1 /* 2 * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved. 3 * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved. 4 * 5 * SPDX-License-Identifier: BSD-3-Clause 6 */ 7 #include <stdbool.h> 8 #include <stddef.h> 9 #include <stdint.h> 10 #include <string.h> 11 12 #include <common/debug.h> 13 #include <common/runtime_svc.h> 14 #include <context.h> 15 #include <lib/coreboot.h> 16 #include <lib/utils_def.h> 17 #include <lib/xlat_tables/xlat_tables_v2.h> 18 #include <smccc_helpers.h> 19 #include <tools_share/uuid.h> 20 21 #include <qti_plat.h> 22 #include <qti_secure_io_cfg.h> 23 #include <qtiseclib_interface.h> 24 25 /* 26 * SIP service - SMC function IDs for SiP Service queries 27 * 28 */ 29 #define QTI_SIP_SVC_CALL_COUNT_ID U(0x0200ff00) 30 #define QTI_SIP_SVC_UID_ID U(0x0200ff01) 31 /* 0x8200ff02 is reserved*/ 32 #define QTI_SIP_SVC_VERSION_ID U(0x0200ff03) 33 #define QTI_SIP_SVC_AVAILABLE_ID U(0x02000601) 34 /* 35 * Syscall's to allow Non Secure world accessing peripheral/IO memory 36 * those are secure/proteced BUT not required to be secure. 37 */ 38 #define QTI_SIP_SVC_SECURE_IO_READ_ID U(0x02000501) 39 #define QTI_SIP_SVC_SECURE_IO_WRITE_ID U(0x02000502) 40 41 /* 42 * Syscall's to assigns a list of intermediate PAs from a 43 * source Virtual Machine (VM) to a destination VM. 44 */ 45 #define QTI_SIP_SVC_MEM_ASSIGN_ID U(0x02000C16) 46 47 #define QTI_SIP_SVC_SECURE_IO_READ_PARAM_ID U(0x1) 48 #define QTI_SIP_SVC_SECURE_IO_WRITE_PARAM_ID U(0x2) 49 #define QTI_SIP_SVC_MEM_ASSIGN_PARAM_ID U(0x1117) 50 51 #define QTI_SIP_SVC_CALL_COUNT U(0x3) 52 #define QTI_SIP_SVC_VERSION_MAJOR U(0x0) 53 #define QTI_SIP_SVC_VERSION_MINOR U(0x0) 54 55 #define QTI_VM_LAST U(44) 56 #define SIZE4K U(0x1000) 57 #define QTI_VM_MAX_LIST_SIZE U(0x20) 58 59 #define FUNCID_OEN_NUM_MASK ((FUNCID_OEN_MASK << FUNCID_OEN_SHIFT)\ 60 |(FUNCID_NUM_MASK << FUNCID_NUM_SHIFT)) 61 62 enum { 63 QTI_SIP_SUCCESS = 0, 64 QTI_SIP_NOT_SUPPORTED = -1, 65 QTI_SIP_PREEMPTED = -2, 66 QTI_SIP_INVALID_PARAM = -3, 67 }; 68 69 /* QTI SiP Service UUID */ 70 DEFINE_SVC_UUID2(qti_sip_svc_uid, 71 0x43864748, 0x217f, 0x41ad, 0xaa, 0x5a, 72 0xba, 0xe7, 0x0f, 0xa5, 0x52, 0xaf); 73 74 static bool qti_is_secure_io_access_allowed(u_register_t addr) 75 { 76 int i = 0; 77 78 for (i = 0; i < ARRAY_SIZE(qti_secure_io_allowed_regs); i++) { 79 if ((uintptr_t) addr == qti_secure_io_allowed_regs[i]) { 80 return true; 81 } 82 } 83 84 return false; 85 } 86 87 static bool qti_check_syscall_availability(u_register_t smc_fid) 88 { 89 switch (smc_fid) { 90 case QTI_SIP_SVC_CALL_COUNT_ID: 91 case QTI_SIP_SVC_UID_ID: 92 case QTI_SIP_SVC_VERSION_ID: 93 case QTI_SIP_SVC_AVAILABLE_ID: 94 case QTI_SIP_SVC_SECURE_IO_READ_ID: 95 case QTI_SIP_SVC_SECURE_IO_WRITE_ID: 96 case QTI_SIP_SVC_MEM_ASSIGN_ID: 97 return true; 98 default: 99 return false; 100 } 101 } 102 103 bool qti_mem_assign_validate_param(memprot_info_t *mem_info, 104 u_register_t u_num_mappings, 105 uint32_t *source_vm_list, 106 u_register_t