xref: /optee_os/core/arch/arm/kernel/entry_a32.S (revision 65401337ca064f6c2866b6881e3d93edbf7f2921)
1/* SPDX-License-Identifier: BSD-2-Clause */
2/*
3 * Copyright (c) 2014, Linaro Limited
4 */
5
6#include <arm32_macros.S>
7#include <arm.h>
8#include <asm.S>
9#include <generated/asm-defines.h>
10#include <keep.h>
11#include <kernel/asan.h>
12#include <kernel/cache_helpers.h>
13#include <kernel/unwind.h>
14#include <platform_config.h>
15#include <sm/optee_smc.h>
16#include <sm/teesmc_opteed.h>
17#include <sm/teesmc_opteed_macros.h>
18
19.arch_extension sec
20
21.section .data
22.balign 4
23
24#ifdef CFG_BOOT_SYNC_CPU
25.equ SEM_CPU_READY, 1
26#endif
27
28#ifdef CFG_PL310
29.section .rodata.init
30panic_boot_file:
31	.asciz __FILE__
32
33/*
34 * void assert_flat_mapped_range(uint32_t vaddr, uint32_t line)
35 */
36LOCAL_FUNC __assert_flat_mapped_range , :
37UNWIND(	.fnstart)
38UNWIND(	.cantunwind)
39	push	{ r4-r6, lr }
40	mov	r4, r0
41	mov	r5, r1
42	bl	cpu_mmu_enabled
43	cmp	r0, #0
44	beq	1f
45	mov	r0, r4
46	bl	virt_to_phys
47	cmp	r0, r4
48	beq	1f
49	/*
50	 * this must be compliant with the panic generic routine:
51	 * __do_panic(__FILE__, __LINE__, __func__, str)
52	 */
53	ldr	r0, =panic_boot_file
54	mov	r1, r5
55	mov	r2, #0
56	mov	r3, #0
57	bl	__do_panic
58	b	.		/* should NOT return */
591:	pop	{ r4-r6, pc }
60UNWIND(	.fnend)
61END_FUNC __assert_flat_mapped_range
62
63	/* panic if mmu is enable and vaddr != paddr (scratch lr) */
64	.macro assert_flat_mapped_range va, line
65		ldr	r0, \va
66		ldr	r1, =\line
67		bl	__assert_flat_mapped_range
68	.endm
69#endif /* CFG_PL310 */
70
71FUNC plat_cpu_reset_early , :
72UNWIND(	.fnstart)
73	bx	lr
74UNWIND(	.fnend)
75END_FUNC plat_cpu_reset_early
76DECLARE_KEEP_PAGER plat_cpu_reset_early
77.weak plat_cpu_reset_early
78
79	.section .identity_map, "ax"
80	.align 5
81LOCAL_FUNC reset_vect_table , : , .identity_map
82	b	.
83	b	.	/* Undef */
84	b	.	/* Syscall */
85	b	.	/* Prefetch abort */
86	b	.	/* Data abort */
87	b	.	/* Reserved */
88	b	.	/* IRQ */
89	b	.	/* FIQ */
90END_FUNC reset_vect_table
91
92	.macro cpu_is_ready
93#ifdef CFG_BOOT_SYNC_CPU
94	bl	__get_core_pos
95	lsl	r0, r0, #2
96	ldr	r1,=sem_cpu_sync
97	ldr	r2, =SEM_CPU_READY
98	str	r2, [r1, r0]
99	dsb
100	sev
101#endif
102	.endm
103
104	.macro wait_primary
105#ifdef CFG_BOOT_SYNC_CPU
106	ldr	r0, =sem_cpu_sync
107	mov	r2, #SEM_CPU_READY
108	sev
1091:
110	ldr	r1, [r0]
111	cmp	r1, r2
112	wfene
113	bne	1b
114#endif
115	.endm
116
117	.macro wait_secondary
118#ifdef CFG_BOOT_SYNC_CPU
119	ldr	r0, =sem_cpu_sync
120	mov	r3, #CFG_TEE_CORE_NB_CORE
121	mov	r2, #SEM_CPU_READY
122	sev
1231:
124	subs	r3, r3, #1
125	beq	3f
126	add	r0, r0, #4
1272:
128	ldr	r1, [r0]
129	cmp	r1, r2
130	wfene
131	bne	2b
132	b	1b
1333:
134#endif
135	.endm
136
137	/*
138	 * set_sctlr : Setup some core configuration in CP15 SCTLR
139	 *
140	 * Setup required by current implementation of the OP-TEE core:
141	 * - Disable data and instruction cache.
