1 /* 2 * Copyright (c) 2021-2023, Arm Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <inttypes.h> 10 #include <stdint.h> 11 #include <string.h> 12 13 #include <arch_helpers.h> 14 #include <arch_features.h> 15 #include <bl31/bl31.h> 16 #include <common/debug.h> 17 #include <common/runtime_svc.h> 18 #include <context.h> 19 #include <lib/el3_runtime/context_mgmt.h> 20 #include <lib/el3_runtime/pubsub.h> 21 #include <lib/extensions/pmuv3.h> 22 #include <lib/extensions/sys_reg_trace.h> 23 #include <lib/gpt_rme/gpt_rme.h> 24 25 #include <lib/spinlock.h> 26 #include <lib/utils.h> 27 #include <lib/xlat_tables/xlat_tables_v2.h> 28 #include <plat/common/common_def.h> 29 #include <plat/common/platform.h> 30 #include <platform_def.h> 31 #include <services/rmmd_svc.h> 32 #include <smccc_helpers.h> 33 #include <lib/extensions/sve.h> 34 #include "rmmd_initial_context.h" 35 #include "rmmd_private.h" 36 37 /******************************************************************************* 38 * RMM boot failure flag 39 ******************************************************************************/ 40 static bool rmm_boot_failed; 41 42 /******************************************************************************* 43 * RMM context information. 44 ******************************************************************************/ 45 rmmd_rmm_context_t rmm_context[PLATFORM_CORE_COUNT]; 46 47 /******************************************************************************* 48 * RMM entry point information. Discovered on the primary core and reused 49 * on secondary cores. 50 ******************************************************************************/ 51 static entry_point_info_t *rmm_ep_info; 52 53 /******************************************************************************* 54 * Static function declaration. 55 ******************************************************************************/ 56 static int32_t rmm_init(void); 57 58 /******************************************************************************* 59 * This function takes an RMM context pointer and performs a synchronous entry 60 * into it. 61 ******************************************************************************/ 62 uint64_t rmmd_rmm_sync_entry(rmmd_rmm_context_t *rmm_ctx) 63 { 64 uint64_t rc; 65 66 assert(rmm_ctx != NULL); 67 68 cm_set_context(&(rmm_ctx->cpu_ctx), REALM); 69 70 /* Restore the realm context assigned above */ 71 cm_el1_sysregs_context_restore(REALM); 72 cm_el2_sysregs_context_restore(REALM); 73 cm_set_next_eret_context(REALM); 74 75 /* Enter RMM */ 76 rc = rmmd_rmm_enter(&rmm_ctx->c_rt_ctx); 77 78 /* 79 * Save realm context. EL1 and EL2 Non-secure 80 * contexts will be restored before exiting to 81 * Non-secure world, therefore there is no need 82 * to clear EL1 and EL2 context registers. 83 */ 84 cm_el1_sysregs_context_save(REALM); 85 cm_el2_sysregs_context_save(REALM); 86 87 return rc; 88 } 89 90 /******************************************************************************* 91 * This function returns to the place where rmmd_rmm_sync_entry() was 92 * called originally. 93 ******************************************************************************/ 94 __dead2 void rmmd_rmm_sync_exit(uint64_t rc) 95 { 96 rmmd_rmm_context_t *ctx = &rmm_context[plat_my_core_pos()]; 97 98 /* Get context of the RMM in use by this CPU. */ 99 assert(cm_get_context(REALM) == &(ctx->cpu_ctx)); 100 101 /* 102 * The RMMD must have initiated the original request through a 103 * synchronous entry into RMM. Jump back to the original C runtime 104 * context with the value of rc in x0; 105 */ 106 rmmd_rmm_exit(ctx->c_rt_ctx, rc); 107 108 panic(); 109 } 110 111 static void rmm_el2_context_init(el2_sysregs_t *regs) 112 { 113 regs->ctx_regs[CTX_SPSR_EL2 >> 3] = REALM_SPSR_EL2; 114 regs->ctx_regs[CTX_SCTLR_EL2 >> 3] = SCTLR_EL2_RES1; 115 } 116 117 /******************************************************************************* 118 * Enable architecture extensions on first entry to Realm world. 