1 /*
2 * Copyright (c) 2022-2025 Arm Limited. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 *
6 * DRTM service
7 *
8 * Authors:
9 * Lucian Paul-Trifu <lucian.paultrifu@gmail.com>
10 * Brian Nezvadovitz <brinez@microsoft.com> 2021-02-01
11 */
12
13 #include <stdint.h>
14
15 #include <arch.h>
16 #include <arch_helpers.h>
17 #include <common/bl_common.h>
18 #include <common/debug.h>
19 #include <common/runtime_svc.h>
20 #include <drivers/auth/crypto_mod.h>
21 #include "drtm_main.h"
22 #include "drtm_measurements.h"
23 #include "drtm_remediation.h"
24 #include <lib/el3_runtime/context_mgmt.h>
25 #include <lib/psci/psci_lib.h>
26 #include <lib/xlat_tables/xlat_tables_v2.h>
27 #include <plat/common/platform.h>
28 #include <services/drtm_svc.h>
29 #include <services/sdei.h>
30 #include <platform_def.h>
31
32 /* Structure to store DRTM features specific to the platform. */
33 static drtm_features_t plat_drtm_features;
34
35 /* DRTM-formatted memory map. */
36 static drtm_memory_region_descriptor_table_t *plat_drtm_mem_map;
37 static const plat_drtm_dma_prot_features_t *plat_dma_prot_feat;
38 static const plat_drtm_tpm_features_t *plat_tpm_feat;
39
40 /* DLME header */
41 struct_dlme_data_header dlme_data_hdr_init;
42
43 /* Minimum data memory requirement */
44 uint64_t dlme_data_min_size;
45
drtm_setup(void)46 int drtm_setup(void)
47 {
48 bool rc;
49
50 INFO("DRTM service setup\n");
51
52 /* Read boot PE ID from MPIDR */
53 plat_drtm_features.boot_pe_id = read_mpidr_el1() & MPIDR_AFFINITY_MASK;
54
55 rc = drtm_dma_prot_init();
56 if (rc) {
57 return INTERNAL_ERROR;
58 }
59
60 /*
61 * initialise the platform supported crypto module that will
62 * be used by the DRTM-service to calculate hash of DRTM-
63 * implementation specific components
64 */
65 crypto_mod_init();
66
67 /* Build DRTM-compatible address map. */
68 plat_drtm_mem_map = drtm_build_address_map();
69 if (plat_drtm_mem_map == NULL) {
70 return INTERNAL_ERROR;
71 }
72
73 /* Get DRTM features from platform hooks. */
74 plat_tpm_feat = plat_drtm_get_tpm_features();
75 if (plat_tpm_feat == NULL) {
76 return INTERNAL_ERROR;
77 }
78
79 plat_dma_prot_feat = plat_drtm_get_dma_prot_features();
80 if (plat_dma_prot_feat == NULL) {
81 return INTERNAL_ERROR;
82 }
83
84 /*
85 * Add up minimum DLME data memory.
86 *
87 * For systems with complete DMA protection there is only one entry in
88 * the protected regions table.
89 */
90 if (plat_dma_prot_feat->dma_protection_support ==
91 ARM_DRTM_DMA_PROT_FEATURES_DMA_SUPPORT_COMPLETE) {
92 dlme_data_min_size =
93 sizeof(drtm_memory_region_descriptor_table_t) +
94 sizeof(drtm_mem_region_t);
95 dlme_data_hdr_init.dlme_prot_regions_size = dlme_data_min_size;
96 } else {
97 /*
98 * TODO set protected regions table size based on platform DMA
99 * protection configuration
100 */
101 panic();
102 }
103
104 dlme_data_hdr_init.dlme_addr_map_size = drtm_get_address_map_size();
105 dlme_data_hdr_init.dlme_tcb_hashes_table_size =
106 plat_drtm_get_tcb_hash_table_size();
107 dlme_data_hdr_init.dlme_acpi_tables_region_size =
108 plat_drtm_get_acpi_tables_region_size();
109 dlme_data_hdr_init.dlme_impdef_region_size =
110 plat_drtm_get_imp_def_dlme_region_size();
111
112 dlme_data_min_size += sizeof(struct_dlme_data_header) +
113 dlme_data_hdr_init.dlme_addr_map_size +
114 ARM_DRTM_MIN_EVENT_LOG_SIZE +
115 dlme_data_hdr_init.dlme_tcb_hashes_table_size +
116 dlme_data_hdr_init.dlme_acpi_tables_region_size +
117 dlme_data_hdr_init.dlme_impdef_region_size;
118
119 /* Fill out platform DRTM features structure */
120 /* Only support default PCR schema (0x1) in this implementation. */
121 ARM_DRTM_TPM_FEATURES_SET_PCR_SCHEMA(plat_drtm_features.tpm_features,
122 ARM_DRTM_TPM_FEATURES_PCR_SCHEMA_DEFAULT);
123 ARM_DRTM_TPM_FEATURES_SET_TPM_HASH(plat_drtm_features.tpm_features,
124 plat_tpm_feat->tpm_based_hash_support);
125 ARM_DRTM_TPM_FEATURES_SET_FW_HASH(plat_drtm_features.tpm_features,
126 plat_tpm_feat->firmware_hash_algorithm);
127 ARM_DRTM_MIN_MEM_REQ_SET_MIN_DLME_DATA_SIZE(plat_drtm_features.minimum_memory_requirement,
128 page_align(dlme_data_min_size, UP)/PAGE_SIZE);
