1 /* 2 * Copyright (c) 2013-2017, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <arch.h> 8 #include <arch_helpers.h> 9 #include <assert.h> 10 #include <auth_mod.h> 11 #include <bl_common.h> 12 #include <debug.h> 13 #include <errno.h> 14 #include <io_storage.h> 15 #include <platform.h> 16 #include <string.h> 17 #include <utils.h> 18 #include <xlat_tables_defs.h> 19 20 uintptr_t page_align(uintptr_t value, unsigned dir) 21 { 22 /* Round up the limit to the next page boundary */ 23 if (value & (PAGE_SIZE - 1)) { 24 value &= ~(PAGE_SIZE - 1); 25 if (dir == UP) 26 value += PAGE_SIZE; 27 } 28 29 return value; 30 } 31 32 /****************************************************************************** 33 * Determine whether the memory region delimited by 'addr' and 'size' is free, 34 * given the extents of free memory. 35 * Return 1 if it is free, 0 if it is not free or if the input values are 36 * invalid. 37 *****************************************************************************/ 38 int is_mem_free(uintptr_t free_base, size_t free_size, 39 uintptr_t addr, size_t size) 40 { 41 uintptr_t free_end, requested_end; 42 43 /* 44 * Handle corner cases first. 45 * 46 * The order of the 2 tests is important, because if there's no space 47 * left (i.e. free_size == 0) but we don't ask for any memory 48 * (i.e. size == 0) then we should report that the memory is free. 49 */ 50 if (size == 0) 51 return 1; /* A zero-byte region is always free */ 52 if (free_size == 0) 53 return 0; 54 55 /* 56 * Check that the end addresses don't overflow. 57 * If they do, consider that this memory region is not free, as this 58 * is an invalid scenario. 59 */ 60 if (check_uptr_overflow(free_base, free_size - 1)) 61 return 0; 62 free_end = free_base + (free_size - 1); 63 64 if (check_uptr_overflow(addr, size - 1)) 65 return 0; 66 requested_end = addr + (size - 1); 67 68 /* 69 * Finally, check that the requested memory region lies within the free 70 * region. 71 */ 72 return (addr >= free_base) && (requested_end <= free_end); 73 } 74 75 #if !LOAD_IMAGE_V2 76 /****************************************************************************** 77 * Inside a given memory region, determine whether a sub-region of memory is 78 * closer from the top or the bottom of the encompassing region. Return the 79 * size of the smallest chunk of free memory surrounding the sub-region in 80 * 'small_chunk_size'. 81 *****************************************************************************/ 82 static unsigned int choose_mem_pos(uintptr_t mem_start, uintptr_t mem_end, 83 uintptr_t submem_start, uintptr_t submem_end, 84 size_t *small_chunk_size) 85 { 86 size_t top_chunk_size, bottom_chunk_size; 87 88 assert(mem_start <= submem_start); 89 assert(submem_start <= submem_end); 90 assert(submem_end <= mem_end); 91 assert(small_chunk_size != NULL); 92 93 top_chunk_size = mem_end - submem_end; 94 bottom_chunk_size = submem_start - mem_start; 95 96 if (top_chunk_size < bottom_chunk_size) { 97 *small_chunk_size = top_chunk_size; 98 return TOP; 99 } else { 100 *small_chunk_size = bottom_chunk_size; 101 return BOTTOM; 102 } 103 } 104 105 /****************************************************************************** 106 * Reserve the memory region delimited by 'addr' and 'size'. The extents of free 107 * memory are passed in 'free_base' and 'free_size' and they will be updated to 108 * reflect the memory usage. 