1 /* 2 * Copyright (c) 2022-2024, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <stdio.h> 10 11 #include <arch_helpers.h> 12 #include <bl31/bl31.h> 13 #include <bl31/ehf.h> 14 #include <bl31/interrupt_mgmt.h> 15 #include <common/debug.h> 16 #include <common/fdt_wrappers.h> 17 #include <common/runtime_svc.h> 18 #include <common/uuid.h> 19 #include <lib/el3_runtime/context_mgmt.h> 20 #include <lib/smccc.h> 21 #include <lib/utils.h> 22 #include <lib/xlat_tables/xlat_tables_v2.h> 23 #include <libfdt.h> 24 #include <plat/common/platform.h> 25 #include <services/el3_spmc_logical_sp.h> 26 #include <services/ffa_svc.h> 27 #include <services/spmc_svc.h> 28 #include <services/spmd_svc.h> 29 #include "spmc.h" 30 #include "spmc_shared_mem.h" 31 32 #include <platform_def.h> 33 34 /* FFA_MEM_PERM_* helpers */ 35 #define FFA_MEM_PERM_MASK U(7) 36 #define FFA_MEM_PERM_DATA_MASK U(3) 37 #define FFA_MEM_PERM_DATA_SHIFT U(0) 38 #define FFA_MEM_PERM_DATA_NA U(0) 39 #define FFA_MEM_PERM_DATA_RW U(1) 40 #define FFA_MEM_PERM_DATA_RES U(2) 41 #define FFA_MEM_PERM_DATA_RO U(3) 42 #define FFA_MEM_PERM_INST_EXEC (U(0) << 2) 43 #define FFA_MEM_PERM_INST_NON_EXEC (U(1) << 2) 44 45 /* Declare the maximum number of SPs and El3 LPs. */ 46 #define MAX_SP_LP_PARTITIONS SECURE_PARTITION_COUNT + MAX_EL3_LP_DESCS_COUNT 47 48 /* 49 * Allocate a secure partition descriptor to describe each SP in the system that 50 * does not reside at EL3. 51 */ 52 static struct secure_partition_desc sp_desc[SECURE_PARTITION_COUNT]; 53 54 /* 55 * Allocate an NS endpoint descriptor to describe each VM and the Hypervisor in 56 * the system that interacts with a SP. It is used to track the Hypervisor 57 * buffer pair, version and ID for now. It could be extended to track VM 58 * properties when the SPMC supports indirect messaging. 59 */ 60 static struct ns_endpoint_desc ns_ep_desc[NS_PARTITION_COUNT]; 61 62 static uint64_t spmc_sp_interrupt_handler(uint32_t id, 63 uint32_t flags, 64 void *handle, 65 void *cookie); 66 67 /* 68 * Helper function to obtain the array storing the EL3 69 * Logical Partition descriptors. 70 */ 71 struct el3_lp_desc *get_el3_lp_array(void) 72 { 73 return (struct el3_lp_desc *) EL3_LP_DESCS_START; 74 } 75 76 /* 77 * Helper function to obtain the descriptor of the last SP to whom control was 78 * handed to on this physical cpu. Currently, we assume there is only one SP. 79 * TODO: Expand to track multiple partitions when required. 80 */ 81 struct secure_partition_desc *spmc_get_current_sp_ctx(void) 82 { 83 return &(sp_desc[ACTIVE_SP_DESC_INDEX]); 84 } 85 86 /* 87 * Helper function to obtain the execution context of an SP on the 88 * current physical cpu. 89 */ 90 struct sp_exec_ctx *spmc_get_sp_ec(struct secure_partition_desc *sp) 91 { 92 return &(sp->ec[get_ec_index(sp)]); 93 } 94 95 /* Helper function to get pointer to SP context from its ID. */ 96 struct secure_partition_desc *spmc_get_sp_ctx(uint16_t id) 97 { 98 /* Check for Secure World Partitions. */ 99 for (unsigned int i = 0U; i < SECURE_PARTITION_COUNT; i++) { 100 if (sp_desc[i].sp_id == id) { 101 return &(sp_desc[i]); 102 } 103 } 104 return NULL; 105 } 106 107 /* 108 * Helper function to obtain the descriptor of the Hypervisor or OS kernel. 109 * We assume that the first descriptor is reserved for this entity. 110 */ 111 struct ns_endpoint_desc *spmc_get_hyp_ctx(void) 112 { 113 return &(ns_ep_desc[0]); 114 } 115 116 /* 117 * Helper function to obtain the RX/TX buffer pair descriptor of the Hypervisor 118 * or OS kernel in the normal world or the last SP that was run. 119 */ 120 struct mailbox *spmc_get_mbox_desc(bool secure_origin) 121 { 122 /* Obtain the RX/TX buffer pair descriptor. */ 123 if (secure_origin) { 124 return &(spmc_get_current_sp_ctx()->mailbox); 125 } else { 126 return &(spmc_get_hyp_ctx()->mailbox); 127 } 128 } 129 130 /****************************************************************************** 131 * This function returns to the place where spmc_sp_synchronous_entry() was 132 * called originally. 133 ******************************************************************************/ 134 __dead2 void spmc_sp_synchronous_exit(struct sp_exec_ctx *ec, uint64_t rc) 135 { 136 /* 137 * The SPM must have initiated the original request through a 138 * synchronous entry into the secure partition. Jump back to the 139 * original C runtime context with the value of rc in x0; 140 */ 141 spm_secure_partition_exit(ec->c_rt_ctx, rc); 142 143 panic(); 144 } 145 146 /******************************************************************************* 147 * Return FFA_ERROR with specified error code. 148 ******************************************************************************/ 149 uint64_t spmc_ffa_error_return(void *handle, int error_code) 150 { 151 SMC_RET8(handle, FFA_ERROR, 152 FFA_TARGET_INFO_MBZ, error_code, 153 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 154 FFA_PARAM_MBZ, FFA_PARAM_MBZ); 155 } 156 157 /****************************************************************************** 158 * Helper function to validate a secure partition ID to ensure it does not 159 * conflict with any other FF-A component and follows the convention to 160 * indicate it resides within the secure world. 161 ******************************************************************************/ 162 bool is_ffa_secure_id_valid(uint16_t partition_id) 163 { 164 struct el3_lp_desc *el3_lp_descs = get_el3_lp_array(); 165 166 /* Ensure the ID is not the invalid partition ID. */ 167 if (partition_id == INV_SP_ID) { 168 return false; 169 } 170 171 /* Ensure the ID is not the SPMD ID. */ 172 if (partition_id == SPMD_DIRECT_MSG_ENDPOINT_ID) { 173 return false; 174 } 175 176 /* 177 * Ensure the ID follows the convention to indicate it resides 178 * in the secure world. 179 */ 180 if (!ffa_is_secure_world_id(partition_id)) { 181 return false; 182 } 183 184 /* Ensure we don't conflict with the SPMC partition ID. */ 185 if (partition_id == FFA_SPMC_ID) { 186 return false; 187 } 188 189 /* Ensure we do not already have an SP context with this ID. */ 190 if (spmc_get_sp_ctx(partition_id)) { 191 return false; 192 } 193 194 /* Ensure we don't clash with any Logical SP's. */ 195 for (unsigned int i = 0U; i < EL3_LP_DESCS_COUNT; i++) { 196 if (el3_lp_descs[i].sp_id == partition_id) { 197 return false; 198 } 199 } 200 201 return true; 202 } 203 204 /******************************************************************************* 205 * This function either forwards the request to the other world or returns 206 * with an ERET depending on the source of the call. 207 * We can assume that the destination is for an entity at a lower exception 208 * level as any messages destined for a logical SP resident in EL3 will have 209 * already been taken care of by the SPMC before entering this function. 210 ******************************************************************************/ 211 static uint64_t spmc_smc_return(uint32_t smc_fid, 212 bool secure_origin, 213 uint64_t x1, 214 uint64_t x2, 215 uint64_t x3, 216 uint64_t x4, 217 void *handle, 218 void *cookie, 219 uint64_t flags, 220 uint16_t dst_id) 221 { 222 /* If the destination is in the normal world always go via the SPMD. */ 223 if (ffa_is_normal_world_id(dst_id)) { 224 return spmd_smc_handler(smc_fid, x1, x2, x3, x4, 225 cookie, handle, flags); 226 } 227 /* 228 * If the caller is secure and we want to return to the secure world, 229 * ERET directly. 230 */ 231 else if (secure_origin && ffa_is_secure_world_id(dst_id)) { 232 SMC_RET5(handle, smc_fid, x1, x2, x3, x4); 233 } 234 /* If we originated in the normal world then switch contexts. */ 235 else if (!secure_origin && ffa_is_secure_world_id(dst_id)) { 236 return spmd_smc_switch_state(smc_fid, secure_origin, x1, x2, 237 x3, x4, handle, flags); 238 } else { 239 /* Unknown State. */ 240 panic(); 241 } 242 243 /* Shouldn't be Reached. */ 244 return 0; 245 } 246 247 /******************************************************************************* 248 * FF-A ABI Handlers. 249 ******************************************************************************/ 250 251 /******************************************************************************* 252 * Helper function to validate arg2 as part of a direct message. 253 ******************************************************************************/ 254 static inline bool direct_msg_validate_arg2(uint64_t x2) 255 { 256 /* Check message type. */ 257 if (x2 & FFA_FWK_MSG_BIT) { 258 /* We have a framework message, ensure it is a known message. */ 259 if (x2 & ~(FFA_FWK_MSG_MASK | FFA_FWK_MSG_BIT)) { 260 VERBOSE("Invalid message format 0x%lx.\n", x2); 261 return false; 262 } 263 } else { 264 /* We have a partition messages, ensure x2 is not set. */ 265 if (x2 != (uint64_t) 0) { 266 VERBOSE("Arg2 MBZ for partition messages. (0x%lx).\n", 267 x2); 268 return false; 269 } 270 } 271 return true; 272 } 273 274 /******************************************************************************* 275 * Helper function to validate the destination ID of a direct response. 276 ******************************************************************************/ 277 static bool direct_msg_validate_dst_id(uint16_t dst_id) 278 { 279 struct secure_partition_desc *sp; 280 281 /* Check if we're targeting a normal world partition. */ 282 if (ffa_is_normal_world_id(dst_id)) { 283 return true; 284 } 285 286 /* Or directed to the SPMC itself.*/ 287 if (dst_id == FFA_SPMC_ID) { 288 return true; 289 } 290 291 /* Otherwise ensure the SP exists. */ 292 sp = spmc_get_sp_ctx(dst_id); 293 if (sp != NULL) { 294 return true; 295 } 296 297 return false; 298 } 299 300 /******************************************************************************* 301 * Helper function to validate the response from a Logical Partition. 302 ******************************************************************************/ 303 static bool direct_msg_validate_lp_resp(uint16_t origin_id, uint16_t lp_id, 304 void *handle) 305 { 306 /* Retrieve populated Direct Response Arguments. */ 307 uint64_t smc_fid = SMC_GET_GP(handle, CTX_GPREG_X0); 308 uint64_t x1 = SMC_GET_GP(handle, CTX_GPREG_X1); 309 uint64_t x2 = SMC_GET_GP(handle, CTX_GPREG_X2); 310 uint16_t src_id = ffa_endpoint_source(x1); 311 uint16_t dst_id = ffa_endpoint_destination(x1); 312 313 if (src_id != lp_id) { 314 ERROR("Invalid EL3 LP source ID (0x%x).