119 ******************************************************************************/ 120 static void manage_extensions_realm(cpu_context_t *ctx) 121 { 122 if (is_feat_sve_supported()) { 123 /* 124 * Enable SVE and FPU in realm context when it is enabled for NS. 125 * Realm manager must ensure that the SVE and FPU register 126 * contexts are properly managed. 127 */ 128 sve_enable(ctx); 129 } 130 131 /* NS can access this but Realm shouldn't */ 132 if (is_feat_sys_reg_trace_supported()) { 133 sys_reg_trace_disable(ctx); 134 } 135 136 pmuv3_enable(ctx); 137 } 138 139 /******************************************************************************* 140 * Jump to the RMM for the first time. 141 ******************************************************************************/ 142 static int32_t rmm_init(void) 143 { 144 long rc; 145 rmmd_rmm_context_t *ctx = &rmm_context[plat_my_core_pos()]; 146 147 INFO("RMM init start.\n"); 148 149 /* Enable architecture extensions */ 150 manage_extensions_realm(&ctx->cpu_ctx); 151 152 /* Initialize RMM EL2 context. */ 153 rmm_el2_context_init(&ctx->cpu_ctx.el2_sysregs_ctx); 154 155 rc = rmmd_rmm_sync_entry(ctx); 156 if (rc != E_RMM_BOOT_SUCCESS) { 157 ERROR("RMM init failed: %ld\n", rc); 158 /* Mark the boot as failed for all the CPUs */ 159 rmm_boot_failed = true; 160 return 0; 161 } 162 163 INFO("RMM init end.\n"); 164 165 return 1; 166 } 167 168 /******************************************************************************* 169 * Load and read RMM manifest, setup RMM. 170 ******************************************************************************/ 171 int rmmd_setup(void) 172 { 173 size_t shared_buf_size __unused; 174 uintptr_t shared_buf_base; 175 uint32_t ep_attr; 176 unsigned int linear_id = plat_my_core_pos(); 177 rmmd_rmm_context_t *rmm_ctx = &rmm_context[linear_id]; 178 struct rmm_manifest *manifest; 179 int rc; 180 181 /* Make sure RME is supported. */ 182 assert(get_armv9_2_feat_rme_support() != 0U); 183 184 rmm_ep_info = bl31_plat_get_next_image_ep_info(REALM); 185 if (rmm_ep_info == NULL) { 186 WARN("No RMM image provided by BL2 boot loader, Booting " 187 "device without RMM initialization. SMCs destined for " 188 "RMM will return SMC_UNK\n"); 189 return -ENOENT; 190 } 191 192 /* Under no circumstances will this parameter be 0 */ 193 assert(rmm_ep_info->pc == RMM_BASE); 194 195 /* Initialise an entrypoint to set up the CPU context */ 196 ep_attr = EP_REALM; 197 if ((read_sctlr_el3() & SCTLR_EE_BIT) != 0U) { 198 ep_attr |= EP_EE_BIG; 199 } 200 201 SET_PARAM_HEAD(rmm_ep_info, PARAM_EP, VERSION_1, ep_attr); 202 rmm_ep_info->spsr = SPSR_64(MODE_EL2, 203 MODE_SP_ELX, 204 DISABLE_ALL_EXCEPTIONS); 205 206 shared_buf_size = 207 plat_rmmd_get_el3_rmm_shared_mem(&shared_buf_base); 208 209 assert((shared_buf_size == SZ_4K) && 210 ((void *)shared_buf_base != NULL)); 211 212 /* Load the boot manifest at the beginning of the shared area */ 213 manifest = (struct rmm_manifest *)shared_buf_base; 214 rc = plat_rmmd_load_manifest(manifest); 215 if (rc != 0) { 216 ERROR("Error loading RMM Boot Manifest (%i)\n", rc); 217 return rc; 218 } 219 flush_dcache_range((uintptr_t)shared_buf_base, shared_buf_size); 220 221 /* 222 * Prepare coldboot arguments for RMM: 223 * arg0: This CPUID (primary processor). 224 * arg1: Version for this Boot Interface. 225 * arg2: PLATFORM_CORE_COUNT. 