1 /* 2 * Copyright (c) 2022-2024, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <stdio.h> 10 11 #include <arch_helpers.h> 12 #include <bl31/bl31.h> 13 #include <bl31/ehf.h> 14 #include <bl31/interrupt_mgmt.h> 15 #include <common/debug.h> 16 #include <common/fdt_wrappers.h> 17 #include <common/runtime_svc.h> 18 #include <common/uuid.h> 19 #include <lib/el3_runtime/context_mgmt.h> 20 #include <lib/smccc.h> 21 #include <lib/utils.h> 22 #include <lib/xlat_tables/xlat_tables_v2.h> 23 #include <libfdt.h> 24 #include <plat/common/platform.h> 25 #include <services/el3_spmc_logical_sp.h> 26 #include <services/ffa_svc.h> 27 #include <services/spmc_svc.h> 28 #include <services/spmd_svc.h> 29 #include "spmc.h" 30 #include "spmc_shared_mem.h" 31 32 #include <platform_def.h> 33 34 /* FFA_MEM_PERM_* helpers */ 35 #define FFA_MEM_PERM_MASK U(7) 36 #define FFA_MEM_PERM_DATA_MASK U(3) 37 #define FFA_MEM_PERM_DATA_SHIFT U(0) 38 #define FFA_MEM_PERM_DATA_NA U(0) 39 #define FFA_MEM_PERM_DATA_RW U(1) 40 #define FFA_MEM_PERM_DATA_RES U(2) 41 #define FFA_MEM_PERM_DATA_RO U(3) 42 #define FFA_MEM_PERM_INST_EXEC (U(0) << 2) 43 #define FFA_MEM_PERM_INST_NON_EXEC (U(1) << 2) 44 45 /* Declare the maximum number of SPs and El3 LPs. */ 46 #define MAX_SP_LP_PARTITIONS SECURE_PARTITION_COUNT + MAX_EL3_LP_DESCS_COUNT 47 48 /* 49 * Allocate a secure partition descriptor to describe each SP in the system that 50 * does not reside at EL3. 51 */ 52 static struct secure_partition_desc sp_desc[SECURE_PARTITION_COUNT]; 53 54 /* 55 * Allocate an NS endpoint descriptor to describe each VM and the Hypervisor in 56 * the system that interacts with a SP. It is used to track the Hypervisor 57 * buffer pair, version and ID for now. It could be extended to track VM 58 * properties when the SPMC supports indirect messaging. 59 */ 60 static struct ns_endpoint_desc ns_ep_desc[NS_PARTITION_COUNT]; 61 62 static uint64_t spmc_sp_interrupt_handler(uint32_t id, 63 uint32_t flags, 64 void *handle, 65 void *cookie); 66 67 /* 68 * Helper function to obtain the array storing the EL3 69 * Logical Partition descriptors. 70 */ 71 struct el3_lp_desc *get_el3_lp_array(void) 72 { 73 return (struct el3_lp_desc *) EL3_LP_DESCS_START; 74 } 75 76 /* 77 * Helper function to obtain the descriptor of the last SP to whom control was 78 * handed to on this physical cpu. Currently, we assume there is only one SP. 79 * TODO: Expand to track multiple partitions when required. 80 */ 81 struct secure_partition_desc *spmc_get_current_sp_ctx(void) 82 { 83 return &(sp_desc[ACTIVE_SP_DESC_INDEX]); 84 } 85 86 /* 87 * Helper function to obtain the execution context of an SP on the 88 * current physical cpu. 89 */ 90 struct sp_exec_ctx *spmc_get_sp_ec(struct secure_partition_desc *sp) 91 { 92 return &(sp->ec[get_ec_index(sp)]); 93 } 94 95 /* Helper function to get pointer to SP context from its ID. */ 96 struct secure_partition_desc *spmc_get_sp_ctx(uint16_t id) 97 { 98 /* Check for Secure World Partitions. */ 99 for (unsigned int i = 0U; i < SECURE_PARTITION_COUNT; i++) { 100 if (sp_desc[i].sp_id == id) { 101 return &(sp_desc[i]); 102 } 103 } 104 return NULL; 105 } 106 107 /* 108 * Helper function to obtain the descriptor of the Hypervisor or OS kernel. 109 * We assume that the first descriptor is reserved for this entity. 110 */ 111 struct ns_endpoint_desc *spmc_get_hyp_ctx(void) 112 { 113 return &(ns_ep_desc[0]); 114 } 115 116 /* 117 * Helper function to obtain the RX/TX buffer pair descriptor of the Hypervisor 118 * or OS kernel in the normal world or the last SP that was run. 119 */ 120 struct mailbox *spmc_get_mbox_desc(bool secure_origin) 121 { 122 /* Obtain the RX/TX buffer pair descriptor. */ 123 if (secure_origin) { 124 return &(spmc_get_current_sp_ctx()->mailbox); 125 } else { 126 return &(spmc_get_hyp_ctx()->mailbox); 127 } 128 } 129 130 /****************************************************************************** 131 * This function returns to the place where spmc_sp_synchronous_entry() was 132 * called originally. 133 ******************************************************************************/ 134 __dead2 void spmc_sp_synchronous_exit(struct sp_exec_ctx *ec, uint64_t rc) 135 { 136 /* 137 * The SPM must have initiated the original request through a 138 * synchronous entry into the secure partition. Jump back to the 139 * original C runtime context with the value of rc in x0; 140 */ 141 spm_secure_partition_exit(ec->c_rt_ctx, rc); 142 143 panic(); 144 } 145 146 /******************************************************************************* 147 * Return FFA_ERROR with specified error code. 148 ******************************************************************************/ 149 uint64_t spmc_ffa_error_return(void *handle, int error_code) 150 { 151 SMC_RET8(handle, FFA_ERROR, 152 FFA_TARGET_INFO_MBZ, error_code, 153 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 154 FFA_PARAM_MBZ, FFA_PARAM_MBZ); 155 } 156 157 /****************************************************************************** 158 * Helper function to validate a secure partition ID to ensure it does not 159 * conflict with any other FF-A component and follows the convention to 160 * indicate it resides within the secure world. 161 ******************************************************************************/ 162 bool is_ffa_secure_id_valid(uint16_t partition_id) 163 { 164 struct el3_lp_desc *el3_lp_descs = get_el3_lp_array(); 165 166 /* Ensure the ID is not the invalid partition ID. */ 167 if (partition_id == INV_SP_ID) { 168 return false; 169 } 170 171 /* Ensure the ID is not the SPMD ID. */ 172 if (partition_id == SPMD_DIRECT_MSG_ENDPOINT_ID) { 173 return false; 174 } 175 176 /* 177 * Ensure the ID follows the convention to indicate it resides 178 * in the secure world. 179 */ 180 if (!ffa_is_secure_world_id(partition_id)) { 181 return false; 182 } 183 184 /* Ensure we don't conflict with the SPMC partition ID. */ 185 if (partition_id == FFA_SPMC_ID) { 186 return false; 187 } 188 189 /* Ensure we do not already have an SP context with this ID. */ 190 if (spmc_get_sp_ctx(partition_id)) { 191 return false; 192 } 193 194 /* Ensure we don't clash with any Logical SP's. */ 195 for (unsigned int i = 0U; i < EL3_LP_DESCS_COUNT; i++) { 196 if (el3_lp_descs[i].sp_id == partition_id) { 197 return false; 198 } 199 } 200 201 return true; 202 } 203 204 /******************************************************************************* 205 * This function either forwards the request to the other world or returns 206 * with an ERET depending on the source of the call. 207 * We can assume that the destination is for an entity at a lower exception 208 * level as any messages destined for a logical SP resident in EL3 will have 209 * already been taken care of by the SPMC before entering this function. 210 ******************************************************************************/ 211 static uint64_t spmc_smc_return(uint32_t smc_fid, 212 bool secure_origin, 213 uint64_t x1, 214 uint64_t x2, 215 uint64_t x3, 216 uint64_t x4, 217 void *handle, 218 void *cookie, 219 uint64_t flags, 220 uint16_t dst_id) 221 { 222 /* If the destination is in the normal world always go via the SPMD. */ 223 if (ffa_is_normal_world_id(dst_id)) { 224 return spmd_smc_handler(smc_fid, x1, x2, x3, x4, 225 cookie, handle, flags); 226 } 227 /* 228 * If the caller is secure and we want to return to the secure world, 229 * ERET directly. 230 */ 231 else if (secure_origin && ffa_is_secure_world_id(dst_id)) { 232 SMC_RET5(handle, smc_fid, x1, x2, x3, x4); 233 } 234 /* If we originated in the normal world then switch contexts. */ 235 else if (!secure_origin && ffa_is_secure_world_id(dst_id)) { 236 return spmd_smc_switch_state(smc_fid, secure_origin, x1, x2, 237 x3, x4, handle, flags); 238 } else { 239 /* Unknown State. */ 240 panic(); 241 } 242 243 /* Shouldn't be Reached. */ 244 return 0; 245 } 246 247 /******************************************************************************* 248 * FF-A ABI Handlers. 249 ******************************************************************************/ 250 251 /******************************************************************************* 252 * Helper function to validate arg2 as part of a direct message. 253 ******************************************************************************/ 254 static inline bool direct_msg_validate_arg2(uint64_t x2) 255 { 256 /* Check message type. */ 257 if (x2 & FFA_FWK_MSG_BIT) { 258 /* We have a framework message, ensure it is a known message. */ 259 if (x2 & ~(FFA_FWK_MSG_MASK | FFA_FWK_MSG_BIT)) { 260 VERBOSE("Invalid message format 0x%lx.