1 /* 2 * Copyright (c) 2013-2014, ARM Limited and Contributors. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * Redistributions of source code must retain the above copyright notice, this 8 * list of conditions and the following disclaimer. 9 * 10 * Redistributions in binary form must reproduce the above copyright notice, 11 * this list of conditions and the following disclaimer in the documentation 12 * and/or other materials provided with the distribution. 13 * 14 * Neither the name of ARM nor the names of its contributors may be used 15 * to endorse or promote products derived from this software without specific 16 * prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 19 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 22 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 #include <stdio.h> 32 #include <string.h> 33 #include <errno.h> 34 #include <assert.h> 35 #include <arch_helpers.h> 36 #include <console.h> 37 #include <platform.h> 38 #include <semihosting.h> 39 #include <bl_common.h> 40 41 /*********************************************************** 42 * Memory for sharing data while changing exception levels. 43 * Only used by the primary core. 44 **********************************************************/ 45 unsigned char bl2_el_change_mem_ptr[EL_CHANGE_MEM_SIZE]; 46 47 unsigned long *get_el_change_mem_ptr(void) 48 { 49 return (unsigned long *) bl2_el_change_mem_ptr; 50 } 51 52 unsigned long page_align(unsigned long value, unsigned dir) 53 { 54 unsigned long page_size = 1 << FOUR_KB_SHIFT; 55 56 /* Round up the limit to the next page boundary */ 57 if (value & (page_size - 1)) { 58 value &= ~(page_size - 1); 59 if (dir == UP) 60 value += page_size; 61 } 62 63 return value; 64 } 65 66 static inline unsigned int is_page_aligned (unsigned long addr) { 67 const unsigned long page_size = 1 << FOUR_KB_SHIFT; 68 69 return (addr & (page_size - 1)) == 0; 70 } 71 72 void change_security_state(unsigned int target_security_state) 73 { 74 unsigned long scr = read_scr(); 75 76 if (target_security_state == SECURE) 77 scr &= ~SCR_NS_BIT; 78 else if (target_security_state == NON_SECURE) 79 scr |= SCR_NS_BIT; 80 else 81 assert(0); 82 83 write_scr(scr); 84 } 85 86 int drop_el(aapcs64_params *args, 87 unsigned long spsr, 88 unsigned long entrypoint) 89 { 90 write_spsr(spsr); 91 write_elr(entrypoint); 92 eret(args->arg0, 93 args->arg1, 94 args->arg2, 95 args->arg3, 96 args->arg4, 97 args->arg5, 98 args->arg6, 99 args->arg7); 100 return -EINVAL; 101 } 102 103 long raise_el(aapcs64_params *args) 104 { 105 return smc(args->arg0, 106 args->arg1, 107 args->arg2, 108 args->arg3, 109 args->arg4, 110 args->arg5, 111 args->arg6, 112 args->arg7); 113 } 114 115 /* 116 * TODO: If we are not EL3 then currently we only issue an SMC. 117 * Add support for dropping into EL0 etc. Consider adding support 118 * for switching from S-EL1 to S-EL0/1 etc. 119 */ 120 long change_el(el_change_info *info) 121 { 122 unsigned long current_el = read_current_el(); 123 124 if (GET_EL(current_el) == MODE_EL3) { 125 /* 126 * We can go anywhere from EL3. So find where. 127 * TODO: Lots to do if we are going non-secure. 128 * Flip the NS bit. Restore NS registers etc. 129 * Just doing the bare minimal for now. 130 */ 131 132 if (info->security_state == NON_SECURE) 133 change_security_state(info->security_state); 134 135 return drop_el(&info->args, info->spsr, info->entrypoint); 136 } else 137 return raise_el(&info->args); 138 } 139 140 /* TODO: add a parameter for DAIF. not needed right now */ 141 unsigned long make_spsr(unsigned long target_el, 142 unsigned long target_sp, 143 unsigned long target_rw) 144 { 145 unsigned long spsr; 146 147 /* Disable all exceptions & setup the EL */ 148 spsr = (DAIF_FIQ_BIT | DAIF_IRQ_BIT | DAIF_ABT_BIT | DAIF_DBG_BIT) 149 << PSR_DAIF_SHIFT; 150 spsr |= PSR_MODE(target_rw, target_el, target_sp); 151 152 return spsr; 153 } 154 155 /******************************************************************************* 156 * The next two functions are the weak definitions. Platform specific 157 * code can override them if it wishes to. 158 ******************************************************************************/ 159 160 /******************************************************************************* 161 * Function that takes a memory layout into which BL31 has been either top or 162 * bottom loaded. Using this information, it populates bl31_mem_layout to tell 163 * BL31 how much memory it has access to and how much is available for use. It 164 * does not need the address where BL31 has been loaded as BL31 will reclaim 165 * all the memory used by BL2. 