blob: 821988204c09b1a4800f6718f101a4982ee66a24 [file] [log] [blame]
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +01001// Copyright 2022, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Low-level entry and exit points of pvmfw.
16
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +010017use crate::config;
Jaewan Kimba8929b2023-01-13 11:13:29 +090018use crate::debug_policy::{handle_debug_policy, DebugPolicyError};
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000019use crate::fdt;
Pierre-Clément Tosifc531152022-10-20 12:22:23 +010020use crate::heap;
Pierre-Clément Tosia1d3ea32022-11-01 15:05:11 +000021use crate::helpers;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000022use crate::memory::MemoryTracker;
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +010023use crate::mmio_guard;
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +000024use crate::mmu;
Pierre-Clément Tosia59103d2023-02-02 14:46:55 +000025use crate::rand;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +010026use core::arch::asm;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000027use core::num::NonZeroUsize;
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010028use core::slice;
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +010029use log::debug;
30use log::error;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000031use log::info;
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +010032use log::warn;
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +010033use log::LevelFilter;
34use vmbase::{console, layout, logger, main, power::reboot};
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010035
36#[derive(Debug, Clone)]
Andrew Walbran19690632022-12-07 16:41:30 +000037pub enum RebootReason {
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +010038 /// A malformed BCC was received.
39 InvalidBcc,
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +010040 /// An invalid configuration was appended to pvmfw.
41 InvalidConfig,
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010042 /// An unexpected internal error happened.
43 InternalError,
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000044 /// The provided FDT was invalid.
45 InvalidFdt,
46 /// The provided payload was invalid.
47 InvalidPayload,
48 /// The provided ramdisk was invalid.
49 InvalidRamdisk,
Alice Wang28cbcf12022-12-01 07:58:28 +000050 /// Failed to verify the payload.
51 PayloadVerificationError,
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000052 /// DICE layering process failed.
53 SecretDerivationError,
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010054}
55
Jaewan Kimba8929b2023-01-13 11:13:29 +090056impl From<DebugPolicyError> for RebootReason {
57 fn from(error: DebugPolicyError) -> Self {
58 match error {
59 DebugPolicyError::Fdt(_, _) => RebootReason::InvalidFdt,
60 DebugPolicyError::DebugPolicyFdt(_, _) => RebootReason::InvalidConfig,
61 DebugPolicyError::OverlaidFdt(_, _) => RebootReason::InternalError,
62 }
63 }
64}
65
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010066main!(start);
67
68/// Entry point for pVM firmware.
69pub fn start(fdt_address: u64, payload_start: u64, payload_size: u64, _arg3: u64) {
70 // Limitations in this function:
71 // - can't access non-pvmfw memory (only statically-mapped memory)
72 // - can't access MMIO (therefore, no logging)
73
74 match main_wrapper(fdt_address as usize, payload_start as usize, payload_size as usize) {
Pierre-Clément Tosib8e7cec2023-01-31 22:11:34 +000075 Ok(entry) => jump_to_payload(fdt_address, entry.try_into().unwrap()),
Pierre-Clément Tosid836b5b2022-12-05 10:49:38 +000076 Err(_) => reboot(), // TODO(b/220071963) propagate the reason back to the host.
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010077 }
78
79 // if we reach this point and return, vmbase::entry::rust_entry() will call power::shutdown().
80}
81
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000082struct MemorySlices<'a> {
83 fdt: &'a mut libfdt::Fdt,
84 kernel: &'a [u8],
85 ramdisk: Option<&'a [u8]>,
86}
87
88impl<'a> MemorySlices<'a> {
89 fn new(
90 fdt: usize,
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +000091 kernel: usize,
92 kernel_size: usize,
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000093 memory: &mut MemoryTracker,
94 ) -> Result<Self, RebootReason> {
95 // SAFETY - SIZE_2MB is non-zero.
96 const FDT_SIZE: NonZeroUsize = unsafe { NonZeroUsize::new_unchecked(helpers::SIZE_2MB) };
97 // TODO - Only map the FDT as read-only, until we modify it right before jump_to_payload()
98 // e.g. by generating a DTBO for a template DT in main() and, on return, re-map DT as RW,
99 // overwrite with the template DT and apply the DTBO.
100 let range = memory.alloc_mut(fdt, FDT_SIZE).map_err(|e| {
101 error!("Failed to allocate the FDT range: {e}");
102 RebootReason::InternalError
103 })?;
104
105 // SAFETY - The tracker validated the range to be in main memory, mapped, and not overlap.
