Android Trusty TEE 2.启动分析
Android Trusty TEE 2. 启动分析
Trusty TEE 其核心是little kernnel(LK),现在分析一下其启动的过程：
链接脚本文件：trusty\external\lk\arch\arm64\system-onesegment.ld
OUTPUT_FORMAT("elf64-littleaarch64", "elf64-bigaarch64", "elf64-littleaarch64")
OUTPUT_ARCH(aarch64)
ENTRY(_start)
SECTIONS
{
. = %KERNEL_BASE% + %KERNEL_LOAD_OFFSET%;
/* text/read-only data */
/* set the load address to physical MEMBASE */
.text : AT(%MEMBASE% + %KERNEL_LOAD_OFFSET%) {
__code_start = .;
KEEP(*(.text.boot))
KEEP(*(.text.boot.vectab))
*(.text* .sram.text.glue_7* .gnu.linkonce.t.*)
}
.interp : {
*(.interp) }
.hash : {
*(.hash) }
.dynsym : {
*(.dynsym) }
.dynstr : {
*(.dynstr) }
.rel.text : {
*(.rel.text) *(.rel.gnu.linkonce.t*) }
.rela.text : {
*(.rela.text) *(.rela.gnu.linkonce.t*) }
.rel.data : {
*(.rel.data) *(.rel.gnu.linkonce.d*) }
.rela.data : {
*(.rela.data) *(.rela.gnu.linkonce.d*) }
.rel.rodata : {
*(.rel.rodata) *(.rel.gnu.linkonce.r*) }
.rela.rodata : {
*(.rela.rodata) *(.rela.gnu.linkonce.r*) }
.rel.got : {
*(.rel.got) }
.rela.got : {
*(.rela.got) }
.rel.ctors : {
*(.rel.ctors) }
.rela.ctors : {
*(.rela.ctors) }
.rel.dtors : {
*(.rel.dtors) }
.rela.dtors : {
*(.rela.dtors) }
.rel.init : {
*(.rel.init) }
.rela.init : {
*(.rela.init) }
.rel.fini : {
*(.rel.fini) }
.rela.fini : {
*(.rela.fini) }
.rel.bss : {
*(.rel.bss) }
.rela.bss : {
*(.rela.bss) }
.rel.plt : {
*(.rel.plt) }
.rela.plt : {
*(.rela.plt) }
.init : {
*(.init) } =0x9090
.plt : {
*(.plt) }
/* .ARM.exidx is sorted, so has to go in its own output section. */
__exidx_start = .;
.ARM.exidx : {
*(.ARM.exidx* .gnu.linkonce.armexidx.*) }
__exidx_end = .;
.dummy_post_text : {
__code_end = .;
}
.rodata : ALIGN(4096) {
__rodata_start = .;
__fault_handler_table_start = .;
KEEP(*(.rodata.fault_handler_table))
__fault_handler_table_end = .;
*(.rodata .rodata.* .gnu.linkonce.r.*)
}
/*
* extra linker scripts tend to insert sections just after .rodata,
* so we want to make sure this symbol comes after anything inserted above,
* but not aligned to the next section necessarily.
*/
.dummy_post_rodata : {
__rodata_end = .;
}
.data : ALIGN(4096) {
/* writable data */
__data_start_rom = .;
/* in one segment binaries, the rom data address is on top of the ram data address */
__data_start = .;
*(.data .data.* .gnu.linkonce.d.*)
}
.ctors : ALIGN(8) {
__ctor_list = .;
KEEP(*(.ctors .init_array))
__ctor_end = .;
}
.dtors : ALIGN(8) {
__dtor_list = .;
KEEP(*(.dtors .fini_array))
__dtor_end = .;
}
.got : {
*(.got.plt) *(.got) }
.dynamic : {
*(.dynamic) }
/*
* extra linker scripts tend to insert sections just after .data,
* so we want to make sure this symbol comes after anything inserted above,
* but not aligned to the next section necessarily.
