1 /* 2 * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved. 3 * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved. 4 * 5 * SPDX-License-Identifier: BSD-3-Clause 6 */ 7 #include <stdbool.h> 8 #include <stddef.h> 9 #include <stdint.h> 10 #include <string.h> 11 12 #include <common/debug.h> 13 #include <common/runtime_svc.h> 14 #include <context.h> 15 #include <lib/coreboot.h> 16 #include <lib/utils_def.h> 17 #include <lib/xlat_tables/xlat_tables_v2.h> 18 #include <smccc_helpers.h> 19 #include <tools_share/uuid.h> 20 21 #include <qti_plat.h> 22 #include <qti_secure_io_cfg.h> 23 #include <qtiseclib_interface.h> 24 25 /* 26 * SIP service - SMC function IDs for SiP Service queries 27 * 28 */ 29 #define QTI_SIP_SVC_CALL_COUNT_ID U(0x0200ff00) 30 #define QTI_SIP_SVC_UID_ID U(0x0200ff01) 31 /* 0x8200ff02 is reserved*/ 32 #define QTI_SIP_SVC_VERSION_ID U(0x0200ff03) 33 #define QTI_SIP_SVC_AVAILABLE_ID U(0x02000601) 34 /* 35 * Syscall's to allow Non Secure world accessing peripheral/IO memory 36 * those are secure/proteced BUT not required to be secure. 37 */ 38 #define QTI_SIP_SVC_SECURE_IO_READ_ID U(0x02000501) 39 #define QTI_SIP_SVC_SECURE_IO_WRITE_ID U(0x02000502) 40 41 /* 42 * Syscall's to assigns a list of intermediate PAs from a 43 * source Virtual Machine (VM) to a destination VM. 44 */ 45 #define QTI_SIP_SVC_MEM_ASSIGN_ID U(0x02000C16) 46 47 #define QTI_SIP_SVC_SECURE_IO_READ_PARAM_ID U(0x1) 48 #define QTI_SIP_SVC_SECURE_IO_WRITE_PARAM_ID U(0x2) 49 #define QTI_SIP_SVC_MEM_ASSIGN_PARAM_ID U(0x1117) 50 51 #define QTI_SIP_SVC_CALL_COUNT U(0x3) 52 #define QTI_SIP_SVC_VERSION_MAJOR U(0x0) 53 #define QTI_SIP_SVC_VERSION_MINOR U(0x0) 54 55 #define QTI_VM_LAST U(44) 56 #define SIZE4K U(0x1000) 57 #define QTI_VM_MAX_LIST_SIZE U(0x20) 58 59 #define FUNCID_OEN_NUM_MASK ((FUNCID_OEN_MASK << FUNCID_OEN_SHIFT)\ 60 |(FUNCID_NUM_MASK << FUNCID_NUM_SHIFT)) 61 62 enum { 63 QTI_SIP_SUCCESS = 0, 64 QTI_SIP_NOT_SUPPORTED = -1, 65 QTI_SIP_PREEMPTED = -2, 66 QTI_SIP_INVALID_PARAM = -3, 67 }; 68 69 /* QTI SiP Service UUID */ 70 DEFINE_SVC_UUID2(qti_sip_svc_uid, 71 0x43864748, 0x217f, 0x41ad, 0xaa, 0x5a, 72 0xba, 0xe7, 0x0f, 0xa5, 0x52, 0xaf); 73 74 static bool qti_is_secure_io_access_allowed(u_register_t addr) 75 { 76 int i = 0; 77 78 for (i = 0; i < ARRAY_SIZE(qti_secure_io_allowed_regs); i++) { 79 if ((uintptr_t) addr == qti_secure_io_allowed_regs[i]) { 80 return true; 81 } 82 } 83 84 return false; 85 } 86 87 static bool qti_check_syscall_availability(u_register_t smc_fid) 88 { 89 switch (smc_fid) { 90 case QTI_SIP_SVC_CALL_COUNT_ID: 91 case QTI_SIP_SVC_UID_ID: 92 case QTI_SIP_SVC_VERSION_ID: 93 case QTI_SIP_SVC_AVAILABLE_ID: 94 case QTI_SIP_SVC_SECURE_IO_READ_ID: 95 case QTI_SIP_SVC_SECURE_IO_WRITE_ID: 96 case QTI_SIP_SVC_MEM_ASSIGN_ID: 97 return true; 98 default: 99 return false; 100 } 101 } 102 103 bool qti_mem_assign_validate_param(memprot_info_t *mem_info, 104 u_register_t u_num_mappings, 105 uint32_t *source_vm_list, 106 u_register_t src_vm_list_cnt, 