src_vm_list_cnt, 107 memprot_dst_vm_perm_info_t *dest_vm_list, 108 u_register_t dst_vm_list_cnt) 109 { 110 int i; 111 112 if (!source_vm_list || !dest_vm_list || !mem_info 113 || (src_vm_list_cnt == 0) 114 || (src_vm_list_cnt >= QTI_VM_LAST) || (dst_vm_list_cnt == 0) 115 || (dst_vm_list_cnt >= QTI_VM_LAST) || (u_num_mappings == 0) 116 || u_num_mappings > QTI_VM_MAX_LIST_SIZE) { 117 ERROR("vm count is 0 or more then QTI_VM_LAST or empty list\n"); 118 ERROR("source_vm_list %p dest_vm_list %p mem_info %p src_vm_list_cnt %u dst_vm_list_cnt %u u_num_mappings %u\n", 119 source_vm_list, dest_vm_list, mem_info, 120 (unsigned int)src_vm_list_cnt, 121 (unsigned int)dst_vm_list_cnt, 122 (unsigned int)u_num_mappings); 123 return false; 124 } 125 for (i = 0; i < u_num_mappings; i++) { 126 if ((mem_info[i].mem_addr & (SIZE4K - 1)) 127 || (mem_info[i].mem_size == 0) 128 || (mem_info[i].mem_size & (SIZE4K - 1))) { 129 ERROR("mem_info passed buffer 0x%x or size 0x%x is not 4k aligned\n", 130 (unsigned int)mem_info[i].mem_addr, 131 (unsigned int)mem_info[i].mem_size); 132 return false; 133 } 134 135 if ((mem_info[i].mem_addr + mem_info[i].mem_size) < 136 mem_info[i].mem_addr) { 137 ERROR("overflow in mem_addr 0x%x add mem_size 0x%x\n", 138 (unsigned int)mem_info[i].mem_addr, 139 (unsigned int)mem_info[i].mem_size); 140 return false; 141 } 142 coreboot_memory_t mem_type = coreboot_get_memory_type( 143 mem_info[i].mem_addr, 144 mem_info[i].mem_size); 145 if (mem_type != CB_MEM_RAM && mem_type != CB_MEM_RESERVED) { 146 ERROR("memory region not in CB MEM RAM or RESERVED area: region start 0x%x size 0x%x\n", 147 (unsigned int)mem_info[i].mem_addr, 148 (unsigned int)mem_info[i].mem_size); 149 return false; 150 } 151 } 152 for (i = 0; i < src_vm_list_cnt; i++) { 153 if (source_vm_list[i] >= QTI_VM_LAST) { 154 ERROR("source_vm_list[%d] 0x%x is more then QTI_VM_LAST\n", 155 i, (unsigned int)source_vm_list[i]); 156 return false; 157 } 158 } 159 for (i = 0; i < dst_vm_list_cnt; i++) { 160 if (dest_vm_list[i].dst_vm >= QTI_VM_LAST) { 161 ERROR("dest_vm_list[%d] 0x%x is more then QTI_VM_LAST\n", 162 i, (unsigned int)dest_vm_list[i].dst_vm); 163 return false; 164 } 165 } 166 return true; 167 } 168 169 static uintptr_t qti_sip_mem_assign(void *handle, uint32_t smc_cc, 170 u_register_t x1, 171 u_register_t x2, 172 u_register_t x3, u_register_t x4) 173 { 174 uintptr_t dyn_map_start = 0, dyn_map_end = 0; 175 size_t dyn_map_size = 0; 176 u_register_t x6, x7; 177 int ret = QTI_SIP_NOT_SUPPORTED; 178 u_register_t x5 = read_ctx_reg(get_gpregs_ctx(handle), CTX_GPREG_X5); 179 180 if (smc_cc == SMC_32) { 181 x5 = (uint32_t) x5; 182 } 183 /* Validate input arg count & retrieve arg3-6 from NS Buffer. */ 184 if ((x1 != QTI_SIP_SVC_MEM_ASSIGN_PARAM_ID) || (x5 == 0x0)) { 185 ERROR("invalid mem_assign param id or no mapping info\n"); 186 goto unmap_return; 187 } 188 189 /* Map NS Buffer. */ 190 dyn_map_start = x5; 191 dyn_map_size = 192 (smc_cc == 193 SMC_32) ? (sizeof(uint32_t) * 