\n", x2); 261 return false; 262 } 263 } else { 264 /* We have a partition messages, ensure x2 is not set. */ 265 if (x2 != (uint64_t) 0) { 266 VERBOSE("Arg2 MBZ for partition messages. (0x%lx).\n", 267 x2); 268 return false; 269 } 270 } 271 return true; 272 } 273 274 /******************************************************************************* 275 * Helper function to validate the destination ID of a direct response. 276 ******************************************************************************/ 277 static bool direct_msg_validate_dst_id(uint16_t dst_id) 278 { 279 struct secure_partition_desc *sp; 280 281 /* Check if we're targeting a normal world partition. */ 282 if (ffa_is_normal_world_id(dst_id)) { 283 return true; 284 } 285 286 /* Or directed to the SPMC itself.*/ 287 if (dst_id == FFA_SPMC_ID) { 288 return true; 289 } 290 291 /* Otherwise ensure the SP exists. */ 292 sp = spmc_get_sp_ctx(dst_id); 293 if (sp != NULL) { 294 return true; 295 } 296 297 return false; 298 } 299 300 /******************************************************************************* 301 * Helper function to validate the response from a Logical Partition. 302 ******************************************************************************/ 303 static bool direct_msg_validate_lp_resp(uint16_t origin_id, uint16_t lp_id, 304 void *handle) 305 { 306 /* Retrieve populated Direct Response Arguments. */ 307 uint64_t smc_fid = SMC_GET_GP(handle, CTX_GPREG_X0); 308 uint64_t x1 = SMC_GET_GP(handle, CTX_GPREG_X1); 309 uint64_t x2 = SMC_GET_GP(handle, CTX_GPREG_X2); 310 uint16_t src_id = ffa_endpoint_source(x1); 311 uint16_t dst_id = ffa_endpoint_destination(x1); 312 313 if (src_id != lp_id) { 314 ERROR("Invalid EL3 LP source ID (0x%x).\n", src_id); 315 return false; 316 } 317 318 /* 319 * Check the destination ID is valid and ensure the LP is responding to 320 * the original request. 321 */ 322 if ((!direct_msg_validate_dst_id(dst_id)) || (dst_id != origin_id)) { 323 ERROR("Invalid EL3 LP destination ID (0x%x).\n", dst_id); 324 return false; 325 } 326 327 if ((smc_fid != FFA_MSG_SEND_DIRECT_RESP2_SMC64) && 328 !direct_msg_validate_arg2(x2)) { 329 ERROR("Invalid EL3 LP message encoding.\n"); 330 return false; 331 } 332 return true; 333 } 334 335 /******************************************************************************* 336 * Helper function to check that partition can receive direct msg or not. 337 ******************************************************************************/ 338 static bool direct_msg_receivable(uint32_t properties, uint16_t dir_req_fnum) 339 { 340 if ((dir_req_fnum == FFA_FNUM_MSG_SEND_DIRECT_REQ && 341 ((properties & FFA_PARTITION_DIRECT_REQ_RECV) == 0U)) || 342 (dir_req_fnum == FFA_FNUM_MSG_SEND_DIRECT_REQ2 && 343 ((properties & FFA_PARTITION_DIRECT_REQ2_RECV) == 0U))) { 344 return false; 345 } 346 347 return true; 348 } 349 350 /******************************************************************************* 351 * Handle direct request messages and route to the appropriate destination. 352 ******************************************************************************/ 353 static uint64_t direct_req_smc_handler(uint32_t smc_fid, 354 bool secure_origin, 355 uint64_t x1, 356 uint64_t x2, 357 uint64_t x3, 358 uint64_t x4, 359 void *cookie, 360 void *handle, 361 uint64_t flags) 362 { 363 uint16_t src_id = ffa_endpoint_source(x1); 364 uint16_t dst_id = ffa_endpoint_destination(x1); 365 uint16_t dir_req_funcid; 366 struct el3_lp_desc *el3_lp_descs; 367 struct secure_partition_desc *sp; 368 unsigned int idx; 369 370 dir_req_funcid = (smc_fid != FFA_MSG_SEND_DIRECT_REQ2_SMC64) ? 371 FFA_FNUM_MSG_SEND_DIRECT_REQ : FFA_FNUM_MSG_SEND_DIRECT_REQ2; 372 373 /* 374 * Sanity check for DIRECT_REQ: 375 * Check if arg2 has been populated correctly based on message type 376 */ 377 if ((dir_req_funcid == FFA_FNUM_MSG_SEND_DIRECT_REQ) && 378 !direct_msg_validate_arg2(x2)) { 379 return spmc_ffa_error_return(handle, FFA_ERROR_INVALID_PARAMETER); 380 } 381 382 /* Validate Sender is either the current SP or from the normal world. */ 383 if ((secure_origin && src_id != spmc_get_current_sp_ctx()->sp_id) || 384 (!secure_origin && !ffa_is_normal_world_id(src_id))) { 385 ERROR("Invalid direct request source ID (0x%x).\n", src_id); 386 return spmc_ffa_error_return(handle, 387 FFA_ERROR_INVALID_PARAMETER); 388 } 389 390 el3_lp_descs = get_el3_lp_array(); 391 392 /* Check if the request is destined for a Logical Partition. */ 393 for (unsigned int i = 0U; i < MAX_EL3_LP_DESCS_COUNT; i++) { 394 if (el3_lp_descs[i].sp_id == dst_id) { 395 if (!direct_msg_receivable(el3_lp_descs[i].properties, dir_req_funcid)) { 396 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 397 } 398 399 uint64_t ret = el3_lp_descs[i].direct_req( 400 smc_fid, secure_origin, x1, x2, 401 x3, x4, cookie, handle, flags); 402 if (!direct_msg_validate_lp_resp(src_id, dst_id, 403 handle)) { 404 panic(); 405 } 406 407 /* Message checks out. */ 408 return ret; 409 } 410 } 411 412 /* 413 * If the request was not targeted to a LSP and from the secure world 414 * then it is invalid since a SP cannot call into the Normal world and 415 * there is no other SP to call into. If there are other SPs in future 416 * then the partition runtime model would need to be validated as well. 417 */ 418 if (secure_origin) { 419 VERBOSE("Direct request not supported to the Normal World.\n"); 420 return spmc_ffa_error_return(handle, 421 FFA_ERROR_INVALID_PARAMETER); 422 } 423 424 /* Check if the SP ID is valid. */ 425 sp = spmc_get_sp_ctx(dst_id); 426 if (sp == NULL) { 427 VERBOSE("Direct request to unknown partition ID (0x%x).\n", 428 dst_id); 429 return spmc_ffa_error_return(handle, 430 FFA_ERROR_INVALID_PARAMETER); 431 } 432 433 if (!direct_msg_receivable(sp->properties, dir_req_funcid)) { 434 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 435 } 436 437 /* Protect the runtime state of a UP S-EL0 SP with a lock. */ 438 if (sp->runtime_el == S_EL0) { 439 spin_lock(&sp->rt_state_lock); 440 } 441 442 /* 443 * Check that the target execution context is in a waiting state before 444 * forwarding the direct request to it. 445 */ 446 idx = get_ec_index(sp); 447 if (sp->ec[idx].rt_state != RT_STATE_WAITING) { 448 VERBOSE("SP context on core%u is not waiting (%u).\n", 449 idx, sp->ec[idx].rt_model); 450 451 if (sp->runtime_el == S_EL0) { 452 spin_unlock(&sp->rt_state_lock); 453 } 454 455 return spmc_ffa_error_return(handle, FFA_ERROR_BUSY); 456 } 457 458 /* 459 * Everything checks out so forward the request to the SP after updating 460 * its state and runtime model. 461 */ 462 sp->ec[idx].rt_state = RT_STATE_RUNNING; 463 sp->ec[idx].rt_model = RT_MODEL_DIR_REQ; 464 sp->ec[idx].dir_req_origin_id = src_id; 465 sp->ec[idx].dir_req_funcid = dir_req_funcid; 466 467 if (sp->runtime_el == S_EL0) { 468 spin_unlock(&sp->rt_state_lock); 469 } 470 471 return spmc_smc_return(smc_fid, secure_origin, x1, x2, x3, x4, 472 handle, cookie, flags, dst_id); 473 } 474 475 /******************************************************************************* 476 * Handle direct response messages and route to the appropriate destination. 477 ******************************************************************************/ 478 static uint64_t direct_resp_smc_handler(uint32_t smc_fid, 479 bool secure_origin, 480 uint64_t x1, 481 uint64_t x2, 482 uint64_t x3, 483 uint64_t x4, 484 void *cookie, 485 void *handle, 486 uint64_t flags) 487 { 488 uint16_t dst_id = ffa_endpoint_destination(x1); 489 uint16_t dir_req_funcid; 490 struct secure_partition_desc *sp; 491 unsigned int idx; 492 493 dir_req_funcid = (smc_fid != FFA_MSG_SEND_DIRECT_RESP2_SMC64) ? 494 FFA_FNUM_MSG_SEND_DIRECT_REQ : FFA_FNUM_MSG_SEND_DIRECT_REQ2; 495 496 /* Check if arg2 has been populated correctly based on message type. */ 497 if (!direct_msg_validate_arg2(x2)) { 498 return spmc_ffa_error_return(handle, 499 FFA_ERROR_INVALID_PARAMETER); 500 } 501 502 /* Check that the response did not originate from the Normal world. */ 503 if (!secure_origin) { 504 VERBOSE("Direct Response not supported from Normal World.\n"); 505 return spmc_ffa_error_return(handle, 506 FFA_ERROR_INVALID_PARAMETER); 507 } 508 509 /* 510 * Check that the response is either targeted to the Normal world or the 511 * SPMC e.g. a PM response. 512 */ 513 if (!direct_msg_validate_dst_id(dst_id)) { 514 VERBOSE("Direct response to invalid partition ID (0x%x).\n", 515 dst_id); 516 return spmc_ffa_error_return(handle, 517 FFA_ERROR_INVALID_PARAMETER); 518 } 519 520 /* Obtain the SP descriptor and update its runtime state. */ 521 sp = spmc_get_sp_ctx(ffa_endpoint_source(x1)); 522 if (sp == NULL) { 523 VERBOSE("Direct response to unknown partition ID (0x%x).