129 ARM_DRTM_MIN_MEM_REQ_SET_DCE_SIZE(plat_drtm_features.minimum_memory_requirement,
130 plat_drtm_get_min_size_normal_world_dce());
131 ARM_DRTM_DMA_PROT_FEATURES_SET_MAX_REGIONS(plat_drtm_features.dma_prot_features,
132 plat_dma_prot_feat->max_num_mem_prot_regions);
133 ARM_DRTM_DMA_PROT_FEATURES_SET_DMA_SUPPORT(plat_drtm_features.dma_prot_features,
134 plat_dma_prot_feat->dma_protection_support);
135 ARM_DRTM_TCB_HASH_FEATURES_SET_MAX_NUM_HASHES(plat_drtm_features.tcb_hash_features,
136 plat_drtm_get_tcb_hash_features());
137 ARM_DRTM_DLME_IMG_AUTH_SUPPORT(plat_drtm_features.dlme_image_auth_features,
138 plat_drtm_get_dlme_img_auth_features());
139
140 return 0;
141 }
142
invalidate_icache_all(void)143 static inline void invalidate_icache_all(void)
144 {
145 __asm__ volatile("ic ialluis");
146 dsb();
147 isb();
148 }
149
drtm_features_tpm(void * ctx)150 static inline uint64_t drtm_features_tpm(void *ctx)
151 {
152 SMC_RET2(ctx, 1ULL, /* TPM feature is supported */
153 plat_drtm_features.tpm_features);
154 }
155
drtm_features_mem_req(void * ctx)156 static inline uint64_t drtm_features_mem_req(void *ctx)
157 {
158 SMC_RET2(ctx, 1ULL, /* memory req Feature is supported */
159 plat_drtm_features.minimum_memory_requirement);
160 }
161
drtm_features_boot_pe_id(void * ctx)162 static inline uint64_t drtm_features_boot_pe_id(void *ctx)
163 {
164 SMC_RET2(ctx, 1ULL, /* Boot PE feature is supported */
165 plat_drtm_features.boot_pe_id);
166 }
167
drtm_features_dma_prot(void * ctx)168 static inline uint64_t drtm_features_dma_prot(void *ctx)
169 {
170 SMC_RET2(ctx, 1ULL, /* DMA protection feature is supported */
171 plat_drtm_features.dma_prot_features);
172 }
173
drtm_features_tcb_hashes(void * ctx)174 static inline uint64_t drtm_features_tcb_hashes(void *ctx)
175 {
176 SMC_RET2(ctx, 1ULL, /* TCB hash feature is supported */
177 plat_drtm_features.tcb_hash_features);
178 }
179
drtm_features_dlme_img_auth_features(void * ctx)180 static inline uint64_t drtm_features_dlme_img_auth_features(void *ctx)
181 {
182 SMC_RET2(ctx, 1ULL, /* DLME Image auth is supported */
183 plat_drtm_features.dlme_image_auth_features);
184 }
185
drtm_dl_check_caller_el(void * ctx)186 static enum drtm_retc drtm_dl_check_caller_el(void *ctx)
187 {
188 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ctx), CTX_SPSR_EL3);
189 uint64_t dl_caller_el;
190 uint64_t dl_caller_aarch;
191
192 dl_caller_el = spsr_el3 >> MODE_EL_SHIFT & MODE_EL_MASK;
193 dl_caller_aarch = spsr_el3 >> MODE_RW_SHIFT & MODE_RW_MASK;
194
195 /* Caller's security state is checked from drtm_smc_handle function */
196
197 /* Caller can be NS-EL2/EL1 */
198 if (dl_caller_el == MODE_EL3) {
199 ERROR("DRTM: invalid launch from EL3\n");
200 return DENIED;
201 }
202
203 if (dl_caller_aarch != MODE_RW_64) {
204 ERROR("DRTM: invalid launch from non-AArch64 execution state\n");
205 return DENIED;
206 }
207
208 return SUCCESS;
209 }
210
drtm_dl_check_cores(void)211 static enum drtm_retc drtm_dl_check_cores(void)
212 {
213 bool running_on_single_core;
214 uint64_t this_pe_aff_value = read_mpidr_el1() & MPIDR_AFFINITY_MASK;
215
216 if (this_pe_aff_value != plat_drtm_features.boot_pe_id) {
217 ERROR("DRTM: invalid launch on a non-boot PE\n");
218 return DENIED;
219 }
220
221 running_on_single_core = psci_is_last_on_cpu_safe(plat_my_core_pos());
222 if (!running_on_single_core) {
223 ERROR("DRTM: invalid launch due to non-boot PE not being turned off\n");
224 return SECONDARY_PE_NOT_OFF;
225 }
226
227 return SUCCESS;
228 }
229
drtm_dl_prepare_dlme_data(const struct_drtm_dl_args * args)230 static enum drtm_retc drtm_dl_prepare_dlme_data(const struct_drtm_dl_args *args)
231 {
232 int rc;
233 uint64_t dlme_data_paddr;
234 size_t dlme_data_max_size;
235 uintptr_t dlme_data_mapping;
236 struct_dlme_data_header *dlme_data_hdr;
237 uint8_t *dlme_data_cursor;
238 size_t dlme_data_mapping_bytes;
239 size_t serialised_bytes_actual;
240
241 dlme_data_paddr = args->dlme_paddr + args->dlme_data_off;
242 dlme_data_max_size = args->dlme_size - args->dlme_data_off;
243
244 /*
245 * The capacity of the given DLME data region is checked when
246 * the other dynamic launch arguments are.
