| /* |
| * Copyright (c) 2018-2021, Arm Limited. All rights reserved. |
| * |
| * SPDX-License-Identifier: BSD-3-Clause |
| * |
| */ |
| |
| #include <inttypes.h> |
| #include <stdbool.h> |
| #include "bitops.h" |
| #include "fih.h" |
| #include "psa/client.h" |
| #include "psa/service.h" |
| #include "tfm_thread.h" |
| #include "tfm_wait.h" |
| #include "internal_errors.h" |
| #include "tfm_spm_hal.h" |
| #include "tfm_api.h" |
| #include "tfm_secure_api.h" |
| #include "tfm_memory_utils.h" |
| #include "tfm_hal_defs.h" |
| #include "tfm_hal_isolation.h" |
| #include "spm_ipc.h" |
| #include "tfm_peripherals_def.h" |
| #include "tfm_core_utils.h" |
| #include "tfm_nspm.h" |
| #include "tfm_rpc.h" |
| #include "tfm_core_trustzone.h" |
| #include "lists.h" |
| #include "tfm_pools.h" |
| #include "region.h" |
| #include "psa_manifest/pid.h" |
| #include "load/partition_defs.h" |
| #include "load/service_defs.h" |
| #include "load/asset_defs.h" |
| #include "load/spm_load_api.h" |
| #include "load/interrupt_defs.h" |
| |
| /* Partition and service runtime data list head/runtime data table */ |
| static struct partition_head_t partitions_listhead; |
| static struct service_head_t services_listhead; |
| struct service_t *stateless_services_ref_tbl[STATIC_HANDLE_NUM_LIMIT]; |
| |
| /* Pools */ |
| TFM_POOL_DECLARE(conn_handle_pool, sizeof(struct tfm_conn_handle_t), |
| TFM_CONN_HANDLE_MAX_NUM); |
| |
| /* The veneer section names come from the scatter file */ |
| REGION_DECLARE(Image$$, TFM_UNPRIV_CODE, $$RO$$Base); |
| REGION_DECLARE(Image$$, TFM_UNPRIV_CODE, $$RO$$Limit); |
| |
| void spm_interrupt_handler(struct partition_load_info_t *p_ldinf, |
| psa_signal_t signal, |
| uint32_t irq_line, |
| psa_flih_func flih_func); |
| |
| #include "tfm_secure_irq_handlers_ipc.inc" |
| |
| /*********************** Connection handle conversion APIs *******************/ |
| |
| #define CONVERSION_FACTOR_BITOFFSET 3 |
| #define CONVERSION_FACTOR_VALUE (1 << CONVERSION_FACTOR_BITOFFSET) |
| /* Set 32 as the maximum */ |
| #define CONVERSION_FACTOR_VALUE_MAX 0x20 |
| |
| #if CONVERSION_FACTOR_VALUE > CONVERSION_FACTOR_VALUE_MAX |
| #error "CONVERSION FACTOR OUT OF RANGE" |
| #endif |
| |
| static uint32_t loop_index; |
| |
| /* |
| * A handle instance psa_handle_t allocated inside SPM is actually a memory |
| * address among the handle pool. Return this handle to the client directly |
| * exposes information of secure memory address. In this case, converting the |
| * handle into another value does not represent the memory address to avoid |
| * exposing secure memory directly to clients. |
| * |
| * This function converts the handle instance into another value by scaling the |
| * handle in pool offset, the converted value is named as a user handle. |
| * |
| * The formula: |
| * user_handle = (handle_instance - POOL_START) * CONVERSION_FACTOR_VALUE + |
| * CLIENT_HANDLE_VALUE_MIN + loop_index |
| * where: |
| * CONVERSION_FACTOR_VALUE = 1 << CONVERSION_FACTOR_BITOFFSET, and should not |
| * exceed CONVERSION_FACTOR_VALUE_MAX. |
| * |
| * handle_instance in RANGE[POOL_START, POOL_END] |
| * user_handle in RANGE[CLIENT_HANDLE_VALUE_MIN, 0x3FFFFFFF] |
| * loop_index in RANGE[0, CONVERSION_FACTOR_VALUE - 1] |
| * |
| * note: |
| * loop_index is used to promise same handle instance is converted into |
| * different user handles in short time. |
| */ |
| psa_handle_t tfm_spm_to_user_handle(struct tfm_conn_handle_t *handle_instance) |