\n", src_id); 315 return false; 316 } 317 318 /* 319 * Check the destination ID is valid and ensure the LP is responding to 320 * the original request. 321 */ 322 if ((!direct_msg_validate_dst_id(dst_id)) || (dst_id != origin_id)) { 323 ERROR("Invalid EL3 LP destination ID (0x%x).\n", dst_id); 324 return false; 325 } 326 327 if ((smc_fid != FFA_MSG_SEND_DIRECT_RESP2_SMC64) && 328 !direct_msg_validate_arg2(x2)) { 329 ERROR("Invalid EL3 LP message encoding.\n"); 330 return false; 331 } 332 return true; 333 } 334 335 /******************************************************************************* 336 * Helper function to check that partition can receive direct msg or not. 337 ******************************************************************************/ 338 static bool direct_msg_receivable(uint32_t properties, uint16_t dir_req_fnum) 339 { 340 if ((dir_req_fnum == FFA_FNUM_MSG_SEND_DIRECT_REQ && 341 ((properties & FFA_PARTITION_DIRECT_REQ_RECV) == 0U)) || 342 (dir_req_fnum == FFA_FNUM_MSG_SEND_DIRECT_REQ2 && 343 ((properties & FFA_PARTITION_DIRECT_REQ2_RECV) == 0U))) { 344 return false; 345 } 346 347 return true; 348 } 349 350 /******************************************************************************* 351 * Handle direct request messages and route to the appropriate destination. 352 ******************************************************************************/ 353 static uint64_t direct_req_smc_handler(uint32_t smc_fid, 354 bool secure_origin, 355 uint64_t x1, 356 uint64_t x2, 357 uint64_t x3, 358 uint64_t x4, 359 void *cookie, 360 void *handle, 361 uint64_t flags) 362 { 363 uint16_t src_id = ffa_endpoint_source(x1); 364 uint16_t dst_id = ffa_endpoint_destination(x1); 365 uint16_t dir_req_funcid; 366 struct el3_lp_desc *el3_lp_descs; 367 struct secure_partition_desc *sp; 368 unsigned int idx; 369 370 dir_req_funcid = (smc_fid != FFA_MSG_SEND_DIRECT_REQ2_SMC64) ? 371 FFA_FNUM_MSG_SEND_DIRECT_REQ : FFA_FNUM_MSG_SEND_DIRECT_REQ2; 372 373 /* 374 * Sanity check for DIRECT_REQ: 375 * Check if arg2 has been populated correctly based on message type 376 */ 377 if ((dir_req_funcid == FFA_FNUM_MSG_SEND_DIRECT_REQ) && 378 !direct_msg_validate_arg2(x2)) { 379 return spmc_ffa_error_return(handle, FFA_ERROR_INVALID_PARAMETER); 380 } 381 382 /* Validate Sender is either the current SP or from the normal world. */ 383 if ((secure_origin && src_id != spmc_get_current_sp_ctx()->sp_id) || 384 (!secure_origin && !ffa_is_normal_world_id(src_id))) { 385 ERROR("Invalid direct request source ID (0x%x).\n", src_id); 386 return spmc_ffa_error_return(handle, 387 FFA_ERROR_INVALID_PARAMETER); 388 } 389 390 el3_lp_descs = get_el3_lp_array(); 391 392 /* Check if the request is destined for a Logical Partition. */ 393 for (unsigned int i = 0U; i < MAX_EL3_LP_DESCS_COUNT; i++) { 394 if (el3_lp_descs[i].sp_id == dst_id) { 395 if (!direct_msg_receivable(el3_lp_descs[i].properties, dir_req_funcid)) { 396 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 397 } 398 399 uint64_t ret = el3_lp_descs[i].direct_req( 400 smc_fid, secure_origin, x1, x2, 401 x3, x4, cookie, handle, flags); 402 if (!direct_msg_validate_lp_resp(src_id, dst_id, 403 handle)) { 404 panic(); 405 } 406 407 /* Message checks out. */ 408 return ret; 409 } 410 } 411 412 /* 413 * If the request was not targeted to a LSP and from the secure world 414 * then it is invalid since a SP cannot call into the Normal world and 415 * there is no other SP to call into. If there are other SPs in future 416 * then the partition runtime model would need to be validated as well. 417 */ 418 if (secure_origin) { 419 VERBOSE("Direct request not supported to the Normal World.\n"); 420 return spmc_ffa_error_return(handle, 421 FFA_ERROR_INVALID_PARAMETER); 422 } 423 424 /* Check if the SP ID is valid. */ 425 sp = spmc_get_sp_ctx(dst_id); 426 if (sp == NULL) { 427 VERBOSE("Direct request to unknown partition ID (0x%x).\n", 428 dst_id); 429 return spmc_ffa_error_return(handle, 430 FFA_ERROR_INVALID_PARAMETER); 431 } 432 433 if (!direct_msg_receivable(sp->properties, dir_req_funcid)) { 434 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 435 } 436 437 /* Protect the runtime state of a UP S-EL0 SP with a lock. */ 438 if (sp->runtime_el == S_EL0) { 439 spin_lock(&sp->rt_state_lock); 440 } 441 442 /* 443 * Check that the target execution context is in a waiting state before 444 * forwarding the direct request to it. 445 */ 446 idx = get_ec_index(sp); 447 if (sp->ec[idx].rt_state != RT_STATE_WAITING) { 448 VERBOSE("SP context on core%u is not waiting (%u).\n", 449 idx, sp->ec[idx].rt_model); 450 451 if (sp->runtime_el == S_EL0) { 452 spin_unlock(&sp->rt_state_lock); 453 } 454 455 return spmc_ffa_error_return(handle, FFA_ERROR_BUSY); 456 } 457 458 /* 459 * Everything checks out so forward the request to the SP after updating 460 * its state and runtime model. 461 */ 462 sp->ec[idx].rt_state = RT_STATE_RUNNING; 463 sp->ec[idx].rt_model = RT_MODEL_DIR_REQ; 464 sp->ec[idx].dir_req_origin_id = src_id; 465 sp->ec[idx].dir_req_funcid = dir_req_funcid; 466 467 if (sp->runtime_el == S_EL0) { 468 spin_unlock(&sp->rt_state_lock); 469 } 470 471 return spmc_smc_return(smc_fid, secure_origin, x1, x2, x3, x4, 472 handle, cookie, flags, dst_id); 473 } 474 475 /******************************************************************************* 476 * Handle direct response messages and route to the appropriate destination. 477 ******************************************************************************/ 478 static uint64_t direct_resp_smc_handler(uint32_t smc_fid, 479 bool secure_origin, 480 uint64_t x1, 481 uint64_t x2, 482 uint64_t x3, 483 uint64_t x4, 484 void *cookie, 485 void *handle, 486 uint64_t flags) 487 { 488 uint16_t dst_id = ffa_endpoint_destination(x1); 489 uint16_t dir_req_funcid; 490 struct secure_partition_desc *sp; 491 unsigned int idx; 492 493 dir_req_funcid = (smc_fid != FFA_MSG_SEND_DIRECT_RESP2_SMC64) ? 494 FFA_FNUM_MSG_SEND_DIRECT_REQ : FFA_FNUM_MSG_SEND_DIRECT_REQ2; 495 496 /* Check if arg2 has been populated correctly based on message type. */ 497 if (!direct_msg_validate_arg2(x2)) { 498 return spmc_ffa_error_return(handle, 499 FFA_ERROR_INVALID_PARAMETER); 500 } 501 502 /* Check that the response did not originate from the Normal world. */ 503 if (!secure_origin) { 504 VERBOSE("Direct Response not supported from Normal World.\n"); 505 return spmc_ffa_error_return(handle, 506 FFA_ERROR_INVALID_PARAMETER); 507 } 508 509 /* 510 * Check that the response is either targeted to the Normal world or the 511 * SPMC e.g. a PM response. 512 */ 513 if (!direct_msg_validate_dst_id(dst_id)) { 514 VERBOSE("Direct response to invalid partition ID (0x%x).\n", 515 dst_id); 516 return spmc_ffa_error_return(handle, 517 FFA_ERROR_INVALID_PARAMETER); 518 } 519 520 /* Obtain the SP descriptor and update its runtime state. */ 521 sp = spmc_get_sp_ctx(ffa_endpoint_source(x1)); 522 if (sp == NULL) { 523 VERBOSE("Direct response to unknown partition ID (0x%x).\n", 524 dst_id); 525 return spmc_ffa_error_return(handle, 526 FFA_ERROR_INVALID_PARAMETER); 527 } 528 529 if (sp->runtime_el == S_EL0) { 530 spin_lock(&sp->rt_state_lock); 531 } 532 533 /* Sanity check state is being tracked correctly in the SPMC. */ 534 idx = get_ec_index(sp); 535 assert(sp->ec[idx].rt_state == RT_STATE_RUNNING); 536 537 /* Ensure SP execution context was in the right runtime model. */ 538 if (sp->ec[idx].rt_model != RT_MODEL_DIR_REQ) { 539 VERBOSE("SP context on core%u not handling direct req (%u).\n", 540 idx, sp->ec[idx].rt_model); 541 if (sp->runtime_el == S_EL0) { 542 spin_unlock(&sp->rt_state_lock); 543 } 544 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 545 } 546 547 if (dir_req_funcid != sp->ec[idx].dir_req_funcid) { 548 WARN("Unmatched direct req/resp func id. req:%x, resp:%x on core%u.\n", 549 sp->ec[idx].dir_req_funcid, (smc_fid & FUNCID_NUM_MASK), idx); 550 if (sp->runtime_el == S_EL0) { 551 spin_unlock(&sp->rt_state_lock); 552 } 553 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 554 } 555 556 if (sp->ec[idx].dir_req_origin_id != dst_id) { 557 WARN("Invalid direct resp partition ID 0x%x != 0x%x on core%u.\n", 558 dst_id, sp->ec[idx].dir_req_origin_id, idx); 559 if (sp->runtime_el == S_EL0) { 560 spin_unlock(&sp->rt_state_lock); 561 } 562 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 563 } 564 565 /* Update the state of the SP execution context. */ 566 sp->ec[idx].rt_state = RT_STATE_WAITING; 567 568 /* Clear the ongoing direct request ID. */ 569 sp->ec[idx].dir_req_origin_id = INV_SP_ID; 570 571 /* Clear the ongoing direct request message version. */ 572 sp->ec[idx].dir_req_funcid = 0U; 573 574 if (sp->runtime_el == S_EL0) { 575 spin_unlock(&sp->rt_state_lock); 576 } 577 578 /* 579 * If the receiver is not the SPMC then forward the response to the 580 * Normal world. 581 */ 582 if (dst_id == FFA_SPMC_ID) { 583 spmc_sp_synchronous_exit(&sp->ec[idx], x4); 584 /* Should not get here. */ 585 panic(); 586 } 587 588 return spmc_smc_return(smc_fid, secure_origin, x1, x2, x3, x4, 589 handle, cookie, flags, dst_id); 590 } 591 592 /******************************************************************************* 593 * This function handles the FFA_MSG_WAIT SMC to allow an SP to relinquish its 594 * cycles. 595 ******************************************************************************/ 596 static uint64_t msg_wait_handler(uint32_t smc_fid, 597 bool secure_origin, 598 uint64_t x1, 599 uint64_t x2, 600 uint64_t x3, 601 uint64_t x4, 602 void *cookie, 603 void *handle, 604 uint64_t flags) 605 { 606 struct secure_partition_desc *sp; 607 unsigned int idx; 608 609 /* 610 * Check that the response did not originate from the Normal world as 611 * only the secure world can call this ABI. 612 */ 613 if (!secure_origin) { 614 VERBOSE("Normal world cannot call FFA_MSG_WAIT.