\n", 524 dst_id); 525 return spmc_ffa_error_return(handle, 526 FFA_ERROR_INVALID_PARAMETER); 527 } 528 529 if (sp->runtime_el == S_EL0) { 530 spin_lock(&sp->rt_state_lock); 531 } 532 533 /* Sanity check state is being tracked correctly in the SPMC. */ 534 idx = get_ec_index(sp); 535 assert(sp->ec[idx].rt_state == RT_STATE_RUNNING); 536 537 /* Ensure SP execution context was in the right runtime model. */ 538 if (sp->ec[idx].rt_model != RT_MODEL_DIR_REQ) { 539 VERBOSE("SP context on core%u not handling direct req (%u).\n", 540 idx, sp->ec[idx].rt_model); 541 if (sp->runtime_el == S_EL0) { 542 spin_unlock(&sp->rt_state_lock); 543 } 544 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 545 } 546 547 if (dir_req_funcid != sp->ec[idx].dir_req_funcid) { 548 WARN("Unmatched direct req/resp func id. req:%x, resp:%x on core%u.\n", 549 sp->ec[idx].dir_req_funcid, (smc_fid & FUNCID_NUM_MASK), idx); 550 if (sp->runtime_el == S_EL0) { 551 spin_unlock(&sp->rt_state_lock); 552 } 553 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 554 } 555 556 if (sp->ec[idx].dir_req_origin_id != dst_id) { 557 WARN("Invalid direct resp partition ID 0x%x != 0x%x on core%u.\n", 558 dst_id, sp->ec[idx].dir_req_origin_id, idx); 559 if (sp->runtime_el == S_EL0) { 560 spin_unlock(&sp->rt_state_lock); 561 } 562 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 563 } 564 565 /* Update the state of the SP execution context. */ 566 sp->ec[idx].rt_state = RT_STATE_WAITING; 567 568 /* Clear the ongoing direct request ID. */ 569 sp->ec[idx].dir_req_origin_id = INV_SP_ID; 570 571 /* Clear the ongoing direct request message version. */ 572 sp->ec[idx].dir_req_funcid = 0U; 573 574 if (sp->runtime_el == S_EL0) { 575 spin_unlock(&sp->rt_state_lock); 576 } 577 578 /* 579 * If the receiver is not the SPMC then forward the response to the 580 * Normal world. 581 */ 582 if (dst_id == FFA_SPMC_ID) { 583 spmc_sp_synchronous_exit(&sp->ec[idx], x4); 584 /* Should not get here. */ 585 panic(); 586 } 587 588 return spmc_smc_return(smc_fid, secure_origin, x1, x2, x3, x4, 589 handle, cookie, flags, dst_id); 590 } 591 592 /******************************************************************************* 593 * This function handles the FFA_MSG_WAIT SMC to allow an SP to relinquish its 594 * cycles. 595 ******************************************************************************/ 596 static uint64_t msg_wait_handler(uint32_t smc_fid, 597 bool secure_origin, 598 uint64_t x1, 599 uint64_t x2, 600 uint64_t x3, 601 uint64_t x4, 602 void *cookie, 603 void *handle, 604 uint64_t flags) 605 { 606 struct secure_partition_desc *sp; 607 unsigned int idx; 608 609 /* 610 * Check that the response did not originate from the Normal world as 611 * only the secure world can call this ABI. 612 */ 613 if (!secure_origin) { 614 VERBOSE("Normal world cannot call FFA_MSG_WAIT.\n"); 615 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 616 } 617 618 /* Get the descriptor of the SP that invoked FFA_MSG_WAIT. */ 619 sp = spmc_get_current_sp_ctx(); 620 if (sp == NULL) { 621 return spmc_ffa_error_return(handle, 622 FFA_ERROR_INVALID_PARAMETER); 623 } 624 625 /* 626 * Get the execution context of the SP that invoked FFA_MSG_WAIT. 627 */ 628 idx = get_ec_index(sp); 629 if (sp->runtime_el == S_EL0) { 630 spin_lock(&sp->rt_state_lock); 631 } 632 633 /* Ensure SP execution context was in the right runtime model. */ 634 if (sp->ec[idx].rt_model == RT_MODEL_DIR_REQ) { 635 if (sp->runtime_el == S_EL0) { 636 spin_unlock(&sp->rt_state_lock); 637 } 638 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 639 } 640 641 /* Sanity check the state is being tracked correctly in the SPMC. */ 642 assert(sp->ec[idx].rt_state == RT_STATE_RUNNING); 643 644 /* 645 * Perform a synchronous exit if the partition was initialising. The 646 * state is updated after the exit. 647 */ 648 if (sp->ec[idx].rt_model == RT_MODEL_INIT) { 649 if (sp->runtime_el == S_EL0) { 650 spin_unlock(&sp->rt_state_lock); 651 } 652 spmc_sp_synchronous_exit(&sp->ec[idx], x4); 653 /* Should not get here */ 654 panic(); 655 } 656 657 /* Update the state of the SP execution context. */ 658 sp->ec[idx].rt_state = RT_STATE_WAITING; 659 660 /* Resume normal world if a secure interrupt was handled. */ 661 if (sp->ec[idx].rt_model == RT_MODEL_INTR) { 662 if (sp->runtime_el == S_EL0) { 663 spin_unlock(&sp->rt_state_lock); 664 } 665 666 return spmd_smc_switch_state(FFA_NORMAL_WORLD_RESUME, secure_origin, 667 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 668 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 669 handle, flags); 670 } 671 672 /* Protect the runtime state of a S-EL0 SP with a lock. */ 673 if (sp->runtime_el == S_EL0) { 674 spin_unlock(&sp->rt_state_lock); 675 } 676 677 /* Forward the response to the Normal world. */ 678 return spmc_smc_return(smc_fid, secure_origin, x1, x2, x3, x4, 679 handle, cookie, flags, FFA_NWD_ID); 680 } 681 682 static uint64_t ffa_error_handler(uint32_t smc_fid, 683 bool secure_origin, 684 uint64_t x1, 685 uint64_t x2, 686 uint64_t x3, 687 uint64_t x4, 688 void *cookie, 689 void *handle, 690 uint64_t flags) 691 { 692 struct secure_partition_desc *sp; 693 unsigned int idx; 694 uint16_t dst_id = ffa_endpoint_destination(x1); 695 bool cancel_dir_req = false; 696 697 /* Check that the response did not originate from the Normal world. */ 698 if (!secure_origin) { 699 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 700 } 701 702 /* Get the descriptor of the SP that invoked FFA_ERROR. */ 703 sp = spmc_get_current_sp_ctx(); 704 if (sp == NULL) { 705 return spmc_ffa_error_return(handle, 706 FFA_ERROR_INVALID_PARAMETER); 707 } 708 709 /* Get the execution context of the SP that invoked FFA_ERROR. */ 710 idx = get_ec_index(sp); 711 712 /* 713 * We only expect FFA_ERROR to be received during SP initialisation 714 * otherwise this is an invalid call. 715 */ 716 if (sp->ec[idx].rt_model == RT_MODEL_INIT) { 717 ERROR("SP 0x%x failed to initialize.\n", sp->sp_id); 718 spmc_sp_synchronous_exit(&sp->ec[idx], x2); 719 /* Should not get here. */ 720 panic(); 721 } 722 723 if (sp->runtime_el == S_EL0) { 724 spin_lock(&sp->rt_state_lock); 725 } 726 727 if (sp->ec[idx].rt_state == RT_STATE_RUNNING && 728 sp->ec[idx].rt_model == RT_MODEL_DIR_REQ) { 729 sp->ec[idx].rt_state = RT_STATE_WAITING; 730 sp->ec[idx].dir_req_origin_id = INV_SP_ID; 731 sp->ec[idx].dir_req_funcid = 0x00; 732 cancel_dir_req = true; 733 } 734 735 if (sp->runtime_el == S_EL0) { 736 spin_unlock(&sp->rt_state_lock); 737 } 738 739 if (cancel_dir_req) { 740 if (dst_id == FFA_SPMC_ID) { 741 spmc_sp_synchronous_exit(&sp->ec[idx], x4); 742 /* Should not get here. */ 743 panic(); 744 } else 745 return spmc_smc_return(smc_fid, secure_origin, x1, x2, x3, x4, 746 handle, cookie, flags, dst_id); 747 } 748 749 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 750 } 751 752 static uint64_t ffa_version_handler(uint32_t smc_fid, 753 bool secure_origin, 754 uint64_t x1, 755 uint64_t x2, 756 uint64_t x3, 757 uint64_t x4, 758 void *cookie, 759 void *handle, 760 uint64_t flags) 761 { 762 uint32_t requested_version = x1 & FFA_VERSION_MASK; 763 764 if (requested_version & FFA_VERSION_BIT31_MASK) { 765 /* Invalid encoding, return an error. */ 766 SMC_RET1(handle, FFA_ERROR_NOT_SUPPORTED); 767 /* Execution stops here. */ 768 } 769 770 /* Determine the caller to store the requested version. */ 771 if (secure_origin) { 772 /* 773 * Ensure that the SP is reporting the same version as 774 * specified in its manifest. If these do not match there is 775 * something wrong with the SP. 776 * TODO: Should we abort the SP? For now assert this is not 777 * case. 778 */ 779 assert(requested_version == 780 spmc_get_current_sp_ctx()->ffa_version); 781 } else { 782 /* 783 * If this is called by the normal world, record this 784 * information in its descriptor. 785 */ 786 spmc_get_hyp_ctx()->ffa_version = requested_version; 787 } 788 789 SMC_RET1(handle, MAKE_FFA_VERSION(FFA_VERSION_MAJOR, 790 FFA_VERSION_MINOR)); 791 } 792 793 /******************************************************************************* 794 * Helper function to obtain the FF-A version of the calling partition. 