1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright (c) 2015-2023, Linaro Limited 4 * Copyright (c) 2023, Arm Limited 5 */ 6 7 #include <arm.h> 8 #include <assert.h> 9 #include <compiler.h> 10 #include <config.h> 11 #include <console.h> 12 #include <crypto/crypto.h> 13 #include <drivers/gic.h> 14 #include <dt-bindings/interrupt-controller/arm-gic.h> 15 #include <ffa.h> 16 #include <initcall.h> 17 #include <inttypes.h> 18 #include <io.h> 19 #include <keep.h> 20 #include <kernel/asan.h> 21 #include <kernel/boot.h> 22 #include <kernel/dt.h> 23 #include <kernel/linker.h> 24 #include <kernel/misc.h> 25 #include <kernel/panic.h> 26 #include <kernel/tee_misc.h> 27 #include <kernel/thread.h> 28 #include <kernel/tpm.h> 29 #include <kernel/transfer_list.h> 30 #include <libfdt.h> 31 #include <malloc.h> 32 #include <memtag.h> 33 #include <mm/core_memprot.h> 34 #include <mm/core_mmu.h> 35 #include <mm/fobj.h> 36 #include <mm/page_alloc.h> 37 #include <mm/phys_mem.h> 38 #include <mm/tee_mm.h> 39 #include <mm/tee_pager.h> 40 #include <sm/psci.h> 41 #include <stdalign.h> 42 #include <trace.h> 43 #include <utee_defines.h> 44 #include <util.h> 45 46 #include <platform_config.h> 47 48 #if !defined(CFG_WITH_ARM_TRUSTED_FW) 49 #include <sm/sm.h> 50 #endif 51 52 #if defined(CFG_WITH_VFP) 53 #include <kernel/vfp.h> 54 #endif 55 56 /* 57 * In this file we're using unsigned long to represent physical pointers as 58 * they are received in a single register when OP-TEE is initially entered. 59 * This limits 32-bit systems to only use make use of the lower 32 bits 60 * of a physical address for initial parameters. 61 * 62 * 64-bit systems on the other hand can use full 64-bit physical pointers. 63 */ 64 #define PADDR_INVALID ULONG_MAX 65 66 #if defined(CFG_BOOT_SECONDARY_REQUEST) 67 struct ns_entry_context { 68 uintptr_t entry_point; 69 uintptr_t context_id; 70 }; 71 struct ns_entry_context ns_entry_contexts[CFG_TEE_CORE_NB_CORE]; 72 static uint32_t spin_table[CFG_TEE_CORE_NB_CORE]; 73 #endif 74 75 #ifdef CFG_BOOT_SYNC_CPU 76 /* 77 * Array used when booting, to synchronize cpu. 78 * When 0, the cpu has not started. 79 * When 1, it has started 80 */ 81 uint32_t sem_cpu_sync[CFG_TEE_CORE_NB_CORE]; 82 DECLARE_KEEP_PAGER(sem_cpu_sync); 83 #endif 84 85 /* 86 * Must not be in .bss since it's initialized and used from assembly before 87 * .bss is cleared. 88 */ 89 vaddr_t boot_cached_mem_end __nex_data = 1; 90 91 static unsigned long boot_arg_fdt __nex_bss; 92 unsigned long boot_arg_nsec_entry __nex_bss; 93 static unsigned long boot_arg_pageable_part __nex_bss; 94 static unsigned long boot_arg_transfer_list __nex_bss; 95 static struct transfer_list_header *mapped_tl __nex_bss; 96 97 #ifdef CFG_SECONDARY_INIT_CNTFRQ 98 static uint32_t cntfrq; 99 #endif 100 101 /* May be overridden in plat-$(PLATFORM)/main.c */ 102 __weak void plat_primary_init_early(void) 103 { 104 } 105 DECLARE_KEEP_PAGER(plat_primary_init_early); 106 107 /* May be overridden in plat-$(PLATFORM)/main.c */ 108 __weak void boot_primary_init_intc(void) 109 { 110 } 111 112 /* May be overridden in plat-$(PLATFORM)/main.c */ 113 __weak void boot_secondary_init_intc(void) 114 { 115 } 116 117 /* May be overridden in plat-$(PLATFORM)/main.c */ 118 __weak unsigned long plat_get_aslr_seed(void) 119 { 120 DMSG("Warning: no ASLR seed"); 121 122 return 0; 123 } 124 125 /* 126 * This function is called as a guard after each smc call which is not 127 * supposed to return. 128 */ 129 void __panic_at_smc_return(void) 130 { 131 panic(); 132 } 133 134 #if defined(CFG_WITH_ARM_TRUSTED_FW) 135 void init_sec_mon(unsigned long nsec_entry __maybe_unused) 136 { 137 assert(nsec_entry == PADDR_INVALID); 138 /* Do nothing as we don't have a secure monitor */ 139 } 140 #else 141 /* May be overridden in plat-$(PLATFORM)/main.c */ 142 __weak void init_sec_mon(unsigned long nsec_entry) 143 { 144 struct sm_nsec_ctx *nsec_ctx; 145 146 assert(nsec_entry != PADDR_INVALID); 147 148 /* Initialize secure monitor */ 149 nsec_ctx = sm_get_nsec_ctx(); 150 nsec_ctx->mon_lr = nsec_entry; 151 nsec_ctx->mon_spsr = CPSR_MODE_SVC | CPSR_I; 152 if (nsec_entry & 1) 153 nsec_ctx->mon_spsr |= CPSR_T; 154 } 155 #endif 156 157 #if defined(CFG_WITH_ARM_TRUSTED_FW) 158 static void init_vfp_nsec(void) 159 { 160 } 161 #else 162 static void init_vfp_nsec(void) 163 { 164 /* Normal world can use CP10 and CP11 (SIMD/VFP) */ 165 write_nsacr(read_nsacr() | NSACR_CP10 | NSACR_CP11); 166 } 167 #endif 168 169 static void check_crypto_extensions(void) 170 { 171 bool ce_supported = true; 172 173 if (!feat_aes_implemented() && 174 IS_ENABLED(CFG_CRYPTO_AES_ARM_CE)) { 175 EMSG("AES instructions are not supported"); 176 ce_supported = false; 177 } 178 179 if (!feat_sha1_implemented() && 180 IS_ENABLED(CFG_CRYPTO_SHA1_ARM_CE)) { 181 EMSG("SHA1 instructions are not supported"); 182 ce_supported = false; 183 } 184 185 if (!feat_sha256_implemented() && 186 IS_ENABLED(CFG_CRYPTO_SHA256_ARM_CE)) { 187 EMSG("SHA256 instructions are not supported"); 188 ce_supported = false; 189 } 190 191 /* Check aarch64 specific instructions */ 192 if (IS_ENABLED(CFG_ARM64_core)) { 193 if (!feat_sha512_implemented() && 194 IS_ENABLED(CFG_CRYPTO_SHA512_ARM_CE)) { 195 EMSG("SHA512 instructions are not supported"); 196 ce_supported = false; 197 } 198 199 if (!feat_sha3_implemented() && 200 IS_ENABLED(CFG_CRYPTO_SHA3_ARM_CE)) { 201 EMSG("SHA3 instructions are not supported"); 202 ce_supported = false; 203 } 204 205 if (!feat_sm3_implemented() && 206 IS_ENABLED(CFG_CRYPTO_SM3_ARM_CE)) { 207 EMSG("SM3 instructions are not supported"); 208 ce_supported = false; 209 } 210 211 if (!feat_sm4_implemented() && 212 IS_ENABLED(CFG_CRYPTO_SM4_ARM_CE)) { 213 EMSG("SM4 instructions are not supported"); 214 ce_supported = false; 215 } 216 } 217 218 if (!ce_supported) 219 panic("HW doesn't support CE instructions"); 220 } 221 222 #if defined(CFG_WITH_VFP) 223 224 #ifdef ARM32 225 static void init_vfp_sec(void) 226 { 227 uint32_t cpacr = read_cpacr(); 228 229 /* 230 * Enable Advanced SIMD functionality. 