4) : (sizeof(uint64_t) * 4); 194 if (qti_mmap_add_dynamic_region(dyn_map_start, dyn_map_size, 195 (MT_NS | MT_RO_DATA)) != 0) { 196 ERROR("map failed for params NS Buffer %x %x\n", 197 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size); 198 goto unmap_return; 199 } 200 /* Retrieve indirect args. */ 201 if (smc_cc == SMC_32) { 202 x6 = *((uint32_t *) x5 + 1); 203 x7 = *((uint32_t *) x5 + 2); 204 x5 = *(uint32_t *) x5; 205 } else { 206 x6 = *((uint64_t *) x5 + 1); 207 x7 = *((uint64_t *) x5 + 2); 208 x5 = *(uint64_t *) x5; 209 } 210 /* Un-Map NS Buffer. */ 211 if (qti_mmap_remove_dynamic_region(dyn_map_start, dyn_map_size) != 0) { 212 ERROR("unmap failed for params NS Buffer %x %x\n", 213 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size); 214 goto unmap_return; 215 } 216 217 /* 218 * Map NS Buffers. 219 * arg0,2,4 points to buffers & arg1,3,5 hold sizes. 220 * MAP api's fail to map if it's already mapped. Let's 221 * find lowest start & highest end address, then map once. 222 */ 223 dyn_map_start = MIN(x2, x4); 224 dyn_map_start = MIN(dyn_map_start, x6); 225 dyn_map_end = MAX((x2 + x3), (x4 + x5)); 226 dyn_map_end = MAX(dyn_map_end, (x6 + x7)); 227 dyn_map_size = dyn_map_end - dyn_map_start; 228 229 if (qti_mmap_add_dynamic_region(dyn_map_start, dyn_map_size, 230 (MT_NS | MT_RO_DATA)) != 0) { 231 ERROR("map failed for params NS Buffer2 %x %x\n", 232 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size); 233 goto unmap_return; 234 } 235 memprot_info_t *mem_info_p = (memprot_info_t *) x2; 236 uint32_t u_num_mappings = x3 / sizeof(memprot_info_t); 237 uint32_t *source_vm_list_p = (uint32_t *) x4; 238 uint32_t src_vm_list_cnt = x5 / sizeof(uint32_t); 239 memprot_dst_vm_perm_info_t *dest_vm_list_p = 240 (memprot_dst_vm_perm_info_t *) x6; 241 uint32_t dst_vm_list_cnt = 242 x7 / sizeof(memprot_dst_vm_perm_info_t); 243 if (qti_mem_assign_validate_param(mem_info_p, u_num_mappings, 244 source_vm_list_p, src_vm_list_cnt, 245 dest_vm_list_p, 246 dst_vm_list_cnt) != true) { 247 ERROR("Param validation failed\n"); 248 goto unmap_return; 249 } 250 251 memprot_info_t mem_info[QTI_VM_MAX_LIST_SIZE]; 252 /* Populating the arguments */ 253 for (int i = 0; i < u_num_mappings; i++) { 254 mem_info[i].mem_addr = mem_info_p[i].mem_addr; 255 mem_info[i].mem_size = mem_info_p[i].mem_size; 256 } 257 258 memprot_dst_vm_perm_info_t dest_vm_list[QTI_VM_LAST]; 259 260 for (int i = 0; i < dst_vm_list_cnt; i++) { 261 dest_vm_list[i].dst_vm = dest_vm_list_p[i].dst_vm; 262 dest_vm_list[i].dst_vm_perm = dest_vm_list_p[i].dst_vm_perm; 263 dest_vm_list[i].ctx = dest_vm_list_p[i].ctx; 264 dest_vm_list[i].ctx_size = dest_vm_list_p[i].ctx_size; 265 } 266 267 uint32_t source_vm_list[QTI_VM_LAST]; 268 269 for (int i = 0; i < src_vm_list_cnt; i++) { 270 source_vm_list[i] = source_vm_list_p[i]; 271 } 272 /* Un-Map NS Buffers. */ 273 if (qti_mmap_remove_dynamic_region(dyn_map_start, 274 dyn_map_size) != 0) { 275 ERROR("unmap failed for params NS Buffer %x %x\n", 276 (unsigned int)dyn_map_start, (unsigned int)dyn_map_size); 277 goto unmap_return; 278 } 279 /* Invoke API lib api. */ 280 ret = qtiseclib_mem_assign(mem_info, u_num_mappings, 281 source_vm_list, src_vm_list_cnt, 282 dest_vm_list, dst_vm_list_cnt); 283 284 if (ret == 0) { 285 SMC_RET2(handle, QTI_SIP_SUCCESS, ret); 286 } 287 unmap_return: 288 /* Un-Map NS Buffers if mapped */ 289 if (dyn_map_start && dyn_map_size) { 290 qti_mmap_remove_dynamic_region(dyn_map_start, dyn_map_size); 291 } 292 293 SMC_RET2(handle, QTI_SIP_INVALID_PARAM, ret); 294 } 295 296 /* 297 * This function handles QTI specific syscalls. Currently only SiP calls are present. 298 * Both FAST & YIELD type call land here. 299 */ 300 static uintptr_t qti_sip_handler(uint32_t smc_fid, 301 u_register_t x1, 302 u_register_t x2, 303 u_register_t x3, 304 u_register_t x4, 305 void *cookie, void *handle, u_register_t flags) 306 { 307 uint32_t l_smc_fid = smc_fid & FUNCID_OEN_NUM_MASK; 308 309 if (GET_SMC_CC(smc_fid) == SMC_32) { 310 x1 = (uint32_t) x1; 311 x2 = (uint32_t) x2; 312 x3 = (uint32_t) x3; 313 x4 = (uint32_t) x4; 314 } 315 316 switch (l_smc_fid) { 317 case QTI_SIP_SVC_CALL_COUNT_ID: 318 { 319 SMC_RET1(handle, QTI_SIP_SVC_CALL_COUNT); 320 break; 321 } 322 case QTI_SIP_SVC_UID_ID: 323 { 324 /* Return UID to the caller */ 325 SMC_UUID_RET(handle, qti_sip_svc_uid); 326 break; 327 } 328 case QTI_SIP_SVC_VERSION_ID: 329 { 330 /* Return the version of current implementation */ 331 SMC_RET2(handle, QTI_SIP_SVC_VERSION_MAJOR, 332 QTI_SIP_SVC_VERSION_MINOR); 333 break; 334 } 335 case QTI_SIP_SVC_AVAILABLE_ID: 336 { 337 if (x1 != 1) { 338 SMC_RET1(handle, QTI_SIP_INVALID_PARAM); 339 } 340 if (qti_check_syscall_availability(x2) == true) { 341 SMC_RET2(handle, QTI_SIP_SUCCESS, 1); 342 } else { 343 SMC_RET2(handle, QTI_SIP_SUCCESS, 0); 344 } 345 break; 346 } 347 case QTI_SIP_SVC_SECURE_IO_READ_ID: 348 { 349 if ((x1 == QTI_SIP_SVC_SECURE_IO_READ_PARAM_ID) && 350 qti_is_secure_io_access_allowed(x2)) { 351 SMC_RET2(handle, QTI_SIP_SUCCESS, 352 *((volatile uint32_t *)x2)); 353 } 354 SMC_RET1(handle, QTI_SIP_INVALID_PARAM); 355 break; 356 } 357 case QTI_SIP_SVC_SECURE_IO_WRITE_ID: 358 { 359 if ((x1 == QTI_SIP_SVC_SECURE_IO_WRITE_PARAM_ID) && 360 qti_is_secure_io_access_allowed(x2)) { 361 *((volatile uint32_t *)x2) = x3; 362 SMC_RET1(handle, QTI_SIP_SUCCESS); 363 } 364 SMC_RET1(handle, QTI_SIP_INVALID_PARAM); 365 break; 366 } 367 case QTI_SIP_SVC_MEM_ASSIGN_ID: 368 { 369 return qti_sip_mem_assign(handle, GET_SMC_CC(smc_fid), 370 x1, x2, x3, x4); 371 break; 372 } 373 default: 374 { 375 SMC_RET1(handle, QTI_SIP_NOT_SUPPORTED); 376 } 377 } 378 return (uintptr_t) handle; 379 } 380 381 /* Define a runtime service descriptor for both fast & yield SiP calls */ 382 DECLARE_RT_SVC(qti_sip_fast_svc, OEN_SIP_START, 383 OEN_SIP_END, SMC_TYPE_FAST, NULL, qti_sip_handler); 384 385 DECLARE_RT_SVC(qti_sip_yield_svc, OEN_SIP_START, 386 OEN_SIP_END, SMC_TYPE_YIELD, NULL, qti_sip_handler); 387