1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2015-2023, Linaro Limited 4 * Copyright (c) 2023, Arm Limited 5 */ 6 7 #include <arm.h> 8 #include <assert.h> 9 #include <compiler.h> 10 #include <config.h> 11 #include <console.h> 12 #include <crypto/crypto.h> 13 #include <drivers/gic.h> 14 #include <dt-bindings/interrupt-controller/arm-gic.h> 15 #include <ffa.h> 16 #include <initcall.h> 17 #include <inttypes.h> 18 #include <io.h> 19 #include <keep.h> 20 #include <kernel/asan.h> 21 #include <kernel/boot.h> 22 #include <kernel/dt.h> 23 #include <kernel/linker.h> 24 #include <kernel/misc.h> 25 #include <kernel/panic.h> 26 #include <kernel/tee_misc.h> 27 #include <kernel/thread.h> 28 #include <kernel/tpm.h> 29 #include <kernel/transfer_list.h> 30 #include <libfdt.h> 31 #include <malloc.h> 32 #include <memtag.h> 33 #include <mm/core_memprot.h> 34 #include <mm/core_mmu.h> 35 #include <mm/fobj.h> 36 #include <mm/page_alloc.h> 37 #include <mm/phys_mem.h> 38 #include <mm/tee_mm.h> 39 #include <mm/tee_pager.h> 40 #include <sm/psci.h> 41 #include <stdalign.h> 42 #include <trace.h> 43 #include <utee_defines.h> 44 #include <util.h> 45 46 #include <platform_config.h> 47 48 #if !defined(CFG_WITH_ARM_TRUSTED_FW) 49 #include <sm/sm.h> 50 #endif 51 52 #if defined(CFG_WITH_VFP) 53 #include <kernel/vfp.h> 54 #endif 55 56 /* 57 * In this file we're using unsigned long to represent physical pointers as 58 * they are received in a single register when OP-TEE is initially entered. 59 * This limits 32-bit systems to only use make use of the lower 32 bits 60 * of a physical address for initial parameters. 61 * 62 * 64-bit systems on the other hand can use full 64-bit physical pointers. 63 */ 64 #define PADDR_INVALID ULONG_MAX 65 66 #if defined(CFG_BOOT_SECONDARY_REQUEST) 67 struct ns_entry_context { 68 uintptr_t entry_point; 69 uintptr_t context_id; 70 }; 71 struct ns_entry_context ns_entry_contexts[CFG_TEE_CORE_NB_CORE]; 72 static uint32_t spin_table[CFG_TEE_CORE_NB_CORE]; 73 #endif 74 75 #ifdef CFG_BOOT_SYNC_CPU 76 /* 77 * Array used when booting, to synchronize cpu. 78 * When 0, the cpu has not started. 79 * When 1, it has started 80 */ 81 uint32_t sem_cpu_sync[CFG_TEE_CORE_NB_CORE]; 82 DECLARE_KEEP_PAGER(sem_cpu_sync); 83 #endif 84 85 /* 86 * Must not be in .bss since it's initialized and used from assembly before 87 * .bss is cleared. 88 */ 89 vaddr_t boot_cached_mem_end __nex_data = 1; 90 91 static unsigned long boot_arg_fdt __nex_bss; 92 unsigned long boot_arg_nsec_entry __nex_bss; 93 static unsigned long boot_arg_pageable_part __nex_bss; 94 static unsigned long boot_arg_transfer_list __nex_bss; 95 static struct transfer_list_header *mapped_tl __nex_bss; 96 97 #ifdef CFG_SECONDARY_INIT_CNTFRQ 98 static uint32_t cntfrq; 99 #endif 100 101 /* May be overridden in plat-$(PLATFORM)/main.c */ 102 __weak void plat_primary_init_early(void) 103 { 104 } 105 DECLARE_KEEP_PAGER(plat_primary_init_early); 106 107 /* May be overridden in plat-$(PLATFORM)/main.c */ 108 __weak void boot_primary_init_intc(void) 109 { 110 } 111 112 /* May be overridden in plat-$(PLATFORM)/main.c */ 113 __weak void boot_secondary_init_intc(void) 114 { 115 } 116 117 /* May be overridden in plat-$(PLATFORM)/main.c */ 118 __weak unsigned long plat_get_aslr_seed(void) 119 { 120 DMSG("Warning: no ASLR seed"); 121 122 return 0; 123 } 124 125 /* 126 * This function is called as a guard after each smc call which is not 127 * supposed to return. 128 */ 129 void __panic_at_smc_return(void) 130 { 131 panic(); 132 } 133 134 #if defined(CFG_WITH_ARM_TRUSTED_FW) 135 void init_sec_mon(unsigned long nsec_entry __maybe_unused) 136 { 137 assert(nsec_entry == PADDR_INVALID); 138 /* Do nothing as we don't have a secure monitor */ 139 } 140 #else 141 /* May be overridden in plat-$(PLATFORM)/main.c */ 142 __weak void init_sec_mon(unsigned long nsec_entry) 143 { 144 struct sm_nsec_ctx *nsec_ctx; 145 146 assert(nsec_entry != PADDR_INVALID); 147 148 /* Initialize secure monitor */ 149 nsec_ctx = sm_get_nsec_ctx(); 150 nsec_ctx->mon_lr = nsec_entry; 151 nsec_ctx->mon_spsr = CPSR_MODE_SVC | CPSR_I; 152 if (nsec_entry & 1) 153 nsec_ctx->mon_spsr |= CPSR_T; 154 } 155 #endif 156 157 #if defined(CFG_WITH_ARM_TRUSTED_FW) 158 static void init_vfp_nsec(void) 159 { 160 } 161 #else 162 static void init_vfp_nsec(void) 163 { 164 /* Normal world can use CP10 and CP11 (SIMD/VFP) */ 165 write_nsacr(read_nsacr() | NSACR_CP10 | NSACR_CP11); 166 } 167 #endif 168 169 static void check_crypto_extensions(void) 170 { 171 bool ce_supported = true; 172 173 if (!feat_aes_implemented() && 174 IS_ENABLED(CFG_CRYPTO_AES_ARM_CE)) { 175 EMSG("AES instructions are not supported"); 176 ce_supported = false; 177 } 178 179 if (!feat_sha1_implemented() && 180 IS_ENABLED(CFG_CRYPTO_SHA1_ARM_CE)) { 181 EMSG("SHA1 instructions are not supported"); 182 ce_supported = false; 183 } 184 185 if (!feat_sha256_implemented() && 186 IS_ENABLED(CFG_CRYPTO_SHA256_ARM_CE)) { 187 EMSG("SHA256 instructions are not supported"); 188 ce_supported = false; 189 } 190 191 /* Check aarch64 specific instructions */ 192 if (IS_ENABLED(CFG_ARM64_core)) { 193 if (!feat_sha512_implemented() && 194 IS_ENABLED(CFG_CRYPTO_SHA512_ARM_CE)) { 195 EMSG("SHA512 instructions are not supported"); 196 ce_supported = false; 197 } 198 199 if (!feat_sha3_implemented() && 200 IS_ENABLED(CFG_CRYPTO_SHA3_ARM_CE)) { 201 EMSG("SHA3 instructions are not supported"); 202 ce_supported = false; 203 } 204 205 if (!feat_sm3_implemented() && 206 IS_ENABLED(CFG_CRYPTO_SM3_ARM_CE)) { 207 EMSG("SM3 instructions are not supported"); 208 ce_supported = false; 209 } 210 211 if (!feat_sm4_implemented() && 212 IS_ENABLED(CFG_CRYPTO_SM4_ARM_CE)) { 213 EMSG("SM4 instructions are not supported"); 214 ce_supported = false; 215 } 216 } 217 218 if (!ce_supported) 219 panic("HW doesn't support CE instructions"); 220 } 221 222 #if defined(CFG_WITH_VFP) 223 224 #ifdef ARM32 225 static void init_vfp_sec(void) 226 { 227 uint32_t cpacr = read_cpacr(); 228 229 /* 230 * Enable Advanced SIMD functionality. 