106 let fdt = unsafe { slice::from_raw_parts_mut(range.start as *mut u8, range.len()) };
107 let fdt = libfdt::Fdt::from_mut_slice(fdt).map_err(|e| {
108 error!("Failed to spawn the FDT wrapper: {e}");
109 RebootReason::InvalidFdt
110 })?;
111
Jiyong Park6a8789a2023-03-21 14:50:59 +0900112 let info = fdt::sanitize_device_tree(fdt)?;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000113 debug!("Fdt passed validation!");
114
Jiyong Park6a8789a2023-03-21 14:50:59 +0900115 let memory_range = info.memory_range;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000116 debug!("Resizing MemoryTracker to range {memory_range:#x?}");
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000117 memory.shrink(&memory_range).map_err(|_| {
118 error!("Failed to use memory range value from DT: {memory_range:#x?}");
119 RebootReason::InvalidFdt
120 })?;
121
Jiyong Park6a8789a2023-03-21 14:50:59 +0900122 let kernel_range = if let Some(r) = info.kernel_range {
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +0000123 memory.alloc_range(&r).map_err(|e| {
124 error!("Failed to obtain the kernel range with DT range: {e}");
125 RebootReason::InternalError
126 })?
127 } else if cfg!(feature = "legacy") {
128 warn!("Failed to find the kernel range in the DT; falling back to legacy ABI");
129
130 let kernel_size = NonZeroUsize::new(kernel_size).ok_or_else(|| {
131 error!("Invalid kernel size: {kernel_size:#x}");
132 RebootReason::InvalidPayload
133 })?;
134
135 memory.alloc(kernel, kernel_size).map_err(|e| {
136 error!("Failed to obtain the kernel range with legacy range: {e}");
137 RebootReason::InternalError
138 })?
139 } else {
140 error!("Failed to locate the kernel from the DT");
141 return Err(RebootReason::InvalidPayload);
142 };
143
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000144 // SAFETY - The tracker validated the range to be in main memory, mapped, and not overlap.
145 let kernel =
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +0000146 unsafe { slice::from_raw_parts(kernel_range.start as *const u8, kernel_range.len()) };
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000147
Jiyong Park6a8789a2023-03-21 14:50:59 +0900148 let ramdisk = if let Some(r) = info.initrd_range {
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000149 debug!("Located ramdisk at {r:?}");
150 let r = memory.alloc_range(&r).map_err(|e| {
151 error!("Failed to obtain the initrd range: {e}");
152 RebootReason::InvalidRamdisk
153 })?;
154
155 // SAFETY - The region was validated by memory to be in main memory, mapped, and
156 // not overlap.
157 Some(unsafe { slice::from_raw_parts(r.start as *const u8, r.len()) })
158 } else {
159 info!("Couldn't locate the ramdisk from the device tree");
160 None
161 };
162
163 Ok(Self { fdt, kernel, ramdisk })
164 }
165}
166
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100167/// Sets up the environment for main() and wraps its result for start().
168///
169/// Provide the abstractions necessary for start() to abort the pVM boot and for main() to run with
170/// the assumption that its environment has been properly configured.
Pierre-Clément Tosib8e7cec2023-01-31 22:11:34 +0000171fn main_wrapper(fdt: usize, payload: usize, payload_size: usize) -> Result<usize, RebootReason> {
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100172 // Limitations in this function:
173 // - only access MMIO once (and while) it has been mapped and configured
174 // - only perform logging once the logger has been initialized
175 // - only access non-pvmfw memory once (and while) it has been mapped
Pierre-Clément Tosifc531152022-10-20 12:22:23 +0100176
177 // SAFETY - This function should and will only be called once, here.
178 unsafe { heap::init() };
179
Pierre-Clément Tosidbd72862022-10-21 14:31:02 +0100180 logger::init(LevelFilter::Info).map_err(|_| RebootReason::InternalError)?;
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100181
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100182 // Use debug!() to avoid printing to the UART if we failed to configure it as only local
183 // builds that have tweaked the logger::init() call will actually attempt to log the message.
184
185 mmio_guard::init().map_err(|e| {
186 debug!("{e}");
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100187 RebootReason::InternalError
188 })?;
189
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100190 mmio_guard::map(console::BASE_ADDRESS).map_err(|e| {
191 debug!("Failed to configure the UART: {e}");
192 RebootReason::InternalError
193 })?;
194
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100195 // SAFETY - We only get the appended payload from here, once. It is mapped and the linker
196 // script prevents it from overlapping with other objects.
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +0000197 let appended_data = unsafe { get_appended_data_slice() };
198
199 // Up to this point, we were using the built-in static (from .rodata) page tables.
