1 /* 2 * Copyright (c) 2013, ARM Limited. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * Redistributions of source code must retain the above copyright notice, this 8 * list of conditions and the following disclaimer. 9 * 10 * Redistributions in binary form must reproduce the above copyright notice, 11 * this list of conditions and the following disclaimer in the documentation 12 * and/or other materials provided with the distribution. 13 * 14 * Neither the name of ARM nor the names of its contributors may be used 15 * to endorse or promote products derived from this software without specific 16 * prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 19 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <stdio.h> 32 #include <string.h> 33 #include <errno.h> 34 #include <assert.h> 35 #include <arch_helpers.h> 36 #include <console.h> 37 #include <platform.h> 38 #include <semihosting.h> 39 #include <bl_common.h> 40 #include <bl1.h> 41 42 /*********************************************************** 43 * Memory for sharing data while changing exception levels. 44 * Only used by the primary core. 45 **********************************************************/ 46 unsigned char bl2_el_change_mem_ptr[EL_CHANGE_MEM_SIZE]; 47 48 unsigned long *get_el_change_mem_ptr(void) 49 { 50 return (unsigned long *) bl2_el_change_mem_ptr; 51 } 52 53 unsigned long page_align(unsigned long value, unsigned dir) 54 { 55 unsigned long page_size = 1 << FOUR_KB_SHIFT; 56 57 /* Round up the limit to the next page boundary */ 58 if (value & (page_size - 1)) { 59 value &= ~(page_size - 1); 60 if (dir == UP) 61 value += page_size; 62 } 63 64 return value; 65 } 66 67 static inline unsigned int is_page_aligned (unsigned long addr) { 68 const unsigned long page_size = 1 << FOUR_KB_SHIFT; 69 70 return (addr & (page_size - 1)) == 0; 71 } 72 73 void change_security_state(unsigned int target_security_state) 74 { 75 unsigned long scr = read_scr(); 76 77 if (target_security_state == SECURE) 78 scr &= ~SCR_NS_BIT; 79 else if (target_security_state == NON_SECURE) 80 scr |= SCR_NS_BIT; 81 else 82 assert(0); 83 84 write_scr(scr); 85 } 86 87 int drop_el(aapcs64_params *args, 88 unsigned long spsr, 89 unsigned long entrypoint) 90 { 91 write_spsr(spsr); 92 write_elr(entrypoint); 93 eret(args->arg0, 94 args->arg1, 95 args->arg2, 96 args->arg3, 97 args->arg4, 98 args->arg5, 99 args->arg6, 100 args->arg7); 101 return -EINVAL; 102 } 103 104 long raise_el(aapcs64_params *args) 105 { 106 return smc(args->arg0, 107 args->arg1, 108 args->arg2, 109 args->arg3, 110 args->arg4, 111 args->arg5, 112 args->arg6, 113 args->arg7); 114 } 115 116 /* 117 * TODO: If we are not EL3 then currently we only issue an SMC. 118 * Add support for dropping into EL0 etc. Consider adding support 119 * for switching from S-EL1 to S-EL0/1 etc. 120 */ 121 long change_el(el_change_info *info) 122 { 123 unsigned long current_el = read_current_el(); 124 125 if (GET_EL(current_el) == MODE_EL3) { 126 /* 127 * We can go anywhere from EL3. So find where. 128 * TODO: Lots to do if we are going non-secure. 129 * Flip the NS bit. Restore NS registers etc. 130 * Just doing the bare minimal for now. 131 */ 132 133 if (info->security_state == NON_SECURE) 134 change_security_state(info->security_state); 135 136 return drop_el(&info->args, info->spsr, info->entrypoint); 137 } else 138 return raise_el(&info->args); 139 } 140 141 /* TODO: add a parameter for DAIF. not needed right now */ 142 unsigned long make_spsr(unsigned long target_el, 143 unsigned long target_sp, 144 unsigned long target_rw) 145 { 146 unsigned long spsr; 147 148 /* Disable all exceptions & setup the EL */ 149 spsr = (DAIF_FIQ_BIT | DAIF_IRQ_BIT | DAIF_ABT_BIT | DAIF_DBG_BIT) 150 << PSR_DAIF_SHIFT; 151 spsr |= PSR_MODE(target_rw, target_el, target_sp); 152 153 return spsr; 154 } 155 156 /******************************************************************************* 157 * The next two functions are the weak definitions. Platform specific 158 * code can override them if it wishes to. 159 ******************************************************************************/ 160 161 /******************************************************************************* 162 * Function that takes a memory layout into which BL31 has been either top or 163 * bottom loaded. Using this information, it populates bl31_mem_layout to tell 164 * BL31 how much memory it has access to and how much is available for use. It 165 * does not need the address where BL31 has been loaded as BL31 will reclaim 166 * all the memory used by BL2. 