795 ******************************************************************************/ 796 uint32_t get_partition_ffa_version(bool secure_origin) 797 { 798 if (secure_origin) { 799 return spmc_get_current_sp_ctx()->ffa_version; 800 } else { 801 return spmc_get_hyp_ctx()->ffa_version; 802 } 803 } 804 805 static uint64_t rxtx_map_handler(uint32_t smc_fid, 806 bool secure_origin, 807 uint64_t x1, 808 uint64_t x2, 809 uint64_t x3, 810 uint64_t x4, 811 void *cookie, 812 void *handle, 813 uint64_t flags) 814 { 815 int ret; 816 uint32_t error_code; 817 uint32_t mem_atts = secure_origin ? MT_SECURE : MT_NS; 818 struct mailbox *mbox; 819 uintptr_t tx_address = x1; 820 uintptr_t rx_address = x2; 821 uint32_t page_count = x3 & FFA_RXTX_PAGE_COUNT_MASK; /* Bits [5:0] */ 822 uint32_t buf_size = page_count * FFA_PAGE_SIZE; 823 824 /* 825 * The SPMC does not support mapping of VM RX/TX pairs to facilitate 826 * indirect messaging with SPs. Check if the Hypervisor has invoked this 827 * ABI on behalf of a VM and reject it if this is the case. 828 */ 829 if (tx_address == 0 || rx_address == 0) { 830 WARN("Mapping RX/TX Buffers on behalf of VM not supported.\n"); 831 return spmc_ffa_error_return(handle, 832 FFA_ERROR_INVALID_PARAMETER); 833 } 834 835 /* Ensure the specified buffers are not the same. */ 836 if (tx_address == rx_address) { 837 WARN("TX Buffer must not be the same as RX Buffer.\n"); 838 return spmc_ffa_error_return(handle, 839 FFA_ERROR_INVALID_PARAMETER); 840 } 841 842 /* Ensure the buffer size is not 0. */ 843 if (buf_size == 0U) { 844 WARN("Buffer size must not be 0\n"); 845 return spmc_ffa_error_return(handle, 846 FFA_ERROR_INVALID_PARAMETER); 847 } 848 849 /* 850 * Ensure the buffer size is a multiple of the translation granule size 851 * in TF-A. 852 */ 853 if (buf_size % PAGE_SIZE != 0U) { 854 WARN("Buffer size must be aligned to translation granule.\n"); 855 return spmc_ffa_error_return(handle, 856 FFA_ERROR_INVALID_PARAMETER); 857 } 858 859 /* Obtain the RX/TX buffer pair descriptor. */ 860 mbox = spmc_get_mbox_desc(secure_origin); 861 862 spin_lock(&mbox->lock); 863 864 /* Check if buffers have already been mapped. */ 865 if (mbox->rx_buffer != 0 || mbox->tx_buffer != 0) { 866 WARN("RX/TX Buffers already mapped (%p/%p)\n", 867 (void *) mbox->rx_buffer, (void *)mbox->tx_buffer); 868 error_code = FFA_ERROR_DENIED; 869 goto err; 870 } 871 872 /* memmap the TX buffer as read only. */ 873 ret = mmap_add_dynamic_region(tx_address, /* PA */ 874 tx_address, /* VA */ 875 buf_size, /* size */ 876 mem_atts | MT_RO_DATA); /* attrs */ 877 if (ret != 0) { 878 /* Return the correct error code. */ 879 error_code = (ret == -ENOMEM) ? FFA_ERROR_NO_MEMORY : 880 FFA_ERROR_INVALID_PARAMETER; 881 WARN("Unable to map TX buffer: %d\n", error_code); 882 goto err; 883 } 884 885 /* memmap the RX buffer as read write. */ 886 ret = mmap_add_dynamic_region(rx_address, /* PA */ 887 rx_address, /* VA */ 888 buf_size, /* size */ 889 mem_atts | MT_RW_DATA); /* attrs */ 890 891 if (ret != 0) { 892 error_code = (ret == -ENOMEM) ? FFA_ERROR_NO_MEMORY : 893 FFA_ERROR_INVALID_PARAMETER; 894 WARN("Unable to map RX buffer: %d\n", error_code); 895 /* Unmap the TX buffer again. */ 896 mmap_remove_dynamic_region(tx_address, buf_size); 897 goto err; 898 } 899 900 mbox->tx_buffer = (void *) tx_address; 901 mbox->rx_buffer = (void *) rx_address; 902 mbox->rxtx_page_count = page_count; 903 spin_unlock(&mbox->lock); 904 905 SMC_RET1(handle, FFA_SUCCESS_SMC32); 906 /* Execution stops here. */ 907 err: 908 spin_unlock(&mbox->lock); 909 return spmc_ffa_error_return(handle, error_code); 910 } 911 912 static uint64_t rxtx_unmap_handler(uint32_t smc_fid, 913 bool secure_origin, 914 uint64_t x1, 915 uint64_t x2, 916 uint64_t x3, 917 uint64_t x4, 918 void *cookie, 919 void *handle, 920 uint64_t flags) 921 { 922 struct mailbox *mbox = spmc_get_mbox_desc(secure_origin); 923 uint32_t buf_size = mbox->rxtx_page_count * FFA_PAGE_SIZE; 924 925 /* 926 * The SPMC does not support mapping of VM RX/TX pairs to facilitate 927 * indirect messaging with SPs. Check if the Hypervisor has invoked this 928 * ABI on behalf of a VM and reject it if this is the case. 929 */ 930 if (x1 != 0UL) { 931 return spmc_ffa_error_return(handle, 932 FFA_ERROR_INVALID_PARAMETER); 933 } 934 935 spin_lock(&mbox->lock); 936 937 /* Check if buffers are currently mapped. */ 938 if (mbox->rx_buffer == 0 || mbox->tx_buffer == 0) { 939 spin_unlock(&mbox->lock); 940 return spmc_ffa_error_return(handle, 941 FFA_ERROR_INVALID_PARAMETER); 942 } 943 944 /* Unmap RX Buffer */ 945 if (mmap_remove_dynamic_region((uintptr_t) mbox->rx_buffer, 946 buf_size) != 0) { 947 WARN("Unable to unmap RX buffer!\n"); 948 } 949 950 mbox->rx_buffer = 0; 951 952 /* Unmap TX Buffer */ 953 if (mmap_remove_dynamic_region((uintptr_t) mbox->tx_buffer, 954 buf_size) != 0) { 955 WARN("Unable to unmap TX buffer!\n"); 956 } 957 958 mbox->tx_buffer = 0; 959 mbox->rxtx_page_count = 0; 960 961 spin_unlock(&mbox->lock); 962 SMC_RET1(handle, FFA_SUCCESS_SMC32); 963 } 964 965 /* 966 * Helper function to populate the properties field of a Partition Info Get 967 * descriptor. 968 */ 969 static uint32_t 970 partition_info_get_populate_properties(uint32_t sp_properties, 971 enum sp_execution_state sp_ec_state) 972 { 973 uint32_t properties = sp_properties; 974 uint32_t ec_state; 975 976 /* Determine the execution state of the SP. */ 977 ec_state = sp_ec_state == SP_STATE_AARCH64 ? 978 FFA_PARTITION_INFO_GET_AARCH64_STATE : 979 FFA_PARTITION_INFO_GET_AARCH32_STATE; 980 981 properties |= ec_state << FFA_PARTITION_INFO_GET_EXEC_STATE_SHIFT; 982 983 return properties; 984 } 985 986 /* 987 * Collate the partition information in a v1.1 partition information 988 * descriptor format, this will be converter later if required. 989 */ 990 static int partition_info_get_handler_v1_1(uint32_t *uuid, 991 struct ffa_partition_info_v1_1 992 *partitions, 993 uint32_t max_partitions, 994 uint32_t *partition_count) 995 { 996 uint32_t index; 997 struct ffa_partition_info_v1_1 *desc; 998 bool null_uuid = is_null_uuid(uuid); 999 struct el3_lp_desc *el3_lp_descs = get_el3_lp_array(); 1000 1001 /* Deal with Logical Partitions. */ 1002 for (index = 0U; index < EL3_LP_DESCS_COUNT; index++) { 1003 if (null_uuid || uuid_match(uuid, el3_lp_descs[index].uuid)) { 1004 /* Found a matching UUID, populate appropriately. */ 1005 if (*partition_count >= max_partitions) { 1006 return FFA_ERROR_NO_MEMORY; 1007 } 1008 1009 desc = &partitions[*partition_count]; 1010 desc->ep_id = el3_lp_descs[index].sp_id; 1011 desc->execution_ctx_count = PLATFORM_CORE_COUNT; 1012 /* LSPs must be AArch64. */ 1013 desc->properties = 1014 partition_info_get_populate_properties( 1015 el3_lp_descs[index].properties, 1016 SP_STATE_AARCH64); 1017 1018 if (null_uuid) { 1019 copy_uuid(desc->uuid, el3_lp_descs[index].uuid); 1020 } 1021 (*partition_count)++; 1022 } 1023 } 1024 1025 /* Deal with physical SP's. */ 1026 for (index = 0U; index < SECURE_PARTITION_COUNT; index++) { 1027 if (null_uuid || uuid_match(uuid, sp_desc[index].uuid)) { 1028 /* Found a matching UUID, populate appropriately. */ 1029 if (*partition_count >= max_partitions) { 1030 return FFA_ERROR_NO_MEMORY; 1031 } 1032 1033 desc = &partitions[*partition_count]; 1034 desc->ep_id = sp_desc[index].sp_id; 1035 /* 1036 * Execution context count must match No. cores for 1037 * S-EL1 SPs. 1038 */ 1039 desc->execution_ctx_count = PLATFORM_CORE_COUNT; 1040 desc->properties = 1041 partition_info_get_populate_properties( 1042 sp_desc[index].properties, 1043 sp_desc[index].execution_state); 1044 1045 if (null_uuid) { 1046 copy_uuid(desc->uuid, sp_desc[index].uuid); 1047 } 1048 (*partition_count)++; 1049 } 1050 } 1051 return 0; 1052 } 1053 1054 /* 1055 * Handle the case where that caller only wants the count of partitions 1056 * matching a given UUID and does not want the corresponding descriptors 1057 * populated. 1058 */ 1059 static uint32_t partition_info_get_handler_count_only(uint32_t *uuid) 1060 { 1061 uint32_t index = 0; 1062 uint32_t partition_count = 0; 1063 bool null_uuid = is_null_uuid(uuid); 1064 struct el3_lp_desc *el3_lp_descs = get_el3_lp_array(); 1065 1066 /* Deal with Logical Partitions. */ 1067 for (index = 0U; index < EL3_LP_DESCS_COUNT; index++) { 1068 if (null_uuid || 1069 uuid_match(uuid, el3_lp_descs[index].uuid)) { 1070 (partition_count)++; 1071 } 1072 } 1073 1074 /* Deal with physical SP's. */ 1075 for (index = 0U; index < SECURE_PARTITION_COUNT; index++) { 1076 if (null_uuid || uuid_match(uuid, sp_desc[index].uuid)) { 1077 (partition_count)++; 1078 } 1079 } 1080 return partition_count; 1081 } 1082 1083 /* 1084 * If the caller of the PARTITION_INFO_GET ABI was a v1.0 caller, populate 1085 * the corresponding descriptor format from the v1.1 descriptor array. 