| /* |
| * Copyright (c) 2013, ARM Limited. All rights reserved. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions are met: |
| * |
| * Redistributions of source code must retain the above copyright notice, this |
| * list of conditions and the following disclaimer. |
| * |
| * Redistributions in binary form must reproduce the above copyright notice, |
| * this list of conditions and the following disclaimer in the documentation |
| * and/or other materials provided with the distribution. |
| * |
| * Neither the name of ARM nor the names of its contributors may be used |
| * to endorse or promote products derived from this software without specific |
| * prior written permission. |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
| * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE |
| * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
| * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
| * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
| * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
| * POSSIBILITY OF SUCH DAMAGE. |
| */ |
| |
| #include <stdio.h> |
| #include <string.h> |
| #include <errno.h> |
| #include <assert.h> |
| #include <arch_helpers.h> |
| #include <console.h> |
| #include <platform.h> |
| #include <semihosting.h> |
| #include <bl_common.h> |
| #include <bl1.h> |
| |
| /*********************************************************** |
| * Memory for sharing data while changing exception levels. |
| * Only used by the primary core. |
| **********************************************************/ |
| unsigned char bl2_el_change_mem_ptr[EL_CHANGE_MEM_SIZE]; |
| |
| unsigned long *get_el_change_mem_ptr(void) |
| { |
| return (unsigned long *) bl2_el_change_mem_ptr; |
| } |
| |
| unsigned long page_align(unsigned long value, unsigned dir) |
| { |
| unsigned long page_size = 1 << FOUR_KB_SHIFT; |
| |
| /* Round up the limit to the next page boundary */ |
| if (value & (page_size - 1)) { |
| value &= ~(page_size - 1); |
| if (dir == UP) |
| value += page_size; |
| } |
| |
| return value; |
| } |
| |
| static inline unsigned int is_page_aligned (unsigned long addr) { |
| const unsigned long page_size = 1 << FOUR_KB_SHIFT; |
| |
| return (addr & (page_size - 1)) == 0; |
| } |
| |
| void change_security_state(unsigned int target_security_state) |
| { |
| unsigned long scr = read_scr(); |
| |
| if (target_security_state == SECURE) |
| scr &= ~SCR_NS_BIT; |
| else if (target_security_state == NON_SECURE) |
| scr |= SCR_NS_BIT; |
| else |
| assert(0); |
| |
| write_scr(scr); |
| } |
| |
| int drop_el(aapcs64_params *args, |
| unsigned long spsr, |
| unsigned long entrypoint) |
| { |
| write_spsr(spsr); |
| write_elr(entrypoint); |
| eret(args->arg0, |
| args->arg1, |
| args->arg2, |
| args->arg3, |
| args->arg4, |
| args->arg5, |
| args->arg6, |
| args->arg7); |
| return -EINVAL; |
| } |
| |
| long raise_el(aapcs64_params *args) |
| { |
| return smc(args->arg0, |
| args->arg1, |
| args->arg2, |
| args->arg3, |
| args->arg4, |
| args->arg5, |
| args->arg6, |
| args->arg7); |
| } |
| |
| /* |
| * TODO: If we are not EL3 then currently we only issue an SMC. |
| * Add support for dropping into EL0 etc. Consider adding support |
| * for switching from S-EL1 to S-EL0/1 etc. |
| */ |
| long change_el(el_change_info *info) |
| { |
| unsigned long current_el = read_current_el(); |
| |
| if (GET_EL(current_el) == MODE_EL3) { |
| /* |
| * We can go anywhere from EL3. So find where. |
| * TODO: Lots to do if we are going non-secure. |
| * Flip the NS bit. Restore NS registers etc. |
| * Just doing the bare minimal for now. |
| */ |
| |
| if (info->security_state == NON_SECURE) |
| change_security_state(info->security_state); |
| |
| return drop_el(&info->args, info->spsr, info->entrypoint); |
| } else |
| return raise_el(&info->args); |
| } |
| |
| /* TODO: add a parameter for DAIF. not needed right now */ |
| unsigned long make_spsr(unsigned long target_el, |
| unsigned long target_sp, |
| unsigned long target_rw) |
| { |
| unsigned long spsr; |
| |
| /* Disable all exceptions & setup the EL */ |
| spsr = (DAIF_FIQ_BIT | DAIF_IRQ_BIT | DAIF_ABT_BIT | DAIF_DBG_BIT) |
