blob: 5dd1d2d7e59c912cc76c4c64e941c32c437a3ee5 [file] [log] [blame]
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +01001// Copyright 2022, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Low-level entry and exit points of pvmfw.
16
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +010017use crate::config;
Pierre-Clément Tosi41748ed2023-03-31 18:20:40 +010018use crate::crypto;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000019use crate::fdt;
Pierre-Clément Tosifc531152022-10-20 12:22:23 +010020use crate::heap;
Pierre-Clément Tosia1d3ea32022-11-01 15:05:11 +000021use crate::helpers;
Jakob Vukalovic85a00d72023-04-20 09:51:10 +010022use crate::memory::{MemoryTracker, MEMORY};
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +000023use crate::mmu;
Pierre-Clément Tosia59103d2023-02-02 14:46:55 +000024use crate::rand;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +010025use core::arch::asm;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000026use core::num::NonZeroUsize;
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010027use core::slice;
Alice Wang90e6f162023-04-17 13:49:45 +000028use hyp::get_hypervisor;
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +010029use log::debug;
30use log::error;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000031use log::info;
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +010032use log::warn;
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +010033use log::LevelFilter;
34use vmbase::{console, layout, logger, main, power::reboot};
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010035
36#[derive(Debug, Clone)]
Andrew Walbran19690632022-12-07 16:41:30 +000037pub enum RebootReason {
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +010038 /// A malformed BCC was received.
39 InvalidBcc,
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +010040 /// An invalid configuration was appended to pvmfw.
41 InvalidConfig,
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010042 /// An unexpected internal error happened.
43 InternalError,
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000044 /// The provided FDT was invalid.
45 InvalidFdt,
46 /// The provided payload was invalid.
47 InvalidPayload,
48 /// The provided ramdisk was invalid.
49 InvalidRamdisk,
Alice Wang28cbcf12022-12-01 07:58:28 +000050 /// Failed to verify the payload.
51 PayloadVerificationError,
Pierre-Clément Tosi4f4f5eb2022-12-08 14:31:42 +000052 /// DICE layering process failed.
53 SecretDerivationError,
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010054}
55
56main!(start);
57
58/// Entry point for pVM firmware.
59pub fn start(fdt_address: u64, payload_start: u64, payload_size: u64, _arg3: u64) {
60 // Limitations in this function:
61 // - can't access non-pvmfw memory (only statically-mapped memory)
62 // - can't access MMIO (therefore, no logging)
63
64 match main_wrapper(fdt_address as usize, payload_start as usize, payload_size as usize) {
Pierre-Clément Tosib8e7cec2023-01-31 22:11:34 +000065 Ok(entry) => jump_to_payload(fdt_address, entry.try_into().unwrap()),
Pierre-Clément Tosid836b5b2022-12-05 10:49:38 +000066 Err(_) => reboot(), // TODO(b/220071963) propagate the reason back to the host.
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +010067 }
68
69 // if we reach this point and return, vmbase::entry::rust_entry() will call power::shutdown().
70}
71
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000072struct MemorySlices<'a> {
73 fdt: &'a mut libfdt::Fdt,
74 kernel: &'a [u8],
75 ramdisk: Option<&'a [u8]>,
76}
77
78impl<'a> MemorySlices<'a> {
79 fn new(
80 fdt: usize,
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +000081 kernel: usize,
82 kernel_size: usize,
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000083 memory: &mut MemoryTracker,
84 ) -> Result<Self, RebootReason> {
85 // SAFETY - SIZE_2MB is non-zero.
86 const FDT_SIZE: NonZeroUsize = unsafe { NonZeroUsize::new_unchecked(helpers::SIZE_2MB) };
87 // TODO - Only map the FDT as read-only, until we modify it right before jump_to_payload()
88 // e.g. by generating a DTBO for a template DT in main() and, on return, re-map DT as RW,
89 // overwrite with the template DT and apply the DTBO.
90 let range = memory.alloc_mut(fdt, FDT_SIZE).map_err(|e| {
91 error!("Failed to allocate the FDT range: {e}");
92 RebootReason::InternalError
93 })?;
94
95 // SAFETY - The tracker validated the range to be in main memory, mapped, and not overlap.
