From 4db05b767f3615842d4d0ad411be4e654ddbb759 Mon Sep 17 00:00:00 2001 From: isiora Date: Tue, 14 Nov 2017 22:46:32 +0000 Subject: Turst zone monitor and smc code. git-svn-id: svn://svn.code.sf.net/p/chibios/svn/trunk@11007 35acf78f-673a-0410-8e92-d51de3d6d3f4 --- os/common/ports/ARMCAx-TZ/compilers/GCC/monitor.S | 166 ++++++++++++++++++++++ 1 file changed, 166 insertions(+) create mode 100644 os/common/ports/ARMCAx-TZ/compilers/GCC/monitor.S (limited to 'os/common/ports/ARMCAx-TZ/compilers/GCC') diff --git a/os/common/ports/ARMCAx-TZ/compilers/GCC/monitor.S b/os/common/ports/ARMCAx-TZ/compilers/GCC/monitor.S new file mode 100644 index 000000000..9b6a1e0f4 --- /dev/null +++ b/os/common/ports/ARMCAx-TZ/compilers/GCC/monitor.S @@ -0,0 +1,166 @@ +/* + ChibiOS - Copyright (C) 2006..2017 Giovanni Di Sirio + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/ + +/** + * @file ARMCAx-TZ/compilers/GCC/monitor.S + * @brief ARMCAx-TZ monitor code + * + * @addtogroup ARM_CORE + * @{ + */ +#define _FROM_ASM_ +#include "chlicense.h" +#include "chconf.h" +#include "armparams.h" + +/* + * We are facing an architecure with security extension exploited. + * The following execution paths are taken by the execution units + * running in secure state when an irq is fired (sm_irq), and in non-secure + * state when a fiq interrupt is fired (sm_fiq). + * They originate by the monitor irq/fiq vector and run in monitor mode, + * ie in secure state. + * It assumes the following, set at boot time, or wherever it needs: + * SCR.FW == 0 and SCR.FIQ == 1 and SCR.IRQ == 0 in non-secure state, + * ie FIQs are taken to monitor mode, IRQs are taken locally + * SCR.FW == 0 and SCR.FIQ == 0 and SCR.IRQ == 1 in secure state, + * ie FIQs are taken locally, IRQs are taken to monitor mode + * MVBAR holds the address of the monitor vectors base. + * The code and the stacks memory reside both in secure memory. + */ + +#if !defined(__DOXYGEN__) + + .set MODE_USR, 0x10 + .set MODE_FIQ, 0x11 + .set MODE_IRQ, 0x12 + .set MODE_SVC, 0x13 + .set MODE_MON, 0x16 + .set MODE_ABT, 0x17 + .set MODE_UND, 0x1B + .set MODE_SYS, 0x1F + + .set I_BIT, 0x80 + .set F_BIT, 0x40 + + .set SCR_NS, 0x01 + .set SCR_IRQ, 0x02 + .set SCR_FIQ, 0x04 + .set SCR_EA, 0x08 + .set SCR_FW, 0x10 + .set SCR_AW, 0x20 + + .set MON_S_SCR, (SCR_IRQ) + .set MON_NS_SCR, (SCR_FIQ|SCR_NS) + + .set MSG_OK, 0 + .set MSG_TIMEOUT, -1 + .set MSG_RESET, -2 + .section .data + .balign 4 + _ns_thread: .zero 4 + + .section .text + .code 32 + .balign 4 +/* + * Monitor vectors + */ + .global _monitor_vectors +_monitor_vectors: + b . // Reset vector, not used + b . // Undefined instruction, not used + b sm_call // Secure monitor call + b . // Prefetch abort, not taken to Monitor mode + b . // Data abort, not taken to Monitor mode + b . // Reserved + b sm_irq // IRQ + b sm_fiq // FIQ +/* + * SMC entry + */ +sm_call: + b sm_call // Unhandled +/* + * FIQ entry + * + * Here the fiq is taken from non-secure state, via the FIQ vector + * that is in the monitor vector table. + * Current mode is monitor (so current state is secure). + * We switch immediately to system mode, enabling FIQ. + * The FIQ is then served while the ns_thread is running. + * Because the ns_thread has the highest priority, the handler returns here + * without scheduling. + */ +sm_fiq: + // check point: SCR.NS == 1 + stmfd sp!, {r0} + ldr r0, =MON_S_SCR // enter in the secure world + mrc p15, 0, r0, c1, c1, 0 + msr CPSR_c, #MODE_SYS | I_BIT // FIQ enabled, served via base table + msr CPSR_c, #MODE_MON | I_BIT | F_BIT // the handler returns here. Switch to monitor mode + ldr r0, =MON_NS_SCR // set non-secure SCR before return + mrc p15, 0, r0, c1, c1, 0 + ldmfd sp!, {r0} + subs pc, lr, #4 // return into non-secure world +/* + * IRQ entry + * + * Here the IRQ is taken from secure state. + * Current mode is monitor (so current state is secure), + * the previous mode and status is in mon.spsr and + * the return address+4 is in mon.lr. + * Because we are running in secure state, main thread is suspended in + * the smc handler. + * The main thread is resumed with MSG_TIMEOUT + * The non secure IRQ handler has then the responsibility to return into + * secure state via a smc. + * + */ + sm_irq: + // check point: SCR.NS == 0 + msr CPSR_c, #MODE_SYS | I_BIT | F_BIT + stmfd sp!, {r0-r3, r12, lr} // save scratch registers and lr + msr CPSR_c, #MODE_MON | I_BIT | F_BIT + mrs r0, SPSR + mov r1, lr + msr CPSR_c, #MODE_SYS | I_BIT | F_BIT + stmfd sp!, {r0, r1} // push R0=SPSR, R1=LR_MON. + + ldr r0, =_ns_thread // check point: ns_tread != 0 + mov r1, #MSG_TIMEOUT +#if CH_DBG_SYSTEM_STATE_CHECK + bl _dbg_check_lock +#endif + bl chThdResumeS // resume the ns_thread and serve the IRQ + // into non-secure world +#if CH_DBG_SYSTEM_STATE_CHECK + bl _dbg_check_unlock +#endif + // The ns_thread reentered smc, that set SRC.NS to 0 + // re-establish the original conditions + ldmfd sp!, {r0, r1} // pop R0=SPSR, R1=LR_MON. + msr CPSR_c, #MODE_MON | I_BIT | F_BIT + msr SPSR_fsxc, r0 + mov lr, r1 + msr CPSR_c, #MODE_SYS | I_BIT | F_BIT + ldmfd sp!, {r0-r3, r12, lr} + msr CPSR_c, #MODE_MON | I_BIT | F_BIT + subs pc, lr, #4 // return into secure world + +#endif /* !defined(__DOXYGEN__) */ + +/** @} */ -- cgit v1.2.3