1 /* 2 * Copyright (c) 2022-2025 Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 * 6 * DRTM service 7 * 8 * Authors: 9 * Lucian Paul-Trifu <lucian.paultrifu@gmail.com> 10 * Brian Nezvadovitz <brinez@microsoft.com> 2021-02-01 11 */ 12 13 #include <stdint.h> 14 15 #include <arch.h> 16 #include <arch_helpers.h> 17 #include <common/bl_common.h> 18 #include <common/debug.h> 19 #include <common/runtime_svc.h> 20 #include <drivers/auth/crypto_mod.h> 21 #include "drtm_main.h" 22 #include "drtm_measurements.h" 23 #include "drtm_remediation.h" 24 #include <lib/el3_runtime/context_mgmt.h> 25 #include <lib/psci/psci_lib.h> 26 #include <lib/xlat_tables/xlat_tables_v2.h> 27 #include <plat/common/platform.h> 28 #include <services/drtm_svc.h> 29 #include <services/sdei.h> 30 #include <platform_def.h> 31 32 /* Structure to store DRTM features specific to the platform. */ 33 static drtm_features_t plat_drtm_features; 34 35 /* DRTM-formatted memory map. */ 36 static drtm_memory_region_descriptor_table_t *plat_drtm_mem_map; 37 static const plat_drtm_dma_prot_features_t *plat_dma_prot_feat; 38 static const plat_drtm_tpm_features_t *plat_tpm_feat; 39 40 /* DLME header */ 41 struct_dlme_data_header dlme_data_hdr_init; 42 43 /* Minimum data memory requirement */ 44 uint64_t dlme_data_min_size; 45 46 int drtm_setup(void) 47 { 48 bool rc; 49 50 INFO("DRTM service setup\n"); 51 52 /* Read boot PE ID from MPIDR */ 53 plat_drtm_features.boot_pe_id = read_mpidr_el1() & MPIDR_AFFINITY_MASK; 54 55 rc = drtm_dma_prot_init(); 56 if (rc) { 57 return INTERNAL_ERROR; 58 } 59 60 /* 61 * initialise the platform supported crypto module that will 62 * be used by the DRTM-service to calculate hash of DRTM- 63 * implementation specific components 64 */ 65 crypto_mod_init(); 66 67 /* Build DRTM-compatible address map. */ 68 plat_drtm_mem_map = drtm_build_address_map(); 69 if (plat_drtm_mem_map == NULL) { 70 return INTERNAL_ERROR; 71 } 72 73 /* Get DRTM features from platform hooks. */ 74 plat_tpm_feat = plat_drtm_get_tpm_features(); 75 if (plat_tpm_feat == NULL) { 76 return INTERNAL_ERROR; 77 } 78 79 plat_dma_prot_feat = plat_drtm_get_dma_prot_features(); 80 if (plat_dma_prot_feat == NULL) { 81 return INTERNAL_ERROR; 82 } 83 84 /* 85 * Add up minimum DLME data memory. 86 * 87 * For systems with complete DMA protection there is only one entry in 88 * the protected regions table. 89 */ 90 if (plat_dma_prot_feat->dma_protection_support == 91 ARM_DRTM_DMA_PROT_FEATURES_DMA_SUPPORT_COMPLETE) { 92 dlme_data_min_size = 93 sizeof(drtm_memory_region_descriptor_table_t) + 94 sizeof(drtm_mem_region_t); 95 dlme_data_hdr_init.dlme_prot_regions_size = dlme_data_min_size; 96 } else { 97 /* 98 * TODO set protected regions table size based on platform DMA 99 * protection configuration 100 */ 101 panic(); 102 } 103 104 dlme_data_hdr_init.dlme_addr_map_size = drtm_get_address_map_size(); 105 dlme_data_hdr_init.dlme_tcb_hashes_table_size = 106 plat_drtm_get_tcb_hash_table_size(); 107 dlme_data_hdr_init.dlme_acpi_tables_region_size = 108 plat_drtm_get_acpi_tables_region_size(); 109 dlme_data_hdr_init.dlme_impdef_region_size = 110 plat_drtm_get_imp_def_dlme_region_size(); 111 112 dlme_data_min_size += sizeof(struct_dlme_data_header) + 113 dlme_data_hdr_init.dlme_addr_map_size + 114 ARM_DRTM_MIN_EVENT_LOG_SIZE + 115 dlme_data_hdr_init.dlme_tcb_hashes_table_size + 116 dlme_data_hdr_init.dlme_acpi_tables_region_size + 117 dlme_data_hdr_init.dlme_impdef_region_size; 118 119 /* Fill out