1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright (C) 2018 Linaro Limited
4 */
5 #include <common.h>
6 #include <dm.h>
7 #include <sandboxtee.h>
8 #include <tee.h>
9 #include <tee/optee_ta_avb.h>
10 #include <tee/optee_ta_rpc_test.h>
11 #include <tee/optee_ta_scp03.h>
12
13 #include "optee/optee_msg.h"
14 #include "optee/optee_private.h"
15
16 /*
17 * The sandbox tee driver tries to emulate a generic Trusted Exectution
18 * Environment (TEE) with the Trusted Applications (TA) OPTEE_TA_AVB and
19 * OPTEE_TA_RPC_TEST available.
20 */
21
22 static const u32 pstorage_max = 16;
23 /**
24 * struct ta_entry - TA entries
25 * @uuid: UUID of an emulated TA
26 * @open_session Called when a session is openened to the TA
27 * @invoke_func Called when a function in the TA is to be invoked
28 *
29 * This struct is used to register TAs in this sandbox emulation of a TEE.
30 */
31 struct ta_entry {
32 struct tee_optee_ta_uuid uuid;
33 u32 (*open_session)(struct udevice *dev, uint num_params,
34 struct tee_param *params);
35 u32 (*invoke_func)(struct udevice *dev,
36 u32 func, uint num_params,
37 struct tee_param *params);
38 };
39
get_msg_arg(struct udevice * dev,uint num_params,struct tee_shm ** shmp,struct optee_msg_arg ** msg_arg)40 static int get_msg_arg(struct udevice *dev, uint num_params,
41 struct tee_shm **shmp, struct optee_msg_arg **msg_arg)
42 {
43 int rc;
44 struct optee_msg_arg *ma;
45
46 rc = __tee_shm_add(dev, OPTEE_MSG_NONCONTIG_PAGE_SIZE, NULL,
47 OPTEE_MSG_GET_ARG_SIZE(num_params), TEE_SHM_ALLOC,
48 shmp);
49 if (rc)
50 return rc;
51
52 ma = (*shmp)->addr;
53 memset(ma, 0, OPTEE_MSG_GET_ARG_SIZE(num_params));
54 ma->num_params = num_params;
55 *msg_arg = ma;
56
57 return 0;
58 }
59
optee_alloc_and_init_page_list(void * buf,ulong len,u64 * phys_buf_ptr)60 void *optee_alloc_and_init_page_list(void *buf, ulong len,
61 u64 *phys_buf_ptr)
62 {
63 /*
64 * An empty stub is added just to fix linking issues.
65 * This function isn't supposed to be called in sandbox
66 * setup, otherwise replace this with a proper
67 * implementation from optee/core.c
68 */
69 return NULL;
70 }
71
72 #if defined(CONFIG_OPTEE_TA_SCP03) || defined(CONFIG_OPTEE_TA_AVB)
get_attr(uint n,uint num_params,struct tee_param * params)73 static u32 get_attr(uint n, uint num_params, struct tee_param *params)
74 {
75 if (n >= num_params)
76 return TEE_PARAM_ATTR_TYPE_NONE;
77
78 return params[n].attr;
79 }
80
check_params(u8 p0,u8 p1,u8 p2,u8 p3,uint num_params,struct tee_param * params)81 static u32 check_params(u8 p0, u8 p1, u8 p2, u8 p3, uint num_params,
82 struct tee_param *params)
83 {
84 u8 p[] = { p0, p1, p2, p3 };
85 uint n;
86
87 for (n = 0; n < ARRAY_SIZE(p); n++)
88 if (p[n] != get_attr(n, num_params, params))
89 goto bad_params;
90
91 for (; n < num_params; n++)
92 if (get_attr(n, num_params, params))
93 goto bad_params;
94
95 return TEE_SUCCESS;
96
97 bad_params:
98 printf("Bad param attrs\n");
99
100 return TEE_ERROR_BAD_PARAMETERS;
101 }
102 #endif
103
104 #ifdef CONFIG_OPTEE_TA_SCP03
pta_scp03_open_session(struct udevice * dev,uint num_params,struct tee_param * params)105 static u32 pta_scp03_open_session(struct udevice *dev, uint num_params,
106 struct tee_param *params)
107 {
108 /*
109 * We don't expect additional parameters when opening a session to
110 * this TA.
