1 /*
2 * Copyright (c) 2022 Arm Limited. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 *
6 * DRTM service
7 *
8 * Authors:
9 * Lucian Paul-Trifu <lucian.paultrifu@gmail.com>
10 * Brian Nezvadovitz <brinez@microsoft.com> 2021-02-01
11 */
12
13 #include <stdint.h>
14
15 #include <arch.h>
16 #include <arch_helpers.h>
17 #include <common/bl_common.h>
18 #include <common/debug.h>
19 #include <common/runtime_svc.h>
20 #include <drivers/auth/crypto_mod.h>
21 #include "drtm_main.h"
22 #include "drtm_measurements.h"
23 #include "drtm_remediation.h"
24 #include <lib/el3_runtime/context_mgmt.h>
25 #include <lib/psci/psci_lib.h>
26 #include <lib/xlat_tables/xlat_tables_v2.h>
27 #include <plat/common/platform.h>
28 #include <services/drtm_svc.h>
29 #include <services/sdei.h>
30 #include <platform_def.h>
31
32 /* Structure to store DRTM features specific to the platform. */
33 static drtm_features_t plat_drtm_features;
34
35 /* DRTM-formatted memory map. */
36 static drtm_memory_region_descriptor_table_t *plat_drtm_mem_map;
37
38 /* DLME header */
39 struct_dlme_data_header dlme_data_hdr_init;
40
41 /* Minimum data memory requirement */
42 uint64_t dlme_data_min_size;
43
drtm_setup(void)44 int drtm_setup(void)
45 {
46 bool rc;
47 const plat_drtm_tpm_features_t *plat_tpm_feat;
48 const plat_drtm_dma_prot_features_t *plat_dma_prot_feat;
49
50 INFO("DRTM service setup\n");
51
52 /* Read boot PE ID from MPIDR */
53 plat_drtm_features.boot_pe_id = read_mpidr_el1() & MPIDR_AFFINITY_MASK;
54
55 rc = drtm_dma_prot_init();
56 if (rc) {
57 return INTERNAL_ERROR;
58 }
59
60 /*
61 * initialise the platform supported crypto module that will
62 * be used by the DRTM-service to calculate hash of DRTM-
63 * implementation specific components
64 */
65 crypto_mod_init();
66
67 /* Build DRTM-compatible address map. */
68 plat_drtm_mem_map = drtm_build_address_map();
69 if (plat_drtm_mem_map == NULL) {
70 return INTERNAL_ERROR;
71 }
72
73 /* Get DRTM features from platform hooks. */
74 plat_tpm_feat = plat_drtm_get_tpm_features();
75 if (plat_tpm_feat == NULL) {
76 return INTERNAL_ERROR;
77 }
78
79 plat_dma_prot_feat = plat_drtm_get_dma_prot_features();
80 if (plat_dma_prot_feat == NULL) {
81 return INTERNAL_ERROR;
82 }
83
84 /*
85 * Add up minimum DLME data memory.
86 *
87 * For systems with complete DMA protection there is only one entry in
88 * the protected regions table.
89 */
90 if (plat_dma_prot_feat->dma_protection_support ==
91 ARM_DRTM_DMA_PROT_FEATURES_DMA_SUPPORT_COMPLETE) {
92 dlme_data_min_size =
93 sizeof(drtm_memory_region_descriptor_table_t) +
94 sizeof(drtm_mem_region_t);
95 dlme_data_hdr_init.dlme_prot_regions_size = dlme_data_min_size;
96 } else {
97 /*
98 * TODO set protected regions table size based on platform DMA
99 * protection configuration
100 */
101 panic();
102 }
103
104 dlme_data_hdr_init.dlme_addr_map_size = drtm_get_address_map_size();
105 dlme_data_hdr_init.dlme_tcb_hashes_table_size =
106 plat_drtm_get_tcb_hash_table_size();
107 dlme_data_hdr_init.dlme_impdef_region_size =
108 plat_drtm_get_imp_def_dlme_region_size();
109
110 dlme_data_min_size += dlme_data_hdr_init.dlme_addr_map_size +
111 PLAT_DRTM_EVENT_LOG_MAX_SIZE +
112 dlme_data_hdr_init.dlme_tcb_hashes_table_size +
113 dlme_data_hdr_init.dlme_impdef_region_size;
114
115 dlme_data_min_size = page_align(dlme_data_min_size, UP)/PAGE_SIZE;
116
117 /* Fill out platform DRTM features structure */
118 /* Only support default PCR schema (0x1) in this implementation. */
119 ARM_DRTM_TPM_FEATURES_SET_PCR_SCHEMA(plat_drtm_features.tpm_features,
120 ARM_DRTM_TPM_FEATURES_PCR_SCHEMA_DEFAULT);
121 ARM_DRTM_TPM_FEATURES_SET_TPM_HASH(plat_drtm_features.tpm_features,
122 plat_tpm_feat->tpm_based_hash_support);
123 ARM_DRTM_TPM_FEATURES_SET_FW_HASH(plat_drtm_features.tpm_features,
124 plat_tpm_feat->firmware_hash_algorithm);