platform DRTM features structure */ 120 /* Only support default PCR schema (0x1) in this implementation. */ 121 ARM_DRTM_TPM_FEATURES_SET_PCR_SCHEMA(plat_drtm_features.tpm_features, 122 ARM_DRTM_TPM_FEATURES_PCR_SCHEMA_DEFAULT); 123 ARM_DRTM_TPM_FEATURES_SET_TPM_HASH(plat_drtm_features.tpm_features, 124 plat_tpm_feat->tpm_based_hash_support); 125 ARM_DRTM_TPM_FEATURES_SET_FW_HASH(plat_drtm_features.tpm_features, 126 plat_tpm_feat->firmware_hash_algorithm); 127 ARM_DRTM_MIN_MEM_REQ_SET_MIN_DLME_DATA_SIZE(plat_drtm_features.minimum_memory_requirement, 128 page_align(dlme_data_min_size, UP)/PAGE_SIZE); 129 ARM_DRTM_MIN_MEM_REQ_SET_DCE_SIZE(plat_drtm_features.minimum_memory_requirement, 130 plat_drtm_get_min_size_normal_world_dce()); 131 ARM_DRTM_DMA_PROT_FEATURES_SET_MAX_REGIONS(plat_drtm_features.dma_prot_features, 132 plat_dma_prot_feat->max_num_mem_prot_regions); 133 ARM_DRTM_DMA_PROT_FEATURES_SET_DMA_SUPPORT(plat_drtm_features.dma_prot_features, 134 plat_dma_prot_feat->dma_protection_support); 135 ARM_DRTM_TCB_HASH_FEATURES_SET_MAX_NUM_HASHES(plat_drtm_features.tcb_hash_features, 136 plat_drtm_get_tcb_hash_features()); 137 ARM_DRTM_DLME_IMG_AUTH_SUPPORT(plat_drtm_features.dlme_image_auth_features, 138 plat_drtm_get_dlme_img_auth_features()); 139 140 return 0; 141 } 142 143 static inline void invalidate_icache_all(void) 144 { 145 __asm__ volatile("ic ialluis"); 146 dsb(); 147 isb(); 148 } 149 150 static inline uint64_t drtm_features_tpm(void *ctx) 151 { 152 SMC_RET2(ctx, 1ULL, /* TPM feature is supported */ 153 plat_drtm_features.tpm_features); 154 } 155 156 static inline uint64_t drtm_features_mem_req(void *ctx) 157 { 158 SMC_RET2(ctx, 1ULL, /* memory req Feature is supported */ 159 plat_drtm_features.minimum_memory_requirement); 160 } 161 162 static inline uint64_t drtm_features_boot_pe_id(void *ctx) 163 { 164 SMC_RET2(ctx, 1ULL, /* Boot PE feature is supported */ 165 plat_drtm_features.boot_pe_id); 166 } 167 168 static inline uint64_t drtm_features_dma_prot(void *ctx) 169 { 170 SMC_RET2(ctx, 1ULL, /* DMA protection feature is supported */ 171 plat_drtm_features.dma_prot_features); 172 } 173 174 static inline uint64_t drtm_features_tcb_hashes(void *ctx) 175 { 176 SMC_RET2(ctx, 1ULL, /* TCB hash feature is supported */ 177 plat_drtm_features.tcb_hash_features); 178 } 179 180 static inline uint64_t drtm_features_dlme_img_auth_features(void *ctx) 181 { 182 SMC_RET2(ctx, 1ULL, /* DLME Image auth is supported */ 183 plat_drtm_features.dlme_image_auth_features); 184 } 185 186 static enum drtm_retc drtm_dl_check_caller_el(void *ctx) 187 { 188 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ctx), CTX_SPSR_EL3); 189 uint64_t dl_caller_el; 190 uint64_t dl_caller_aarch; 191 192 dl_caller_el = spsr_el3 >> MODE_EL_SHIFT & MODE_EL_MASK; 193 dl_caller_aarch = spsr_el3 >> MODE_RW_SHIFT & MODE_RW_MASK; 194 195 /* Caller's security state is checked from drtm_smc_handle function */ 196 197 /* Caller can be NS-EL2/EL1 */ 198 if (dl_caller_el == MODE_EL3) { 199 ERROR("DRTM: invalid launch from EL3\n"); 200 return DENIED; 201 } 202 203 if (dl_caller_aarch != MODE_RW_64) { 204 ERROR("DRTM: invalid launch from non-AArch64 execution state\n"); 205 return DENIED; 206 } 207 208 return SUCCESS; 209 } 210 211 static enum drtm_retc drtm_dl_check_cores(void) 212 { 213 bool running_on_single_core; 214 uint64_t this_pe_aff_value = read_mpidr_el1() & MPIDR_AFFINITY_MASK; 215 216 if (this_pe_aff_value != plat_drtm_features.boot_pe_id) { 217 ERROR("DRTM: invalid launch on a non-boot PE\n"); 218 return DENIED; 219 } 220 221 running_on_single_core = psci_is_last_on_cpu_safe(plat_my_core_pos()); 222 if (!running_on_single_core) { 223 ERROR("DRTM: invalid launch due to non-boot PE not being turned off\n"); 224 return SECONDARY_PE_NOT_OFF; 225 } 226 227 return SUCCESS; 228 } 229 230 static enum drtm_retc drtm_dl_prepare_dlme_data(const struct_drtm_dl_args *args) 231 { 232 int rc; 233 uint64_t dlme_data_paddr; 234 size_t dlme_data_max_size; 235 uintptr_t dlme_data_mapping; 236 struct_dlme_data_header *dlme_data_hdr; 237 uint8_t *dlme_data_cursor; 238 size_t dlme_data_mapping_bytes; 239 size_t serialised_bytes_actual; 240 241 dlme_data_paddr = args->dlme_paddr + args->dlme_data_off; 242 dlme_data_max_size = args->dlme_size - args->dlme_data_off; 243 244 /* 245 * The capacity of the given DLME data region is checked when 246 * the other dynamic launch arguments are. 247 */ 248 if (dlme_data_max_size < dlme_data_min_size) { 249 ERROR("%s: assertion failed:" 250 " dlme_data_max_size (%ld) < dlme_data_min_size (%ld)\n", 251 __func__, dlme_data_max_size, dlme_data_min_size); 252 panic(); 253 } 254 255 /* Map the DLME data region as NS memory. */ 256 dlme_data_mapping_bytes = ALIGNED_UP(dlme_data_max_size, DRTM_PAGE_SIZE); 257 rc = mmap_add_dynamic_region_alloc_va(dlme_data_paddr, 258 &dlme_data_mapping, 259 dlme_data_mapping_bytes, 260 MT_RW_DATA | MT_NS | 261 MT_SHAREABILITY_ISH); 262 if (rc != 0) { 263 WARN("DRTM: %s: mmap_add_dynamic_region() failed rc=%d\n", 264 __func__, rc); 265 return INTERNAL_ERROR; 266 } 267 dlme_data_hdr = (struct_dlme_data_header *)dlme_data_mapping; 268 dlme_data_cursor = (uint8_t *)dlme_data_hdr + sizeof(*dlme_data_hdr); 269 270 memcpy(dlme_data_hdr, (const void *)&dlme_data_hdr_init, 271 sizeof(*dlme_data_hdr)); 272 273 /* Set the header version and size. */ 274 dlme_data_hdr->version = 1; 275 dlme_data_hdr->this_hdr_size = sizeof(*dlme_data_hdr); 276 277 /* Prepare DLME protected regions. */ 278 drtm_dma_prot_serialise_table(dlme_data_cursor, 279 &serialised_bytes_actual); 280 assert(serialised_bytes_actual == 281 dlme_data_hdr->dlme_prot_regions_size); 282 dlme_data_cursor += serialised_bytes_actual; 283 284 /* Prepare DLME address map. */ 285 if (plat_drtm_mem_map != NULL) { 286 memcpy(dlme_data_cursor, plat_drtm_mem_map, 287 dlme_data_hdr->dlme_addr_map_size); 288 } else { 289 WARN("DRTM: DLME address map is not in the cache\n"); 290 } 291 dlme_data_cursor += dlme_data_hdr->dlme_addr_map_size; 292 293 /* Prepare DRTM event log for DLME. */ 294 drtm_serialise_event_log(dlme_data_cursor, &serialised_bytes_actual); 295 assert(serialised_bytes_actual <= ARM_DRTM_MIN_EVENT_LOG_SIZE); 296 dlme_data_hdr->dlme_tpm_log_size = serialised_bytes_actual; 297 dlme_data_cursor += serialised_bytes_actual; 298 299 /* 300 * TODO: Prepare the TCB hashes for DLME, currently its size 301 * 0 302 */ 303 dlme_data_cursor += dlme_data_hdr->dlme_tcb_hashes_table_size; 304 305 /* Implementation-specific region size is unused. */ 306 dlme_data_cursor += dlme_data_hdr->dlme_impdef_region_size; 307 308 /* 309 * Prepare DLME data size, includes all data region referenced above 310 * alongwith the DLME data header 311 */ 312 dlme_data_hdr->dlme_data_size = dlme_data_cursor - (uint8_t *)dlme_data_hdr; 313 314 /* Unmap the DLME data region. */ 315 rc = mmap_remove_dynamic_region(dlme_data_mapping, dlme_data_mapping_bytes); 316 if (rc != 0) { 317 ERROR("%s(): mmap_remove_dynamic_region() failed" 