96 let fdt = unsafe { slice::from_raw_parts_mut(range.start as *mut u8, range.len()) };
97 let fdt = libfdt::Fdt::from_mut_slice(fdt).map_err(|e| {
98 error!("Failed to spawn the FDT wrapper: {e}");
99 RebootReason::InvalidFdt
100 })?;
101
Jiyong Park6a8789a2023-03-21 14:50:59 +0900102 let info = fdt::sanitize_device_tree(fdt)?;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000103 debug!("Fdt passed validation!");
104
Jiyong Park6a8789a2023-03-21 14:50:59 +0900105 let memory_range = info.memory_range;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000106 debug!("Resizing MemoryTracker to range {memory_range:#x?}");
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000107 memory.shrink(&memory_range).map_err(|_| {
108 error!("Failed to use memory range value from DT: {memory_range:#x?}");
109 RebootReason::InvalidFdt
110 })?;
111
Jiyong Park6a8789a2023-03-21 14:50:59 +0900112 let kernel_range = if let Some(r) = info.kernel_range {
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +0000113 memory.alloc_range(&r).map_err(|e| {
114 error!("Failed to obtain the kernel range with DT range: {e}");
115 RebootReason::InternalError
116 })?
117 } else if cfg!(feature = "legacy") {
118 warn!("Failed to find the kernel range in the DT; falling back to legacy ABI");
119
120 let kernel_size = NonZeroUsize::new(kernel_size).ok_or_else(|| {
121 error!("Invalid kernel size: {kernel_size:#x}");
122 RebootReason::InvalidPayload
123 })?;
124
125 memory.alloc(kernel, kernel_size).map_err(|e| {
126 error!("Failed to obtain the kernel range with legacy range: {e}");
127 RebootReason::InternalError
128 })?
129 } else {
130 error!("Failed to locate the kernel from the DT");
131 return Err(RebootReason::InvalidPayload);
132 };
133
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000134 // SAFETY - The tracker validated the range to be in main memory, mapped, and not overlap.
135 let kernel =
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +0000136 unsafe { slice::from_raw_parts(kernel_range.start as *const u8, kernel_range.len()) };
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000137
Jiyong Park6a8789a2023-03-21 14:50:59 +0900138 let ramdisk = if let Some(r) = info.initrd_range {
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000139 debug!("Located ramdisk at {r:?}");
140 let r = memory.alloc_range(&r).map_err(|e| {
141 error!("Failed to obtain the initrd range: {e}");
142 RebootReason::InvalidRamdisk
143 })?;
144
145 // SAFETY - The region was validated by memory to be in main memory, mapped, and
146 // not overlap.
147 Some(unsafe { slice::from_raw_parts(r.start as *const u8, r.len()) })
148 } else {
149 info!("Couldn't locate the ramdisk from the device tree");
150 None
151 };
152
153 Ok(Self { fdt, kernel, ramdisk })
154 }
155}
156
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100157/// Sets up the environment for main() and wraps its result for start().
158///
159/// Provide the abstractions necessary for start() to abort the pVM boot and for main() to run with
160/// the assumption that its environment has been properly configured.
Pierre-Clément Tosib8e7cec2023-01-31 22:11:34 +0000161fn main_wrapper(fdt: usize, payload: usize, payload_size: usize) -> Result<usize, RebootReason> {
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100162 // Limitations in this function:
163 // - only access MMIO once (and while) it has been mapped and configured
164 // - only perform logging once the logger has been initialized
165 // - only access non-pvmfw memory once (and while) it has been mapped
Pierre-Clément Tosifc531152022-10-20 12:22:23 +0100166
167 // SAFETY - This function should and will only be called once, here.
168 unsafe { heap::init() };
169
Pierre-Clément Tosidbd72862022-10-21 14:31:02 +0100170 logger::init(LevelFilter::Info).map_err(|_| RebootReason::InternalError)?;
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100171
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100172 // Use debug!() to avoid printing to the UART if we failed to configure it as only local
173 // builds that have tweaked the logger::init() call will actually attempt to log the message.
174
Alice Wang90e6f162023-04-17 13:49:45 +0000175 get_hypervisor().mmio_guard_init().map_err(|e| {
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100176 debug!("{e}");
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100177 RebootReason::InternalError
178 })?;
179
Alice Wang90e6f162023-04-17 13:49:45 +0000180 get_hypervisor().mmio_guard_map(console::BASE_ADDRESS).map_err(|e| {
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100181 debug!("Failed to configure the UART: {e}");
182 RebootReason::InternalError
183 })?;
184
Pierre-Clément Tosi41748ed2023-03-31 18:20:40 +0100185 crypto::init();
186
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100187 // SAFETY - We only get the appended payload from here, once. It is mapped and the linker
188 // script prevents it from overlapping with other objects.
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +0000189 let appended_data = unsafe { get_appended_data_slice() };
190
191 // Up to this point, we were using the built-in static (from .rodata) page tables.
192
193 let mut page_table = mmu::PageTable::from_static_layout().map_err(|e| {
194 error!("Failed to set up the dynamic page tables: {e}");
195 RebootReason::InternalError
196 })?;
197
198 const CONSOLE_LEN: usize = 1; // vmbase::uart::Uart only uses one u8 register.