107 memprot_dst_vm_perm_info_t *dest_vm_list, 108 u_register_t dst_vm_list_cnt) 109 { 110 int i; 111 112 if (!source_vm_list || !dest_vm_list || !mem_info 113 || (src_vm_list_cnt == 0) 114 || (src_vm_list_cnt >= QTI_VM_LAST) || (dst_vm_list_cnt == 0) 115 || (dst_vm_list_cnt >= QTI_VM_LAST) || (u_num_mappings == 0) 116 || u_num_mappings > QTI_VM_MAX_LIST_SIZE) { 117 ERROR("vm count is 0 or more then QTI_VM_LAST or empty list\n"); 118 ERROR("source_vm_list %p dest_vm_list %p mem_info %p src_vm_list_cnt %u dst_vm_list_cnt %u u_num_mappings %u\n", 119 source_vm_list, dest_vm_list, mem_info, 120 (unsigned int)src_vm_list_cnt, 121 (unsigned int)dst_vm_list_cnt, 122 (unsigned int)u_num_mappings); 123 return false; 124 } 125 for (i = 0; i < u_num_mappings; i++) { 126 if ((mem_info[i].mem_addr & (SIZE4K - 1)) 127 || (mem_info[i].mem_size == 0) 128 || (mem_info[i].mem_size & (SIZE4K - 1))) { 129 ERROR("mem_info passed buffer 0x%x or size 0x%x is not 4k aligned\n", 130 (unsigned int)mem_info[i].mem_addr, 131 (unsigned int)mem_info[i].mem_size); 132 return false; 133 } 134 135 if ((mem_info[i].mem_addr + mem_info[i].mem_size) < 136 mem_info[i].mem_addr) { 137 ERROR("overflow in mem_addr 0x%x add mem_size 0x%x\n", 138 (unsigned int)mem_info[i].mem_addr, 139 (unsigned int)mem_info[i].mem_size); 140 return false; 141 } 142 #if COREBOOT == 1 143 coreboot_memory_t mem_type = coreboot_get_memory_type( 144 mem_info[i].mem_addr, 145 mem_info[i].mem_size); 146 if (mem_type != CB_MEM_RAM && mem_type != CB_MEM_RESERVED) { 147 ERROR("memory region not in CB MEM RAM or RESERVED area: region start 0x%x size 0x%x\n", 148 (unsigned int)mem_info[i].mem_addr, 149 (unsigned int)mem_info[i].mem_size); 150 return false; 151 } 152 #endif 153 } 154 for (i = 0; i < src_vm_list_cnt; i++) { 155 if (source_vm_list[i] >= QTI_VM_LAST) { 156 ERROR("source_vm_list[%d] 0x%x is more then QTI_VM_LAST\n", 157 i, (unsigned int)source_vm_list[i]); 158 return false; 159 } 160 } 161 for (i = 0; i < dst_vm_list_cnt; i++) { 162 if (dest_vm_list[i].dst_vm >= QTI_VM_LAST) { 163 ERROR("dest_vm_list[%d] 0x%x is more then QTI_VM_LAST\n", 164 i, (unsigned int)dest_vm_list[i].dst_vm); 165 return false; 166 } 167 } 168 return true; 169 } 170 171 static uintptr_t qti_sip_mem_assign(void *handle, uint32_t smc_cc, 172 u_register_t x1, 173 u_register_t x2, 174 u_register_t x3, u_register_t x4) 175 { 176 uintptr_t dyn_map_start = 0, dyn_map_end = 0; 177 size_t dyn_map_size = 0; 178 u_register_t x6, x7; 179 int ret = QTI_SIP_NOT_SUPPORTED; 180 u_register_t x5 = read_ctx_reg(get_gpregs_ctx(handle), CTX_GPREG_X5); 181 182 if (smc_cc == SMC_32) { 183 x5 = (uint32_t) x5; 184 } 185 /* Validate input arg count & retrieve arg3-6 from NS Buffer. */ 186 if ((x1 != QTI_SIP_SVC_MEM_ASSIGN_PARAM_ID) || (x5 == 0x0)) { 187 ERROR("invalid mem_assign param id or no mapping info\n"); 188 goto unmap_return; 189 } 190 191 /* Map NS Buffer. */ 192 dyn_map_start = x5; 193 dyn_map_size = 194 (smc_cc == 195 