318 " unexpectedly rc=%d\n", __func__, rc); 319 panic(); 320 } 321 322 return SUCCESS; 323 } 324 325 /* Function to check if the value is valid for each bit field */ 326 static int drtm_dl_check_features_sanity(uint32_t val) 327 { 328 /** 329 * Ensure that if DLME Authorities Schema (Bits [2:1]) is set, then 330 * DLME image authentication (Bit[6]) must also be set 331 */ 332 if ((EXTRACT(DRTM_LAUNCH_FEAT_PCR_USAGE_SCHEMA, val) == DLME_AUTH_SCHEMA) && 333 (EXTRACT(DRTM_LAUNCH_FEAT_DLME_IMG_AUTH, val) != DLME_IMG_AUTH)) { 334 return INVALID_PARAMETERS; 335 } 336 337 /** 338 * Check if Bits [5:3] (Memory protection type) matches with platform's 339 * memory protection type 340 */ 341 if (EXTRACT(DRTM_LAUNCH_FEAT_MEM_PROTECTION_TYPE, val) != 342 __builtin_ctz(plat_dma_prot_feat->dma_protection_support)) { 343 return INVALID_PARAMETERS; 344 } 345 346 /** 347 * Check if Bits [0] (Type of hashing) matches with platform's 348 * supported hash type. 349 */ 350 if (EXTRACT(DRTM_LAUNCH_FEAT_HASHING_TYPE, val) != 351 plat_tpm_feat->tpm_based_hash_support) { 352 return INVALID_PARAMETERS; 353 } 354 355 return 0; 356 } 357 358 /* 359 * Note: accesses to the dynamic launch args, and to the DLME data are 360 * little-endian as required, thanks to TF-A BL31 init requirements. 361 */ 362 static enum drtm_retc drtm_dl_check_args(uint64_t x1, 363 struct_drtm_dl_args *a_out) 364 { 365 uint64_t dlme_start, dlme_end; 366 uint64_t dlme_img_start, dlme_img_ep, dlme_img_end; 367 uint64_t dlme_data_start, dlme_data_end; 368 uintptr_t va_mapping; 369 size_t va_mapping_size; 370 struct_drtm_dl_args *a; 371 struct_drtm_dl_args args_buf; 372 int rc; 373 374 if (x1 % DRTM_PAGE_SIZE != 0) { 375 ERROR("DRTM: parameters structure is not " 376 DRTM_PAGE_SIZE_STR "-aligned\n"); 377 return INVALID_PARAMETERS; 378 } 379 380 va_mapping_size = ALIGNED_UP(sizeof(struct_drtm_dl_args), DRTM_PAGE_SIZE); 381 382 /* check DRTM parameters are within NS address region */ 383 rc = plat_drtm_validate_ns_region(x1, va_mapping_size); 384 if (rc != 0) { 385 ERROR("DRTM: parameters lies within secure memory\n"); 386 return INVALID_PARAMETERS; 387 } 388 389 rc = mmap_add_dynamic_region_alloc_va(x1, &va_mapping, va_mapping_size, 390 MT_MEMORY | MT_NS | MT_RO | 391 MT_SHAREABILITY_ISH); 392 if (rc != 0) { 393 WARN("DRTM: %s: mmap_add_dynamic_region() failed rc=%d\n", 394 __func__, rc); 395 return INTERNAL_ERROR; 396 } 397 a = (struct_drtm_dl_args *)va_mapping; 398 399 /* Sanitize cache of data passed in args by the DCE Preamble. */ 400 flush_dcache_range(va_mapping, va_mapping_size); 401 402 args_buf = *a; 403 404 rc = mmap_remove_dynamic_region(va_mapping, va_mapping_size); 405 if (rc != 0) { 406 ERROR("%s(): mmap_remove_dynamic_region() failed unexpectedly" 407 " rc=%d\n", __func__, rc); 408 panic(); 409 } 410 a = &args_buf; 411 412 if (!((a->version >= ARM_DRTM_PARAMS_MIN_VERSION) && 413 (a->version <= ARM_DRTM_PARAMS_MAX_VERSION))) { 414 ERROR("DRTM: parameters structure version %u is unsupported\n", 415 a->version); 416 return NOT_SUPPORTED; 417 } 418 419 rc = drtm_dl_check_features_sanity(a->features); 420 if (rc != 0) { 421 ERROR("%s(): drtm_dl_check_features_sanity() failed.\n" 422 " rc=%d\n", __func__, rc); 423 return rc; 424 } 425 426 if (!