199 let uart_range = console::BASE_ADDRESS..(console::BASE_ADDRESS + CONSOLE_LEN);
200 page_table.map_device(&uart_range).map_err(|e| {
201 error!("Failed to remap the UART as a dynamic page table entry: {e}");
202 RebootReason::InternalError
203 })?;
204
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100205 // SAFETY - We only get the appended payload from here, once. It is statically mapped and the
206 // linker script prevents it from overlapping with other objects.
207 let mut appended = unsafe { AppendedPayload::new(appended_data) }.ok_or_else(|| {
208 error!("No valid configuration found");
209 RebootReason::InvalidConfig
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +0000210 })?;
211
Pierre-Clément Tosiefe780c2023-02-21 21:36:30 +0000212 let (bcc_slice, debug_policy) = appended.get_entries();
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100213
Pierre-Clément Tosia8a4a202022-11-03 14:16:46 +0000214 debug!("Activating dynamic page table...");
215 // SAFETY - page_table duplicates the static mappings for everything that the Rust code is
216 // aware of so activating it shouldn't have any visible effect.
217 unsafe { page_table.activate() };
218 debug!("... Success!");
219
Jakob Vukalovic85a00d72023-04-20 09:51:10 +0100220 MEMORY.lock().replace(MemoryTracker::new(page_table));
221 let slices = MemorySlices::new(fdt, payload, payload_size, MEMORY.lock().as_mut().unwrap())?;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +0000222
Pierre-Clément Tosia59103d2023-02-02 14:46:55 +0000223 rand::init().map_err(|e| {
224 error!("Failed to initialize rand: {e}");
225 RebootReason::InternalError
226 })?;
227
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100228 // This wrapper allows main() to be blissfully ignorant of platform details.
Jakob Vukalovic85a00d72023-04-20 09:51:10 +0100229 crate::main(
230 slices.fdt,
231 slices.kernel,
232 slices.ramdisk,
233 bcc_slice,
234 debug_policy,
235 MEMORY.lock().as_mut().unwrap(),
236 )?;
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100237
Pierre-Clément Tosi8383c542022-11-01 14:07:29 +0000238 helpers::flushed_zeroize(bcc_slice);
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000239 helpers::flush(slices.fdt.as_slice());
Pierre-Clément Tosi072969b2022-10-19 17:32:24 +0100240
Andrew Walbran19690632022-12-07 16:41:30 +0000241 info!("Expecting a bug making MMIO_GUARD_UNMAP return NOT_SUPPORTED on success");
Jakob Vukalovic85a00d72023-04-20 09:51:10 +0100242 MEMORY.lock().as_mut().unwrap().mmio_unmap_all().map_err(|e| {
Andrew Walbran19690632022-12-07 16:41:30 +0000243 error!("Failed to unshare MMIO ranges: {e}");
244 RebootReason::InternalError
245 })?;
Alice Wang90e6f162023-04-17 13:49:45 +0000246 get_hypervisor().mmio_guard_unmap(console::BASE_ADDRESS).map_err(|e| {
Pierre-Clément Tosia99bfa62022-10-06 13:30:52 +0100247 error!("Failed to unshare the UART: {e}");
248 RebootReason::InternalError
249 })?;
Jakob Vukalovic85a00d72023-04-20 09:51:10 +0100250 MEMORY.lock().take().unwrap();
Pierre-Clément Tosia99bfa62022-10-06 13:30:52 +0100251
Pierre-Clément Tosib8e7cec2023-01-31 22:11:34 +0000252 Ok(slices.kernel.as_ptr() as usize)
Pierre-Clément Tosi5bbfca52022-10-21 12:14:35 +0100253}
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100254
255fn jump_to_payload(fdt_address: u64, payload_start: u64) -> ! {
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000256 const SCTLR_EL1_RES1: u64 = (0b11 << 28) | (0b101 << 20) | (0b1 << 11);
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100257 // Stage 1 instruction access cacheability is unaffected.
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000258 const SCTLR_EL1_I: u64 = 0b1 << 12;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100259 // SETEND instruction disabled at EL0 in aarch32 mode.
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000260 const SCTLR_EL1_SED: u64 = 0b1 << 8;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100261 // Various IT instructions are disabled at EL0 in aarch32 mode.
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000262 const SCTLR_EL1_ITD: u64 = 0b1 << 7;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100263
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000264 const SCTLR_EL1_VAL: u64 = SCTLR_EL1_RES1 | SCTLR_EL1_ITD | SCTLR_EL1_SED | SCTLR_EL1_I;
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100265
Pierre-Clément Tosi6c0d48b2022-11-07 11:00:32 +0000266 // Disable the exception vector, caches and page table and then jump to the payload at the
267 // given address, passing it the given FDT pointer.
268 //
Pierre-Clément Tosi645e90e2022-10-21 13:27:19 +0100269 // SAFETY - We're exiting pvmfw by passing the register values we need to a noreturn asm!().