142	 * - MMU is expected off and exceptions trapped in ARM mode.
143	 * - Enable or disable alignment checks upon platform configuration.
144	 * - Optionally enable write-implies-execute-never.
145	 * - Optionally enable round robin strategy for cache replacement.
146	 *
147	 * Clobbers r0.
148	 */
149	.macro set_sctlr
150		read_sctlr r0
151		bic	r0, r0, #(SCTLR_M | SCTLR_C)
152		bic	r0, r0, #SCTLR_I
153		bic	r0, r0, #SCTLR_TE
154		orr	r0, r0, #SCTLR_SPAN
155#if defined(CFG_SCTLR_ALIGNMENT_CHECK)
156		orr	r0, r0, #SCTLR_A
157#else
158		bic	r0, r0, #SCTLR_A
159#endif
160#if defined(CFG_HWSUPP_MEM_PERM_WXN) && defined(CFG_CORE_RWDATA_NOEXEC)
161		orr	r0, r0, #(SCTLR_WXN | SCTLR_UWXN)
162#endif
163#if defined(CFG_ENABLE_SCTLR_RR)
164		orr	r0, r0, #SCTLR_RR
165#endif
166		write_sctlr r0
167	.endm
168
169	/*
170	 * Save boot arguments
171	 * entry r0, saved r4: pagestore
172	 * entry r1, saved r7: (ARMv7 standard bootarg #1)
173	 * entry r2, saved r6: device tree address, (ARMv7 standard bootarg #2)
174	 * entry lr, saved r5: non-secure entry address (ARMv7 bootarg #0)
175	 */
176	.macro bootargs_entry
177#if defined(CFG_NS_ENTRY_ADDR)
178	ldr	r5, =CFG_NS_ENTRY_ADDR
179#else
180	mov	r5, lr
181#endif
182#if defined(CFG_PAGEABLE_ADDR)
183	ldr	r4, =CFG_PAGEABLE_ADDR
184#else
185	mov	r4, r0
186#endif
187#if defined(CFG_DT_ADDR)
188	ldr	r6, =CFG_DT_ADDR
189#else
190	mov	r6, r2
191#endif
192	mov	r7, r1
193	.endm
194
195	.macro maybe_init_spectre_workaround
196#if !defined(CFG_WITH_ARM_TRUSTED_FW) && \
197    (defined(CFG_CORE_WORKAROUND_SPECTRE_BP) || \
198     defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC))
199	read_midr r0
200	ubfx	r1, r0, #MIDR_IMPLEMENTER_SHIFT, #MIDR_IMPLEMENTER_WIDTH
201	cmp	r1, #MIDR_IMPLEMENTER_ARM
202	bne	1f
203	ubfx	r1, r0, #MIDR_PRIMARY_PART_NUM_SHIFT, \
204			#MIDR_PRIMARY_PART_NUM_WIDTH
205
206	movw	r2, #CORTEX_A8_PART_NUM
207	cmp	r1, r2
208	moveq	r2, #ACTLR_CA8_ENABLE_INVALIDATE_BTB
209	beq	2f
210
211	movw	r2, #CORTEX_A15_PART_NUM
212	cmp	r1, r2
213	moveq	r2, #ACTLR_CA15_ENABLE_INVALIDATE_BTB
214	bne	1f	/* Skip it for all other CPUs */
2152:
216	read_actlr r0
217	orr	r0, r0, r2
218	write_actlr r0
219	isb
2201:
221#endif
222	.endm
223
224FUNC _start , :
225UNWIND(	.fnstart)
226UNWIND(	.cantunwind)
227
228	bootargs_entry
229
230	/*
231	 * 32bit entry is expected to execute Supervisor mode,
232	 * some bootloader may enter in Supervisor or Monitor
233	 */
234	cps	#CPSR_MODE_SVC
235
236	/* Early ARM secure MP specific configuration */
237	bl	plat_cpu_reset_early
238	maybe_init_spectre_workaround
239
240	set_sctlr
241	isb
242
243	ldr	r0, =reset_vect_table
244	write_vbar r0
245
246#if defined(CFG_WITH_ARM_TRUSTED_FW)
247	b	reset_primary
248#else
249	bl	__get_core_pos
250	cmp	r0, #0
251	beq	reset_primary
252	b	reset_secondary
253#endif
254UNWIND(	.fnend)
255END_FUNC _start
256DECLARE_KEEP_INIT _start