247 */
248 if (dlme_data_max_size < dlme_data_min_size) {
249 ERROR("%s: assertion failed:"
250 " dlme_data_max_size (%ld) < dlme_data_min_size (%ld)\n",
251 __func__, dlme_data_max_size, dlme_data_min_size);
252 panic();
253 }
254
255 /* Map the DLME data region as NS memory. */
256 dlme_data_mapping_bytes = ALIGNED_UP(dlme_data_max_size, DRTM_PAGE_SIZE);
257 rc = mmap_add_dynamic_region_alloc_va(dlme_data_paddr,
258 &dlme_data_mapping,
259 dlme_data_mapping_bytes,
260 MT_RW_DATA | MT_NS |
261 MT_SHAREABILITY_ISH);
262 if (rc != 0) {
263 WARN("DRTM: %s: mmap_add_dynamic_region() failed rc=%d\n",
264 __func__, rc);
265 return INTERNAL_ERROR;
266 }
267 dlme_data_hdr = (struct_dlme_data_header *)dlme_data_mapping;
268 dlme_data_cursor = (uint8_t *)dlme_data_hdr + sizeof(*dlme_data_hdr);
269
270 memcpy(dlme_data_hdr, (const void *)&dlme_data_hdr_init,
271 sizeof(*dlme_data_hdr));
272
273 /* Set the header version and size. */
274 dlme_data_hdr->version = 1;
275 dlme_data_hdr->this_hdr_size = sizeof(*dlme_data_hdr);
276
277 /* Prepare DLME protected regions. */
278 drtm_dma_prot_serialise_table(dlme_data_cursor,
279 &serialised_bytes_actual);
280 assert(serialised_bytes_actual ==
281 dlme_data_hdr->dlme_prot_regions_size);
282 dlme_data_cursor += serialised_bytes_actual;
283
284 /* Prepare DLME address map. */
285 if (plat_drtm_mem_map != NULL) {
286 memcpy(dlme_data_cursor, plat_drtm_mem_map,
287 dlme_data_hdr->dlme_addr_map_size);
288 } else {
289 WARN("DRTM: DLME address map is not in the cache\n");
290 }
291 dlme_data_cursor += dlme_data_hdr->dlme_addr_map_size;
292
293 /* Prepare DRTM event log for DLME. */
294 drtm_serialise_event_log(dlme_data_cursor, &serialised_bytes_actual);
295 assert(serialised_bytes_actual <= ARM_DRTM_MIN_EVENT_LOG_SIZE);
296 dlme_data_hdr->dlme_tpm_log_size = serialised_bytes_actual;
297 dlme_data_cursor += serialised_bytes_actual;
298
299 /*
300 * TODO: Prepare the TCB hashes for DLME, currently its size
301 * 0
302 */
303 dlme_data_cursor += dlme_data_hdr->dlme_tcb_hashes_table_size;
304
305 /* Implementation-specific region size is unused. */
306 dlme_data_cursor += dlme_data_hdr->dlme_impdef_region_size;
307
308 /*
309 * Prepare DLME data size, includes all data region referenced above
310 * alongwith the DLME data header
311 */
312 dlme_data_hdr->dlme_data_size = dlme_data_cursor - (uint8_t *)dlme_data_hdr;
313
314 /* Unmap the DLME data region. */
315 rc = mmap_remove_dynamic_region(dlme_data_mapping, dlme_data_mapping_bytes);
316 if (rc != 0) {
317 ERROR("%s(): mmap_remove_dynamic_region() failed"
318 " unexpectedly rc=%d\n", __func__, rc);
319 panic();
320 }
321
322 return SUCCESS;
323 }
324
325 /* Function to check if the value is valid for each bit field */
drtm_dl_check_features_sanity(uint32_t val)326 static int drtm_dl_check_features_sanity(uint32_t val)
327 {
328 /**
329 * Ensure that if DLME Authorities Schema (Bits [2:1]) is set, then
330 * DLME image authentication (Bit[6]) must also be set
331 */
332 if ((EXTRACT(DRTM_LAUNCH_FEAT_PCR_USAGE_SCHEMA, val) == DLME_AUTH_SCHEMA) &&
333 (EXTRACT(DRTM_LAUNCH_FEAT_DLME_IMG_AUTH, val) != DLME_IMG_AUTH)) {
334 return INVALID_PARAMETERS;
335 }
336
337 /**
338 * Check if Bits [5:3] (Memory protection type) matches with platform's
339 * memory protection type
340 */
341 if (EXTRACT(DRTM_LAUNCH_FEAT_MEM_PROTECTION_TYPE, val) !=
342 __builtin_ctz(plat_dma_prot_feat->dma_protection_support)) {
343 return INVALID_PARAMETERS;
344 }
345
346 /**
347 * Check if Bits [0] (Type of hashing) matches with platform's
348 * supported hash type.