200
201 let mut page_table = mmu::PageTable::from_static_layout().map_err(|e| {
202 error!("Failed to set up the dynamic page tables: {e}");
203 RebootReason::InternalError
204 })?;
205
206 const CONSOLE_LEN: usize = 1; // vmbase::uart::Uart only uses one u8 register.
207 let uart_range = console::BASE_ADDRESS..(console::BASE_ADDRESS + CONSOLE_LEN);
208 page_table.map_device(&uart_range).map_err(|e| {
209 error!("Failed to remap the UART as a dynamic page table entry: {e}");
210 RebootReason::InternalError
211 })?;
212
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100213 // SAFETY - We only get the appended payload from here, once. It is statically mapped and the
214 // linker script prevents it from overlapping with other objects.
215 let mut appended = unsafe { AppendedPayload::new(appended_data) }.ok_or_else(|| {
216 error!("No valid configuration found");
217 RebootReason::InvalidConfig
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +0000218 })?;
219
Pierre-Clément Tosiefe780c2023-02-21 21:36:30 +0000220 let (bcc_slice, debug_policy) = appended.get_entries();
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100221
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +0000222 debug!("Activating dynamic page table...");
223 // SAFETY - page_table duplicates the static mappings for everything that the Rust code is
224 // aware of so activating it shouldn't have any visible effect.
225 unsafe { page_table.activate() };
226 debug!("... Success!");
227
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000228 let mut memory = MemoryTracker::new(page_table);
229 let slices = MemorySlices::new(fdt, payload, payload_size, &mut memory)?;
230
Pierre-Clément Tosia59103d2023-02-02 14:46:55 +0000231 rand::init().map_err(|e| {
232 error!("Failed to initialize rand: {e}");
233 RebootReason::InternalError
234 })?;
235
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100236 // This wrapper allows main() to be blissfully ignorant of platform details.
Alice Wang843d8312023-02-15 09:47:06 +0000237 crate::main(slices.fdt, slices.kernel, slices.ramdisk, bcc_slice, &mut memory)?;
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100238
Pierre-Clément Tosi8383c542022-11-01 14:07:29 +0000239 helpers::flushed_zeroize(bcc_slice);
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000240 helpers::flush(slices.fdt.as_slice());
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100241
Jaewan Kimba8929b2023-01-13 11:13:29 +0900242 // SAFETY - As we `?` the result, there is no risk of using a bad `slices.fdt`.
243 unsafe {
Pierre-Clément Tosiefe780c2023-02-21 21:36:30 +0000244 handle_debug_policy(slices.fdt, debug_policy).map_err(|e| {
Jaewan Kimba8929b2023-01-13 11:13:29 +0900245 error!("Unexpected error when handling debug policy: {e:?}");
246 RebootReason::from(e)
247 })?;
Pierre-Clément Tosi90e19352022-11-21 17:11:48 +0000248 }
249
Andrew Walbran19690632022-12-07 16:41:30 +0000250 info!("Expecting a bug making MMIO_GUARD_UNMAP return NOT_SUPPORTED on success");
251 memory.mmio_unmap_all().map_err(|e| {
252 error!("Failed to unshare MMIO ranges: {e}");
253 RebootReason::InternalError
254 })?;
Pierre-Clément Tosia99bfa62022-10-06 13:30:52 +0100255 mmio_guard::unmap(console::BASE_ADDRESS).map_err(|e| {
256 error!("Failed to unshare the UART: {e}");
257 RebootReason::InternalError
258 })?;
259
Pierre-Clément Tosib8e7cec2023-01-31 22:11:34 +0000260 Ok(slices.kernel.as_ptr() as usize)
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100261}
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100262
263fn jump_to_payload(fdt_address: u64, payload_start: u64) -> ! {
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000264 const SCTLR_EL1_RES1: u64 = (0b11 << 28) | (0b101 << 20) | (0b1 << 11);
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100265 // Stage 1 instruction access cacheability is unaffected.
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000266 const SCTLR_EL1_I: u64 = 0b1 << 12;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100267 // SETEND instruction disabled at EL0 in aarch32 mode.
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000268 const SCTLR_EL1_SED: u64 = 0b1 << 8;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100269 // Various IT instructions are disabled at EL0 in aarch32 mode.
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000270 const SCTLR_EL1_ITD: u64 = 0b1 << 7;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100271
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000272 const SCTLR_EL1_VAL: u64 = SCTLR_EL1_RES1 | SCTLR_EL1_ITD | SCTLR_EL1_SED | SCTLR_EL1_I;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100273
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000274 // Disable the exception vector, caches and page table and then jump to the payload at the
275 // given address, passing it the given FDT pointer.
