Memory layout: Difference between revisions

The kernel uses a MT19937 random number generator, seeded by [[SMC#GetRandomBytes|smcGetRandomBytes]].

= Secure Monitor =

Unless otherwise mentionned, block descriptors (in our case, the one uses for the DRAM identity mapping) are all ORRed by 0x401 and page descriptors by 0x403.

== [[1.0.0]] ==

{| class="wikitable" border="1"

|-

! Descriptor ORR-value

|-

| 0x50041000

| 0x1000

| 0x40000000000324

| 0x40000000000324

| 0x1F0007000

| 0x60006000

During boot, the BootROM saves the BCT in IRAM at address 0x40000100. The preceding 0x100 bytes (IRAM memory range from 0x40000000 to 0x40000100) contain a structure called BIT (Boot Info Table) which encapsulates the BCT in IRAM and is initialized by the BootROM as follows:

|  0x04

|  BootTimeLogInit

|  Value from TIMERUS_CNTR_1US when the BootROM enters its main function.

|  0x1C

|  BootTimeLogExit

|  This is the value that gets written into SB_CSR before nvboot. (0x10)

|  0x2C

|  0x01

|  0x18*4

|  Padding

= Carveouts =

The MC (Memory Controller) provides multiple configurable memory carveouts which allow to protect and limit access to sensitive DRAM regions. Carveouts work on the physical access level, thus acting as the last protection barrier from unauthorized memory accesses.

 

A total of 9 programmable carveouts are available from which 4 have a fixed function (TZDRAM, VPR, SEC and MTS) and 5 are generalized carevouts (GSCs 1 to 5).

 

== TZDRAM Carveout ==

Defines a DRAM region that can only be accessed by TrustZone-secure clients. Currently unused by the Switch.

 

 

 

* MC_VIDEO_PROTECT_SIZE_MB

 

== SEC Carveout ==

Defines a DRAM region that can only be accessed by the [[#TSEC|TSEC]]. Deprecated and unused by the Switch.

 

 

 

 

* GSC 5: TSECB

 

* GSC 1: None

 

 

  Granule size for TTBR0*_EL1 is 4KB.

  T0SZ = 31. Hence, bit-size of the TTBR0*_EL1 vmem region is 33. (0x0000000200000000)

  T1SZ = 28. Hence, bit-size of the TTBR1*_EL1 vmem region is 36. (0x0000001000000000)

  Note: ARM config for TTBR0 is presumably configured for userland later.

  See arm-doc for "Table D4-25 Translation table entry addresses when using the 4KB translation granule".

  See arm-doc for "Table D4-11 TCR.TnSZ values and IA ranges, 4K granule with no concatenation of tables".

  Due to T*SZ, Stage1/Stage2 translation for the initial table(level1) are the same, except Stage2 uses hard-coded T0SZ.

  Basically, the table is accessed as: ((u64*)tablebase)[<IA[y:30]>], where y = (37-T*SZ)+26. That is, starting at bit "y" ending(inclusive) at bit30. For TTBR0*_EL1, y = 32, while for TTBR1_EL1 y = 35.

 

"Vector Base Address Register (EL1)" = 0xfffffff7ffc50800.

 

* Vmem 0x80000000 is mapped to physmem 0x80000000, using a size loaded from a register. This is only done when: "endaddr = 0x7fffffff + size; if(endaddr >= 0x80000001){...}"

** The size is loaded from: "(u32 *0x70019050 & 0x3fff) << 20;"

** The value written to the MMU-table descriptor is: "physaddr | val | 0x709;". val is 1<<52 when "tmp>>34" is non-zero and when "if((physaddr & 0x3c0000000) == 0)", otherwise val=0. tmp=size at the start and increased by 0xffffffffc0000000 each loop iteration. physaddr is increased by 0x40000000 each loop iteration.

 

* vmem 0xFFFFFFF800000000 is mapped to physmem 0x80000000. Similar to above, except tmp=0 due to wrap-around, etc. This also has usermode/kernel XN enabled in the descriptor ORR-value. The chunksize used when increasing addr is 0xfffffff840000000, with another +=0x40000000 separate from the addr cmp for the loop.

** "endaddr = 0x3fffffff + (<size from above> | 0xfffffff800000000); enaddr = (endaddr & 0xffffffffc0000000)-1; if(endaddr >= 0xfffffff800000001){<map mem>}"

* Initializes level2 pagetable descriptor for vmem 0xFFFFFFF7C0000000. descriptor = 0x3 | physaddr. physaddr is core-specific.

** Initializes level3 pagetable descriptor for vmem 0xFFFFFFF7FF800000. physaddr = tablebase + (0x6<<12).