231 * Enable use of D16-D31 of the Floating-point Extension register 232 * file. 233 */ 234 cpacr &= ~(CPACR_ASEDIS | CPACR_D32DIS); 235 /* 236 * Enable usage of CP10 and CP11 (SIMD/VFP) (both kernel and user 237 * mode. 238 */ 239 cpacr |= CPACR_CP(10, CPACR_CP_ACCESS_FULL); 240 cpacr |= CPACR_CP(11, CPACR_CP_ACCESS_FULL); 241 write_cpacr(cpacr); 242 } 243 #endif /* ARM32 */ 244 245 #ifdef ARM64 246 static void init_vfp_sec(void) 247 { 248 /* Not using VFP until thread_kernel_enable_vfp() */ 249 vfp_disable(); 250 } 251 #endif /* ARM64 */ 252 253 #else /* CFG_WITH_VFP */ 254 255 static void init_vfp_sec(void) 256 { 257 /* Not using VFP */ 258 } 259 #endif 260 261 #ifdef CFG_SECONDARY_INIT_CNTFRQ 262 static void primary_save_cntfrq(void) 263 { 264 assert(cntfrq == 0); 265 266 /* 267 * CNTFRQ should be initialized on the primary CPU by a 268 * previous boot stage 269 */ 270 cntfrq = read_cntfrq(); 271 } 272 273 static void secondary_init_cntfrq(void) 274 { 275 assert(cntfrq != 0); 276 write_cntfrq(cntfrq); 277 } 278 #else /* CFG_SECONDARY_INIT_CNTFRQ */ 279 static void primary_save_cntfrq(void) 280 { 281 } 282 283 static void secondary_init_cntfrq(void) 284 { 285 } 286 #endif 287 288 #ifdef CFG_CORE_SANITIZE_KADDRESS 289 static void init_run_constructors(void) 290 { 291 const vaddr_t *ctor; 292 293 for (ctor = &__ctor_list; ctor < &__ctor_end; ctor++) 294 ((void (*)(void))(*ctor))(); 295 } 296 297 static void init_asan(void) 298 { 299 300 /* 301 * CFG_ASAN_SHADOW_OFFSET is also supplied as 302 * -fasan-shadow-offset=$(CFG_ASAN_SHADOW_OFFSET) to the compiler. 303 * Since all the needed values to calculate the value of 304 * CFG_ASAN_SHADOW_OFFSET isn't available in to make we need to 305 * calculate it in advance and hard code it into the platform 306 * conf.mk. Here where we have all the needed values we double 307 * check that the compiler is supplied the correct value. 308 */ 309 310 #define __ASAN_SHADOW_START \ 311 ROUNDUP(TEE_RAM_START + (TEE_RAM_VA_SIZE * 8) / 9 - 8, 8) 312 assert(__ASAN_SHADOW_START == (vaddr_t)&__asan_shadow_start); 313 #define __CFG_ASAN_SHADOW_OFFSET \ 314 (__ASAN_SHADOW_START - (TEE_RAM_START / 8)) 315 COMPILE_TIME_ASSERT(CFG_ASAN_SHADOW_OFFSET == __CFG_ASAN_SHADOW_OFFSET); 316 #undef __ASAN_SHADOW_START 317 #undef __CFG_ASAN_SHADOW_OFFSET 318 319 /* 320 * Assign area covered by the shadow area, everything from start up 321 * to the beginning of the shadow area. 322 */ 323 asan_set_shadowed((void *)TEE_LOAD_ADDR, &__asan_shadow_start); 324 325 /* 326 * Add access to areas that aren't opened automatically by a 327 * constructor. 328 */ 329 asan_tag_access(&__ctor_list, &__ctor_end); 330 asan_tag_access(__rodata_start, __rodata_end); 331 #ifdef CFG_WITH_PAGER 332 asan_tag_access(__pageable_start, __pageable_end); 333 #endif /*CFG_WITH_PAGER*/ 334 asan_tag_access(__nozi_start, __nozi_end); 335 #ifdef ARM32 336 asan_tag_access(__exidx_start, __exidx_end); 337 asan_tag_access(__extab_start, __extab_end); 338 #endif 339 340 init_run_constructors(); 341 342 /* Everything is tagged correctly, let's start address sanitizing. */ 343 asan_start(); 344 } 345 #else /*CFG_CORE_SANITIZE_KADDRESS*/ 346 static void init_asan(void) 347 { 348 } 349 #endif /*CFG_CORE_SANITIZE_KADDRESS*/ 350 351 #if defined(CFG_MEMTAG) 352 /* Called from entry_a64.S only when MEMTAG is configured */ 353 void boot_init_memtag(void) 354 { 355 memtag_init_ops(feat_mte_implemented()); 356 } 357 358 static TEE_Result mmap_clear_memtag(struct tee_mmap_region *map, 359 void *ptr __unused) 360 { 361 switch (map->type) { 362 case MEM_AREA_NEX_RAM_RO: 363 case MEM_AREA_SEC_RAM_OVERALL: 364 DMSG("Clearing tags for VA %#"PRIxVA"..%#"PRIxVA, 365 map->va, map->va + map->size - 1); 366 memtag_set_tags((void *)map->va, map->size, 0); 367 break; 368 default: 369 break; 370 } 371 372 return TEE_SUCCESS; 373 } 374 375 /* Called from entry_a64.S only when MEMTAG is configured */ 376 void boot_clear_memtag(void) 377 { 378 core_mmu_for_each_map(NULL, mmap_clear_memtag); 379 } 380 #endif 381 382 #ifdef CFG_WITH_PAGER 383 384 #ifdef CFG_CORE_SANITIZE_KADDRESS 385 static void carve_out_asan_mem(void) 386 { 387 nex_phys_mem_partial_carve_out(ASAN_MAP_PA, ASAN_MAP_SZ); 388 } 389 #else 390 static void carve_out_asan_mem(void) 391 { 392 } 393 #endif 394 395 static void print_pager_pool_size(void) 396 { 397 struct tee_pager_stats __maybe_unused stats; 398 399 tee_pager_get_stats(&stats); 400 IMSG("Pager pool size: %zukB", 401 stats.npages_all * SMALL_PAGE_SIZE / 1024); 402 } 403 404 static void init_virt_pool(tee_mm_pool_t *virt_pool) 405 { 406 const vaddr_t begin = VCORE_START_VA; 407 size_t size = TEE_RAM_VA_SIZE; 408 409 #ifdef CFG_CORE_SANITIZE_KADDRESS 410 /* Carve out asan memory, flat maped after core memory */ 411 if (begin + size > ASAN_SHADOW_PA) 412 size = ASAN_MAP_PA - begin; 413 #endif 414 415 if (!tee_mm_init(virt_pool, begin, size, SMALL_PAGE_SHIFT, 416 TEE_MM_POOL_NO_FLAGS)) 417 panic("core_virt_mem_pool init failed"); 418 } 419 420 /* 421 * With CFG_CORE_ASLR=y the init part is relocated very early during boot. 422 * The init part is also paged just as the rest of the normal paged code, with 423 * the difference that it's preloaded during boot. When the backing store 424 * is configured the entire paged binary is copied in place and then also 425 * the init part. Since the init part has been relocated (references to 426 * addresses updated to compensate for the new load address) this has to be 427 * undone for the hashes of those pages to match with the original binary. 