276 //
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100277 // SAFETY - We're exiting pvmfw by passing the register values we need to a noreturn asm!().
278 unsafe {
279 asm!(
280 "msr sctlr_el1, {sctlr_el1_val}",
281 "isb",
282 "mov x1, xzr",
283 "mov x2, xzr",
284 "mov x3, xzr",
285 "mov x4, xzr",
286 "mov x5, xzr",
287 "mov x6, xzr",
288 "mov x7, xzr",
289 "mov x8, xzr",
290 "mov x9, xzr",
291 "mov x10, xzr",
292 "mov x11, xzr",
293 "mov x12, xzr",
294 "mov x13, xzr",
295 "mov x14, xzr",
296 "mov x15, xzr",
297 "mov x16, xzr",
298 "mov x17, xzr",
299 "mov x18, xzr",
300 "mov x19, xzr",
301 "mov x20, xzr",
302 "mov x21, xzr",
303 "mov x22, xzr",
304 "mov x23, xzr",
305 "mov x24, xzr",
306 "mov x25, xzr",
307 "mov x26, xzr",
308 "mov x27, xzr",
309 "mov x28, xzr",
310 "mov x29, xzr",
311 "msr ttbr0_el1, xzr",
312 "isb",
313 "dsb nsh",
314 "br x30",
315 sctlr_el1_val = in(reg) SCTLR_EL1_VAL,
316 in("x0") fdt_address,
317 in("x30") payload_start,
318 options(nomem, noreturn, nostack),
319 );
320 };
321}
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100322
323unsafe fn get_appended_data_slice() -> &'static mut [u8] {
324 let base = helpers::align_up(layout::binary_end(), helpers::SIZE_4KB).unwrap();
325 // pvmfw is contained in a 2MiB region so the payload can't be larger than the 2MiB alignment.
326 let size = helpers::align_up(base, helpers::SIZE_2MB).unwrap() - base;
327
328 slice::from_raw_parts_mut(base as *mut u8, size)
329}
330
Pierre-Clément Tosi7aca7ff2022-12-12 14:04:30 +0000331enum AppendedConfigType {
332 Valid,
333 Invalid,
334 NotFound,
335}
336
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100337enum AppendedPayload<'a> {
338 /// Configuration data.
339 Config(config::Config<'a>),
340 /// Deprecated raw BCC, as used in Android T.
341 LegacyBcc(&'a mut [u8]),
342}
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100343
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100344impl<'a> AppendedPayload<'a> {
345 /// SAFETY - 'data' should respect the alignment of config::Header.
346 unsafe fn new(data: &'a mut [u8]) -> Option<Self> {
Pierre-Clément Tosi7aca7ff2022-12-12 14:04:30 +0000347 match Self::guess_config_type(data) {
348 AppendedConfigType::Valid => Some(Self::Config(config::Config::new(data).unwrap())),
349 AppendedConfigType::NotFound if cfg!(feature = "legacy") => {
350 const BCC_SIZE: usize = helpers::SIZE_4KB;
351 warn!("Assuming the appended data at {:?} to be a raw BCC", data.as_ptr());
352 Some(Self::LegacyBcc(&mut data[..BCC_SIZE]))
353 }
354 _ => None,
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100355 }
356 }
357
Pierre-Clément Tosi7aca7ff2022-12-12 14:04:30 +0000358 unsafe fn guess_config_type(data: &mut [u8]) -> AppendedConfigType {
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100359 // This function is necessary to prevent the borrow checker from getting confused
360 // about the ownership of data in new(); see https://users.rust-lang.org/t/78467.
361 let addr = data.as_ptr();
Pierre-Clément Tosi7aca7ff2022-12-12 14:04:30 +0000362 match config::Config::new(data) {
363 Err(config::Error::InvalidMagic) => {
364 warn!("No configuration data found at {addr:?}");
365 AppendedConfigType::NotFound
366 }
367 Err(e) => {
368 error!("Invalid configuration data at {addr:?}: {e}");
369 AppendedConfigType::Invalid
370 }
371 Ok(_) => AppendedConfigType::Valid,
372 }
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100373 }
374
Pierre-Clément Tosiefe780c2023-02-21 21:36:30 +0000375 fn get_entries(&mut self) -> (&mut [u8], Option<&mut [u8]>) {
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100376 match self {
Pierre-Clément Tosiefe780c2023-02-21 21:36:30 +0000377 Self::Config(ref mut cfg) => cfg.get_entries(),
378 Self::LegacyBcc(ref mut bcc) => (bcc, None),
Pierre-Clément Tosi8edf72e2022-12-06 16:02:57 +0000379 }
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100380 }
381}