loader: fix EL level for MMU disable

There are some cases where the loader is being entered at EL3
and so we should ensure we drop to EL2/EL1 first before trying
to disable the MMU.

Co-authored-by: Julia Vassiliki <julia.vassiliki@unsw.edu.au>
Signed-off-by: Ivan Velickovic <i.velickovic@unsw.edu.au>

Author: Ivan-Velickovic

loader/src/aarch64/init.c

@@ -75,6 +75,13 @@ void arch_init(void)
     configure_gicv2();
 #endif
 
+    /* Drop to correct EL before disabling MMU */
+    int r = ensure_correct_el(0);
+    if (r != 0) {
+        puts("LDR|ERROR: failed to ensure correct EL\n");
+        fail();
+    }
+
     /* Disable the MMU, as U-Boot will start in virtual memory on some platforms
      * (https://docs.u-boot.org/en/latest/arch/arm64.html), which means that
      * certain physical memory addresses contain page table information which
@@ -95,6 +102,7 @@ void arch_init(void)
         el2_mmu_disable();
     } else {
         puts("LDR|ERROR: unknown EL level for MMU disable\n");
+        fail();
     }
 
     // TODO: handle non-PSCI platforms better, see https://github.com/seL4/microkit/issues/401.

loader/src/loader.c

@@ -138,6 +138,14 @@ void relocation_log(uint64_t reloc_addr, uint64_t curr_addr)
     puts("\n");
 }
 
+_Noreturn void fail(void)
+{
+    /* IMPROVEMENT: use SMC SVC call to try and power-off / reboot system.
+     * or at least go to a WFI loop
+     */
+    while (1) {}
+}
+
 int main(void)
 {
     int r;
@@ -153,7 +161,7 @@ int main(void)
     /* Check that the loader magic number is set correctly */
     if (loader_data->magic != MAGIC) {
         puts("LDR|ERROR: mismatch on loader data structure magic number\n");
-        goto fail;
+        fail();
     }
 
     print_loader_data();
@@ -174,7 +182,7 @@ int main(void)
             putdecimal(cpu);
             puts(" returned error: ");
             puthex32(r);
-            goto fail;
+            fail();
         }
 
 #ifdef CONFIG_PRINTING
@@ -186,12 +194,6 @@ int main(void)
     }
 
     start_kernel(0);
-
-fail:
     /* Note: can't usefully return to U-Boot once we are here. */
-    /* IMPROVEMENT: use SMC SVC call to try and power-off / reboot system.
-     * or at least go to a WFI loop
-     */
-    for (;;) {
-    }
+    fail();
 }

loader/src/loader.h

@@ -48,6 +48,9 @@ void relocation_log(uint64_t reloc_addr, uint64_t curr_addr);
 
 extern uint64_t _stack[NUM_ACTIVE_CPUS][STACK_SIZE / sizeof(uint64_t)];
 
+/* Fatal error, call to not continue execution of the loader. */
+void fail(void);
+
 void start_kernel(int logical_cpu);
 
 #endif