1 /* 2 * Copyright (c) 2015-2016, ARM Limited and Contributors. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * Redistributions of source code must retain the above copyright notice, this 8 * list of conditions and the following disclaimer. 9 * 10 * Redistributions in binary form must reproduce the above copyright notice, 11 * this list of conditions and the following disclaimer in the documentation 12 * and/or other materials provided with the distribution. 13 * 14 * Neither the name of ARM nor the names of its contributors may be used 15 * to endorse or promote products derived from this software without specific 16 * prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 19 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <assert.h> 32 #include <arch_helpers.h> 33 #include <auth_mod.h> 34 #include <bl1.h> 35 #include <bl_common.h> 36 #include <context.h> 37 #include <context_mgmt.h> 38 #include <debug.h> 39 #include <errno.h> 40 #include <platform.h> 41 #include <platform_def.h> 42 #include <smcc_helpers.h> 43 #include <string.h> 44 #include "bl1_private.h" 45 46 /* 47 * Function declarations. 48 */ 49 static int bl1_fwu_image_copy(unsigned int image_id, 50 uintptr_t image_addr, 51 unsigned int block_size, 52 unsigned int image_size, 53 unsigned int flags); 54 static int bl1_fwu_image_auth(unsigned int image_id, 55 uintptr_t image_addr, 56 unsigned int image_size, 57 unsigned int flags); 58 static int bl1_fwu_image_execute(unsigned int image_id, 59 void **handle, 60 unsigned int flags); 61 static register_t bl1_fwu_image_resume(register_t image_param, 62 void **handle, 63 unsigned int flags); 64 static int bl1_fwu_sec_image_done(void **handle, 65 unsigned int flags); 66 __dead2 static void bl1_fwu_done(void *client_cookie, void *reserved); 67 68 /* 69 * This keeps track of last executed secure image id. 70 */ 71 static unsigned int sec_exec_image_id = INVALID_IMAGE_ID; 72 73 /******************************************************************************* 74 * Top level handler for servicing FWU SMCs. 75 ******************************************************************************/ 76 register_t bl1_fwu_smc_handler(unsigned int smc_fid, 77 register_t x1, 78 register_t x2, 79 register_t x3, 80 register_t x4, 81 void *cookie, 82 void *handle, 83 unsigned int flags) 84 { 85 86 switch (smc_fid) { 87 case FWU_SMC_IMAGE_COPY: 88 SMC_RET1(handle, bl1_fwu_image_copy(x1, x2, x3, x4, flags)); 89 90 case FWU_SMC_IMAGE_AUTH: 91 SMC_RET1(handle, bl1_fwu_image_auth(x1, x2, x3, flags)); 92 93 case FWU_SMC_IMAGE_EXECUTE: 94 SMC_RET1(handle, bl1_fwu_image_execute(x1, &handle, flags)); 95 96 case FWU_SMC_IMAGE_RESUME: 97 SMC_RET1(handle, bl1_fwu_image_resume(x1, &handle, flags)); 98 99 case FWU_SMC_SEC_IMAGE_DONE: 100 SMC_RET1(handle, bl1_fwu_sec_image_done(&handle, flags)); 101 102 case FWU_SMC_UPDATE_DONE: 103 bl1_fwu_done((void *)x1, NULL); 104 /* We should never return from bl1_fwu_done() */ 105 106 default: 107 assert(0); 108 break; 109 } 110 111 SMC_RET0(handle); 112 } 113 114 /******************************************************************************* 115 * This function is responsible for copying secure images in AP Secure RAM. 116 ******************************************************************************/ 117 static int bl1_fwu_image_copy(unsigned int image_id, 118 uintptr_t image_src, 119 unsigned int block_size, 120 unsigned int image_size, 121 unsigned int flags) 122 { 123 uintptr_t base_addr; 124 meminfo_t *mem_layout; 125 126 /* Get the image descriptor. */ 127 image_desc_t *image_desc = bl1_plat_get_image_desc(image_id); 128 129 /* Check if we are in correct state. */ 130 if ((!image_desc) || 131 ((image_desc->state != IMAGE_STATE_RESET) && 132 (image_desc->state != IMAGE_STATE_COPYING))) { 133 WARN("BL1-FWU: Copy not allowed due to invalid state\n"); 134 return -EPERM; 135 } 136 137 /* Only Normal world is allowed to copy a Secure image. */ 138 if ((GET_SECURITY_STATE(flags) == SECURE) || 139 (GET_SECURITY_STATE(image_desc->ep_info.h.attr) == NON_SECURE)) { 140 WARN("BL1-FWU: Copy not allowed for Non-Secure " 141 "image from Secure-world\n"); 142 return -EPERM; 143 } 144 145 if ((!image_src) || (!block_size)) { 146 WARN("BL1-FWU: Copy not allowed due to invalid image source" 147 " or block size\n"); 148 return -ENOMEM; 149 } 150 151 /* Get the image base address. */ 152 base_addr = image_desc->image_info.image_base; 153 154 if (image_desc->state == IMAGE_STATE_COPYING) { 155 /* 156 * If last block is more than expected then 157 * clip the block to the required image size. 158 */ 159 if (image_desc->copied_size + block_size > 160 image_desc->image_info.image_size) { 161 block_size = image_desc->image_info.image_size - 162 image_desc->copied_size; 163 WARN("BL1-FWU: Copy argument block_size > remaining image size." 164 " Clipping block_size\n"); 165 } 166 167 /* Make sure the image src/size is mapped. */ 168 if (bl1_plat_mem_check(image_src, block_size, flags)) { 169 WARN("BL1-FWU: Copy arguments source/size not mapped\n"); 170 return -ENOMEM; 171 } 172 173 INFO("BL1-FWU: Continuing image copy in blocks\n"); 174 175 /* Copy image for given block size. */ 176 base_addr += image_desc->copied_size; 177 image_desc->copied_size += block_size; 178 memcpy((void *)base_addr, (const void *)image_src, block_size); 179 flush_dcache_range(base_addr, block_size); 180 181 /* Update the state if last block. */ 182 if (image_desc->copied_size == 183 image_desc->image_info.image_size) { 184 image_desc->state = IMAGE_STATE_COPIED; 185 INFO("BL1-FWU: Image copy in blocks completed\n"); 186 } 187 } else { 188 /* This means image is in RESET state and ready to be copied. */ 189 INFO("BL1-FWU: Fresh call to copy an image\n"); 190 191 if (!image_size) { 192 WARN("BL1-FWU: Copy not allowed due to invalid image size\n"); 193 return -ENOMEM; 194 } 195 196 /* 197 * If block size is more than total size then 198 * assume block size as the total image size. 199 */ 200 if (block_size > image_size) { 201 block_size = image_size; 202 WARN("BL1-FWU: Copy argument block_size > image size." 203 " Clipping block_size\n"); 204 } 205 206 /* Make sure the image src/size is mapped. */ 207 if (bl1_plat_mem_check(image_src, block_size, flags)) { 208 WARN("BL1-FWU: Copy arguments source/size not mapped\n"); 209 return -ENOMEM; 210 } 211 212 /* Find out how much free trusted ram remains after BL1 load */ 213 mem_layout = bl1_plat_sec_mem_layout(); 214 if ((image_desc->image_info.image_base < mem_layout->free_base) || 215 (image_desc->image_info.image_base + image_size > 216 mem_layout->free_base + mem_layout->free_size)) { 217 WARN("BL1-FWU: Memory not available to copy\n"); 218 return -ENOMEM; 219 } 220 221 /* Update the image size. */ 222 image_desc->image_info.image_size = image_size; 223 224 /* Copy image for given size. */ 225 memcpy((void *)base_addr, (const void *)image_src, block_size); 226 flush_dcache_range(base_addr, block_size); 227 228 /* Update the state. */ 229 if (block_size == image_size) { 230 image_desc->state = IMAGE_STATE_COPIED; 231 INFO("BL1-FWU: Image is copied successfully\n"); 232 } else { 233 image_desc->state = IMAGE_STATE_COPYING; 234 INFO("BL1-FWU: Started image copy in blocks\n"); 235 } 236 237 image_desc->copied_size = block_size; 238 } 239 240 return 0; 241 } 242 243 /******************************************************************************* 244 * This function is responsible for authenticating Normal/Secure images. 