111 */
112 return check_params(TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
113 TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
114 num_params, params);
115 }
116
pta_scp03_invoke_func(struct udevice * dev,u32 func,uint num_params,struct tee_param * params)117 static u32 pta_scp03_invoke_func(struct udevice *dev, u32 func, uint num_params,
118 struct tee_param *params)
119 {
120 u32 res;
121 static bool enabled;
122 static bool provisioned;
123
124 switch (func) {
125 case PTA_CMD_ENABLE_SCP03:
126 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
127 TEE_PARAM_ATTR_TYPE_NONE,
128 TEE_PARAM_ATTR_TYPE_NONE,
129 TEE_PARAM_ATTR_TYPE_NONE,
130 num_params, params);
131 if (res)
132 return res;
133
134 /* If SCP03 was not enabled, enable it */
135 if (!enabled)
136 enabled = true;
137
138 /* If SCP03 was not provisioned, provision new keys */
139 if (params[0].u.value.a && !provisioned)
140 provisioned = true;
141
142 /*
143 * Either way, we asume both operations succeeded and that
144 * the communication channel has now been stablished
145 */
146
147 return TEE_SUCCESS;
148 default:
149 return TEE_ERROR_NOT_SUPPORTED;
150 }
151 }
152 #endif
153
154 #ifdef CONFIG_OPTEE_TA_AVB
ta_avb_open_session(struct udevice * dev,uint num_params,struct tee_param * params)155 static u32 ta_avb_open_session(struct udevice *dev, uint num_params,
156 struct tee_param *params)
157 {
158 /*
159 * We don't expect additional parameters when opening a session to
160 * this TA.
161 */
162 return check_params(TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
163 TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
164 num_params, params);
165 }
166
ta_avb_invoke_func(struct udevice * dev,u32 func,uint num_params,struct tee_param * params)167 static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
168 struct tee_param *params)
169 {
170 struct sandbox_tee_state *state = dev_get_priv(dev);
171 struct env_entry e, *ep;
172 char *name;
173 u32 res;
174 uint slot;
175 u64 val;
176 char *value;
177 u32 value_sz;
178
179 switch (func) {
180 case TA_AVB_CMD_READ_ROLLBACK_INDEX:
181 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
182 TEE_PARAM_ATTR_TYPE_VALUE_OUTPUT,
183 TEE_PARAM_ATTR_TYPE_NONE,
184 TEE_PARAM_ATTR_TYPE_NONE,
185 num_params, params);
186 if (res)
187 return res;
188
189 slot = params[0].u.value.a;
190 if (slot >= ARRAY_SIZE(state->ta_avb_rollback_indexes)) {
191 printf("Rollback index slot out of bounds %u\n", slot);
192 return TEE_ERROR_BAD_PARAMETERS;
193 }
194
195 val = state->ta_avb_rollback_indexes[slot];
196 params[1].u.value.a = val >> 32;
197 params[1].u.value.b = val;
198 return TEE_SUCCESS;
199
200 case TA_AVB_CMD_WRITE_ROLLBACK_INDEX:
201 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
202 TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
203 TEE_PARAM_ATTR_TYPE_NONE,
204 TEE_PARAM_ATTR_TYPE_NONE,
205 num_params, params);
206 if (res)
207 return res;
208
209 slot = params[0].u.value.a;
210 if (slot >= ARRAY_SIZE(state->ta_avb_rollback_indexes)) {
211 printf("Rollback index slot out of bounds %u\n", slot);
212 return TEE_ERROR_BAD_PARAMETERS;
213 }
214
215 val = (u64)params[1].u.value.a << 32 | params[1].u.value.b;
216 if (val < state->ta_avb_rollback_indexes[slot])
217 return TEE_ERROR_SECURITY;
218
219 state->ta_avb_rollback_indexes[slot] = val;
220 return TEE_SUCCESS;
221
222 case TA_AVB_CMD_READ_LOCK_STATE:
223 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_OUTPUT,
224 TEE_PARAM_ATTR_TYPE_NONE,