231 * Enable use of D16-D31 of the Floating-point Extension register 232 * file. 233 */ 234 cpacr &= ~(CPACR_ASEDIS | CPACR_D32DIS); 235 /* 236 * Enable usage of CP10 and CP11 (SIMD/VFP) (both kernel and user 237 * mode. 238 */ 239 cpacr |= CPACR_CP(10, CPACR_CP_ACCESS_FULL); 240 cpacr |= CPACR_CP(11, CPACR_CP_ACCESS_FULL); 241 write_cpacr(cpacr); 242 } 243 #endif /* ARM32 */ 244 245 #ifdef ARM64 246 static void init_vfp_sec(void) 247 { 248 /* Not using VFP until thread_kernel_enable_vfp() */ 249 vfp_disable(); 250 } 251 #endif /* ARM64 */ 252 253 #else /* CFG_WITH_VFP */ 254 255 static void init_vfp_sec(void) 256 { 257 /* Not using VFP */ 258 } 259 #endif 260 261 #ifdef CFG_SECONDARY_INIT_CNTFRQ 262 static void primary_save_cntfrq(void) 263 { 264 assert(cntfrq == 0); 265 266 /* 267 * CNTFRQ should be initialized on the primary CPU by a 268 * previous boot stage 269 */ 270 cntfrq = read_cntfrq(); 271 } 272 273 static void secondary_init_cntfrq(void) 274 { 275 assert(cntfrq != 0); 276 write_cntfrq(cntfrq); 277 } 278 #else /* CFG_SECONDARY_INIT_CNTFRQ */ 279 static void primary_save_cntfrq(void) 280 { 281 } 282 283 static void secondary_init_cntfrq(void) 284 { 285 } 286 #endif 287 288 #ifdef CFG_CORE_SANITIZE_KADDRESS 289 static void init_run_constructors(void) 290 { 291 const vaddr_t *ctor; 292 293 for (ctor = &__ctor_list; ctor < &__ctor_end; ctor++) 294 ((void (*)(void))(*ctor))(); 295 } 296 297 static void init_asan(void) 298 { 299 300 /* 301 * CFG_ASAN_SHADOW_OFFSET is also supplied as 302 * -fasan-shadow-offset=$(CFG_ASAN_SHADOW_OFFSET) to the compiler. 303 * Since all the needed values to calculate the value of 304 * CFG_ASAN_SHADOW_OFFSET isn't available in to make we need to 305 * calculate it in advance and hard code it into the platform 306 * conf.mk. Here where we have all the needed values we double 307 * check that the compiler is supplied the correct value. 308 */ 309 310 #define __ASAN_SHADOW_START \ 311 ROUNDUP(TEE_RAM_START + (TEE_RAM_VA_SIZE * 8) / 9 - 8, 8) 312 assert(__ASAN_SHADOW_START == (vaddr_t)&__asan_shadow_start); 313 #define __CFG_ASAN_SHADOW_OFFSET \ 314 (__ASAN_SHADOW_START - (TEE_RAM_START / 8)) 315 COMPILE_TIME_ASSERT(CFG_ASAN_SHADOW_OFFSET == __CFG_ASAN_SHADOW_OFFSET); 316 #undef __ASAN_SHADOW_START 317 #undef __CFG_ASAN_SHADOW_OFFSET 318 319 /* 320 * Assign area covered by the shadow area, everything from start up 321 * to the beginning of the shadow area. 322 */ 323 asan_set_shadowed((void *)TEE_LOAD_ADDR, &__asan_shadow_start); 324 325 /* 326 * Add access to areas that aren't opened automatically by a 327 * constructor. 328 */ 329 asan_tag_access(&__ctor_list, &__ctor_end); 330 asan_tag_access(__rodata_start, __rodata_end); 331 #ifdef CFG_WITH_PAGER 332 asan_tag_access(__pageable_start, __pageable_end); 333 #endif /*CFG_WITH_PAGER*/ 334 asan_tag_access(__nozi_start, __nozi_end); 335 #ifdef ARM32 336 asan_tag_access(__exidx_start, __exidx_end); 337 asan_tag_access(__extab_start, __extab_end); 338 #endif 339 340 init_run_constructors(); 341 342 /* Everything is tagged correctly, let's start address sanitizing. */ 343 asan_start(); 344 } 345 #else /*CFG_CORE_SANITIZE_KADDRESS*/ 346 static void init_asan(void) 347 { 348 } 349 #endif /*CFG_CORE_SANITIZE_KADDRESS*/ 350 351 #if defined(CFG_MEMTAG) 352 /* Called from entry_a64.S only when MEMTAG is configured */ 353 void boot_init_memtag(void) 354 { 355 memtag_init_ops(feat_mte_implemented()); 356 } 357 358 static TEE_Result mmap_clear_memtag(struct tee_mmap_region *map, 359 void *ptr __unused) 360 { 361 switch (map->type) { 362 case MEM_AREA_NEX_RAM_RO: 363 case MEM_AREA_SEC_RAM_OVERALL: 364 DMSG("Clearing tags for VA %#"PRIxVA"..%#"PRIxVA, 365 map->va, map->va + map->size - 1); 366 memtag_set_tags((void *)map->va, map->size, 0); 367 break; 368 default: 369 break; 370 } 371 372 return TEE_SUCCESS; 373 } 374 375 /* Called from entry_a64.S only when MEMTAG is configured */ 376 void boot_clear_memtag(void) 377 { 378 core_mmu_for_each_map(NULL, mmap_clear_memtag); 379 } 380 #endif 381 382 #ifdef CFG_WITH_PAGER 383 384 #ifdef CFG_CORE_SANITIZE_KADDRESS 385 static void carve_out_asan_mem(void) 386 { 387 nex_phys_mem_partial_carve_out(ASAN_MAP_PA, ASAN_MAP_SZ); 388 } 389 #else 390 static void carve_out_asan_mem(void) 391 { 392 } 393 #endif 394 395 static void print_pager_pool_size(void) 396 { 397 struct tee_pager_stats __maybe_unused stats; 398 399 tee_pager_get_stats(&stats); 400 IMSG("Pager pool size: %zukB", 401 stats.npages_all * SMALL_PAGE_SIZE / 1024); 402 } 403 404 static void init_virt_pool(tee_mm_pool_t *virt_pool) 405 { 406 const vaddr_t begin = VCORE_START_VA; 407 size_t size = TEE_RAM_VA_SIZE; 408 409 #ifdef CFG_CORE_SANITIZE_KADDRESS 410 /* Carve out asan memory, flat maped after core memory */ 411 if (begin + size > ASAN_SHADOW_PA) 412 size = ASAN_MAP_PA - begin; 413 #endif 414 415 if (!tee_mm_init(virt_pool, begin, size, SMALL_PAGE_SHIFT, 416 TEE_MM_POOL_NO_FLAGS)) 417 panic("core_virt_mem_pool init failed"); 418 } 419 420 /* 421 * With CFG_CORE_ASLR=y the init part is relocated very early during boot. 422 * The init part is also paged just as the rest of the normal paged code, with 423 * the difference that it's preloaded during boot. When the backing store 424 * is configured the entire paged binary is copied in place and then also 425 * the init part. Since the init part has been relocated (references to 426 * addresses updated to compensate for the new load address) this has to be 427 * undone for the hashes of those pages to match with the original binary. 