349 */
350 if (EXTRACT(DRTM_LAUNCH_FEAT_HASHING_TYPE, val) !=
351 plat_tpm_feat->tpm_based_hash_support) {
352 return INVALID_PARAMETERS;
353 }
354
355 return 0;
356 }
357
358 /*
359 * Note: accesses to the dynamic launch args, and to the DLME data are
360 * little-endian as required, thanks to TF-A BL31 init requirements.
361 */
drtm_dl_check_args(uint64_t x1,struct_drtm_dl_args * a_out)362 static enum drtm_retc drtm_dl_check_args(uint64_t x1,
363 struct_drtm_dl_args *a_out)
364 {
365 uint64_t dlme_start, dlme_end;
366 uint64_t dlme_img_start, dlme_img_ep, dlme_img_end;
367 uint64_t dlme_data_start, dlme_data_end;
368 uintptr_t va_mapping;
369 size_t va_mapping_size;
370 struct_drtm_dl_args *a;
371 struct_drtm_dl_args args_buf;
372 int rc;
373
374 if (x1 % DRTM_PAGE_SIZE != 0) {
375 ERROR("DRTM: parameters structure is not "
376 DRTM_PAGE_SIZE_STR "-aligned\n");
377 return INVALID_PARAMETERS;
378 }
379
380 va_mapping_size = ALIGNED_UP(sizeof(struct_drtm_dl_args), DRTM_PAGE_SIZE);
381
382 /* check DRTM parameters are within NS address region */
383 rc = plat_drtm_validate_ns_region(x1, va_mapping_size);
384 if (rc != 0) {
385 ERROR("DRTM: parameters lies within secure memory\n");
386 return INVALID_PARAMETERS;
387 }
388
389 rc = mmap_add_dynamic_region_alloc_va(x1, &va_mapping, va_mapping_size,
390 MT_MEMORY | MT_NS | MT_RO |
391 MT_SHAREABILITY_ISH);
392 if (rc != 0) {
393 WARN("DRTM: %s: mmap_add_dynamic_region() failed rc=%d\n",
394 __func__, rc);
395 return INTERNAL_ERROR;
396 }
397 a = (struct_drtm_dl_args *)va_mapping;
398
399 /* Sanitize cache of data passed in args by the DCE Preamble. */
400 flush_dcache_range(va_mapping, va_mapping_size);
401
402 args_buf = *a;
403
404 rc = mmap_remove_dynamic_region(va_mapping, va_mapping_size);
405 if (rc != 0) {
406 ERROR("%s(): mmap_remove_dynamic_region() failed unexpectedly"
407 " rc=%d\n", __func__, rc);
408 panic();
409 }
410 a = &args_buf;
411
412 if (!((a->version >= ARM_DRTM_PARAMS_MIN_VERSION) &&
413 (a->version <= ARM_DRTM_PARAMS_MAX_VERSION))) {
414 ERROR("DRTM: parameters structure version %u is unsupported\n",
415 a->version);
416 return NOT_SUPPORTED;
417 }
418
419 rc = drtm_dl_check_features_sanity(a->features);
420 if (rc != 0) {
421 ERROR("%s(): drtm_dl_check_features_sanity() failed.\n"
422 " rc=%d\n", __func__, rc);
423 return rc;
424 }
425
426 if (!(a->dlme_img_off < a->dlme_size &&
427 a->dlme_data_off < a->dlme_size)) {
428 ERROR("DRTM: argument offset is outside of the DLME region\n");
429 return INVALID_PARAMETERS;
430 }
431 dlme_start = a->dlme_paddr;
432 dlme_end = a->dlme_paddr + a->dlme_size;
433 dlme_img_start = a->dlme_paddr + a->dlme_img_off;
434 dlme_img_ep = dlme_img_start + a->dlme_img_ep_off;
435 dlme_img_end = dlme_img_start + a->dlme_img_size;
436 dlme_data_start = a->dlme_paddr + a->dlme_data_off;
437 dlme_data_end = dlme_end;
438
439 /* Check the DLME regions arguments. */
440 if ((dlme_start % DRTM_PAGE_SIZE) != 0) {
441 ERROR("DRTM: argument DLME region is not "
442 DRTM_PAGE_SIZE_STR "-aligned\n");
443 return INVALID_PARAMETERS;
444 }
445
446 if (!(dlme_start < dlme_end &&
447 dlme_start <= dlme_img_start && dlme_img_start < dlme_img_end &&
448 dlme_start <= dlme_data_start && dlme_data_start < dlme_data_end)) {
449 ERROR("DRTM: argument DLME region is discontiguous\n");