225 TEE_PARAM_ATTR_TYPE_NONE,
226 TEE_PARAM_ATTR_TYPE_NONE,
227 num_params, params);
228 if (res)
229 return res;
230
231 params[0].u.value.a = state->ta_avb_lock_state;
232 return TEE_SUCCESS;
233
234 case TA_AVB_CMD_WRITE_LOCK_STATE:
235 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
236 TEE_PARAM_ATTR_TYPE_NONE,
237 TEE_PARAM_ATTR_TYPE_NONE,
238 TEE_PARAM_ATTR_TYPE_NONE,
239 num_params, params);
240 if (res)
241 return res;
242
243 if (state->ta_avb_lock_state != params[0].u.value.a) {
244 state->ta_avb_lock_state = params[0].u.value.a;
245 memset(state->ta_avb_rollback_indexes, 0,
246 sizeof(state->ta_avb_rollback_indexes));
247 }
248
249 return TEE_SUCCESS;
250 case TA_AVB_CMD_READ_PERSIST_VALUE:
251 res = check_params(TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
252 TEE_PARAM_ATTR_TYPE_MEMREF_INOUT,
253 TEE_PARAM_ATTR_TYPE_NONE,
254 TEE_PARAM_ATTR_TYPE_NONE,
255 num_params, params);
256 if (res)
257 return res;
258
259 name = params[0].u.memref.shm->addr;
260
261 value = params[1].u.memref.shm->addr;
262 value_sz = params[1].u.memref.size;
263
264 e.key = name;
265 e.data = NULL;
266 hsearch_r(e, ENV_FIND, &ep, &state->pstorage_htab, 0);
267 if (!ep)
268 return TEE_ERROR_ITEM_NOT_FOUND;
269
270 value_sz = strlen(ep->data) + 1;
271 memcpy(value, ep->data, value_sz);
272
273 return TEE_SUCCESS;
274 case TA_AVB_CMD_WRITE_PERSIST_VALUE:
275 res = check_params(TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
276 TEE_PARAM_ATTR_TYPE_MEMREF_INPUT,
277 TEE_PARAM_ATTR_TYPE_NONE,
278 TEE_PARAM_ATTR_TYPE_NONE,
279 num_params, params);
280 if (res)
281 return res;
282
283 name = params[0].u.memref.shm->addr;
284
285 value = params[1].u.memref.shm->addr;
286 value_sz = params[1].u.memref.size;
287
288 e.key = name;
289 e.data = NULL;
290 hsearch_r(e, ENV_FIND, &ep, &state->pstorage_htab, 0);
291 if (ep)
292 hdelete_r(e.key, &state->pstorage_htab, 0);
293
294 e.key = name;
295 e.data = value;
296 hsearch_r(e, ENV_ENTER, &ep, &state->pstorage_htab, 0);
297 if (!ep)
298 return TEE_ERROR_OUT_OF_MEMORY;
299
300 return TEE_SUCCESS;
301
302 default:
303 return TEE_ERROR_NOT_SUPPORTED;
304 }
305 }
306 #endif /* OPTEE_TA_AVB */
307
308 #ifdef CONFIG_OPTEE_TA_RPC_TEST
ta_rpc_test_open_session(struct udevice * dev,uint num_params,struct tee_param * params)309 static u32 ta_rpc_test_open_session(struct udevice *dev, uint num_params,
310 struct tee_param *params)
311 {
312 /*
313 * We don't expect additional parameters when opening a session to
314 * this TA.
315 */
316 return check_params(TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
317 TEE_PARAM_ATTR_TYPE_NONE, TEE_PARAM_ATTR_TYPE_NONE,
318 num_params, params);
319 }
320
fill_i2c_rpc_params(struct optee_msg_arg * msg_arg,u64 bus_num,u64 chip_addr,u64 xfer_flags,u64 op,struct tee_param_memref memref)321 static void fill_i2c_rpc_params(struct optee_msg_arg *msg_arg, u64 bus_num,
322 u64 chip_addr, u64 xfer_flags, u64 op,
323 struct tee_param_memref memref)
324 {
325 msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
326 msg_arg->params[1].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
327 msg_arg->params[2].attr = OPTEE_MSG_ATTR_TYPE_RMEM_INOUT;
328 msg_arg->params[3].attr = OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT;
329
330 /* trigger I2C services of TEE supplicant */
331 msg_arg->cmd = OPTEE_MSG_RPC_CMD_I2C_TRANSFER;
332
333 msg_arg->params[0].u.value.a = op;
334 msg_arg->params[0].u.value.b = bus_num;
335 msg_arg->params[0].u.value.c = chip_addr;