428 * 429 * If CFG_CORE_ASLR=n, nothing needs to be done as the code/ro pages are 430 * unchanged. 431 */ 432 static void undo_init_relocation(uint8_t *paged_store __maybe_unused) 433 { 434 #ifdef CFG_CORE_ASLR 435 unsigned long *ptr = NULL; 436 const uint32_t *reloc = NULL; 437 const uint32_t *reloc_end = NULL; 438 unsigned long offs = boot_mmu_config.map_offset; 439 const struct boot_embdata *embdata = (const void *)__init_end; 440 vaddr_t addr_end = (vaddr_t)__init_end - offs - TEE_LOAD_ADDR; 441 vaddr_t addr_start = (vaddr_t)__init_start - offs - TEE_LOAD_ADDR; 442 443 reloc = (const void *)((vaddr_t)embdata + embdata->reloc_offset); 444 reloc_end = reloc + embdata->reloc_len / sizeof(*reloc); 445 446 for (; reloc < reloc_end; reloc++) { 447 if (*reloc < addr_start) 448 continue; 449 if (*reloc >= addr_end) 450 break; 451 ptr = (void *)(paged_store + *reloc - addr_start); 452 *ptr -= offs; 453 } 454 #endif 455 } 456 457 static struct fobj *ro_paged_alloc(tee_mm_entry_t *mm, void *hashes, 458 void *store) 459 { 460 const unsigned int num_pages = tee_mm_get_bytes(mm) / SMALL_PAGE_SIZE; 461 #ifdef CFG_CORE_ASLR 462 unsigned int reloc_offs = (vaddr_t)__pageable_start - VCORE_START_VA; 463 const struct boot_embdata *embdata = (const void *)__init_end; 464 const void *reloc = __init_end + embdata->reloc_offset; 465 466 return fobj_ro_reloc_paged_alloc(num_pages, hashes, reloc_offs, 467 reloc, embdata->reloc_len, store); 468 #else 469 return fobj_ro_paged_alloc(num_pages, hashes, store); 470 #endif 471 } 472 473 static void init_pager_runtime(unsigned long pageable_part) 474 { 475 size_t n; 476 size_t init_size = (size_t)(__init_end - __init_start); 477 size_t pageable_start = (size_t)__pageable_start; 478 size_t pageable_end = (size_t)__pageable_end; 479 size_t pageable_size = pageable_end - pageable_start; 480 vaddr_t tzsram_end = TZSRAM_BASE + TZSRAM_SIZE - TEE_LOAD_ADDR + 481 VCORE_START_VA; 482 size_t hash_size = (pageable_size / SMALL_PAGE_SIZE) * 483 TEE_SHA256_HASH_SIZE; 484 const struct boot_embdata *embdata = (const void *)__init_end; 485 const void *tmp_hashes = NULL; 486 tee_mm_entry_t *mm = NULL; 487 struct fobj *fobj = NULL; 488 uint8_t *paged_store = NULL; 489 uint8_t *hashes = NULL; 490 491 assert(pageable_size % SMALL_PAGE_SIZE == 0); 492 assert(embdata->total_len >= embdata->hashes_offset + 493 embdata->hashes_len); 494 assert(hash_size == embdata->hashes_len); 495 496 tmp_hashes = __init_end + embdata->hashes_offset; 497 498 /* 499 * This needs to be initialized early to support address lookup 500 * in MEM_AREA_TEE_RAM 501 */ 502 tee_pager_early_init(); 503 504 hashes = malloc(hash_size); 505 IMSG_RAW("\n"); 506 IMSG("Pager is enabled. Hashes: %zu bytes", hash_size); 507 assert(hashes); 508 asan_memcpy_unchecked(hashes, tmp_hashes, hash_size); 509 510 /* 511 * The pager is about the be enabled below, eventual temporary boot 512 * memory allocation must be removed now. 513 */ 514 boot_mem_release_tmp_alloc(); 515 516 carve_out_asan_mem(); 517 518 mm = nex_phys_mem_ta_alloc(pageable_size); 519 assert(mm); 520 paged_store = phys_to_virt(tee_mm_get_smem(mm), 521 MEM_AREA_SEC_RAM_OVERALL, pageable_size); 522 /* 523 * Load pageable part in the dedicated allocated area: 524 * - Move pageable non-init part into pageable area. Note bootloader 525 * may have loaded it anywhere in TA RAM hence use memmove(). 526 * - Copy pageable init part from current location into pageable area. 527 */ 528 memmove(paged_store + init_size, 529 phys_to_virt(pageable_part, 530 core_mmu_get_type_by_pa(pageable_part), 531 __pageable_part_end - __pageable_part_start), 532 __pageable_part_end - __pageable_part_start); 533 asan_memcpy_unchecked(paged_store, __init_start, init_size); 534 /* 535 * Undo eventual relocation for the init part so the hash checks 536 * can pass. 537 */ 538 undo_init_relocation(paged_store); 539 540 /* Check that hashes of what's in pageable area is OK */ 541 DMSG("Checking hashes of pageable area"); 542 for (n = 0; (n * SMALL_PAGE_SIZE) < pageable_size; n++) { 543 const uint8_t *hash = hashes + n * TEE_SHA256_HASH_SIZE; 544 const uint8_t *page = paged_store + n * SMALL_PAGE_SIZE; 545 TEE_Result res; 546 547 DMSG("hash pg_idx %zu hash %p page %p", n, hash, page); 548 res = hash_sha256_check(hash, page, SMALL_PAGE_SIZE); 549 if (res != TEE_SUCCESS) { 550 EMSG("Hash failed for page %zu at %p: res 0x%x", 551 n, (void *)page, res); 552 panic(); 553 } 554 } 555 556 /* 557 * Assert prepaged init sections are page aligned so that nothing 558 * trails uninited at the end of the premapped init area. 559 */ 560 assert(!(init_size & SMALL_PAGE_MASK)); 561 562 /* 563 * Initialize the virtual memory pool used for main_mmu_l2_ttb which 564 * is supplied to tee_pager_init() below. 565 */ 566 init_virt_pool(&core_virt_mem_pool); 567 568 /* 569 * Assign alias area for pager end of the small page block the rest 570 * of the binary is loaded into. We're taking more than needed, but 571 * we're guaranteed to not need more than the physical amount of 572 * TZSRAM. 