109 * The caller must ensure the memory to reserve is free and that the addresses 110 * and sizes passed in arguments are sane. 111 *****************************************************************************/ 112 void reserve_mem(uintptr_t *free_base, size_t *free_size, 113 uintptr_t addr, size_t size) 114 { 115 size_t discard_size; 116 size_t reserved_size; 117 unsigned int pos; 118 119 assert(free_base != NULL); 120 assert(free_size != NULL); 121 assert(is_mem_free(*free_base, *free_size, addr, size)); 122 123 if (size == 0) { 124 WARN("Nothing to allocate, requested size is zero\n"); 125 return; 126 } 127 128 pos = choose_mem_pos(*free_base, *free_base + (*free_size - 1), 129 addr, addr + (size - 1), 130 &discard_size); 131 132 reserved_size = size + discard_size; 133 *free_size -= reserved_size; 134 135 if (pos == BOTTOM) 136 *free_base = addr + size; 137 138 VERBOSE("Reserved 0x%zx bytes (discarded 0x%zx bytes %s)\n", 139 reserved_size, discard_size, 140 pos == TOP ? "above" : "below"); 141 } 142 143 static void dump_load_info(uintptr_t image_load_addr, 144 size_t image_size, 145 const meminfo_t *mem_layout) 146 { 147 INFO("Trying to load image at address %p, size = 0x%zx\n", 148 (void *)image_load_addr, image_size); 149 INFO("Current memory layout:\n"); 150 INFO(" total region = [base = %p, size = 0x%zx]\n", 151 (void *) mem_layout->total_base, mem_layout->total_size); 152 INFO(" free region = [base = %p, size = 0x%zx]\n", 153 (void *) mem_layout->free_base, mem_layout->free_size); 154 } 155 #endif /* LOAD_IMAGE_V2 */ 156 157 /* Generic function to return the size of an image */ 158 size_t image_size(unsigned int image_id) 159 { 160 uintptr_t dev_handle; 161 uintptr_t image_handle; 162 uintptr_t image_spec; 163 size_t image_size = 0; 164 int io_result; 165 166 /* Obtain a reference to the image by querying the platform layer */ 167 io_result = plat_get_image_source(image_id, &dev_handle, &image_spec); 168 if (io_result != 0) { 169 WARN("Failed to obtain reference to image id=%u (%i)\n", 170 image_id, io_result); 171 return 0; 172 } 173 174 /* Attempt to access the image */ 175 io_result = io_open(dev_handle, image_spec, &image_handle); 176 if (io_result != 0) { 177 WARN("Failed to access image id=%u (%i)\n", 178 image_id, io_result); 179 return 0; 180 } 181 182 /* Find the size of the image */ 183 io_result = io_size(image_handle, &image_size); 184 if ((io_result != 0) || (image_size == 0)) { 185 WARN("Failed to determine the size of the image id=%u (%i)\n", 186 image_id, io_result); 187 } 188 io_result = io_close(image_handle); 189 /* Ignore improbable/unrecoverable error in 'close' */ 190 191 /* TODO: Consider maintaining open device connection from this 192 * bootloader stage 193 */ 194 io_result = io_dev_close(dev_handle); 195 /* Ignore improbable/unrecoverable error in 'dev_close' */ 196 197 return image_size; 198 } 199 200 #if LOAD_IMAGE_V2 201 202 /******************************************************************************* 203 * Generic function to load an image at a specific address given 204 * an image ID and extents of free memory. 205 * 206 * If the load is successful then the image information is updated. 207 * 208 * Returns 0 on success, a negative error code otherwise. 209 ******************************************************************************/ 210 int load_image(unsigned int image_id, image_info_t *image_data) 211 { 212 uintptr_t dev_handle; 213 uintptr_t image_handle; 214 uintptr_t image_spec; 215 uintptr_t image_base; 216 size_t image_size; 217 size_t bytes_read; 218 int io_result; 219 220 assert(image_data != NULL); 221 assert(image_data->h.version >= VERSION_2); 222 223 image_base = image_data->image_base; 224 225 /* Obtain a reference to the image by querying the platform layer */ 226 io_result = plat_get_image_source(image_id, &dev_handle, &image_spec); 227 if (io_result != 0) { 228 WARN("Failed to obtain reference to image id=%u (%i)\n", 229 image_id, io_result); 230 return io_result; 231 } 232 233 /* Attempt to access the image */ 234 io_result = io_open(dev_handle, image_spec, &image_handle); 235 if (io_result != 0) { 236 WARN("Failed to access image id=%u (%i)\n", 237 image_id, io_result); 238 return io_result; 239 } 240 241 INFO("Loading image id=%u at address %p\n", image_id, 242 (void *) image_base); 