257
258	/*
259	 * Setup sp to point to the top of the tmp stack for the current CPU:
260	 * sp is assigned stack_tmp_export + cpu_id * stack_tmp_stride
261	 */
262	.macro set_sp
263		bl	__get_core_pos
264		cmp	r0, #CFG_TEE_CORE_NB_CORE
265		/* Unsupported CPU, park it before it breaks something */
266		bge	unhandled_cpu
267
268		/*
269		 * stack_tmp_stride and stack_tmp_stride_rel are the
270		 * equivalent of:
271		 * extern const u32 stack_tmp_stride;
272		 * u32 stack_tmp_stride_rel = (u32)&stack_tmp_stride -
273		 *			      (u32)&stack_tmp_stride_rel
274		 *
275		 * To load the value of stack_tmp_stride we do the equivalent
276		 * of:
277		 * *(u32 *)(stack_tmp_stride + (u32)&stack_tmp_stride_rel)
278		 */
279		adr	r3, stack_tmp_stride_rel
280		ldr	r1, [r3]
281		ldr	r1, [r1, r3]
282
283		/* Same pattern as for stack_tmp_stride above */
284		adr	r3, stack_tmp_export_rel
285		ldr	r2, [r3]
286		ldr	r2, [r2, r3]
287
288		/*
289		 * r0 is core pos
290		 * r1 is value of stack_tmp_stride
291		 * r2 is value of stack_tmp_export
292		 */
293		mul	r1, r0, r1
294		add	sp, r1, r2
295	.endm
296
297	/*
298	 * Cache maintenance during entry: handle outer cache.
299	 * End address is exclusive: first byte not to be changed.
300	 * Note however arm_clX_inv/cleanbyva operate on full cache lines.
301	 *
302	 * Use ANSI #define to trap source file line number for PL310 assertion
303	 */
304	.macro __inval_cache_vrange vbase, vend, line
305#if defined(CFG_PL310) && !defined(CFG_PL310_SIP_PROTOCOL)
306		assert_flat_mapped_range (\vbase), (\line)
307		bl	pl310_base
308		ldr	r1, \vbase
309		ldr	r2, \vend
310		bl	arm_cl2_invbypa
311#endif
312		ldr	r0, \vbase
313		ldr	r1, \vend
314		sub	r1, r1, r0
315		bl	dcache_inv_range
316	.endm
317
318	.macro __flush_cache_vrange vbase, vend, line
319#if defined(CFG_PL310) && !defined(CFG_PL310_SIP_PROTOCOL)
320		assert_flat_mapped_range (\vbase), (\line)
321		ldr	r0, \vbase
322		ldr	r1, \vend
323		sub	r1, r1, r0
324		bl	dcache_clean_range
325		bl	pl310_base
326		ldr	r1, \vbase
327		ldr	r2, \vend
328		bl	arm_cl2_cleaninvbypa
329#endif
330		ldr	r0, \vbase
331		ldr	r1, \vend
332		sub	r1, r1, r0
333		bl	dcache_cleaninv_range
334	.endm
335
336#define inval_cache_vrange(vbase, vend) \
337		__inval_cache_vrange vbase, vend, __LINE__
338
339#define flush_cache_vrange(vbase, vend) \
340		__flush_cache_vrange vbase, vend, __LINE__
341
342#ifdef CFG_BOOT_SYNC_CPU
343#define flush_cpu_semaphores \
344		flush_cache_vrange(sem_cpu_sync_start, sem_cpu_sync_end)
345#else
346#define flush_cpu_semaphores
347#endif
348
349LOCAL_FUNC reset_primary , : , .identity_map
350UNWIND(	.fnstart)
351UNWIND(	.cantunwind)
352
353	/* preserve r4-r7: bootargs */
354
355#ifdef CFG_WITH_PAGER
356	/*
357	 * Move init code into correct location and move hashes to a
358	 * temporary safe location until the heap is initialized.