| << PSR_DAIF_SHIFT; |
| spsr |= PSR_MODE(target_rw, target_el, target_sp); |
| |
| return spsr; |
| } |
| |
| /******************************************************************************* |
| * The next two functions are the weak definitions. Platform specific |
| * code can override them if it wishes to. |
| ******************************************************************************/ |
| |
| /******************************************************************************* |
| * Function that takes a memory layout into which BL31 has been either top or |
| * bottom loaded. Using this information, it populates bl31_mem_layout to tell |
| * BL31 how much memory it has access to and how much is available for use. It |
| * does not need the address where BL31 has been loaded as BL31 will reclaim |
| * all the memory used by BL2. |
| * TODO: Revisit if this and init_bl2_mem_layout can be replaced by a single |
| * routine. |
| ******************************************************************************/ |
| void init_bl31_mem_layout(const meminfo *bl2_mem_layout, |
| meminfo *bl31_mem_layout, |
| unsigned int load_type) |
| { |
| if (load_type == BOT_LOAD) { |
| /* |
| * ------------ ^ |
| * | BL2 | | |
| * |----------| ^ | BL2 |
| * | | | BL2 free | total |
| * | | | size | size |
| * |----------| BL2 free base v | |
| * | BL31 | | |
| * ------------ BL2 total base v |
| */ |
| unsigned long bl31_size; |
| |
| bl31_mem_layout->free_base = bl2_mem_layout->free_base; |
| |
| bl31_size = bl2_mem_layout->free_base - bl2_mem_layout->total_base; |
| bl31_mem_layout->free_size = bl2_mem_layout->total_size - bl31_size; |
| } else { |
| /* |
| * ------------ ^ |
| * | BL31 | | |
| * |----------| ^ | BL2 |
| * | | | BL2 free | total |
| * | | | size | size |
| * |----------| BL2 free base v | |
| * | BL2 | | |
| * ------------ BL2 total base v |
| */ |
| unsigned long bl2_size; |
| |
| bl31_mem_layout->free_base = bl2_mem_layout->total_base; |
| |
| bl2_size = bl2_mem_layout->free_base - bl2_mem_layout->total_base; |
| bl31_mem_layout->free_size = bl2_mem_layout->free_size + bl2_size; |
| } |
| |
| bl31_mem_layout->total_base = bl2_mem_layout->total_base; |
| bl31_mem_layout->total_size = bl2_mem_layout->total_size; |
| bl31_mem_layout->attr = load_type; |
| |
| flush_dcache_range((unsigned long) bl31_mem_layout, sizeof(meminfo)); |
| return; |
| } |
| |
| /******************************************************************************* |
| * Function that takes a memory layout into which BL2 has been either top or |
| * bottom loaded along with the address where BL2 has been loaded in it. Using |
| * this information, it populates bl2_mem_layout to tell BL2 how much memory |
| * it has access to and how much is available for use. |
| ******************************************************************************/ |
| void init_bl2_mem_layout(meminfo *bl1_mem_layout, |
| meminfo *bl2_mem_layout, |
| unsigned int load_type, |
| unsigned long bl2_base) |
| { |
| unsigned tmp; |
| |
| if (load_type == BOT_LOAD) { |
| bl2_mem_layout->total_base = bl2_base; |
| tmp = bl1_mem_layout->free_base - bl2_base; |
| bl2_mem_layout->total_size = bl1_mem_layout->free_size + tmp; |
| |
| } else { |
| bl2_mem_layout->total_base = bl1_mem_layout->free_base; |
| tmp = bl1_mem_layout->total_base + bl1_mem_layout->total_size; |
| bl2_mem_layout->total_size = tmp - bl1_mem_layout->free_base; |
| } |
| |
| bl2_mem_layout->free_base = bl1_mem_layout->free_base; |
| bl2_mem_layout->free_size = bl1_mem_layout->free_size; |
| bl2_mem_layout->attr = load_type; |
| |
| flush_dcache_range((unsigned long) bl2_mem_layout, sizeof(meminfo)); |
| return; |
| } |
| |
| static void dump_load_info(unsigned long image_load_addr, |
| unsigned long image_size, |
| const meminfo *mem_layout) |
| { |
| #if DEBUG |
| printf("Trying to load image at address 0x%lx, size = 0x%lx\r\n", |
| image_load_addr, image_size); |
| printf("Current memory layout:\r\n"); |
| printf(" total region = [0x%lx, 0x%lx]\r\n", mem_layout->total_base, |
| mem_layout->total_base + mem_layout->total_size); |
| printf(" free region = [0x%lx, 0x%lx]\r\n", mem_layout->free_base, |