243 244 /* Find the size of the image */ 245 io_result = io_size(image_handle, &image_size); 246 if ((io_result != 0) || (image_size == 0)) { 247 WARN("Failed to determine the size of the image id=%u (%i)\n", 248 image_id, io_result); 249 goto exit; 250 } 251 252 /* Check that the image size to load is within limit */ 253 if (image_size > image_data->image_max_size) { 254 WARN("Image id=%u size out of bounds\n", image_id); 255 io_result = -EFBIG; 256 goto exit; 257 } 258 259 image_data->image_size = image_size; 260 261 /* We have enough space so load the image now */ 262 /* TODO: Consider whether to try to recover/retry a partially successful read */ 263 io_result = io_read(image_handle, image_base, image_size, &bytes_read); 264 if ((io_result != 0) || (bytes_read < image_size)) { 265 WARN("Failed to load image id=%u (%i)\n", image_id, io_result); 266 goto exit; 267 } 268 269 #if !TRUSTED_BOARD_BOOT 270 /* 271 * File has been successfully loaded. 272 * Flush the image to main memory so that it can be executed later by 273 * any CPU, regardless of cache and MMU state. 274 * When TBB is enabled the image is flushed later, after image 275 * authentication. 276 */ 277 flush_dcache_range(image_base, image_size); 278 #endif /* TRUSTED_BOARD_BOOT */ 279 280 INFO("Image id=%u loaded: %p - %p\n", image_id, (void *) image_base, 281 (void *) (image_base + image_size)); 282 283 exit: 284 io_close(image_handle); 285 /* Ignore improbable/unrecoverable error in 'close' */ 286 287 /* TODO: Consider maintaining open device connection from this bootloader stage */ 288 io_dev_close(dev_handle); 289 /* Ignore improbable/unrecoverable error in 'dev_close' */ 290 291 return io_result; 292 } 293 294 static int load_auth_image_internal(unsigned int image_id, 295 image_info_t *image_data, 296 int is_parent_image) 297 { 298 int rc; 299 300 #if TRUSTED_BOARD_BOOT 301 unsigned int parent_id; 302 303 /* Use recursion to authenticate parent images */ 304 rc = auth_mod_get_parent_id(image_id, &parent_id); 305 if (rc == 0) { 306 rc = load_auth_image_internal(parent_id, image_data, 1); 307 if (rc != 0) { 308 return rc; 309 } 310 } 311 #endif /* TRUSTED_BOARD_BOOT */ 312 313 /* Load the image */ 314 rc = load_image(image_id, image_data); 315 if (rc != 0) { 316 return rc; 317 } 318 319 #if TRUSTED_BOARD_BOOT 320 /* Authenticate it */ 321 rc = auth_mod_verify_img(image_id, 322 (void *)image_data->image_base, 323 image_data->image_size); 324 if (rc != 0) { 325 /* Authentication error, zero memory and flush it right away. */ 326 zero_normalmem((void *)image_data->image_base, 327 image_data->image_size); 328 flush_dcache_range(image_data->image_base, 329 image_data->image_size); 330 return -EAUTH; 331 } 332 333 /* 334 * File has been successfully loaded and authenticated. 335 * Flush the image to main memory so that it can be executed later by 336 * any CPU, regardless of cache and MMU state. 337 * Do it only for child images, not for the parents (certificates). 338 */ 339 if (!is_parent_image) { 340 flush_dcache_range(image_data->image_base, 341 image_data->image_size); 342 } 343 #endif /* TRUSTED_BOARD_BOOT */ 344 345 return 0; 346 } 347 348 /******************************************************************************* 349 * Generic function to load and authenticate an image. The image is actually 350 * loaded by calling the 'load_image()' function. Therefore, it returns the 351 * same error codes if the loading operation failed, or -EAUTH if the 352 * authentication failed. In addition, this function uses recursion to 353 * authenticate the parent images up to the root of trust. 354 ******************************************************************************/ 355 int load_auth_image(unsigned int image_id, image_info_t *image_data) 356 { 357 return load_auth_image_internal(image_id, image_data, 0); 358 } 359 360 #else /* LOAD_IMAGE_V2 */ 361 362 /******************************************************************************* 363 * Generic function to load an image at a specific address given an image ID and 364 * extents of free memory. 