166 * TODO: Revisit if this and init_bl2_mem_layout can be replaced by a single 167 * routine. 168 ******************************************************************************/ 169 void init_bl31_mem_layout(const meminfo *bl2_mem_layout, 170 meminfo *bl31_mem_layout, 171 unsigned int load_type) 172 { 173 if (load_type == BOT_LOAD) { 174 /* 175 * ------------ ^ 176 * | BL2 | | 177 * |----------| ^ | BL2 178 * | | | BL2 free | total 179 * | | | size | size 180 * |----------| BL2 free base v | 181 * | BL31 | | 182 * ------------ BL2 total base v 183 */ 184 unsigned long bl31_size; 185 186 bl31_mem_layout->free_base = bl2_mem_layout->free_base; 187 188 bl31_size = bl2_mem_layout->free_base - bl2_mem_layout->total_base; 189 bl31_mem_layout->free_size = bl2_mem_layout->total_size - bl31_size; 190 } else { 191 /* 192 * ------------ ^ 193 * | BL31 | | 194 * |----------| ^ | BL2 195 * | | | BL2 free | total 196 * | | | size | size 197 * |----------| BL2 free base v | 198 * | BL2 | | 199 * ------------ BL2 total base v 200 */ 201 unsigned long bl2_size; 202 203 bl31_mem_layout->free_base = bl2_mem_layout->total_base; 204 205 bl2_size = bl2_mem_layout->free_base - bl2_mem_layout->total_base; 206 bl31_mem_layout->free_size = bl2_mem_layout->free_size + bl2_size; 207 } 208 209 bl31_mem_layout->total_base = bl2_mem_layout->total_base; 210 bl31_mem_layout->total_size = bl2_mem_layout->total_size; 211 bl31_mem_layout->attr = load_type; 212 213 flush_dcache_range((unsigned long) bl31_mem_layout, sizeof(meminfo)); 214 return; 215 } 216 217 /******************************************************************************* 218 * Function that takes a memory layout into which BL2 has been either top or 219 * bottom loaded along with the address where BL2 has been loaded in it. Using 220 * this information, it populates bl2_mem_layout to tell BL2 how much memory 221 * it has access to and how much is available for use. 222 ******************************************************************************/ 223 void init_bl2_mem_layout(meminfo *bl1_mem_layout, 224 meminfo *bl2_mem_layout, 225 unsigned int load_type, 226 unsigned long bl2_base) 227 { 228 unsigned tmp; 229 230 if (load_type == BOT_LOAD) { 231 bl2_mem_layout->total_base = bl2_base; 232 tmp = bl1_mem_layout->free_base - bl2_base; 233 bl2_mem_layout->total_size = bl1_mem_layout->free_size + tmp; 234 235 } else { 236 bl2_mem_layout->total_base = bl1_mem_layout->free_base; 237 tmp = bl1_mem_layout->total_base + bl1_mem_layout->total_size; 238 bl2_mem_layout->total_size = tmp - bl1_mem_layout->free_base; 239 } 240 241 bl2_mem_layout->free_base = bl1_mem_layout->free_base; 242 bl2_mem_layout->free_size = bl1_mem_layout->free_size; 243 bl2_mem_layout->attr = load_type; 244 245 flush_dcache_range((unsigned long) bl2_mem_layout, sizeof(meminfo)); 246 return; 247 } 248 249 static void dump_load_info(unsigned long image_load_addr, 250 unsigned long image_size, 251 const meminfo *mem_layout) 252 { 253 #if DEBUG 254 printf("Trying to load image at address 0x%lx, size = 0x%lx\r\n", 255 image_load_addr, image_size); 256 printf("Current memory layout:\r\n"); 257 printf(" total region = [0x%lx, 0x%lx]\r\n", mem_layout->total_base, 258 mem_layout->total_base + mem_layout->total_size); 259 printf(" free region = [0x%lx, 0x%lx]\r\n", mem_layout->free_base, 260 mem_layout->free_base + mem_layout->free_size); 261 #endif 262 } 263 264 /******************************************************************************* 265 * Generic function to load an image into the trusted RAM using semihosting 266 * given a name, extents of free memory & whether the image should be loaded at 267 * the bottom or top of the free memory. It updates the memory layout if the 268 * load is successful. 