167 * TODO: Revisit if this and init_bl2_mem_layout can be replaced by a single 168 * routine. 169 ******************************************************************************/ 170 void init_bl31_mem_layout(const meminfo *bl2_mem_layout, 171 meminfo *bl31_mem_layout, 172 unsigned int load_type) 173 { 174 if (load_type == BOT_LOAD) { 175 /* 176 * ------------ ^ 177 * | BL2 | | 178 * |----------| ^ | BL2 179 * | | | BL2 free | total 180 * | | | size | size 181 * |----------| BL2 free base v | 182 * | BL31 | | 183 * ------------ BL2 total base v 184 */ 185 unsigned long bl31_size; 186 187 bl31_mem_layout->free_base = bl2_mem_layout->free_base; 188 189 bl31_size = bl2_mem_layout->free_base - bl2_mem_layout->total_base; 190 bl31_mem_layout->free_size = bl2_mem_layout->total_size - bl31_size; 191 } else { 192 /* 193 * ------------ ^ 194 * | BL31 | | 195 * |----------| ^ | BL2 196 * | | | BL2 free | total 197 * | | | size | size 198 * |----------| BL2 free base v | 199 * | BL2 | | 200 * ------------ BL2 total base v 201 */ 202 unsigned long bl2_size; 203 204 bl31_mem_layout->free_base = bl2_mem_layout->total_base; 205 206 bl2_size = bl2_mem_layout->free_base - bl2_mem_layout->total_base; 207 bl31_mem_layout->free_size = bl2_mem_layout->free_size + bl2_size; 208 } 209 210 bl31_mem_layout->total_base = bl2_mem_layout->total_base; 211 bl31_mem_layout->total_size = bl2_mem_layout->total_size; 212 bl31_mem_layout->attr = load_type; 213 214 flush_dcache_range((unsigned long) bl31_mem_layout, sizeof(meminfo)); 215 return; 216 } 217 218 /******************************************************************************* 219 * Function that takes a memory layout into which BL2 has been either top or 220 * bottom loaded along with the address where BL2 has been loaded in it. Using 221 * this information, it populates bl2_mem_layout to tell BL2 how much memory 222 * it has access to and how much is available for use. 223 ******************************************************************************/ 224 void init_bl2_mem_layout(meminfo *bl1_mem_layout, 225 meminfo *bl2_mem_layout, 226 unsigned int load_type, 227 unsigned long bl2_base) 228 { 229 unsigned tmp; 230 231 if (load_type == BOT_LOAD) { 232 bl2_mem_layout->total_base = bl2_base; 233 tmp = bl1_mem_layout->free_base - bl2_base; 234 bl2_mem_layout->total_size = bl1_mem_layout->free_size + tmp; 235 236 } else { 237 bl2_mem_layout->total_base = bl1_mem_layout->free_base; 238 tmp = bl1_mem_layout->total_base + bl1_mem_layout->total_size; 239 bl2_mem_layout->total_size = tmp - bl1_mem_layout->free_base; 240 } 241 242 bl2_mem_layout->free_base = bl1_mem_layout->free_base; 243 bl2_mem_layout->free_size = bl1_mem_layout->free_size; 244 bl2_mem_layout->attr = load_type; 245 246 flush_dcache_range((unsigned long) bl2_mem_layout, sizeof(meminfo)); 247 return; 248 } 249 250 static void dump_load_info(unsigned long image_load_addr, 251 unsigned long image_size, 252 const meminfo *mem_layout) 253 { 254 #if DEBUG 255 printf("Trying to load image at address 0x%lx, size = 0x%lx\r\n", 256 image_load_addr, image_size); 257 printf("Current memory layout:\r\n"); 258 printf(" total region = [0x%lx, 0x%lx]\r\n", mem_layout->total_base, 259 mem_layout->total_base + mem_layout->total_size); 260 printf(" free region = [0x%lx, 0x%lx]\r\n", mem_layout->free_base, 261 mem_layout->free_base + mem_layout->free_size); 262 #endif 263 } 264 265 /******************************************************************************* 266 * Generic function to load an image into the trusted RAM using semihosting 267 * given a name, extents of free memory & whether the image should be loaded at 268 * the bottom or top of the free memory. It updates the memory layout if the 269 * load is successful. 