270 unsafe {
271 asm!(
272 "msr sctlr_el1, {sctlr_el1_val}",
273 "isb",
274 "mov x1, xzr",
275 "mov x2, xzr",
276 "mov x3, xzr",
277 "mov x4, xzr",
278 "mov x5, xzr",
279 "mov x6, xzr",
280 "mov x7, xzr",
281 "mov x8, xzr",
282 "mov x9, xzr",
283 "mov x10, xzr",
284 "mov x11, xzr",
285 "mov x12, xzr",
286 "mov x13, xzr",
287 "mov x14, xzr",
288 "mov x15, xzr",
289 "mov x16, xzr",
290 "mov x17, xzr",
291 "mov x18, xzr",
292 "mov x19, xzr",
293 "mov x20, xzr",
294 "mov x21, xzr",
295 "mov x22, xzr",
296 "mov x23, xzr",
297 "mov x24, xzr",
298 "mov x25, xzr",
299 "mov x26, xzr",
300 "mov x27, xzr",
301 "mov x28, xzr",
302 "mov x29, xzr",
303 "msr ttbr0_el1, xzr",
304 "isb",
305 "dsb nsh",
306 "br x30",
307 sctlr_el1_val = in(reg) SCTLR_EL1_VAL,
308 in("x0") fdt_address,
309 in("x30") payload_start,
310 options(nomem, noreturn, nostack),
311 );
312 };
313}
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100314
315unsafe fn get_appended_data_slice() -> &'static mut [u8] {
316 let base = helpers::align_up(layout::binary_end(), helpers::SIZE_4KB).unwrap();
317 // pvmfw is contained in a 2MiB region so the payload can't be larger than the 2MiB alignment.
318 let size = helpers::align_up(base, helpers::SIZE_2MB).unwrap() - base;
319
320 slice::from_raw_parts_mut(base as *mut u8, size)
321}
322
Pierre-Clément Tosi7aca7ff2022-12-12 14:04:30 +0000323enum AppendedConfigType {
324 Valid,
325 Invalid,
326 NotFound,
327}
328
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100329enum AppendedPayload<'a> {
330 /// Configuration data.
331 Config(config::Config<'a>),
332 /// Deprecated raw BCC, as used in Android T.
333 LegacyBcc(&'a mut [u8]),
334}
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100335
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100336impl<'a> AppendedPayload<'a> {
337 /// SAFETY - 'data' should respect the alignment of config::Header.
338 unsafe fn new(data: &'a mut [u8]) -> Option<Self> {
Pierre-Clément Tosi7aca7ff2022-12-12 14:04:30 +0000339 match Self::guess_config_type(data) {
340 AppendedConfigType::Valid => Some(Self::Config(config::Config::new(data).unwrap())),
341 AppendedConfigType::NotFound if cfg!(feature = "legacy") => {
342 const BCC_SIZE: usize = helpers::SIZE_4KB;
343 warn!("Assuming the appended data at {:?} to be a raw BCC", data.as_ptr());
344 Some(Self::LegacyBcc(&mut data[..BCC_SIZE]))
345 }
346 _ => None,
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100347 }
348 }
349
Pierre-Clément Tosi7aca7ff2022-12-12 14:04:30 +0000350 unsafe fn guess_config_type(data: &mut [u8]) -> AppendedConfigType {
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100351 // This function is necessary to prevent the borrow checker from getting confused
352 // about the ownership of data in new(); see https://users.rust-lang.org/t/78467.
353 let addr = data.as_ptr();
Pierre-Clément Tosi7aca7ff2022-12-12 14:04:30 +0000354 match config::Config::new(data) {
355 Err(config::Error::InvalidMagic) => {
356 warn!("No configuration data found at {addr:?}");
357 AppendedConfigType::NotFound
358 }
359 Err(e) => {
360 error!("Invalid configuration data at {addr:?}: {e}");
361 AppendedConfigType::Invalid
362 }
363 Ok(_) => AppendedConfigType::Valid,
364 }
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100365 }
366
Pierre-Clément Tosiefe780c2023-02-21 21:36:30 +0000367 fn get_entries(&mut self) -> (&mut [u8], Option<&mut [u8]>) {
Pierre-Clément Tosi20b60962022-10-17 13:35:27 +0100368 match self {
Pierre-Clément Tosiefe780c2023-02-21 21:36:30 +0000369 Self::Config(ref mut cfg) => cfg.get_entries(),
370 Self::LegacyBcc(ref mut bcc) => (bcc, None),
Pierre-Clément Tosi8edf72e2022-12-06 16:02:57 +0000371 }
Pierre-Clément Tosie8726e42022-10-17 13:35:27 +0100372 }
373}