Refactor the switch from supervisor to hypervisor to a new function called at the beginning of do_bootefi().

Signed-off-by: Heinrich Schuchardt xypron.glpk@gmx.de --- v3 Move weak function to common/bootm.c. Rename functions. Add more comments. Avoid static variable for jump buffer. v2 Use weak function with implementation in arch directories --- arch/arm/cpu/armv7/Makefile | 1 + arch/arm/cpu/armv7/exception_level.c | 56 ++++++++++++++++++++++ arch/arm/cpu/armv8/Makefile | 1 + arch/arm/cpu/armv8/exception_level.c | 55 +++++++++++++++++++++ cmd/bootefi.c | 72 ++-------------------------- common/bootm.c | 10 ++++ include/bootm.h | 5 ++ 7 files changed, 132 insertions(+), 68 deletions(-) create mode 100644 arch/arm/cpu/armv7/exception_level.c create mode 100644 arch/arm/cpu/armv8/exception_level.c

diff --git a/arch/arm/cpu/armv7/Makefile b/arch/arm/cpu/armv7/Makefile index 4f4647c90ac..8c955d0d528 100644 --- a/arch/arm/cpu/armv7/Makefile +++ b/arch/arm/cpu/armv7/Makefile @@ -14,6 +14,7 @@ obj-$(CONFIG_SYS_ARM_MPU) += mpu_v7r.o

ifneq ($(CONFIG_SPL_BUILD),y) obj-$(CONFIG_EFI_LOADER) += sctlr.o +obj-$(CONFIG_ARMV7_NONSEC) += exception_level.o endif

ifneq ($(CONFIG_SKIP_LOWLEVEL_INIT),y) diff --git a/arch/arm/cpu/armv7/exception_level.c b/arch/arm/cpu/armv7/exception_level.c new file mode 100644 index 00000000000..e116435623f --- /dev/null +++ b/arch/arm/cpu/armv7/exception_level.c @@ -0,0 +1,56 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Switch to non-secure mode + * + * Copyright (c) 2018 Heinrich Schuchardt + * + * This module contains the ARMv7 specific code required for leaving the + * secure mode before booting an operating system. + */ + +#include <common.h> +#include <bootm.h> +#include <asm/armv7.h> +#include <asm/secure.h> +#include <asm/setjmp.h> + +/** + * entry_non_secure() - entry point when switching to non-secure mode + * + * When switching to non-secure mode switch_to_non_secure_mode() calls this + * function passing a jump buffer. We use this jump buffer to restoring the + * original stack and register state. + * + * @non_secure_jmp: jump buffer for restoring stack and registers + */ +static void entry_non_secure(struct jmp_buf_data *non_secure_jmp) +{ + dcache_enable(); + debug("Reached non-secure mode\n"); + + /* Restore stack and registers saved in switch_to_non_secure_mode() */ + longjmp(non_secure_jmp, 1); +} + +/** + * switch_to_non_secure_mode() - switch to non-secure mode + * + * Operating systems are expected to run in non-secure mode. Here we check if + * we are running in secure mode and switch to non-secure mode if necessary. + */ +void switch_to_non_secure_mode(void) +{ + static bool is_nonsec; + struct jmp_buf_data non_secure_jmp; + + if (armv7_boot_nonsec() && !is_nonsec) { + if (setjmp(&non_secure_jmp)) + return; + dcache_disable(); /* flush cache before switch to HYP */ + armv7_init_nonsec(); + is_nonsec = true; + secure_ram_addr(_do_nonsec_entry)(entry_non_secure, + (uintptr_t)&non_secure_jmp, + 0, 0); + } +} diff --git a/arch/arm/cpu/armv8/Makefile b/arch/arm/cpu/armv8/Makefile index 52c8daa0496..8b0b887a696 100644 --- a/arch/arm/cpu/armv8/Makefile +++ b/arch/arm/cpu/armv8/Makefile @@ -14,6 +14,7 @@ ifdef CONFIG_SPL_BUILD obj-$(CONFIG_ARMV8_SPL_EXCEPTION_VECTORS) += exceptions.o else obj-y += exceptions.o +obj-y += exception_level.o endif obj-y += cache.o obj-y += tlb.o diff --git a/arch/arm/cpu/armv8/exception_level.c b/arch/arm/cpu/armv8/exception_level.c new file mode 100644 index 00000000000..245af3f1d4e --- /dev/null +++ b/arch/arm/cpu/armv8/exception_level.c @@ -0,0 +1,55 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Switch to non-secure mode + * + * Copyright (c) 2018 Heinrich Schuchardt + * + * This module contains the ARMv8 specific code required to adjust the exception + * level before booting an operating system. + */ + +#include <common.h> +#include <bootm.h> +#include <asm/setjmp.h> + +/** + * entry_non_secure() - entry point when switching to non-secure mode + * + * When switching to non-secure mode switch_to_non_secure_mode() calls this + * function passing a jump buffer. We use this jump buffer to restoring the + * original stack and register state. + * + * @non_secure_jmp: jump buffer for restoring stack and registers + */ +static void entry_non_secure(struct jmp_buf_data *non_secure_jmp) +{ + dcache_enable(); + debug("Reached non-secure mode\n"); + + /* Restore stack and registers saved in switch_to_non_secure_mode() */ + longjmp(non_secure_jmp, 1); +} + +/** + * switch_to_non_secure_mode() - switch to non-secure mode + * + * Exception level EL3 is meant to be used by the secure monitor only (ARM + * trusted firmware being one embodiment). The operating system shall be + * started at exception level EL2. So here we check the exception level + * and switch it if necessary. + */ +void switch_to_non_secure_mode(void) +{ + struct jmp_buf_data non_secure_jmp; + + /* On AArch64 we need to make sure we call our payload in < EL3 */ + if (current_el() == 3) { + if (setjmp(&non_secure_jmp)) + return; + dcache_disable(); /* flush cache before switch to EL2 */ + + /* Move into EL2 and keep running there */ + armv8_switch_to_el2((uintptr_t)&non_secure_jmp, 0, 0, 0, + (uintptr_t)entry_non_secure, ES_TO_AARCH64); + } +} diff --git a/cmd/bootefi.c b/cmd/bootefi.c index 23639ced7a0..4c87dca808f 100644 --- a/cmd/bootefi.c +++ b/cmd/bootefi.c @@ -5,8 +5,9 @@ * Copyright (c) 2016 Alexander Graf */