\n"); 615 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 616 } 617 618 /* Get the descriptor of the SP that invoked FFA_MSG_WAIT. */ 619 sp = spmc_get_current_sp_ctx(); 620 if (sp == NULL) { 621 return spmc_ffa_error_return(handle, 622 FFA_ERROR_INVALID_PARAMETER); 623 } 624 625 /* 626 * Get the execution context of the SP that invoked FFA_MSG_WAIT. 627 */ 628 idx = get_ec_index(sp); 629 if (sp->runtime_el == S_EL0) { 630 spin_lock(&sp->rt_state_lock); 631 } 632 633 /* Ensure SP execution context was in the right runtime model. */ 634 if (sp->ec[idx].rt_model == RT_MODEL_DIR_REQ) { 635 if (sp->runtime_el == S_EL0) { 636 spin_unlock(&sp->rt_state_lock); 637 } 638 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 639 } 640 641 /* Sanity check the state is being tracked correctly in the SPMC. */ 642 assert(sp->ec[idx].rt_state == RT_STATE_RUNNING); 643 644 /* 645 * Perform a synchronous exit if the partition was initialising. The 646 * state is updated after the exit. 647 */ 648 if (sp->ec[idx].rt_model == RT_MODEL_INIT) { 649 if (sp->runtime_el == S_EL0) { 650 spin_unlock(&sp->rt_state_lock); 651 } 652 spmc_sp_synchronous_exit(&sp->ec[idx], x4); 653 /* Should not get here */ 654 panic(); 655 } 656 657 /* Update the state of the SP execution context. */ 658 sp->ec[idx].rt_state = RT_STATE_WAITING; 659 660 /* Resume normal world if a secure interrupt was handled. */ 661 if (sp->ec[idx].rt_model == RT_MODEL_INTR) { 662 /* FFA_MSG_WAIT can only be called from the secure world. */ 663 unsigned int secure_state_in = SECURE; 664 unsigned int secure_state_out = NON_SECURE; 665 666 cm_el1_sysregs_context_save(secure_state_in); 667 cm_el1_sysregs_context_restore(secure_state_out); 668 cm_set_next_eret_context(secure_state_out); 669 670 if (sp->runtime_el == S_EL0) { 671 spin_unlock(&sp->rt_state_lock); 672 } 673 674 SMC_RET0(cm_get_context(secure_state_out)); 675 } 676 677 /* Protect the runtime state of a S-EL0 SP with a lock. */ 678 if (sp->runtime_el == S_EL0) { 679 spin_unlock(&sp->rt_state_lock); 680 } 681 682 /* Forward the response to the Normal world. */ 683 return spmc_smc_return(smc_fid, secure_origin, x1, x2, x3, x4, 684 handle, cookie, flags, FFA_NWD_ID); 685 } 686 687 static uint64_t ffa_error_handler(uint32_t smc_fid, 688 bool secure_origin, 689 uint64_t x1, 690 uint64_t x2, 691 uint64_t x3, 692 uint64_t x4, 693 void *cookie, 694 void *handle, 695 uint64_t flags) 696 { 697 struct secure_partition_desc *sp; 698 unsigned int idx; 699 uint16_t dst_id = ffa_endpoint_destination(x1); 700 bool cancel_dir_req = false; 701 702 /* Check that the response did not originate from the Normal world. */ 703 if (!secure_origin) { 704 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 705 } 706 707 /* Get the descriptor of the SP that invoked FFA_ERROR. */ 708 sp = spmc_get_current_sp_ctx(); 709 if (sp == NULL) { 710 return spmc_ffa_error_return(handle, 711 FFA_ERROR_INVALID_PARAMETER); 712 } 713 714 /* Get the execution context of the SP that invoked FFA_ERROR. */ 715 idx = get_ec_index(sp); 716 717 /* 718 * We only expect FFA_ERROR to be received during SP initialisation 719 * otherwise this is an invalid call. 720 */ 721 if (sp->ec[idx].rt_model == RT_MODEL_INIT) { 722 ERROR("SP 0x%x failed to initialize.\n", sp->sp_id); 723 spmc_sp_synchronous_exit(&sp->ec[idx], x2); 724 /* Should not get here. */ 725 panic(); 726 } 727 728 if (sp->runtime_el == S_EL0) { 729 spin_lock(&sp->rt_state_lock); 730 } 731 732 if (sp->ec[idx].rt_state == RT_STATE_RUNNING && 733 sp->ec[idx].rt_model == RT_MODEL_DIR_REQ) { 734 sp->ec[idx].rt_state = RT_STATE_WAITING; 735 sp->ec[idx].dir_req_origin_id = INV_SP_ID; 736 sp->ec[idx].dir_req_funcid = 0x00; 737 cancel_dir_req = true; 738 } 739 740 if (sp->runtime_el == S_EL0) { 741 spin_unlock(&sp->rt_state_lock); 742 } 743 744 if (cancel_dir_req) { 745 if (dst_id == FFA_SPMC_ID) { 746 spmc_sp_synchronous_exit(&sp->ec[idx], x4); 747 /* Should not get here. */ 748 panic(); 749 } else 750 return spmc_smc_return(smc_fid, secure_origin, x1, x2, x3, x4, 751 handle, cookie, flags, dst_id); 752 } 753 754 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 755 } 756 757 static uint64_t ffa_version_handler(uint32_t smc_fid, 758 bool secure_origin, 759 uint64_t x1, 760 uint64_t x2, 761 uint64_t x3, 762 uint64_t x4, 763 void *cookie, 764 void *handle, 765 uint64_t flags) 766 { 767 uint32_t requested_version = x1 & FFA_VERSION_MASK; 768 769 if (requested_version & FFA_VERSION_BIT31_MASK) { 770 /* Invalid encoding, return an error. */ 771 SMC_RET1(handle, FFA_ERROR_NOT_SUPPORTED); 772 /* Execution stops here. */ 773 } 774 775 /* Determine the caller to store the requested version. */ 776 if (secure_origin) { 777 /* 778 * Ensure that the SP is reporting the same version as 779 * specified in its manifest. If these do not match there is 780 * something wrong with the SP. 781 * TODO: Should we abort the SP? For now assert this is not 782 * case. 783 */ 784 assert(requested_version == 785 spmc_get_current_sp_ctx()->ffa_version); 786 } else { 787 /* 788 * If this is called by the normal world, record this 789 * information in its descriptor. 790 */ 791 spmc_get_hyp_ctx()->ffa_version = requested_version; 792 } 793 794 SMC_RET1(handle, MAKE_FFA_VERSION(FFA_VERSION_MAJOR, 795 FFA_VERSION_MINOR)); 796 } 797 798 /******************************************************************************* 799 * Helper function to obtain the FF-A version of the calling partition. 800 ******************************************************************************/ 801 uint32_t get_partition_ffa_version(bool secure_origin) 802 { 803 if (secure_origin) { 804 return spmc_get_current_sp_ctx()->ffa_version; 805 } else { 806 return spmc_get_hyp_ctx()->ffa_version; 807 } 808 } 809 810 static uint64_t rxtx_map_handler(uint32_t smc_fid, 811 bool secure_origin, 812 uint64_t x1, 813 uint64_t x2, 814 uint64_t x3, 815 uint64_t x4, 816 void *cookie, 817 void *handle, 818 uint64_t flags) 819 { 820 int ret; 821 uint32_t error_code; 822 uint32_t mem_atts = secure_origin ? MT_SECURE : MT_NS; 823 struct mailbox *mbox; 824 uintptr_t tx_address = x1; 825 uintptr_t rx_address = x2; 826 uint32_t page_count = x3 & FFA_RXTX_PAGE_COUNT_MASK; /* Bits [5:0] */ 827 uint32_t buf_size = page_count * FFA_PAGE_SIZE; 828 829 /* 830 * The SPMC does not support mapping of VM RX/TX pairs to facilitate 831 * indirect messaging with SPs. Check if the Hypervisor has invoked this 832 * ABI on behalf of a VM and reject it if this is the case. 833 */ 834 if (tx_address == 0 || rx_address == 0) { 835 WARN("Mapping RX/TX Buffers on behalf of VM not supported.\n"); 836 return spmc_ffa_error_return(handle, 837 FFA_ERROR_INVALID_PARAMETER); 838 } 839 840 /* Ensure the specified buffers are not the same. */ 841 if (tx_address == rx_address) { 842 WARN("TX Buffer must not be the same as RX Buffer.\n"); 843 return spmc_ffa_error_return(handle, 844 FFA_ERROR_INVALID_PARAMETER); 845 } 846 847 /* Ensure the buffer size is not 0. */ 848 if (buf_size == 0U) { 849 WARN("Buffer size must not be 0\n"); 850 return spmc_ffa_error_return(handle, 851 FFA_ERROR_INVALID_PARAMETER); 852 } 853 854 /* 855 * Ensure the buffer size is a multiple of the translation granule size 856 * in TF-A. 857 */ 858 if (buf_size % PAGE_SIZE != 0U) { 859 WARN("Buffer size must be aligned to translation granule.\n"); 860 return spmc_ffa_error_return(handle, 861 FFA_ERROR_INVALID_PARAMETER); 862 } 863 864 /* Obtain the RX/TX buffer pair descriptor. */ 865 mbox = spmc_get_mbox_desc(secure_origin); 866 867 spin_lock(&mbox->lock); 868 869 /* Check if buffers have already been mapped. */ 870 if (mbox->rx_buffer != 0 || mbox->tx_buffer != 0) { 871 WARN("RX/TX Buffers already mapped (%p/%p)\n", 872 (void *) mbox->rx_buffer, (void *)mbox->tx_buffer); 873 error_code = FFA_ERROR_DENIED; 874 goto err; 875 } 876 877 /* memmap the TX buffer as read only. */ 878 ret = mmap_add_dynamic_region(tx_address, /* PA */ 879 tx_address, /* VA */ 880 buf_size, /* size */ 881 mem_atts | MT_RO_DATA); /* attrs */ 882 if (ret != 0) { 883 /* Return the correct error code. */ 884 error_code = (ret == -ENOMEM) ? FFA_ERROR_NO_MEMORY : 885 FFA_ERROR_INVALID_PARAMETER; 886 WARN("Unable to map TX buffer: %d\n", error_code); 887 goto err; 888 } 889 890 /* memmap the RX buffer as read write. */ 891 ret = mmap_add_dynamic_region(rx_address, /* PA */ 892 rx_address, /* VA */ 893 buf_size, /* size */ 894 mem_atts | MT_RW_DATA); /* attrs */ 895 896 if (ret != 0) { 897 error_code = (ret == -ENOMEM) ? FFA_ERROR_NO_MEMORY : 898 FFA_ERROR_INVALID_PARAMETER; 899 WARN("Unable to map RX buffer: %d\n", error_code); 900 /* Unmap the TX buffer again. */ 901 mmap_remove_dynamic_region(tx_address, buf_size); 902 goto err; 903 } 904 905 mbox->tx_buffer = (void *) tx_address; 906 mbox->rx_buffer = (void *) rx_address; 907 mbox->rxtx_page_count = page_count; 908 spin_unlock(&mbox->lock); 909 910 SMC_RET1(handle, FFA_SUCCESS_SMC32); 911 /* Execution stops here. */ 912 err: 913 spin_unlock(&mbox->lock); 914 return spmc_ffa_error_return(handle, error_code); 915 } 916 917 static uint64_t rxtx_unmap_handler(uint32_t smc_fid, 918 bool secure_origin, 919 uint64_t x1, 920 uint64_t x2, 921 uint64_t x3, 922 uint64_t x4, 923 void *cookie, 924 void *handle, 925 uint64_t flags) 926 { 927 struct mailbox *mbox = spmc_get_mbox_desc(secure_origin); 928 uint32_t buf_size = mbox->rxtx_page_count * FFA_PAGE_SIZE; 929 930 /* 931 * The SPMC does not support mapping of VM RX/TX pairs to facilitate 932 * indirect messaging with SPs. Check if the Hypervisor has invoked this 933 * ABI on behalf of a VM and reject it if this is the case. 934 */ 935 if (x1 != 0UL) { 936 return spmc_ffa_error_return(handle, 937 FFA_ERROR_INVALID_PARAMETER); 938 } 939 940 spin_lock(&mbox->lock); 941 942 /* Check if buffers are currently mapped. */ 943 if (mbox->rx_buffer == 0 || mbox->tx_buffer == 0) { 944 spin_unlock(&mbox->lock); 945 return spmc_ffa_error_return(handle, 946 FFA_ERROR_INVALID_PARAMETER); 947 } 948 949 /* Unmap RX Buffer */ 950 if (mmap_remove_dynamic_region((uintptr_t) mbox->rx_buffer, 951 buf_size) != 0) { 952 WARN("Unable to unmap RX buffer!\n"); 953 } 954 955 mbox->rx_buffer = 0; 956 957 /* Unmap TX Buffer */ 958 if (mmap_remove_dynamic_region((uintptr_t) mbox->tx_buffer, 959 buf_size) != 0) { 960 WARN("Unable to unmap TX buffer!