365 * 366 * If the load is successful then the image information is updated. 367 * 368 * If the entry_point_info argument is not NULL then this function also updates: 369 * - the memory layout to mark the memory as reserved; 370 * - the entry point information. 371 * 372 * The caller might pass a NULL pointer for the entry point if they are not 373 * interested in this information. This is typically the case for non-executable 374 * images (e.g. certificates) and executable images that won't ever be executed 375 * on the application processor (e.g. additional microcontroller firmware). 376 * 377 * Returns 0 on success, a negative error code otherwise. 378 ******************************************************************************/ 379 int load_image(meminfo_t *mem_layout, 380 unsigned int image_id, 381 uintptr_t image_base, 382 image_info_t *image_data, 383 entry_point_info_t *entry_point_info) 384 { 385 uintptr_t dev_handle; 386 uintptr_t image_handle; 387 uintptr_t image_spec; 388 size_t image_size; 389 size_t bytes_read; 390 int io_result; 391 392 assert(mem_layout != NULL); 393 assert(image_data != NULL); 394 assert(image_data->h.version == VERSION_1); 395 396 /* Obtain a reference to the image by querying the platform layer */ 397 io_result = plat_get_image_source(image_id, &dev_handle, &image_spec); 398 if (io_result != 0) { 399 WARN("Failed to obtain reference to image id=%u (%i)\n", 400 image_id, io_result); 401 return io_result; 402 } 403 404 /* Attempt to access the image */ 405 io_result = io_open(dev_handle, image_spec, &image_handle); 406 if (io_result != 0) { 407 WARN("Failed to access image id=%u (%i)\n", 408 image_id, io_result); 409 return io_result; 410 } 411 412 INFO("Loading image id=%u at address %p\n", image_id, 413 (void *) image_base); 414 415 /* Find the size of the image */ 416 io_result = io_size(image_handle, &image_size); 417 if ((io_result != 0) || (image_size == 0)) { 418 WARN("Failed to determine the size of the image id=%u (%i)\n", 419 image_id, io_result); 420 goto exit; 421 } 422 423 /* Check that the memory where the image will be loaded is free */ 424 if (!is_mem_free(mem_layout->free_base, mem_layout->free_size, 425 image_base, image_size)) { 426 WARN("Failed to reserve region [base = %p, size = 0x%zx]\n", 427 (void *) image_base, image_size); 428 dump_load_info(image_base, image_size, mem_layout); 429 io_result = -ENOMEM; 430 goto exit; 431 } 432 433 /* We have enough space so load the image now */ 434 /* TODO: Consider whether to try to recover/retry a partially successful read */ 435 io_result = io_read(image_handle, image_base, image_size, &bytes_read); 436 if ((io_result != 0) || (bytes_read < image_size)) { 437 WARN("Failed to load image id=%u (%i)\n", image_id, io_result); 438 goto exit; 439 } 440 441 image_data->image_base = image_base; 442 image_data->image_size = image_size; 443 444 /* 445 * Update the memory usage info. 446 * This is done after the actual loading so that it is not updated when 447 * the load is unsuccessful. 448 * If the caller does not provide an entry point, bypass the memory 449 * reservation. 450 */ 451 if (entry_point_info != NULL) { 452 reserve_mem(&mem_layout->free_base, &mem_layout->free_size, 453 image_base, image_size); 454 entry_point_info->pc = image_base; 455 } else { 456 INFO("Skip reserving region [base = %p, size = 0x%zx]\n", 457 (void *) image_base, image_size); 458 } 459 460 #if !TRUSTED_BOARD_BOOT 461 /* 462 * File has been successfully loaded. 463 * Flush the image to main memory so that it can be executed later by 464 * any CPU, regardless of cache and MMU state. 