125 ARM_DRTM_MIN_MEM_REQ_SET_MIN_DLME_DATA_SIZE(plat_drtm_features.minimum_memory_requirement,
126 dlme_data_min_size);
127 ARM_DRTM_MIN_MEM_REQ_SET_DCE_SIZE(plat_drtm_features.minimum_memory_requirement,
128 plat_drtm_get_min_size_normal_world_dce());
129 ARM_DRTM_DMA_PROT_FEATURES_SET_MAX_REGIONS(plat_drtm_features.dma_prot_features,
130 plat_dma_prot_feat->max_num_mem_prot_regions);
131 ARM_DRTM_DMA_PROT_FEATURES_SET_DMA_SUPPORT(plat_drtm_features.dma_prot_features,
132 plat_dma_prot_feat->dma_protection_support);
133 ARM_DRTM_TCB_HASH_FEATURES_SET_MAX_NUM_HASHES(plat_drtm_features.tcb_hash_features,
134 plat_drtm_get_tcb_hash_features());
135
136 return 0;
137 }
138
invalidate_icache_all(void)139 static inline void invalidate_icache_all(void)
140 {
141 __asm__ volatile("ic ialluis");
142 dsb();
143 isb();
144 }
145
drtm_features_tpm(void * ctx)146 static inline uint64_t drtm_features_tpm(void *ctx)
147 {
148 SMC_RET2(ctx, 1ULL, /* TPM feature is supported */
149 plat_drtm_features.tpm_features);
150 }
151
drtm_features_mem_req(void * ctx)152 static inline uint64_t drtm_features_mem_req(void *ctx)
153 {
154 SMC_RET2(ctx, 1ULL, /* memory req Feature is supported */
155 plat_drtm_features.minimum_memory_requirement);
156 }
157
drtm_features_boot_pe_id(void * ctx)158 static inline uint64_t drtm_features_boot_pe_id(void *ctx)
159 {
160 SMC_RET2(ctx, 1ULL, /* Boot PE feature is supported */
161 plat_drtm_features.boot_pe_id);
162 }
163
drtm_features_dma_prot(void * ctx)164 static inline uint64_t drtm_features_dma_prot(void *ctx)
165 {
166 SMC_RET2(ctx, 1ULL, /* DMA protection feature is supported */
167 plat_drtm_features.dma_prot_features);
168 }
169
drtm_features_tcb_hashes(void * ctx)170 static inline uint64_t drtm_features_tcb_hashes(void *ctx)
171 {
172 SMC_RET2(ctx, 1ULL, /* TCB hash feature is supported */
173 plat_drtm_features.tcb_hash_features);
174 }
175
drtm_dl_check_caller_el(void * ctx)176 static enum drtm_retc drtm_dl_check_caller_el(void *ctx)
177 {
178 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ctx), CTX_SPSR_EL3);
179 uint64_t dl_caller_el;
180 uint64_t dl_caller_aarch;
181
182 dl_caller_el = spsr_el3 >> MODE_EL_SHIFT & MODE_EL_MASK;
183 dl_caller_aarch = spsr_el3 >> MODE_RW_SHIFT & MODE_RW_MASK;
184
185 /* Caller's security state is checked from drtm_smc_handle function */
186
187 /* Caller can be NS-EL2/EL1 */
188 if (dl_caller_el == MODE_EL3) {
189 ERROR("DRTM: invalid launch from EL3\n");
190 return DENIED;
191 }
192
193 if (dl_caller_aarch != MODE_RW_64) {
194 ERROR("DRTM: invalid launch from non-AArch64 execution state\n");
195 return DENIED;
196 }
197
198 return SUCCESS;
199 }
200
drtm_dl_check_cores(void)201 static enum drtm_retc drtm_dl_check_cores(void)
202 {
203 bool running_on_single_core;
204 uint64_t this_pe_aff_value = read_mpidr_el1() & MPIDR_AFFINITY_MASK;
205
206 if (this_pe_aff_value != plat_drtm_features.boot_pe_id) {
207 ERROR("DRTM: invalid launch on a non-boot PE\n");
208 return DENIED;
209 }
210
211 running_on_single_core = psci_is_last_on_cpu_safe();
212 if (!running_on_single_core) {
213 ERROR("DRTM: invalid launch due to non-boot PE not being turned off\n");
214 return DENIED;
215 }
216
217 return SUCCESS;
218 }
219
drtm_dl_prepare_dlme_data(const struct_drtm_dl_args * args)220 static enum drtm_retc drtm_dl_prepare_dlme_data(const struct_drtm_dl_args *args)
221 {
222 int rc;
223 uint64_t dlme_data_paddr;
224 size_t dlme_data_max_size;
225 uintptr_t dlme_data_mapping;
226 struct_dlme_data_header *dlme_data_hdr;
227 uint8_t *dlme_data_cursor;
228 size_t dlme_data_mapping_bytes;
229 size_t serialised_bytes_actual;
230
231 dlme_data_paddr = args->dlme_paddr + args->dlme_data_off;
232 dlme_data_max_size = args->dlme_size - args->dlme_data_off;
233
234 /*
235 * The capacity of the given DLME data region is checked when
236 * the other dynamic launch arguments are.