| { |
| psa_handle_t user_handle; |
| |
| loop_index = (loop_index + 1) % CONVERSION_FACTOR_VALUE; |
| user_handle = (psa_handle_t)((((uintptr_t)handle_instance - |
| (uintptr_t)conn_handle_pool) << CONVERSION_FACTOR_BITOFFSET) + |
| CLIENT_HANDLE_VALUE_MIN + loop_index); |
| |
| return user_handle; |
| } |
| |
| /* |
| * This function converts a user handle into a corresponded handle instance. |
| * The converted value is validated before returning, an invalid handle instance |
| * is returned as NULL. |
| * |
| * The formula: |
| * handle_instance = ((user_handle - CLIENT_HANDLE_VALUE_MIN) / |
| * CONVERSION_FACTOR_VALUE) + POOL_START |
| * where: |
| * CONVERSION_FACTOR_VALUE = 1 << CONVERSION_FACTOR_BITOFFSET, and should not |
| * exceed CONVERSION_FACTOR_VALUE_MAX. |
| * |
| * handle_instance in RANGE[POOL_START, POOL_END] |
| * user_handle in RANGE[CLIENT_HANDLE_VALUE_MIN, 0x3FFFFFFF] |
| * loop_index in RANGE[0, CONVERSION_FACTOR_VALUE - 1] |
| */ |
| struct tfm_conn_handle_t *tfm_spm_to_handle_instance(psa_handle_t user_handle) |
| { |
| struct tfm_conn_handle_t *handle_instance; |
| |
| if (user_handle == PSA_NULL_HANDLE) { |
| return NULL; |
| } |
| |
| handle_instance = (struct tfm_conn_handle_t *)((((uintptr_t)user_handle - |
| CLIENT_HANDLE_VALUE_MIN) >> CONVERSION_FACTOR_BITOFFSET) + |
| (uintptr_t)conn_handle_pool); |
| |
| return handle_instance; |
| } |
| |
| /* Service handle management functions */ |
| struct tfm_conn_handle_t *tfm_spm_create_conn_handle(struct service_t *service, |
| int32_t client_id) |
| { |
| struct tfm_conn_handle_t *p_handle; |
| |
| TFM_CORE_ASSERT(service); |
| |
| /* Get buffer for handle list structure from handle pool */ |
| p_handle = (struct tfm_conn_handle_t *)tfm_pool_alloc(conn_handle_pool); |
| if (!p_handle) { |
| return NULL; |
| } |
| |
| p_handle->service = service; |
| p_handle->status = TFM_HANDLE_STATUS_IDLE; |
| p_handle->client_id = client_id; |
| |
| /* Add handle node to list for next psa functions */ |
| BI_LIST_INSERT_BEFORE(&service->handle_list, &p_handle->list); |
| |
| return p_handle; |
| } |
| |
| int32_t tfm_spm_validate_conn_handle( |
| const struct tfm_conn_handle_t *conn_handle, |
| int32_t client_id) |
| { |
| /* Check the handle address is validated */ |
| if (is_valid_chunk_data_in_pool(conn_handle_pool, |
| (uint8_t *)conn_handle) != true) { |
| return SPM_ERROR_GENERIC; |
| } |
| |
| /* Check the handle caller is correct */ |
| if (conn_handle->client_id != client_id) { |
| return SPM_ERROR_GENERIC; |
| } |
| |
| return SPM_SUCCESS; |
| } |
| |
| int32_t tfm_spm_free_conn_handle(struct service_t *service, |
| struct tfm_conn_handle_t *conn_handle) |
| { |
| TFM_CORE_ASSERT(service); |
| TFM_CORE_ASSERT(conn_handle != NULL); |
| |
| /* Clear magic as the handler is not used anymore */ |
| conn_handle->internal_msg.magic = 0; |
| |
| /* Remove node from handle list */ |
| BI_LIST_REMOVE_NODE(&conn_handle->list); |
| |
| /* Back handle buffer to pool */ |
| tfm_pool_free(conn_handle_pool, conn_handle); |
| return SPM_SUCCESS; |
| } |
| |
| int32_t tfm_spm_set_rhandle(struct service_t *service, |
| struct tfm_conn_handle_t *conn_handle, |
| void *rhandle) |
| { |
| TFM_CORE_ASSERT(service); |
| /* Set reverse handle value only be allowed for a connected handle */ |
| TFM_CORE_ASSERT(conn_handle != NULL); |
| |
| conn_handle->rhandle = rhandle; |
| return SPM_SUCCESS; |
| } |
| |
| /** |
| * \brief Get reverse handle value from connection handle. |
