1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2023 ARM Ltd.
4 */
5
6 #include <linux/arm-rsi-cmds.h>
7 #include <linux/arm-smccc-bus.h>
8 #include <linux/arm-smccc-rsi.h>
9 #include <linux/cc_platform.h>
10 #include <linux/kernel.h>
11 #include <linux/device-id/platform.h>
12 #include <linux/module.h>
13 #include <linux/smp.h>
14 #include <linux/tsm.h>
15 #include <linux/types.h>
16
17 /**
18 * struct arm_cca_token_info - a descriptor for the token buffer.
19 * @granule: PA of the granule to which the token will be written
20 * @offset: Offset within granule to start of buffer in bytes
21 */
22 struct arm_cca_token_info {
23 phys_addr_t granule;
24 unsigned long offset;
25 };
26
27 /**
28 * arm_cca_attestation_continue - Retrieve the attestation token data.
29 *
30 * @info: pointer to the arm_cca_token_info
31 *
32 * Attestation token generation is a long running operation and therefore
33 * the token data may not be retrieved in a single call. Moreover, the
34 * token retrieval operation must be requested on the same CPU on which the
35 * attestation token generation was initialised.
36 * This helper function must therefore be executed on the same CPU multiple
37 * times until the entire token data is retrieved.
38 */
39 static unsigned long
arm_cca_attestation_continue(struct arm_cca_token_info * info)40 arm_cca_attestation_continue(struct arm_cca_token_info *info)
41 {
42 unsigned long ret;
43 unsigned long len;
44 unsigned long size;
45
46 size = RSI_GRANULE_SIZE - info->offset;
47 ret = rsi_attestation_token_continue(info->granule, info->offset, size,
48 &len);
49 info->offset += len;
50 return ret;
51 }
52
53 /**
54 * arm_cca_report_new - Generate a new attestation token.
55 *
56 * @report: pointer to the TSM report context information.
57 * @data: pointer to the context specific data for this module.
58 *
59 * Initialise the attestation token generation using the challenge data
60 * passed in the TSM descriptor. Allocate memory for the attestation token
61 * and retrieve the attestation token on the same CPU on which the
62 * attestation token generation was initialised.
63 *
64 * The challenge data must be at least 32 bytes and no more than 64 bytes. If
65 * less than 64 bytes are provided it will be zero padded to 64 bytes.
66 *
67 * Return:
68 * * %0 - Attestation token generated successfully.
69 * * %-EINVAL - A parameter was not valid.
70 * * %-ENOMEM - Out of memory.
71 * * %-EFAULT - Failed to get IPA for memory page(s).
72 */
arm_cca_report_new(struct tsm_report * report,void * data)73 static int arm_cca_report_new(struct tsm_report *report, void *data)
74 {
75 int ret = 0;
76 unsigned long rsi_result;
77 long max_size;
78 unsigned long token_size = 0;
79 struct arm_cca_token_info info;
80 void *buf;
81 u8 *token __free(kvfree) = NULL;
82 struct tsm_report_desc *desc = &report->desc;
83
84 if (desc->inblob_len < 32 || desc->inblob_len > 64)
85 return -EINVAL;
86
87 /*
88 * The attestation token 'init' and 'continue' calls must be
89 * performed on the same CPU, so disable CPU migration around
90 * those operations.
91 */
92 migrate_disable();
93
94 max_size = rsi_attestation_token_init(desc->inblob, desc->inblob_len);
95 if (max_size <= 0) {
96 ret = -EINVAL;
97 goto exit_migrate_enable;
98 }
99
100 /* Allocate outblob */
101 token = kvzalloc(max_size, GFP_KERNEL);
102 if (!token) {
103 ret = -ENOMEM;
104 goto exit_migrate_enable;
105 }
106
107 /*
108 * Since the outblob may not be physically contiguous, use a page
109 * to bounce the buffer from RMM.
110 */
111 buf = alloc_pages_exact(RSI_GRANULE_SIZE, GFP_KERNEL);
112 if (!buf) {
113 ret = -ENOMEM;
114 goto exit_migrate_enable;
115 }
116
117 /* Get the PA of the memory page(s) that were allocated */
118 info.granule = (unsigned long)virt_to_phys(buf);
119
120 /* Loop until the token is ready or there is an error */
121 do {
122 /* Retrieve one RSI_GRANULE_SIZE data per loop iteration */
123 info.offset = 0;
124 do {
125 /*
126 * Retrieve a sub-granule chunk of data per loop
127 * iteration.
128 */
129 rsi_result = arm_cca_attestation_continue(&info);
130 } while (rsi_result == RSI_INCOMPLETE &&
131 info.offset < RSI_GRANULE_SIZE);
132
133 /* Break out in case of failure */
134 if (rsi_result != RSI_SUCCESS && rsi_result != RSI_INCOMPLETE) {
135 ret = -ENXIO;
136 token_size = 0;
137 goto exit_free_granule_page;
138 }
139
140 /*
141 * Copy the retrieved token data from the granule
142 * to the token buffer, ensuring that the RMM doesn't
143 * overflow the buffer.
144 */
145 if (WARN_ON(token_size + info.offset > max_size))
146 break;
147 memcpy(&token[token_size], buf, info.offset);
148 token_size += info.offset;
149 } while (rsi_result == RSI_INCOMPLETE);
150
151 report->outblob = no_free_ptr(token);
152 exit_free_granule_page:
153 report->outblob_len = token_size;
154 free_pages_exact(buf, RSI_GRANULE_SIZE);
155 exit_migrate_enable:
156 migrate_enable();
157 return ret;
158 }
159
160 static const struct tsm_report_ops arm_cca_tsm_report_ops = {
161 .name = KBUILD_MODNAME,
162 .report_new = arm_cca_report_new,
163 };
164
cca_tsm_probe(struct arm_smccc_device * sdev)165 static int cca_tsm_probe(struct arm_smccc_device *sdev)
166 {
167 int ret;
168
169 if (!is_realm_world())
170 return -ENODEV;
171
172 ret = tsm_report_register(&arm_cca_tsm_report_ops, NULL);
173 if (ret < 0)
174 return dev_err_probe(&sdev->dev,
175 ret, "Error registering with TSM\n");
176
177 return 0;
178 }
179
cca_tsm_remove(struct arm_smccc_device * sdev)180 static void cca_tsm_remove(struct arm_smccc_device *sdev)
181 {
182 tsm_report_unregister(&arm_cca_tsm_report_ops);
183 }
184
185 static const struct arm_smccc_device_id cca_tsm_id_table[] = {
186 { .func_id = SMC_RSI_ABI_VERSION },
187 {}
188 };
189 MODULE_DEVICE_TABLE(arm_smccc, cca_tsm_id_table);
190
191 static struct arm_smccc_driver cca_tsm_driver = {
192 .name = KBUILD_MODNAME,
193 .probe = cca_tsm_probe,
194 .remove = cca_tsm_remove,
195 .id_table = cca_tsm_id_table,
196 };
197 module_arm_smccc_driver(cca_tsm_driver);
198 MODULE_AUTHOR("Sami Mujawar <sami.mujawar@arm.com>");
199 MODULE_DESCRIPTION("Arm CCA Guest TSM Driver");
200 MODULE_LICENSE("GPL");
201