428 * 429 * If CFG_CORE_ASLR=n, nothing needs to be done as the code/ro pages are 430 * unchanged. 431 */ 432 static void undo_init_relocation(uint8_t *paged_store __maybe_unused) 433 { 434 #ifdef CFG_CORE_ASLR 435 unsigned long *ptr = NULL; 436 const uint32_t *reloc = NULL; 437 const uint32_t *reloc_end = NULL; 438 unsigned long offs = boot_mmu_config.map_offset; 439 const struct boot_embdata *embdata = (const void *)__init_end; 440 vaddr_t addr_end = (vaddr_t)__init_end - offs - TEE_LOAD_ADDR; 441 vaddr_t addr_start = (vaddr_t)__init_start - offs - TEE_LOAD_ADDR; 442 443 reloc = (const void *)((vaddr_t)embdata + embdata->reloc_offset); 444 reloc_end = reloc + embdata->reloc_len / sizeof(*reloc); 445 446 for (; reloc < reloc_end; reloc++) { 447 if (*reloc < addr_start) 448 continue; 449 if (*reloc >= addr_end) 450 break; 451 ptr = (void *)(paged_store + *reloc - addr_start); 452 *ptr -= offs; 453 } 454 #endif 455 } 456 457 static struct fobj *ro_paged_alloc(tee_mm_entry_t *mm, void *hashes, 458 void *store) 459 { 460 const unsigned int num_pages = tee_mm_get_bytes(mm) / SMALL_PAGE_SIZE; 461 #ifdef CFG_CORE_ASLR 462 unsigned int reloc_offs = (vaddr_t)__pageable_start - VCORE_START_VA; 463 const struct boot_embdata *embdata = (const void *)__init_end; 464 const void *reloc = __init_end + embdata->reloc_offset; 465 466 return fobj_ro_reloc_paged_alloc(num_pages, hashes, reloc_offs, 467 reloc, embdata->reloc_len, store); 468 #else 469 return fobj_ro_paged_alloc(num_pages, hashes, store); 470 #endif 471 } 472 473 static void init_pager_runtime(unsigned long pageable_part) 474 { 475 size_t n; 476 size_t init_size = (size_t)(__init_end - __init_start); 477 size_t pageable_start = (size_t)__pageable_start; 478 size_t pageable_end = (size_t)__pageable_end; 479 size_t pageable_size = pageable_end - pageable_start; 480 vaddr_t tzsram_end = TZSRAM_BASE + TZSRAM_SIZE - TEE_LOAD_ADDR + 481 VCORE_START_VA; 482 size_t hash_size = (pageable_size / SMALL_PAGE_SIZE) * 483 TEE_SHA256_HASH_SIZE; 484 const struct boot_embdata *embdata = (const void *)__init_end; 485 const void *tmp_hashes = NULL; 486 tee_mm_entry_t *mm = NULL; 487 struct fobj *fobj = NULL; 488 uint8_t *paged_store = NULL; 489 uint8_t *hashes = NULL; 490 491 assert(pageable_size % SMALL_PAGE_SIZE == 0); 492 assert(embdata->total_len >= embdata->hashes_offset + 493 embdata->hashes_len); 494 assert(hash_size == embdata->hashes_len); 495 496 tmp_hashes = __init_end + embdata->hashes_offset; 497 498 /* 499 * This needs to be initialized early to support address lookup 500 * in MEM_AREA_TEE_RAM 501 */ 502 tee_pager_early_init(); 503 504 hashes = malloc(hash_size); 505 IMSG_RAW("\n"); 506 IMSG("Pager is enabled. Hashes: %zu bytes", hash_size); 507 assert(hashes); 508 asan_memcpy_unchecked(hashes, tmp_hashes, hash_size); 509 510 /* 511 * The pager is about the be enabled below, eventual temporary boot 512 * memory allocation must be removed now. 513 */ 514 boot_mem_release_tmp_alloc(); 515 516 carve_out_asan_mem(); 517 518 mm = nex_phys_mem_ta_alloc(pageable_size); 519 assert(mm); 520 paged_store = phys_to_virt(tee_mm_get_smem(mm), 521 MEM_AREA_SEC_RAM_OVERALL, pageable_size); 522 /* 523 * Load pageable part in the dedicated allocated area: 524 * - Move pageable non-init part into pageable area. Note bootloader 525 * may have loaded it anywhere in TA RAM hence use memmove(). 526 * - Copy pageable init part from current location into pageable area. 527 */ 528 memmove(paged_store + init_size, 529 phys_to_virt(pageable_part, 530 core_mmu_get_type_by_pa(pageable_part), 531 __pageable_part_end - __pageable_part_start), 532 __pageable_part_end - __pageable_part_start); 533 asan_memcpy_unchecked(paged_store, __init_start, init_size); 534 /* 535 * Undo eventual relocation for the init part so the hash checks 536 * can pass. 537 */ 538 undo_init_relocation(paged_store); 539 540 /* Check that hashes of what's in pageable area is OK */ 541 DMSG("Checking hashes of pageable area"); 542 for (n = 0; (n * SMALL_PAGE_SIZE) < pageable_size; n++) { 543 const uint8_t *hash = hashes + n * TEE_SHA256_HASH_SIZE; 544 const uint8_t *page = paged_store + n * SMALL_PAGE_SIZE; 545 TEE_Result res; 546 547 DMSG("hash pg_idx %zu hash %p page %p", n, hash, page); 548 res = hash_sha256_check(hash, page, SMALL_PAGE_SIZE); 549 if (res != TEE_SUCCESS) { 550 EMSG("Hash failed for page %zu at %p: res 0x%x", 551 n, (void *)page, res); 552 panic(); 553 } 554 } 555 556 /* 557 * Assert prepaged init sections are page aligned so that nothing 558 * trails uninited at the end of the premapped init area. 559 */ 560 assert(!(init_size & SMALL_PAGE_MASK)); 561 562 /* 563 * Initialize the virtual memory pool used for main_mmu_l2_ttb which 564 * is supplied to tee_pager_init() below. 565 */ 566 init_virt_pool(&core_virt_mem_pool); 567 568 /* 569 * Assign alias area for pager end of the small page block the rest 570 * of the binary is loaded into. We're taking more than needed, but 571 * we're guaranteed to not need more than the physical amount of 572 * TZSRAM. 