573 */ 574 mm = tee_mm_alloc2(&core_virt_mem_pool, 575 (vaddr_t)core_virt_mem_pool.lo + 576 core_virt_mem_pool.size - TZSRAM_SIZE, 577 TZSRAM_SIZE); 578 assert(mm); 579 tee_pager_set_alias_area(mm); 580 581 /* 582 * Claim virtual memory which isn't paged. 583 * Linear memory (flat map core memory) ends there. 584 */ 585 mm = tee_mm_alloc2(&core_virt_mem_pool, VCORE_UNPG_RX_PA, 586 (vaddr_t)(__pageable_start - VCORE_UNPG_RX_PA)); 587 assert(mm); 588 589 /* 590 * Allocate virtual memory for the pageable area and let the pager 591 * take charge of all the pages already assigned to that memory. 592 */ 593 mm = tee_mm_alloc2(&core_virt_mem_pool, (vaddr_t)__pageable_start, 594 pageable_size); 595 assert(mm); 596 fobj = ro_paged_alloc(mm, hashes, paged_store); 597 assert(fobj); 598 tee_pager_add_core_region(tee_mm_get_smem(mm), PAGED_REGION_TYPE_RO, 599 fobj); 600 fobj_put(fobj); 601 602 tee_pager_add_pages(pageable_start, init_size / SMALL_PAGE_SIZE, false); 603 tee_pager_add_pages(pageable_start + init_size, 604 (pageable_size - init_size) / SMALL_PAGE_SIZE, 605 true); 606 if (pageable_end < tzsram_end) 607 tee_pager_add_pages(pageable_end, (tzsram_end - pageable_end) / 608 SMALL_PAGE_SIZE, true); 609 610 /* 611 * There may be physical pages in TZSRAM before the core load address. 612 * These pages can be added to the physical pages pool of the pager. 613 * This setup may happen when a the secure bootloader runs in TZRAM 614 * and its memory can be reused by OP-TEE once boot stages complete. 615 */ 616 tee_pager_add_pages(core_virt_mem_pool.lo, 617 (VCORE_UNPG_RX_PA - core_virt_mem_pool.lo) / 618 SMALL_PAGE_SIZE, 619 true); 620 621 print_pager_pool_size(); 622 } 623 #else /*!CFG_WITH_PAGER*/ 624 static void init_pager_runtime(unsigned long pageable_part __unused) 625 { 626 } 627 #endif 628 629 #if defined(CFG_DT) 630 static int add_optee_dt_node(struct dt_descriptor *dt) 631 { 632 int offs; 633 int ret; 634 635 if (fdt_path_offset(dt->blob, "/firmware/optee") >= 0) { 636 DMSG("OP-TEE Device Tree node already exists!"); 637 return 0; 638 } 639 640 offs = fdt_path_offset(dt->blob, "/firmware"); 641 if (offs < 0) { 642 offs = add_dt_path_subnode(dt, "/", "firmware"); 643 if (offs < 0) 644 return -1; 645 } 646 647 offs = fdt_add_subnode(dt->blob, offs, "optee"); 648 if (offs < 0) 649 return -1; 650 651 ret = fdt_setprop_string(dt->blob, offs, "compatible", 652 "linaro,optee-tz"); 653 if (ret < 0) 654 return -1; 655 ret = fdt_setprop_string(dt->blob, offs, "method", "smc"); 656 if (ret < 0) 657 return -1; 658 659 if (CFG_CORE_ASYNC_NOTIF_GIC_INTID) { 660 /* 661 * The format of the interrupt property is defined by the 662 * binding of the interrupt domain root. In this case it's 663 * one Arm GIC v1, v2 or v3 so we must be compatible with 664 * these. 665 * 666 * An SPI type of interrupt is indicated with a 0 in the 667 * first cell. A PPI type is indicated with value 1. 668 * 669 * The interrupt number goes in the second cell where 670 * SPIs ranges from 0 to 987 and PPI ranges from 0 to 15. 671 * 672 * Flags are passed in the third cells. 673 */ 674 uint32_t itr_trigger = 0; 675 uint32_t itr_type = 0; 676 uint32_t itr_id = 0; 677 uint32_t val[3] = { }; 678 679 /* PPI are visible only in current CPU cluster */ 680 static_assert(IS_ENABLED(CFG_CORE_FFA) || 681 !CFG_CORE_ASYNC_NOTIF_GIC_INTID || 682 (CFG_CORE_ASYNC_NOTIF_GIC_INTID >= 683 GIC_SPI_BASE) || 684 ((CFG_TEE_CORE_NB_CORE <= 8) && 685 (CFG_CORE_ASYNC_NOTIF_GIC_INTID >= 686 GIC_PPI_BASE))); 687 688 if (CFG_CORE_ASYNC_NOTIF_GIC_INTID >= GIC_SPI_BASE) { 689 itr_type = GIC_SPI; 690 itr_id = CFG_CORE_ASYNC_NOTIF_GIC_INTID - GIC_SPI_BASE; 691 itr_trigger = IRQ_TYPE_EDGE_RISING; 692 } else { 693 itr_type = GIC_PPI; 694 itr_id = CFG_CORE_ASYNC_NOTIF_GIC_INTID - GIC_PPI_BASE; 695 itr_trigger = IRQ_TYPE_EDGE_RISING | 696 GIC_CPU_MASK_SIMPLE(CFG_TEE_CORE_NB_CORE); 697 } 698 699 val[0] = TEE_U32_TO_BIG_ENDIAN(itr_type); 700 val[1] = TEE_U32_TO_BIG_ENDIAN(itr_id); 701 val[2] = TEE_U32_TO_BIG_ENDIAN(itr_trigger); 702 703 ret = fdt_setprop(dt->blob, offs, "interrupts", val, 704 sizeof(val)); 705 if (ret < 0) 706 return -1; 707 } 708 return 0; 709 } 710 711 #ifdef CFG_PSCI_ARM32 712 static int append_psci_compatible(void *fdt, int offs, const char *str) 713 { 714 return fdt_appendprop(fdt, offs, "compatible", str, strlen(str) + 1); 715 } 716 717 static int dt_add_psci_node(struct dt_descriptor *dt) 718 { 719 int offs; 720 721 if (fdt_path_offset(dt->blob, "/psci") >= 0) { 722 DMSG("PSCI Device Tree node already exists!"); 723 return 0; 724 } 725 726 offs = add_dt_path_subnode(dt, "/", "psci"); 727 if (offs < 0) 728 return -1; 729 if (append_psci_compatible(dt->blob, offs, "arm,psci-1.0")) 730 return -1; 731 if (append_psci_compatible(dt->blob, offs, "arm,psci-0.2")) 732 return -1; 733 if (append_psci_compatible(dt->blob, offs, "arm,psci")) 734 return -1; 735 if (fdt_setprop_string(dt->blob, offs, "method", "smc")) 736 return -1; 737 if (fdt_setprop_u32(dt->blob, offs, "cpu_suspend", PSCI_CPU_SUSPEND)) 738 return -1; 739 if (fdt_setprop_u32(dt->blob, offs, "cpu_off", PSCI_CPU_OFF)) 740 return -1; 741 if (fdt_setprop_u32(dt->blob, offs, "cpu_on", PSCI_CPU_ON)) 742 return -1; 743 if (fdt_setprop_u32(dt->blob, offs, "sys_poweroff", PSCI_SYSTEM_OFF)) 744 return -1; 745 if (fdt_setprop_u32(dt->blob, offs, "sys_reset", PSCI_SYSTEM_RESET)) 746 return -1; 747 return 0; 748 } 749 750 static int check_node_compat_prefix(struct dt_descriptor *dt, int offs, 751 const char *prefix) 752 { 753 const size_t