450 return INVALID_PARAMETERS;
451 }
452
453 if (dlme_img_start < dlme_data_end && dlme_data_start < dlme_img_end) {
454 ERROR("DRTM: argument DLME regions overlap\n");
455 return INVALID_PARAMETERS;
456 }
457
458 /* Check the DLME image region arguments. */
459 if ((dlme_img_start % DRTM_PAGE_SIZE) != 0) {
460 ERROR("DRTM: argument DLME image region is not "
461 DRTM_PAGE_SIZE_STR "-aligned\n");
462 return INVALID_PARAMETERS;
463 }
464
465 if (!(dlme_img_start <= dlme_img_ep && dlme_img_ep < dlme_img_end)) {
466 ERROR("DRTM: DLME entry point is outside of the DLME image region\n");
467 return INVALID_PARAMETERS;
468 }
469
470 if ((dlme_img_ep % 4) != 0) {
471 ERROR("DRTM: DLME image entry point is not 4-byte-aligned\n");
472 return INVALID_PARAMETERS;
473 }
474
475 /* Check the DLME data region arguments. */
476 if ((dlme_data_start % DRTM_PAGE_SIZE) != 0) {
477 ERROR("DRTM: argument DLME data region is not "
478 DRTM_PAGE_SIZE_STR "-aligned\n");
479 return INVALID_PARAMETERS;
480 }
481
482 if (dlme_data_end - dlme_data_start < dlme_data_min_size) {
483 ERROR("DRTM: argument DLME data region is short of %lu bytes\n",
484 dlme_data_min_size - (size_t)(dlme_data_end - dlme_data_start));
485 return INVALID_PARAMETERS;
486 }
487
488 /* check DLME region (paddr + size) is within a NS address region */
489 rc = plat_drtm_validate_ns_region(dlme_start, (size_t)a->dlme_size);
490 if (rc != 0) {
491 ERROR("DRTM: DLME region lies within secure memory\n");
492 return INVALID_PARAMETERS;
493 }
494
495 /* Check the Normal World DCE region arguments. */
496 if (a->dce_nwd_paddr != 0) {
497 uint32_t dce_nwd_start = a->dce_nwd_paddr;
498 uint32_t dce_nwd_end = dce_nwd_start + a->dce_nwd_size;
499
500 if (!(dce_nwd_start < dce_nwd_end)) {
501 ERROR("DRTM: argument Normal World DCE region is dicontiguous\n");
502 return INVALID_PARAMETERS;
503 }
504
505 if (dce_nwd_start < dlme_end && dlme_start < dce_nwd_end) {
506 ERROR("DRTM: argument Normal World DCE regions overlap\n");
507 return INVALID_PARAMETERS;
508 }
509 }
510
511 /*
512 * Map and sanitize the cache of data range passed by DCE Preamble. This
513 * is required to avoid / defend against racing with cache evictions
514 */
515 va_mapping_size = ALIGNED_UP((dlme_end - dlme_start), DRTM_PAGE_SIZE);
516 rc = mmap_add_dynamic_region_alloc_va(dlme_start, &va_mapping, va_mapping_size,
517 MT_MEMORY | MT_NS | MT_RO |
518 MT_SHAREABILITY_ISH);
519 if (rc != 0) {
520 ERROR("DRTM: %s: mmap_add_dynamic_region_alloc_va() failed rc=%d\n",
521 __func__, rc);
522 return INTERNAL_ERROR;
523 }
524 flush_dcache_range(va_mapping, va_mapping_size);
525
526 rc = mmap_remove_dynamic_region(va_mapping, va_mapping_size);
527 if (rc) {
528 ERROR("%s(): mmap_remove_dynamic_region() failed unexpectedly"
529 " rc=%d\n", __func__, rc);
530 panic();
531 }
532
533 *a_out = *a;
534 return SUCCESS;
535 }
536
drtm_dl_reset_dlme_el_state(enum drtm_dlme_el dlme_el)537 static void drtm_dl_reset_dlme_el_state(enum drtm_dlme_el dlme_el)
538 {
539 uint64_t sctlr;
540
541 switch (dlme_el) {
542 case DLME_AT_EL1:
543 sctlr = read_sctlr_el1();
544 break;
545
546 case DLME_AT_EL2:
547 sctlr = read_sctlr_el2();
548 break;
549
550 default: /* Not reached */
551 ERROR("%s(): dlme_el has the unexpected value %d\n",
552 __func__, dlme_el);
553 panic();