\n"); 961 } 962 963 mbox->tx_buffer = 0; 964 mbox->rxtx_page_count = 0; 965 966 spin_unlock(&mbox->lock); 967 SMC_RET1(handle, FFA_SUCCESS_SMC32); 968 } 969 970 /* 971 * Helper function to populate the properties field of a Partition Info Get 972 * descriptor. 973 */ 974 static uint32_t 975 partition_info_get_populate_properties(uint32_t sp_properties, 976 enum sp_execution_state sp_ec_state) 977 { 978 uint32_t properties = sp_properties; 979 uint32_t ec_state; 980 981 /* Determine the execution state of the SP. */ 982 ec_state = sp_ec_state == SP_STATE_AARCH64 ? 983 FFA_PARTITION_INFO_GET_AARCH64_STATE : 984 FFA_PARTITION_INFO_GET_AARCH32_STATE; 985 986 properties |= ec_state << FFA_PARTITION_INFO_GET_EXEC_STATE_SHIFT; 987 988 return properties; 989 } 990 991 /* 992 * Collate the partition information in a v1.1 partition information 993 * descriptor format, this will be converter later if required. 994 */ 995 static int partition_info_get_handler_v1_1(uint32_t *uuid, 996 struct ffa_partition_info_v1_1 997 *partitions, 998 uint32_t max_partitions, 999 uint32_t *partition_count) 1000 { 1001 uint32_t index; 1002 struct ffa_partition_info_v1_1 *desc; 1003 bool null_uuid = is_null_uuid(uuid); 1004 struct el3_lp_desc *el3_lp_descs = get_el3_lp_array(); 1005 1006 /* Deal with Logical Partitions. */ 1007 for (index = 0U; index < EL3_LP_DESCS_COUNT; index++) { 1008 if (null_uuid || uuid_match(uuid, el3_lp_descs[index].uuid)) { 1009 /* Found a matching UUID, populate appropriately. */ 1010 if (*partition_count >= max_partitions) { 1011 return FFA_ERROR_NO_MEMORY; 1012 } 1013 1014 desc = &partitions[*partition_count]; 1015 desc->ep_id = el3_lp_descs[index].sp_id; 1016 desc->execution_ctx_count = PLATFORM_CORE_COUNT; 1017 /* LSPs must be AArch64. */ 1018 desc->properties = 1019 partition_info_get_populate_properties( 1020 el3_lp_descs[index].properties, 1021 SP_STATE_AARCH64); 1022 1023 if (null_uuid) { 1024 copy_uuid(desc->uuid, el3_lp_descs[index].uuid); 1025 } 1026 (*partition_count)++; 1027 } 1028 } 1029 1030 /* Deal with physical SP's. */ 1031 for (index = 0U; index < SECURE_PARTITION_COUNT; index++) { 1032 if (null_uuid || uuid_match(uuid, sp_desc[index].uuid)) { 1033 /* Found a matching UUID, populate appropriately. */ 1034 if (*partition_count >= max_partitions) { 1035 return FFA_ERROR_NO_MEMORY; 1036 } 1037 1038 desc = &partitions[*partition_count]; 1039 desc->ep_id = sp_desc[index].sp_id; 1040 /* 1041 * Execution context count must match No. cores for 1042 * S-EL1 SPs. 1043 */ 1044 desc->execution_ctx_count = PLATFORM_CORE_COUNT; 1045 desc->properties = 1046 partition_info_get_populate_properties( 1047 sp_desc[index].properties, 1048 sp_desc[index].execution_state); 1049 1050 if (null_uuid) { 1051 copy_uuid(desc->uuid, sp_desc[index].uuid); 1052 } 1053 (*partition_count)++; 1054 } 1055 } 1056 return 0; 1057 } 1058 1059 /* 1060 * Handle the case where that caller only wants the count of partitions 1061 * matching a given UUID and does not want the corresponding descriptors 1062 * populated. 1063 */ 1064 static uint32_t partition_info_get_handler_count_only(uint32_t *uuid) 1065 { 1066 uint32_t index = 0; 1067 uint32_t partition_count = 0; 1068 bool null_uuid = is_null_uuid(uuid); 1069 struct el3_lp_desc *el3_lp_descs = get_el3_lp_array(); 1070 1071 /* Deal with Logical Partitions. */ 1072 for (index = 0U; index < EL3_LP_DESCS_COUNT; index++) { 1073 if (null_uuid || 1074 uuid_match(uuid, el3_lp_descs[index].uuid)) { 1075 (partition_count)++; 1076 } 1077 } 1078 1079 /* Deal with physical SP's. */ 1080 for (index = 0U; index < SECURE_PARTITION_COUNT; index++) { 1081 if (null_uuid || uuid_match(uuid, sp_desc[index].uuid)) { 1082 (partition_count)++; 1083 } 1084 } 1085 return partition_count; 1086 } 1087 1088 /* 1089 * If the caller of the PARTITION_INFO_GET ABI was a v1.0 caller, populate 1090 * the corresponding descriptor format from the v1.1 descriptor array. 1091 */ 1092 static uint64_t partition_info_populate_v1_0(struct ffa_partition_info_v1_1 1093 *partitions, 1094 struct mailbox *mbox, 1095 int partition_count) 1096 { 1097 uint32_t index; 1098 uint32_t buf_size; 1099 uint32_t descriptor_size; 1100 struct ffa_partition_info_v1_0 *v1_0_partitions = 1101 (struct ffa_partition_info_v1_0 *) mbox->rx_buffer; 1102 1103 buf_size = mbox->rxtx_page_count * FFA_PAGE_SIZE; 1104 descriptor_size = partition_count * 1105 sizeof(struct ffa_partition_info_v1_0); 1106 1107 if (descriptor_size > buf_size) { 1108 return FFA_ERROR_NO_MEMORY; 1109 } 1110 1111 for (index = 0U; index < partition_count; index++) { 1112 v1_0_partitions[index].ep_id = partitions[index].ep_id; 1113 v1_0_partitions[index].execution_ctx_count = 1114 partitions[index].execution_ctx_count; 1115 /* Only report v1.0 properties. */ 1116 v1_0_partitions[index].properties = 1117 (partitions[index].properties & 1118 FFA_PARTITION_INFO_GET_PROPERTIES_V1_0_MASK); 1119 } 1120 return 0; 1121 } 1122 1123 /* 1124 * Main handler for FFA_PARTITION_INFO_GET which supports both FF-A v1.1 and 1125 * v1.0 implementations. 1126 */ 1127 static uint64_t partition_info_get_handler(uint32_t smc_fid, 1128 bool secure_origin, 1129 uint64_t x1, 1130 uint64_t x2, 1131 uint64_t x3, 1132 uint64_t x4, 1133 void *cookie, 1134 void *handle, 1135 uint64_t flags) 1136 { 1137 int ret; 1138 uint32_t partition_count = 0; 1139 uint32_t size = 0; 1140 uint32_t ffa_version = get_partition_ffa_version(secure_origin); 1141 struct mailbox *mbox; 1142 uint64_t info_get_flags; 1143 bool count_only; 1144 uint32_t uuid[4]; 1145 1146 uuid[0] = x1; 1147 uuid[1] = x2; 1148 uuid[2] = x3; 1149 uuid[3] = x4; 1150 1151 /* Determine if the Partition descriptors should be populated. */ 1152 info_get_flags = SMC_GET_GP(handle, CTX_GPREG_X5); 1153 count_only = (info_get_flags & FFA_PARTITION_INFO_GET_COUNT_FLAG_MASK); 1154 1155 /* Handle the case where we don't need to populate the descriptors. */ 1156 if (count_only) { 1157 partition_count = partition_info_get_handler_count_only(uuid); 1158 if (partition_count == 0) { 1159 return spmc_ffa_error_return(handle, 1160 FFA_ERROR_INVALID_PARAMETER); 1161 } 1162 } else { 1163 struct ffa_partition_info_v1_1 partitions[MAX_SP_LP_PARTITIONS]; 1164 1165 /* 1166 * Handle the case where the partition descriptors are required, 1167 * check we have the buffers available and populate the 1168 * appropriate structure version. 1169 */ 1170 1171 /* Obtain the v1.1 format of the descriptors. */ 1172 ret = partition_info_get_handler_v1_1(uuid, partitions, 1173 MAX_SP_LP_PARTITIONS, 1174 &partition_count); 1175 1176 /* Check if an error occurred during discovery. */ 1177 if (ret != 0) { 1178 goto err; 1179 } 1180 1181 /* If we didn't find any matches the UUID is unknown. */ 1182 if (partition_count == 0) { 1183 ret = FFA_ERROR_INVALID_PARAMETER; 1184 goto err; 1185 } 1186 1187 /* Obtain the partition mailbox RX/TX buffer pair descriptor. */ 1188 mbox = spmc_get_mbox_desc(secure_origin); 1189 1190 /* 1191 * If the caller has not bothered registering its RX/TX pair 1192 * then return an error code. 1193 */ 1194 spin_lock(&mbox->lock); 1195 if (mbox->rx_buffer == NULL) { 1196 ret = FFA_ERROR_BUSY; 1197 goto err_unlock; 1198 } 1199 1200 /* Ensure the RX buffer is currently free. */ 1201 if (mbox->state != MAILBOX_STATE_EMPTY) { 1202 ret = FFA_ERROR_BUSY; 1203 goto err_unlock; 1204 } 1205 1206 /* Zero the RX buffer before populating. */ 1207 (void)memset(mbox->rx_buffer, 0, 1208 mbox->rxtx_page_count * FFA_PAGE_SIZE); 1209 1210 /* 1211 * Depending on the FF-A version of the requesting partition 1212 * we may need to convert to a v1.0 format otherwise we can copy 1213 * directly. 1214 */ 1215 if (ffa_version == MAKE_FFA_VERSION(U(1), U(0))) { 1216 ret = partition_info_populate_v1_0(partitions, 1217 mbox, 1218 partition_count); 1219 if (ret != 0) { 1220 goto err_unlock; 1221 } 1222 } else { 1223 uint32_t buf_size = mbox->rxtx_page_count * 1224 FFA_PAGE_SIZE; 1225 1226 /* Ensure the descriptor will fit in the buffer. */ 1227 size = sizeof(struct ffa_partition_info_v1_1); 1228 if (partition_count * size > buf_size) { 1229 ret = FFA_ERROR_NO_MEMORY; 1230 goto err_unlock; 1231 } 1232 memcpy(mbox->rx_buffer, partitions, 1233 partition_count * size); 1234 } 1235 1236 mbox->state = MAILBOX_STATE_FULL; 1237 spin_unlock(&mbox->lock); 1238 } 1239 SMC_RET4(handle, FFA_SUCCESS_SMC32, 0, partition_count, size); 1240 1241 err_unlock: 1242 spin_unlock(&mbox->lock); 1243 err: 1244 return spmc_ffa_error_return(handle, ret); 1245 } 1246 1247 static uint64_t ffa_feature_success(void *handle, uint32_t arg2) 1248 { 1249 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0, arg2); 1250 } 1251 1252 static uint64_t ffa_features_retrieve_request(bool secure_origin, 1253 uint32_t input_properties, 1254 void *handle) 1255 { 1256 /* 1257 * If we're called by the normal world we don't support any 1258 * additional features. 1259 */ 1260 if (!secure_origin) { 1261 if ((input_properties & FFA_FEATURES_RET_REQ_NS_BIT) != 0U) { 1262 return spmc_ffa_error_return(handle, 1263 FFA_ERROR_NOT_SUPPORTED); 1264 } 1265 1266 } else { 1267 struct secure_partition_desc *sp = spmc_get_current_sp_ctx(); 1268 /* 1269 * If v1.1 the NS bit must be set otherwise it is an invalid 1270 * call. If v1.0 check and store whether the SP has requested 1271 * the use of the NS bit. 1272 */ 1273 if (sp->ffa_version == MAKE_FFA_VERSION(1, 1)) { 1274 if ((input_properties & 1275 FFA_FEATURES_RET_REQ_NS_BIT) == 0U) { 1276 return spmc_ffa_error_return(handle, 1277 FFA_ERROR_NOT_SUPPORTED); 1278 } 1279 return ffa_feature_success(handle, 1280 FFA_FEATURES_RET_REQ_NS_BIT); 1281 } else { 1282 sp->ns_bit_requested = (input_properties & 1283 FFA_FEATURES_RET_REQ_NS_BIT) != 1284 0U; 1285 } 1286 if (sp->ns_bit_requested) { 1287 return ffa_feature_success(handle, 1288 FFA_FEATURES_RET_REQ_NS_BIT); 1289 } 1290 } 1291 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1292 } 1293 1294 static uint64_t ffa_features_handler(uint32_t smc_fid, 1295 bool secure_origin, 1296 uint64_t x1, 1297 uint64_t x2, 1298 uint64_t x3, 1299 uint64_t x4, 1300 void *cookie, 1301 void *handle, 1302 uint64_t flags) 1303 { 1304 uint32_t function_id = (uint32_t) x1; 1305 uint32_t input_properties = (uint32_t) x2; 1306 1307 /* Check if a Feature ID was requested. */ 1308 if ((function_id & FFA_FEATURES_BIT31_MASK) == 0U) { 1309 /* We currently don't support any additional features. */ 1310 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1311 } 1312 1313 /* 1314 * Handle the cases where we have separate handlers due to additional 1315 * properties. 