prefix_len = strlen(prefix); 754 size_t l; 755 int plen; 756 const char *prop; 757 758 prop = fdt_getprop(dt->blob, offs, "compatible", &plen); 759 if (!prop) 760 return -1; 761 762 while (plen > 0) { 763 if (memcmp(prop, prefix, prefix_len) == 0) 764 return 0; /* match */ 765 766 l = strlen(prop) + 1; 767 prop += l; 768 plen -= l; 769 } 770 771 return -1; 772 } 773 774 static int dt_add_psci_cpu_enable_methods(struct dt_descriptor *dt) 775 { 776 int offs = 0; 777 778 while (1) { 779 offs = fdt_next_node(dt->blob, offs, NULL); 780 if (offs < 0) 781 break; 782 if (fdt_getprop(dt->blob, offs, "enable-method", NULL)) 783 continue; /* already set */ 784 if (check_node_compat_prefix(dt, offs, "arm,cortex-a")) 785 continue; /* no compatible */ 786 if (fdt_setprop_string(dt->blob, offs, "enable-method", "psci")) 787 return -1; 788 /* Need to restart scanning as offsets may have changed */ 789 offs = 0; 790 } 791 return 0; 792 } 793 794 static int config_psci(struct dt_descriptor *dt) 795 { 796 if (dt_add_psci_node(dt)) 797 return -1; 798 return dt_add_psci_cpu_enable_methods(dt); 799 } 800 #else 801 static int config_psci(struct dt_descriptor *dt __unused) 802 { 803 return 0; 804 } 805 #endif /*CFG_PSCI_ARM32*/ 806 807 static int mark_tzdram_as_reserved(struct dt_descriptor *dt) 808 { 809 return add_res_mem_dt_node(dt, "optee_core", CFG_TZDRAM_START, 810 CFG_TZDRAM_SIZE); 811 } 812 813 static void update_external_dt(void) 814 { 815 struct dt_descriptor *dt = get_external_dt_desc(); 816 817 if (!dt || !dt->blob) 818 return; 819 820 if (!IS_ENABLED(CFG_CORE_FFA) && add_optee_dt_node(dt)) 821 panic("Failed to add OP-TEE Device Tree node"); 822 823 if (config_psci(dt)) 824 panic("Failed to config PSCI"); 825 826 #ifdef CFG_CORE_RESERVED_SHM 827 if (mark_static_shm_as_reserved(dt)) 828 panic("Failed to config non-secure memory"); 829 #endif 830 831 if (mark_tzdram_as_reserved(dt)) 832 panic("Failed to config secure memory"); 833 } 834 #else /*CFG_DT*/ 835 static void update_external_dt(void) 836 { 837 } 838 #endif /*!CFG_DT*/ 839 840 void init_tee_runtime(void) 841 { 842 /* 843 * With virtualization we call this function when creating the 844 * OP-TEE partition instead. 845 */ 846 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) 847 call_preinitcalls(); 848 call_early_initcalls(); 849 call_service_initcalls(); 850 851 /* 852 * These two functions uses crypto_rng_read() to initialize the 853 * pauth keys. Once call_initcalls() returns we're guaranteed that 854 * crypto_rng_read() is ready to be used. 855 */ 856 thread_init_core_local_pauth_keys(); 857 thread_init_thread_pauth_keys(); 858 859 /* 860 * Reinitialize canaries around the stacks with crypto_rng_read(). 861 * 862 * TODO: Updating canaries when CFG_NS_VIRTUALIZATION is enabled will 863 * require synchronization between thread_check_canaries() and 864 * thread_update_canaries(). 865 */ 866 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) 867 thread_update_canaries(); 868 } 869 870 static bool add_padding_to_pool(vaddr_t va, size_t len, void *ptr __unused) 871 { 872 #ifdef CFG_NS_VIRTUALIZATION 873 nex_malloc_add_pool((void *)va, len); 874 #else 875 malloc_add_pool((void *)va, len); 876 #endif 877 return true; 878 } 879 880 static void init_primary(unsigned long pageable_part) 881 { 882 vaddr_t va = 0; 883 884 /* 885 * Mask asynchronous exceptions before switch to the thread vector 886 * as the thread handler requires those to be masked while 887 * executing with the temporary stack. The thread subsystem also 888 * asserts that the foreign interrupts are blocked when using most of 889 * its functions. 890 */ 891 thread_set_exceptions(THREAD_EXCP_ALL); 892 primary_save_cntfrq(); 893 init_vfp_sec(); 894 895 if (IS_ENABLED(CFG_CRYPTO_WITH_CE)) 896 check_crypto_extensions(); 897 898 init_asan(); 899 900 /* 901 * By default whole OP-TEE uses malloc, so we need to initialize 902 * it early. But, when virtualization is enabled, malloc is used 903 * only by TEE runtime, so malloc should be initialized later, for 904 * every virtual partition separately. Core code uses nex_malloc 905 * instead. 906 */ 907 #ifdef CFG_WITH_PAGER 908 /* Add heap2 first as heap1 may be too small as initial bget pool */ 909 malloc_add_pool(__heap2_start, __heap2_end - __heap2_start); 910 #endif 911 #ifdef CFG_NS_VIRTUALIZATION 912 nex_malloc_add_pool(__nex_heap_start, __nex_heap_end - 913 __nex_heap_start); 914 #else 915 malloc_add_pool(__heap1_start, __heap1_end - __heap1_start); 916 #endif 917 IMSG_RAW("\n"); 918 if (IS_ENABLED(CFG_DYN_CONFIG)) { 919 size_t sz = sizeof(struct thread_core_local) * 920 CFG_TEE_CORE_NB_CORE; 921 void *p = boot_mem_alloc(sz, alignof(void *) * 2); 922 923 #ifdef CFG_NS_VIRTUALIZATION 924 nex_malloc_add_pool(p, sz); 925 #else 926 malloc_add_pool(p, sz); 927 #endif 928 } 929 930 core_mmu_save_mem_map(); 931 core_mmu_init_phys_mem(); 932 boot_mem_foreach_padding(add_padding_to_pool, NULL); 933 va = boot_mem_release_unused(); 934 if (!IS_ENABLED(CFG_WITH_PAGER)) { 935 /* 936 * We must update boot_cached_mem_end to reflect the memory 937 * just unmapped by boot_mem_release_unused(). 938 */ 939 assert(va && va <= boot_cached_mem_end); 940 boot_cached_mem_end = va; 941 } 942 943 if (IS_ENABLED(CFG_DYN_CONFIG)) { 944 /* 945 * This is needed to enable virt_page_alloc() now that 946 * boot_mem_alloc() can't be used any longer. 