554 }
555
556 sctlr &= ~(/* Disable DLME's EL MMU, since the existing page-tables are untrusted. */
557 SCTLR_M_BIT
558 | SCTLR_EE_BIT /* Little-endian data accesses. */
559 | SCTLR_C_BIT /* disable data caching */
560 | SCTLR_I_BIT /* disable instruction caching */
561 );
562
563 switch (dlme_el) {
564 case DLME_AT_EL1:
565 write_sctlr_el1(sctlr);
566 break;
567
568 case DLME_AT_EL2:
569 write_sctlr_el2(sctlr);
570 break;
571 }
572 }
573
drtm_dl_reset_dlme_context(enum drtm_dlme_el dlme_el)574 static void drtm_dl_reset_dlme_context(enum drtm_dlme_el dlme_el)
575 {
576 void *ns_ctx = cm_get_context(NON_SECURE);
577 gp_regs_t *gpregs = get_gpregs_ctx(ns_ctx);
578 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ns_ctx), CTX_SPSR_EL3);
579
580 /* Reset all gpregs, including SP_EL0. */
581 memset(gpregs, 0, sizeof(*gpregs));
582
583 /* Reset SP_ELx. */
584 switch (dlme_el) {
585 case DLME_AT_EL1:
586 write_sp_el1(0);
587 break;
588
589 case DLME_AT_EL2:
590 write_sp_el2(0);
591 break;
592 }
593
594 /*
595 * DLME's async exceptions are masked to avoid a NWd attacker's timed
596 * interference with any state we established trust in or measured.
597 */
598 spsr_el3 |= SPSR_DAIF_MASK << SPSR_DAIF_SHIFT;
599
600 write_ctx_reg(get_el3state_ctx(ns_ctx), CTX_SPSR_EL3, spsr_el3);
601 }
602
drtm_dl_prepare_eret_to_dlme(const struct_drtm_dl_args * args,enum drtm_dlme_el dlme_el)603 static void drtm_dl_prepare_eret_to_dlme(const struct_drtm_dl_args *args, enum drtm_dlme_el dlme_el)
604 {
605 void *ctx = cm_get_context(NON_SECURE);
606 uint64_t dlme_ep = DL_ARGS_GET_DLME_ENTRY_POINT(args);
607 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ctx), CTX_SPSR_EL3);
608
609 /* Next ERET is to the DLME's EL. */
610 spsr_el3 &= ~(MODE_EL_MASK << MODE_EL_SHIFT);
611 switch (dlme_el) {
612 case DLME_AT_EL1:
613 spsr_el3 |= MODE_EL1 << MODE_EL_SHIFT;
614 break;
615
616 case DLME_AT_EL2:
617 spsr_el3 |= MODE_EL2 << MODE_EL_SHIFT;
618 break;
619 }
620
621 /* Next ERET is to the DLME entry point. */
622 cm_set_elr_spsr_el3(NON_SECURE, dlme_ep, spsr_el3);
623 }
624
drtm_dynamic_launch(uint64_t x1,void * handle)625 static uint64_t drtm_dynamic_launch(uint64_t x1, void *handle)
626 {
627 enum drtm_retc ret = SUCCESS;
628 enum drtm_retc dma_prot_ret;
629 struct_drtm_dl_args args;
630 /* DLME should be highest NS exception level */
631 enum drtm_dlme_el dlme_el = (el_implemented(2) != EL_IMPL_NONE) ? MODE_EL2 : MODE_EL1;
632
633 /* Ensure that only boot PE is powered on */
634 ret = drtm_dl_check_cores();
635 if (ret != SUCCESS) {
636 SMC_RET1(handle, ret);
637 }
638
639 /*
640 * Ensure that execution state is AArch64 and the caller
641 * is highest non-secure exception level
642 */
643 ret = drtm_dl_check_caller_el(handle);
644 if (ret != SUCCESS) {
645 SMC_RET1(handle, ret);
646 }
647
648 ret = drtm_dl_check_args(x1, &args);
649 if (ret != SUCCESS) {
650 SMC_RET1(handle, ret);
651 }
652
653 /* Ensure that there are no SDEI event registered */
654 #if SDEI_SUPPORT
655 if (sdei_get_registered_event_count() != 0) {
656 SMC_RET1(handle, DENIED);
657 }
658 #endif /* SDEI_SUPPORT */
659
660 /*
661 * Engage the DMA protections. The launch cannot proceed without the DMA
662 * protections due to potential TOC/TOU vulnerabilities w.r.t. the DLME
663 * region (and to the NWd DCE region).