| * |
| * \param[in] service Target service context pointer |
| * \param[in] conn_handle Connection handle created by |
| * tfm_spm_create_conn_handle() |
| * |
| * \retval void * Success |
| * \retval "Does not return" Panic for those: |
| * service pointer are NULL |
| * handle is \ref PSA_NULL_HANDLE |
| * handle node does not be found |
| */ |
| static void *tfm_spm_get_rhandle(struct service_t *service, |
| struct tfm_conn_handle_t *conn_handle) |
| { |
| TFM_CORE_ASSERT(service); |
| /* Get reverse handle value only be allowed for a connected handle */ |
| TFM_CORE_ASSERT(conn_handle != NULL); |
| |
| return conn_handle->rhandle; |
| } |
| |
| /* Partition management functions */ |
| |
| struct tfm_msg_body_t *tfm_spm_get_msg_by_signal(struct partition_t *partition, |
| psa_signal_t signal) |
| { |
| struct bi_list_node_t *node, *head; |
| struct tfm_msg_body_t *tmp_msg, *msg = NULL; |
| |
| TFM_CORE_ASSERT(partition); |
| |
| head = &partition->msg_list; |
| |
| if (BI_LIST_IS_EMPTY(head)) { |
| return NULL; |
| } |
| |
| /* |
| * There may be multiple messages for this RoT Service signal, do not clear |
| * partition mask until no remaining message. Search may be optimized. |
| */ |
| BI_LIST_FOR_EACH(node, head) { |
| tmp_msg = TO_CONTAINER(node, struct tfm_msg_body_t, msg_node); |
| if (tmp_msg->service->p_ldinf->signal == signal && msg) { |
| return msg; |
| } else if (tmp_msg->service->p_ldinf->signal == signal) { |
| msg = tmp_msg; |
| BI_LIST_REMOVE_NODE(node); |
| } |
| } |
| |
| partition->signals_asserted &= ~signal; |
| |
| return msg; |
| } |
| |
| uint32_t tfm_spm_partition_get_privileged_mode(uint32_t partition_flags) |
| { |
| #if TFM_LVL == 1 |
| return TFM_PARTITION_PRIVILEGED_MODE; |
| #else /* TFM_LVL == 1 */ |
| if (partition_flags & SPM_PART_FLAG_PSA_ROT) { |
| return TFM_PARTITION_PRIVILEGED_MODE; |
| } else { |
| return TFM_PARTITION_UNPRIVILEGED_MODE; |
| } |
| #endif /* TFM_LVL == 1 */ |
| } |
| |
| struct service_t *tfm_spm_get_service_by_sid(uint32_t sid) |
| { |
| struct service_t *p_prev, *p_curr; |
| |
| UNI_LIST_FOR_EACH_PREV(p_prev, p_curr, &services_listhead) { |
| if (p_curr->p_ldinf->sid == sid) { |
| UNI_LIST_MOVE_AFTER(&services_listhead, p_prev, p_curr); |
| return p_curr; |
| } |
| } |
| |
| return NULL; |
| } |
| |
| /** |
| * \brief Get the partition context by partition ID. |
| * |
| * \param[in] partition_id Partition identity |
| * |
| * \retval NULL Failed |
| * \retval "Not NULL" Target partition context pointer, |
| * \ref partition_t structures |
| */ |
| struct partition_t *tfm_spm_get_partition_by_id(int32_t partition_id) |
| { |
| struct partition_t *p_part; |
| |
| UNI_LIST_FOR_EACH(p_part, &partitions_listhead) { |
| if (p_part->p_ldinf->pid == partition_id) { |
| return p_part; |
| } |
| } |
| |
| return NULL; |
| } |
| |
| struct partition_t *tfm_spm_get_running_partition(void) |
| { |
| struct tfm_core_thread_t *pth = tfm_core_thrd_get_curr(); |
| struct partition_t *partition; |
| |
| partition = TO_CONTAINER(pth, struct partition_t, sp_thread); |
| |
| return partition; |
| } |
| |
| int32_t tfm_spm_check_client_version(struct service_t *service, |
| uint32_t version) |
| { |
| TFM_CORE_ASSERT(service); |
| |
| switch (SERVICE_GET_VERSION_POLICY(service->p_ldinf->flags)) { |
| case SERVICE_VERSION_POLICY_RELAXED: |
| if (version > service->p_ldinf->version) { |
| return SPM_ERROR_VERSION; |
| } |
| break; |
