sandbox_tee_probe(struct udevice * dev)541 static int sandbox_tee_probe(struct udevice *dev)
542 {
543 struct sandbox_tee_state *state = dev_get_priv(dev);
544 /*
545 * With this hastable we emulate persistent storage,
546 * which should contain persistent values
547 * between different sessions/command invocations.
548 */
549 if (!hcreate_r(pstorage_max, &state->pstorage_htab))
550 return TEE_ERROR_OUT_OF_MEMORY;
551
552 return 0;
553 }
554
555 static const struct tee_driver_ops sandbox_tee_ops = {
556 .get_version = sandbox_tee_get_version,
557 .open_session = sandbox_tee_open_session,
558 .close_session = sandbox_tee_close_session,
559 .invoke_func = sandbox_tee_invoke_func,
560 .shm_register = sandbox_tee_shm_register,
561 .shm_unregister = sandbox_tee_shm_unregister,
562 };
563
564 static const struct udevice_id sandbox_tee_match[] = {
565 { .compatible = "sandbox,tee" },
566 {},
567 };
568
569 U_BOOT_DRIVER(sandbox_tee) = {
570 .name = "sandbox_tee",
571 .id = UCLASS_TEE,
572 .of_match = sandbox_tee_match,
573 .ops = &sandbox_tee_ops,
574 .priv_auto = sizeof(struct sandbox_tee_state),
575 .probe = sandbox_tee_probe,
576 .remove = sandbox_tee_remove,
577 };
578