664 */
665 ret = drtm_dma_prot_engage(&args.dma_prot_args,
666 DL_ARGS_GET_DMA_PROT_TYPE(&args));
667 if (ret != SUCCESS) {
668 SMC_RET1(handle, ret);
669 }
670
671 /*
672 * The DMA protection is now engaged. Note that any failure mode that
673 * returns an error to the DRTM-launch caller must now disengage DMA
674 * protections before returning to the caller.
675 */
676
677 ret = drtm_take_measurements(&args);
678 if (ret != SUCCESS) {
679 goto err_undo_dma_prot;
680 }
681
682 ret = drtm_dl_prepare_dlme_data(&args);
683 if (ret != SUCCESS) {
684 goto err_undo_dma_prot;
685 }
686
687 /*
688 * Note that, at the time of writing, the DRTM spec allows a successful
689 * launch from NS-EL1 to return to a DLME in NS-EL2. The practical risk
690 * of a privilege escalation, e.g. due to a compromised hypervisor, is
691 * considered small enough not to warrant the specification of additional
692 * DRTM conduits that would be necessary to maintain OSs' abstraction from
693 * the presence of EL2 were the dynamic launch only be allowed from the
694 * highest NS EL.
695 */
696
697 dlme_el = (el_implemented(2) != EL_IMPL_NONE) ? MODE_EL2 : MODE_EL1;
698
699 drtm_dl_reset_dlme_el_state(dlme_el);
700 drtm_dl_reset_dlme_context(dlme_el);
701
702 /*
703 * Setting the Generic Timer frequency is required before launching
704 * DLME and is already done for running CPU during PSCI setup.
705 */
706 drtm_dl_prepare_eret_to_dlme(&args, dlme_el);
707
708 /*
709 * As per DRTM 1.0 spec table #30 invalidate the instruction cache
710 * before jumping to the DLME. This is required to defend against
711 * potentially-malicious cache contents.
712 */
713 invalidate_icache_all();
714
715 /* Return the DLME region's address in x0, and the DLME data offset in x1.*/
716 SMC_RET2(handle, args.dlme_paddr, args.dlme_data_off);
717
718 err_undo_dma_prot:
719 dma_prot_ret = drtm_dma_prot_disengage();
720 if (dma_prot_ret != SUCCESS) {
721 ERROR("%s(): drtm_dma_prot_disengage() failed unexpectedly"
722 " rc=%d\n", __func__, ret);
723 panic();
724 }
725
726 SMC_RET1(handle, ret);
727 }
728
drtm_smc_handler(uint32_t smc_fid,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)729 uint64_t drtm_smc_handler(uint32_t smc_fid,
730 uint64_t x1,
731 uint64_t x2,
732 uint64_t x3,
733 uint64_t x4,
734 void *cookie,
735 void *handle,
736 uint64_t flags)
737 {
738 /* Check that the SMC call is from the Normal World. */
739 if (!is_caller_non_secure(flags)) {
740 SMC_RET1(handle, NOT_SUPPORTED);
741 }
742
743 switch (smc_fid) {
744 case ARM_DRTM_SVC_VERSION:
745 INFO("DRTM service handler: version\n");
746 /* Return the version of current implementation */
747 SMC_RET1(handle, ARM_DRTM_VERSION);
748 break; /* not reached */
749
750 case ARM_DRTM_SVC_FEATURES:
751 if (((x1 >> ARM_DRTM_FUNC_SHIFT) & ARM_DRTM_FUNC_MASK) ==
752 ARM_DRTM_FUNC_ID) {
753 /* Dispatch function-based queries. */
754 switch (x1 & FUNCID_MASK) {
755 case ARM_DRTM_SVC_VERSION:
756 SMC_RET1(handle, SUCCESS);
757 break; /* not reached */
758
759 case ARM_DRTM_SVC_FEATURES:
760 SMC_RET1(handle, SUCCESS);
761 break; /* not reached */
762
763 case ARM_DRTM_SVC_UNPROTECT_MEM:
764 SMC_RET1(handle, SUCCESS);
765 break; /* not reached */
766
767 case ARM_DRTM_SVC_DYNAMIC_LAUNCH:
768 SMC_RET1(handle, SUCCESS);
769 break; /* not reached */
770
771 case ARM_DRTM_SVC_CLOSE_LOCALITY:
772 WARN("ARM_DRTM_SVC_CLOSE_LOCALITY feature %s",
773 "is not supported\n");
774 SMC_RET1(handle, NOT_SUPPORTED);