SMC_32) ? (sizeof(uint32_t) * 4) : (sizeof(uint64_t) * 4); 196 if (qti_mmap_add_dynamic_region(dyn_map_start, dyn_map_size, 197 (MT_NS | MT_RO_DATA)) != 0) { 198 ERROR("map failed for params NS Buffer %x %x\n", 199 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size); 200 goto unmap_return; 201 } 202 /* Retrieve indirect args. */ 203 if (smc_cc == SMC_32) { 204 x6 = *((uint32_t *) x5 + 1); 205 x7 = *((uint32_t *) x5 + 2); 206 x5 = *(uint32_t *) x5; 207 } else { 208 x6 = *((uint64_t *) x5 + 1); 209 x7 = *((uint64_t *) x5 + 2); 210 x5 = *(uint64_t *) x5; 211 } 212 /* Un-Map NS Buffer. */ 213 if (qti_mmap_remove_dynamic_region(dyn_map_start, dyn_map_size) != 0) { 214 ERROR("unmap failed for params NS Buffer %x %x\n", 215 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size); 216 goto unmap_return; 217 } 218 219 /* 220 * Map NS Buffers. 221 * arg0,2,4 points to buffers & arg1,3,5 hold sizes. 222 * MAP api's fail to map if it's already mapped. Let's 223 * find lowest start & highest end address, then map once. 224 */ 225 dyn_map_start = MIN(x2, x4); 226 dyn_map_start = MIN(dyn_map_start, x6); 227 dyn_map_end = MAX((x2 + x3), (x4 + x5)); 228 dyn_map_end = MAX(dyn_map_end, (x6 + x7)); 229 dyn_map_size = dyn_map_end - dyn_map_start; 230 231 if (qti_mmap_add_dynamic_region(dyn_map_start, dyn_map_size, 232 (MT_NS | MT_RO_DATA)) != 0) { 233 ERROR("map failed for params NS Buffer2 %x %x\n", 234 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size); 235 goto unmap_return; 236 } 237 memprot_info_t *mem_info_p = (memprot_info_t *) x2; 238 uint32_t u_num_mappings = x3 / sizeof(memprot_info_t); 239 uint32_t *source_vm_list_p = (uint32_t *) x4; 240 uint32_t src_vm_list_cnt = x5 / sizeof(uint32_t); 241 memprot_dst_vm_perm_info_t *dest_vm_list_p = 242 (memprot_dst_vm_perm_info_t *) x6; 243 uint32_t dst_vm_list_cnt = 244 x7 / sizeof(memprot_dst_vm_perm_info_t); 245 if (qti_mem_assign_validate_param(mem_info_p, u_num_mappings, 246 source_vm_list_p, src_vm_list_cnt, 247 dest_vm_list_p, 248 dst_vm_list_cnt) != true) { 249 ERROR("Param validation failed\n"); 250 goto unmap_return; 251 } 252 253 memprot_info_t mem_info[QTI_VM_MAX_LIST_SIZE]; 254 /* Populating the arguments */ 255 for (int i = 0; i < u_num_mappings; i++) { 256 mem_info[i].mem_addr = mem_info_p[i].mem_addr; 257 mem_info[i].mem_size = mem_info_p[i].mem_size; 258 } 259 260 memprot_dst_vm_perm_info_t dest_vm_list[QTI_VM_LAST]; 261 262 for (int i = 0; i < dst_vm_list_cnt; i++) { 263 dest_vm_list[i].dst_vm = dest_vm_list_p[i].dst_vm; 264 dest_vm_list[i].dst_vm_perm = dest_vm_list_p[i].dst_vm_perm; 265 dest_vm_list[i].ctx = dest_vm_list_p[i].ctx; 266 dest_vm_list[i].ctx_size = dest_vm_list_p[i].ctx_size; 267 } 268 269 uint32_t source_vm_list[QTI_VM_LAST]; 270 271 for (int i = 0; i < src_vm_list_cnt; i++) { 272 source_vm_list[i] = source_vm_list_p[i]; 273 } 274 /* Un-Map NS Buffers. */ 275 if (qti_mmap_remove_dynamic_region(dyn_map_start, 276 dyn_map_size) != 0) { 277 ERROR("unmap failed for params NS