| case SERVICE_VERSION_POLICY_STRICT: |
| if (version != service->p_ldinf->version) { |
| return SPM_ERROR_VERSION; |
| } |
| break; |
| default: |
| return SPM_ERROR_VERSION; |
| } |
| return SPM_SUCCESS; |
| } |
| |
| int32_t tfm_spm_check_authorization(uint32_t sid, |
| struct service_t *service, |
| bool ns_caller) |
| { |
| struct partition_t *partition = NULL; |
| uint32_t *dep; |
| int32_t i; |
| |
| TFM_CORE_ASSERT(service); |
| |
| if (ns_caller) { |
| if (!SERVICE_IS_NS_ACCESSIBLE(service->p_ldinf->flags)) { |
| return SPM_ERROR_GENERIC; |
| } |
| } else { |
| partition = tfm_spm_get_running_partition(); |
| if (!partition) { |
| tfm_core_panic(); |
| } |
| |
| dep = (uint32_t *)LOAD_INFO_DEPS(partition->p_ldinf); |
| for (i = 0; i < partition->p_ldinf->ndeps; i++) { |
| if (dep[i] == sid) { |
| break; |
| } |
| } |
| |
| if (i == partition->p_ldinf->ndeps) { |
| return SPM_ERROR_GENERIC; |
| } |
| } |
| return SPM_SUCCESS; |
| } |
| |
| /* Message functions */ |
| |
| struct tfm_msg_body_t *tfm_spm_get_msg_from_handle(psa_handle_t msg_handle) |
| { |
| /* |
| * The message handler passed by the caller is considered invalid in the |
| * following cases: |
| * 1. Not a valid message handle. (The address of a message is not the |
| * address of a possible handle from the pool |
| * 2. Handle not belongs to the caller partition (The handle is either |
| * unused, or owned by anither partition) |
| * Check the conditions above |
| */ |
| struct tfm_msg_body_t *p_msg; |
| int32_t partition_id; |
| struct tfm_conn_handle_t *p_conn_handle = |
| tfm_spm_to_handle_instance(msg_handle); |
| |
| if (is_valid_chunk_data_in_pool( |
| conn_handle_pool, (uint8_t *)p_conn_handle) != 1) { |
| return NULL; |
| } |
| |
| p_msg = &p_conn_handle->internal_msg; |
| |
| /* |
| * Check that the magic number is correct. This proves that the message |
| * structure contains an active message. |
| */ |
| if (p_msg->magic != TFM_MSG_MAGIC) { |
| return NULL; |
| } |
| |
| /* Check that the running partition owns the message */ |
| partition_id = tfm_spm_partition_get_running_partition_id(); |
| if (partition_id != p_msg->service->partition->p_ldinf->pid) { |
| return NULL; |
| } |
| |
| return p_msg; |
| } |
| |
| struct tfm_msg_body_t * |
| tfm_spm_get_msg_buffer_from_conn_handle(struct tfm_conn_handle_t *conn_handle) |
| { |
| TFM_CORE_ASSERT(conn_handle != NULL); |
| |
| return &(conn_handle->internal_msg); |
| } |
| |
| void tfm_spm_fill_msg(struct tfm_msg_body_t *msg, |
| struct service_t *service, |
| psa_handle_t handle, |
| int32_t type, int32_t client_id, |
| psa_invec *invec, size_t in_len, |
| psa_outvec *outvec, size_t out_len, |
| psa_outvec *caller_outvec) |
| { |
| uint32_t i; |
| struct tfm_conn_handle_t *conn_handle; |
| |
| TFM_CORE_ASSERT(msg); |
| TFM_CORE_ASSERT(service); |
| TFM_CORE_ASSERT(!(invec == NULL && in_len != 0)); |
| TFM_CORE_ASSERT(!(outvec == NULL && out_len != 0)); |
| TFM_CORE_ASSERT(in_len <= PSA_MAX_IOVEC); |
| TFM_CORE_ASSERT(out_len <= PSA_MAX_IOVEC); |
| TFM_CORE_ASSERT(in_len + out_len <= PSA_MAX_IOVEC); |
| |
| /* Clear message buffer before using it */ |
| spm_memset(msg, 0, sizeof(struct tfm_msg_body_t)); |
| |
| tfm_event_init(&msg->ack_evnt); |
| msg->magic = TFM_MSG_MAGIC; |
| msg->service = service; |
| msg->caller_outvec = caller_outvec; |
| msg->msg.client_id = client_id; |
| |
| /* Copy contents */ |
| msg->msg.type = type; |
| |
| for (i = 0; i < in_len; i++) { |