237 */
238 if (dlme_data_max_size < dlme_data_min_size) {
239 ERROR("%s: assertion failed:"
240 " dlme_data_max_size (%ld) < dlme_data_total_bytes_req (%ld)\n",
241 __func__, dlme_data_max_size, dlme_data_min_size);
242 panic();
243 }
244
245 /* Map the DLME data region as NS memory. */
246 dlme_data_mapping_bytes = ALIGNED_UP(dlme_data_max_size, DRTM_PAGE_SIZE);
247 rc = mmap_add_dynamic_region_alloc_va(dlme_data_paddr,
248 &dlme_data_mapping,
249 dlme_data_mapping_bytes,
250 MT_RW_DATA | MT_NS |
251 MT_SHAREABILITY_ISH);
252 if (rc != 0) {
253 WARN("DRTM: %s: mmap_add_dynamic_region() failed rc=%d\n",
254 __func__, rc);
255 return INTERNAL_ERROR;
256 }
257 dlme_data_hdr = (struct_dlme_data_header *)dlme_data_mapping;
258 dlme_data_cursor = (uint8_t *)dlme_data_hdr + sizeof(*dlme_data_hdr);
259
260 memcpy(dlme_data_hdr, (const void *)&dlme_data_hdr_init,
261 sizeof(*dlme_data_hdr));
262
263 /* Set the header version and size. */
264 dlme_data_hdr->version = 1;
265 dlme_data_hdr->this_hdr_size = sizeof(*dlme_data_hdr);
266
267 /* Prepare DLME protected regions. */
268 drtm_dma_prot_serialise_table(dlme_data_cursor,
269 &serialised_bytes_actual);
270 assert(serialised_bytes_actual ==
271 dlme_data_hdr->dlme_prot_regions_size);
272 dlme_data_cursor += serialised_bytes_actual;
273
274 /* Prepare DLME address map. */
275 if (plat_drtm_mem_map != NULL) {
276 memcpy(dlme_data_cursor, plat_drtm_mem_map,
277 dlme_data_hdr->dlme_addr_map_size);
278 } else {
279 WARN("DRTM: DLME address map is not in the cache\n");
280 }
281 dlme_data_cursor += dlme_data_hdr->dlme_addr_map_size;
282
283 /* Prepare DRTM event log for DLME. */
284 drtm_serialise_event_log(dlme_data_cursor, &serialised_bytes_actual);
285 assert(serialised_bytes_actual <= PLAT_DRTM_EVENT_LOG_MAX_SIZE);
286 dlme_data_hdr->dlme_tpm_log_size = serialised_bytes_actual;
287 dlme_data_cursor += serialised_bytes_actual;
288
289 /*
290 * TODO: Prepare the TCB hashes for DLME, currently its size
291 * 0
292 */
293 dlme_data_cursor += dlme_data_hdr->dlme_tcb_hashes_table_size;
294
295 /* Implementation-specific region size is unused. */
296 dlme_data_cursor += dlme_data_hdr->dlme_impdef_region_size;
297
298 /*
299 * Prepare DLME data size, includes all data region referenced above
300 * alongwith the DLME data header
301 */
302 dlme_data_hdr->dlme_data_size = dlme_data_cursor - (uint8_t *)dlme_data_hdr;
303
304 /* Unmap the DLME data region. */
305 rc = mmap_remove_dynamic_region(dlme_data_mapping, dlme_data_mapping_bytes);
306 if (rc != 0) {
307 ERROR("%s(): mmap_remove_dynamic_region() failed"
308 " unexpectedly rc=%d\n", __func__, rc);
309 panic();
310 }
311
312 return SUCCESS;
313 }
314
315 /*
316 * Note: accesses to the dynamic launch args, and to the DLME data are
317 * little-endian as required, thanks to TF-A BL31 init requirements.
