docs/getting_started/rt-svc-writers-guide.rst

7 This document describes how to add a runtime service to the EL3 Runtime
10 Software executing in the normal world and in the trusted world at exception
11 levels lower than EL3 will request runtime services using the Secure Monitor
12 Call (SMC) instruction. These requests will follow the convention described in
13 the SMC Calling Convention PDD (`SMCCC`_). The `SMCCC`_ assigns function
17 SMC Functions are grouped together based on the implementor of the service, for
18 example a subset of the Function IDs are designated as "OEM Calls" (see `SMCCC`_
19 for full details). The EL3 runtime services framework in BL31 enables the
21 into the BL31 image. This simplifies the integration of common software from
24 dispatched to their respective service implementation - the
27 The interface and operation of the runtime services depends heavily on the
28 concepts and definitions described in the `SMCCC`_, in particular SMC Function
29 IDs, Owning Entity Numbers (OEN), Fast and Standard calls, and the SMC32 and
39 with the SMC call type, which is either *Fast* or *Yielding*. Fast calls are
43 legacy 32-bit software that predates the `SMCCC`_.
65 Each individual entity can allocate the valid identifiers within the entity
67 the same type. For example, two SoC providers can use the same Function ID
68 within the SiP Service calls OEN range to mean different things - as these
69 calls should be specific to the SoC. The Standard Runtime Calls OEN is used for
72 The SMC Function ID also indicates whether the call has followed the SMC32
73 calling convention, where all parameters are 32-bit, or the SMC64 calling
74 convention, where the parameters are 64-bit. The framework identifies and
75 rejects invalid calls that use the SMC64 calling convention but that originate
78 The EL3 runtime services framework uses the call type and OEN to identify a
85 TF-A has a ``services`` directory in the source tree under which
86 each owning entity can place the implementation of its runtime service. The
87 `PSCI`_ implementation is located here in the ``lib/psci`` directory.
89 Runtime service sources will need to include the ``runtime_svc.h`` header file.
94 A runtime service is registered using the ``DECLARE_RT_SVC()`` macro, specifying
95 the name of the service, the range of OENs covered, the type of service and
102 -  ``_name`` is used to identify the data structure declared by this macro, and
105 -  ``_start`` and ``_end`` values must be based on the ``OEN_*`` values defined in
110 -  ``_setup`` is the initialization function with the ``rt_svc_init`` signature:
116 -  ``_smch`` is the SMC handler function with the ``rt_svc_handle`` signature:
127 Details of the requirements and behavior of the two callbacks is provided in
128 the following sections.
130 During initialization the services framework validates each declared service
131 to ensure that the following conditions are met:
133 #. The ``_start`` OEN is not greater than the ``_end`` OEN
134 #. The ``_end`` OEN does not exceed the maximum OEN value (63)
155 Runtime services are initialized once, during cold boot, by the primary CPU
157 performs basic validation of the declared service before calling
158 the service initialization function (``_setup`` in the declaration). This
160 SMC Function call via the handler function.
162 On success, the initialization function must return ``0``. Any other return value
163 will cause the framework to issue a diagnostic:
167     Error initializing runtime service <name of the service>
169 and then ignore the service - the system will continue to boot but SMC calls
170 will not be passed to the service handler and instead return the *Unknown SMC
173 If the system must not be allowed to proceed without the service, the
174 initialization function must itself cause the firmware boot to be halted.
176 If the service uses per-CPU data this must either be initialized for all CPUs
183 SMC calls for a service are forwarded by the framework to the service's SMC
184 handler function (``_smch`` in the service declaration). This function must have
185 the following signature:
199    otherwise completing the request with the *Unknown SMC Function ID*:
205 #. Determining if the requested function is valid for the calling security
207    the framework will forward all calls to the service handler.
209    The ``flags`` parameter to this function indicates the caller security state
212    the caller's security state is Secure, Non-secure or Realm respectively.
214    If invalid, the request should be completed with:
220 #. Truncating parameters for calls made using the SMC32 calling convention.
221    Such calls can be determined by checking the CC field in bit[30] of the
228    For such calls, the upper bits of the parameters x1-x4 and the saved
229    parameters X5-X7 are UNDEFINED and must be explicitly ignored by the
230    handler. This can be done by truncating the values to a suitable 32-bit
234 #. Providing the service requested by the SMC Function, utilizing the
235    immediate parameters x1-x4 and/or the additional saved parameters X5-X7.
236    The latter can be retrieved using the ``SMC_GET_GP(handle, ref)`` function,
237    supplying the appropriate ``CTX_GPREG_Xn`` reference, e.g.
243 #. Implementing the standard SMC32 Functions that provide information about
244    the implementation of the service. These are the Call Count, Implementor
245    UID and Revision Details for each service documented in section 6 of the
250 #. Returning the result to the caller. Based on `SMCCC`_ spec, results are
253    state. The framework provides a family of macros to set the multi-register
254    return value and complete the handler:
280 The ``cookie`` parameter to the handler is reserved for future use and can be
281 ignored. The ``handle`` is returned by the SMC handler - completion of the
282 handler function must always be via one of the ``SMC_RETn()`` macros.
286    all of the above requirements yet.
292 example, the Standard calls service handles ``0x84000000``-``0x8400FFFF`` and
293 ``0xC4000000``-``0xC400FFFF`` functions. Within that range, the `PSCI`_ service
294 handles the ``0x84000000``-``0x8400001F`` and ``0xC4000000``-``0xC400001F`` functions.
295 In that respect, `PSCI`_ is a 'sub-service' of the Standard calls service. In
296 future, there could be additional such sub-services in the Standard calls
301 very similar to the current runtime services framework, but using a different
302 part of the SMC Function ID to identify the sub-service. TF-A does not provide
309 or other Secure-EL1 Payload are special. These services need to manage the
310 Secure-EL1 context, provide the *Secure Monitor* functionality of switching
311 between the normal and secure worlds, deliver SMC Calls through to Secure-EL1
312 and generally manage the Secure-EL1 Payload through CPU power-state transitions.
314 TODO: Provide details of the additional work required to implement a SPD and
315 the BL31 support for these services. Or a reference to the document that will