245 ******************************************************************************/ 246 static int bl1_fwu_image_auth(unsigned int image_id, 247 uintptr_t image_src, 248 unsigned int image_size, 249 unsigned int flags) 250 { 251 int result; 252 uintptr_t base_addr; 253 unsigned int total_size; 254 255 /* Get the image descriptor. */ 256 image_desc_t *image_desc = bl1_plat_get_image_desc(image_id); 257 if (!image_desc) 258 return -EPERM; 259 260 if (GET_SECURITY_STATE(flags) == SECURE) { 261 if (image_desc->state != IMAGE_STATE_RESET) { 262 WARN("BL1-FWU: Authentication from secure world " 263 "while in invalid state\n"); 264 return -EPERM; 265 } 266 } else { 267 if (GET_SECURITY_STATE(image_desc->ep_info.h.attr) == SECURE) { 268 if (image_desc->state != IMAGE_STATE_COPIED) { 269 WARN("BL1-FWU: Authentication of secure image " 270 "from non-secure world while not in copied state\n"); 271 return -EPERM; 272 } 273 } else { 274 if (image_desc->state != IMAGE_STATE_RESET) { 275 WARN("BL1-FWU: Authentication of non-secure image " 276 "from non-secure world while in invalid state\n"); 277 return -EPERM; 278 } 279 } 280 } 281 282 if (image_desc->state == IMAGE_STATE_COPIED) { 283 /* 284 * Image is in COPIED state. 285 * Use the stored address and size. 286 */ 287 base_addr = image_desc->image_info.image_base; 288 total_size = image_desc->image_info.image_size; 289 } else { 290 if ((!image_src) || (!image_size)) { 291 WARN("BL1-FWU: Auth not allowed due to invalid" 292 " image source/size\n"); 293 return -ENOMEM; 294 } 295 296 /* 297 * Image is in RESET state. 298 * Check the parameters and authenticate the source image in place. 299 */ 300 if (bl1_plat_mem_check(image_src, image_size, \ 301 image_desc->ep_info.h.attr)) { 302 WARN("BL1-FWU: Authentication arguments source/size not mapped\n"); 303 return -ENOMEM; 304 } 305 306 base_addr = image_src; 307 total_size = image_size; 308 309 /* Update the image size in the descriptor. */ 310 image_desc->image_info.image_size = total_size; 311 } 312 313 /* 314 * Authenticate the image. 315 */ 316 INFO("BL1-FWU: Authenticating image_id:%d\n", image_id); 317 result = auth_mod_verify_img(image_id, (void *)base_addr, total_size); 318 if (result != 0) { 319 WARN("BL1-FWU: Authentication Failed err=%d\n", result); 320 321 /* 322 * Authentication has failed. 323 * Clear the memory if the image was copied. 324 * This is to prevent an attack where this contains 325 * some malicious code that can somehow be executed later. 326 */ 327 if (image_desc->state == IMAGE_STATE_COPIED) { 328 /* Clear the memory.*/ 329 memset((void *)base_addr, 0, total_size); 330 flush_dcache_range(base_addr, total_size); 331 332 /* Indicate that image can be copied again*/ 333 image_desc->state = IMAGE_STATE_RESET; 334 } 335 return -EAUTH; 336 } 337 338 /* Indicate that image is in authenticated state. */ 339 image_desc->state = IMAGE_STATE_AUTHENTICATED; 340 341 /* 342 * Flush image_info to memory so that other 343 * secure world images can see changes. 344 */ 345 flush_dcache_range((unsigned long)&image_desc->image_info, 346 sizeof(image_info_t)); 347 348 INFO("BL1-FWU: Authentication was successful\n"); 349 350 return 0; 351 } 352 353 /******************************************************************************* 354 * This function is responsible for executing Secure images. 355 ******************************************************************************/ 356 static int bl1_fwu_image_execute(unsigned int image_id, 357 void **handle, 358 unsigned int flags) 359 { 360 /* Get the image descriptor. */ 361 image_desc_t *image_desc = bl1_plat_get_image_desc(image_id); 362 363 /* 364 * Execution is NOT allowed if: 365 * image_id is invalid OR 366 * Caller is from Secure world OR 367 * Image is Non-Secure OR 368 * Image is Non-Executable OR 369 * Image is NOT in AUTHENTICATED state. 370 */ 371 if ((!image_desc) || 372 (GET_SECURITY_STATE(flags) == SECURE) || 373 (GET_SECURITY_STATE(image_desc->ep_info.h.attr) == NON_SECURE) || 374 (EP_GET_EXE(image_desc->ep_info.h.attr) == NON_EXECUTABLE) || 375 (image_desc->state != IMAGE_STATE_AUTHENTICATED)) { 376 WARN("BL1-FWU: Execution not allowed due to invalid state/args\n"); 377 return -EPERM; 378 } 379 380 INFO("BL1-FWU: Executing Secure image\n"); 381 382 /* Save NS-EL1 system registers. */ 383 cm_el1_sysregs_context_save(NON_SECURE); 384 385 /* Prepare the image for execution. */ 386 bl1_prepare_next_image(image_id); 387 388 /* Update the secure image id. */ 389 sec_exec_image_id = image_id; 390 391 *handle = cm_get_context(SECURE); 392 return 0; 