947 */ 948 if (IS_ENABLED(CFG_NS_VIRTUALIZATION)) 949 nex_page_alloc_init(); 950 else 951 page_alloc_init(); 952 } 953 954 if (IS_ENABLED(CFG_WITH_PAGER)) { 955 /* 956 * Pager: init_runtime() calls thread_kernel_enable_vfp() 957 * so we must set a current thread right now to avoid a 958 * chicken-and-egg problem (thread_init_boot_thread() sets 959 * the current thread but needs things set by 960 * init_runtime()). 961 */ 962 thread_get_core_local()->curr_thread = 0; 963 init_pager_runtime(pageable_part); 964 } 965 966 /* Initialize canaries around the stacks */ 967 thread_init_canaries(); 968 thread_init_per_cpu(); 969 } 970 971 static bool cpu_nmfi_enabled(void) 972 { 973 #if defined(ARM32) 974 return read_sctlr() & SCTLR_NMFI; 975 #else 976 /* Note: ARM64 does not feature non-maskable FIQ support. */ 977 return false; 978 #endif 979 } 980 981 /* 982 * Note: this function is weak just to make it possible to exclude it from 983 * the unpaged area. 984 */ 985 void __weak boot_init_primary_late(unsigned long fdt __unused, 986 unsigned long manifest __unused) 987 { 988 size_t fdt_size = CFG_DTB_MAX_SIZE; 989 990 if (IS_ENABLED(CFG_TRANSFER_LIST) && mapped_tl) { 991 struct transfer_list_entry *tl_e = NULL; 992 993 tl_e = transfer_list_find(mapped_tl, TL_TAG_FDT); 994 if (tl_e) { 995 /* 996 * Expand the data size of the DTB entry to the maximum 997 * allocable mapped memory to reserve sufficient space 998 * for inserting new nodes, avoid potentially corrupting 999 * next entries. 1000 */ 1001 uint32_t dtb_max_sz = mapped_tl->max_size - 1002 mapped_tl->size + tl_e->data_size; 1003 1004 if (!transfer_list_set_data_size(mapped_tl, tl_e, 1005 dtb_max_sz)) { 1006 EMSG("Failed to extend DTB size to %#"PRIx32, 1007 dtb_max_sz); 1008 panic(); 1009 } 1010 fdt_size = tl_e->data_size; 1011 } 1012 } 1013 1014 init_external_dt(boot_arg_fdt, fdt_size); 1015 reinit_manifest_dt(); 1016 #ifdef CFG_CORE_SEL1_SPMC 1017 tpm_map_log_area(get_manifest_dt()); 1018 #else 1019 tpm_map_log_area(get_external_dt()); 1020 #endif 1021 discover_nsec_memory(); 1022 update_external_dt(); 1023 configure_console_from_dt(); 1024 1025 if (IS_ENABLED(CFG_NS_VIRTUALIZATION)) { 1026 /* 1027 * Virtualization: We can't initialize threads right now because 1028 * threads belong to "tee" part and will be initialized 1029 * separately per each new virtual guest. So, we'll clear 1030 * "curr_thread" and call it done. 1031 */ 1032 thread_get_core_local()->curr_thread = -1; 1033 } else { 1034 thread_init_boot_thread(); 1035 } 1036 thread_init_thread_core_local(CFG_TEE_CORE_NB_CORE); 1037 } 1038 1039 void __weak boot_init_primary_runtime(void) 1040 { 1041 thread_init_primary(); 1042 IMSG("OP-TEE version: %s", core_v_str); 1043 if (IS_ENABLED(CFG_INSECURE)) { 1044 IMSG("WARNING: This OP-TEE configuration might be insecure!"); 1045 IMSG("WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html"); 1046 } 1047 IMSG("Primary CPU initializing"); 1048 #ifdef CFG_CORE_ASLR 1049 DMSG("Executing at offset %#lx with virtual load address %#"PRIxVA, 1050 (unsigned long)boot_mmu_config.map_offset, VCORE_START_VA); 1051 #endif 1052 #ifdef CFG_NS_VIRTUALIZATION 1053 DMSG("NS-virtualization enabled, supporting %u guests", 1054 CFG_VIRT_GUEST_COUNT); 1055 #endif 1056 if (IS_ENABLED(CFG_MEMTAG)) 1057 DMSG("Memory tagging %s", 1058 memtag_is_enabled() ? "enabled" : "disabled"); 1059 1060 /* Check if platform needs NMFI workaround */ 1061 if (cpu_nmfi_enabled()) { 1062 if (!IS_ENABLED(CFG_CORE_WORKAROUND_ARM_NMFI)) 1063 IMSG("WARNING: This ARM core has NMFI enabled, please apply workaround!"); 1064 } else { 1065 if (IS_ENABLED(CFG_CORE_WORKAROUND_ARM_NMFI)) 1066 IMSG("WARNING: This ARM core does not have NMFI enabled, no need for workaround"); 1067 } 1068 1069 boot_primary_init_intc(); 1070 init_vfp_nsec(); 1071 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) { 1072 /* 1073 * Unmask native interrupts during driver initcalls. 1074 * 1075 * NS-virtualization still uses the temporary stack also 1076 * used for exception handling so it must still have native 1077 * interrupts masked. 1078 */ 1079 thread_set_exceptions(thread_get_exceptions() & 1080 ~THREAD_EXCP_NATIVE_INTR); 1081 init_tee_runtime(); 1082 } 1083 1084 if (!IS_ENABLED(CFG_WITH_PAGER)) 1085 boot_mem_release_tmp_alloc(); 1086 } 1087 1088 void __weak boot_init_primary_final(void) 1089 { 1090 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) 1091 call_driver_initcalls(); 1092 1093 call_finalcalls(); 1094 1095 IMSG("Primary CPU switching to normal world boot"); 1096 1097 /* Mask native interrupts before switching to the normal world */ 1098 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) 1099 thread_set_exceptions(thread_get_exceptions() | 1100 THREAD_EXCP_NATIVE_INTR); 1101 } 1102 1103 static void init_secondary_helper(void) 1104 { 1105 IMSG("Secondary CPU %zu initializing", get_core_pos()); 1106 1107 /* 1108 * Mask asynchronous exceptions before switch to the thread vector 1109 * as the thread handler requires those to be masked while 1110 * executing with the temporary stack. The thread subsystem also 1111 * asserts that the foreign interrupts are blocked when using most of 1112 * its functions. 