1316 */ 1317 switch (function_id) { 1318 case FFA_MEM_RETRIEVE_REQ_SMC32: 1319 case FFA_MEM_RETRIEVE_REQ_SMC64: 1320 return ffa_features_retrieve_request(secure_origin, 1321 input_properties, 1322 handle); 1323 } 1324 1325 /* 1326 * We don't currently support additional input properties for these 1327 * other ABIs therefore ensure this value is set to 0. 1328 */ 1329 if (input_properties != 0U) { 1330 return spmc_ffa_error_return(handle, 1331 FFA_ERROR_NOT_SUPPORTED); 1332 } 1333 1334 /* Report if any other FF-A ABI is supported. */ 1335 switch (function_id) { 1336 /* Supported features from both worlds. */ 1337 case FFA_ERROR: 1338 case FFA_SUCCESS_SMC32: 1339 case FFA_INTERRUPT: 1340 case FFA_SPM_ID_GET: 1341 case FFA_ID_GET: 1342 case FFA_FEATURES: 1343 case FFA_VERSION: 1344 case FFA_RX_RELEASE: 1345 case FFA_MSG_SEND_DIRECT_REQ_SMC32: 1346 case FFA_MSG_SEND_DIRECT_REQ_SMC64: 1347 case FFA_MSG_SEND_DIRECT_REQ2_SMC64: 1348 case FFA_PARTITION_INFO_GET: 1349 case FFA_RXTX_MAP_SMC32: 1350 case FFA_RXTX_MAP_SMC64: 1351 case FFA_RXTX_UNMAP: 1352 case FFA_MEM_FRAG_TX: 1353 case FFA_MSG_RUN: 1354 1355 /* 1356 * We are relying on the fact that the other registers 1357 * will be set to 0 as these values align with the 1358 * currently implemented features of the SPMC. If this 1359 * changes this function must be extended to handle 1360 * reporting the additional functionality. 1361 */ 1362 1363 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1364 /* Execution stops here. */ 1365 1366 /* Supported ABIs only from the secure world. */ 1367 case FFA_SECONDARY_EP_REGISTER_SMC64: 1368 case FFA_MSG_SEND_DIRECT_RESP_SMC32: 1369 case FFA_MSG_SEND_DIRECT_RESP_SMC64: 1370 case FFA_MSG_SEND_DIRECT_RESP2_SMC64: 1371 case FFA_MEM_RELINQUISH: 1372 case FFA_MSG_WAIT: 1373 case FFA_CONSOLE_LOG_SMC32: 1374 case FFA_CONSOLE_LOG_SMC64: 1375 1376 if (!secure_origin) { 1377 return spmc_ffa_error_return(handle, 1378 FFA_ERROR_NOT_SUPPORTED); 1379 } 1380 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1381 /* Execution stops here. */ 1382 1383 /* Supported features only from the normal world. */ 1384 case FFA_MEM_SHARE_SMC32: 1385 case FFA_MEM_SHARE_SMC64: 1386 case FFA_MEM_LEND_SMC32: 1387 case FFA_MEM_LEND_SMC64: 1388 case FFA_MEM_RECLAIM: 1389 case FFA_MEM_FRAG_RX: 1390 1391 if (secure_origin) { 1392 return spmc_ffa_error_return(handle, 1393 FFA_ERROR_NOT_SUPPORTED); 1394 } 1395 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1396 /* Execution stops here. */ 1397 1398 default: 1399 return spmc_ffa_error_return(handle, 1400 FFA_ERROR_NOT_SUPPORTED); 1401 } 1402 } 1403 1404 static uint64_t ffa_id_get_handler(uint32_t smc_fid, 1405 bool secure_origin, 1406 uint64_t x1, 1407 uint64_t x2, 1408 uint64_t x3, 1409 uint64_t x4, 1410 void *cookie, 1411 void *handle, 1412 uint64_t flags) 1413 { 1414 if (secure_origin) { 1415 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0x0, 1416 spmc_get_current_sp_ctx()->sp_id); 1417 } else { 1418 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0x0, 1419 spmc_get_hyp_ctx()->ns_ep_id); 1420 } 1421 } 1422 1423 /* 1424 * Enable an SP to query the ID assigned to the SPMC. 1425 */ 1426 static uint64_t ffa_spm_id_get_handler(uint32_t smc_fid, 1427 bool secure_origin, 1428 uint64_t x1, 1429 uint64_t x2, 1430 uint64_t x3, 1431 uint64_t x4, 1432 void *cookie, 1433 void *handle, 1434 uint64_t flags) 1435 { 1436 assert(x1 == 0UL); 1437 assert(x2 == 0UL); 1438 assert(x3 == 0UL); 1439 assert(x4 == 0UL); 1440 assert(SMC_GET_GP(handle, CTX_GPREG_X5) == 0UL); 1441 assert(SMC_GET_GP(handle, CTX_GPREG_X6) == 0UL); 1442 assert(SMC_GET_GP(handle, CTX_GPREG_X7) == 0UL); 1443 1444 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0x0, FFA_SPMC_ID); 1445 } 1446 1447 static uint64_t ffa_run_handler(uint32_t smc_fid, 1448 bool secure_origin, 1449 uint64_t x1, 1450 uint64_t x2, 1451 uint64_t x3, 1452 uint64_t x4, 1453 void *cookie, 1454 void *handle, 1455 uint64_t flags) 1456 { 1457 struct secure_partition_desc *sp; 1458 uint16_t target_id = FFA_RUN_EP_ID(x1); 1459 uint16_t vcpu_id = FFA_RUN_VCPU_ID(x1); 1460 unsigned int idx; 1461 unsigned int *rt_state; 1462 unsigned int *rt_model; 1463 1464 /* Can only be called from the normal world. */ 1465 if (secure_origin) { 1466 ERROR("FFA_RUN can only be called from NWd.\n"); 1467 return spmc_ffa_error_return(handle, 1468 FFA_ERROR_INVALID_PARAMETER); 1469 } 1470 1471 /* Cannot run a Normal world partition. */ 1472 if (ffa_is_normal_world_id(target_id)) { 1473 ERROR("Cannot run a NWd partition (0x%x).\n", target_id); 1474 return spmc_ffa_error_return(handle, 1475 FFA_ERROR_INVALID_PARAMETER); 1476 } 1477 1478 /* Check that the target SP exists. */ 1479 sp = spmc_get_sp_ctx(target_id); 1480 ERROR("Unknown partition ID (0x%x).\n", target_id); 1481 if (sp == NULL) { 1482 return spmc_ffa_error_return(handle, 1483 FFA_ERROR_INVALID_PARAMETER); 1484 } 1485 1486 idx = get_ec_index(sp); 1487 1488 if (idx != vcpu_id) { 1489 ERROR("Cannot run vcpu %d != %d.\n", idx, vcpu_id); 1490 return spmc_ffa_error_return(handle, 1491 FFA_ERROR_INVALID_PARAMETER); 1492 } 1493 if (sp->runtime_el == S_EL0) { 1494 spin_lock(&sp->rt_state_lock); 1495 } 1496 rt_state = &((sp->ec[idx]).rt_state); 1497 rt_model = &((sp->ec[idx]).rt_model); 1498 if (*rt_state == RT_STATE_RUNNING) { 1499 if (sp->runtime_el == S_EL0) { 1500 spin_unlock(&sp->rt_state_lock); 1501 } 1502 ERROR("Partition (0x%x) is already running.\n", target_id); 1503 return spmc_ffa_error_return(handle, FFA_ERROR_BUSY); 1504 } 1505 1506 /* 1507 * Sanity check that if the execution context was not waiting then it 1508 * was either in the direct request or the run partition runtime model. 1509 */ 1510 if (*rt_state == RT_STATE_PREEMPTED || *rt_state == RT_STATE_BLOCKED) { 1511 assert(*rt_model == RT_MODEL_RUN || 1512 *rt_model == RT_MODEL_DIR_REQ); 1513 } 1514 1515 /* 1516 * If the context was waiting then update the partition runtime model. 1517 */ 1518 if (*rt_state == RT_STATE_WAITING) { 1519 *rt_model = RT_MODEL_RUN; 1520 } 1521 1522 /* 1523 * Forward the request to the correct SP vCPU after updating 1524 * its state. 1525 */ 1526 *rt_state = RT_STATE_RUNNING; 1527 1528 if (sp->runtime_el == S_EL0) { 1529 spin_unlock(&sp->rt_state_lock); 1530 } 1531 1532 return spmc_smc_return(smc_fid, secure_origin, x1, 0, 0, 0, 1533 handle, cookie, flags, target_id); 1534 } 1535 1536 static uint64_t rx_release_handler(uint32_t smc_fid, 1537 bool secure_origin, 1538 uint64_t x1, 1539 uint64_t x2, 1540 uint64_t x3, 1541 uint64_t x4, 1542 void *cookie, 1543 void *handle, 1544 uint64_t flags) 1545 { 1546 struct mailbox *mbox = spmc_get_mbox_desc(secure_origin); 1547 1548 spin_lock(&mbox->lock); 1549 1550 if (mbox->state != MAILBOX_STATE_FULL) { 1551 spin_unlock(&mbox->lock); 1552 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1553 } 1554 1555 mbox->state = MAILBOX_STATE_EMPTY; 1556 spin_unlock(&mbox->lock); 1557 1558 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1559 } 1560 1561 static uint64_t spmc_ffa_console_log(uint32_t smc_fid, 1562 bool secure_origin, 1563 uint64_t x1, 1564 uint64_t x2, 1565 uint64_t x3, 1566 uint64_t x4, 1567 void *cookie, 1568 void *handle, 1569 uint64_t flags) 1570 { 1571 /* Maximum number of characters is 48: 6 registers of 8 bytes each. */ 1572 char chars[48] = {0}; 1573 size_t chars_max; 1574 size_t chars_count = x1; 1575 1576 /* Does not support request from Nwd. */ 1577 if (!secure_origin) { 1578 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1579 } 1580 1581 assert(smc_fid == FFA_CONSOLE_LOG_SMC32 || smc_fid == FFA_CONSOLE_LOG_SMC64); 1582 if (smc_fid == FFA_CONSOLE_LOG_SMC32) { 1583 uint32_t *registers = (uint32_t *)chars; 1584 registers[0] = (uint32_t)x2; 1585 registers[1] = (uint32_t)x3; 1586 registers[2] = (uint32_t)x4; 1587 registers[3] = (uint32_t)SMC_GET_GP(handle, CTX_GPREG_X5); 1588 registers[4] = (uint32_t)SMC_GET_GP(handle, CTX_GPREG_X6); 1589 registers[5] = (uint32_t)SMC_GET_GP(handle, CTX_GPREG_X7); 1590 chars_max = 6 * sizeof(uint32_t); 1591 } else { 1592 uint64_t *registers = (uint64_t *)chars; 1593 registers[0] = x2; 1594 registers[1] = x3; 1595 registers[2] = x4; 1596 registers[3] = SMC_GET_GP(handle, CTX_GPREG_X5); 1597 registers[4] = SMC_GET_GP(handle, CTX_GPREG_X6); 1598 registers[5] = SMC_GET_GP(handle, CTX_GPREG_X7); 1599 chars_max = 6 * sizeof(uint64_t); 1600 } 1601 1602 if ((chars_count == 0) || (chars_count > chars_max)) { 1603 return spmc_ffa_error_return(handle, FFA_ERROR_INVALID_PARAMETER); 1604 } 1605 1606 for (size_t i = 0; (i < chars_count) && (chars[i] != '\0'); i++) { 1607 putchar(chars[i]); 1608 } 1609 1610 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1611 } 1612 1613 /* 1614 * Perform initial validation on the provided secondary entry point. 1615 * For now ensure it does not lie within the BL31 Image or the SP's 1616 * RX/TX buffers as these are mapped within EL3. 1617 * TODO: perform validation for additional invalid memory regions. 1618 */ 1619 static int validate_secondary_ep(uintptr_t ep, struct secure_partition_desc *sp) 1620 { 1621 struct mailbox *mb; 1622 uintptr_t buffer_size; 1623 uintptr_t sp_rx_buffer; 1624 uintptr_t sp_tx_buffer; 1625 uintptr_t sp_rx_buffer_limit; 1626 uintptr_t sp_tx_buffer_limit; 1627 1628 mb = &sp->mailbox; 1629 buffer_size = (uintptr_t) (mb->rxtx_page_count * FFA_PAGE_SIZE); 1630 sp_rx_buffer = (uintptr_t) mb->rx_buffer; 1631 sp_tx_buffer = (uintptr_t) mb->tx_buffer; 1632 sp_rx_buffer_limit = sp_rx_buffer + buffer_size; 1633 sp_tx_buffer_limit = sp_tx_buffer + buffer_size; 1634 1635 /* 1636 * Check if the entry point lies within BL31, or the 1637 * SP's RX or TX buffer. 