359	 *
360	 * The binary is built as:
361	 * [Pager code, rodata and data] : In correct location
362	 * [Init code and rodata] : Should be copied to __init_start
363	 * [struct boot_embdata + data] : Should be saved before
364	 * initializing pager, first uint32_t tells the length of the data
365	 */
366	ldr	r0, =__init_start	/* dst */
367	ldr	r1, =__data_end 	/* src */
368	ldr	r2, =__init_end
369	sub	r2, r2, r0		/* init len */
370	ldr	r12, [r1, r2]		/* length of hashes etc */
371	add	r2, r2, r12		/* length of init and hashes etc */
372	/* Copy backwards (as memmove) in case we're overlapping */
373	add	r0, r0, r2		/* __init_start + len */
374	add	r1, r1, r2		/* __data_end + len */
375	str	r0, cached_mem_end
376	ldr	r2, =__init_start
377copy_init:
378	ldmdb	r1!, {r3, r8-r12}
379	stmdb	r0!, {r3, r8-r12}
380	cmp	r0, r2
381	bgt	copy_init
382#else
383	/*
384	 * The binary is built as:
385	 * [Core, rodata and data] : In correct location
386	 * [struct boot_embdata + data] : Should be moved to __end, first
387	 * uint32_t tells the length of the struct + data
388	 */
389	ldr	r0, =__end		/* dst */
390	ldr	r1, =__data_end		/* src */
391	ldr	r2, [r1]		/* struct boot_embdata::total_len */
392	/* Copy backwards (as memmove) in case we're overlapping */
393	add	r0, r0, r2
394	add	r1, r1, r2
395	str	r0, cached_mem_end
396	ldr	r2, =__end
397
398copy_init:
399	ldmdb	r1!, {r3, r8-r12}
400	stmdb	r0!, {r3, r8-r12}
401	cmp	r0, r2
402	bgt	copy_init
403#endif
404
405	/*
406	 * Clear .bss, this code obviously depends on the linker keeping
407	 * start/end of .bss at least 8 byte aligned.
408	 */
409	ldr	r0, =__bss_start
410	ldr	r1, =__bss_end
411	mov	r2, #0
412	mov	r3, #0
413clear_bss:
414	stmia	r0!, {r2, r3}
415	cmp	r0, r1
416	bls	clear_bss
417
418#ifdef CFG_VIRTUALIZATION
419	/*
420	 * Clear .nex_bss, this code obviously depends on the linker keeping
421	 * start/end of .bss at least 8 byte aligned.
422	 */
423	ldr	r0, =__nex_bss_start
424	ldr	r1, =__nex_bss_end
425	mov	r2, #0
426	mov	r3, #0
427clear_nex_bss:
428	stmia	r0!, {r2, r3}
429	cmp	r0, r1
430	bls	clear_nex_bss
431#endif
432
433#ifdef CFG_CORE_SANITIZE_KADDRESS
434	/* First initialize the entire shadow area with no access */
435	ldr	r0, =__asan_shadow_start	/* start */
436	ldr	r1, =__asan_shadow_end	/* limit */
437	mov	r2, #ASAN_DATA_RED_ZONE
438shadow_no_access:
439	str	r2, [r0], #4
440	cmp	r0, r1
441	bls	shadow_no_access
442
443	/* Mark the entire stack area as OK */
444	ldr	r2, =CFG_ASAN_SHADOW_OFFSET
445	ldr	r0, =__nozi_stack_start	/* start */
446	lsr	r0, r0, #ASAN_BLOCK_SHIFT
447	add	r0, r0, r2
448	ldr	r1, =__nozi_stack_end	/* limit */
449	lsr	r1, r1, #ASAN_BLOCK_SHIFT
450	add	r1, r1, r2
451	mov	r2, #0
452shadow_stack_access_ok:
453	strb	r2, [r0], #1
454	cmp	r0, r1
455	bls	shadow_stack_access_ok
456#endif
457
458	set_sp
459
460	/* complete ARM secure MP common configuration */
461	bl	plat_primary_init_early
462
463	/* Enable Console */
464	bl	console_init
465
466#ifdef CFG_PL310
467	bl	pl310_base
468	bl	arm_cl2_config
469#endif
470
471	/*
472	 * Invalidate dcache for all memory used during initialization to
473	 * avoid nasty surprices when the cache is turned on. We must not
474	 * invalidate memory not used by OP-TEE since we may invalidate
475	 * entries used by for instance ARM Trusted Firmware.