| msg->msg.in_size[i] = invec[i].len; |
| msg->invec[i].base = invec[i].base; |
| } |
| |
| for (i = 0; i < out_len; i++) { |
| msg->msg.out_size[i] = outvec[i].len; |
| msg->outvec[i].base = outvec[i].base; |
| /* Out len is used to record the writed number, set 0 here again */ |
| msg->outvec[i].len = 0; |
| } |
| |
| /* Use the user connect handle as the message handle */ |
| msg->msg.handle = handle; |
| |
| conn_handle = tfm_spm_to_handle_instance(handle); |
| /* For connected handle, set rhandle to every message */ |
| if (conn_handle) { |
| msg->msg.rhandle = tfm_spm_get_rhandle(service, conn_handle); |
| } |
| |
| /* Set the private data of NSPE client caller in multi-core topology */ |
| if (TFM_CLIENT_ID_IS_NS(client_id)) { |
| tfm_rpc_set_caller_data(msg, client_id); |
| } |
| } |
| |
| void tfm_spm_send_event(struct service_t *service, |
| struct tfm_msg_body_t *msg) |
| { |
| struct partition_t *partition = NULL; |
| psa_signal_t signal = 0; |
| |
| if (!msg || !service || !service->p_ldinf || !service->partition) { |
| tfm_core_panic(); |
| } |
| |
| partition = service->partition; |
| signal = service->p_ldinf->signal; |
| |
| /* Add message to partition message list tail */ |
| BI_LIST_INSERT_BEFORE(&partition->msg_list, &msg->msg_node); |
| |
| /* Messages put. Update signals */ |
| partition->signals_asserted |= signal; |
| |
| if (partition->signals_waiting & signal) { |
| tfm_event_wake( |
| &partition->event, |
| (partition->signals_asserted & partition->signals_waiting)); |
| partition->signals_waiting &= ~signal; |
| } |
| |
| /* |
| * If it is a NS request via RPC, it is unnecessary to block current |
| * thread. |
| */ |
| if (!is_tfm_rpc_msg(msg)) { |
| tfm_event_wait(&msg->ack_evnt); |
| } |
| } |
| |
| int32_t tfm_spm_partition_get_running_partition_id(void) |
| { |
| struct partition_t *partition; |
| |
| partition = tfm_spm_get_running_partition(); |
| if (partition && partition->p_ldinf) { |
| return partition->p_ldinf->pid; |
| } else { |
| return INVALID_PARTITION_ID; |
| } |
| } |
| |
| int32_t tfm_memory_check(const void *buffer, size_t len, bool ns_caller, |
| enum tfm_memory_access_e access, |
| uint32_t privileged) |
| { |
| enum tfm_hal_status_t err; |
| uint32_t attr = 0; |
| |
| /* If len is zero, this indicates an empty buffer and base is ignored */ |
| if (len == 0) { |
| return SPM_SUCCESS; |
| } |
| |
| if (!buffer) { |
| return SPM_ERROR_BAD_PARAMETERS; |
| } |
| |
| if ((uintptr_t)buffer > (UINTPTR_MAX - len)) { |
| return SPM_ERROR_MEMORY_CHECK; |
| } |
| |
| if (access == TFM_MEMORY_ACCESS_RW) { |
| attr |= (TFM_HAL_ACCESS_READABLE | TFM_HAL_ACCESS_WRITABLE); |
| } else { |
| attr |= TFM_HAL_ACCESS_READABLE; |
| } |
| |
| if (privileged == TFM_PARTITION_UNPRIVILEGED_MODE) { |
| attr |= TFM_HAL_ACCESS_UNPRIVILEGED; |
| } else { |
| attr &= ~TFM_HAL_ACCESS_UNPRIVILEGED; |
| } |
| |
| if (ns_caller) { |
| attr |= TFM_HAL_ACCESS_NS; |
| } |
| |
| err = tfm_hal_memory_has_access((uintptr_t)buffer, len, attr); |
| |
| if (err == TFM_HAL_SUCCESS) { |
| return SPM_SUCCESS; |
| } |
| |
| return SPM_ERROR_MEMORY_CHECK; |
| } |
| |
| bool tfm_spm_is_ns_caller(void) |
| { |
| #if defined(TFM_MULTI_CORE_TOPOLOGY) || defined(FORWARD_PROT_MSG) |
| /* Multi-core NS PSA API request is processed by pendSV. */ |
| return (__get_active_exc_num() == EXC_NUM_PENDSV); |
| #else |
| struct partition_t *partition = tfm_spm_get_running_partition(); |
| |
| if (!partition) { |
| tfm_core_panic(); |