(a->dlme_img_off < a->dlme_size && 427 a->dlme_data_off < a->dlme_size)) { 428 ERROR("DRTM: argument offset is outside of the DLME region\n"); 429 return INVALID_PARAMETERS; 430 } 431 dlme_start = a->dlme_paddr; 432 dlme_end = a->dlme_paddr + a->dlme_size; 433 dlme_img_start = a->dlme_paddr + a->dlme_img_off; 434 dlme_img_ep = dlme_img_start + a->dlme_img_ep_off; 435 dlme_img_end = dlme_img_start + a->dlme_img_size; 436 dlme_data_start = a->dlme_paddr + a->dlme_data_off; 437 dlme_data_end = dlme_end; 438 439 /* Check the DLME regions arguments. */ 440 if ((dlme_start % DRTM_PAGE_SIZE) != 0) { 441 ERROR("DRTM: argument DLME region is not " 442 DRTM_PAGE_SIZE_STR "-aligned\n"); 443 return INVALID_PARAMETERS; 444 } 445 446 if (!(dlme_start < dlme_end && 447 dlme_start <= dlme_img_start && dlme_img_start < dlme_img_end && 448 dlme_start <= dlme_data_start && dlme_data_start < dlme_data_end)) { 449 ERROR("DRTM: argument DLME region is discontiguous\n"); 450 return INVALID_PARAMETERS; 451 } 452 453 if (dlme_img_start < dlme_data_end && dlme_data_start < dlme_img_end) { 454 ERROR("DRTM: argument DLME regions overlap\n"); 455 return INVALID_PARAMETERS; 456 } 457 458 /* Check the DLME image region arguments. */ 459 if ((dlme_img_start % DRTM_PAGE_SIZE) != 0) { 460 ERROR("DRTM: argument DLME image region is not " 461 DRTM_PAGE_SIZE_STR "-aligned\n"); 462 return INVALID_PARAMETERS; 463 } 464 465 if (!(dlme_img_start <= dlme_img_ep && dlme_img_ep < dlme_img_end)) { 466 ERROR("DRTM: DLME entry point is outside of the DLME image region\n"); 467 return INVALID_PARAMETERS; 468 } 469 470 if ((dlme_img_ep % 4) != 0) { 471 ERROR("DRTM: DLME image entry point is not 4-byte-aligned\n"); 472 return INVALID_PARAMETERS; 473 } 474 475 /* Check the DLME data region arguments. */ 476 if ((dlme_data_start % DRTM_PAGE_SIZE) != 0) { 477 ERROR("DRTM: argument DLME data region is not " 478 DRTM_PAGE_SIZE_STR "-aligned\n"); 479 return INVALID_PARAMETERS; 480 } 481 482 if (dlme_data_end - dlme_data_start < dlme_data_min_size) { 483 ERROR("DRTM: argument DLME data region is short of %lu bytes\n", 484 dlme_data_min_size - (size_t)(dlme_data_end - dlme_data_start)); 485 return INVALID_PARAMETERS; 486 } 487 488 /* check DLME region (paddr + size) is within a NS address region */ 489 rc = plat_drtm_validate_ns_region(dlme_start, (size_t)a->dlme_size); 490 if (rc != 0) { 491 ERROR("DRTM: DLME region lies within secure memory\n"); 492 return INVALID_PARAMETERS; 493 } 494 495 /* Check the Normal World DCE region arguments. */ 496 if (a->dce_nwd_paddr != 0) { 497 uint32_t dce_nwd_start = a->dce_nwd_paddr; 498 uint32_t dce_nwd_end = dce_nwd_start + a->dce_nwd_size; 499 500 if (!(dce_nwd_start < dce_nwd_end)) { 501 ERROR("DRTM: argument Normal World DCE region is dicontiguous\n"); 502 return INVALID_PARAMETERS; 503 } 504 505 if (dce_nwd_start < dlme_end && dlme_start < dce_nwd_end) { 506 ERROR("DRTM: argument Normal World DCE regions overlap\n"); 507 return INVALID_PARAMETERS; 508 } 509 } 510 511 /* 512 * Map and sanitize the cache of data range passed by DCE Preamble. This 513 * is required to avoid / defend against racing with cache evictions 514 */ 515 va_mapping_size = ALIGNED_UP((dlme_end - dlme_start), DRTM_PAGE_SIZE); 516 rc = mmap_add_dynamic_region_alloc_va(dlme_start, &va_mapping, va_mapping_size, 517 MT_MEMORY | MT_NS | MT_RO | 518 MT_SHAREABILITY_ISH); 519 if (rc != 0) { 520 ERROR("DRTM: %s: mmap_add_dynamic_region_alloc_va() failed rc=%d\n", 521 __func__, rc); 522 return INTERNAL_ERROR; 523 } 524 flush_dcache_range(va_mapping, va_mapping_size); 525 526 rc = mmap_remove_dynamic_region(va_mapping, va_mapping_size); 527 if (rc) { 528 ERROR("%s(): mmap_remove_dynamic_region() failed