775 break; /* not reached */
776
777 case ARM_DRTM_SVC_GET_ERROR:
778 SMC_RET1(handle, SUCCESS);
779 break; /* not reached */
780
781 case ARM_DRTM_SVC_SET_ERROR:
782 SMC_RET1(handle, SUCCESS);
783 break; /* not reached */
784
785 case ARM_DRTM_SVC_SET_TCB_HASH:
786 WARN("ARM_DRTM_SVC_TCB_HASH feature %s",
787 "is not supported\n");
788 SMC_RET1(handle, NOT_SUPPORTED);
789 break; /* not reached */
790
791 case ARM_DRTM_SVC_LOCK_TCB_HASH:
792 WARN("ARM_DRTM_SVC_LOCK_TCB_HASH feature %s",
793 "is not supported\n");
794 SMC_RET1(handle, NOT_SUPPORTED);
795 break; /* not reached */
796
797 default:
798 ERROR("Unknown DRTM service function\n");
799 SMC_RET1(handle, NOT_SUPPORTED);
800 break; /* not reached */
801 }
802 } else {
803 /* Dispatch feature-based queries. */
804 switch (x1 & ARM_DRTM_FEAT_ID_MASK) {
805 case ARM_DRTM_FEATURES_TPM:
806 INFO("++ DRTM service handler: TPM features\n");
807 return drtm_features_tpm(handle);
808 break; /* not reached */
809
810 case ARM_DRTM_FEATURES_MEM_REQ:
811 INFO("++ DRTM service handler: Min. mem."
812 " requirement features\n");
813 return drtm_features_mem_req(handle);
814 break; /* not reached */
815
816 case ARM_DRTM_FEATURES_DMA_PROT:
817 INFO("++ DRTM service handler: "
818 "DMA protection features\n");
819 return drtm_features_dma_prot(handle);
820 break; /* not reached */
821
822 case ARM_DRTM_FEATURES_BOOT_PE_ID:
823 INFO("++ DRTM service handler: "
824 "Boot PE ID features\n");
825 return drtm_features_boot_pe_id(handle);
826 break; /* not reached */
827
828 case ARM_DRTM_FEATURES_TCB_HASHES:
829 INFO("++ DRTM service handler: "
830 "TCB-hashes features\n");
831 return drtm_features_tcb_hashes(handle);
832 break; /* not reached */
833
834 case ARM_DRTM_FEATURES_DLME_IMG_AUTH:
835 INFO("++ DRTM service handler: "
836 "DLME Image authentication features\n");
837 return drtm_features_dlme_img_auth_features(handle);
838 break; /* not reached */
839
840 default:
841 ERROR("Unknown ARM DRTM service feature\n");
842 SMC_RET1(handle, NOT_SUPPORTED);
843 break; /* not reached */
844 }
845 }
846
847 case ARM_DRTM_SVC_UNPROTECT_MEM:
848 INFO("DRTM service handler: unprotect mem\n");
849 return drtm_unprotect_mem(handle);
850 break; /* not reached */
851
852 case ARM_DRTM_SVC_DYNAMIC_LAUNCH:
853 INFO("DRTM service handler: dynamic launch\n");
854 return drtm_dynamic_launch(x1, handle);
855 break; /* not reached */
856
857 case ARM_DRTM_SVC_CLOSE_LOCALITY:
858 WARN("DRTM service handler: close locality %s\n",
859 "is not supported");
860 SMC_RET1(handle, NOT_SUPPORTED);
861 break; /* not reached */
862
863 case ARM_DRTM_SVC_GET_ERROR:
864 INFO("DRTM service handler: get error\n");
865 return drtm_get_error(handle);
866 break; /* not reached */
867
868 case ARM_DRTM_SVC_SET_ERROR:
869 INFO("DRTM service handler: set error\n");
870 return drtm_set_error(x1, handle);
871 break; /* not reached */
872
873 case ARM_DRTM_SVC_SET_TCB_HASH:
874 WARN("DRTM service handler: set TCB hash %s\n",
875 "is not supported");
876 SMC_RET1(handle, NOT_SUPPORTED);
877 break; /* not reached */
878
879 case ARM_DRTM_SVC_LOCK_TCB_HASH:
880 WARN("DRTM service handler: lock TCB hash %s\n",
881 "is not supported");
882 SMC_RET1(handle, NOT_SUPPORTED);
883 break; /* not reached */
884
885 default:
886 ERROR("Unknown DRTM service function: 0x%x\n", smc_fid);
887 SMC_RET1(handle, SMC_UNK);
888 break; /* not reached */
889 }
890
891 /* not reached */
892 SMC_RET1(handle, SMC_UNK);
893 }
894