| } |
| |
| return (partition->p_ldinf->pid == TFM_SP_NON_SECURE_ID); |
| #endif |
| } |
| |
| uint32_t tfm_spm_get_caller_privilege_mode(void) |
| { |
| struct partition_t *partition; |
| |
| #if defined(TFM_MULTI_CORE_TOPOLOGY) || defined(FORWARD_PROT_MSG) |
| /* |
| * In multi-core topology, if PSA request is from mailbox, the client |
| * is unprivileged. |
| */ |
| if (__get_active_exc_num() == EXC_NUM_PENDSV) { |
| return TFM_PARTITION_UNPRIVILEGED_MODE; |
| } |
| #endif |
| partition = tfm_spm_get_running_partition(); |
| if (!partition) { |
| tfm_core_panic(); |
| } |
| |
| return tfm_spm_partition_get_privileged_mode(partition->p_ldinf->flags); |
| } |
| |
| int32_t tfm_spm_get_client_id(bool ns_caller) |
| { |
| int32_t client_id; |
| |
| if (ns_caller) { |
| client_id = tfm_nspm_get_current_client_id(); |
| } else { |
| client_id = tfm_spm_partition_get_running_partition_id(); |
| } |
| |
| if (ns_caller != (client_id < 0)) { |
| /* NS client ID must be negative and Secure ID must >= 0 */ |
| tfm_core_panic(); |
| } |
| |
| return client_id; |
| } |
| |
| uint32_t tfm_spm_init(void) |
| { |
| struct partition_t *partition; |
| struct tfm_core_thread_t *pth, *p_ns_entry_thread = NULL; |
| const struct partition_load_info_t *p_ldinf; |
| void *p_boundaries = NULL; |
| |
| #ifdef TFM_FIH_PROFILE_ON |
| fih_int fih_rc = FIH_FAILURE; |
| #endif |
| |
| tfm_pool_init(conn_handle_pool, |
| POOL_BUFFER_SIZE(conn_handle_pool), |
| sizeof(struct tfm_conn_handle_t), |
| TFM_CONN_HANDLE_MAX_NUM); |
| |
| UNI_LISI_INIT_HEAD(&partitions_listhead); |
| UNI_LISI_INIT_HEAD(&services_listhead); |
| |
| while (1) { |
| partition = load_a_partition_assuredly(&partitions_listhead); |
| if (partition == NO_MORE_PARTITION) { |
| break; |
| } |
| |
| p_ldinf = partition->p_ldinf; |
| |
| if (p_ldinf->nservices) { |
| load_services_assuredly(partition, &services_listhead, |
| stateless_services_ref_tbl, |
| sizeof(stateless_services_ref_tbl)); |
| } |
| |
| if (p_ldinf->nirqs) { |
| load_irqs_assuredly(partition); |
| } |
| |
| /* Bind the partition with plaform. */ |
| #if TFM_FIH_PROFILE_ON |
| FIH_CALL(tfm_hal_bind_boundaries, fih_rc, partition->p_ldinf, |
| &p_boundaries); |
| if (fih_not_eq(fih_rc, fih_int_encode(TFM_HAL_SUCCESS))) { |
| tfm_core_panic(); |
| } |
| #else /* TFM_FIH_PROFILE_ON */ |
| if (tfm_hal_bind_boundaries(partition->p_ldinf, |
| &p_boundaries) != TFM_HAL_SUCCESS) { |
| tfm_core_panic(); |
| } |
| #endif /* TFM_FIH_PROFILE_ON */ |
| |
| partition->p_boundaries = p_boundaries; |
| partition->signals_allowed |= PSA_DOORBELL; |
| |
| tfm_event_init(&partition->event); |
| BI_LIST_INIT_NODE(&partition->msg_list); |
| |
| pth = &partition->sp_thread; |
| |
| /* Extendable partition load info is right after p_ldinf. */ |
| tfm_core_thrd_init( |
| pth, |
| POSITION_TO_ENTRY(p_ldinf->entry, tfm_core_thrd_entry_t), |
| NULL, |
| LOAD_ALLOCED_STACK_ADDR(p_ldinf) + p_ldinf->stack_size, |
| LOAD_ALLOCED_STACK_ADDR(p_ldinf)); |
| |
| pth->prior = TO_THREAD_PRIORITY(PARTITION_PRIORITY(p_ldinf->flags)); |
| |
| if (p_ldinf->pid == TFM_SP_NON_SECURE_ID) { |
| p_ns_entry_thread = pth; |
| pth->param = (void *)tfm_spm_hal_get_ns_entry_point(); |
| } |
| |
| /* Kick off */ |
| if (tfm_core_thrd_start(pth) != THRD_SUCCESS) { |
| tfm_core_panic(); |
| } |
| } |
| |
| /* |
| * All threads initialized, start the scheduler. |
| * |
| * NOTE: |
| * It is worthy to give the thread object to scheduler if the background |