unexpectedly" 529 " rc=%d\n", __func__, rc); 530 panic(); 531 } 532 533 *a_out = *a; 534 return SUCCESS; 535 } 536 537 static void drtm_dl_reset_dlme_el_state(enum drtm_dlme_el dlme_el) 538 { 539 uint64_t sctlr; 540 541 switch (dlme_el) { 542 case DLME_AT_EL1: 543 sctlr = read_sctlr_el1(); 544 break; 545 546 case DLME_AT_EL2: 547 sctlr = read_sctlr_el2(); 548 break; 549 550 default: /* Not reached */ 551 ERROR("%s(): dlme_el has the unexpected value %d\n", 552 __func__, dlme_el); 553 panic(); 554 } 555 556 sctlr &= ~(/* Disable DLME's EL MMU, since the existing page-tables are untrusted. */ 557 SCTLR_M_BIT 558 | SCTLR_EE_BIT /* Little-endian data accesses. */ 559 | SCTLR_C_BIT /* disable data caching */ 560 | SCTLR_I_BIT /* disable instruction caching */ 561 ); 562 563 switch (dlme_el) { 564 case DLME_AT_EL1: 565 write_sctlr_el1(sctlr); 566 break; 567 568 case DLME_AT_EL2: 569 write_sctlr_el2(sctlr); 570 break; 571 } 572 } 573 574 static void drtm_dl_reset_dlme_context(enum drtm_dlme_el dlme_el) 575 { 576 void *ns_ctx = cm_get_context(NON_SECURE); 577 gp_regs_t *gpregs = get_gpregs_ctx(ns_ctx); 578 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ns_ctx), CTX_SPSR_EL3); 579 580 /* Reset all gpregs, including SP_EL0. */ 581 memset(gpregs, 0, sizeof(*gpregs)); 582 583 /* Reset SP_ELx. */ 584 switch (dlme_el) { 585 case DLME_AT_EL1: 586 write_sp_el1(0); 587 break; 588 589 case DLME_AT_EL2: 590 write_sp_el2(0); 591 break; 592 } 593 594 /* 595 * DLME's async exceptions are masked to avoid a NWd attacker's timed 596 * interference with any state we established trust in or measured. 597 */ 598 spsr_el3 |= SPSR_DAIF_MASK << SPSR_DAIF_SHIFT; 599 600 write_ctx_reg(get_el3state_ctx(ns_ctx), CTX_SPSR_EL3, spsr_el3); 601 } 602 603 static void drtm_dl_prepare_eret_to_dlme(const struct_drtm_dl_args *args, enum drtm_dlme_el dlme_el) 604 { 605 void *ctx = cm_get_context(NON_SECURE); 606 uint64_t dlme_ep = DL_ARGS_GET_DLME_ENTRY_POINT(args); 607 uint64_t spsr_el3 = read_ctx_reg(get_el3state_ctx(ctx), CTX_SPSR_EL3); 608 609 /* Next ERET is to the DLME's EL. */ 610 spsr_el3 &= ~(MODE_EL_MASK << MODE_EL_SHIFT); 611 switch (dlme_el) { 612 case DLME_AT_EL1: 613 spsr_el3 |= MODE_EL1 << MODE_EL_SHIFT; 614 break; 615 616 case DLME_AT_EL2: 617 spsr_el3 |= MODE_EL2 << MODE_EL_SHIFT; 618 break; 619 } 620 621 /* Next ERET is to the DLME entry point. */ 622 cm_set_elr_spsr_el3(NON_SECURE, dlme_ep, spsr_el3); 623 } 624 625 static uint64_t drtm_dynamic_launch(uint64_t x1, void *handle) 626 { 627 enum drtm_retc ret = SUCCESS; 628 enum drtm_retc dma_prot_ret; 629 struct_drtm_dl_args args; 630 /* DLME should be highest NS exception level */ 631 enum drtm_dlme_el dlme_el = (el_implemented(2) != EL_IMPL_NONE) ? MODE_EL2 : MODE_EL1; 632 633 /* Ensure that only boot PE is powered on */ 634 ret = drtm_dl_check_cores(); 635 if (ret != SUCCESS) { 636 SMC_RET1(handle, ret); 637 } 638 639 /* 640 * Ensure that execution state is AArch64 and the caller 641 * is highest non-secure exception level 642 */ 643 ret = drtm_dl_check_caller_el(handle); 644 if (ret != SUCCESS) { 645 SMC_RET1(handle, ret); 646 } 647 648 ret = drtm_dl_check_args(x1, &args); 649 if (ret != SUCCESS) { 650 SMC_RET1(handle, ret); 651 } 652 653 /* Ensure that there are no SDEI event registered */ 654 #if SDEI_SUPPORT 655 if (sdei_get_registered_event_count() != 0) { 656 SMC_RET1(handle, DENIED); 657 } 658 #endif /* SDEI_SUPPORT */ 659 660 /* 661 * Engage the DMA protections. The launch cannot proceed without the DMA 662 * protections due to potential TOC/TOU vulnerabilities w.r.t. the DLME 663 * region (and to the NWd DCE region). 