Function initialize_memory_layout

security-monitor/src/core/initialization/mod.rs:118–150

Reads the layout of physical memory from the flattened device tree (FDT), splitting it (logically) into confidential and non-confidential memory region. The FDT content is trusted. # Guarantees The end of the confidential memory is not lower than the start of the confidential memory

(fdt: &FlattenedDeviceTree)

///
/// The end of the confidential memory is not lower than the start of the confidential memory
fn initialize_memory_layout(fdt: &FlattenedDeviceTree) -> Result<(ConfidentialMemoryAddress, *const usize), Error> {
    // TODO: FDT may contain multiple regions. For now, we assume there is only one region in the FDT.
    // This assumption is fine for the emulated environment (QEMU).

    // Information read from FDT is trusted assuming we are executing as part of a measured and secure boot. So we trust that we read the
    // correct base and size of the memory.
    let fdt_memory_region = fdt.memory()?;
    // Safety: We own all the memory because we are early in the boot process and have full rights to split memory according to our needs.
    // Thus, it is fine to cast `usize` to `*mut usize`.
    let memory_start = fdt_memory_region.base as *mut usize;
    // In assembly that executed this initialization function splitted the memory into two regions where
    // the second region's size is equal or greater than the first ones.
    let non_confidential_memory_size = fdt_memory_region.size.try_into().map_err(|_| Error::InvalidMemoryBoundary())?;
    let confidential_memory_size = non_confidential_memory_size;
    let memory_size = non_confidential_memory_size + confidential_memory_size;
    let memory_end = memory_start.wrapping_byte_add(memory_size) as *const usize;
    debug!("Memory 0x{:#?}-0x{:#?}", memory_start, memory_end);

    // First region of memory is defined as non-confidential memory
    let non_confidential_memory_start = memory_start;
    let non_confidential_memory_end = ptr_byte_add_mut(non_confidential_memory_start, non_confidential_memory_size, memory_end)
        .map_err(|_| Error::InvalidMemoryBoundary())?;
    debug!("Non-confidential memory 0x{:#?}-0x{:#?}", non_confidential_memory_start, non_confidential_memory_end);

    // Second region of memory is defined as confidential memory
    let confidential_memory_start = non_confidential_memory_end;
    let confidential_memory_end = memory_end;
    debug!("Confidential memory 0x{:#?}-0x{:#?}", confidential_memory_start, confidential_memory_end);

    unsafe {
        MemoryLayout::init(non_confidential_memory_start, non_confidential_memory_end, confidential_memory_start, confidential_memory_end)
    }
}

/// This function is called only once during the initialization of the security
/// monitor during the boot process. This function initializes secure monitor's