| mem_layout->free_base + mem_layout->free_size); |
| #endif |
| } |
| |
| /******************************************************************************* |
| * Generic function to load an image into the trusted RAM using semihosting |
| * given a name, extents of free memory & whether the image should be loaded at |
| * the bottom or top of the free memory. It updates the memory layout if the |
| * load is successful. |
| ******************************************************************************/ |
| unsigned long load_image(meminfo *mem_layout, |
| const char *image_name, |
| unsigned int load_type, |
| unsigned long fixed_addr) |
| { |
| unsigned long temp_image_base, image_base; |
| long offset; |
| int image_flen; |
| |
| /* Find the size of the image */ |
| image_flen = semihosting_get_flen(image_name); |
| if (image_flen < 0) { |
| printf("ERROR: Cannot access '%s' file (%i).\r\n", |
| image_name, image_flen); |
| return 0; |
| } |
| |
| /* See if we have enough space */ |
| if (image_flen > mem_layout->free_size) { |
| printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", |
| image_name); |
| dump_load_info(0, image_flen, mem_layout); |
| return 0; |
| } |
| |
| switch (load_type) { |
| |
| case TOP_LOAD: |
| |
| /* Load the image in the top of free memory */ |
| temp_image_base = mem_layout->free_base + mem_layout->free_size; |
| temp_image_base -= image_flen; |
| |
| /* Page align base address and check whether the image still fits */ |
| image_base = page_align(temp_image_base, DOWN); |
| assert(image_base <= temp_image_base); |
| |
| if (image_base < mem_layout->free_base) { |
| printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", |
| image_name); |
| dump_load_info(image_base, image_flen, mem_layout); |
| return 0; |
| } |
| |
| /* Calculate the amount of extra memory used due to alignment */ |
| offset = temp_image_base - image_base; |
| |
| break; |
| |
| case BOT_LOAD: |
| |
| /* Load the BL2 image in the bottom of free memory */ |
| temp_image_base = mem_layout->free_base; |
| image_base = page_align(temp_image_base, UP); |
| assert(image_base >= temp_image_base); |
| |
| /* Page align base address and check whether the image still fits */ |
| if (image_base + image_flen > |
| mem_layout->free_base + mem_layout->free_size) { |
| printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", |
| image_name); |
| dump_load_info(image_base, image_flen, mem_layout); |
| return 0; |
| } |
| |
| /* Calculate the amount of extra memory used due to alignment */ |
| offset = image_base - temp_image_base; |
| |
| break; |
| |
| default: |
| assert(0); |
| |
| } |
| |
| /* |
| * Some images must be loaded at a fixed address, not a dynamic one. |
| * |
| * This has been implemented as a hack on top of the existing dynamic |
| * loading mechanism, for the time being. If the 'fixed_addr' function |
| * argument is different from zero, then it will force the load address. |
| * So we still have this principle of top/bottom loading but the code |
| * determining the load address is bypassed and the load address is |
| * forced to the fixed one. |
| * |
| * This can result in quite a lot of wasted space because we still use |
| * 1 sole meminfo structure to represent the extents of free memory, |
| * where we should use some sort of linked list. |
| * |
| * E.g. we want to load BL2 at address 0x04020000, the resulting memory |
| * layout should look as follows: |
| * ------------ 0x04040000 |
| * | | <- Free space (1) |
| * |----------| |
| * | BL2 | |
| * |----------| 0x04020000 |
| * | | <- Free space (2) |
| * |----------| |
| * | BL1 | |
| * ------------ 0x04000000 |
| * |
| * But in the current hacky implementation, we'll need to specify |
| * whether BL2 is loaded at the top or bottom of the free memory. |
| * E.g. if BL2 is considered as top-loaded, the meminfo structure |
| * will give the following view of the memory, hiding the chunk of |
| * free memory above BL2: |
| * ------------ 0x04040000 |
| * | | |
| * | | |
| * | BL2 | |
| * |----------| 0x04020000 |
| * | | <- Free space (2) |
| * |----------| |
| * | BL1 | |
| * ------------ 0x04000000 |
| */ |