1086 */ 1087 static uint64_t partition_info_populate_v1_0(struct ffa_partition_info_v1_1 1088 *partitions, 1089 struct mailbox *mbox, 1090 int partition_count) 1091 { 1092 uint32_t index; 1093 uint32_t buf_size; 1094 uint32_t descriptor_size; 1095 struct ffa_partition_info_v1_0 *v1_0_partitions = 1096 (struct ffa_partition_info_v1_0 *) mbox->rx_buffer; 1097 1098 buf_size = mbox->rxtx_page_count * FFA_PAGE_SIZE; 1099 descriptor_size = partition_count * 1100 sizeof(struct ffa_partition_info_v1_0); 1101 1102 if (descriptor_size > buf_size) { 1103 return FFA_ERROR_NO_MEMORY; 1104 } 1105 1106 for (index = 0U; index < partition_count; index++) { 1107 v1_0_partitions[index].ep_id = partitions[index].ep_id; 1108 v1_0_partitions[index].execution_ctx_count = 1109 partitions[index].execution_ctx_count; 1110 /* Only report v1.0 properties. */ 1111 v1_0_partitions[index].properties = 1112 (partitions[index].properties & 1113 FFA_PARTITION_INFO_GET_PROPERTIES_V1_0_MASK); 1114 } 1115 return 0; 1116 } 1117 1118 /* 1119 * Main handler for FFA_PARTITION_INFO_GET which supports both FF-A v1.1 and 1120 * v1.0 implementations. 1121 */ 1122 static uint64_t partition_info_get_handler(uint32_t smc_fid, 1123 bool secure_origin, 1124 uint64_t x1, 1125 uint64_t x2, 1126 uint64_t x3, 1127 uint64_t x4, 1128 void *cookie, 1129 void *handle, 1130 uint64_t flags) 1131 { 1132 int ret; 1133 uint32_t partition_count = 0; 1134 uint32_t size = 0; 1135 uint32_t ffa_version = get_partition_ffa_version(secure_origin); 1136 struct mailbox *mbox; 1137 uint64_t info_get_flags; 1138 bool count_only; 1139 uint32_t uuid[4]; 1140 1141 uuid[0] = x1; 1142 uuid[1] = x2; 1143 uuid[2] = x3; 1144 uuid[3] = x4; 1145 1146 /* Determine if the Partition descriptors should be populated. */ 1147 info_get_flags = SMC_GET_GP(handle, CTX_GPREG_X5); 1148 count_only = (info_get_flags & FFA_PARTITION_INFO_GET_COUNT_FLAG_MASK); 1149 1150 /* Handle the case where we don't need to populate the descriptors. */ 1151 if (count_only) { 1152 partition_count = partition_info_get_handler_count_only(uuid); 1153 if (partition_count == 0) { 1154 return spmc_ffa_error_return(handle, 1155 FFA_ERROR_INVALID_PARAMETER); 1156 } 1157 } else { 1158 struct ffa_partition_info_v1_1 partitions[MAX_SP_LP_PARTITIONS]; 1159 1160 /* 1161 * Handle the case where the partition descriptors are required, 1162 * check we have the buffers available and populate the 1163 * appropriate structure version. 1164 */ 1165 1166 /* Obtain the v1.1 format of the descriptors. */ 1167 ret = partition_info_get_handler_v1_1(uuid, partitions, 1168 MAX_SP_LP_PARTITIONS, 1169 &partition_count); 1170 1171 /* Check if an error occurred during discovery. */ 1172 if (ret != 0) { 1173 goto err; 1174 } 1175 1176 /* If we didn't find any matches the UUID is unknown. */ 1177 if (partition_count == 0) { 1178 ret = FFA_ERROR_INVALID_PARAMETER; 1179 goto err; 1180 } 1181 1182 /* Obtain the partition mailbox RX/TX buffer pair descriptor. */ 1183 mbox = spmc_get_mbox_desc(secure_origin); 1184 1185 /* 1186 * If the caller has not bothered registering its RX/TX pair 1187 * then return an error code. 1188 */ 1189 spin_lock(&mbox->lock); 1190 if (mbox->rx_buffer == NULL) { 1191 ret = FFA_ERROR_BUSY; 1192 goto err_unlock; 1193 } 1194 1195 /* Ensure the RX buffer is currently free. */ 1196 if (mbox->state != MAILBOX_STATE_EMPTY) { 1197 ret = FFA_ERROR_BUSY; 1198 goto err_unlock; 1199 } 1200 1201 /* Zero the RX buffer before populating. */ 1202 (void)memset(mbox->rx_buffer, 0, 1203 mbox->rxtx_page_count * FFA_PAGE_SIZE); 1204 1205 /* 1206 * Depending on the FF-A version of the requesting partition 1207 * we may need to convert to a v1.0 format otherwise we can copy 1208 * directly. 1209 */ 1210 if (ffa_version == MAKE_FFA_VERSION(U(1), U(0))) { 1211 ret = partition_info_populate_v1_0(partitions, 1212 mbox, 1213 partition_count); 1214 if (ret != 0) { 1215 goto err_unlock; 1216 } 1217 } else { 1218 uint32_t buf_size = mbox->rxtx_page_count * 1219 FFA_PAGE_SIZE; 1220 1221 /* Ensure the descriptor will fit in the buffer. */ 1222 size = sizeof(struct ffa_partition_info_v1_1); 1223 if (partition_count * size > buf_size) { 1224 ret = FFA_ERROR_NO_MEMORY; 1225 goto err_unlock; 1226 } 1227 memcpy(mbox->rx_buffer, partitions, 1228 partition_count * size); 1229 } 1230 1231 mbox->state = MAILBOX_STATE_FULL; 1232 spin_unlock(&mbox->lock); 1233 } 1234 SMC_RET4(handle, FFA_SUCCESS_SMC32, 0, partition_count, size); 1235 1236 err_unlock: 1237 spin_unlock(&mbox->lock); 1238 err: 1239 return spmc_ffa_error_return(handle, ret); 1240 } 1241 1242 static uint64_t ffa_feature_success(void *handle, uint32_t arg2) 1243 { 1244 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0, arg2); 1245 } 1246 1247 static uint64_t ffa_features_retrieve_request(bool secure_origin, 1248 uint32_t input_properties, 1249 void *handle) 1250 { 1251 /* 1252 * If we're called by the normal world we don't support any 1253 * additional features. 1254 */ 1255 if (!secure_origin) { 1256 if ((input_properties & FFA_FEATURES_RET_REQ_NS_BIT) != 0U) { 1257 return spmc_ffa_error_return(handle, 1258 FFA_ERROR_NOT_SUPPORTED); 1259 } 1260 1261 } else { 1262 struct secure_partition_desc *sp = spmc_get_current_sp_ctx(); 1263 /* 1264 * If v1.1 the NS bit must be set otherwise it is an invalid 1265 * call. If v1.0 check and store whether the SP has requested 1266 * the use of the NS bit. 1267 */ 1268 if (sp->ffa_version == MAKE_FFA_VERSION(1, 1)) { 1269 if ((input_properties & 1270 FFA_FEATURES_RET_REQ_NS_BIT) == 0U) { 1271 return spmc_ffa_error_return(handle, 1272 FFA_ERROR_NOT_SUPPORTED); 1273 } 1274 return ffa_feature_success(handle, 1275 FFA_FEATURES_RET_REQ_NS_BIT); 1276 } else { 1277 sp->ns_bit_requested = (input_properties & 1278 FFA_FEATURES_RET_REQ_NS_BIT) != 1279 0U; 1280 } 1281 if (sp->ns_bit_requested) { 1282 return ffa_feature_success(handle, 1283 FFA_FEATURES_RET_REQ_NS_BIT); 1284 } 1285 } 1286 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1287 } 1288 1289 static uint64_t ffa_features_handler(uint32_t smc_fid, 1290 bool secure_origin, 1291 uint64_t x1, 1292 uint64_t x2, 1293 uint64_t x3, 1294 uint64_t x4, 1295 void *cookie, 1296 void *handle, 1297 uint64_t flags) 1298 { 1299 uint32_t function_id = (uint32_t) x1; 1300 uint32_t input_properties = (uint32_t) x2; 1301 1302 /* Check if a Feature ID was requested. */ 1303 if ((function_id & FFA_FEATURES_BIT31_MASK) == 0U) { 1304 /* We currently don't support any additional features. */ 1305 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1306 } 1307 1308 /* 1309 * Handle the cases where we have separate handlers due to additional 1310 * properties. 1311 */ 1312 switch (function_id) { 1313 case FFA_MEM_RETRIEVE_REQ_SMC32: 1314 case FFA_MEM_RETRIEVE_REQ_SMC64: 1315 return ffa_features_retrieve_request(secure_origin, 1316 input_properties, 1317 handle); 1318 } 1319 1320 /* 1321 * We don't currently support additional input properties for these 1322 * other ABIs therefore ensure this value is set to 0. 1323 */ 1324 if (input_properties != 0U) { 1325 return spmc_ffa_error_return(handle, 1326 FFA_ERROR_NOT_SUPPORTED); 1327 } 1328 1329 /* Report if any other FF-A ABI is supported. */ 1330 switch (function_id) { 1331 /* Supported features from both worlds. */ 1332 case FFA_ERROR: 1333 case FFA_SUCCESS_SMC32: 1334 case FFA_INTERRUPT: 1335 case FFA_SPM_ID_GET: 1336 case FFA_ID_GET: 1337 case FFA_FEATURES: 1338 case FFA_VERSION: 1339 case FFA_RX_RELEASE: 1340 case FFA_MSG_SEND_DIRECT_REQ_SMC32: 1341 case FFA_MSG_SEND_DIRECT_REQ_SMC64: 1342 case FFA_MSG_SEND_DIRECT_REQ2_SMC64: 1343 case FFA_PARTITION_INFO_GET: 1344 case FFA_RXTX_MAP_SMC32: 1345 case FFA_RXTX_MAP_SMC64: 1346 case FFA_RXTX_UNMAP: 1347 case FFA_MEM_FRAG_TX: 1348 case FFA_MSG_RUN: 1349 1350 /* 1351 * We are relying on the fact that the other registers 1352 * will be set to 0 as these values align with the 1353 * currently implemented features of the SPMC. If this 1354 * changes this function must be extended to handle 1355 * reporting the additional functionality. 