476	 */
477	inval_cache_vrange(cached_mem_start, cached_mem_end)
478
479#if defined(CFG_PL310) && !defined(CFG_PL310_SIP_PROTOCOL)
480	/* Enable PL310 if not yet enabled */
481	bl	pl310_base
482	bl	arm_cl2_enable
483#endif
484
485#ifdef CFG_CORE_ASLR
486	mov	r0, r6
487	bl	get_aslr_seed
488#else
489	mov	r0, #0
490#endif
491
492	ldr	r1, =boot_mmu_config
493	bl	core_init_mmu_map
494
495#ifdef CFG_CORE_ASLR
496	/*
497	 * Process relocation information for updating with the new offset.
498	 * We're doing this now before MMU is enabled as some of the memory
499	 * will become write protected.
500	 */
501	ldr	r0, =boot_mmu_config
502	ldr	r0, [r0, #CORE_MMU_CONFIG_LOAD_OFFSET]
503	/*
504	 * Update cached_mem_end address with load offset since it was
505	 * calculated before relocation.
506	 */
507	ldr	r2, cached_mem_end
508	add	r2, r2, r0
509	str	r2, cached_mem_end
510
511	bl	relocate
512#endif
513
514	bl	__get_core_pos
515	bl	enable_mmu
516#ifdef CFG_CORE_ASLR
517	/*
518	 * Reinitialize console, since register_serial_console() has
519	 * previously registered a PA and with ASLR the VA is different
520	 * from the PA.
521	 */
522	bl	console_init
523#endif
524
525	mov	r0, r4		/* pageable part address */
526	mov	r1, r5		/* ns-entry address */
527	mov	r2, r6		/* DT address */
528	bl	boot_init_primary
529
530	/*
531	 * In case we've touched memory that secondary CPUs will use before
532	 * they have turned on their D-cache, clean and invalidate the
533	 * D-cache before exiting to normal world.
534	 */
535	flush_cache_vrange(cached_mem_start, cached_mem_end)
536
537	/* release secondary boot cores and sync with them */
538	cpu_is_ready
539	flush_cpu_semaphores
540	wait_secondary
541
542#ifdef CFG_PL310_LOCKED
543#ifdef CFG_PL310_SIP_PROTOCOL
544#error "CFG_PL310_LOCKED must not be defined when CFG_PL310_SIP_PROTOCOL=y"
545#endif
546	/* lock/invalidate all lines: pl310 behaves as if disable */
547	bl	pl310_base
548	bl	arm_cl2_lockallways
549	bl	pl310_base
550	bl	arm_cl2_cleaninvbyway
551#endif
552
553	/*
554	 * Clear current thread id now to allow the thread to be reused on
555	 * next entry. Matches the thread_init_boot_thread() in
556	 * boot.c.
557	 */
558	bl 	thread_clr_boot_thread
559
560#if defined(CFG_WITH_ARM_TRUSTED_FW)
561	ldr	r0, =boot_mmu_config
562	ldr	r0, [r0, #CORE_MMU_CONFIG_LOAD_OFFSET]
563	ldr	r1, =thread_vector_table
564	/* Pass the vector address returned from main_init */
565	sub	r1, r1, r0
566#else
567	/* realy standard bootarg #1 and #2 to non secure entry */
568	mov	r4, #0
569	mov	r3, r6		/* std bootarg #2 for register R2 */
570	mov	r2, r7		/* std bootarg #1 for register R1 */
571	mov	r1, #0
572#endif /* CFG_WITH_ARM_TRUSTED_FW */
573
574	mov	r0, #TEESMC_OPTEED_RETURN_ENTRY_DONE
575	smc	#0
576	b	.	/* SMC should not return */
577UNWIND(	.fnend)
578END_FUNC reset_primary
579
580#ifdef CFG_BOOT_SYNC_CPU
581LOCAL_DATA sem_cpu_sync_start , :
582	.word	sem_cpu_sync
583END_DATA sem_cpu_sync_start
584
585LOCAL_DATA sem_cpu_sync_end , :
586	.word	sem_cpu_sync + (CFG_TEE_CORE_NB_CORE << 2)
587END_DATA sem_cpu_sync_end
588#endif
589
590LOCAL_DATA cached_mem_start , :
591	.word	__text_start
592END_DATA cached_mem_start
593
594LOCAL_DATA cached_mem_end , :
595	.skip	4
596END_DATA cached_mem_end
597
598LOCAL_FUNC unhandled_cpu , :
599UNWIND(	.fnstart)
600	wfi
601	b	unhandled_cpu
602UNWIND(	.fnend)
603END_FUNC unhandled_cpu
604
605#ifdef CFG_CORE_ASLR
606LOCAL_FUNC relocate , :
607	push	{r4-r5}
608	/* r0 holds load offset */
609#ifdef CFG_WITH_PAGER
610	ldr	r12, =__init_end
611#else
612	ldr	r12, =__end
613#endif
614	ldr	r2, [r12, #BOOT_EMBDATA_RELOC_OFFSET]
615	ldr	r3, [r12, #BOOT_EMBDATA_RELOC_LEN]
616
617	mov_imm	r1, TEE_RAM_START
618	add	r2, r2, r12	/* start of relocations */
619	add	r3, r3, r2	/* end of relocations */
620
621	/*
622	 * Relocations are not formatted as Rel32, instead they are in a
623	 * compressed format created by get_reloc_bin() in
624	 * scripts/gen_tee_bin.py
625	 *
626	 * All the R_ARM_RELATIVE relocations are translated into a list
627	 * list of 32-bit offsets from TEE_RAM_START. At each address a
628	 * 32-bit value pointed out which increased with the load offset.