270 ******************************************************************************/ 271 unsigned long load_image(meminfo *mem_layout, 272 const char *image_name, 273 unsigned int load_type, 274 unsigned long fixed_addr) 275 { 276 unsigned long temp_image_base, image_base; 277 long offset; 278 int image_flen; 279 280 /* Find the size of the image */ 281 image_flen = semihosting_get_flen(image_name); 282 if (image_flen < 0) { 283 printf("ERROR: Cannot access '%s' file (%i).\r\n", 284 image_name, image_flen); 285 return 0; 286 } 287 288 /* See if we have enough space */ 289 if (image_flen > mem_layout->free_size) { 290 printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", 291 image_name); 292 dump_load_info(0, image_flen, mem_layout); 293 return 0; 294 } 295 296 switch (load_type) { 297 298 case TOP_LOAD: 299 300 /* Load the image in the top of free memory */ 301 temp_image_base = mem_layout->free_base + mem_layout->free_size; 302 temp_image_base -= image_flen; 303 304 /* Page align base address and check whether the image still fits */ 305 image_base = page_align(temp_image_base, DOWN); 306 assert(image_base <= temp_image_base); 307 308 if (image_base < mem_layout->free_base) { 309 printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", 310 image_name); 311 dump_load_info(image_base, image_flen, mem_layout); 312 return 0; 313 } 314 315 /* Calculate the amount of extra memory used due to alignment */ 316 offset = temp_image_base - image_base; 317 318 break; 319 320 case BOT_LOAD: 321 322 /* Load the BL2 image in the bottom of free memory */ 323 temp_image_base = mem_layout->free_base; 324 image_base = page_align(temp_image_base, UP); 325 assert(image_base >= temp_image_base); 326 327 /* Page align base address and check whether the image still fits */ 328 if (image_base + image_flen > 329 mem_layout->free_base + mem_layout->free_size) { 330 printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", 331 image_name); 332 dump_load_info(image_base, image_flen, mem_layout); 333 return 0; 334 } 335 336 /* Calculate the amount of extra memory used due to alignment */ 337 offset = image_base - temp_image_base; 338 339 break; 340 341 default: 342 assert(0); 343 344 } 345 346 /* 347 * Some images must be loaded at a fixed address, not a dynamic one. 348 * 349 * This has been implemented as a hack on top of the existing dynamic 350 * loading mechanism, for the time being. If the 'fixed_addr' function 351 * argument is different from zero, then it will force the load address. 352 * So we still have this principle of top/bottom loading but the code 353 * determining the load address is bypassed and the load address is 354 * forced to the fixed one. 355 * 356 * This can result in quite a lot of wasted space because we still use 357 * 1 sole meminfo structure to represent the extents of free memory, 358 * where we should use some sort of linked list. 359 * 360 * E.g. we want to load BL2 at address 0x04020000, the resulting memory 361 * layout should look as follows: 362 * ------------ 0x04040000 363 * | | <- Free space (1) 364 * |----------| 365 * | BL2 | 366 * |----------| 0x04020000 367 * | | <- Free space (2) 368 * |----------| 369 * | BL1 | 370 * ------------ 0x04000000 371 * 372 * But in the current hacky implementation, we'll need to specify 373 * whether BL2 is loaded at the top or bottom of the free memory. 