1113 */ 1114 thread_set_exceptions(THREAD_EXCP_ALL); 1115 1116 secondary_init_cntfrq(); 1117 thread_init_per_cpu(); 1118 boot_secondary_init_intc(); 1119 init_vfp_sec(); 1120 init_vfp_nsec(); 1121 1122 IMSG("Secondary CPU %zu switching to normal world boot", get_core_pos()); 1123 } 1124 1125 /* 1126 * Note: this function is weak just to make it possible to exclude it from 1127 * the unpaged area so that it lies in the init area. 1128 */ 1129 void __weak boot_init_primary_early(void) 1130 { 1131 unsigned long pageable_part = 0; 1132 struct transfer_list_entry *tl_e = NULL; 1133 1134 if (IS_ENABLED(CFG_TRANSFER_LIST) && boot_arg_transfer_list) { 1135 /* map and save the TL */ 1136 mapped_tl = transfer_list_map(boot_arg_transfer_list); 1137 if (!mapped_tl) 1138 panic("Failed to map transfer list"); 1139 1140 transfer_list_dump(mapped_tl); 1141 tl_e = transfer_list_find(mapped_tl, TL_TAG_OPTEE_PAGABLE_PART); 1142 } 1143 1144 if (IS_ENABLED(CFG_WITH_PAGER)) { 1145 if (IS_ENABLED(CFG_TRANSFER_LIST) && tl_e) 1146 pageable_part = 1147 get_le64(transfer_list_entry_data(tl_e)); 1148 else 1149 pageable_part = boot_arg_pageable_part; 1150 } 1151 1152 init_primary(pageable_part); 1153 } 1154 1155 static void boot_save_transfer_list(unsigned long zero_reg, 1156 unsigned long transfer_list, 1157 unsigned long fdt) 1158 { 1159 struct transfer_list_header *tl = (void *)transfer_list; 1160 struct transfer_list_entry *tl_e = NULL; 1161 1162 if (zero_reg != 0) 1163 panic("Incorrect transfer list register convention"); 1164 1165 if (!IS_ALIGNED_WITH_TYPE(transfer_list, struct transfer_list_header) || 1166 !IS_ALIGNED(transfer_list, TL_ALIGNMENT_FROM_ORDER(tl->alignment))) 1167 panic("Transfer list base address is not aligned"); 1168 1169 if (transfer_list_check_header(tl) == TL_OPS_NONE) 1170 panic("Invalid transfer list"); 1171 1172 tl_e = transfer_list_find(tl, TL_TAG_FDT); 1173 if (fdt != (unsigned long)transfer_list_entry_data(tl_e)) 1174 panic("DT does not match to the DT entry of the TL"); 1175 1176 boot_arg_transfer_list = transfer_list; 1177 } 1178 1179 #if defined(CFG_WITH_ARM_TRUSTED_FW) 1180 unsigned long boot_cpu_on_handler(unsigned long a0 __maybe_unused, 1181 unsigned long a1 __unused) 1182 { 1183 init_secondary_helper(); 1184 return 0; 1185 } 1186 #else 1187 void boot_init_secondary(unsigned long nsec_entry __unused) 1188 { 1189 init_secondary_helper(); 1190 } 1191 #endif 1192 1193 #if defined(CFG_BOOT_SECONDARY_REQUEST) 1194 void boot_set_core_ns_entry(size_t core_idx, uintptr_t entry, 1195 uintptr_t context_id) 1196 { 1197 ns_entry_contexts[core_idx].entry_point = entry; 1198 ns_entry_contexts[core_idx].context_id = context_id; 1199 dsb_ishst(); 1200 } 1201 1202 int boot_core_release(size_t core_idx, paddr_t entry) 1203 { 1204 if (!core_idx || core_idx >= CFG_TEE_CORE_NB_CORE) 1205 return -1; 1206 1207 ns_entry_contexts[core_idx].entry_point = entry; 1208 dmb(); 1209 spin_table[core_idx] = 1; 1210 dsb(); 1211 sev(); 1212 1213 return 0; 1214 } 1215 1216 /* 1217 * spin until secondary boot request, then returns with 1218 * the secondary core entry address. 1219 */ 1220 struct ns_entry_context *boot_core_hpen(void) 1221 { 1222 #ifdef CFG_PSCI_ARM32 1223 return &ns_entry_contexts[get_core_pos()]; 1224 #else 1225 do { 1226 wfe(); 1227 } while (!spin_table[get_core_pos()]); 1228 dmb(); 1229 return &ns_entry_contexts[get_core_pos()]; 1230 #endif 1231 } 1232 #endif 1233 1234 #if defined(CFG_CORE_ASLR) 1235 #if defined(CFG_DT) 1236 unsigned long __weak get_aslr_seed(void) 1237 { 1238 void *fdt = NULL; 1239 int rc = 0; 1240 const uint64_t *seed = NULL; 1241 int offs = 0; 1242 int len = 0; 1243 1244 if (!IS_ENABLED(CFG_CORE_SEL2_SPMC)) 1245 fdt = (void *)boot_arg_fdt; 1246 1247 if (!fdt) { 1248 DMSG("No fdt"); 1249 goto err; 1250 } 1251 1252 rc = fdt_check_header(fdt); 1253 if (rc) { 1254 DMSG("Bad fdt: %d", rc); 1255 goto err; 1256 } 1257 1258 offs = fdt_path_offset(fdt, "/secure-chosen"); 1259 if (offs < 0) { 1260 DMSG("Cannot find /secure-chosen"); 1261 goto err; 1262 } 1263 seed = fdt_getprop(fdt, offs, "kaslr-seed", &len); 1264 if (!seed || len != sizeof(*seed)) { 1265 DMSG("Cannot find valid kaslr-seed"); 1266 goto err; 1267 } 1268 1269 return fdt64_to_cpu(fdt64_ld(seed)); 1270 1271 err: 1272 /* Try platform implementation */ 1273 return plat_get_aslr_seed(); 1274 } 1275 #else /*!CFG_DT*/ 1276 unsigned long __weak get_aslr_seed(void) 1277 { 1278 /* Try platform implementation */ 1279 return plat_get_aslr_seed(); 1280 } 1281 #endif /*!CFG_DT*/ 1282 #endif /*CFG_CORE_ASLR*/ 1283 1284 static void *get_fdt_from_boot_info(struct ffa_boot_info_header_1_1 *hdr) 1285 { 1286 struct ffa_boot_info_1_1 *desc = NULL; 1287 uint8_t content_fmt = 0; 1288 uint8_t name_fmt = 0; 1289 void *fdt = NULL; 1290 int ret = 0; 1291 1292 if (hdr->signature != FFA_BOOT_INFO_SIGNATURE) { 1293 EMSG("Bad boot info signature %#"PRIx32, hdr->signature); 1294 panic(); 1295 } 1296 if (hdr->version != FFA_BOOT_INFO_VERSION_1_1 && 1297 hdr->version != FFA_BOOT_INFO_VERSION_1_2) { 1298 EMSG("Bad boot info version %#"PRIx32, hdr->version); 1299 panic(); 1300 } 1301 if (hdr->desc_count != 1) { 1302 EMSG("Bad boot info descriptor count %#"PRIx32, 1303 hdr->desc_count); 1304 panic(); 1305 } 1306 desc = (void *)((vaddr_t)hdr + hdr->desc_offset); 1307 name_fmt = desc->flags & FFA_BOOT_INFO_FLAG_NAME_FORMAT_MASK; 1308 if (name_fmt == FFA_BOOT_INFO_FLAG_NAME_FORMAT_STRING) 1309 DMSG("Boot info descriptor name \"%16s\"", desc->name); 1310 else if (name_fmt == FFA_BOOT_INFO_FLAG_NAME_FORMAT_UUID) 1311 DMSG("Boot info descriptor UUID %pUl", (void *)desc->name); 1312 else 1313 DMSG("Boot info descriptor: unknown name format %"PRIu8, 1314 name_fmt); 1315 1316 content_fmt = (desc->flags & FFA_BOOT_INFO_FLAG_CONTENT_FORMAT_MASK) >> 1317 FFA_BOOT_INFO_FLAG_CONTENT_FORMAT_SHIFT; 1318 if (content_fmt != FFA_BOOT_INFO_FLAG_CONTENT_FORMAT_ADDR) { 1319 EMSG("Bad boot info content format %"PRIu8", expected %u (address)", 1320 content_fmt, FFA_BOOT_INFO_FLAG_CONTENT_FORMAT_ADDR); 1321 panic(); 1322 } 