336 msg_arg->params[1].u.value.a = xfer_flags;
337
338 /* buffer to read/write data */
339 msg_arg->params[2].u.rmem.shm_ref = (ulong)memref.shm;
340 msg_arg->params[2].u.rmem.size = memref.size;
341 msg_arg->params[2].u.rmem.offs = memref.shm_offs;
342
343 msg_arg->num_params = 4;
344 }
345
ta_rpc_test_invoke_func(struct udevice * dev,u32 func,uint num_params,struct tee_param * params)346 static u32 ta_rpc_test_invoke_func(struct udevice *dev, u32 func,
347 uint num_params,
348 struct tee_param *params)
349 {
350 struct tee_shm *shm;
351 struct tee_param_memref memref_data;
352 struct optee_msg_arg *msg_arg;
353 int chip_addr, bus_num, op, xfer_flags;
354 int res;
355
356 res = check_params(TEE_PARAM_ATTR_TYPE_VALUE_INPUT,
357 TEE_PARAM_ATTR_TYPE_MEMREF_INOUT,
358 TEE_PARAM_ATTR_TYPE_NONE,
359 TEE_PARAM_ATTR_TYPE_NONE,
360 num_params, params);
361 if (res)
362 return TEE_ERROR_BAD_PARAMETERS;
363
364 bus_num = params[0].u.value.a;
365 chip_addr = params[0].u.value.b;
366 xfer_flags = params[0].u.value.c;
367 memref_data = params[1].u.memref;
368
369 switch (func) {
370 case TA_RPC_TEST_CMD_I2C_READ:
371 op = OPTEE_MSG_RPC_CMD_I2C_TRANSFER_RD;
372 break;
373 case TA_RPC_TEST_CMD_I2C_WRITE:
374 op = OPTEE_MSG_RPC_CMD_I2C_TRANSFER_WR;
375 break;
376 default:
377 return TEE_ERROR_NOT_SUPPORTED;
378 }
379
380 /*
381 * Fill params for an RPC call to tee supplicant
382 */
383 res = get_msg_arg(dev, 4, &shm, &msg_arg);
384 if (res)
385 goto out;
386
387 fill_i2c_rpc_params(msg_arg, bus_num, chip_addr, xfer_flags, op,
388 memref_data);
389
390 /* Make an RPC call to tee supplicant */
391 optee_suppl_cmd(dev, shm, 0);
392 res = msg_arg->ret;
393 out:
394 tee_shm_free(shm);
395
396 return res;
397 }
398 #endif /* CONFIG_OPTEE_TA_RPC_TEST */
399
400 static const struct ta_entry ta_entries[] = {
401 #ifdef CONFIG_OPTEE_TA_AVB
402 { .uuid = TA_AVB_UUID,
403 .open_session = ta_avb_open_session,
404 .invoke_func = ta_avb_invoke_func,
405 },
406 #endif
407 #ifdef CONFIG_OPTEE_TA_RPC_TEST
408 { .uuid = TA_RPC_TEST_UUID,
409 .open_session = ta_rpc_test_open_session,
410 .invoke_func = ta_rpc_test_invoke_func,
411 },
412 #endif
413 #ifdef CONFIG_OPTEE_TA_SCP03
414 { .uuid = PTA_SCP03_UUID,
415 .open_session = pta_scp03_open_session,
416 .invoke_func = pta_scp03_invoke_func,
417 },
418 #endif
419 };
420
sandbox_tee_get_version(struct udevice * dev,struct tee_version_data * vers)421 static void sandbox_tee_get_version(struct udevice *dev,
422 struct tee_version_data *vers)
423 {
424 struct tee_version_data v = {
425 .gen_caps = TEE_GEN_CAP_GP | TEE_GEN_CAP_REG_MEM,
426 };
427
428 *vers = v;
429 }
430
sandbox_tee_close_session(struct udevice * dev,u32 session)431 static int sandbox_tee_close_session(struct udevice *dev, u32 session)
432 {
433 struct sandbox_tee_state *state = dev_get_priv(dev);
434
435 if (!state->ta || state->session != session)
436 return -EINVAL;
437
438 state->session = 0;
439 state->ta = NULL;
440
441 return 0;
442 }
443
find_ta_entry(u8 uuid[TEE_UUID_LEN])444 static const struct ta_entry *find_ta_entry(u8 uuid[TEE_UUID_LEN])
445 {
446 struct tee_optee_ta_uuid u;
447 uint n;
448
449 tee_optee_ta_uuid_from_octets(&u, uuid);
450
451 for (n = 0; n < ARRAY_SIZE(ta_entries); n++)
452 if (!memcmp(&u, &ta_entries[n].uuid, sizeof(u)))
453 return ta_entries + n;
454
455 return NULL;
456 }
457
sandbox_tee_open_session(struct udevice * dev,struct tee_open_session_arg * arg,uint num_params,struct tee_param * params)458 static int sandbox_tee_open_session(struct udevice *dev,