374 * E.g. if BL2 is considered as top-loaded, the meminfo structure 375 * will give the following view of the memory, hiding the chunk of 376 * free memory above BL2: 377 * ------------ 0x04040000 378 * | | 379 * | | 380 * | BL2 | 381 * |----------| 0x04020000 382 * | | <- Free space (2) 383 * |----------| 384 * | BL1 | 385 * ------------ 0x04000000 386 */ 387 if (fixed_addr != 0) { 388 /* Load the image at the given address. */ 389 image_base = fixed_addr; 390 391 /* Check whether the image fits. */ 392 if ((image_base < mem_layout->free_base) || 393 (image_base + image_flen > 394 mem_layout->free_base + mem_layout->free_size)) { 395 printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", 396 image_name); 397 dump_load_info(image_base, image_flen, mem_layout); 398 return 0; 399 } 400 401 /* Check whether the fixed load address is page-aligned. */ 402 if (!is_page_aligned(image_base)) { 403 printf("ERROR: Cannot load '%s' file at unaligned address 0x%lx.\r\n", 404 image_name, fixed_addr); 405 return 0; 406 } 407 408 /* 409 * Calculate the amount of extra memory used due to fixed 410 * loading. 411 */ 412 if (load_type == TOP_LOAD) { 413 unsigned long max_addr, space_used; 414 /* 415 * ------------ max_addr 416 * | /wasted/ | | offset 417 * |..........|.............................. 418 * | image | | image_flen 419 * |----------| fixed_addr 420 * | | 421 * | | 422 * ------------ total_base 423 */ 424 max_addr = mem_layout->total_base + mem_layout->total_size; 425 /* 426 * Compute the amount of memory used by the image. 427 * Corresponds to all space above the image load 428 * address. 429 */ 430 space_used = max_addr - fixed_addr; 431 /* 432 * Calculate the amount of wasted memory within the 433 * amount of memory used by the image. 434 */ 435 offset = space_used - image_flen; 436 } else /* BOT_LOAD */ 437 /* 438 * ------------ 439 * | | 440 * | | 441 * |----------| 442 * | image | 443 * |..........| fixed_addr 444 * | /wasted/ | | offset 445 * ------------ total_base 446 */ 447 offset = fixed_addr - mem_layout->total_base; 448 } 449 450 /* We have enough space so load the image now */ 451 image_flen = semihosting_download_file(image_name, 452 image_flen, 453 (void *) image_base); 454 if (image_flen <= 0) { 455 printf("ERROR: Failed to load '%s' file from semihosting (%i).\r\n", 456 image_name, image_flen); 457 return 0; 458 } 459 460 /* 461 * File has been successfully loaded. Update the free memory 462 * data structure & flush the contents of the TZRAM so that 463 * the next EL can see it. 464 */ 465 /* Update the memory contents */ 466 flush_dcache_range(image_base, image_flen); 467 468 mem_layout->free_size -= image_flen + offset; 469 470 /* Update the base of free memory since its moved up */ 471 if (load_type == BOT_LOAD) 472 mem_layout->free_base += offset + image_flen; 473 474 return image_base; 475 } 476 477 /******************************************************************************* 478 * Run a loaded image from the given entry point. This could result in either 479 * dropping into a lower exception level or jumping to a higher exception level. 480 * The only way of doing the latter is through an SMC. In either case, setup the 481 * parameters for the EL change request correctly. 482 ******************************************************************************/ 483 int run_image(unsigned long entrypoint, 484 unsigned long spsr, 485 unsigned long target_security_state, 486 meminfo *mem_layout, 487 void *data) 488 { 489 el_change_info run_image_info; 490 unsigned long current_el = read_current_el(); 491 492 /* Tell next EL what we want done */ 493 run_image_info.args.arg0 = RUN_IMAGE; 494 run_image_info.entrypoint = entrypoint; 495 run_image_info.spsr = spsr; 496 run_image_info.security_state = target_security_state; 497 run_image_info.next = 0; 498 499 /* 500 * If we are EL3 then only an eret can take us to the desired 501 * exception level. Else for the time being assume that we have 502 * to jump to a higher EL and issue an SMC. Contents of argY 503 * will go into the general purpose register xY e.g. arg0->x0 504 */ 505 if (GET_EL(current_el) == MODE_EL3) { 506 run_image_info.args.arg1 = (unsigned long) mem_layout; 507 run_image_info.args.arg2 = (unsigned long) data; 508 } else { 509 run_image_info.args.arg1 = entrypoint; 510 run_image_info.args.arg2 = spsr; 511 run_image_info.args.arg3 = (unsigned long) mem_layout; 512 run_image_info.args.arg4 = (unsigned long) data; 513 } 514 515 return change_el(&run_image_info); 516 } 517