573 */ 574 mm = tee_mm_alloc2(&core_virt_mem_pool, 575 (vaddr_t)core_virt_mem_pool.lo + 576 core_virt_mem_pool.size - TZSRAM_SIZE, 577 TZSRAM_SIZE); 578 assert(mm); 579 tee_pager_set_alias_area(mm); 580 581 /* 582 * Claim virtual memory which isn't paged. 583 * Linear memory (flat map core memory) ends there. 584 */ 585 mm = tee_mm_alloc2(&core_virt_mem_pool, VCORE_UNPG_RX_PA, 586 (vaddr_t)(__pageable_start - VCORE_UNPG_RX_PA)); 587 assert(mm); 588 589 /* 590 * Allocate virtual memory for the pageable area and let the pager 591 * take charge of all the pages already assigned to that memory. 592 */ 593 mm = tee_mm_alloc2(&core_virt_mem_pool, (vaddr_t)__pageable_start, 594 pageable_size); 595 assert(mm); 596 fobj = ro_paged_alloc(mm, hashes, paged_store); 597 assert(fobj); 598 tee_pager_add_core_region(tee_mm_get_smem(mm), PAGED_REGION_TYPE_RO, 599 fobj); 600 fobj_put(fobj); 601 602 tee_pager_add_pages(pageable_start, init_size / SMALL_PAGE_SIZE, false); 603 tee_pager_add_pages(pageable_start + init_size, 604 (pageable_size - init_size) / SMALL_PAGE_SIZE, 605 true); 606 if (pageable_end < tzsram_end) 607 tee_pager_add_pages(pageable_end, (tzsram_end - pageable_end) / 608 SMALL_PAGE_SIZE, true); 609 610 /* 611 * There may be physical pages in TZSRAM before the core load address. 612 * These pages can be added to the physical pages pool of the pager. 613 * This setup may happen when a the secure bootloader runs in TZRAM 614 * and its memory can be reused by OP-TEE once boot stages complete. 615 */ 616 tee_pager_add_pages(core_virt_mem_pool.lo, 617 (VCORE_UNPG_RX_PA - core_virt_mem_pool.lo) / 618 SMALL_PAGE_SIZE, 619 true); 620 621 print_pager_pool_size(); 622 } 623 #else /*!CFG_WITH_PAGER*/ 624 static void init_pager_runtime(unsigned long pageable_part __unused) 625 { 626 } 627 #endif 628 629 #if defined(CFG_DT) 630 static int add_optee_dt_node(struct dt_descriptor *dt) 631 { 632 int offs; 633 int ret; 634 635 if (fdt_path_offset(dt->blob, "/firmware/optee") >= 0) { 636 DMSG("OP-TEE Device Tree node already exists!"); 637 return 0; 638 } 639 640 offs = fdt_path_offset(dt->blob, "/firmware"); 641 if (offs < 0) { 642 offs = add_dt_path_subnode(dt, "/", "firmware"); 643 if (offs < 0) 644 return -1; 645 } 646 647 offs = fdt_add_subnode(dt->blob, offs, "optee"); 648 if (offs < 0) 649 return -1; 650 651 ret = fdt_setprop_string(dt->blob, offs, "compatible", 652 "linaro,optee-tz"); 653 if (ret < 0) 654 return -1; 655 ret = fdt_setprop_string(dt->blob, offs, "method", "smc"); 656 if (ret < 0) 657 return -1; 658 659 if (CFG_CORE_ASYNC_NOTIF_GIC_INTID) { 660 /* 661 * The format of the interrupt property is defined by the 662 * binding of the interrupt domain root. In this case it's 663 * one Arm GIC v1, v2 or v3 so we must be compatible with 664 * these. 665 * 666 * An SPI type of interrupt is indicated with a 0 in the 667 * first cell. A PPI type is indicated with value 1. 668 * 669 * The interrupt number goes in the second cell where 670 * SPIs ranges from 0 to 987 and PPI ranges from 0 to 15. 671 * 672 * Flags are passed in the third cells. 673 */ 674 uint32_t itr_trigger = 0; 675 uint32_t itr_type = 0; 676 uint32_t itr_id = 0; 677 uint32_t val[3] = { }; 678 679 /* PPI are visible only in current CPU cluster */ 680 static_assert(IS_ENABLED(CFG_CORE_FFA) || 681 !CFG_CORE_ASYNC_NOTIF_GIC_INTID || 682 (CFG_CORE_ASYNC_NOTIF_GIC_INTID >= 683 GIC_SPI_BASE) || 684 ((CFG_TEE_CORE_NB_CORE <= 8) && 685 (CFG_CORE_ASYNC_NOTIF_GIC_INTID >= 686 GIC_PPI_BASE))); 687 688 if (CFG_CORE_ASYNC_NOTIF_GIC_INTID >= GIC_SPI_BASE) { 689 itr_type = GIC_SPI; 690 itr_id = CFG_CORE_ASYNC_NOTIF_GIC_INTID - GIC_SPI_BASE; 691 itr_trigger = IRQ_TYPE_EDGE_RISING; 692 } else { 693 itr_type = GIC_PPI; 694 itr_id = CFG_CORE_ASYNC_NOTIF_GIC_INTID - GIC_PPI_BASE; 695 itr_trigger = IRQ_TYPE_EDGE_RISING | 696 GIC_CPU_MASK_SIMPLE(CFG_TEE_CORE_NB_CORE); 697 } 698 699 val[0] = TEE_U32_TO_BIG_ENDIAN(itr_type); 700 val[1] = TEE_U32_TO_BIG_ENDIAN(itr_id); 701 val[2] = TEE_U32_TO_BIG_ENDIAN(itr_trigger); 702 703 ret = fdt_setprop(dt->blob, offs, "interrupts", val, 704 sizeof(val)); 705 if (ret < 0) 706 return -1; 707 } 708 return 0; 709 } 710 711 #ifdef CFG_PSCI_ARM32 712 static int append_psci_compatible(void *fdt, int offs, const char *str) 713 { 714 return fdt_appendprop(fdt, offs, "compatible", str, strlen(str) + 1); 715 } 716 717 static int dt_add_psci_node(struct dt_descriptor *dt) 718 { 719 int offs; 720 721 if (fdt_path_offset(dt->blob, "/psci") >= 0) { 722 DMSG("PSCI Device Tree node already exists!"); 723 return 0; 724 } 725 726 offs = add_dt_path_subnode(dt, "/", "psci"); 727 if (offs < 0) 728 return -1; 729 if (append_psci_compatible(dt->blob, offs, "arm,psci-1.0")) 730 return -1; 731 if (append_psci_compatible(dt->blob, offs, "arm,psci-0.2")) 732 return -1; 733 if (append_psci_compatible(dt->blob, offs, "arm,psci")) 734 return -1; 735 if (fdt_setprop_string(dt->blob, offs, "method", "smc")) 736 return -1; 737 if (fdt_setprop_u32(dt->blob, offs, "cpu_suspend", PSCI_CPU_SUSPEND)) 738 return -1; 739 if (fdt_setprop_u32(dt->blob, offs, "cpu_off", PSCI_CPU_OFF)) 740 return -1; 741 if (fdt_setprop_u32(dt->blob, offs, "cpu_on", PSCI_CPU_ON)) 742 return -1; 743 if (fdt_setprop_u32(dt->blob, offs, "sys_poweroff", PSCI_SYSTEM_OFF)) 744 return -1; 745 if (fdt_setprop_u32(dt->blob, offs, "sys_reset", PSCI_SYSTEM_RESET)) 746 return -1; 747 return 0; 748 } 749 750 static int check_node_compat_prefix(struct dt_descriptor *dt, int offs, 751 const char *prefix) 752 { 753 const size_t prefix_len = strlen(prefix); 754 size_t l; 755 int plen; 756 const char *prop; 757 758 prop = fdt_getprop(dt->blob, offs, "compatible", &plen); 759 if (!prop) 760 return -1; 761 762 while (plen > 0) { 763 if (memcmp(prop, prefix, prefix_len) == 0) 764 return 0; /* match */ 765 766 l = strlen(prop) + 1; 767 prop += l; 768 plen -= l; 769 } 770 771 return -1; 772 } 773 774 static int dt_add_psci_cpu_enable_methods(struct dt_descriptor *dt) 775 { 776 int offs = 0; 777 778 while (1) { 779 offs = fdt_next_node(dt->blob, offs, NULL); 780 if (offs < 0) 781 break; 782 if (fdt_getprop(dt->blob, offs, "enable-method", NULL)) 783 continue; /* already set */ 784 if (check_node_compat_prefix(dt, offs, "arm,cortex-a")) 785 continue; /* no compatible */ 786 if (fdt_setprop_string(dt->blob, offs, "enable-method", "psci")) 787 return -1; 788 /* Need to restart scanning as offsets may have changed */ 789 offs = 0; 790 } 791 return 0; 792 } 793 794 static int config_psci(struct dt_descriptor *dt) 795 { 796 if (dt_add_psci_node(dt)) 797 return -1; 798 return dt_add_psci_cpu_enable_methods(dt); 799 } 800 #else 801 static int config_psci(struct dt_descriptor *dt __unused) 802 { 803 return 0; 804 } 805 #endif /*CFG_PSCI_ARM32*/ 806 807 static int mark_tzdram_as_reserved(struct dt_descriptor *dt) 808 { 809 return add_res_mem_dt_node(dt, "optee_core", CFG_TZDRAM_START, 810 CFG_TZDRAM_SIZE); 811 } 812 813 static void update_external_dt(void) 814 { 815 struct dt_descriptor *dt = get_external_dt_desc(); 816 817 if (!dt || !dt->blob) 818 return; 819 820 if (!IS_ENABLED(CFG_CORE_FFA) && add_optee_dt_node(dt)) 821 panic("Failed to add OP-TEE Device Tree node"); 822 823 if (config_psci(dt)) 824 panic("Failed to config PSCI"); 825 826 #ifdef CFG_CORE_RESERVED_SHM 827 if (mark_static_shm_as_reserved(dt)) 828 panic("Failed to config non-secure memory"); 829 #endif 830 831 if (mark_tzdram_as_reserved(dt)) 832 panic("Failed to config secure memory"); 833 } 834 #else /*CFG_DT*/ 835 static void update_external_dt(void) 836 { 837 } 838 #endif /*!CFG_DT*/ 839 840 void init_tee_runtime(void) 841 { 842 /* 843 * With virtualization we call this function when creating the 844 * OP-TEE partition instead. 845 */ 846 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) 847 call_preinitcalls(); 848 call_early_initcalls(); 849 call_service_initcalls(); 850 851 /* 852 * These two functions uses crypto_rng_read() to initialize the 853 * pauth keys. Once call_initcalls() returns we're guaranteed that 854 * crypto_rng_read() is ready to be used. 855 */ 856 thread_init_core_local_pauth_keys(); 857 thread_init_thread_pauth_keys(); 858 859 /* 860 * Reinitialize canaries around the stacks with crypto_rng_read(). 861 * 862 * TODO: Updating canaries when CFG_NS_VIRTUALIZATION is enabled will 863 * require synchronization between thread_check_canaries() and 864 * thread_update_canaries(). 865 */ 866 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) 867 thread_update_canaries(); 868 } 869 870 static bool add_padding_to_pool(vaddr_t va, size_t len, void *ptr __unused) 871 { 872 #ifdef CFG_NS_VIRTUALIZATION 873 nex_malloc_add_pool((void *)va, len); 874 #else 875 malloc_add_pool((void *)va, len); 876 #endif 877 return true; 878 } 879 880 static void init_primary(unsigned long pageable_part) 881 { 882 vaddr_t va = 0; 883 884 /* 885 * Mask asynchronous exceptions before switch to the thread vector 886 * as the thread handler requires those to be masked while 887 * executing with the temporary stack. The thread subsystem also 888 * asserts that the foreign interrupts are blocked when using most of 889 * its functions. 890 */ 891 thread_set_exceptions(THREAD_EXCP_ALL); 892 primary_save_cntfrq(); 893 init_vfp_sec(); 894 895 if (IS_ENABLED(CFG_CRYPTO_WITH_CE)) 896 check_crypto_extensions(); 897 898 init_asan(); 899 900 /* 901 * By default whole OP-TEE uses malloc, so we need to initialize 902 * it early. But, when virtualization is enabled, malloc is used 903 * only by TEE runtime, so malloc should be initialized later, for 904 * every virtual partition separately. Core code uses nex_malloc 905 * instead. 906 */ 907 #ifdef CFG_WITH_PAGER 908 /* Add heap2 first as heap1 may be too small as initial bget pool */ 909 malloc_add_pool(__heap2_start, __heap2_end - __heap2_start); 910 #endif 911 #ifdef CFG_NS_VIRTUALIZATION 912 nex_malloc_add_pool(__nex_heap_start, __nex_heap_end - 913 __nex_heap_start); 914 #else 915 malloc_add_pool(__heap1_start, __heap1_end - __heap1_start); 916 #endif 917 IMSG_RAW("\n"); 918 if (IS_ENABLED(CFG_DYN_CONFIG)) { 919 size_t sz = sizeof(struct thread_core_local) * 920 CFG_TEE_CORE_NB_CORE; 921 void *p = boot_mem_alloc(sz, alignof(void *) * 2); 922 923 #ifdef CFG_NS_VIRTUALIZATION 924 nex_malloc_add_pool(p, sz); 925 #else 926 malloc_add_pool(p, sz); 927 #endif 928 } 929 930 core_mmu_save_mem_map(); 931 core_mmu_init_phys_mem(); 932 boot_mem_foreach_padding(add_padding_to_pool, NULL); 933 va = boot_mem_release_unused(); 934 if (!IS_ENABLED(CFG_WITH_PAGER)) { 935 /* 936 * We must update boot_cached_mem_end to reflect the memory 937 * just unmapped by boot_mem_release_unused(). 938 */ 939 assert(va && va <= boot_cached_mem_end); 940 boot_cached_mem_end = va; 941 } 942 943 if (IS_ENABLED(CFG_DYN_CONFIG)) { 944 /* 945 * This is needed to enable virt_page_alloc() now that 946 * boot_mem_alloc() can't be used any longer. 