1356 */ 1357 1358 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1359 /* Execution stops here. */ 1360 1361 /* Supported ABIs only from the secure world. */ 1362 case FFA_SECONDARY_EP_REGISTER_SMC64: 1363 case FFA_MSG_SEND_DIRECT_RESP_SMC32: 1364 case FFA_MSG_SEND_DIRECT_RESP_SMC64: 1365 case FFA_MSG_SEND_DIRECT_RESP2_SMC64: 1366 case FFA_MEM_RELINQUISH: 1367 case FFA_MSG_WAIT: 1368 case FFA_CONSOLE_LOG_SMC32: 1369 case FFA_CONSOLE_LOG_SMC64: 1370 1371 if (!secure_origin) { 1372 return spmc_ffa_error_return(handle, 1373 FFA_ERROR_NOT_SUPPORTED); 1374 } 1375 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1376 /* Execution stops here. */ 1377 1378 /* Supported features only from the normal world. */ 1379 case FFA_MEM_SHARE_SMC32: 1380 case FFA_MEM_SHARE_SMC64: 1381 case FFA_MEM_LEND_SMC32: 1382 case FFA_MEM_LEND_SMC64: 1383 case FFA_MEM_RECLAIM: 1384 case FFA_MEM_FRAG_RX: 1385 1386 if (secure_origin) { 1387 return spmc_ffa_error_return(handle, 1388 FFA_ERROR_NOT_SUPPORTED); 1389 } 1390 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1391 /* Execution stops here. */ 1392 1393 default: 1394 return spmc_ffa_error_return(handle, 1395 FFA_ERROR_NOT_SUPPORTED); 1396 } 1397 } 1398 1399 static uint64_t ffa_id_get_handler(uint32_t smc_fid, 1400 bool secure_origin, 1401 uint64_t x1, 1402 uint64_t x2, 1403 uint64_t x3, 1404 uint64_t x4, 1405 void *cookie, 1406 void *handle, 1407 uint64_t flags) 1408 { 1409 if (secure_origin) { 1410 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0x0, 1411 spmc_get_current_sp_ctx()->sp_id); 1412 } else { 1413 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0x0, 1414 spmc_get_hyp_ctx()->ns_ep_id); 1415 } 1416 } 1417 1418 /* 1419 * Enable an SP to query the ID assigned to the SPMC. 1420 */ 1421 static uint64_t ffa_spm_id_get_handler(uint32_t smc_fid, 1422 bool secure_origin, 1423 uint64_t x1, 1424 uint64_t x2, 1425 uint64_t x3, 1426 uint64_t x4, 1427 void *cookie, 1428 void *handle, 1429 uint64_t flags) 1430 { 1431 assert(x1 == 0UL); 1432 assert(x2 == 0UL); 1433 assert(x3 == 0UL); 1434 assert(x4 == 0UL); 1435 assert(SMC_GET_GP(handle, CTX_GPREG_X5) == 0UL); 1436 assert(SMC_GET_GP(handle, CTX_GPREG_X6) == 0UL); 1437 assert(SMC_GET_GP(handle, CTX_GPREG_X7) == 0UL); 1438 1439 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0x0, FFA_SPMC_ID); 1440 } 1441 1442 static uint64_t ffa_run_handler(uint32_t smc_fid, 1443 bool secure_origin, 1444 uint64_t x1, 1445 uint64_t x2, 1446 uint64_t x3, 1447 uint64_t x4, 1448 void *cookie, 1449 void *handle, 1450 uint64_t flags) 1451 { 1452 struct secure_partition_desc *sp; 1453 uint16_t target_id = FFA_RUN_EP_ID(x1); 1454 uint16_t vcpu_id = FFA_RUN_VCPU_ID(x1); 1455 unsigned int idx; 1456 unsigned int *rt_state; 1457 unsigned int *rt_model; 1458 1459 /* Can only be called from the normal world. */ 1460 if (secure_origin) { 1461 ERROR("FFA_RUN can only be called from NWd.\n"); 1462 return spmc_ffa_error_return(handle, 1463 FFA_ERROR_INVALID_PARAMETER); 1464 } 1465 1466 /* Cannot run a Normal world partition. */ 1467 if (ffa_is_normal_world_id(target_id)) { 1468 ERROR("Cannot run a NWd partition (0x%x).\n", target_id); 1469 return spmc_ffa_error_return(handle, 1470 FFA_ERROR_INVALID_PARAMETER); 1471 } 1472 1473 /* Check that the target SP exists. */ 1474 sp = spmc_get_sp_ctx(target_id); 1475 if (sp == NULL) { 1476 ERROR("Unknown partition ID (0x%x).\n", target_id); 1477 return spmc_ffa_error_return(handle, 1478 FFA_ERROR_INVALID_PARAMETER); 1479 } 1480 1481 idx = get_ec_index(sp); 1482 1483 if (idx != vcpu_id) { 1484 ERROR("Cannot run vcpu %d != %d.\n", idx, vcpu_id); 1485 return spmc_ffa_error_return(handle, 1486 FFA_ERROR_INVALID_PARAMETER); 1487 } 1488 if (sp->runtime_el == S_EL0) { 1489 spin_lock(&sp->rt_state_lock); 1490 } 1491 rt_state = &((sp->ec[idx]).rt_state); 1492 rt_model = &((sp->ec[idx]).rt_model); 1493 if (*rt_state == RT_STATE_RUNNING) { 1494 if (sp->runtime_el == S_EL0) { 1495 spin_unlock(&sp->rt_state_lock); 1496 } 1497 ERROR("Partition (0x%x) is already running.\n", target_id); 1498 return spmc_ffa_error_return(handle, FFA_ERROR_BUSY); 1499 } 1500 1501 /* 1502 * Sanity check that if the execution context was not waiting then it 1503 * was either in the direct request or the run partition runtime model. 1504 */ 1505 if (*rt_state == RT_STATE_PREEMPTED || *rt_state == RT_STATE_BLOCKED) { 1506 assert(*rt_model == RT_MODEL_RUN || 1507 *rt_model == RT_MODEL_DIR_REQ); 1508 } 1509 1510 /* 1511 * If the context was waiting then update the partition runtime model. 1512 */ 1513 if (*rt_state == RT_STATE_WAITING) { 1514 *rt_model = RT_MODEL_RUN; 1515 } 1516 1517 /* 1518 * Forward the request to the correct SP vCPU after updating 1519 * its state. 1520 */ 1521 *rt_state = RT_STATE_RUNNING; 1522 1523 if (sp->runtime_el == S_EL0) { 1524 spin_unlock(&sp->rt_state_lock); 1525 } 1526 1527 return spmc_smc_return(smc_fid, secure_origin, x1, 0, 0, 0, 1528 handle, cookie, flags, target_id); 1529 } 1530 1531 static uint64_t rx_release_handler(uint32_t smc_fid, 1532 bool secure_origin, 1533 uint64_t x1, 1534 uint64_t x2, 1535 uint64_t x3, 1536 uint64_t x4, 1537 void *cookie, 1538 void *handle, 1539 uint64_t flags) 1540 { 1541 struct mailbox *mbox = spmc_get_mbox_desc(secure_origin); 1542 1543 spin_lock(&mbox->lock); 1544 1545 if (mbox->state != MAILBOX_STATE_FULL) { 1546 spin_unlock(&mbox->lock); 1547 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1548 } 1549 1550 mbox->state = MAILBOX_STATE_EMPTY; 1551 spin_unlock(&mbox->lock); 1552 1553 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1554 } 1555 1556 static uint64_t spmc_ffa_console_log(uint32_t smc_fid, 1557 bool secure_origin, 1558 uint64_t x1, 1559 uint64_t x2, 1560 uint64_t x3, 1561 uint64_t x4, 1562 void *cookie, 1563 void *handle, 1564 uint64_t flags) 1565 { 1566 /* Maximum number of characters is 48: 6 registers of 8 bytes each. */ 1567 char chars[48] = {0}; 1568 size_t chars_max; 1569 size_t chars_count = x1; 1570 1571 /* Does not support request from Nwd. */ 1572 if (!secure_origin) { 1573 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1574 } 1575 1576 assert(smc_fid == FFA_CONSOLE_LOG_SMC32 || smc_fid == FFA_CONSOLE_LOG_SMC64); 1577 if (smc_fid == FFA_CONSOLE_LOG_SMC32) { 1578 uint32_t *registers = (uint32_t *)chars; 1579 registers[0] = (uint32_t)x2; 1580 registers[1] = (uint32_t)x3; 1581 registers[2] = (uint32_t)x4; 1582 registers[3] = (uint32_t)SMC_GET_GP(handle, CTX_GPREG_X5); 1583 registers[4] = (uint32_t)SMC_GET_GP(handle, CTX_GPREG_X6); 1584 registers[5] = (uint32_t)SMC_GET_GP(handle, CTX_GPREG_X7); 1585 chars_max = 6 * sizeof(uint32_t); 1586 } else { 1587 uint64_t *registers = (uint64_t *)chars; 1588 registers[0] = x2; 1589 registers[1] = x3; 1590 registers[2] = x4; 1591 registers[3] = SMC_GET_GP(handle, CTX_GPREG_X5); 1592 registers[4] = SMC_GET_GP(handle, CTX_GPREG_X6); 1593 registers[5] = SMC_GET_GP(handle, CTX_GPREG_X7); 1594 chars_max = 6 * sizeof(uint64_t); 1595 } 1596 1597 if ((chars_count == 0) || (chars_count > chars_max)) { 1598 return spmc_ffa_error_return(handle, FFA_ERROR_INVALID_PARAMETER); 1599 } 1600 1601 for (size_t i = 0; (i < chars_count) && (chars[i] != '\0'); i++) { 1602 putchar(chars[i]); 1603 } 1604 1605 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1606 } 1607 1608 /* 1609 * Perform initial validation on the provided secondary entry point. 1610 * For now ensure it does not lie within the BL31 Image or the SP's 1611 * RX/TX buffers as these are mapped within EL3. 1612 * TODO: perform validation for additional invalid memory regions. 1613 */ 1614 static int validate_secondary_ep(uintptr_t ep, struct secure_partition_desc *sp) 1615 { 1616 struct mailbox *mb; 1617 uintptr_t buffer_size; 1618 uintptr_t sp_rx_buffer; 1619 uintptr_t sp_tx_buffer; 1620 uintptr_t sp_rx_buffer_limit; 1621 uintptr_t sp_tx_buffer_limit; 1622 1623 mb = &sp->mailbox; 1624 buffer_size = (uintptr_t) (mb->rxtx_page_count * FFA_PAGE_SIZE); 1625 sp_rx_buffer = (uintptr_t) mb->rx_buffer; 1626 sp_tx_buffer = (uintptr_t) mb->tx_buffer; 1627 sp_rx_buffer_limit = sp_rx_buffer + buffer_size; 1628 sp_tx_buffer_limit = sp_tx_buffer + buffer_size; 1629 1630 /* 1631 * Check if the entry point lies within BL31, or the 1632 * SP's RX or TX buffer. 1633 */ 1634 if ((ep >= BL31_BASE && ep < BL31_LIMIT) || 1635 (ep >= sp_rx_buffer && ep < sp_rx_buffer_limit) || 1636 (ep >= sp_tx_buffer && ep < sp_tx_buffer_limit)) { 1637 return -EINVAL; 1638 } 1639 return 0; 1640 } 1641 1642 /******************************************************************************* 1643 * This function handles the FFA_SECONDARY_EP_REGISTER SMC to allow an SP to 1644 * register an entry point for initialization during a secondary cold boot. 1645 ******************************************************************************/ 1646 static uint64_t ffa_sec_ep_register_handler(uint32_t smc_fid, 1647 bool secure_origin, 1648 uint64_t x1, 1649 uint64_t x2, 1650 uint64_t x3, 1651 uint64_t x4, 1652 void *cookie, 1653 void *handle, 1654 uint64_t flags) 1655 { 1656 struct secure_partition_desc *sp; 1657 struct sp_exec_ctx *sp_ctx; 1658 1659 /* This request cannot originate from the Normal world. */ 1660 if (!secure_origin) { 1661 WARN("%s: Can only be called from SWd.\n", __func__); 1662 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1663 } 1664 1665 /* Get the context of the current SP. */ 1666 sp = spmc_get_current_sp_ctx(); 1667 if (sp == NULL) { 1668 WARN("%s: Cannot find SP context.