318 */
drtm_dl_check_args(uint64_t x1,struct_drtm_dl_args * a_out)319 static enum drtm_retc drtm_dl_check_args(uint64_t x1,
320 struct_drtm_dl_args *a_out)
321 {
322 uint64_t dlme_start, dlme_end;
323 uint64_t dlme_img_start, dlme_img_ep, dlme_img_end;
324 uint64_t dlme_data_start, dlme_data_end;
325 uintptr_t va_mapping;
326 size_t va_mapping_size;
327 struct_drtm_dl_args *a;
328 struct_drtm_dl_args args_buf;
329 int rc;
330
331 if (x1 % DRTM_PAGE_SIZE != 0) {
332 ERROR("DRTM: parameters structure is not "
333 DRTM_PAGE_SIZE_STR "-aligned\n");
334 return INVALID_PARAMETERS;
335 }
336
337 va_mapping_size = ALIGNED_UP(sizeof(struct_drtm_dl_args), DRTM_PAGE_SIZE);
338
339 /* check DRTM parameters are within NS address region */
340 rc = plat_drtm_validate_ns_region(x1, va_mapping_size);
341 if (rc != 0) {
342 ERROR("DRTM: parameters lies within secure memory\n");
343 return INVALID_PARAMETERS;
344 }
345
346 rc = mmap_add_dynamic_region_alloc_va(x1, &va_mapping, va_mapping_size,
347 MT_MEMORY | MT_NS | MT_RO |
348 MT_SHAREABILITY_ISH);
349 if (rc != 0) {
350 WARN("DRTM: %s: mmap_add_dynamic_region() failed rc=%d\n",
351 __func__, rc);
352 return INTERNAL_ERROR;
353 }
354 a = (struct_drtm_dl_args *)va_mapping;
355
356 /* Sanitize cache of data passed in args by the DCE Preamble. */
357 flush_dcache_range(va_mapping, va_mapping_size);
358
359 args_buf = *a;
360
361 rc = mmap_remove_dynamic_region(va_mapping, va_mapping_size);
362 if (rc) {
363 ERROR("%s(): mmap_remove_dynamic_region() failed unexpectedly"
364 " rc=%d\n", __func__, rc);
365 panic();
366 }
367 a = &args_buf;
368
369 if (!((a->version >= ARM_DRTM_PARAMS_MIN_VERSION) &&
370 (a->version <= ARM_DRTM_PARAMS_MAX_VERSION))) {
371 ERROR("DRTM: parameters structure version %u is unsupported\n",
372 a->version);
373 return NOT_SUPPORTED;
374 }
375
376 if (!(a->dlme_img_off < a->dlme_size &&
377 a->dlme_data_off < a->dlme_size)) {
378 ERROR("DRTM: argument offset is outside of the DLME region\n");
379 return INVALID_PARAMETERS;
380 }
381 dlme_start = a->dlme_paddr;
382 dlme_end = a->dlme_paddr + a->dlme_size;
383 dlme_img_start = a->dlme_paddr + a->dlme_img_off;
384 dlme_img_ep = dlme_img_start + a->dlme_img_ep_off;
385 dlme_img_end = dlme_img_start + a->dlme_img_size;
386 dlme_data_start = a->dlme_paddr + a->dlme_data_off;
387 dlme_data_end = dlme_end;
388
389 /* Check the DLME regions arguments. */
390 if ((dlme_start % DRTM_PAGE_SIZE) != 0) {
391 ERROR("DRTM: argument DLME region is not "
392 DRTM_PAGE_SIZE_STR "-aligned\n");
393 return INVALID_PARAMETERS;
394 }
395
396 if (!(dlme_start < dlme_end &&
397 dlme_start <= dlme_img_start && dlme_img_start < dlme_img_end &&
398 dlme_start <= dlme_data_start && dlme_data_start < dlme_data_end)) {
399 ERROR("DRTM: argument DLME region is discontiguous\n");
400 return INVALID_PARAMETERS;
401 }
402
403 if (dlme_img_start < dlme_data_end && dlme_data_start < dlme_img_end) {
404 ERROR("DRTM: argument DLME regions overlap\n");
405 return INVALID_PARAMETERS;
406 }
407
