1 /*
2 * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
3 * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
4 *
5 * SPDX-License-Identifier: BSD-3-Clause
6 */
7 #include <stdbool.h>
8 #include <stddef.h>
9 #include <stdint.h>
10 #include <string.h>
11
12 #include <common/debug.h>
13 #include <common/runtime_svc.h>
14 #include <context.h>
15 #include <lib/coreboot.h>
16 #include <lib/utils_def.h>
17 #include <lib/xlat_tables/xlat_tables_v2.h>
18 #include <smccc_helpers.h>
19 #include <tools_share/uuid.h>
20
21 #include <qti_plat.h>
22 #include <qti_secure_io_cfg.h>
23 #include <qtiseclib_interface.h>
24
25 /*
26 * SIP service - SMC function IDs for SiP Service queries
27 *
28 */
29 #define QTI_SIP_SVC_CALL_COUNT_ID U(0x0200ff00)
30 #define QTI_SIP_SVC_UID_ID U(0x0200ff01)
31 /* 0x8200ff02 is reserved*/
32 #define QTI_SIP_SVC_VERSION_ID U(0x0200ff03)
33 #define QTI_SIP_SVC_AVAILABLE_ID U(0x02000601)
34 /*
35 * Syscall's to allow Non Secure world accessing peripheral/IO memory
36 * those are secure/proteced BUT not required to be secure.
37 */
38 #define QTI_SIP_SVC_SECURE_IO_READ_ID U(0x02000501)
39 #define QTI_SIP_SVC_SECURE_IO_WRITE_ID U(0x02000502)
40
41 /*
42 * Syscall's to assigns a list of intermediate PAs from a
43 * source Virtual Machine (VM) to a destination VM.
44 */
45 #define QTI_SIP_SVC_MEM_ASSIGN_ID U(0x02000C16)
46
47 #define QTI_SIP_SVC_SECURE_IO_READ_PARAM_ID U(0x1)
48 #define QTI_SIP_SVC_SECURE_IO_WRITE_PARAM_ID U(0x2)
49 #define QTI_SIP_SVC_MEM_ASSIGN_PARAM_ID U(0x1117)
50
51 #define QTI_SIP_SVC_CALL_COUNT U(0x3)
52 #define QTI_SIP_SVC_VERSION_MAJOR U(0x0)
53 #define QTI_SIP_SVC_VERSION_MINOR U(0x0)
54
55 #define QTI_VM_LAST U(44)
56 #define SIZE4K U(0x1000)
57 #define QTI_VM_MAX_LIST_SIZE U(0x20)
58
59 #define FUNCID_OEN_NUM_MASK ((FUNCID_OEN_MASK << FUNCID_OEN_SHIFT)\
60 |(FUNCID_NUM_MASK << FUNCID_NUM_SHIFT))
61
62 enum {
63 QTI_SIP_SUCCESS = 0,
64 QTI_SIP_NOT_SUPPORTED = -1,
65 QTI_SIP_PREEMPTED = -2,
66 QTI_SIP_INVALID_PARAM = -3,
67 };
68
69 /* QTI SiP Service UUID */
70 DEFINE_SVC_UUID2(qti_sip_svc_uid,
71 0x43864748, 0x217f, 0x41ad, 0xaa, 0x5a,
72 0xba, 0xe7, 0x0f, 0xa5, 0x52, 0xaf);
73
qti_is_secure_io_access_allowed(u_register_t addr)74 static bool qti_is_secure_io_access_allowed(u_register_t addr)
75 {
76 int i = 0;
77
78 for (i = 0; i < ARRAY_SIZE(qti_secure_io_allowed_regs); i++) {
79 if ((uintptr_t) addr == qti_secure_io_allowed_regs[i]) {
80 return true;
81 }
82 }
83
84 return false;
85 }
86
qti_check_syscall_availability(u_register_t smc_fid)87 static bool qti_check_syscall_availability(u_register_t smc_fid)
88 {
89 switch (smc_fid) {
90 case QTI_SIP_SVC_CALL_COUNT_ID:
91 case QTI_SIP_SVC_UID_ID:
92 case QTI_SIP_SVC_VERSION_ID:
93 case QTI_SIP_SVC_AVAILABLE_ID:
94 case QTI_SIP_SVC_SECURE_IO_READ_ID:
95 case QTI_SIP_SVC_SECURE_IO_WRITE_ID:
96 case QTI_SIP_SVC_MEM_ASSIGN_ID:
97 return true;
98 default:
99 return false;
100 }
101 }
102
qti_mem_assign_validate_param(memprot_info_t * mem_info,u_register_t u_num_mappings,uint32_t * source_vm_list,u_register_t src_vm_list_cnt,memprot_dst_vm_perm_info_t * dest_vm_list,u_register_t dst_vm_list_cnt)103 bool qti_mem_assign_validate_param(memprot_info_t *mem_info,
104 u_register_t u_num_mappings,
105 uint32_t *source_vm_list,
106 u_register_t src_vm_list_cnt,
107 memprot_dst_vm_perm_info_t *dest_vm_list,