629	 */
630
631#ifdef CFG_WITH_PAGER
632	/*
633	 * With pager enabled we can only relocate the pager and init
634	 * parts, the rest has to be done when a page is populated.
635	 */
636	sub	r12, r12, r1
637#endif
638
639	b	2f
640	/* Loop over the relocation addresses and process all entries */
6411:	ldr	r4, [r2], #4
642#ifdef CFG_WITH_PAGER
643	/* Skip too large addresses */
644	cmp	r4, r12
645	bge	2f
646#endif
647	ldr	r5, [r4, r1]
648	add	r5, r5, r0
649	str	r5, [r4, r1]
650
6512:	cmp	r2, r3
652	bne	1b
653
654	pop	{r4-r5}
655	bx	lr
656END_FUNC relocate
657#endif
658
659/*
660 * void enable_mmu(unsigned long core_pos);
661 *
662 * This function depends on being mapped with in the identity map where
663 * physical address and virtual address is the same. After MMU has been
664 * enabled the instruction pointer will be updated to execute as the new
665 * offset instead. Stack pointers and the return address are updated.
666 */
667LOCAL_FUNC enable_mmu , : , .identity_map
668	/* r0 = core pos */
669	adr	r1, boot_mmu_config
670
671#ifdef CFG_WITH_LPAE
672	ldm	r1!, {r2, r3}
673	/*
674	 * r2 = ttbcr
675	 * r3 = mair0
676	 */
677	write_ttbcr r2
678	write_mair0 r3
679
680	ldm	r1!, {r2, r3}
681	/*
682	 * r2 = ttbr0_base
683	 * r3 = ttbr0_core_offset
684	 */
685
686	/*
687	 * ttbr0_el1 = ttbr0_base + ttbr0_core_offset * core_pos
688	 */
689	mla	r12, r0, r3, r2
690	mov	r0, #0
691	write_ttbr0_64bit r12, r0
692	write_ttbr1_64bit r0, r0
693#else
694	ldm	r1!, {r2, r3}
695	/*
696	 * r2 = prrr
697	 * r3 = nmrr
698	 */
699	write_prrr r2
700	write_nmrr r3
701
702	ldm	r1!, {r2, r3}
703	/*
704	 * r2 = dacr
705	 * r3 = ttbcr
706	 */
707	write_dacr r2
708	write_ttbcr r3
709
710	ldm	r1!, {r2}
711	/* r2 = ttbr */
712	write_ttbr0 r2
713	write_ttbr1 r2
714
715	mov	r2, #0
716	write_contextidr r2
717#endif
718	ldm	r1!, {r2}
719	/* r2 = load_offset (always 0 if CFG_CORE_ASLR=n) */
720	isb
721
722	/* Invalidate TLB */
723	write_tlbiall
724
725	/*
726	 * Make sure translation table writes have drained into memory and
727	 * the TLB invalidation is complete.