947 */ 948 if (IS_ENABLED(CFG_NS_VIRTUALIZATION)) 949 nex_page_alloc_init(); 950 else 951 page_alloc_init(); 952 } 953 954 if (IS_ENABLED(CFG_WITH_PAGER)) { 955 /* 956 * Pager: init_runtime() calls thread_kernel_enable_vfp() 957 * so we must set a current thread right now to avoid a 958 * chicken-and-egg problem (thread_init_boot_thread() sets 959 * the current thread but needs things set by 960 * init_runtime()). 961 */ 962 thread_get_core_local()->curr_thread = 0; 963 init_pager_runtime(pageable_part); 964 } 965 966 /* Initialize canaries around the stacks */ 967 thread_init_canaries(); 968 thread_init_per_cpu(); 969 } 970 971 static bool cpu_nmfi_enabled(void) 972 { 973 #if defined(ARM32) 974 return read_sctlr() & SCTLR_NMFI; 975 #else 976 /* Note: ARM64 does not feature non-maskable FIQ support. */ 977 return false; 978 #endif 979 } 980 981 /* 982 * Note: this function is weak just to make it possible to exclude it from 983 * the unpaged area. 984 */ 985 void __weak boot_init_primary_late(unsigned long fdt __unused, 986 unsigned long manifest __unused) 987 { 988 size_t fdt_size = CFG_DTB_MAX_SIZE; 989 990 if (IS_ENABLED(CFG_TRANSFER_LIST) && mapped_tl) { 991 struct transfer_list_entry *tl_e = NULL; 992 993 tl_e = transfer_list_find(mapped_tl, TL_TAG_FDT); 994 if (tl_e) { 995 /* 996 * Expand the data size of the DTB entry to the maximum 997 * allocable mapped memory to reserve sufficient space 998 * for inserting new nodes, avoid potentially corrupting 999 * next entries. 1000 */ 1001 uint32_t dtb_max_sz = mapped_tl->max_size - 1002 mapped_tl->size + tl_e->data_size; 1003 1004 if (!transfer_list_set_data_size(mapped_tl, tl_e, 1005 dtb_max_sz)) { 1006 EMSG("Failed to extend DTB size to %#"PRIx32, 1007 dtb_max_sz); 1008 panic(); 1009 } 1010 fdt_size = tl_e->data_size; 1011 } 1012 } 1013 1014 init_external_dt(boot_arg_fdt, fdt_size); 1015 reinit_manifest_dt(); 1016 #ifdef CFG_CORE_SEL1_SPMC 1017 tpm_map_log_area(get_manifest_dt()); 1018 #else 1019 tpm_map_log_area(get_external_dt()); 1020 #endif 1021 discover_nsec_memory(); 1022 update_external_dt(); 1023 configure_console_from_dt(); 1024 1025 if (IS_ENABLED(CFG_NS_VIRTUALIZATION)) { 1026 /* 1027 * Virtualization: We can't initialize threads right now because 1028 * threads belong to "tee" part and will be initialized 1029 * separately per each new virtual guest. So, we'll clear 1030 * "curr_thread" and call it done. 1031 */ 1032 thread_get_core_local()->curr_thread = -1; 1033 } else { 1034 thread_init_threads(CFG_NUM_THREADS); 1035 thread_init_boot_thread(); 1036 } 1037 thread_init_thread_core_local(CFG_TEE_CORE_NB_CORE); 1038 } 1039 1040 void __weak boot_init_primary_runtime(void) 1041 { 1042 thread_init_primary(); 1043 IMSG("OP-TEE version: %s", core_v_str); 1044 if (IS_ENABLED(CFG_INSECURE)) { 1045 IMSG("WARNING: This OP-TEE configuration might be insecure!"); 1046 IMSG("WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html"); 1047 } 1048 IMSG("Primary CPU initializing"); 1049 #ifdef CFG_CORE_ASLR 1050 DMSG("Executing at offset %#lx with virtual load address %#"PRIxVA, 1051 (unsigned long)boot_mmu_config.map_offset, VCORE_START_VA); 1052 #endif 1053 #ifdef CFG_NS_VIRTUALIZATION 1054 DMSG("NS-virtualization enabled, supporting %u guests", 1055 CFG_VIRT_GUEST_COUNT); 1056 #endif 1057 if (IS_ENABLED(CFG_MEMTAG)) 1058 DMSG("Memory tagging %s", 1059 memtag_is_enabled() ? "enabled" : "disabled"); 1060 1061 /* Check if platform needs NMFI workaround */ 1062 if (cpu_nmfi_enabled()) { 1063 if (!IS_ENABLED(CFG_CORE_WORKAROUND_ARM_NMFI)) 1064 IMSG("WARNING: This ARM core has NMFI enabled, please apply workaround!"); 1065 } else { 1066 if (IS_ENABLED(CFG_CORE_WORKAROUND_ARM_NMFI)) 1067 IMSG("WARNING: This ARM core does not have NMFI enabled, no need for workaround"); 1068 } 1069 1070 boot_primary_init_intc(); 1071 init_vfp_nsec(); 1072 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) { 1073 /* 1074 * Unmask native interrupts during driver initcalls. 1075 * 1076 * NS-virtualization still uses the temporary stack also 1077 * used for exception handling so it must still have native 1078 * interrupts masked. 1079 */ 1080 thread_set_exceptions(thread_get_exceptions() & 1081 ~THREAD_EXCP_NATIVE_INTR); 1082 init_tee_runtime(); 1083 } 1084 1085 if (!IS_ENABLED(CFG_WITH_PAGER)) 1086 boot_mem_release_tmp_alloc(); 1087 } 1088 1089 void __weak boot_init_primary_final(void) 1090 { 1091 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) 1092 call_driver_initcalls(); 1093 1094 call_finalcalls(); 1095 1096 IMSG("Primary CPU switching to normal world boot"); 1097 1098 /* Mask native interrupts before switching to the normal world */ 1099 if (!IS_ENABLED(CFG_NS_VIRTUALIZATION)) 1100 thread_set_exceptions(thread_get_exceptions() | 1101 THREAD_EXCP_NATIVE_INTR); 1102 } 1103 1104 static void init_secondary_helper(void) 1105 { 1106 IMSG("Secondary CPU %zu initializing", get_core_pos()); 1107 1108 /* 1109 * Mask asynchronous exceptions before switch to the thread vector 1110 * as the thread handler requires those to be masked while 1111 * executing with the temporary stack. The thread subsystem also 1112 * asserts that the foreign interrupts are blocked when using most of 1113 * its functions. 