108 u_register_t dst_vm_list_cnt)
109 {
110 int i;
111
112 if (!source_vm_list || !dest_vm_list || !mem_info
113 || (src_vm_list_cnt == 0)
114 || (src_vm_list_cnt >= QTI_VM_LAST) || (dst_vm_list_cnt == 0)
115 || (dst_vm_list_cnt >= QTI_VM_LAST) || (u_num_mappings == 0)
116 || u_num_mappings > QTI_VM_MAX_LIST_SIZE) {
117 ERROR("vm count is 0 or more then QTI_VM_LAST or empty list\n");
118 ERROR("source_vm_list %p dest_vm_list %p mem_info %p src_vm_list_cnt %u dst_vm_list_cnt %u u_num_mappings %u\n",
119 source_vm_list, dest_vm_list, mem_info,
120 (unsigned int)src_vm_list_cnt,
121 (unsigned int)dst_vm_list_cnt,
122 (unsigned int)u_num_mappings);
123 return false;
124 }
125 for (i = 0; i < u_num_mappings; i++) {
126 if ((mem_info[i].mem_addr & (SIZE4K - 1))
127 || (mem_info[i].mem_size == 0)
128 || (mem_info[i].mem_size & (SIZE4K - 1))) {
129 ERROR("mem_info passed buffer 0x%x or size 0x%x is not 4k aligned\n",
130 (unsigned int)mem_info[i].mem_addr,
131 (unsigned int)mem_info[i].mem_size);
132 return false;
133 }
134
135 if ((mem_info[i].mem_addr + mem_info[i].mem_size) <
136 mem_info[i].mem_addr) {
137 ERROR("overflow in mem_addr 0x%x add mem_size 0x%x\n",
138 (unsigned int)mem_info[i].mem_addr,
139 (unsigned int)mem_info[i].mem_size);
140 return false;
141 }
142 #if COREBOOT == 1
143 coreboot_memory_t mem_type = coreboot_get_memory_type(
144 mem_info[i].mem_addr,
145 mem_info[i].mem_size);
146 if (mem_type != CB_MEM_RAM && mem_type != CB_MEM_RESERVED) {
147 ERROR("memory region not in CB MEM RAM or RESERVED area: region start 0x%x size 0x%x\n",
148 (unsigned int)mem_info[i].mem_addr,
149 (unsigned int)mem_info[i].mem_size);
150 return false;
151 }
152 #endif
153 }
154 for (i = 0; i < src_vm_list_cnt; i++) {
155 if (source_vm_list[i] >= QTI_VM_LAST) {
156 ERROR("source_vm_list[%d] 0x%x is more then QTI_VM_LAST\n",
157 i, (unsigned int)source_vm_list[i]);
158 return false;
159 }
160 }
161 for (i = 0; i < dst_vm_list_cnt; i++) {
162 if (dest_vm_list[i].dst_vm >= QTI_VM_LAST) {
163 ERROR("dest_vm_list[%d] 0x%x is more then QTI_VM_LAST\n",
164 i, (unsigned int)dest_vm_list[i].dst_vm);
165 return false;
166 }
167 }
168 return true;
169 }
170
qti_sip_mem_assign(void * handle,uint32_t smc_cc,u_register_t x1,u_register_t x2,u_register_t x3,u_register_t x4)171 static uintptr_t qti_sip_mem_assign(void *handle, uint32_t smc_cc,
172 u_register_t x1,
173 u_register_t x2,
174 u_register_t x3, u_register_t x4)
175 {
176 uintptr_t dyn_map_start = 0, dyn_map_end = 0;
177 size_t dyn_map_size = 0;
178 u_register_t x6, x7;
179 int ret = QTI_SIP_NOT_SUPPORTED;
180 u_register_t x5 = read_ctx_reg(get_gpregs_ctx(handle), CTX_GPREG_X5);
181
182 if (smc_cc == SMC_32) {
183 x5 = (uint32_t) x5;
184 }
185 /* Validate input arg count & retrieve arg3-6 from NS Buffer. */
186 if ((x1 != QTI_SIP_SVC_MEM_ASSIGN_PARAM_ID) || (x5 == 0x0)) {
187 ERROR("invalid mem_assign param id or no mapping info\n");
188 goto unmap_return;
189 }
190
191 /* Map NS Buffer. */
192 dyn_map_start = x5;
193 dyn_map_size =
194 (smc_cc ==
195 SMC_32) ? (sizeof(uint32_t) * 4) : (sizeof(uint64_t) * 4);
196 if (qti_mmap_add_dynamic_region(dyn_map_start, dyn_map_size,
197 (MT_NS | MT_RO_DATA)) != 0) {
198 ERROR("map failed for params NS Buffer %x %x\n",
199 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size);
200 goto unmap_return;
201 }
202 /* Retrieve indirect args. */