-#include <charset.h> #include <common.h> +#include <bootm.h> +#include <charset.h> #include <command.h> #include <dm.h> #include <efi_loader.h> @@ -21,17 +22,11 @@ #include <asm-generic/unaligned.h> #include <linux/linkage.h>

-#ifdef CONFIG_ARMV7_NONSEC -#include <asm/armv7.h> -#include <asm/secure.h> -#endif - DECLARE_GLOBAL_DATA_PTR;

#define OBJ_LIST_NOT_INITIALIZED 1

static efi_status_t efi_obj_list_initialized = OBJ_LIST_NOT_INITIALIZED; - static struct efi_device_path *bootefi_image_path; static struct efi_device_path *bootefi_device_path;

@@ -233,34 +228,6 @@ static efi_status_t efi_do_enter( return ret; }

-#ifdef CONFIG_ARM64 -static efi_status_t efi_run_in_el2(EFIAPI efi_status_t (*entry)( - efi_handle_t image_handle, struct efi_system_table *st), - efi_handle_t image_handle, struct efi_system_table *st) -{ - /* Enable caches again */ - dcache_enable(); - - return efi_do_enter(image_handle, st, entry); -} -#endif - -#ifdef CONFIG_ARMV7_NONSEC -static bool is_nonsec; - -static efi_status_t efi_run_in_hyp(EFIAPI efi_status_t (*entry)( - efi_handle_t image_handle, struct efi_system_table *st), - efi_handle_t image_handle, struct efi_system_table *st) -{ - /* Enable caches again */ - dcache_enable(); - - is_nonsec = true; - - return efi_do_enter(image_handle, st, entry); -} -#endif - /* * efi_carve_out_dt_rsv() - Carve out DT reserved memory ranges * @@ -440,39 +407,6 @@ static efi_status_t do_bootefi_exec(void *efi, goto err_prepare; }

-#ifdef CONFIG_ARM64 - /* On AArch64 we need to make sure we call our payload in < EL3 */ - if (current_el() == 3) { - smp_kick_all_cpus(); - dcache_disable(); /* flush cache before switch to EL2 */ - - /* Move into EL2 and keep running there */ - armv8_switch_to_el2((ulong)entry, - (ulong)&image_obj->header, - (ulong)&systab, 0, (ulong)efi_run_in_el2, - ES_TO_AARCH64); - - /* Should never reach here, efi exits with longjmp */ - while (1) { } - } -#endif - -#ifdef CONFIG_ARMV7_NONSEC - if (armv7_boot_nonsec() && !is_nonsec) { - dcache_disable(); /* flush cache before switch to HYP */ - - armv7_init_nonsec(); - secure_ram_addr(_do_nonsec_entry)( - efi_run_in_hyp, - (uintptr_t)entry, - (uintptr_t)&image_obj->header, - (uintptr_t)&systab); - - /* Should never reach here, efi exits with longjmp */ - while (1) { } - } -#endif - ret = efi_do_enter(&image_obj->header, &systab, entry);

err_prepare: @@ -558,6 +492,8 @@ static int do_bootefi(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) /* Allow unaligned memory access */ allow_unaligned();

+ switch_to_non_secure_mode(); + /* Initialize EFI drivers */ r = efi_init_obj_list(); if (r != EFI_SUCCESS) { diff --git a/common/bootm.c b/common/bootm.c index 8bf84ebcb7e..e34d3ac8f44 100644 --- a/common/bootm.c +++ b/common/bootm.c @@ -915,6 +915,16 @@ static const void *boot_get_kernel(cmd_tbl_t *cmdtp, int flag, int argc,

return buf; } + +/** + * switch_to_non_secure_mode() - switch to non-secure mode + * + * This routine is overridden by architectures requiring this feature. + */ +void __weak switch_to_non_secure_mode(void) +{ +} + #else /* USE_HOSTCC */

void memmove_wd(void *to, void *from, size_t len, ulong chunksz) diff --git a/include/bootm.h b/include/bootm.h index 0501414e0dc..81b7252bd4d 100644 --- a/include/bootm.h +++ b/include/bootm.h @@ -80,4 +80,9 @@ int bootm_decomp_image(int comp, ulong load, ulong image_start, int type, */ void board_quiesce_devices(void);

+/** + * switch_to_non_secure_mode() - switch to non-secure mode + */ +void switch_to_non_secure_mode(void); + #endif