xref: /linux/drivers/firmware/arm_rmm/rsi.c (revision 303bff3637d13f0ecbb280c7cb403470c440a2a6)

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (C) 2023 ARM Ltd.
 */

#include <linux/jump_label.h>
#include <linux/memblock.h>
#include <linux/psci.h>
#include <linux/swiotlb.h>
#include <linux/arm-rsi-cmds.h>
#include <linux/kobject.h>
#include <linux/sysfs.h>

#include <asm/io.h>
#include <asm/mem_encrypt.h>
#include <asm/pgtable.h>

static struct realm_config config;

unsigned long prot_ns_shared;
EXPORT_SYMBOL(prot_ns_shared);

DEFINE_STATIC_KEY_FALSE_RO(rsi_present);
EXPORT_SYMBOL(rsi_present);

static bool rsi_version_matches(void)
{
	unsigned long ver_lower, ver_higher;
	unsigned long ret = rsi_request_version(RSI_ABI_VERSION,
						&ver_lower,
						&ver_higher);

	if (ret == SMCCC_RET_NOT_SUPPORTED)
		return false;

	if (ret != RSI_SUCCESS) {
		pr_err("RME: RMM doesn't support RSI version %lu.%lu. Supported range: %lu.%lu-%lu.%lu\n",
		       RSI_ABI_VERSION_MAJOR, RSI_ABI_VERSION_MINOR,
		       RSI_ABI_VERSION_GET_MAJOR(ver_lower),
		       RSI_ABI_VERSION_GET_MINOR(ver_lower),
		       RSI_ABI_VERSION_GET_MAJOR(ver_higher),
		       RSI_ABI_VERSION_GET_MINOR(ver_higher));
		return false;
	}

	pr_info("RME: Using RSI version %lu.%lu\n",
		RSI_ABI_VERSION_GET_MAJOR(ver_lower),
		RSI_ABI_VERSION_GET_MINOR(ver_lower));

	return true;
}

static void __init arm64_rsi_setup_memory(void)
{
	u64 i;
	phys_addr_t start, end;

	/*
	 * Iterate over the available memory ranges and convert the state to
	 * protected memory. We should take extra care to ensure that we DO NOT
	 * permit any "DESTROYED" pages to be converted to "RAM".
	 *
	 * panic() is used because if the attempt to switch the memory to
	 * protected has failed here, then future accesses to the memory are
	 * simply going to be reflected as a SEA (Synchronous External Abort)
	 * which we can't handle.  Bailing out early prevents the guest limping
	 * on and dying later.
	 */
	for_each_mem_range(i, &start, &end) {
		if (rsi_set_memory_range_protected_safe(start, end)) {
			panic("Failed to set memory range to protected: %pa-%pa",
			      &start, &end);
		}
	}
}

/*
 * Check if a given PA range is Trusted (e.g., Protected memory, a Trusted Device
 * mapping, or an MMIO emulated in the Realm world).
 *
 * We can rely on the RIPAS value of the region to detect if a given region is
 * protected.
 *
 *  RIPAS_DEV - A trusted device memory or a trusted emulated MMIO (in the Realm
 *		world
 *  RIPAS_RAM - Memory (RAM), protected by the RMM guarantees. (e.g., Firmware
 *		reserved regions for data sharing).
 *
 *  RIPAS_DESTROYED is a special case of one of the above, where the host did
 *  something without our permission and as such we can't do anything about it.
 *
 * The only case where something is emulated by the untrusted hypervisor or is
 * backed by shared memory is indicated by RSI_RIPAS_EMPTY.
 */
bool arm64_rsi_is_protected(phys_addr_t base, size_t size)
{
	enum ripas ripas;
	phys_addr_t end, top;

	/* Overflow ? */
	if (WARN_ON(base + size <= base))
		return false;

	end = ALIGN(base + size, RSI_GRANULE_SIZE);
	base = ALIGN_DOWN(base, RSI_GRANULE_SIZE);

	while (base < end) {
		if (WARN_ON(rsi_ipa_state_get(base, end, &ripas, &top)))
			break;
		if (WARN_ON(top <= base))
			break;
		if (ripas == RSI_RIPAS_EMPTY)
			break;
		base = top;
	}

	return base >= end;
}
EXPORT_SYMBOL(arm64_rsi_is_protected);

static int realm_ioremap_hook(phys_addr_t phys, size_t size, pgprot_t *prot)
{
	if (arm64_rsi_is_protected(phys, size))
		*prot = pgprot_encrypted(*prot);
	else
		*prot = pgprot_decrypted(*prot);

	return 0;
}

static int realm_set_memory_encrypted(unsigned long addr, int numpages)
{
	int ret = __set_memory_enc_dec(addr, numpages, true);

	/*
	 * If the request to change state fails, then the only sensible cause
	 * of action for the caller is to leak the memory
	 */
	WARN(ret, "Failed to encrypt memory, %d pages will be leaked",
	     numpages);

	return ret;
}

static int realm_set_memory_decrypted(unsigned long addr, int numpages)
{
	int ret = __set_memory_enc_dec(addr, numpages, false);

	WARN(ret, "Failed to decrypt memory, %d pages will be leaked",
	     numpages);

	return ret;
}

static const struct arm64_mem_crypt_ops realm_crypt_ops = {
	.encrypt = realm_set_memory_encrypted,
	.decrypt = realm_set_memory_decrypted,
};

static int realm_register_memory_enc_ops(void)
{
	return arm64_mem_crypt_ops_register(&realm_crypt_ops);
}

void __init arm64_rsi_init(void)
{
	if (arm_smccc_1_1_get_conduit() != SMCCC_CONDUIT_SMC)
		return;
	if (!rsi_version_matches())
		return;
	if (WARN_ON(rsi_get_realm_config(lm_alias(&config))))
		return;
	prot_ns_shared = __phys_to_pte_val(BIT(config.ipa_bits - 1));

	if (arm64_ioremap_prot_hook_register(realm_ioremap_hook))
		return;

	if (realm_register_memory_enc_ops())
		return;

	arm64_rsi_setup_memory();

	static_branch_enable(&rsi_present);
}

static ssize_t realm_guest_show(struct kobject *kobj,
		struct kobj_attribute *attr, char *buf)
{
	return sysfs_emit(buf, "1\n");
}

static struct kobj_attribute cca_realm_guest = __ATTR_RO(realm_guest);
static const struct attribute *cca_realm_attrs[] = {
	&cca_realm_guest.attr,
	NULL
};

static int __init realm_sysfs_init(void)
{
	int ret;
	struct kobject *cca_kobj;

	if (!is_realm_world())
		return 0;

	cca_kobj = kobject_create_and_add("cca", firmware_kobj);
	if (!cca_kobj)
		return -ENOMEM;

	ret = sysfs_create_files(cca_kobj, cca_realm_attrs);
	if (!ret)
		return 0;

	kobject_put(cca_kobj);
	return ret;
}
device_initcall(realm_sysfs_init);