465 * When TBB is enabled the image is flushed later, after image 466 * authentication. 467 */ 468 flush_dcache_range(image_base, image_size); 469 #endif /* TRUSTED_BOARD_BOOT */ 470 471 INFO("Image id=%u loaded at address %p, size = 0x%zx\n", image_id, 472 (void *) image_base, image_size); 473 474 exit: 475 io_close(image_handle); 476 /* Ignore improbable/unrecoverable error in 'close' */ 477 478 /* TODO: Consider maintaining open device connection from this bootloader stage */ 479 io_dev_close(dev_handle); 480 /* Ignore improbable/unrecoverable error in 'dev_close' */ 481 482 return io_result; 483 } 484 485 static int load_auth_image_internal(meminfo_t *mem_layout, 486 unsigned int image_id, 487 uintptr_t image_base, 488 image_info_t *image_data, 489 entry_point_info_t *entry_point_info, 490 int is_parent_image) 491 { 492 int rc; 493 494 #if TRUSTED_BOARD_BOOT 495 unsigned int parent_id; 496 497 /* Use recursion to authenticate parent images */ 498 rc = auth_mod_get_parent_id(image_id, &parent_id); 499 if (rc == 0) { 500 rc = load_auth_image_internal(mem_layout, parent_id, image_base, 501 image_data, NULL, 1); 502 if (rc != 0) { 503 return rc; 504 } 505 } 506 #endif /* TRUSTED_BOARD_BOOT */ 507 508 /* Load the image */ 509 rc = load_image(mem_layout, image_id, image_base, image_data, 510 entry_point_info); 511 if (rc != 0) { 512 return rc; 513 } 514 515 #if TRUSTED_BOARD_BOOT 516 /* Authenticate it */ 517 rc = auth_mod_verify_img(image_id, 518 (void *)image_data->image_base, 519 image_data->image_size); 520 if (rc != 0) { 521 /* Authentication error, zero memory and flush it right away. */ 522 zero_normalmem((void *)image_data->image_base, 523 image_data->image_size); 524 flush_dcache_range(image_data->image_base, 525 image_data->image_size); 526 return -EAUTH; 527 } 528 /* 529 * File has been successfully loaded and authenticated. 530 * Flush the image to main memory so that it can be executed later by 531 * any CPU, regardless of cache and MMU state. 532 * Do it only for child images, not for the parents (certificates). 533 */ 534 if (!is_parent_image) { 535 flush_dcache_range(image_data->image_base, 536 image_data->image_size); 537 } 538 #endif /* TRUSTED_BOARD_BOOT */ 539 540 return 0; 541 } 542 543 /******************************************************************************* 544 * Generic function to load and authenticate an image. The image is actually 545 * loaded by calling the 'load_image()' function. Therefore, it returns the 546 * same error codes if the loading operation failed, or -EAUTH if the 547 * authentication failed. In addition, this function uses recursion to 548 * authenticate the parent images up to the root of trust. 549 ******************************************************************************/ 550 int load_auth_image(meminfo_t *mem_layout, 551 unsigned int image_id, 552 uintptr_t image_base, 553 image_info_t *image_data, 554 entry_point_info_t *entry_point_info) 555 { 556 return load_auth_image_internal(mem_layout, image_id, image_base, 557 image_data, entry_point_info, 0); 558 } 559 560 #endif /* LOAD_IMAGE_V2 */ 561 562 /******************************************************************************* 563 * Print the content of an entry_point_info_t structure. 564 ******************************************************************************/ 565 void print_entry_point_info(const entry_point_info_t *ep_info) 566 { 567 INFO("Entry point address = %p\n", (void *)ep_info->pc); 568 INFO("SPSR = 0x%x\n", ep_info->spsr); 569 570 #define PRINT_IMAGE_ARG(n) \ 571 VERBOSE("Argument #" #n " = 0x%llx\n", \ 572 (unsigned long long) ep_info->args.arg##n) 573 574 PRINT_IMAGE_ARG(0); 575 PRINT_IMAGE_ARG(1); 576 PRINT_IMAGE_ARG(2); 577 PRINT_IMAGE_ARG(3); 578 #ifndef AARCH32 579 PRINT_IMAGE_ARG(4); 580 PRINT_IMAGE_ARG(5); 581 PRINT_IMAGE_ARG(6); 582 PRINT_IMAGE_ARG(7); 583 #endif 584 #undef PRINT_IMAGE_ARG 585 } 586