226 * arg3: Base address for the EL3 <-> RMM shared area. The boot 227 * manifest will be stored at the beginning of this area. 228 */ 229 rmm_ep_info->args.arg0 = linear_id; 230 rmm_ep_info->args.arg1 = RMM_EL3_INTERFACE_VERSION; 231 rmm_ep_info->args.arg2 = PLATFORM_CORE_COUNT; 232 rmm_ep_info->args.arg3 = shared_buf_base; 233 234 /* Initialise RMM context with this entry point information */ 235 cm_setup_context(&rmm_ctx->cpu_ctx, rmm_ep_info); 236 237 INFO("RMM setup done.\n"); 238 239 /* Register init function for deferred init. */ 240 bl31_register_rmm_init(&rmm_init); 241 242 return 0; 243 } 244 245 /******************************************************************************* 246 * Forward SMC to the other security state 247 ******************************************************************************/ 248 static uint64_t rmmd_smc_forward(uint32_t src_sec_state, 249 uint32_t dst_sec_state, uint64_t x0, 250 uint64_t x1, uint64_t x2, uint64_t x3, 251 uint64_t x4, void *handle) 252 { 253 cpu_context_t *ctx = cm_get_context(dst_sec_state); 254 255 /* Save incoming security state */ 256 cm_el1_sysregs_context_save(src_sec_state); 257 cm_el2_sysregs_context_save(src_sec_state); 258 259 /* Restore outgoing security state */ 260 cm_el1_sysregs_context_restore(dst_sec_state); 261 cm_el2_sysregs_context_restore(dst_sec_state); 262 cm_set_next_eret_context(dst_sec_state); 263 264 /* 265 * As per SMCCCv1.2, we need to preserve x4 to x7 unless 266 * being used as return args. Hence we differentiate the 267 * onward and backward path. Support upto 8 args in the 268 * onward path and 4 args in return path. 269 * Register x4 will be preserved by RMM in case it is not 270 * used in return path. 271 */ 272 if (src_sec_state == NON_SECURE) { 273 SMC_RET8(ctx, x0, x1, x2, x3, x4, 274 SMC_GET_GP(handle, CTX_GPREG_X5), 275 SMC_GET_GP(handle, CTX_GPREG_X6), 276 SMC_GET_GP(handle, CTX_GPREG_X7)); 277 } 278 279 SMC_RET5(ctx, x0, x1, x2, x3, x4); 280 } 281 282 /******************************************************************************* 283 * This function handles all SMCs in the range reserved for RMI. Each call is 284 * either forwarded to the other security state or handled by the RMM dispatcher 285 ******************************************************************************/ 286 uint64_t rmmd_rmi_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2, 287 uint64_t x3, uint64_t x4, void *cookie, 288 void *handle, uint64_t flags) 289 { 290 uint32_t src_sec_state; 291 292 /* If RMM failed to boot, treat any RMI SMC as unknown */ 293 if (rmm_boot_failed) { 294 WARN("RMMD: Failed to boot up RMM. Ignoring RMI call\n"); 295 SMC_RET1(handle, SMC_UNK); 296 } 297 298 /* Determine which security state this SMC originated from */ 299 src_sec_state = caller_sec_state(flags); 300 301 /* RMI must not be invoked by the Secure world */ 302 if (src_sec_state == SMC_FROM_SECURE) { 303 WARN("RMMD: RMI invoked by secure world.\n"); 304 SMC_RET1(handle, SMC_UNK); 305 } 306 307 /* 308 * Forward an RMI call from the Normal world to the Realm world as it 309 * is. 310 */ 311 if (src_sec_state == SMC_FROM_NON_SECURE) { 312 VERBOSE("RMMD: RMI call from non-secure world.\n"); 313 return rmmd_smc_forward(NON_SECURE, REALM, smc_fid, 314 x1, x2, x3, x4, handle); 315 } 316 317 if (src_sec_state != SMC_FROM_REALM) { 318 SMC_RET1(handle, SMC_UNK); 319 } 320 321 switch (smc_fid) { 322 case RMM_RMI_REQ_COMPLETE: { 323 uint64_t x5 = SMC_GET_GP(handle, CTX_GPREG_X5); 324 325 return rmmd_smc_forward(REALM, NON_SECURE, x1, 326 x2, x3, x4, x5, handle); 327 } 328 default: 329 WARN("RMMD: Unsupported RMM call 0x%08x\n", smc_fid); 330 SMC_RET1(handle, SMC_UNK); 331 } 332 } 333 334 /******************************************************************************* 335 * This cpu has been turned on. Enter RMM to initialise R-EL2. Entry into RMM 336 * is done after initialising minimal architectural state that guarantees safe 337 * execution. 