1638 */ 1639 if ((ep >= BL31_BASE && ep < BL31_LIMIT) || 1640 (ep >= sp_rx_buffer && ep < sp_rx_buffer_limit) || 1641 (ep >= sp_tx_buffer && ep < sp_tx_buffer_limit)) { 1642 return -EINVAL; 1643 } 1644 return 0; 1645 } 1646 1647 /******************************************************************************* 1648 * This function handles the FFA_SECONDARY_EP_REGISTER SMC to allow an SP to 1649 * register an entry point for initialization during a secondary cold boot. 1650 ******************************************************************************/ 1651 static uint64_t ffa_sec_ep_register_handler(uint32_t smc_fid, 1652 bool secure_origin, 1653 uint64_t x1, 1654 uint64_t x2, 1655 uint64_t x3, 1656 uint64_t x4, 1657 void *cookie, 1658 void *handle, 1659 uint64_t flags) 1660 { 1661 struct secure_partition_desc *sp; 1662 struct sp_exec_ctx *sp_ctx; 1663 1664 /* This request cannot originate from the Normal world. */ 1665 if (!secure_origin) { 1666 WARN("%s: Can only be called from SWd.\n", __func__); 1667 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1668 } 1669 1670 /* Get the context of the current SP. */ 1671 sp = spmc_get_current_sp_ctx(); 1672 if (sp == NULL) { 1673 WARN("%s: Cannot find SP context.\n", __func__); 1674 return spmc_ffa_error_return(handle, 1675 FFA_ERROR_INVALID_PARAMETER); 1676 } 1677 1678 /* Only an S-EL1 SP should be invoking this ABI. */ 1679 if (sp->runtime_el != S_EL1) { 1680 WARN("%s: Can only be called for a S-EL1 SP.\n", __func__); 1681 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1682 } 1683 1684 /* Ensure the SP is in its initialization state. */ 1685 sp_ctx = spmc_get_sp_ec(sp); 1686 if (sp_ctx->rt_model != RT_MODEL_INIT) { 1687 WARN("%s: Can only be called during SP initialization.\n", 1688 __func__); 1689 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1690 } 1691 1692 /* Perform initial validation of the secondary entry point. */ 1693 if (validate_secondary_ep(x1, sp)) { 1694 WARN("%s: Invalid entry point provided (0x%lx).\n", 1695 __func__, x1); 1696 return spmc_ffa_error_return(handle, 1697 FFA_ERROR_INVALID_PARAMETER); 1698 } 1699 1700 /* 1701 * Update the secondary entrypoint in SP context. 1702 * We don't need a lock here as during partition initialization there 1703 * will only be a single core online. 1704 */ 1705 sp->secondary_ep = x1; 1706 VERBOSE("%s: 0x%lx\n", __func__, sp->secondary_ep); 1707 1708 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1709 } 1710 1711 /******************************************************************************* 1712 * Permissions are encoded using a different format in the FFA_MEM_PERM_* ABIs 1713 * than in the Trusted Firmware, where the mmap_attr_t enum type is used. This 1714 * function converts a permission value from the FF-A format to the mmap_attr_t 1715 * format by setting MT_RW/MT_RO, MT_USER/MT_PRIVILEGED and 1716 * MT_EXECUTE/MT_EXECUTE_NEVER. The other fields are left as 0 because they are 1717 * ignored by the function xlat_change_mem_attributes_ctx(). 1718 ******************************************************************************/ 1719 static unsigned int ffa_perm_to_mmap_perm(unsigned int perms) 1720 { 1721 unsigned int tf_attr = 0U; 1722 unsigned int access; 1723 1724 /* Deal with data access permissions first. */ 1725 access = (perms & FFA_MEM_PERM_DATA_MASK) >> FFA_MEM_PERM_DATA_SHIFT; 1726 1727 switch (access) { 1728 case FFA_MEM_PERM_DATA_RW: 1729 /* Return 0 if the execute is set with RW. */ 1730 if ((perms & FFA_MEM_PERM_INST_NON_EXEC) != 0) { 1731 tf_attr |= MT_RW | MT_USER | MT_EXECUTE_NEVER; 1732 } 1733 break; 1734 1735 case FFA_MEM_PERM_DATA_RO: 1736 tf_attr |= MT_RO | MT_USER; 1737 /* Deal with the instruction access permissions next. */ 1738 if ((perms & FFA_MEM_PERM_INST_NON_EXEC) == 0) { 1739 tf_attr |= MT_EXECUTE; 1740 } else { 1741 tf_attr |= MT_EXECUTE_NEVER; 1742 } 1743 break; 1744 1745 case FFA_MEM_PERM_DATA_NA: 1746 default: 1747 return tf_attr; 1748 } 1749 1750 return tf_attr; 1751 } 1752 1753 /******************************************************************************* 1754 * Handler to set the permissions of a set of contiguous pages of a S-EL0 SP 1755 ******************************************************************************/ 1756 static uint64_t ffa_mem_perm_set_handler(uint32_t smc_fid, 1757 bool secure_origin, 1758 uint64_t x1, 1759 uint64_t x2, 1760 uint64_t x3, 1761 uint64_t x4, 1762 void *cookie, 1763 void *handle, 1764 uint64_t flags) 1765 { 1766 struct secure_partition_desc *sp; 1767 unsigned int idx; 1768 uintptr_t base_va = (uintptr_t) x1; 1769 size_t size = (size_t)(x2 * PAGE_SIZE); 1770 uint32_t tf_attr; 1771 int ret; 1772 1773 /* This request cannot originate from the Normal world. */ 1774 if (!secure_origin) { 1775 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1776 } 1777 1778 if (size == 0) { 1779 return spmc_ffa_error_return(handle, 1780 FFA_ERROR_INVALID_PARAMETER); 1781 } 1782 1783 /* Get the context of the current SP. */ 1784 sp = spmc_get_current_sp_ctx(); 1785 if (sp == NULL) { 1786 return spmc_ffa_error_return(handle, 1787 FFA_ERROR_INVALID_PARAMETER); 1788 } 1789 1790 /* A S-EL1 SP has no business invoking this ABI. */ 1791 if (sp->runtime_el == S_EL1) { 1792 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1793 } 1794 1795 if ((x3 & ~((uint64_t)FFA_MEM_PERM_MASK)) != 0) { 1796 return spmc_ffa_error_return(handle, 1797 FFA_ERROR_INVALID_PARAMETER); 1798 } 1799 1800 /* Get the execution context of the calling SP. */ 1801 idx = get_ec_index(sp); 1802 1803 /* 1804 * Ensure that the S-EL0 SP is initialising itself. We do not need to 1805 * synchronise this operation through a spinlock since a S-EL0 SP is UP 1806 * and can only be initialising on this cpu. 1807 */ 1808 if (sp->ec[idx].rt_model != RT_MODEL_INIT) { 1809 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1810 } 1811 1812 VERBOSE("Setting memory permissions:\n"); 1813 VERBOSE(" Start address : 0x%lx\n", base_va); 1814 VERBOSE(" Number of pages: %lu (%zu bytes)\n", x2, size); 1815 VERBOSE(" Attributes : 0x%x\n", (uint32_t)x3); 1816 1817 /* Convert inbound permissions to TF-A permission attributes */ 1818 tf_attr = ffa_perm_to_mmap_perm((unsigned int)x3); 1819 if (tf_attr == 0U) { 1820 return spmc_ffa_error_return(handle, 1821 FFA_ERROR_INVALID_PARAMETER); 1822 } 1823 1824 /* Request the change in permissions */ 1825 ret = xlat_change_mem_attributes_ctx(sp->xlat_ctx_handle, 1826 base_va, size, tf_attr); 1827 if (ret != 0) { 1828 return spmc_ffa_error_return(handle, 1829 FFA_ERROR_INVALID_PARAMETER); 1830 } 1831 1832 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1833 } 1834 1835 /******************************************************************************* 1836 * Permissions are encoded using a different format in the FFA_MEM_PERM_* ABIs 1837 * than in the Trusted Firmware, where the mmap_attr_t enum type is used. This 1838 * function converts a permission value from the mmap_attr_t format to the FF-A 1839 * format. 1840 ******************************************************************************/ 1841 static unsigned int mmap_perm_to_ffa_perm(unsigned int attr) 1842 { 1843 unsigned int perms = 0U; 1844 unsigned int data_access; 1845 1846 if ((attr & MT_USER) == 0) { 1847 /* No access from EL0. */ 1848 data_access = FFA_MEM_PERM_DATA_NA; 1849 } else { 1850 if ((attr & MT_RW) != 0) { 1851 data_access = FFA_MEM_PERM_DATA_RW; 1852 } else { 1853 data_access = FFA_MEM_PERM_DATA_RO; 1854 } 1855 } 1856 1857 perms |= (data_access & FFA_MEM_PERM_DATA_MASK) 1858 << FFA_MEM_PERM_DATA_SHIFT; 1859 1860 if ((attr & MT_EXECUTE_NEVER) != 0U) { 1861 perms |= FFA_MEM_PERM_INST_NON_EXEC; 1862 } 1863 1864 return perms; 1865 } 1866 1867 /******************************************************************************* 1868 * Handler to get the permissions of a set of contiguous pages of a S-EL0 SP 1869 ******************************************************************************/ 1870 static uint64_t ffa_mem_perm_get_handler(uint32_t smc_fid, 1871 bool secure_origin, 1872 uint64_t x1, 1873 uint64_t x2, 1874 uint64_t x3, 1875 uint64_t x4, 1876 void *cookie, 1877 void *handle, 1878 uint64_t flags) 1879 { 1880 struct secure_partition_desc *sp; 1881 unsigned int idx; 1882 uintptr_t base_va = (uintptr_t)x1; 1883 uint32_t tf_attr = 0; 1884 int ret; 1885 1886 /* This request cannot originate from the Normal world. */ 1887 if (!secure_origin) { 1888 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1889 } 1890 1891 /* Get the context of the current SP. */ 1892 sp = spmc_get_current_sp_ctx(); 1893 if (sp == NULL) { 1894 return spmc_ffa_error_return(handle, 1895 FFA_ERROR_INVALID_PARAMETER); 1896 } 1897 1898 /* A S-EL1 SP has no business invoking this ABI. */ 1899 if (sp->runtime_el == S_EL1) { 1900 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1901 } 1902 1903 /* Get the execution context of the calling SP. */ 1904 idx = get_ec_index(sp); 1905 1906 /* 1907 * Ensure that the S-EL0 SP is initialising itself. We do not need to 1908 * synchronise this operation through a spinlock since a S-EL0 SP is UP 1909 * and can only be initialising on this cpu. 1910 */ 1911 if (sp->ec[idx].rt_model != RT_MODEL_INIT) { 1912 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1913 } 1914 1915 /* Request the permissions */ 1916 ret = xlat_get_mem_attributes_ctx(sp->xlat_ctx_handle, base_va, &tf_attr); 1917 if (ret != 0) { 1918 return spmc_ffa_error_return(handle, 1919 FFA_ERROR_INVALID_PARAMETER); 1920 } 1921 1922 /* Convert TF-A permission to FF-A permissions attributes. */ 1923 x2 = mmap_perm_to_ffa_perm(tf_attr); 1924 1925 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0, x2); 1926 } 1927 1928 /******************************************************************************* 1929 * This function will parse the Secure Partition Manifest. From manifest, it 1930 * will fetch details for preparing Secure partition image context and secure 1931 * partition image boot arguments if any. 1932 ******************************************************************************/ 1933 static int sp_manifest_parse(void *sp_manifest, int offset, 1934 struct secure_partition_desc *sp, 1935 entry_point_info_t *ep_info, 1936 int32_t *boot_info_reg) 1937 { 1938 int32_t ret, node; 1939 uint32_t config_32; 1940 1941 /* 1942 * Look for the mandatory fields that are expected to be present in 1943 * the SP manifests. 