| if (fixed_addr != 0) { |
| /* Load the image at the given address. */ |
| image_base = fixed_addr; |
| |
| /* Check whether the image fits. */ |
| if ((image_base < mem_layout->free_base) || |
| (image_base + image_flen > |
| mem_layout->free_base + mem_layout->free_size)) { |
| printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", |
| image_name); |
| dump_load_info(image_base, image_flen, mem_layout); |
| return 0; |
| } |
| |
| /* Check whether the fixed load address is page-aligned. */ |
| if (!is_page_aligned(image_base)) { |
| printf("ERROR: Cannot load '%s' file at unaligned address 0x%lx.\r\n", |
| image_name, fixed_addr); |
| return 0; |
| } |
| |
| /* |
| * Calculate the amount of extra memory used due to fixed |
| * loading. |
| */ |
| if (load_type == TOP_LOAD) { |
| unsigned long max_addr, space_used; |
| /* |
| * ------------ max_addr |
| * | /wasted/ | | offset |
| * |..........|.............................. |
| * | image | | image_flen |
| * |----------| fixed_addr |
| * | | |
| * | | |
| * ------------ total_base |
| */ |
| max_addr = mem_layout->total_base + mem_layout->total_size; |
| /* |
| * Compute the amount of memory used by the image. |
| * Corresponds to all space above the image load |
| * address. |
| */ |
| space_used = max_addr - fixed_addr; |
| /* |
| * Calculate the amount of wasted memory within the |
| * amount of memory used by the image. |
| */ |
| offset = space_used - image_flen; |
| } else /* BOT_LOAD */ |
| /* |
| * ------------ |
| * | | |
| * | | |
| * |----------| |
| * | image | |
| * |..........| fixed_addr |
| * | /wasted/ | | offset |
| * ------------ total_base |
| */ |
| offset = fixed_addr - mem_layout->total_base; |
| } |
| |
| /* We have enough space so load the image now */ |
| image_flen = semihosting_download_file(image_name, |
| image_flen, |
| (void *) image_base); |
| if (image_flen <= 0) { |
| printf("ERROR: Failed to load '%s' file from semihosting (%i).\r\n", |
| image_name, image_flen); |
| return 0; |
| } |
| |
| /* |
| * File has been successfully loaded. Update the free memory |
| * data structure & flush the contents of the TZRAM so that |
| * the next EL can see it. |
| */ |
| /* Update the memory contents */ |
| flush_dcache_range(image_base, image_flen); |
| |
| mem_layout->free_size -= image_flen + offset; |
| |
| /* Update the base of free memory since its moved up */ |
| if (load_type == BOT_LOAD) |
| mem_layout->free_base += offset + image_flen; |
| |
| return image_base; |
| } |
| |
| /******************************************************************************* |
| * Run a loaded image from the given entry point. This could result in either |
| * dropping into a lower exception level or jumping to a higher exception level. |
| * The only way of doing the latter is through an SMC. In either case, setup the |
| * parameters for the EL change request correctly. |
| ******************************************************************************/ |
| int run_image(unsigned long entrypoint, |
| unsigned long spsr, |
| unsigned long target_security_state, |
| meminfo *mem_layout, |
| void *data) |
| { |
| el_change_info run_image_info; |
| unsigned long current_el = read_current_el(); |
| |
| /* Tell next EL what we want done */ |
| run_image_info.args.arg0 = RUN_IMAGE; |
| run_image_info.entrypoint = entrypoint; |
| run_image_info.spsr = spsr; |
| run_image_info.security_state = target_security_state; |
| run_image_info.next = 0; |
| |
| /* |
| * If we are EL3 then only an eret can take us to the desired |
| * exception level. Else for the time being assume that we have |
| * to jump to a higher EL and issue an SMC. Contents of argY |
| * will go into the general purpose register xY e.g. arg0->x0 |
| */ |
| if (GET_EL(current_el) == MODE_EL3) { |
| run_image_info.args.arg1 = (unsigned long) mem_layout; |
| run_image_info.args.arg2 = (unsigned long) data; |
| } else { |
| run_image_info.args.arg1 = entrypoint; |
| run_image_info.args.arg2 = spsr; |
| run_image_info.args.arg3 = (unsigned long) mem_layout; |
| run_image_info.args.arg4 = (unsigned long) data; |
| } |
| |
| return change_el(&run_image_info); |
| } |