1323 1324 fdt = (void *)(vaddr_t)desc->contents; 1325 ret = fdt_check_full(fdt, desc->size); 1326 if (ret < 0) { 1327 EMSG("Invalid Device Tree at %p: error %d", fdt, ret); 1328 panic(); 1329 } 1330 return fdt; 1331 } 1332 1333 static void get_sec_mem_from_manifest(void *fdt, paddr_t *base, 1334 paddr_size_t *size) 1335 { 1336 int ret = 0; 1337 uint64_t num = 0; 1338 1339 ret = fdt_node_check_compatible(fdt, 0, "arm,ffa-manifest-1.0"); 1340 if (ret < 0) { 1341 EMSG("Invalid FF-A manifest at %p: error %d", fdt, ret); 1342 panic(); 1343 } 1344 ret = dt_getprop_as_number(fdt, 0, "load-address", &num); 1345 if (ret < 0) { 1346 EMSG("Can't read \"load-address\" from FF-A manifest at %p: error %d", 1347 fdt, ret); 1348 panic(); 1349 } 1350 *base = num; 1351 /* "mem-size" is currently an undocumented extension to the spec. */ 1352 ret = dt_getprop_as_number(fdt, 0, "mem-size", &num); 1353 if (ret < 0) { 1354 EMSG("Can't read \"mem-size\" from FF-A manifest at %p: error %d", 1355 fdt, ret); 1356 panic(); 1357 } 1358 *size = num; 1359 } 1360 1361 void __weak boot_save_args(unsigned long a0, unsigned long a1, 1362 unsigned long a2, unsigned long a3, 1363 unsigned long a4 __maybe_unused) 1364 { 1365 /* 1366 * Register use: 1367 * 1368 * Scenario A: Default arguments 1369 * a0 - CFG_CORE_FFA=y && CFG_CORE_SEL2_SPMC=n: 1370 * if non-NULL holds the TOS FW config [1] address 1371 * - CFG_CORE_FFA=y && 1372 (CFG_CORE_SEL2_SPMC=y || CFG_CORE_EL3_SPMC=y): 1373 * address of FF-A Boot Information Blob 1374 * - CFG_CORE_FFA=n: 1375 * if non-NULL holds the pagable part address 1376 * a1 - CFG_WITH_ARM_TRUSTED_FW=n (Armv7): 1377 * Armv7 standard bootarg #1 (kept track of in entry_a32.S) 1378 * a2 - CFG_CORE_SEL2_SPMC=n: 1379 * if non-NULL holds the system DTB address 1380 * - CFG_WITH_ARM_TRUSTED_FW=n (Armv7): 1381 * Armv7 standard bootarg #2 (system DTB address, kept track 1382 * of in entry_a32.S) 1383 * a3 - Not used 1384 * a4 - CFG_WITH_ARM_TRUSTED_FW=n: 1385 * Non-secure entry address 1386 * 1387 * [1] A TF-A concept: TOS_FW_CONFIG - Trusted OS Firmware 1388 * configuration file. Used by Trusted OS (BL32), that is, OP-TEE 1389 * here. This is also called Manifest DT, related to the Manifest DT 1390 * passed in the FF-A Boot Information Blob, but with a different 1391 * compatible string. 1392 1393 * Scenario B: FW Handoff via Transfer List 1394 * Note: FF-A and non-secure entry are not yet supported with 1395 * Transfer List 1396 * a0 - DTB address or 0 (AArch64) 1397 * - must be 0 (AArch32) 1398 * a1 - 1 << 32 | TRANSFER_LIST_SIGNATURE[0:31] (AArch64) 1399 * - 1 << 24 | TRANSFER_LIST_SIGNATURE[0:23] (AArch32) 1400 * a2 - must be 0 (AArch64) 1401 * - DTB address or 0 (AArch32) 1402 * a3 - Transfer list base address 1403 * a4 - Not used 1404 */ 1405 1406 if (IS_ENABLED(CFG_TRANSFER_LIST)) { 1407 if (IS_ENABLED(CFG_ARM64_core) && 1408 a1 == TL_HANDOFF_X1_VALUE(TL_REG_CONVENTION_VER)) { 1409 boot_save_transfer_list(a2, a3, a0); 1410 boot_arg_fdt = a0; 1411 } else if (IS_ENABLED(CFG_ARM32_core) && 1412 a1 == TL_HANDOFF_R1_VALUE(TL_REG_CONVENTION_VER)) { 1413 boot_save_transfer_list(a0, a3, a2); 1414 boot_arg_fdt = a2; 1415 } 1416 1417 return; 1418 } 1419 1420 if (!IS_ENABLED(CFG_CORE_SEL2_SPMC)) { 1421 #if defined(CFG_DT_ADDR) 1422 boot_arg_fdt = CFG_DT_ADDR; 1423 #else 1424 boot_arg_fdt = a2; 1425 #endif 1426 } 1427 1428 if (IS_ENABLED(CFG_CORE_FFA)) { 1429 size_t fdt_max_size = CFG_DTB_MAX_SIZE; 1430 void *fdt = NULL; 1431 1432 if (IS_ENABLED(CFG_CORE_SEL2_SPMC) || 1433 IS_ENABLED(CFG_CORE_EL3_SPMC)) 1434 fdt = get_fdt_from_boot_info((void *)a0); 1435 else 1436 fdt = (void *)a0; 1437 if (IS_ENABLED(CFG_CORE_SEL2_SPMC)) { 1438 paddr_size_t size = 0; 1439 paddr_t base = 0; 1440 1441 if (IS_ENABLED(CFG_CORE_PHYS_RELOCATABLE)) { 1442 get_sec_mem_from_manifest(fdt, &base, &size); 1443 core_mmu_set_secure_memory(base, size); 1444 } else { 1445 core_mmu_get_secure_memory(&base, &size); 1446 } 1447 assert((unsigned long)fdt >= base); 1448 assert((unsigned long)fdt <= base + size); 1449 assert((unsigned long)fdt < VCORE_START_VA); 1450 fdt_max_size = VCORE_START_VA - (unsigned long)fdt; 1451 } 1452 init_manifest_dt(fdt, fdt_max_size); 1453 } else { 1454 if (IS_ENABLED(CFG_WITH_PAGER)) { 1455 #if defined(CFG_PAGEABLE_ADDR) 1456 boot_arg_pageable_part = CFG_PAGEABLE_ADDR; 1457 #else 1458 boot_arg_pageable_part = a0; 1459 #endif 1460 } 1461 if (!IS_ENABLED(CFG_WITH_ARM_TRUSTED_FW)) { 1462 #if defined(CFG_NS_ENTRY_ADDR) 1463 boot_arg_nsec_entry = CFG_NS_ENTRY_ADDR; 1464 #else 1465 boot_arg_nsec_entry = a4; 1466 #endif 1467 } 1468 } 1469 } 1470 1471 #if defined(CFG_TRANSFER_LIST) 1472 static TEE_Result release_transfer_list(void) 1473 { 1474 struct dt_descriptor *dt = get_external_dt_desc(); 1475 1476 if (!mapped_tl) 1477 return TEE_SUCCESS; 1478 1479 if (dt) { 1480 int ret = 0; 1481 struct transfer_list_entry *tl_e = NULL; 1482 1483 /* 1484 * Pack the DTB and update the transfer list before un-mapping 1485 */ 1486 ret = fdt_pack(dt->blob); 1487 if (ret < 0) { 1488 EMSG("Failed to pack Device Tree at 0x%" PRIxPA 1489 ": error %d", virt_to_phys(dt->blob), ret); 1490 panic(); 1491 } 1492 1493 tl_e = transfer_list_find(mapped_tl, TL_TAG_FDT); 1494 assert(dt->blob == transfer_list_entry_data(tl_e)); 1495 transfer_list_set_data_size(mapped_tl, tl_e, 1496 fdt_totalsize(dt->blob)); 1497 dt->blob = NULL; 1498 } 1499 1500 transfer_list_unmap_sync(mapped_tl); 1501 mapped_tl = NULL; 1502 1503 return TEE_SUCCESS; 1504 } 1505 1506 boot_final(release_transfer_list); 1507 #endif 1508