World ✤ Physical Memory Partition ✤ Switch between Secure and Normal World ✤ Save & Load: TTBR1_EL1, SCTLR_EL1, TCR_EL1, … ✤ Dispatch SMC ✤ Trusted Core handles most of smc calls, where EL3 handles the rest
R | W 0x1CE00000 0x1FE00000 Trusted Core R | W 0x1FE00000 0x1FE2A000 ATF CODE R | E 0x1FE2A000 0x20000000 ATF DATA R | W 0x209E1000 0x209F8000 ??? R | W 0x5A000000 0xFFFDF000 MMIO R | W FASTBOOT
= rpmb_request_phy + 0x6000; if ( a2 ) { NOTICE("rpmb error: the result from kernel is error,%lx\n", a2); v32 = *(v31 + 0xC38); v33 = x1; if ( !v32) return NOTICE("rpmb request callback function is NULL\n"); return v32(v33); } }
= rpmb_request_phy + 0x6000; if ( a2 ) { NOTICE("rpmb error: the result from kernel is error,%lx\n", a2); v32 = *(v31 + 0xC38); v33 = x1; if ( !v32) return NOTICE("rpmb request callback function is NULL\n"); return v32(v33); } }
= rpmb_request_phy + 0x6000; if ( a2 ) { NOTICE("rpmb error: the result from kernel is error,%lx\n", a2); v32 = *(v31 + 0xC38); v33 = x1; if ( !v32) return NOTICE("rpmb request callback function is NULL\n"); return v32(v33); //Both PC and x0 are controlled !!! } }
v31 = rpmb_request_phy + 0x6000; if ( a2 ) { NOTICE("rpmb error: the result from kernel is error,%lx\n", a2); v32 = *(v31 + 0xC38); v33 = x1; if ( !v32) return NOTICE("rpmb request callback function is NULL\n"); return v32(v33); } } ~2018.7 Ancient
v31 = rpmb_request_phy + 0x6000; //0x209E0000 is accessible to EL1 if ( a2 ) { NOTICE("rpmb error: the result from kernel is error,%lx\n", a2); v32 = *(v31 + 0xC38); v33 = x1; if ( !v32) return NOTICE("rpmb request callback function is NULL\n"); return v32(v33); } } ~2018.7 Ancient
v31 = callback_vtable; //inaccessible to EL1 if ( a2 ) { NOTICE("rpmb error: the result from kernel is error,%lx\n", a2); v32 = *(v31); v33 = x1; if ( !v32) return NOTICE("rpmb request callback function is NULL\n"); return v32(v33); } } Contemporary ~2018.7 Ancient
R | W 0x1CE00000 0x1FE00000 Trusted Core R | W 0x1FE00000 0x1FE2A000 ATF CODE R | E 0x1FE2A000 0x20000000 ATF DATA R | W 0x209E1000 0x209F8000 Shared Memory R | W 0x5A000000 0xFFFDF000 MMIO R | W
R | W 0x1CE00000 0x1FE00000 Trusted Core R | W 0x1FE00000 0x1FE2A000 ATF CODE R | E 0x1FE2A000 0x20000000 ATF DATA R | W 0x209E1000 0x209F8000 Shellcode R | W 0x5A000000 0xFFFDF000 MMIO R | W
R | W 0x1CE00000 0x1FE00000 Trusted Core R | W 0x1FE00000 0x1FE2A000 ATF CODE R | E 0x1FE2A000 0x20000000 ATF DATA R | W 0x209E1000 0x209F8000 Shellcode R | W 0x5A000000 0xFFFDF000 MMIO R | W