393 } 394 395 /******************************************************************************* 396 * This function is responsible for resuming execution in the other security 397 * world 398 ******************************************************************************/ 399 static register_t bl1_fwu_image_resume(register_t image_param, 400 void **handle, 401 unsigned int flags) 402 { 403 image_desc_t *image_desc; 404 unsigned int resume_sec_state; 405 unsigned int caller_sec_state = GET_SECURITY_STATE(flags); 406 407 /* Get the image descriptor for last executed secure image id. */ 408 image_desc = bl1_plat_get_image_desc(sec_exec_image_id); 409 if (caller_sec_state == NON_SECURE) { 410 if (!image_desc) { 411 WARN("BL1-FWU: Resume not allowed due to no available" 412 "secure image\n"); 413 return -EPERM; 414 } 415 } else { 416 /* image_desc must be valid for secure world callers */ 417 assert(image_desc); 418 } 419 420 assert(GET_SECURITY_STATE(image_desc->ep_info.h.attr) == SECURE); 421 assert(EP_GET_EXE(image_desc->ep_info.h.attr) == EXECUTABLE); 422 423 if (caller_sec_state == SECURE) { 424 assert(image_desc->state == IMAGE_STATE_EXECUTED); 425 426 /* Update the flags. */ 427 image_desc->state = IMAGE_STATE_INTERRUPTED; 428 resume_sec_state = NON_SECURE; 429 } else { 430 assert(image_desc->state == IMAGE_STATE_INTERRUPTED); 431 432 /* Update the flags. */ 433 image_desc->state = IMAGE_STATE_EXECUTED; 434 resume_sec_state = SECURE; 435 } 436 437 /* Save the EL1 system registers of calling world. */ 438 cm_el1_sysregs_context_save(caller_sec_state); 439 440 /* Restore the EL1 system registers of resuming world. */ 441 cm_el1_sysregs_context_restore(resume_sec_state); 442 443 /* Update the next context. */ 444 cm_set_next_eret_context(resume_sec_state); 445 446 INFO("BL1-FWU: Resuming %s world context\n", 447 (resume_sec_state == SECURE) ? "secure" : "normal"); 448 449 *handle = cm_get_context(resume_sec_state); 450 return image_param; 451 } 452 453 /******************************************************************************* 454 * This function is responsible for resuming normal world context. 455 ******************************************************************************/ 456 static int bl1_fwu_sec_image_done(void **handle, unsigned int flags) 457 { 458 image_desc_t *image_desc; 459 460 /* Make sure caller is from the secure world */ 461 if (GET_SECURITY_STATE(flags) == NON_SECURE) { 462 WARN("BL1-FWU: Image done not allowed from normal world\n"); 463 return -EPERM; 464 } 465 466 /* Get the image descriptor for last executed secure image id */ 467 image_desc = bl1_plat_get_image_desc(sec_exec_image_id); 468 469 /* image_desc must correspond to a valid secure executing image */ 470 assert(image_desc); 471 assert(GET_SECURITY_STATE(image_desc->ep_info.h.attr) == SECURE); 472 assert(EP_GET_EXE(image_desc->ep_info.h.attr) == EXECUTABLE); 473 assert(image_desc->state == IMAGE_STATE_EXECUTED); 474 475 /* Update the flags. */ 476 image_desc->state = IMAGE_STATE_RESET; 477 sec_exec_image_id = INVALID_IMAGE_ID; 478 479 /* 480 * Secure world is done so no need to save the context. 481 * Just restore the Non-Secure context. 482 */ 483 cm_el1_sysregs_context_restore(NON_SECURE); 484 485 /* Update the next context. */ 486 cm_set_next_eret_context(NON_SECURE); 487 488 INFO("BL1-FWU: Resuming Normal world context\n"); 489 490 *handle = cm_get_context(NON_SECURE); 491 return 0; 492 } 493 494 /******************************************************************************* 495 * This function provides the opportunity for users to perform any 496 * platform specific handling after the Firmware update is done. 497 ******************************************************************************/ 498 __dead2 static void bl1_fwu_done(void *client_cookie, void *reserved) 499 { 500 NOTICE("BL1-FWU: *******FWU Process Completed*******\n"); 501 502 /* 503 * Call platform done function. 504 */ 505 bl1_plat_fwu_done(client_cookie, reserved); 506 assert(0); 507 } 508