203 if (smc_cc == SMC_32) {
204 x6 = *((uint32_t *) x5 + 1);
205 x7 = *((uint32_t *) x5 + 2);
206 x5 = *(uint32_t *) x5;
207 } else {
208 x6 = *((uint64_t *) x5 + 1);
209 x7 = *((uint64_t *) x5 + 2);
210 x5 = *(uint64_t *) x5;
211 }
212 /* Un-Map NS Buffer. */
213 if (qti_mmap_remove_dynamic_region(dyn_map_start, dyn_map_size) != 0) {
214 ERROR("unmap failed for params NS Buffer %x %x\n",
215 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size);
216 goto unmap_return;
217 }
218
219 /*
220 * Map NS Buffers.
221 * arg0,2,4 points to buffers & arg1,3,5 hold sizes.
222 * MAP api's fail to map if it's already mapped. Let's
223 * find lowest start & highest end address, then map once.
224 */
225 dyn_map_start = MIN(x2, x4);
226 dyn_map_start = MIN(dyn_map_start, x6);
227 dyn_map_end = MAX((x2 + x3), (x4 + x5));
228 dyn_map_end = MAX(dyn_map_end, (x6 + x7));
229 dyn_map_size = dyn_map_end - dyn_map_start;
230
231 if (qti_mmap_add_dynamic_region(dyn_map_start, dyn_map_size,
232 (MT_NS | MT_RO_DATA)) != 0) {
233 ERROR("map failed for params NS Buffer2 %x %x\n",
234 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size);
235 goto unmap_return;
236 }
237 memprot_info_t *mem_info_p = (memprot_info_t *) x2;
238 uint32_t u_num_mappings = x3 / sizeof(memprot_info_t);
239 uint32_t *source_vm_list_p = (uint32_t *) x4;
240 uint32_t src_vm_list_cnt = x5 / sizeof(uint32_t);
241 memprot_dst_vm_perm_info_t *dest_vm_list_p =
242 (memprot_dst_vm_perm_info_t *) x6;
243 uint32_t dst_vm_list_cnt =
244 x7 / sizeof(memprot_dst_vm_perm_info_t);
245 if (qti_mem_assign_validate_param(mem_info_p, u_num_mappings,
246 source_vm_list_p, src_vm_list_cnt,
247 dest_vm_list_p,
248 dst_vm_list_cnt) != true) {
249 ERROR("Param validation failed\n");
250 goto unmap_return;
251 }
252
253 memprot_info_t mem_info[QTI_VM_MAX_LIST_SIZE];
254 /* Populating the arguments */
255 for (int i = 0; i < u_num_mappings; i++) {
256 mem_info[i].mem_addr = mem_info_p[i].mem_addr;
257 mem_info[i].mem_size = mem_info_p[i].mem_size;
258 }
259
260 memprot_dst_vm_perm_info_t dest_vm_list[QTI_VM_LAST];
261
262 for (int i = 0; i < dst_vm_list_cnt; i++) {
263 dest_vm_list[i].dst_vm = dest_vm_list_p[i].dst_vm;
264 dest_vm_list[i].dst_vm_perm = dest_vm_list_p[i].dst_vm_perm;
265 dest_vm_list[i].ctx = dest_vm_list_p[i].ctx;
266 dest_vm_list[i].ctx_size = dest_vm_list_p[i].ctx_size;
267 }
268
269 uint32_t source_vm_list[QTI_VM_LAST];
270
271 for (int i = 0; i < src_vm_list_cnt; i++) {
272 source_vm_list[i] = source_vm_list_p[i];
273 }
274 /* Un-Map NS Buffers. */
275 if (qti_mmap_remove_dynamic_region(dyn_map_start,
276 dyn_map_size) != 0) {
277 ERROR("unmap failed for params NS Buffer %x %x\n",
278 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size);
279 goto unmap_return;
280 }
281 /* Invoke API lib api. */
282 ret = qtiseclib_mem_assign(mem_info, u_num_mappings,
283 source_vm_list, src_vm_list_cnt,
284 dest_vm_list, dst_vm_list_cnt);
285
286 if (ret == 0) {
287 SMC_RET2(handle, QTI_SIP_SUCCESS, ret);
288 }
289 unmap_return:
290 /* Un-Map NS Buffers if mapped */
291 if (dyn_map_start && dyn_map_size) {
292 qti_mmap_remove_dynamic_region(dyn_map_start, dyn_map_size);
293 }
294
295 SMC_RET2(handle, QTI_SIP_INVALID_PARAM, ret);
296 }
297
298 /*
299 * This function handles QTI specific syscalls. Currently only SiP calls are present.