664 */ 665 ret = drtm_dma_prot_engage(&args.dma_prot_args, 666 DL_ARGS_GET_DMA_PROT_TYPE(&args)); 667 if (ret != SUCCESS) { 668 SMC_RET1(handle, ret); 669 } 670 671 /* 672 * The DMA protection is now engaged. Note that any failure mode that 673 * returns an error to the DRTM-launch caller must now disengage DMA 674 * protections before returning to the caller. 675 */ 676 677 ret = drtm_take_measurements(&args); 678 if (ret != SUCCESS) { 679 goto err_undo_dma_prot; 680 } 681 682 ret = drtm_dl_prepare_dlme_data(&args); 683 if (ret != SUCCESS) { 684 goto err_undo_dma_prot; 685 } 686 687 /* 688 * Note that, at the time of writing, the DRTM spec allows a successful 689 * launch from NS-EL1 to return to a DLME in NS-EL2. The practical risk 690 * of a privilege escalation, e.g. due to a compromised hypervisor, is 691 * considered small enough not to warrant the specification of additional 692 * DRTM conduits that would be necessary to maintain OSs' abstraction from 693 * the presence of EL2 were the dynamic launch only be allowed from the 694 * highest NS EL. 695 */ 696 697 dlme_el = (el_implemented(2) != EL_IMPL_NONE) ? MODE_EL2 : MODE_EL1; 698 699 drtm_dl_reset_dlme_el_state(dlme_el); 700 drtm_dl_reset_dlme_context(dlme_el); 701 702 /* 703 * Setting the Generic Timer frequency is required before launching 704 * DLME and is already done for running CPU during PSCI setup. 705 */ 706 drtm_dl_prepare_eret_to_dlme(&args, dlme_el); 707 708 /* 709 * As per DRTM 1.0 spec table #30 invalidate the instruction cache 710 * before jumping to the DLME. This is required to defend against 711 * potentially-malicious cache contents. 712 */ 713 invalidate_icache_all(); 714 715 /* Return the DLME region's address in x0, and the DLME data offset in x1.*/ 716 SMC_RET2(handle, args.dlme_paddr, args.dlme_data_off); 717 718 err_undo_dma_prot: 719 dma_prot_ret = drtm_dma_prot_disengage(); 720 if (dma_prot_ret != SUCCESS) { 721 ERROR("%s(): drtm_dma_prot_disengage() failed unexpectedly" 722 " rc=%d\n", __func__, ret); 723 panic(); 724 } 725 726 SMC_RET1(handle, ret); 727 } 728 729 uint64_t drtm_smc_handler(uint32_t smc_fid, 730 uint64_t x1, 731 uint64_t x2, 732 uint64_t x3, 733 uint64_t x4, 734 void *cookie, 735 void *handle, 736 uint64_t flags) 737 { 738 /* Check that the SMC call is from the Normal World. */ 739 if (!is_caller_non_secure(flags)) { 740 SMC_RET1(handle, NOT_SUPPORTED); 741 } 742 743 switch (smc_fid) { 744 case ARM_DRTM_SVC_VERSION: 745 INFO("DRTM service handler: version\n"); 746 /* Return the version of current implementation */ 747 SMC_RET1(handle, ARM_DRTM_VERSION); 748 break; /* not reached */ 749 750 case ARM_DRTM_SVC_FEATURES: 751 if (((x1 >> ARM_DRTM_FUNC_SHIFT) & ARM_DRTM_FUNC_MASK) == 752 ARM_DRTM_FUNC_ID) { 753 /* Dispatch function-based queries. */ 754 switch (x1 & FUNCID_MASK) { 755 case ARM_DRTM_SVC_VERSION: 756 SMC_RET1(handle, SUCCESS); 757 break; /* not reached */ 758 759 case ARM_DRTM_SVC_FEATURES: 760 SMC_RET1(handle, SUCCESS); 761 break; /* not reached */ 762 763 case ARM_DRTM_SVC_UNPROTECT_MEM: 764 SMC_RET1(handle, SUCCESS); 765 break; /* not reached */ 766 767 case ARM_DRTM_SVC_DYNAMIC_LAUNCH: 768 SMC_RET1(handle, SUCCESS); 769 break; /* not reached */ 770 771 case ARM_DRTM_SVC_CLOSE_LOCALITY: 772 WARN("ARM_DRTM_SVC_CLOSE_LOCALITY feature %s", 773 "is not supported\n"); 774 