\n", __func__); 1669 return spmc_ffa_error_return(handle, 1670 FFA_ERROR_INVALID_PARAMETER); 1671 } 1672 1673 /* Only an S-EL1 SP should be invoking this ABI. */ 1674 if (sp->runtime_el != S_EL1) { 1675 WARN("%s: Can only be called for a S-EL1 SP.\n", __func__); 1676 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1677 } 1678 1679 /* Ensure the SP is in its initialization state. */ 1680 sp_ctx = spmc_get_sp_ec(sp); 1681 if (sp_ctx->rt_model != RT_MODEL_INIT) { 1682 WARN("%s: Can only be called during SP initialization.\n", 1683 __func__); 1684 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1685 } 1686 1687 /* Perform initial validation of the secondary entry point. */ 1688 if (validate_secondary_ep(x1, sp)) { 1689 WARN("%s: Invalid entry point provided (0x%lx).\n", 1690 __func__, x1); 1691 return spmc_ffa_error_return(handle, 1692 FFA_ERROR_INVALID_PARAMETER); 1693 } 1694 1695 /* 1696 * Update the secondary entrypoint in SP context. 1697 * We don't need a lock here as during partition initialization there 1698 * will only be a single core online. 1699 */ 1700 sp->secondary_ep = x1; 1701 VERBOSE("%s: 0x%lx\n", __func__, sp->secondary_ep); 1702 1703 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1704 } 1705 1706 /******************************************************************************* 1707 * Permissions are encoded using a different format in the FFA_MEM_PERM_* ABIs 1708 * than in the Trusted Firmware, where the mmap_attr_t enum type is used. This 1709 * function converts a permission value from the FF-A format to the mmap_attr_t 1710 * format by setting MT_RW/MT_RO, MT_USER/MT_PRIVILEGED and 1711 * MT_EXECUTE/MT_EXECUTE_NEVER. The other fields are left as 0 because they are 1712 * ignored by the function xlat_change_mem_attributes_ctx(). 1713 ******************************************************************************/ 1714 static unsigned int ffa_perm_to_mmap_perm(unsigned int perms) 1715 { 1716 unsigned int tf_attr = 0U; 1717 unsigned int access; 1718 1719 /* Deal with data access permissions first. */ 1720 access = (perms & FFA_MEM_PERM_DATA_MASK) >> FFA_MEM_PERM_DATA_SHIFT; 1721 1722 switch (access) { 1723 case FFA_MEM_PERM_DATA_RW: 1724 /* Return 0 if the execute is set with RW. */ 1725 if ((perms & FFA_MEM_PERM_INST_NON_EXEC) != 0) { 1726 tf_attr |= MT_RW | MT_USER | MT_EXECUTE_NEVER; 1727 } 1728 break; 1729 1730 case FFA_MEM_PERM_DATA_RO: 1731 tf_attr |= MT_RO | MT_USER; 1732 /* Deal with the instruction access permissions next. */ 1733 if ((perms & FFA_MEM_PERM_INST_NON_EXEC) == 0) { 1734 tf_attr |= MT_EXECUTE; 1735 } else { 1736 tf_attr |= MT_EXECUTE_NEVER; 1737 } 1738 break; 1739 1740 case FFA_MEM_PERM_DATA_NA: 1741 default: 1742 return tf_attr; 1743 } 1744 1745 return tf_attr; 1746 } 1747 1748 /******************************************************************************* 1749 * Handler to set the permissions of a set of contiguous pages of a S-EL0 SP 1750 ******************************************************************************/ 1751 static uint64_t ffa_mem_perm_set_handler(uint32_t smc_fid, 1752 bool secure_origin, 1753 uint64_t x1, 1754 uint64_t x2, 1755 uint64_t x3, 1756 uint64_t x4, 1757 void *cookie, 1758 void *handle, 1759 uint64_t flags) 1760 { 1761 struct secure_partition_desc *sp; 1762 unsigned int idx; 1763 uintptr_t base_va = (uintptr_t) x1; 1764 size_t size = (size_t)(x2 * PAGE_SIZE); 1765 uint32_t tf_attr; 1766 int ret; 1767 1768 /* This request cannot originate from the Normal world. */ 1769 if (!secure_origin) { 1770 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1771 } 1772 1773 if (size == 0) { 1774 return spmc_ffa_error_return(handle, 1775 FFA_ERROR_INVALID_PARAMETER); 1776 } 1777 1778 /* Get the context of the current SP. */ 1779 sp = spmc_get_current_sp_ctx(); 1780 if (sp == NULL) { 1781 return spmc_ffa_error_return(handle, 1782 FFA_ERROR_INVALID_PARAMETER); 1783 } 1784 1785 /* A S-EL1 SP has no business invoking this ABI. */ 1786 if (sp->runtime_el == S_EL1) { 1787 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1788 } 1789 1790 if ((x3 & ~((uint64_t)FFA_MEM_PERM_MASK)) != 0) { 1791 return spmc_ffa_error_return(handle, 1792 FFA_ERROR_INVALID_PARAMETER); 1793 } 1794 1795 /* Get the execution context of the calling SP. */ 1796 idx = get_ec_index(sp); 1797 1798 /* 1799 * Ensure that the S-EL0 SP is initialising itself. We do not need to 1800 * synchronise this operation through a spinlock since a S-EL0 SP is UP 1801 * and can only be initialising on this cpu. 1802 */ 1803 if (sp->ec[idx].rt_model != RT_MODEL_INIT) { 1804 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1805 } 1806 1807 VERBOSE("Setting memory permissions:\n"); 1808 VERBOSE(" Start address : 0x%lx\n", base_va); 1809 VERBOSE(" Number of pages: %lu (%zu bytes)\n", x2, size); 1810 VERBOSE(" Attributes : 0x%x\n", (uint32_t)x3); 1811 1812 /* Convert inbound permissions to TF-A permission attributes */ 1813 tf_attr = ffa_perm_to_mmap_perm((unsigned int)x3); 1814 if (tf_attr == 0U) { 1815 return spmc_ffa_error_return(handle, 1816 FFA_ERROR_INVALID_PARAMETER); 1817 } 1818 1819 /* Request the change in permissions */ 1820 ret = xlat_change_mem_attributes_ctx(sp->xlat_ctx_handle, 1821 base_va, size, tf_attr); 1822 if (ret != 0) { 1823 return spmc_ffa_error_return(handle, 1824 FFA_ERROR_INVALID_PARAMETER); 1825 } 1826 1827 SMC_RET1(handle, FFA_SUCCESS_SMC32); 1828 } 1829 1830 /******************************************************************************* 1831 * Permissions are encoded using a different format in the FFA_MEM_PERM_* ABIs 1832 * than in the Trusted Firmware, where the mmap_attr_t enum type is used. This 1833 * function converts a permission value from the mmap_attr_t format to the FF-A 1834 * format. 1835 ******************************************************************************/ 1836 static unsigned int mmap_perm_to_ffa_perm(unsigned int attr) 1837 { 1838 unsigned int perms = 0U; 1839 unsigned int data_access; 1840 1841 if ((attr & MT_USER) == 0) { 1842 /* No access from EL0. */ 1843 data_access = FFA_MEM_PERM_DATA_NA; 1844 } else { 1845 if ((attr & MT_RW) != 0) { 1846 data_access = FFA_MEM_PERM_DATA_RW; 1847 } else { 1848 data_access = FFA_MEM_PERM_DATA_RO; 1849 } 1850 } 1851 1852 perms |= (data_access & FFA_MEM_PERM_DATA_MASK) 1853 << FFA_MEM_PERM_DATA_SHIFT; 1854 1855 if ((attr & MT_EXECUTE_NEVER) != 0U) { 1856 perms |= FFA_MEM_PERM_INST_NON_EXEC; 1857 } 1858 1859 return perms; 1860 } 1861 1862 /******************************************************************************* 1863 * Handler to get the permissions of a set of contiguous pages of a S-EL0 SP 1864 ******************************************************************************/ 1865 static uint64_t ffa_mem_perm_get_handler(uint32_t smc_fid, 1866 bool secure_origin, 1867 uint64_t x1, 1868 uint64_t x2, 1869 uint64_t x3, 1870 uint64_t x4, 1871 void *cookie, 1872 void *handle, 1873 uint64_t flags) 1874 { 1875 struct secure_partition_desc *sp; 1876 unsigned int idx; 1877 uintptr_t base_va = (uintptr_t)x1; 1878 uint32_t tf_attr = 0; 1879 int ret; 1880 1881 /* This request cannot originate from the Normal world. */ 1882 if (!secure_origin) { 1883 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1884 } 1885 1886 /* Get the context of the current SP. */ 1887 sp = spmc_get_current_sp_ctx(); 1888 if (sp == NULL) { 1889 return spmc_ffa_error_return(handle, 1890 FFA_ERROR_INVALID_PARAMETER); 1891 } 1892 1893 /* A S-EL1 SP has no business invoking this ABI. */ 1894 if (sp->runtime_el == S_EL1) { 1895 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1896 } 1897 1898 /* Get the execution context of the calling SP. */ 1899 idx = get_ec_index(sp); 1900 1901 /* 1902 * Ensure that the S-EL0 SP is initialising itself. We do not need to 1903 * synchronise this operation through a spinlock since a S-EL0 SP is UP 1904 * and can only be initialising on this cpu. 1905 */ 1906 if (sp->ec[idx].rt_model != RT_MODEL_INIT) { 1907 return spmc_ffa_error_return(handle, FFA_ERROR_DENIED); 1908 } 1909 1910 /* Request the permissions */ 1911 ret = xlat_get_mem_attributes_ctx(sp->xlat_ctx_handle, base_va, &tf_attr); 1912 if (ret != 0) { 1913 return spmc_ffa_error_return(handle, 1914 FFA_ERROR_INVALID_PARAMETER); 1915 } 1916 1917 /* Convert TF-A permission to FF-A permissions attributes. */ 1918 x2 = mmap_perm_to_ffa_perm(tf_attr); 1919 1920 SMC_RET3(handle, FFA_SUCCESS_SMC32, 0, x2); 1921 } 1922 1923 /******************************************************************************* 1924 * This function will parse the Secure Partition Manifest. From manifest, it 1925 * will fetch details for preparing Secure partition image context and secure 1926 * partition image boot arguments if any. 1927 ******************************************************************************/ 1928 static int sp_manifest_parse(void *sp_manifest, int offset, 1929 struct secure_partition_desc *sp, 1930 entry_point_info_t *ep_info, 1931 int32_t *boot_info_reg) 1932 { 1933 int32_t ret, node; 1934 uint32_t config_32; 1935 1936 /* 1937 * Look for the mandatory fields that are expected to be present in 1938 * the SP manifests. 