1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2023 ARM Ltd.
4 */
5
6 #include <linux/arm-smccc.h>
7 #include <linux/cc_platform.h>
8 #include <linux/kernel.h>
9 #include <linux/device-id/platform.h>
10 #include <linux/module.h>
11 #include <linux/smp.h>
12 #include <linux/tsm.h>
13 #include <linux/types.h>
14
15 #include <asm/rsi.h>
16
17 /**
18 * struct arm_cca_token_info - a descriptor for the token buffer.
19 * @granule: PA of the granule to which the token will be written
20 * @offset: Offset within granule to start of buffer in bytes
21 */
22 struct arm_cca_token_info {
23 phys_addr_t granule;
24 unsigned long offset;
25 };
26
27 /**
28 * arm_cca_attestation_continue - Retrieve the attestation token data.
29 *
30 * @info: pointer to the arm_cca_token_info
31 *
32 * Attestation token generation is a long running operation and therefore
33 * the token data may not be retrieved in a single call. Moreover, the
34 * token retrieval operation must be requested on the same CPU on which the
35 * attestation token generation was initialised.
36 * This helper function must therefore be executed on the same CPU multiple
37 * times until the entire token data is retrieved.
38 */
39 static unsigned long
arm_cca_attestation_continue(struct arm_cca_token_info * info)40 arm_cca_attestation_continue(struct arm_cca_token_info *info)
41 {
42 unsigned long ret;
43 unsigned long len;
44 unsigned long size;
45
46 size = RSI_GRANULE_SIZE - info->offset;
47 ret = rsi_attestation_token_continue(info->granule, info->offset, size,
48 &len);
49 info->offset += len;
50 return ret;
51 }
52
53 /**
54 * arm_cca_report_new - Generate a new attestation token.
55 *
56 * @report: pointer to the TSM report context information.
57 * @data: pointer to the context specific data for this module.
58 *
59 * Initialise the attestation token generation using the challenge data
60 * passed in the TSM descriptor. Allocate memory for the attestation token
61 * and retrieve the attestation token on the same CPU on which the
62 * attestation token generation was initialised.
63 *
64 * The challenge data must be at least 32 bytes and no more than 64 bytes. If
65 * less than 64 bytes are provided it will be zero padded to 64 bytes.
66 *
67 * Return:
68 * * %0 - Attestation token generated successfully.
69 * * %-EINVAL - A parameter was not valid.
70 * * %-ENOMEM - Out of memory.
71 * * %-EFAULT - Failed to get IPA for memory page(s).
72 */
arm_cca_report_new(struct tsm_report * report,void * data)73 static int arm_cca_report_new(struct tsm_report *report, void *data)
74 {
75 int ret = 0;
76 unsigned long rsi_result;
77 long max_size;
78 unsigned long token_size = 0;
79 struct arm_cca_token_info info;
80 void *buf;
81 u8 *token __free(kvfree) = NULL;
82 struct tsm_report_desc *desc = &report->desc;
83
84 if (desc->inblob_len < 32 || desc->inblob_len > 64)
85 return -EINVAL;
86
87 /*
88 * The attestation token 'init' and 'continue' calls must be
89 * performed on the same CPU, so disable CPU migration around
90 * those operations.
91 */
92 migrate_disable();
93
94 max_size = rsi_attestation_token_init(desc->inblob, desc->inblob_len);
95 if (max_size <= 0) {
96 ret = -EINVAL;
97 goto exit_migrate_enable;
98 }
99
100 /* Allocate outblob */
101 token = kvzalloc(max_size, GFP_KERNEL);
102 if (!token) {
103 ret = -ENOMEM;
104 goto exit_migrate_enable;
105 }
106
107 /*
108 * Since the outblob may not be physically contiguous, use a page
109 * to bounce the buffer from RMM.
110 */
111 buf = alloc_pages_exact(RSI_GRANULE_SIZE, GFP_KERNEL);
112 if (!buf) {
113 ret = -ENOMEM;
114 goto exit_migrate_enable;
115 }
116
117 /* Get the PA of the memory page(s) that were allocated */
118 info.granule = (unsigned long)virt_to_phys(buf);
119
120 /* Loop until the token is ready or there is an error */
121 do {
122 /* Retrieve one RSI_GRANULE_SIZE data per loop iteration */
123 info.offset = 0;
124 do {
125 /*
126 * Retrieve a sub-granule chunk of data per loop
127 * iteration.
128 */
129 rsi_result = arm_cca_attestation_continue(&info);
130 } while (rsi_result == RSI_INCOMPLETE &&
131 info.offset < RSI_GRANULE_SIZE);
132
133 /* Break out in case of failure */
134 if (rsi_result != RSI_SUCCESS && rsi_result != RSI_INCOMPLETE) {
135 ret = -ENXIO;
136 token_size = 0;
137 goto exit_free_granule_page;
138 }
139
140 /*
141 * Copy the retrieved token data from the granule
142 * to the token buffer, ensuring that the RMM doesn't
143 * overflow the buffer.
144 */
145 if (WARN_ON(token_size + info.offset > max_size))
146 break;
147 memcpy(&token[token_size], buf, info.offset);
148 token_size += info.offset;
149 } while (rsi_result == RSI_INCOMPLETE);
150
151 report->outblob = no_free_ptr(token);
152 exit_free_granule_page:
153 report->outblob_len = token_size;
154 free_pages_exact(buf, RSI_GRANULE_SIZE);
155 exit_migrate_enable:
156 migrate_enable();
157 return ret;
158 }
159
160 static const struct tsm_report_ops arm_cca_tsm_ops = {
161 .name = KBUILD_MODNAME,
162 .report_new = arm_cca_report_new,
163 };
164
165 /**
166 * arm_cca_guest_init - Register with the Trusted Security Module (TSM)
167 * interface.
168 *
169 * Return:
170 * * %0 - Registered successfully with the TSM interface.
171 * * %-ENODEV - The execution context is not an Arm Realm.
172 * * %-EBUSY - Already registered.
173 */
arm_cca_guest_init(void)174 static int __init arm_cca_guest_init(void)
175 {
176 int ret;
177
178 if (!is_realm_world())
179 return -ENODEV;
180
181 ret = tsm_report_register(&arm_cca_tsm_ops, NULL);
182 if (ret < 0)
183 pr_err("Error %d registering with TSM\n", ret);
184
185 return ret;
186 }
187 module_init(arm_cca_guest_init);
188
189 /**
190 * arm_cca_guest_exit - unregister with the Trusted Security Module (TSM)
191 * interface.
192 */
arm_cca_guest_exit(void)193 static void __exit arm_cca_guest_exit(void)
194 {
195 tsm_report_unregister(&arm_cca_tsm_ops);
196 }
197 module_exit(arm_cca_guest_exit);
198
199 /* modalias, so userspace can autoload this module when RSI is available */
200 static const struct platform_device_id arm_cca_match[] __maybe_unused = {
201 { .name = RSI_PDEV_NAME },
202 { }
203 };
204
205 MODULE_DEVICE_TABLE(platform, arm_cca_match);
206 MODULE_AUTHOR("Sami Mujawar <sami.mujawar@arm.com>");
207 MODULE_DESCRIPTION("Arm CCA Guest TSM Driver");
208 MODULE_LICENSE("GPL");
209