408 /* Check the DLME image region arguments. */
409 if ((dlme_img_start % DRTM_PAGE_SIZE) != 0) {
410 ERROR("DRTM: argument DLME image region is not "
411 DRTM_PAGE_SIZE_STR "-aligned\n");
412 return INVALID_PARAMETERS;
413 }
414
415 if (!(dlme_img_start <= dlme_img_ep && dlme_img_ep < dlme_img_end)) {
416 ERROR("DRTM: DLME entry point is outside of the DLME image region\n");
417 return INVALID_PARAMETERS;
418 }
419
420 if ((dlme_img_ep % 4) != 0) {
421 ERROR("DRTM: DLME image entry point is not 4-byte-aligned\n");
422 return INVALID_PARAMETERS;
423 }
424
425 /* Check the DLME data region arguments. */
426 if ((dlme_data_start % DRTM_PAGE_SIZE) != 0) {
427 ERROR("DRTM: argument DLME data region is not "
428 DRTM_PAGE_SIZE_STR "-aligned\n");
429 return INVALID_PARAMETERS;
430 }
431
432 if (dlme_data_end - dlme_data_start < dlme_data_min_size) {
433 ERROR("DRTM: argument DLME data region is short of %lu bytes\n",
434 dlme_data_min_size - (size_t)(dlme_data_end - dlme_data_start));
435 return INVALID_PARAMETERS;
436 }
437
438 /* check DLME region (paddr + size) is within a NS address region */
439 rc = plat_drtm_validate_ns_region(dlme_start, (size_t)a->dlme_size);
440 if (rc != 0) {
441 ERROR("DRTM: DLME region lies within secure memory\n");
442 return INVALID_PARAMETERS;
443 }
444
445 /* Check the Normal World DCE region arguments. */
446 if (a->dce_nwd_paddr != 0) {
447 uint32_t dce_nwd_start = a->dce_nwd_paddr;
448 uint32_t dce_nwd_end = dce_nwd_start + a->dce_nwd_size;
449
450 if (!(dce_nwd_start < dce_nwd_end)) {
451 ERROR("DRTM: argument Normal World DCE region is dicontiguous\n");
452 return INVALID_PARAMETERS;
453 }
454
455 if (dce_nwd_start < dlme_end && dlme_start < dce_nwd_end) {
456 ERROR("DRTM: argument Normal World DCE regions overlap\n");
457 return INVALID_PARAMETERS;
458 }
459 }
460
461 /*
462 * Map and sanitize the cache of data range passed by DCE Preamble. This
463 * is required to avoid / defend against racing with cache evictions
464 */
465 va_mapping_size = ALIGNED_UP((dlme_end - dlme_start), DRTM_PAGE_SIZE);
466 rc = mmap_add_dynamic_region_alloc_va(dlme_img_start, &va_mapping, va_mapping_size,
467 MT_MEMORY | MT_NS | MT_RO |
468 MT_SHAREABILITY_ISH);
469 if (rc != 0) {
470 ERROR("DRTM: %s: mmap_add_dynamic_region_alloc_va() failed rc=%d\n",
471 __func__, rc);
472 return INTERNAL_ERROR;
473 }
474 flush_dcache_range(va_mapping, va_mapping_size);
475
476 rc = mmap_remove_dynamic_region(va_mapping, va_mapping_size);
477 if (rc) {
478 ERROR("%s(): mmap_remove_dynamic_region() failed unexpectedly"
479 " rc=%d\n", __func__, rc);
480 panic();
481 }
482
483 *a_out = *a;
484 return SUCCESS;
485 }
486
drtm_dl_reset_dlme_el_state(enum drtm_dlme_el dlme_el)487 static void drtm_dl_reset_dlme_el_state(enum drtm_dlme_el dlme_el)
488 {
489 uint64_t sctlr;
490
491 /*
492 * TODO: Set PE state according to the PSCI's specification of the initial
493 * state after CPU_ON, or to reset values if unspecified, where they exist,
494 * or define sensible values otherwise.