300 * Both FAST & YIELD type call land here.
301 */
qti_sip_handler(uint32_t smc_fid,u_register_t x1,u_register_t x2,u_register_t x3,u_register_t x4,void * cookie,void * handle,u_register_t flags)302 static uintptr_t qti_sip_handler(uint32_t smc_fid,
303 u_register_t x1,
304 u_register_t x2,
305 u_register_t x3,
306 u_register_t x4,
307 void *cookie, void *handle, u_register_t flags)
308 {
309 uint32_t l_smc_fid = smc_fid & FUNCID_OEN_NUM_MASK;
310
311 if (GET_SMC_CC(smc_fid) == SMC_32) {
312 x1 = (uint32_t) x1;
313 x2 = (uint32_t) x2;
314 x3 = (uint32_t) x3;
315 x4 = (uint32_t) x4;
316 }
317
318 switch (l_smc_fid) {
319 case QTI_SIP_SVC_CALL_COUNT_ID:
320 {
321 SMC_RET1(handle, QTI_SIP_SVC_CALL_COUNT);
322 break;
323 }
324 case QTI_SIP_SVC_UID_ID:
325 {
326 /* Return UID to the caller */
327 SMC_UUID_RET(handle, qti_sip_svc_uid);
328 break;
329 }
330 case QTI_SIP_SVC_VERSION_ID:
331 {
332 /* Return the version of current implementation */
333 SMC_RET2(handle, QTI_SIP_SVC_VERSION_MAJOR,
334 QTI_SIP_SVC_VERSION_MINOR);
335 break;
336 }
337 case QTI_SIP_SVC_AVAILABLE_ID:
338 {
339 if (x1 != 1) {
340 SMC_RET1(handle, QTI_SIP_INVALID_PARAM);
341 }
342 if (qti_check_syscall_availability(x2) == true) {
343 SMC_RET2(handle, QTI_SIP_SUCCESS, 1);
344 } else {
345 SMC_RET2(handle, QTI_SIP_SUCCESS, 0);
346 }
347 break;
348 }
349 case QTI_SIP_SVC_SECURE_IO_READ_ID:
350 {
351 if ((x1 == QTI_SIP_SVC_SECURE_IO_READ_PARAM_ID) &&
352 qti_is_secure_io_access_allowed(x2)) {
353 SMC_RET2(handle, QTI_SIP_SUCCESS,
354 *((volatile uint32_t *)x2));
355 }
356 SMC_RET1(handle, QTI_SIP_INVALID_PARAM);
357 break;
358 }
359 case QTI_SIP_SVC_SECURE_IO_WRITE_ID:
360 {
361 if ((x1 == QTI_SIP_SVC_SECURE_IO_WRITE_PARAM_ID) &&
362 qti_is_secure_io_access_allowed(x2)) {
363 *((volatile uint32_t *)x2) = x3;
364 SMC_RET1(handle, QTI_SIP_SUCCESS);
365 }
366 SMC_RET1(handle, QTI_SIP_INVALID_PARAM);
367 break;
368 }
369 case QTI_SIP_SVC_MEM_ASSIGN_ID:
370 {
371 return qti_sip_mem_assign(handle, GET_SMC_CC(smc_fid),
372 x1, x2, x3, x4);
373 break;
374 }
375 default:
376 {
377 SMC_RET1(handle, QTI_SIP_NOT_SUPPORTED);
378 }
379 }
380 return (uintptr_t) handle;
381 }
382
383 /* Define a runtime service descriptor for both fast & yield SiP calls */
384 DECLARE_RT_SVC(qti_sip_fast_svc, OEN_SIP_START,
385 OEN_SIP_END, SMC_TYPE_FAST, NULL, qti_sip_handler);
386
387 DECLARE_RT_SVC(qti_sip_yield_svc, OEN_SIP_START,
388 OEN_SIP_END, SMC_TYPE_YIELD, NULL, qti_sip_handler);
389