728	 */
729	dsb	sy
730	isb
731
732	read_sctlr r0
733	orr	r0, r0, #SCTLR_M
734#ifndef CFG_WITH_LPAE
735	/* Enable Access flag (simplified access permissions) and TEX remap */
736	orr	r0, r0, #(SCTLR_AFE | SCTLR_TRE)
737#endif
738	write_sctlr r0
739	isb
740
741	/* Update vbar */
742	read_vbar r1
743	add	r1, r1, r2
744	write_vbar r1
745	isb
746
747	/* Invalidate instruction cache and branch predictor */
748	write_iciallu
749	write_bpiall
750	isb
751
752	read_sctlr r0
753	/* Enable I and D cache */
754	orr	r0, r0, #SCTLR_I
755	orr	r0, r0, #SCTLR_C
756#if defined(CFG_ENABLE_SCTLR_Z)
757	/*
758	 * This is only needed on ARMv7 architecture and hence conditionned
759	 * by configuration directive CFG_ENABLE_SCTLR_Z. For recent
760	 * architectures, the program flow prediction is automatically
761	 * enabled upon MMU enablement.
762	 */
763	orr	r0, r0, #SCTLR_Z
764#endif
765	write_sctlr r0
766	isb
767
768	/* Adjust stack pointer and return address */
769	add	sp, sp, r2
770	add	lr, lr, r2
771
772	bx	lr
773END_FUNC enable_mmu
774
775LOCAL_DATA stack_tmp_export_rel , :
776	.word	stack_tmp_export - stack_tmp_export_rel
777END_DATA stack_tmp_export_rel
778
779LOCAL_DATA stack_tmp_stride_rel , :
780	.word	stack_tmp_stride - stack_tmp_stride_rel
781END_DATA stack_tmp_stride_rel
782
783DATA boot_mmu_config , : /* struct core_mmu_config */
784	.skip	CORE_MMU_CONFIG_SIZE
785END_DATA boot_mmu_config
786
787#if defined(CFG_WITH_ARM_TRUSTED_FW)
788FUNC cpu_on_handler , : , .identity_map
789UNWIND(	.fnstart)
790UNWIND(	.cantunwind)
791	mov	r4, r0
792	mov	r5, r1
793	mov	r6, lr
794
795	set_sctlr
796	isb
797
798	adr	r0, reset_vect_table
799	write_vbar r0
800
801	mov	r4, lr
802
803	bl	__get_core_pos
804	bl	enable_mmu
805
806	set_sp
807
808	mov	r0, r4
809	mov	r1, r5
810	bl	boot_cpu_on_handler
811
812	bx	r6
813UNWIND(	.fnend)
814END_FUNC cpu_on_handler
815DECLARE_KEEP_PAGER cpu_on_handler
816
817#else /* defined(CFG_WITH_ARM_TRUSTED_FW) */
818
819LOCAL_FUNC reset_secondary , : , .identity_map
820UNWIND(	.fnstart)
821UNWIND(	.cantunwind)
822	adr	r0, reset_vect_table
823	write_vbar r0
824
825	wait_primary
826
827	set_sp
828#ifdef CFG_CORE_ASLR
829	/*
830	 * stack_tmp_export which is used as base when initializing sp has
831	 * been relocated to the new offset. Since MMU isn't enabled on
832	 * this CPU yet we need to restore the corresponding physical
833	 * address.
834	 */
835	adr	r0, boot_mmu_config
836	ldr	r0, [r0, #CORE_MMU_CONFIG_LOAD_OFFSET]
837	sub	sp, sp, r0
838#endif
839
840#if defined (CFG_BOOT_SECONDARY_REQUEST)
841	/* if L1 is not invalidated before, do it here */
842	mov	r0, #DCACHE_OP_INV
843	bl	dcache_op_level1
844#endif
845
846	bl	__get_core_pos
847	bl	enable_mmu
848
849	cpu_is_ready
850
851#if defined (CFG_BOOT_SECONDARY_REQUEST)
852	/*
853	 * boot_core_hpen() return value (r0) is address of
854	 * ns entry context structure
855	 */
856	bl	boot_core_hpen
857	ldm	r0, {r0, r6}
858#else
859	mov	r0, r5		/* ns-entry address */
860	mov	r6, #0
861#endif
862	bl	boot_init_secondary
863
864	mov	r0, #TEESMC_OPTEED_RETURN_ENTRY_DONE
865	mov	r1, r6
866	mov	r2, #0
867	mov	r3, #0
868	mov	r4, #0
869	smc	#0
870	b	.	/* SMC should not return */
871UNWIND(	.fnend)
872END_FUNC reset_secondary
873DECLARE_KEEP_PAGER reset_secondary
874#endif /* defined(CFG_WITH_ARM_TRUSTED_FW) */
875