1114 */ 1115 thread_set_exceptions(THREAD_EXCP_ALL); 1116 1117 secondary_init_cntfrq(); 1118 thread_init_per_cpu(); 1119 boot_secondary_init_intc(); 1120 init_vfp_sec(); 1121 init_vfp_nsec(); 1122 1123 IMSG("Secondary CPU %zu switching to normal world boot", get_core_pos()); 1124 } 1125 1126 /* 1127 * Note: this function is weak just to make it possible to exclude it from 1128 * the unpaged area so that it lies in the init area. 1129 */ 1130 void __weak boot_init_primary_early(void) 1131 { 1132 unsigned long pageable_part = 0; 1133 struct transfer_list_entry *tl_e = NULL; 1134 1135 if (IS_ENABLED(CFG_TRANSFER_LIST) && boot_arg_transfer_list) { 1136 /* map and save the TL */ 1137 mapped_tl = transfer_list_map(boot_arg_transfer_list); 1138 if (!mapped_tl) 1139 panic("Failed to map transfer list"); 1140 1141 transfer_list_dump(mapped_tl); 1142 tl_e = transfer_list_find(mapped_tl, TL_TAG_OPTEE_PAGABLE_PART); 1143 } 1144 1145 if (IS_ENABLED(CFG_WITH_PAGER)) { 1146 if (IS_ENABLED(CFG_TRANSFER_LIST) && tl_e) 1147 pageable_part = 1148 get_le64(transfer_list_entry_data(tl_e)); 1149 else 1150 pageable_part = boot_arg_pageable_part; 1151 } 1152 1153 init_primary(pageable_part); 1154 } 1155 1156 static void boot_save_transfer_list(unsigned long zero_reg, 1157 unsigned long transfer_list, 1158 unsigned long fdt) 1159 { 1160 struct transfer_list_header *tl = (void *)transfer_list; 1161 struct transfer_list_entry *tl_e = NULL; 1162 1163 if (zero_reg != 0) 1164 panic("Incorrect transfer list register convention"); 1165 1166 if (!IS_ALIGNED_WITH_TYPE(transfer_list, struct transfer_list_header) || 1167 !IS_ALIGNED(transfer_list, TL_ALIGNMENT_FROM_ORDER(tl->alignment))) 1168 panic("Transfer list base address is not aligned"); 1169 1170 if (transfer_list_check_header(tl) == TL_OPS_NONE) 1171 panic("Invalid transfer list"); 1172 1173 tl_e = transfer_list_find(tl, TL_TAG_FDT); 1174 if (fdt != (unsigned long)transfer_list_entry_data(tl_e)) 1175 panic("DT does not match to the DT entry of the TL"); 1176 1177 boot_arg_transfer_list = transfer_list; 1178 } 1179 1180 #if defined(CFG_WITH_ARM_TRUSTED_FW) 1181 unsigned long boot_cpu_on_handler(unsigned long a0 __maybe_unused, 1182 unsigned long a1 __unused) 1183 { 1184 init_secondary_helper(); 1185 return 0; 1186 } 1187 #else 1188 void boot_init_secondary(unsigned long nsec_entry __unused) 1189 { 1190 init_secondary_helper(); 1191 } 1192 #endif 1193 1194 #if defined(CFG_BOOT_SECONDARY_REQUEST) 1195 void boot_set_core_ns_entry(size_t core_idx, uintptr_t entry, 1196 uintptr_t context_id) 1197 { 1198 ns_entry_contexts[core_idx].entry_point = entry; 1199 ns_entry_contexts[core_idx].context_id = context_id; 1200 dsb_ishst(); 1201 } 1202 1203 int boot_core_release(size_t core_idx, paddr_t entry) 1204 { 1205 if (!core_idx || core_idx >= CFG_TEE_CORE_NB_CORE) 1206 return -1; 1207 1208 ns_entry_contexts[core_idx].entry_point = entry; 1209 dmb(); 1210 spin_table[core_idx] = 1; 1211 dsb(); 1212 sev(); 1213 1214 return 0; 1215 } 1216 1217 /* 1218 * spin until secondary boot request, then returns with 1219 * the secondary core entry address. 1220 */ 1221 struct ns_entry_context *boot_core_hpen(void) 1222 { 1223 #ifdef CFG_PSCI_ARM32 1224 return &ns_entry_contexts[get_core_pos()]; 1225 #else 1226 do { 1227 wfe(); 1228 } while (!spin_table[get_core_pos()]); 1229 dmb(); 1230 return &ns_entry_contexts[get_core_pos()]; 1231 #endif 1232 } 1233 #endif 1234 1235 #if defined(CFG_CORE_ASLR) 1236 #if defined(CFG_DT) 1237 unsigned long __weak get_aslr_seed(void) 1238 { 1239 void *fdt = NULL; 1240 int rc = 0; 1241 const uint64_t *seed = NULL; 1242 int offs = 0; 1243 int len = 0; 1244 1245 if (!IS_ENABLED(CFG_CORE_SEL2_SPMC)) 1246 fdt = (void *)boot_arg_fdt; 1247 1248 if (!fdt) { 1249 DMSG("No fdt"); 1250 goto err; 1251 } 1252 1253 rc = fdt_check_header(fdt); 1254 if (rc) { 1255 DMSG("Bad fdt: %d", rc); 1256 goto err; 1257 } 1258 1259 offs = fdt_path_offset(fdt, "/secure-chosen"); 1260 if (offs < 0) { 1261 DMSG("Cannot find /secure-chosen"); 1262 goto err; 1263 } 1264 seed = fdt_getprop(fdt, offs, "kaslr-seed", &len); 1265 if (!seed || len != sizeof(*seed)) { 1266 DMSG("Cannot find valid kaslr-seed"); 1267 goto err; 1268 } 1269 1270 return fdt64_to_cpu(fdt64_ld(seed)); 1271 1272 err: 1273 /* Try platform implementation */ 1274 return plat_get_aslr_seed(); 1275 } 1276 #else /*!CFG_DT*/ 1277 unsigned long __weak get_aslr_seed(void) 1278 { 1279 /* Try platform implementation */ 1280 return plat_get_aslr_seed(); 1281 } 1282 #endif /*!CFG_DT*/ 1283 #endif /*CFG_CORE_ASLR*/ 1284 1285 static void *get_fdt_from_boot_info(struct ffa_boot_info_header_1_1 *hdr) 1286 { 1287 struct ffa_boot_info_1_1 *desc = NULL; 1288 uint8_t content_fmt = 0; 1289 uint8_t name_fmt = 0; 1290 void *fdt = NULL; 1291 int ret = 0; 1292 1293 if (hdr->signature != FFA_BOOT_INFO_SIGNATURE) { 1294 EMSG("Bad boot info signature %#"PRIx32, hdr->signature); 1295 panic(); 1296 } 1297 if (hdr->version != FFA_BOOT_INFO_VERSION_1_1 && 1298 hdr->version != FFA_BOOT_INFO_VERSION_1_2) { 1299 EMSG("Bad boot info version %#"PRIx32, hdr->version); 1300 panic(); 1301 } 1302 if (hdr->desc_count != 1) { 1303 EMSG("Bad boot info descriptor count %#"PRIx32, 1304 hdr->desc_count); 1305 panic(); 1306 } 1307 desc = (void *)((vaddr_t)hdr + hdr->desc_offset); 1308 name_fmt = desc->flags & FFA_BOOT_INFO_FLAG_NAME_FORMAT_MASK; 1309 if (name_fmt == FFA_BOOT_INFO_FLAG_NAME_FORMAT_STRING) 1310 DMSG("Boot info descriptor name \"%16s\"", desc->name); 1311 else if (name_fmt == FFA_BOOT_INFO_FLAG_NAME_FORMAT_UUID) 1312 DMSG("Boot info descriptor UUID %pUl", (void *)desc->name); 1313 else 1314 DMSG("Boot info descriptor: unknown name format %"PRIu8, 1315 name_fmt); 1316 1317 content_fmt = (desc->flags & FFA_BOOT_INFO_FLAG_CONTENT_FORMAT_MASK) >> 1318 FFA_BOOT_INFO_FLAG_CONTENT_FORMAT_SHIFT; 1319 if (content_fmt != FFA_BOOT_INFO_FLAG_CONTENT_FORMAT_ADDR) { 1320 EMSG("Bad boot info content format %"PRIu8", expected %u (address)", 1321 content_fmt, FFA_BOOT_INFO_FLAG_CONTENT_FORMAT_ADDR); 1322 panic(); 