1944 */ 1945 node = fdt_path_offset(sp_manifest, "/"); 1946 if (node < 0) { 1947 ERROR("Did not find root node.\n"); 1948 return node; 1949 } 1950 1951 ret = fdt_read_uint32_array(sp_manifest, node, "uuid", 1952 ARRAY_SIZE(sp->uuid), sp->uuid); 1953 if (ret != 0) { 1954 ERROR("Missing Secure Partition UUID.\n"); 1955 return ret; 1956 } 1957 1958 ret = fdt_read_uint32(sp_manifest, node, "exception-level", &config_32); 1959 if (ret != 0) { 1960 ERROR("Missing SP Exception Level information.\n"); 1961 return ret; 1962 } 1963 1964 sp->runtime_el = config_32; 1965 1966 ret = fdt_read_uint32(sp_manifest, node, "ffa-version", &config_32); 1967 if (ret != 0) { 1968 ERROR("Missing Secure Partition FF-A Version.\n"); 1969 return ret; 1970 } 1971 1972 sp->ffa_version = config_32; 1973 1974 ret = fdt_read_uint32(sp_manifest, node, "execution-state", &config_32); 1975 if (ret != 0) { 1976 ERROR("Missing Secure Partition Execution State.\n"); 1977 return ret; 1978 } 1979 1980 sp->execution_state = config_32; 1981 1982 ret = fdt_read_uint32(sp_manifest, node, 1983 "messaging-method", &config_32); 1984 if (ret != 0) { 1985 ERROR("Missing Secure Partition messaging method.\n"); 1986 return ret; 1987 } 1988 1989 /* Validate this entry, we currently only support direct messaging. */ 1990 if ((config_32 & ~(FFA_PARTITION_DIRECT_REQ_RECV | 1991 FFA_PARTITION_DIRECT_REQ_SEND | 1992 FFA_PARTITION_DIRECT_REQ2_RECV | 1993 FFA_PARTITION_DIRECT_REQ2_SEND)) != 0U) { 1994 WARN("Invalid Secure Partition messaging method (0x%x)\n", 1995 config_32); 1996 return -EINVAL; 1997 } 1998 1999 sp->properties = config_32; 2000 2001 ret = fdt_read_uint32(sp_manifest, node, 2002 "execution-ctx-count", &config_32); 2003 2004 if (ret != 0) { 2005 ERROR("Missing SP Execution Context Count.\n"); 2006 return ret; 2007 } 2008 2009 /* 2010 * Ensure this field is set correctly in the manifest however 2011 * since this is currently a hardcoded value for S-EL1 partitions 2012 * we don't need to save it here, just validate. 2013 */ 2014 if ((sp->runtime_el == S_EL1) && (config_32 != PLATFORM_CORE_COUNT)) { 2015 ERROR("SP Execution Context Count (%u) must be %u.\n", 2016 config_32, PLATFORM_CORE_COUNT); 2017 return -EINVAL; 2018 } 2019 2020 /* 2021 * Look for the optional fields that are expected to be present in 2022 * an SP manifest. 2023 */ 2024 ret = fdt_read_uint32(sp_manifest, node, "id", &config_32); 2025 if (ret != 0) { 2026 WARN("Missing Secure Partition ID.\n"); 2027 } else { 2028 if (!is_ffa_secure_id_valid(config_32)) { 2029 ERROR("Invalid Secure Partition ID (0x%x).\n", 2030 config_32); 2031 return -EINVAL; 2032 } 2033 sp->sp_id = config_32; 2034 } 2035 2036 ret = fdt_read_uint32(sp_manifest, node, 2037 "power-management-messages", &config_32); 2038 if (ret != 0) { 2039 WARN("Missing Power Management Messages entry.\n"); 2040 } else { 2041 if ((sp->runtime_el == S_EL0) && (config_32 != 0)) { 2042 ERROR("Power messages not supported for S-EL0 SP\n"); 2043 return -EINVAL; 2044 } 2045 2046 /* 2047 * Ensure only the currently supported power messages have 2048 * been requested. 2049 */ 2050 if (config_32 & ~(FFA_PM_MSG_SUB_CPU_OFF | 2051 FFA_PM_MSG_SUB_CPU_SUSPEND | 2052 FFA_PM_MSG_SUB_CPU_SUSPEND_RESUME)) { 2053 ERROR("Requested unsupported PM messages (%x)\n", 2054 config_32); 2055 return -EINVAL; 2056 } 2057 sp->pwr_mgmt_msgs = config_32; 2058 } 2059 2060 ret = fdt_read_uint32(sp_manifest, node, 2061 "gp-register-num", &config_32); 2062 if (ret != 0) { 2063 WARN("Missing boot information register.\n"); 2064 } else { 2065 /* Check if a register number between 0-3 is specified. */ 2066 if (config_32 < 4) { 2067 *boot_info_reg = config_32; 2068 } else { 2069 WARN("Incorrect boot information register (%u).\n", 2070 config_32); 2071 } 2072 } 2073 2074 return 0; 2075 } 2076 2077 /******************************************************************************* 2078 * This function gets the Secure Partition Manifest base and maps the manifest 2079 * region. 2080 * Currently only one Secure Partition manifest is considered which is used to 2081 * prepare the context for the single Secure Partition. 2082 ******************************************************************************/ 2083 static int find_and_prepare_sp_context(void) 2084 { 2085 void *sp_manifest; 2086 uintptr_t manifest_base; 2087 uintptr_t manifest_base_align; 2088 entry_point_info_t *next_image_ep_info; 2089 int32_t ret, boot_info_reg = -1; 2090 struct secure_partition_desc *sp; 2091 2092 next_image_ep_info = bl31_plat_get_next_image_ep_info(SECURE); 2093 if (next_image_ep_info == NULL) { 2094 WARN("No Secure Partition image provided by BL2.\n"); 2095 return -ENOENT; 2096 } 2097 2098 sp_manifest = (void *)next_image_ep_info->args.arg0; 2099 if (sp_manifest == NULL) { 2100 WARN("Secure Partition manifest absent.\n"); 2101 return -ENOENT; 2102 } 2103 2104 manifest_base = (uintptr_t)sp_manifest; 2105 manifest_base_align = page_align(manifest_base, DOWN); 2106 2107 /* 2108 * Map the secure partition manifest region in the EL3 translation 2109 * regime. 2110 * Map an area equal to (2 * PAGE_SIZE) for now. During manifest base 2111 * alignment the region of 1 PAGE_SIZE from manifest align base may 2112 * not completely accommodate the secure partition manifest region. 2113 */ 2114 ret = mmap_add_dynamic_region((unsigned long long)manifest_base_align, 2115 manifest_base_align, 2116 PAGE_SIZE * 2, 2117 MT_RO_DATA); 2118 if (ret != 0) { 2119 ERROR("Error while mapping SP manifest (%d).\n", ret); 2120 return ret; 2121 } 2122 2123 ret = fdt_node_offset_by_compatible(sp_manifest, -1, 2124 "arm,ffa-manifest-1.0"); 2125 if (ret < 0) { 2126 ERROR("Error happened in SP manifest reading.\n"); 2127 return -EINVAL; 2128 } 2129 2130 /* 2131 * Store the size of the manifest so that it can be used later to pass 2132 * the manifest as boot information later. 2133 */ 2134 next_image_ep_info->args.arg1 = fdt_totalsize(sp_manifest); 2135 INFO("Manifest adr = %lx , size = %lu bytes\n", manifest_base, 2136 next_image_ep_info->args.arg1); 2137 2138 /* 2139 * Select an SP descriptor for initialising the partition's execution 2140 * context on the primary CPU. 2141 */ 2142 sp = spmc_get_current_sp_ctx(); 2143 2144 #if SPMC_AT_EL3_SEL0_SP 2145 /* Assign translation tables context. */ 2146 sp_desc->xlat_ctx_handle = spm_get_sp_xlat_context(); 2147 2148 #endif /* SPMC_AT_EL3_SEL0_SP */ 2149 /* Initialize entry point information for the SP */ 2150 SET_PARAM_HEAD(next_image_ep_info, PARAM_EP, VERSION_1, 2151 SECURE | EP_ST_ENABLE); 2152 2153 /* Parse the SP manifest. */ 2154 ret = sp_manifest_parse(sp_manifest, ret, sp, next_image_ep_info, 2155 &boot_info_reg); 2156 if (ret != 0) { 2157 ERROR("Error in Secure Partition manifest parsing.\n"); 2158 return ret; 2159 } 2160 2161 /* Perform any common initialisation. */ 2162 spmc_sp_common_setup(sp, next_image_ep_info, boot_info_reg); 2163 2164 /* Perform any initialisation specific to S-EL1 SPs. */ 2165 if (sp->runtime_el == S_EL1) { 2166 spmc_el1_sp_setup(sp, next_image_ep_info); 2167 spmc_sp_common_ep_commit(sp, next_image_ep_info); 2168 } 2169 #if SPMC_AT_EL3_SEL0_SP 2170 /* Perform any initialisation specific to S-EL0 SPs. */ 2171 else if (sp->runtime_el == S_EL0) { 2172 /* Setup spsr in endpoint info for common context management routine. */ 2173 spmc_el0_sp_spsr_setup(next_image_ep_info); 2174 2175 spmc_sp_common_ep_commit(sp, next_image_ep_info); 2176 2177 /* 2178 * Perform any initialisation specific to S-EL0 not set by common 2179 * context management routine. 2180 */ 2181 spmc_el0_sp_setup(sp, boot_info_reg, sp_manifest); 2182 } 2183 #endif /* SPMC_AT_EL3_SEL0_SP */ 2184 else { 2185 ERROR("Unexpected runtime EL: %u\n", sp->runtime_el); 2186 return -EINVAL; 2187 } 2188 2189 return 0; 2190 } 2191 2192 /******************************************************************************* 2193 * This function takes an SP context pointer and performs a synchronous entry 2194 * into it. 2195 ******************************************************************************/ 2196 static int32_t logical_sp_init(void) 2197 { 2198 int32_t rc = 0; 2199 struct el3_lp_desc *el3_lp_descs; 2200 2201 /* Perform initial validation of the Logical Partitions. */ 2202 rc = el3_sp_desc_validate(); 2203 if (rc != 0) { 2204 ERROR("Logical Partition validation failed!\n"); 2205 return rc; 2206 } 2207 2208 el3_lp_descs = get_el3_lp_array(); 2209 2210 INFO("Logical Secure Partition init start.\n"); 2211 for (unsigned int i = 0U; i < EL3_LP_DESCS_COUNT; i++) { 2212 rc = el3_lp_descs[i].init(); 2213 if (rc != 0) { 2214 ERROR("Logical SP (0x%x) Failed to Initialize\n", 2215 el3_lp_descs[i].sp_id); 2216 return rc; 2217 } 2218 VERBOSE("Logical SP (0x%x) Initialized\n", 2219 el3_lp_descs[i].sp_id); 2220 } 2221 2222 INFO("Logical Secure Partition init completed.\n"); 2223 2224 return rc; 2225 } 2226 2227 uint64_t spmc_sp_synchronous_entry(struct sp_exec_ctx *ec) 2228 { 2229 uint64_t rc; 2230 2231 assert(ec != NULL); 2232 2233 /* Assign the context of the SP to this CPU */ 2234 cm_set_context(&(ec->cpu_ctx), SECURE); 2235 2236 /* Restore the context assigned above */ 2237 cm_el1_sysregs_context_restore(SECURE); 2238 cm_set_next_eret_context(SECURE); 2239 2240 /* Invalidate TLBs at EL1. */ 2241 tlbivmalle1(); 2242 dsbish(); 2243 2244 /* Enter Secure Partition */ 2245 rc = spm_secure_partition_enter(&ec->c_rt_ctx); 2246 2247 /* Save secure state */ 2248 cm_el1_sysregs_context_save(SECURE); 2249 2250 return rc; 2251 } 2252 2253 /******************************************************************************* 2254 * SPMC Helper Functions. 2255 ******************************************************************************/ 2256 static int32_t sp_init(void) 2257 { 2258 uint64_t rc; 2259 struct secure_partition_desc *sp; 2260 struct sp_exec_ctx *ec; 2261 2262 sp = spmc_get_current_sp_ctx(); 2263 ec = spmc_get_sp_ec(sp); 2264 ec->rt_model = RT_MODEL_INIT; 2265 ec->rt_state = RT_STATE_RUNNING; 2266 2267 INFO("Secure Partition (0x%x) init start.