269 ******************************************************************************/ 270 unsigned long load_image(meminfo *mem_layout, 271 const char *image_name, 272 unsigned int load_type, 273 unsigned long fixed_addr) 274 { 275 unsigned long temp_image_base, image_base; 276 long offset; 277 int image_flen; 278 279 /* Find the size of the image */ 280 image_flen = semihosting_get_flen(image_name); 281 if (image_flen < 0) { 282 printf("ERROR: Cannot access '%s' file (%i).\r\n", 283 image_name, image_flen); 284 return 0; 285 } 286 287 /* See if we have enough space */ 288 if (image_flen > mem_layout->free_size) { 289 printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", 290 image_name); 291 dump_load_info(0, image_flen, mem_layout); 292 return 0; 293 } 294 295 switch (load_type) { 296 297 case TOP_LOAD: 298 299 /* Load the image in the top of free memory */ 300 temp_image_base = mem_layout->free_base + mem_layout->free_size; 301 temp_image_base -= image_flen; 302 303 /* Page align base address and check whether the image still fits */ 304 image_base = page_align(temp_image_base, DOWN); 305 assert(image_base <= temp_image_base); 306 307 if (image_base < mem_layout->free_base) { 308 printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", 309 image_name); 310 dump_load_info(image_base, image_flen, mem_layout); 311 return 0; 312 } 313 314 /* Calculate the amount of extra memory used due to alignment */ 315 offset = temp_image_base - image_base; 316 317 break; 318 319 case BOT_LOAD: 320 321 /* Load the BL2 image in the bottom of free memory */ 322 temp_image_base = mem_layout->free_base; 323 image_base = page_align(temp_image_base, UP); 324 assert(image_base >= temp_image_base); 325 326 /* Page align base address and check whether the image still fits */ 327 if (image_base + image_flen > 328 mem_layout->free_base + mem_layout->free_size) { 329 printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", 330 image_name); 331 dump_load_info(image_base, image_flen, mem_layout); 332 return 0; 333 } 334 335 /* Calculate the amount of extra memory used due to alignment */ 336 offset = image_base - temp_image_base; 337 338 break; 339 340 default: 341 assert(0); 342 343 } 344 345 /* 346 * Some images must be loaded at a fixed address, not a dynamic one. 347 * 348 * This has been implemented as a hack on top of the existing dynamic 349 * loading mechanism, for the time being. If the 'fixed_addr' function 350 * argument is different from zero, then it will force the load address. 351 * So we still have this principle of top/bottom loading but the code 352 * determining the load address is bypassed and the load address is 353 * forced to the fixed one. 354 * 355 * This can result in quite a lot of wasted space because we still use 356 * 1 sole meminfo structure to represent the extents of free memory, 357 * where we should use some sort of linked list. 358 * 359 * E.g. we want to load BL2 at address 0x04020000, the resulting memory 360 * layout should look as follows: 361 * ------------ 0x04040000 362 * | | <- Free space (1) 363 * |----------| 364 * | BL2 | 365 * |----------| 0x04020000 366 * | | <- Free space (2) 367 * |----------| 368 * | BL1 | 369 * ------------ 0x04000000 370 * 371 * But in the current hacky implementation, we'll need to specify 372 * whether BL2 is loaded at the top or bottom of the free memory. 373 * E.g. if BL2 is considered as top-loaded, the meminfo structure 374 * will give the following view of the memory, hiding the chunk of 375 * free memory above BL2: 376 * ------------ 0x04040000 377 * | | 378 * | | 379 * | BL2 | 380 * |----------| 0x04020000 381 * | | <- Free space (2) 382 * |----------| 383 * | BL1 | 384 * ------------ 0x04000000 385 */ 386 if (fixed_addr != 0) { 387 /* Load the image at the given address. */ 388 image_base = fixed_addr; 389 390 /* Check whether the image fits. */ 391 if ((image_base < mem_layout->free_base) || 392 (image_base + image_flen > 393 mem_layout->free_base + mem_layout->free_size)) { 394 printf("ERROR: Cannot load '%s' file: Not enough space.