Turst zone monitor and smc code.

git-svn-id: svn://svn.code.sf.net/p/chibios/svn/trunk@11007 35acf78f-673a-0410-8e92-d51de3d6d3f4

1 files changed, 166 insertions, 0 deletions

diff --git a/os/common/ports/ARMCAx-TZ/compilers/GCC/monitor.S b/os/common/ports/ARMCAx-TZ/compilers/GCC/monitor.S
new file mode 100644
index 000000000..9b6a1e0f4
--- /dev/null
+++ b/os/common/ports/ARMCAx-TZ/compilers/GCC/monitor.S
@@ -0,0 +1,166 @@
+/*
+    ChibiOS - Copyright (C) 2006..2017 Giovanni Di Sirio
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+*/
+
+/**
+ * @file    ARMCAx-TZ/compilers/GCC/monitor.S
+ * @brief   ARMCAx-TZ monitor code
+ *
+ * @addtogroup ARM_CORE
+ * @{
+ */
+#define _FROM_ASM_
+#include "chlicense.h"
+#include "chconf.h"
+#include "armparams.h"
+
+/*
+ * We are facing an architecure with security extension exploited.
+ * The following execution paths are taken by the execution units
+ * running in secure state when an irq is fired (sm_irq), and in non-secure
+ * state when a fiq interrupt is fired (sm_fiq).
+ * They originate by the monitor irq/fiq vector and run in monitor mode,
+ * ie in secure state.
+ * It assumes the following, set at boot time, or wherever it needs:
+ *   SCR.FW  == 0 and SCR.FIQ == 1 and SCR.IRQ == 0 in non-secure state,
+ *      ie FIQs are taken to monitor mode, IRQs are taken locally
+ *   SCR.FW  == 0 and SCR.FIQ == 0 and SCR.IRQ == 1 in secure state,
+ *      ie FIQs are taken locally, IRQs are taken to monitor mode
+ *   MVBAR holds the address of the monitor vectors base.
+ *   The code and the stacks memory reside both in secure memory.
+ */
+
+#if !defined(__DOXYGEN__)
+
+                .set    MODE_USR,       0x10
+                .set    MODE_FIQ,       0x11
+                .set    MODE_IRQ,       0x12
+                .set    MODE_SVC,       0x13
+                .set    MODE_MON,       0x16
+                .set    MODE_ABT,       0x17
+                .set    MODE_UND,       0x1B
+                .set    MODE_SYS,       0x1F
+
+                .set    I_BIT,          0x80
+                .set    F_BIT,          0x40
+
+                .set    SCR_NS,         0x01
+                .set    SCR_IRQ,        0x02
+                .set    SCR_FIQ,        0x04
+                .set    SCR_EA,         0x08
+                .set    SCR_FW,         0x10
+                .set    SCR_AW,         0x20
+
+                .set    MON_S_SCR,      (SCR_IRQ)
+                .set    MON_NS_SCR,     (SCR_FIQ|SCR_NS)
+
+                .set    MSG_OK,         0
+                .set    MSG_TIMEOUT,    -1
+                .set    MSG_RESET,      -2
+                .section .data
+                .balign 4
+ _ns_thread:    .zero   4
+
+                .section .text
+                .code   32
+                .balign 4
+/*
+ * Monitor vectors
+ */
+				.global _monitor_vectors
+_monitor_vectors:
+                b   .           // Reset vector, not used
+                b   .           // Undefined instruction, not used
+                b   sm_call     // Secure monitor call
+                b   .           // Prefetch abort, not taken to Monitor mode
+                b   .           // Data abort, not taken to Monitor mode
+                b   .           // Reserved
+                b   sm_irq      // IRQ
+                b   sm_fiq      // FIQ
+/*
+ * SMC entry
+ */
+sm_call:
+                b   sm_call     // Unhandled
+/*
+ * FIQ entry
+ *
+ * Here the fiq is taken from non-secure state, via the FIQ vector
+ * that is in the monitor vector table.
+ * Current mode is monitor (so current state is secure).
+ * We switch immediately to system mode, enabling FIQ.
+ * The FIQ is then served while the ns_thread is running.
+ * Because the ns_thread has the highest priority, the handler returns here
+ * without scheduling.
+ */
+sm_fiq:
+                                                            // check point: SCR.NS == 1
+                stmfd   sp!, {r0}
+                ldr     r0, =MON_S_SCR                      // enter in the secure world
+                mrc     p15, 0, r0, c1, c1, 0
+                msr     CPSR_c, #MODE_SYS | I_BIT           // FIQ enabled, served via base table
+                msr     CPSR_c, #MODE_MON | I_BIT | F_BIT   // the handler returns here. Switch to monitor mode
+                ldr     r0, =MON_NS_SCR                     // set non-secure SCR before return
+                mrc     p15, 0, r0, c1, c1, 0
+                ldmfd   sp!, {r0}
+                subs    pc, lr, #4                          // return into non-secure world
+/*
+ * IRQ entry
+ *
+ * Here the IRQ is taken from secure state.
+ * Current mode is monitor (so current state is secure),
+ * the previous mode and status is in mon.spsr and
+ * the return address+4 is in mon.lr.
+ * Because we are running in secure state, main thread is suspended in
+ * the smc handler.
+ * The main thread is resumed with MSG_TIMEOUT
+ * The non secure IRQ handler has then the responsibility to return into
+ * secure state via a smc.
+ *
+ */
+ sm_irq:
+                                                            // check point: SCR.NS == 0
+                msr     CPSR_c, #MODE_SYS | I_BIT | F_BIT
+                stmfd   sp!, {r0-r3, r12, lr}               // save scratch registers and lr
+                msr     CPSR_c, #MODE_MON | I_BIT | F_BIT
+                mrs     r0, SPSR
+                mov     r1, lr
+                msr     CPSR_c, #MODE_SYS | I_BIT | F_BIT
+                stmfd   sp!, {r0, r1}                       // push R0=SPSR, R1=LR_MON.
+
+                ldr     r0, =_ns_thread                     // check point: ns_tread != 0
+                mov     r1, #MSG_TIMEOUT
+#if CH_DBG_SYSTEM_STATE_CHECK
+                bl      _dbg_check_lock
+#endif
+                bl      chThdResumeS                        // resume the ns_thread and serve the IRQ
+                                                            // into non-secure world
+#if CH_DBG_SYSTEM_STATE_CHECK
+                bl      _dbg_check_unlock
+#endif
+                // The ns_thread reentered smc, that set SRC.NS to 0
+                // re-establish the original conditions
+                ldmfd   sp!, {r0, r1}                       // pop R0=SPSR, R1=LR_MON.
+                msr     CPSR_c, #MODE_MON | I_BIT | F_BIT
+                msr     SPSR_fsxc, r0
+                mov     lr, r1
+                msr     CPSR_c, #MODE_SYS | I_BIT | F_BIT
+                ldmfd   sp!, {r0-r3, r12, lr}
+                msr     CPSR_c, #MODE_MON | I_BIT | F_BIT
+                subs    pc, lr, #4                          // return into secure world
+
+#endif /* !defined(__DOXYGEN__) */
+
+/** @} */