495 */
496
497 switch (dlme_el) {
498 case DLME_AT_EL1:
499 sctlr = read_sctlr_el1();
500 break;
501
502 case DLME_AT_EL2:
503 sctlr = read_sctlr_el2();
504 break;
505
506 default: /* Not reached */
507 ERROR("%s(): dlme_el has the unexpected value %d\n",
508 __func__, dlme_el);
509 panic();
510 }
511
512 sctlr &= ~(/* Disable DLME's EL MMU, since the existing page-tables are untrusted. */
513 SCTLR_M_BIT
514 | SCTLR_EE_BIT /* Little-endian data accesses. */
515 );
516
517 sctlr |= SCTLR_C_BIT | SCTLR_I_BIT; /* Allow instruction and data caching. */
518
519 switch (dlme_el) {
520 case DLME_AT_EL1:
521 write_sctlr_el1(sctlr);
522 break;
523
524 case DLME_AT_EL2:
525 write_sctlr_el2(sctlr);
526 break;
527 }
528 }
529
drtm_dl_reset_dlme_context(enum drtm_dlme_el dlme_el)530 static void drtm_dl_reset_dlme_context(enum drtm_dlme_el dlme_el)
531 {
532 void *ns_ctx = cm_get_context(NON_SECURE);
533 gp_regs_t *gpregs = get_gpregs_ctx(ns_ctx);
534 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ns_ctx), CTX_SPSR_EL3);
535
536 /* Reset all gpregs, including SP_EL0. */
537 memset(gpregs, 0, sizeof(*gpregs));
538
539 /* Reset SP_ELx. */
540 switch (dlme_el) {
541 case DLME_AT_EL1:
542 write_sp_el1(0);
543 break;
544
545 case DLME_AT_EL2:
546 write_sp_el2(0);
547 break;
548 }
549
550 /*
551 * DLME's async exceptions are masked to avoid a NWd attacker's timed
552 * interference with any state we established trust in or measured.
553 */
554 spsr_el3 |= SPSR_DAIF_MASK << SPSR_DAIF_SHIFT;
555
556 write_ctx_reg(get_el3state_ctx(ns_ctx), CTX_SPSR_EL3, spsr_el3);
557 }
558
drtm_dl_prepare_eret_to_dlme(const struct_drtm_dl_args * args,enum drtm_dlme_el dlme_el)559 static void drtm_dl_prepare_eret_to_dlme(const struct_drtm_dl_args *args, enum drtm_dlme_el dlme_el)
560 {
561 void *ctx = cm_get_context(NON_SECURE);
562 uint64_t dlme_ep = DL_ARGS_GET_DLME_ENTRY_POINT(args);
563 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ctx), CTX_SPSR_EL3);
564
565 /* Next ERET is to the DLME's EL. */
566 spsr_el3 &= ~(MODE_EL_MASK << MODE_EL_SHIFT);
567 switch (dlme_el) {
568 case DLME_AT_EL1:
569 spsr_el3 |= MODE_EL1 << MODE_EL_SHIFT;
570 break;
571
572 case DLME_AT_EL2:
573 spsr_el3 |= MODE_EL2 << MODE_EL_SHIFT;
574 break;
575 }
576
577 /* Next ERET is to the DLME entry point. */
578 cm_set_elr_spsr_el3(NON_SECURE, dlme_ep, spsr_el3);
579 }
580
drtm_dynamic_launch(uint64_t x1,void * handle)581 static uint64_t drtm_dynamic_launch(uint64_t x1, void *handle)
582 {
583 enum drtm_retc ret = SUCCESS;
584 enum drtm_retc dma_prot_ret;
585 struct_drtm_dl_args args;
586 /* DLME should be highest NS exception level */
587 enum drtm_dlme_el dlme_el = (el_implemented(2) != EL_IMPL_NONE) ? MODE_EL2 : MODE_EL1;
588
589 /* Ensure that only boot PE is powered on */
590 ret = drtm_dl_check_cores();
591 if (ret != SUCCESS) {
592 SMC_RET1(handle, ret);
593 }
594
595 /*
596 * Ensure that execution state is AArch64 and the caller
597 * is highest non-secure exception level
598 */
599 ret = drtm_dl_check_caller_el(handle);
600 if (ret != SUCCESS) {
601 SMC_RET1(handle, ret);
602 }
603
604 ret = drtm_dl_check_args(x1, &args);
605 if (ret != SUCCESS) {
606 SMC_RET1(handle, ret);
607 }
608
609 /* Ensure that there are no SDEI event registered */
610 #if SDEI_SUPPORT
611 if (sdei_get_registered_event_count() != 0) {
612 SMC_RET1(handle, DENIED);
613 }
614 #endif /* SDEI_SUPPORT */
615
616 /*
617 * Engage the DMA protections. The launch cannot proceed without the DMA
618 * protections due to potential TOC/TOU vulnerabilities w.r.t. the DLME
619 * region (and to the NWd DCE region).