\r\n", 395 image_name); 396 dump_load_info(image_base, image_flen, mem_layout); 397 return 0; 398 } 399 400 /* Check whether the fixed load address is page-aligned. */ 401 if (!is_page_aligned(image_base)) { 402 printf("ERROR: Cannot load '%s' file at unaligned address 0x%lx.\r\n", 403 image_name, fixed_addr); 404 return 0; 405 } 406 407 /* 408 * Calculate the amount of extra memory used due to fixed 409 * loading. 410 */ 411 if (load_type == TOP_LOAD) { 412 unsigned long max_addr, space_used; 413 /* 414 * ------------ max_addr 415 * | /wasted/ | | offset 416 * |..........|.............................. 417 * | image | | image_flen 418 * |----------| fixed_addr 419 * | | 420 * | | 421 * ------------ total_base 422 */ 423 max_addr = mem_layout->total_base + mem_layout->total_size; 424 /* 425 * Compute the amount of memory used by the image. 426 * Corresponds to all space above the image load 427 * address. 428 */ 429 space_used = max_addr - fixed_addr; 430 /* 431 * Calculate the amount of wasted memory within the 432 * amount of memory used by the image. 433 */ 434 offset = space_used - image_flen; 435 } else /* BOT_LOAD */ 436 /* 437 * ------------ 438 * | | 439 * | | 440 * |----------| 441 * | image | 442 * |..........| fixed_addr 443 * | /wasted/ | | offset 444 * ------------ total_base 445 */ 446 offset = fixed_addr - mem_layout->total_base; 447 } 448 449 /* We have enough space so load the image now */ 450 image_flen = semihosting_download_file(image_name, 451 image_flen, 452 (void *) image_base); 453 if (image_flen <= 0) { 454 printf("ERROR: Failed to load '%s' file from semihosting (%i).\r\n", 455 image_name, image_flen); 456 return 0; 457 } 458 459 /* 460 * File has been successfully loaded. Update the free memory 461 * data structure & flush the contents of the TZRAM so that 462 * the next EL can see it. 463 */ 464 /* Update the memory contents */ 465 flush_dcache_range(image_base, image_flen); 466 467 mem_layout->free_size -= image_flen + offset; 468 469 /* Update the base of free memory since its moved up */ 470 if (load_type == BOT_LOAD) 471 mem_layout->free_base += offset + image_flen; 472 473 return image_base; 474 } 475 476 /******************************************************************************* 477 * Run a loaded image from the given entry point. This could result in either 478 * dropping into a lower exception level or jumping to a higher exception level. 479 * The only way of doing the latter is through an SMC. In either case, setup the 480 * parameters for the EL change request correctly. 481 ******************************************************************************/ 482 int run_image(unsigned long entrypoint, 483 unsigned long spsr, 484 unsigned long target_security_state, 485 meminfo *mem_layout, 486 void *data) 487 { 488 el_change_info run_image_info; 489 unsigned long current_el = read_current_el(); 490 491 /* Tell next EL what we want done */ 492 run_image_info.args.arg0 = RUN_IMAGE; 493 run_image_info.entrypoint = entrypoint; 494 run_image_info.spsr = spsr; 495 run_image_info.security_state = target_security_state; 496 run_image_info.next = 0; 497 498 /* 499 * If we are EL3 then only an eret can take us to the desired 500 * exception level. Else for the time being assume that we have 501 * to jump to a higher EL and issue an SMC. Contents of argY 502 * will go into the general purpose register xY e.g. arg0->x0 503 */ 504 if (GET_EL(current_el) == MODE_EL3) { 505 run_image_info.args.arg1 = (unsigned long) mem_layout; 506 run_image_info.args.arg2 = (unsigned long) data; 507 } else { 508 run_image_info.args.arg1 = entrypoint; 509 run_image_info.args.arg2 = spsr; 510 run_image_info.args.arg3 = (unsigned long) mem_layout; 511 run_image_info.args.arg4 = (unsigned long) data; 512 } 513 514 return change_el(&run_image_info); 515 } 516