338 ******************************************************************************/ 339 static void *rmmd_cpu_on_finish_handler(const void *arg) 340 { 341 long rc; 342 uint32_t linear_id = plat_my_core_pos(); 343 rmmd_rmm_context_t *ctx = &rmm_context[linear_id]; 344 345 if (rmm_boot_failed) { 346 /* RMM Boot failed on a previous CPU. Abort. */ 347 ERROR("RMM Failed to initialize. Ignoring for CPU%d\n", 348 linear_id); 349 return NULL; 350 } 351 352 /* 353 * Prepare warmboot arguments for RMM: 354 * arg0: This CPUID. 355 * arg1 to arg3: Not used. 356 */ 357 rmm_ep_info->args.arg0 = linear_id; 358 rmm_ep_info->args.arg1 = 0ULL; 359 rmm_ep_info->args.arg2 = 0ULL; 360 rmm_ep_info->args.arg3 = 0ULL; 361 362 /* Initialise RMM context with this entry point information */ 363 cm_setup_context(&ctx->cpu_ctx, rmm_ep_info); 364 365 /* Enable architecture extensions */ 366 manage_extensions_realm(&ctx->cpu_ctx); 367 368 /* Initialize RMM EL2 context. */ 369 rmm_el2_context_init(&ctx->cpu_ctx.el2_sysregs_ctx); 370 371 rc = rmmd_rmm_sync_entry(ctx); 372 373 if (rc != E_RMM_BOOT_SUCCESS) { 374 ERROR("RMM init failed on CPU%d: %ld\n", linear_id, rc); 375 /* Mark the boot as failed for any other booting CPU */ 376 rmm_boot_failed = true; 377 } 378 379 return NULL; 380 } 381 382 /* Subscribe to PSCI CPU on to initialize RMM on secondary */ 383 SUBSCRIBE_TO_EVENT(psci_cpu_on_finish, rmmd_cpu_on_finish_handler); 384 385 /* Convert GPT lib error to RMMD GTS error */ 386 static int gpt_to_gts_error(int error, uint32_t smc_fid, uint64_t address) 387 { 388 int ret; 389 390 if (error == 0) { 391 return E_RMM_OK; 392 } 393 394 if (error == -EINVAL) { 395 ret = E_RMM_BAD_ADDR; 396 } else { 397 /* This is the only other error code we expect */ 398 assert(error == -EPERM); 399 ret = E_RMM_BAD_PAS; 400 } 401 402 ERROR("RMMD: PAS Transition failed. GPT ret = %d, PA: 0x%"PRIx64 ", FID = 0x%x\n", 403 error, address, smc_fid); 404 return ret; 405 } 406 407 /******************************************************************************* 408 * This function handles RMM-EL3 interface SMCs 409 ******************************************************************************/ 410 uint64_t rmmd_rmm_el3_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2, 411 uint64_t x3, uint64_t x4, void *cookie, 412 void *handle, uint64_t flags) 413 { 414 uint32_t src_sec_state; 415 int ret; 416 417 /* If RMM failed to boot, treat any RMM-EL3 interface SMC as unknown */ 418 if (rmm_boot_failed) { 419 WARN("RMMD: Failed to boot up RMM. Ignoring RMM-EL3 call\n"); 420 SMC_RET1(handle, SMC_UNK); 421 } 422 423 /* Determine which security state this SMC originated from */ 424 src_sec_state = caller_sec_state(flags); 425 426 if (src_sec_state != SMC_FROM_REALM) { 427 WARN("RMMD: RMM-EL3 call originated from secure or normal world\n"); 428 SMC_RET1(handle, SMC_UNK); 429 } 430 431 switch (smc_fid) { 432 case RMM_GTSI_DELEGATE: 433 ret = gpt_delegate_pas(x1, PAGE_SIZE_4KB, SMC_FROM_REALM); 434 SMC_RET1(handle, gpt_to_gts_error(ret, smc_fid, x1)); 435 case RMM_GTSI_UNDELEGATE: 436 ret = gpt_undelegate_pas(x1, PAGE_SIZE_4KB, SMC_FROM_REALM); 437 SMC_RET1(handle, gpt_to_gts_error(ret, smc_fid, x1)); 438 case RMM_ATTEST_GET_PLAT_TOKEN: 439 ret = rmmd_attest_get_platform_token(x1, &x2, x3); 440 SMC_RET2(handle, ret, x2); 441 case RMM_ATTEST_GET_REALM_KEY: 442 ret = rmmd_attest_get_signing_key(x1, &x2, x3); 443 SMC_RET2(handle, ret, x2); 444 445 case RMM_BOOT_COMPLETE: 446 VERBOSE("RMMD: running rmmd_rmm_sync_exit\n"); 447 rmmd_rmm_sync_exit(x1); 448 449 default: 450 WARN("RMMD: Unsupported RMM-EL3 call 0x%08x\n", smc_fid); 451 SMC_RET1(handle, SMC_UNK); 452 } 453 } 454