SMC_RET1(handle, NOT_SUPPORTED); 775 break; /* not reached */ 776 777 case ARM_DRTM_SVC_GET_ERROR: 778 SMC_RET1(handle, SUCCESS); 779 break; /* not reached */ 780 781 case ARM_DRTM_SVC_SET_ERROR: 782 SMC_RET1(handle, SUCCESS); 783 break; /* not reached */ 784 785 case ARM_DRTM_SVC_SET_TCB_HASH: 786 WARN("ARM_DRTM_SVC_TCB_HASH feature %s", 787 "is not supported\n"); 788 SMC_RET1(handle, NOT_SUPPORTED); 789 break; /* not reached */ 790 791 case ARM_DRTM_SVC_LOCK_TCB_HASH: 792 WARN("ARM_DRTM_SVC_LOCK_TCB_HASH feature %s", 793 "is not supported\n"); 794 SMC_RET1(handle, NOT_SUPPORTED); 795 break; /* not reached */ 796 797 default: 798 ERROR("Unknown DRTM service function\n"); 799 SMC_RET1(handle, NOT_SUPPORTED); 800 break; /* not reached */ 801 } 802 } else { 803 /* Dispatch feature-based queries. */ 804 switch (x1 & ARM_DRTM_FEAT_ID_MASK) { 805 case ARM_DRTM_FEATURES_TPM: 806 INFO("++ DRTM service handler: TPM features\n"); 807 return drtm_features_tpm(handle); 808 break; /* not reached */ 809 810 case ARM_DRTM_FEATURES_MEM_REQ: 811 INFO("++ DRTM service handler: Min. mem." 812 " requirement features\n"); 813 return drtm_features_mem_req(handle); 814 break; /* not reached */ 815 816 case ARM_DRTM_FEATURES_DMA_PROT: 817 INFO("++ DRTM service handler: " 818 "DMA protection features\n"); 819 return drtm_features_dma_prot(handle); 820 break; /* not reached */ 821 822 case ARM_DRTM_FEATURES_BOOT_PE_ID: 823 INFO("++ DRTM service handler: " 824 "Boot PE ID features\n"); 825 return drtm_features_boot_pe_id(handle); 826 break; /* not reached */ 827 828 case ARM_DRTM_FEATURES_TCB_HASHES: 829 INFO("++ DRTM service handler: " 830 "TCB-hashes features\n"); 831 return drtm_features_tcb_hashes(handle); 832 break; /* not reached */ 833 834 case ARM_DRTM_FEATURES_DLME_IMG_AUTH: 835 INFO("++ DRTM service handler: " 836 "DLME Image authentication features\n"); 837 return drtm_features_dlme_img_auth_features(handle); 838 break; /* not reached */ 839 840 default: 841 ERROR("Unknown ARM DRTM service feature\n"); 842 SMC_RET1(handle, NOT_SUPPORTED); 843 break; /* not reached */ 844 } 845 } 846 847 case ARM_DRTM_SVC_UNPROTECT_MEM: 848 INFO("DRTM service handler: unprotect mem\n"); 849 return drtm_unprotect_mem(handle); 850 break; /* not reached */ 851 852 case ARM_DRTM_SVC_DYNAMIC_LAUNCH: 853 INFO("DRTM service handler: dynamic launch\n"); 854 return drtm_dynamic_launch(x1, handle); 855 break; /* not reached */ 856 857 case ARM_DRTM_SVC_CLOSE_LOCALITY: 858 WARN("DRTM service handler: close locality %s\n", 859 "is not supported"); 860 SMC_RET1(handle, NOT_SUPPORTED); 861 break; /* not reached */ 862 863 case ARM_DRTM_SVC_GET_ERROR: 864 INFO("DRTM service handler: get error\n"); 865 return drtm_get_error(handle); 866 break; /* not reached */ 867 868 case ARM_DRTM_SVC_SET_ERROR: 869 INFO("DRTM service handler: set error\n"); 870 return drtm_set_error(x1, handle); 871 break; /* not reached */ 872 873 case ARM_DRTM_SVC_SET_TCB_HASH: 874 WARN("DRTM service handler: set TCB hash %s\n", 875 "is not supported"); 876 SMC_RET1(handle, NOT_SUPPORTED); 877 break; /* not reached */ 878 879 case ARM_DRTM_SVC_LOCK_TCB_HASH: 880 WARN("DRTM service handler: lock TCB hash %s\n", 881 "is not supported"); 882 SMC_RET1(handle, NOT_SUPPORTED); 883 break; /* not reached */ 884 885 default: 886 ERROR("Unknown DRTM service function: 0x%x\n", smc_fid); 887 SMC_RET1(handle, SMC_UNK); 888 break; /* not reached */ 889 } 890 891 /* not reached */ 892 SMC_RET1(handle, SMC_UNK); 893 } 894