| * context belongs to one of the threads. Here the background thread is the |
| * initialization thread who calls SPM SVC, which re-uses the non-secure |
| * entry thread's stack. After SPM initialization is done, this stack is |
| * cleaned up and the background context is never going to return. Tell |
| * the scheduler that the current thread is non-secure entry thread. |
| */ |
| tfm_core_thrd_start_scheduler(p_ns_entry_thread); |
| |
| return p_ns_entry_thread->arch_ctx.lr; |
| } |
| |
| void tfm_pendsv_do_schedule(struct tfm_arch_ctx_t *p_actx) |
| { |
| struct partition_t *p_part_curr, *p_part_next; |
| struct tfm_core_thread_t *pth_next = tfm_core_thrd_get_next(); |
| struct tfm_core_thread_t *pth_curr = tfm_core_thrd_get_curr(); |
| |
| if (pth_next != NULL && pth_curr != pth_next) { |
| p_part_curr = TO_CONTAINER(pth_curr, struct partition_t, sp_thread); |
| p_part_next = TO_CONTAINER(pth_next, struct partition_t, sp_thread); |
| |
| /* |
| * If required, let the platform update boundary based on its |
| * implementation. Change privilege, MPU or other configurations. |
| */ |
| if (p_part_curr->p_boundaries != p_part_next->p_boundaries) { |
| if (tfm_hal_update_boundaries(p_part_next->p_ldinf, |
| p_part_next->p_boundaries) |
| != TFM_HAL_SUCCESS) { |
| tfm_core_panic(); |
| } |
| } |
| tfm_core_thrd_switch_context(p_actx, pth_curr, pth_next); |
| } |
| |
| /* |
| * Handle pending mailbox message from NS in multi-core topology. |
| * Empty operation on single Armv8-M platform. |
| */ |
| tfm_rpc_client_call_handler(); |
| } |
| |
| void update_caller_outvec_len(struct tfm_msg_body_t *msg) |
| { |
| uint32_t i; |
| |
| /* |
| * FixeMe: abstract these part into dedicated functions to avoid |
| * accessing thread context in psa layer |
| */ |
| /* If it is a NS request via RPC, the owner of this message is not set */ |
| if (!is_tfm_rpc_msg(msg)) { |
| TFM_CORE_ASSERT(msg->ack_evnt.owner->state == THRD_STATE_BLOCK); |
| } |
| |
| for (i = 0; i < PSA_MAX_IOVEC; i++) { |
| if (msg->msg.out_size[i] == 0) { |
| continue; |
| } |
| |
| TFM_CORE_ASSERT(msg->caller_outvec[i].base == msg->outvec[i].base); |
| |
| msg->caller_outvec[i].len = msg->outvec[i].len; |
| } |
| } |
| |
| void notify_with_signal(int32_t partition_id, psa_signal_t signal) |
| { |
| struct partition_t *partition = NULL; |
| |
| /* |
| * The value of partition_id must be greater than zero as the target of |
| * notification must be a Secure Partition, providing a Non-secure |
| * Partition ID is a fatal error. |
| */ |
| if (!TFM_CLIENT_ID_IS_S(partition_id)) { |
| tfm_core_panic(); |
| } |
| |
| /* |
| * It is a fatal error if partition_id does not correspond to a Secure |
| * Partition. |
| */ |
| partition = tfm_spm_get_partition_by_id(partition_id); |
| if (!partition) { |
| tfm_core_panic(); |
| } |
| |
| partition->signals_asserted |= signal; |
| |
| if (partition->signals_waiting & signal) { |
| tfm_event_wake( |
| &partition->event, |
| partition->signals_asserted & partition->signals_waiting); |
| partition->signals_waiting &= ~signal; |
| } |
| } |
| |
| __attribute__((naked)) |
| static void tfm_flih_deprivileged_handling(uint32_t p_ldinf, |
| psa_flih_func flih_func, |
| psa_signal_t signal) |
| { |
| __ASM volatile("SVC %0 \n" |
| "BX LR \n" |
| : : "I" (TFM_SVC_PREPARE_DEPRIV_FLIH)); |
| } |
| |
| void spm_interrupt_handler(struct partition_load_info_t *p_ldinf, |
| psa_signal_t signal, |
| uint32_t irq_line, |