620 */
621 ret = drtm_dma_prot_engage(&args.dma_prot_args,
622 DL_ARGS_GET_DMA_PROT_TYPE(&args));
623 if (ret != SUCCESS) {
624 SMC_RET1(handle, ret);
625 }
626
627 /*
628 * The DMA protection is now engaged. Note that any failure mode that
629 * returns an error to the DRTM-launch caller must now disengage DMA
630 * protections before returning to the caller.
631 */
632
633 ret = drtm_take_measurements(&args);
634 if (ret != SUCCESS) {
635 goto err_undo_dma_prot;
636 }
637
638 ret = drtm_dl_prepare_dlme_data(&args);
639 if (ret != SUCCESS) {
640 goto err_undo_dma_prot;
641 }
642
643 /*
644 * Note that, at the time of writing, the DRTM spec allows a successful
645 * launch from NS-EL1 to return to a DLME in NS-EL2. The practical risk
646 * of a privilege escalation, e.g. due to a compromised hypervisor, is
647 * considered small enough not to warrant the specification of additional
648 * DRTM conduits that would be necessary to maintain OSs' abstraction from
649 * the presence of EL2 were the dynamic launch only be allowed from the
650 * highest NS EL.
651 */
652
653 dlme_el = (el_implemented(2) != EL_IMPL_NONE) ? MODE_EL2 : MODE_EL1;
654
655 drtm_dl_reset_dlme_el_state(dlme_el);
656 drtm_dl_reset_dlme_context(dlme_el);
657
658 drtm_dl_prepare_eret_to_dlme(&args, dlme_el);
659
660 /*
661 * As per DRTM beta0 spec table #28 invalidate the instruction cache
662 * before jumping to the DLME. This is required to defend against
663 * potentially-malicious cache contents.
664 */
665 invalidate_icache_all();
666
667 /* Return the DLME region's address in x0, and the DLME data offset in x1.*/
668 SMC_RET2(handle, args.dlme_paddr, args.dlme_data_off);
669
670 err_undo_dma_prot:
671 dma_prot_ret = drtm_dma_prot_disengage();
672 if (dma_prot_ret != SUCCESS) {
673 ERROR("%s(): drtm_dma_prot_disengage() failed unexpectedly"
674 " rc=%d\n", __func__, ret);
675 panic();
676 }
677
678 SMC_RET1(handle, ret);
679 }
680
drtm_smc_handler(uint32_t smc_fid,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)681 uint64_t drtm_smc_handler(uint32_t smc_fid,
682 uint64_t x1,
683 uint64_t x2,
684 uint64_t x3,
685 uint64_t x4,
686 void *cookie,
687 void *handle,
688 uint64_t flags)
689 {
690 /* Check that the SMC call is from the Normal World. */
691 if (!is_caller_non_secure(flags)) {
692 SMC_RET1(handle, NOT_SUPPORTED);
693 }
694
695 switch (smc_fid) {
696 case ARM_DRTM_SVC_VERSION:
697 INFO("DRTM service handler: version\n");
698 /* Return the version of current implementation */
699 SMC_RET1(handle, ARM_DRTM_VERSION);
700 break; /* not reached */
701
702 case ARM_DRTM_SVC_FEATURES:
703 if (((x1 >> ARM_DRTM_FUNC_SHIFT) & ARM_DRTM_FUNC_MASK) ==
704 ARM_DRTM_FUNC_ID) {
705 /* Dispatch function-based queries. */
706 switch (x1 & FUNCID_MASK) {
707 case ARM_DRTM_SVC_VERSION:
708 SMC_RET1(handle, SUCCESS);
709 break; /* not reached */
710
711 case ARM_DRTM_SVC_FEATURES:
712 SMC_RET1(handle, SUCCESS);
713 break; /* not reached */
714
715 case ARM_DRTM_SVC_UNPROTECT_MEM:
716 SMC_RET1(handle, SUCCESS);
717 break; /* not reached */
718
719 case ARM_DRTM_SVC_DYNAMIC_LAUNCH:
720 SMC_RET1(handle, SUCCESS);
721 break; /* not reached */
722
723 case ARM_DRTM_SVC_CLOSE_LOCALITY:
724 WARN("ARM_DRTM_SVC_CLOSE_LOCALITY feature %s",
725 "is not supported\n");