Buffer %x %x\n", 278 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size); 279 goto unmap_return; 280 } 281 /* Invoke API lib api. */ 282 ret = qtiseclib_mem_assign(mem_info, u_num_mappings, 283 source_vm_list, src_vm_list_cnt, 284 dest_vm_list, dst_vm_list_cnt); 285 286 if (ret == 0) { 287 SMC_RET2(handle, QTI_SIP_SUCCESS, ret); 288 } 289 unmap_return: 290 /* Un-Map NS Buffers if mapped */ 291 if (dyn_map_start && dyn_map_size) { 292 qti_mmap_remove_dynamic_region(dyn_map_start, dyn_map_size); 293 } 294 295 SMC_RET2(handle, QTI_SIP_INVALID_PARAM, ret); 296 } 297 298 /* 299 * This function handles QTI specific syscalls. Currently only SiP calls are present. 300 * Both FAST & YIELD type call land here. 301 */ 302 static uintptr_t qti_sip_handler(uint32_t smc_fid, 303 u_register_t x1, 304 u_register_t x2, 305 u_register_t x3, 306 u_register_t x4, 307 void *cookie, void *handle, u_register_t flags) 308 { 309 uint32_t l_smc_fid = smc_fid & FUNCID_OEN_NUM_MASK; 310 311 if (GET_SMC_CC(smc_fid) == SMC_32) { 312 x1 = (uint32_t) x1; 313 x2 = (uint32_t) x2; 314 x3 = (uint32_t) x3; 315 x4 = (uint32_t) x4; 316 } 317 318 switch (l_smc_fid) { 319 case QTI_SIP_SVC_CALL_COUNT_ID: 320 { 321 SMC_RET1(handle, QTI_SIP_SVC_CALL_COUNT); 322 break; 323 } 324 case QTI_SIP_SVC_UID_ID: 325 { 326 /* Return UID to the caller */ 327 SMC_UUID_RET(handle, qti_sip_svc_uid); 328 break; 329 } 330 case QTI_SIP_SVC_VERSION_ID: 331 { 332 /* Return the version of current implementation */ 333 SMC_RET2(handle, QTI_SIP_SVC_VERSION_MAJOR, 334 QTI_SIP_SVC_VERSION_MINOR); 335 break; 336 } 337 case QTI_SIP_SVC_AVAILABLE_ID: 338 { 339 if (x1 != 1) { 340 SMC_RET1(handle, QTI_SIP_INVALID_PARAM); 341 } 342 if (qti_check_syscall_availability(x2) == true) { 343 SMC_RET2(handle, QTI_SIP_SUCCESS, 1); 344 } else { 345 SMC_RET2(handle, QTI_SIP_SUCCESS, 0); 346 } 347 break; 348 } 349 case QTI_SIP_SVC_SECURE_IO_READ_ID: 350 { 351 if ((x1 == QTI_SIP_SVC_SECURE_IO_READ_PARAM_ID) && 352 qti_is_secure_io_access_allowed(x2)) { 353 SMC_RET2(handle, QTI_SIP_SUCCESS, 354 *((volatile uint32_t *)x2)); 355 } 356 SMC_RET1(handle, QTI_SIP_INVALID_PARAM); 357 break; 358 } 359 case QTI_SIP_SVC_SECURE_IO_WRITE_ID: 360 { 361 if ((x1 == QTI_SIP_SVC_SECURE_IO_WRITE_PARAM_ID) && 362 qti_is_secure_io_access_allowed(x2)) { 363 *((volatile uint32_t *)x2) = x3; 364 SMC_RET1(handle, QTI_SIP_SUCCESS); 365 } 366 SMC_RET1(handle, QTI_SIP_INVALID_PARAM); 367 break; 368 } 369 case QTI_SIP_SVC_MEM_ASSIGN_ID: 370 { 371 return qti_sip_mem_assign(handle, GET_SMC_CC(smc_fid), 372 x1, x2, x3, x4); 373 break; 374 } 375 default: 376 { 377 SMC_RET1(handle, QTI_SIP_NOT_SUPPORTED); 378 } 379 } 380 return (uintptr_t) handle; 381 } 382 383 /* Define a runtime service descriptor for both fast & yield SiP calls */ 384 DECLARE_RT_SVC(qti_sip_fast_svc, OEN_SIP_START, 385 OEN_SIP_END, SMC_TYPE_FAST, NULL, qti_sip_handler); 386 387 DECLARE_RT_SVC(qti_sip_yield_svc, OEN_SIP_START, 388 OEN_SIP_END, SMC_TYPE_YIELD, NULL, qti_sip_handler); 389