| psa_flih_func flih_func) |
| { |
| int32_t pid; |
| psa_flih_result_t flih_result; |
| |
| pid = p_ldinf->pid; |
| |
| if (flih_func == NULL) { |
| /* SLIH Model Handling */ |
| __disable_irq(); |
| tfm_spm_hal_disable_irq(irq_line); |
| notify_with_signal(pid, signal); |
| __enable_irq(); |
| return; |
| } |
| |
| /* FLIH Model Handling */ |
| if (tfm_spm_partition_get_privileged_mode(p_ldinf->flags) == |
| TFM_PARTITION_PRIVILEGED_MODE) { |
| flih_result = flih_func(); |
| if (flih_result == PSA_FLIH_SIGNAL) { |
| __disable_irq(); |
| notify_with_signal(pid, signal); |
| __enable_irq(); |
| } else if (flih_result != PSA_FLIH_NO_SIGNAL) { |
| /* |
| * Nothing needed to do for PSA_FLIH_NO_SIGNAL |
| * But if the flih_result is invalid, should panic. |
| */ |
| tfm_core_panic(); |
| } |
| } else { |
| tfm_flih_deprivileged_handling((uint32_t)p_ldinf, flih_func, signal); |
| } |
| } |
| |
| struct irq_load_info_t *get_irq_info_for_signal( |
| const struct partition_load_info_t *p_ldinf, |
| psa_signal_t signal) |
| { |
| size_t i; |
| struct irq_load_info_t *irq_info; |
| |
| if (!IS_ONLY_ONE_BIT_IN_UINT32(signal)) { |
| return NULL; |
| } |
| |
| irq_info = (struct irq_load_info_t *)LOAD_INFO_IRQ(p_ldinf); |
| for (i = 0; i < p_ldinf->nirqs; i++) { |
| if (irq_info[i].signal == signal) { |
| return &irq_info[i]; |
| } |
| } |
| |
| return NULL; |
| } |
| |
| #if !defined(__ARM_ARCH_8_1M_MAIN__) |
| void tfm_spm_validate_caller(uint32_t *p_ctx, uint32_t exc_return) |
| { |
| /* |
| * TODO: the reentrant detection mechanism needs to be changed when there |
| * is no boundaries. |
| */ |
| uintptr_t stacked_ctx_pos; |
| bool ns_caller = false; |
| struct partition_t *p_cur_sp = tfm_spm_get_running_partition(); |
| uint32_t veneer_base = |
| (uint32_t)®ION_NAME(Image$$, TFM_UNPRIV_CODE, $$RO$$Base); |
| uint32_t veneer_limit = |
| (uint32_t)®ION_NAME(Image$$, TFM_UNPRIV_CODE, $$RO$$Limit); |
| |
| if (!p_cur_sp) { |
| tfm_core_panic(); |
| } |
| |
| /* |
| * The caller security attribute detection bases on LR of state context. |
| * However, if SP calls PSA APIs based on its customized SVC, the LR may be |
| * occupied by general purpose value while calling SVC. |
| * Check if caller comes from non-secure: return address (p_ctx[6]) belongs |
| * to veneer section, and the bit0 of LR (p_ctx[5]) is zero. |
| */ |
| if (p_ctx[6] >= veneer_base && p_ctx[6] < veneer_limit && |
| !(p_ctx[5] & TFM_VENEER_LR_BIT0_MASK)) { |
| ns_caller = true; |
| } |
| |
| /* If called from ns, partition ID should be TFM_SP_NON_SECURE_ID. */ |
| if ((ns_caller == true) != |
| (p_cur_sp->p_ldinf->pid == TFM_SP_NON_SECURE_ID)) { |
| tfm_core_panic(); |
| } |
| |
| if (ns_caller) { |
| /* |
| * The background IRQ can't be supported, since if SP is executing, |
| * the preempted context of SP can be different with the one who |
| * preempts veneer. Check if veneer stack contains multiple contexts. |
| */ |
| stacked_ctx_pos = (uintptr_t)p_ctx + |
| sizeof(struct tfm_state_context_t) + |
| TFM_STACK_SEALED_SIZE; |
| |
| if (is_stack_alloc_fp_space(exc_return)) { |
| #if defined(__FPU_USED) && (__FPU_USED == 1U) |
| if (FPU->FPCCR & FPU_FPCCR_TS_Msk) { |
| stacked_ctx_pos += TFM_ADDTIONAL_FP_CONTEXT_WORDS * |
| sizeof(uint32_t); |
| } |
| #endif |
| stacked_ctx_pos += TFM_BASIC_FP_CONTEXT_WORDS * sizeof(uint32_t); |
| } |
| |
| if (stacked_ctx_pos != p_cur_sp->sp_thread.stk_top) { |
| tfm_core_panic(); |
| } |
| } |
| } |
| #endif |