726 SMC_RET1(handle, NOT_SUPPORTED);
727 break; /* not reached */
728
729 case ARM_DRTM_SVC_GET_ERROR:
730 SMC_RET1(handle, SUCCESS);
731 break; /* not reached */
732
733 case ARM_DRTM_SVC_SET_ERROR:
734 SMC_RET1(handle, SUCCESS);
735 break; /* not reached */
736
737 case ARM_DRTM_SVC_SET_TCB_HASH:
738 WARN("ARM_DRTM_SVC_TCB_HASH feature %s",
739 "is not supported\n");
740 SMC_RET1(handle, NOT_SUPPORTED);
741 break; /* not reached */
742
743 case ARM_DRTM_SVC_LOCK_TCB_HASH:
744 WARN("ARM_DRTM_SVC_LOCK_TCB_HASH feature %s",
745 "is not supported\n");
746 SMC_RET1(handle, NOT_SUPPORTED);
747 break; /* not reached */
748
749 default:
750 ERROR("Unknown DRTM service function\n");
751 SMC_RET1(handle, NOT_SUPPORTED);
752 break; /* not reached */
753 }
754 } else {
755 /* Dispatch feature-based queries. */
756 switch (x1 & ARM_DRTM_FEAT_ID_MASK) {
757 case ARM_DRTM_FEATURES_TPM:
758 INFO("++ DRTM service handler: TPM features\n");
759 return drtm_features_tpm(handle);
760 break; /* not reached */
761
762 case ARM_DRTM_FEATURES_MEM_REQ:
763 INFO("++ DRTM service handler: Min. mem."
764 " requirement features\n");
765 return drtm_features_mem_req(handle);
766 break; /* not reached */
767
768 case ARM_DRTM_FEATURES_DMA_PROT:
769 INFO("++ DRTM service handler: "
770 "DMA protection features\n");
771 return drtm_features_dma_prot(handle);
772 break; /* not reached */
773
774 case ARM_DRTM_FEATURES_BOOT_PE_ID:
775 INFO("++ DRTM service handler: "
776 "Boot PE ID features\n");
777 return drtm_features_boot_pe_id(handle);
778 break; /* not reached */
779
780 case ARM_DRTM_FEATURES_TCB_HASHES:
781 INFO("++ DRTM service handler: "
782 "TCB-hashes features\n");
783 return drtm_features_tcb_hashes(handle);
784 break; /* not reached */
785
786 default:
787 ERROR("Unknown ARM DRTM service feature\n");
788 SMC_RET1(handle, NOT_SUPPORTED);
789 break; /* not reached */
790 }
791 }
792
793 case ARM_DRTM_SVC_UNPROTECT_MEM:
794 INFO("DRTM service handler: unprotect mem\n");
795 return drtm_unprotect_mem(handle);
796 break; /* not reached */
797
798 case ARM_DRTM_SVC_DYNAMIC_LAUNCH:
799 INFO("DRTM service handler: dynamic launch\n");
800 return drtm_dynamic_launch(x1, handle);
801 break; /* not reached */
802
803 case ARM_DRTM_SVC_CLOSE_LOCALITY:
804 WARN("DRTM service handler: close locality %s\n",
805 "is not supported");
806 SMC_RET1(handle, NOT_SUPPORTED);
807 break; /* not reached */
808
809 case ARM_DRTM_SVC_GET_ERROR:
810 INFO("DRTM service handler: get error\n");
811 drtm_get_error(handle);
812 break; /* not reached */
813
814 case ARM_DRTM_SVC_SET_ERROR:
815 INFO("DRTM service handler: set error\n");
816 drtm_set_error(x1, handle);
817 break; /* not reached */
818
819 case ARM_DRTM_SVC_SET_TCB_HASH:
820 WARN("DRTM service handler: set TCB hash %s\n",
821 "is not supported");
822 SMC_RET1(handle, NOT_SUPPORTED);
823 break; /* not reached */
824
825 case ARM_DRTM_SVC_LOCK_TCB_HASH:
826 WARN("DRTM service handler: lock TCB hash %s\n",
827 "is not supported");
828 SMC_RET1(handle, NOT_SUPPORTED);
829 break; /* not reached */
830
831 default:
832 ERROR("Unknown DRTM service function: 0x%x\n", smc_fid);
833 SMC_RET1(handle, SMC_UNK);
834 break; /* not reached */
835 }
836
837 /* not reached */
838 SMC_RET1(handle, SMC_UNK);
839 }
840