1323 } 1324 1325 fdt = (void *)(vaddr_t)desc->contents; 1326 ret = fdt_check_full(fdt, desc->size); 1327 if (ret < 0) { 1328 EMSG("Invalid Device Tree at %p: error %d", fdt, ret); 1329 panic(); 1330 } 1331 return fdt; 1332 } 1333 1334 static void get_sec_mem_from_manifest(void *fdt, paddr_t *base, 1335 paddr_size_t *size) 1336 { 1337 int ret = 0; 1338 uint64_t num = 0; 1339 1340 ret = fdt_node_check_compatible(fdt, 0, "arm,ffa-manifest-1.0"); 1341 if (ret < 0) { 1342 EMSG("Invalid FF-A manifest at %p: error %d", fdt, ret); 1343 panic(); 1344 } 1345 ret = dt_getprop_as_number(fdt, 0, "load-address", &num); 1346 if (ret < 0) { 1347 EMSG("Can't read \"load-address\" from FF-A manifest at %p: error %d", 1348 fdt, ret); 1349 panic(); 1350 } 1351 *base = num; 1352 /* "mem-size" is currently an undocumented extension to the spec. */ 1353 ret = dt_getprop_as_number(fdt, 0, "mem-size", &num); 1354 if (ret < 0) { 1355 EMSG("Can't read \"mem-size\" from FF-A manifest at %p: error %d", 1356 fdt, ret); 1357 panic(); 1358 } 1359 *size = num; 1360 } 1361 1362 void __weak boot_save_args(unsigned long a0, unsigned long a1, 1363 unsigned long a2, unsigned long a3, 1364 unsigned long a4 __maybe_unused) 1365 { 1366 /* 1367 * Register use: 1368 * 1369 * Scenario A: Default arguments 1370 * a0 - CFG_CORE_FFA=y && CFG_CORE_SEL2_SPMC=n: 1371 * if non-NULL holds the TOS FW config [1] address 1372 * - CFG_CORE_FFA=y && 1373 (CFG_CORE_SEL2_SPMC=y || CFG_CORE_EL3_SPMC=y): 1374 * address of FF-A Boot Information Blob 1375 * - CFG_CORE_FFA=n: 1376 * if non-NULL holds the pagable part address 1377 * a1 - CFG_WITH_ARM_TRUSTED_FW=n (Armv7): 1378 * Armv7 standard bootarg #1 (kept track of in entry_a32.S) 1379 * a2 - CFG_CORE_SEL2_SPMC=n: 1380 * if non-NULL holds the system DTB address 1381 * - CFG_WITH_ARM_TRUSTED_FW=n (Armv7): 1382 * Armv7 standard bootarg #2 (system DTB address, kept track 1383 * of in entry_a32.S) 1384 * a3 - Not used 1385 * a4 - CFG_WITH_ARM_TRUSTED_FW=n: 1386 * Non-secure entry address 1387 * 1388 * [1] A TF-A concept: TOS_FW_CONFIG - Trusted OS Firmware 1389 * configuration file. Used by Trusted OS (BL32), that is, OP-TEE 1390 * here. This is also called Manifest DT, related to the Manifest DT 1391 * passed in the FF-A Boot Information Blob, but with a different 1392 * compatible string. 1393 1394 * Scenario B: FW Handoff via Transfer List 1395 * Note: FF-A and non-secure entry are not yet supported with 1396 * Transfer List 1397 * a0 - DTB address or 0 (AArch64) 1398 * - must be 0 (AArch32) 1399 * a1 - 1 << 32 | TRANSFER_LIST_SIGNATURE[0:31] (AArch64) 1400 * - 1 << 24 | TRANSFER_LIST_SIGNATURE[0:23] (AArch32) 1401 * a2 - must be 0 (AArch64) 1402 * - DTB address or 0 (AArch32) 1403 * a3 - Transfer list base address 1404 * a4 - Not used 1405 */ 1406 1407 if (IS_ENABLED(CFG_TRANSFER_LIST)) { 1408 if (IS_ENABLED(CFG_ARM64_core) && 1409 a1 == TL_HANDOFF_X1_VALUE(TL_REG_CONVENTION_VER)) { 1410 boot_save_transfer_list(a2, a3, a0); 1411 boot_arg_fdt = a0; 1412 } else if (IS_ENABLED(CFG_ARM32_core) && 1413 a1 == TL_HANDOFF_R1_VALUE(TL_REG_CONVENTION_VER)) { 1414 boot_save_transfer_list(a0, a3, a2); 1415 boot_arg_fdt = a2; 1416 } 1417 1418 return; 1419 } 1420 1421 if (!IS_ENABLED(CFG_CORE_SEL2_SPMC)) { 1422 #if defined(CFG_DT_ADDR) 1423 boot_arg_fdt = CFG_DT_ADDR; 1424 #else 1425 boot_arg_fdt = a2; 1426 #endif 1427 } 1428 1429 if (IS_ENABLED(CFG_CORE_FFA)) { 1430 size_t fdt_max_size = CFG_DTB_MAX_SIZE; 1431 void *fdt = NULL; 1432 1433 if (IS_ENABLED(CFG_CORE_SEL2_SPMC) || 1434 IS_ENABLED(CFG_CORE_EL3_SPMC)) 1435 fdt = get_fdt_from_boot_info((void *)a0); 1436 else 1437 fdt = (void *)a0; 1438 if (IS_ENABLED(CFG_CORE_SEL2_SPMC)) { 1439 paddr_size_t size = 0; 1440 paddr_t base = 0; 1441 1442 if (IS_ENABLED(CFG_CORE_PHYS_RELOCATABLE)) { 1443 get_sec_mem_from_manifest(fdt, &base, &size); 1444 core_mmu_set_secure_memory(base, size); 1445 } else { 1446 core_mmu_get_secure_memory(&base, &size); 1447 } 1448 assert((unsigned long)fdt >= base); 1449 assert((unsigned long)fdt <= base + size); 1450 assert((unsigned long)fdt < VCORE_START_VA); 1451 fdt_max_size = VCORE_START_VA - (unsigned long)fdt; 1452 } 1453 init_manifest_dt(fdt, fdt_max_size); 1454 } else { 1455 if (IS_ENABLED(CFG_WITH_PAGER)) { 1456 #if defined(CFG_PAGEABLE_ADDR) 1457 boot_arg_pageable_part = CFG_PAGEABLE_ADDR; 1458 #else 1459 boot_arg_pageable_part = a0; 1460 #endif 1461 } 1462 if (!IS_ENABLED(CFG_WITH_ARM_TRUSTED_FW)) { 1463 #if defined(CFG_NS_ENTRY_ADDR) 1464 boot_arg_nsec_entry = CFG_NS_ENTRY_ADDR; 1465 #else 1466 boot_arg_nsec_entry = a4; 1467 #endif 1468 } 1469 } 1470 } 1471 1472 #if defined(CFG_TRANSFER_LIST) 1473 static TEE_Result release_transfer_list(void) 1474 { 1475 struct dt_descriptor *dt = get_external_dt_desc(); 1476 1477 if (!mapped_tl) 1478 return TEE_SUCCESS; 1479 1480 if (dt) { 1481 int ret = 0; 1482 struct transfer_list_entry *tl_e = NULL; 1483 1484 /* 1485 * Pack the DTB and update the transfer list before un-mapping 1486 */ 1487 ret = fdt_pack(dt->blob); 1488 if (ret < 0) { 1489 EMSG("Failed to pack Device Tree at 0x%" PRIxPA 1490 ": error %d", virt_to_phys(dt->blob), ret); 1491 panic(); 1492 } 1493 1494 tl_e = transfer_list_find(mapped_tl, TL_TAG_FDT); 1495 assert(dt->blob == transfer_list_entry_data(tl_e)); 1496 transfer_list_set_data_size(mapped_tl, tl_e, 1497 fdt_totalsize(dt->blob)); 1498 dt->blob = NULL; 1499 } 1500 1501 transfer_list_unmap_sync(mapped_tl); 1502 mapped_tl = NULL; 1503 1504 return TEE_SUCCESS; 1505 } 1506 1507 boot_final(release_transfer_list); 1508 #endif 1509