*/
.dummy_post_data : {
__data_end = .;
}
/* unintialized data (in same segment as writable data) */
.bss : ALIGN(4096) {
__bss_start = .;
KEEP(*(.bss.prebss.*))
. = ALIGN(8);
__post_prebss_bss_start = .;
*(.bss .bss.*)
*(.gnu.linkonce.b.*)
*(COMMON)
. = ALIGN(8);
__bss_end = .;
}
/* Align the end to ensure anything after the kernel ends up on its own pages */
. = ALIGN(4096);
_end = .;
. = %KERNEL_BASE% + %MEMSIZE%;
_end_of_ram = .;
/* Strip unnecessary stuff */
/DISCARD/ : {
*(.comment .note .eh_frame) }
}
程序从_start函数开始，这个函数在那里呢，在这个位置：trusty\external\lk\arch\arm64\start.S
#include 这段代码中，如果含有多核，首先根据cpuid 来判断是不是首次启动，如果是0 CPU程序最终回跳到lk_main()执行程序（lk_main()位于 top/main.c）。如果非0 则执行.Lsecondary_boot。下面我看看lk_main()做了些什么。
/* called from arch code */
void lk_main(ulong arg0, ulong arg1, ulong arg2, ulong arg3)
{
// save the boot args
lk_boot_args[0] = arg0;
lk_boot_args[1] = arg1;
lk_boot_args[2] = arg2;
lk_boot_args[3] = arg3;
// get us into some sort of thread context
thread_init_early();// called once ,初始化thread
// early arch stuff
lk_primary_cpu_init_level(LK_INIT_LEVEL_EARLIEST, LK_INIT_LEVEL_ARCH_EARLY - 1);
arch_early_init(); // 向量表，cache
// do any super early platform initialization
lk_primary_cpu_init_level(LK_INIT_LEVEL_ARCH_EARLY, LK_INIT_LEVEL_PLATFORM_EARLY - 1);
platform_early_init();
// do any super early target initialization
lk_primary_cpu_init_level(LK_INIT_LEVEL_PLATFORM_EARLY, LK_INIT_LEVEL_TARGET_EARLY - 1);
target_early_init();
#if WITH_SMP
dprintf(INFO, "\nwelcome to lk/MP\n\n");
#else
dprintf(INFO, "\nwelcome to lk\n\n");
#endif
dprintf(INFO, "boot args 0x%lx 0x%lx 0x%lx 0x%lx\n",
lk_boot_args[0], lk_boot_args[1], lk_boot_args[2], lk_boot_args[3]);
// bring up the kernel heap
lk_primary_cpu_init_level(LK_INIT_LEVEL_TARGET_EARLY, LK_INIT_LEVEL_HEAP - 1);
dprintf(SPEW, "initializing heap\n");
heap_init();
// deal with any static constructors
dprintf(SPEW, "calling constructors\n");
call_constructors();
// initialize the kernel
lk_primary_cpu_init_level(LK_INIT_LEVEL_HEAP, LK_INIT_LEVEL_KERNEL - 1);
kernel_init();
lk_primary_cpu_init_level(LK_INIT_LEVEL_KERNEL, LK_INIT_LEVEL_THREADING - 1);
// create a thread to complete system initialization
dprintf(SPEW, "creating bootstrap completion thread\n");
thread_t *t = thread_create("bootstrap2", &bootstrap2, NULL, DEFAULT_PRIORITY, DEFAULT_STACK_SIZE);
thread_set_pinned_cpu(t, 0);
thread_detach(t);
thread_resume(t);
// become the idle thread and enable interrupts to start the scheduler
thread_become_idle();
}
在lk_main()函数的最后，调用了thread_become_idle（）函数。接下来我卡看一下这个函数。
/**
* @brief Become an idle thread
*
* This function marks the current thread as the idle thread -- the one which
* executes when there is nothing else to do. This function does not return.
* This function is called once at boot time.
*/
{
DEBUG_ASSERT(arch_ints_disabled());
thread_t *t = get_current_thread();
#if WITH_SMP
char name[16];
snprintf(name, sizeof(name), "idle %d", arch_curr_cpu_num());
thread_set_name(name);
#else
thread_set_name("idle");
#endif
/* mark ourself as idle */
t->priority = IDLE_PRIORITY;
t->flags |= THREAD_FLAG_IDLE;
thread_set_pinned_cpu(t, arch_curr_cpu_num());
mp_set_curr_cpu_active(true);
mp_set_cpu_idle(arch_curr_cpu_num());
/* enable interrupts and start the scheduler */
arch_enable_ints();
thread_yield();
idle_thread_routine();
}
从这个函数的介绍可以知道，这个就是使当前的线程为idle线程。到这里就启动完了。