459 struct tee_open_session_arg *arg,
460 uint num_params, struct tee_param *params)
461 {
462 struct sandbox_tee_state *state = dev_get_priv(dev);
463 const struct ta_entry *ta;
464
465 if (state->ta) {
466 printf("A session is already open\n");
467 return -EBUSY;
468 }
469
470 ta = find_ta_entry(arg->uuid);
471 if (!ta) {
472 printf("Cannot find TA\n");
473 arg->ret = TEE_ERROR_ITEM_NOT_FOUND;
474 arg->ret_origin = TEE_ORIGIN_TEE;
475
476 return 0;
477 }
478
479 arg->ret = ta->open_session(dev, num_params, params);
480 arg->ret_origin = TEE_ORIGIN_TRUSTED_APP;
481
482 if (!arg->ret) {
483 state->ta = (void *)ta;
484 state->session = 1;
485 arg->session = state->session;
486 } else {
487 printf("Cannot open session, TA returns error\n");
488 }
489
490 return 0;
491 }
492
sandbox_tee_invoke_func(struct udevice * dev,struct tee_invoke_arg * arg,uint num_params,struct tee_param * params)493 static int sandbox_tee_invoke_func(struct udevice *dev,
494 struct tee_invoke_arg *arg,
495 uint num_params, struct tee_param *params)
496 {
497 struct sandbox_tee_state *state = dev_get_priv(dev);
498 struct ta_entry *ta = state->ta;
499
500 if (!arg->session) {
501 printf("Missing session\n");
502 return -EINVAL;
503 }
504
505 if (!ta) {
506 printf("TA session not available\n");
507 return -EINVAL;
508 }
509
510 if (arg->session != state->session) {
511 printf("Session mismatch\n");
512 return -EINVAL;
513 }
514
515 arg->ret = ta->invoke_func(dev, arg->func, num_params, params);
516 arg->ret_origin = TEE_ORIGIN_TRUSTED_APP;
517
518 return 0;
519 }
520
sandbox_tee_shm_register(struct udevice * dev,struct tee_shm * shm)521 static int sandbox_tee_shm_register(struct udevice *dev, struct tee_shm *shm)
522 {
523 struct sandbox_tee_state *state = dev_get_priv(dev);
524
525 state->num_shms++;
526
527 return 0;
528 }
529
sandbox_tee_shm_unregister(struct udevice * dev,struct tee_shm * shm)530 static int sandbox_tee_shm_unregister(struct udevice *dev, struct tee_shm *shm)
531 {
532 struct sandbox_tee_state *state = dev_get_priv(dev);
533
534 state->num_shms--;
535
536 return 0;
537 }
538
sandbox_tee_remove(struct udevice * dev)539 static int sandbox_tee_remove(struct udevice *dev)
540 {
541 struct sandbox_tee_state *state = dev_get_priv(dev);
542
543 hdestroy_r(&state->pstorage_htab);
544
545 return 0;
546 }
547
sandbox_tee_probe(struct udevice * dev)548 static int sandbox_tee_probe(struct udevice *dev)
549 {
550 struct sandbox_tee_state *state = dev_get_priv(dev);
551 /*
552 * With this hastable we emulate persistent storage,
553 * which should contain persistent values
554 * between different sessions/command invocations.
555 */
556 if (!hcreate_r(pstorage_max, &state->pstorage_htab))
557 return TEE_ERROR_OUT_OF_MEMORY;
558
559 return 0;
560 }
561
562 static const struct tee_driver_ops sandbox_tee_ops = {
563 .get_version = sandbox_tee_get_version,
564 .open_session = sandbox_tee_open_session,
565 .close_session = sandbox_tee_close_session,
566 .invoke_func = sandbox_tee_invoke_func,
567 .shm_register = sandbox_tee_shm_register,
568 .shm_unregister = sandbox_tee_shm_unregister,
569 };
570
571 static const struct udevice_id sandbox_tee_match[] = {
572 { .compatible = "sandbox,tee" },
573 {},
574 };
575
576 U_BOOT_DRIVER(sandbox_tee) = {
577 .name = "sandbox_tee",
578 .id = UCLASS_TEE,
579 .of_match = sandbox_tee_match,
580 .ops = &sandbox_tee_ops,
581 .priv_auto = sizeof(struct sandbox_tee_state),
582 .probe = sandbox_tee_probe,
583 .remove = sandbox_tee_remove,
584 };
585