\n", sp->sp_id); 2268 2269 rc = spmc_sp_synchronous_entry(ec); 2270 if (rc != 0) { 2271 /* Indicate SP init was not successful. */ 2272 ERROR("SP (0x%x) failed to initialize (%lu).\n", 2273 sp->sp_id, rc); 2274 return 0; 2275 } 2276 2277 ec->rt_state = RT_STATE_WAITING; 2278 INFO("Secure Partition initialized.\n"); 2279 2280 return 1; 2281 } 2282 2283 static void initalize_sp_descs(void) 2284 { 2285 struct secure_partition_desc *sp; 2286 2287 for (unsigned int i = 0U; i < SECURE_PARTITION_COUNT; i++) { 2288 sp = &sp_desc[i]; 2289 sp->sp_id = INV_SP_ID; 2290 sp->mailbox.rx_buffer = NULL; 2291 sp->mailbox.tx_buffer = NULL; 2292 sp->mailbox.state = MAILBOX_STATE_EMPTY; 2293 sp->secondary_ep = 0; 2294 } 2295 } 2296 2297 static void initalize_ns_ep_descs(void) 2298 { 2299 struct ns_endpoint_desc *ns_ep; 2300 2301 for (unsigned int i = 0U; i < NS_PARTITION_COUNT; i++) { 2302 ns_ep = &ns_ep_desc[i]; 2303 /* 2304 * Clashes with the Hypervisor ID but will not be a 2305 * problem in practice. 2306 */ 2307 ns_ep->ns_ep_id = 0; 2308 ns_ep->ffa_version = 0; 2309 ns_ep->mailbox.rx_buffer = NULL; 2310 ns_ep->mailbox.tx_buffer = NULL; 2311 ns_ep->mailbox.state = MAILBOX_STATE_EMPTY; 2312 } 2313 } 2314 2315 /******************************************************************************* 2316 * Initialize SPMC attributes for the SPMD. 2317 ******************************************************************************/ 2318 void spmc_populate_attrs(spmc_manifest_attribute_t *spmc_attrs) 2319 { 2320 spmc_attrs->major_version = FFA_VERSION_MAJOR; 2321 spmc_attrs->minor_version = FFA_VERSION_MINOR; 2322 spmc_attrs->exec_state = MODE_RW_64; 2323 spmc_attrs->spmc_id = FFA_SPMC_ID; 2324 } 2325 2326 /******************************************************************************* 2327 * Initialize contexts of all Secure Partitions. 2328 ******************************************************************************/ 2329 int32_t spmc_setup(void) 2330 { 2331 int32_t ret; 2332 uint32_t flags; 2333 2334 /* Initialize endpoint descriptors */ 2335 initalize_sp_descs(); 2336 initalize_ns_ep_descs(); 2337 2338 /* 2339 * Retrieve the information of the datastore for tracking shared memory 2340 * requests allocated by platform code and zero the region if available. 2341 */ 2342 ret = plat_spmc_shmem_datastore_get(&spmc_shmem_obj_state.data, 2343 &spmc_shmem_obj_state.data_size); 2344 if (ret != 0) { 2345 ERROR("Failed to obtain memory descriptor backing store!\n"); 2346 return ret; 2347 } 2348 memset(spmc_shmem_obj_state.data, 0, spmc_shmem_obj_state.data_size); 2349 2350 /* Setup logical SPs. */ 2351 ret = logical_sp_init(); 2352 if (ret != 0) { 2353 ERROR("Failed to initialize Logical Partitions.\n"); 2354 return ret; 2355 } 2356 2357 /* Perform physical SP setup. */ 2358 2359 /* Disable MMU at EL1 (initialized by BL2) */ 2360 disable_mmu_icache_el1(); 2361 2362 /* Initialize context of the SP */ 2363 INFO("Secure Partition context setup start.\n"); 2364 2365 ret = find_and_prepare_sp_context(); 2366 if (ret != 0) { 2367 ERROR("Error in SP finding and context preparation.\n"); 2368 return ret; 2369 } 2370 2371 /* Register power management hooks with PSCI */ 2372 psci_register_spd_pm_hook(&spmc_pm); 2373 2374 /* 2375 * Register an interrupt handler for S-EL1 interrupts 2376 * when generated during code executing in the 2377 * non-secure state. 2378 */ 2379 flags = 0; 2380 set_interrupt_rm_flag(flags, NON_SECURE); 2381 ret = register_interrupt_type_handler(INTR_TYPE_S_EL1, 2382 spmc_sp_interrupt_handler, 2383 flags); 2384 if (ret != 0) { 2385 ERROR("Failed to register interrupt handler! (%d)\n", ret); 2386 panic(); 2387 } 2388 2389 /* Register init function for deferred init. */ 2390 bl31_register_bl32_init(&sp_init); 2391 2392 INFO("Secure Partition setup done.\n"); 2393 2394 return 0; 2395 } 2396 2397 /******************************************************************************* 2398 * Secure Partition Manager SMC handler. 2399 ******************************************************************************/ 2400 uint64_t spmc_smc_handler(uint32_t smc_fid, 2401 bool secure_origin, 2402 uint64_t x1, 2403 uint64_t x2, 2404 uint64_t x3, 2405 uint64_t x4, 2406 void *cookie, 2407 void *handle, 2408 uint64_t flags) 2409 { 2410 switch (smc_fid) { 2411 2412 case FFA_VERSION: 2413 return ffa_version_handler(smc_fid, secure_origin, x1, x2, x3, 2414 x4, cookie, handle, flags); 2415 2416 case FFA_SPM_ID_GET: 2417 return ffa_spm_id_get_handler(smc_fid, secure_origin, x1, x2, 2418 x3, x4, cookie, handle, flags); 2419 2420 case FFA_ID_GET: 2421 return ffa_id_get_handler(smc_fid, secure_origin, x1, x2, x3, 2422 x4, cookie, handle, flags); 2423 2424 case FFA_FEATURES: 2425 return ffa_features_handler(smc_fid, secure_origin, x1, x2, x3, 2426 x4, cookie, handle, flags); 2427 2428 case FFA_SECONDARY_EP_REGISTER_SMC64: 2429 return ffa_sec_ep_register_handler(smc_fid, secure_origin, x1, 2430 x2, x3, x4, cookie, handle, 2431 flags); 2432 2433 case FFA_MSG_SEND_DIRECT_REQ_SMC32: 2434 case FFA_MSG_SEND_DIRECT_REQ_SMC64: 2435 case FFA_MSG_SEND_DIRECT_REQ2_SMC64: 2436 return direct_req_smc_handler(smc_fid, secure_origin, x1, x2, 2437 x3, x4, cookie, handle, flags); 2438 2439 case FFA_MSG_SEND_DIRECT_RESP_SMC32: 2440 case FFA_MSG_SEND_DIRECT_RESP_SMC64: 2441 case FFA_MSG_SEND_DIRECT_RESP2_SMC64: 2442 return direct_resp_smc_handler(smc_fid, secure_origin, x1, x2, 2443 x3, x4, cookie, handle, flags); 2444 2445 case FFA_RXTX_MAP_SMC32: 2446 case FFA_RXTX_MAP_SMC64: 2447 return rxtx_map_handler(smc_fid, secure_origin, x1, x2, x3, x4, 2448 cookie, handle, flags); 2449 2450 case FFA_RXTX_UNMAP: 2451 return rxtx_unmap_handler(smc_fid, secure_origin, x1, x2, x3, 2452 x4, cookie, handle, flags); 2453 2454 case FFA_PARTITION_INFO_GET: 2455 return partition_info_get_handler(smc_fid, secure_origin, x1, 2456 x2, x3, x4, cookie, handle, 2457 flags); 2458 2459 case FFA_RX_RELEASE: 2460 return rx_release_handler(smc_fid, secure_origin, x1, x2, x3, 2461 x4, cookie, handle, flags); 2462 2463 case FFA_MSG_WAIT: 2464 return msg_wait_handler(smc_fid, secure_origin, x1, x2, x3, x4, 2465 cookie, handle, flags); 2466 2467 case FFA_ERROR: 2468 return ffa_error_handler(smc_fid, secure_origin, x1, x2, x3, x4, 2469 cookie, handle, flags); 2470 2471 case FFA_MSG_RUN: 2472 return ffa_run_handler(smc_fid, secure_origin, x1, x2, x3, x4, 2473 cookie, handle, flags); 2474 2475 case FFA_MEM_SHARE_SMC32: 2476 case FFA_MEM_SHARE_SMC64: 2477 case FFA_MEM_LEND_SMC32: 2478 case FFA_MEM_LEND_SMC64: 2479 return spmc_ffa_mem_send(smc_fid, secure_origin, x1, x2, x3, x4, 2480 cookie, handle, flags); 2481 2482 case FFA_MEM_FRAG_TX: 2483 return spmc_ffa_mem_frag_tx(smc_fid, secure_origin, x1, x2, x3, 2484 x4, cookie, handle, flags); 2485 2486 case FFA_MEM_FRAG_RX: 2487 return spmc_ffa_mem_frag_rx(smc_fid, secure_origin, x1, x2, x3, 2488 x4, cookie, handle, flags); 2489 2490 case FFA_MEM_RETRIEVE_REQ_SMC32: 2491 case FFA_MEM_RETRIEVE_REQ_SMC64: 2492 return spmc_ffa_mem_retrieve_req(smc_fid, secure_origin, x1, x2, 2493 x3, x4, cookie, handle, flags); 2494 2495 case FFA_MEM_RELINQUISH: 2496 return spmc_ffa_mem_relinquish(smc_fid, secure_origin, x1, x2, 2497 x3, x4, cookie, handle, flags); 2498 2499 case FFA_MEM_RECLAIM: 2500 return spmc_ffa_mem_reclaim(smc_fid, secure_origin, x1, x2, x3, 2501 x4, cookie, handle, flags); 2502 case FFA_CONSOLE_LOG_SMC32: 2503 case FFA_CONSOLE_LOG_SMC64: 2504 return spmc_ffa_console_log(smc_fid, secure_origin, x1, x2, x3, 2505 x4, cookie, handle, flags); 2506 2507 case FFA_MEM_PERM_GET_SMC32: 2508 case FFA_MEM_PERM_GET_SMC64: 2509 return ffa_mem_perm_get_handler(smc_fid, secure_origin, x1, x2, 2510 x3, x4, cookie, handle, flags); 2511 2512 case FFA_MEM_PERM_SET_SMC32: 2513 case FFA_MEM_PERM_SET_SMC64: 2514 return ffa_mem_perm_set_handler(smc_fid, secure_origin, x1, x2, 2515 x3, x4, cookie, handle, flags); 2516 2517 default: 2518 WARN("Unsupported FF-A call 0x%08x.\n", smc_fid); 2519 break; 2520 } 2521 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 2522 } 2523 2524 /******************************************************************************* 2525 * This function is the handler registered for S-EL1 interrupts by the SPMC. It 2526 * validates the interrupt and upon success arranges entry into the SP for 2527 * handling the interrupt. 2528 ******************************************************************************/ 2529 static uint64_t spmc_sp_interrupt_handler(uint32_t id, 2530 uint32_t flags, 2531 void *handle, 2532 void *cookie) 2533 { 2534 struct secure_partition_desc *sp = spmc_get_current_sp_ctx(); 2535 struct sp_exec_ctx *ec; 2536 uint32_t linear_id = plat_my_core_pos(); 2537 2538 /* Sanity check for a NULL pointer dereference. */ 2539 assert(sp != NULL); 2540 2541 /* Check the security state when the exception was generated. */ 2542 assert(get_interrupt_src_ss(flags) == NON_SECURE); 2543 2544 /* Panic if not an S-EL1 Partition. */ 2545 if (sp->runtime_el != S_EL1) { 2546 ERROR("Interrupt received for a non S-EL1 SP on core%u.\n", 2547 linear_id); 2548 panic(); 2549 } 2550 2551 /* Obtain a reference to the SP execution context. */ 2552 ec = spmc_get_sp_ec(sp); 2553 2554 /* Ensure that the execution context is in waiting state else panic. */ 2555 if (ec->rt_state != RT_STATE_WAITING) { 2556 ERROR("SP EC on core%u is not waiting (%u), it is (%u).\n", 2557 linear_id, RT_STATE_WAITING, ec->rt_state); 2558 panic(); 2559 } 2560 2561 /* Update the runtime model and state of the partition. */ 2562 ec->rt_model = RT_MODEL_INTR; 2563 ec->rt_state = RT_STATE_RUNNING; 2564 2565 VERBOSE("SP (0x%x) interrupt start on core%u.\n", sp->sp_id, linear_id); 2566 2567 /* 2568 * Forward the interrupt to the S-EL1 SP. The interrupt ID is not 2569 * populated as the SP can determine this by itself. 2570 * The flags field is forced to 0 mainly to pass the SVE hint bit 2571 * cleared for consumption by the lower EL. 2572 */ 2573 return spmd_smc_switch_state(FFA_INTERRUPT, false, 2574 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 2575 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 2576 handle, 0ULL); 2577 } 2578