1939 */ 1940 node = fdt_path_offset(sp_manifest, "/"); 1941 if (node < 0) { 1942 ERROR("Did not find root node.\n"); 1943 return node; 1944 } 1945 1946 ret = fdt_read_uint32_array(sp_manifest, node, "uuid", 1947 ARRAY_SIZE(sp->uuid), sp->uuid); 1948 if (ret != 0) { 1949 ERROR("Missing Secure Partition UUID.\n"); 1950 return ret; 1951 } 1952 1953 ret = fdt_read_uint32(sp_manifest, node, "exception-level", &config_32); 1954 if (ret != 0) { 1955 ERROR("Missing SP Exception Level information.\n"); 1956 return ret; 1957 } 1958 1959 sp->runtime_el = config_32; 1960 1961 ret = fdt_read_uint32(sp_manifest, node, "ffa-version", &config_32); 1962 if (ret != 0) { 1963 ERROR("Missing Secure Partition FF-A Version.\n"); 1964 return ret; 1965 } 1966 1967 sp->ffa_version = config_32; 1968 1969 ret = fdt_read_uint32(sp_manifest, node, "execution-state", &config_32); 1970 if (ret != 0) { 1971 ERROR("Missing Secure Partition Execution State.\n"); 1972 return ret; 1973 } 1974 1975 sp->execution_state = config_32; 1976 1977 ret = fdt_read_uint32(sp_manifest, node, 1978 "messaging-method", &config_32); 1979 if (ret != 0) { 1980 ERROR("Missing Secure Partition messaging method.\n"); 1981 return ret; 1982 } 1983 1984 /* Validate this entry, we currently only support direct messaging. */ 1985 if ((config_32 & ~(FFA_PARTITION_DIRECT_REQ_RECV | 1986 FFA_PARTITION_DIRECT_REQ_SEND | 1987 FFA_PARTITION_DIRECT_REQ2_RECV | 1988 FFA_PARTITION_DIRECT_REQ2_SEND)) != 0U) { 1989 WARN("Invalid Secure Partition messaging method (0x%x)\n", 1990 config_32); 1991 return -EINVAL; 1992 } 1993 1994 sp->properties = config_32; 1995 1996 ret = fdt_read_uint32(sp_manifest, node, 1997 "execution-ctx-count", &config_32); 1998 1999 if (ret != 0) { 2000 ERROR("Missing SP Execution Context Count.\n"); 2001 return ret; 2002 } 2003 2004 /* 2005 * Ensure this field is set correctly in the manifest however 2006 * since this is currently a hardcoded value for S-EL1 partitions 2007 * we don't need to save it here, just validate. 2008 */ 2009 if ((sp->runtime_el == S_EL1) && (config_32 != PLATFORM_CORE_COUNT)) { 2010 ERROR("SP Execution Context Count (%u) must be %u.\n", 2011 config_32, PLATFORM_CORE_COUNT); 2012 return -EINVAL; 2013 } 2014 2015 /* 2016 * Look for the optional fields that are expected to be present in 2017 * an SP manifest. 2018 */ 2019 ret = fdt_read_uint32(sp_manifest, node, "id", &config_32); 2020 if (ret != 0) { 2021 WARN("Missing Secure Partition ID.\n"); 2022 } else { 2023 if (!is_ffa_secure_id_valid(config_32)) { 2024 ERROR("Invalid Secure Partition ID (0x%x).\n", 2025 config_32); 2026 return -EINVAL; 2027 } 2028 sp->sp_id = config_32; 2029 } 2030 2031 ret = fdt_read_uint32(sp_manifest, node, 2032 "power-management-messages", &config_32); 2033 if (ret != 0) { 2034 WARN("Missing Power Management Messages entry.\n"); 2035 } else { 2036 if ((sp->runtime_el == S_EL0) && (config_32 != 0)) { 2037 ERROR("Power messages not supported for S-EL0 SP\n"); 2038 return -EINVAL; 2039 } 2040 2041 /* 2042 * Ensure only the currently supported power messages have 2043 * been requested. 2044 */ 2045 if (config_32 & ~(FFA_PM_MSG_SUB_CPU_OFF | 2046 FFA_PM_MSG_SUB_CPU_SUSPEND | 2047 FFA_PM_MSG_SUB_CPU_SUSPEND_RESUME)) { 2048 ERROR("Requested unsupported PM messages (%x)\n", 2049 config_32); 2050 return -EINVAL; 2051 } 2052 sp->pwr_mgmt_msgs = config_32; 2053 } 2054 2055 ret = fdt_read_uint32(sp_manifest, node, 2056 "gp-register-num", &config_32); 2057 if (ret != 0) { 2058 WARN("Missing boot information register.\n"); 2059 } else { 2060 /* Check if a register number between 0-3 is specified. */ 2061 if (config_32 < 4) { 2062 *boot_info_reg = config_32; 2063 } else { 2064 WARN("Incorrect boot information register (%u).\n", 2065 config_32); 2066 } 2067 } 2068 2069 return 0; 2070 } 2071 2072 /******************************************************************************* 2073 * This function gets the Secure Partition Manifest base and maps the manifest 2074 * region. 2075 * Currently only one Secure Partition manifest is considered which is used to 2076 * prepare the context for the single Secure Partition. 2077 ******************************************************************************/ 2078 static int find_and_prepare_sp_context(void) 2079 { 2080 void *sp_manifest; 2081 uintptr_t manifest_base; 2082 uintptr_t manifest_base_align; 2083 entry_point_info_t *next_image_ep_info; 2084 int32_t ret, boot_info_reg = -1; 2085 struct secure_partition_desc *sp; 2086 2087 next_image_ep_info = bl31_plat_get_next_image_ep_info(SECURE); 2088 if (next_image_ep_info == NULL) { 2089 WARN("No Secure Partition image provided by BL2.\n"); 2090 return -ENOENT; 2091 } 2092 2093 sp_manifest = (void *)next_image_ep_info->args.arg0; 2094 if (sp_manifest == NULL) { 2095 WARN("Secure Partition manifest absent.\n"); 2096 return -ENOENT; 2097 } 2098 2099 manifest_base = (uintptr_t)sp_manifest; 2100 manifest_base_align = page_align(manifest_base, DOWN); 2101 2102 /* 2103 * Map the secure partition manifest region in the EL3 translation 2104 * regime. 2105 * Map an area equal to (2 * PAGE_SIZE) for now. During manifest base 2106 * alignment the region of 1 PAGE_SIZE from manifest align base may 2107 * not completely accommodate the secure partition manifest region. 2108 */ 2109 ret = mmap_add_dynamic_region((unsigned long long)manifest_base_align, 2110 manifest_base_align, 2111 PAGE_SIZE * 2, 2112 MT_RO_DATA); 2113 if (ret != 0) { 2114 ERROR("Error while mapping SP manifest (%d).\n", ret); 2115 return ret; 2116 } 2117 2118 ret = fdt_node_offset_by_compatible(sp_manifest, -1, 2119 "arm,ffa-manifest-1.0"); 2120 if (ret < 0) { 2121 ERROR("Error happened in SP manifest reading.\n"); 2122 return -EINVAL; 2123 } 2124 2125 /* 2126 * Store the size of the manifest so that it can be used later to pass 2127 * the manifest as boot information later. 2128 */ 2129 next_image_ep_info->args.arg1 = fdt_totalsize(sp_manifest); 2130 INFO("Manifest adr = %lx , size = %lu bytes\n", manifest_base, 2131 next_image_ep_info->args.arg1); 2132 2133 /* 2134 * Select an SP descriptor for initialising the partition's execution 2135 * context on the primary CPU. 2136 */ 2137 sp = spmc_get_current_sp_ctx(); 2138 2139 #if SPMC_AT_EL3_SEL0_SP 2140 /* Assign translation tables context. */ 2141 sp_desc->xlat_ctx_handle = spm_get_sp_xlat_context(); 2142 2143 #endif /* SPMC_AT_EL3_SEL0_SP */ 2144 /* Initialize entry point information for the SP */ 2145 SET_PARAM_HEAD(next_image_ep_info, PARAM_EP, VERSION_1, 2146 SECURE | EP_ST_ENABLE); 2147 2148 /* Parse the SP manifest. */ 2149 ret = sp_manifest_parse(sp_manifest, ret, sp, next_image_ep_info, 2150 &boot_info_reg); 2151 if (ret != 0) { 2152 ERROR("Error in Secure Partition manifest parsing.\n"); 2153 return ret; 2154 } 2155 2156 /* Perform any common initialisation. */ 2157 spmc_sp_common_setup(sp, next_image_ep_info, boot_info_reg); 2158 2159 /* Perform any initialisation specific to S-EL1 SPs. */ 2160 if (sp->runtime_el == S_EL1) { 2161 spmc_el1_sp_setup(sp, next_image_ep_info); 2162 spmc_sp_common_ep_commit(sp, next_image_ep_info); 2163 } 2164 #if SPMC_AT_EL3_SEL0_SP 2165 /* Perform any initialisation specific to S-EL0 SPs. */ 2166 else if (sp->runtime_el == S_EL0) { 2167 /* Setup spsr in endpoint info for common context management routine. */ 2168 spmc_el0_sp_spsr_setup(next_image_ep_info); 2169 2170 spmc_sp_common_ep_commit(sp, next_image_ep_info); 2171 2172 /* 2173 * Perform any initialisation specific to S-EL0 not set by common 2174 * context management routine. 2175 */ 2176 spmc_el0_sp_setup(sp, boot_info_reg, sp_manifest); 2177 } 2178 #endif /* SPMC_AT_EL3_SEL0_SP */ 2179 else { 2180 ERROR("Unexpected runtime EL: %u\n", sp->runtime_el); 2181 return -EINVAL; 2182 } 2183 2184 return 0; 2185 } 2186 2187 /******************************************************************************* 2188 * This function takes an SP context pointer and performs a synchronous entry 2189 * into it. 2190 ******************************************************************************/ 2191 static int32_t logical_sp_init(void) 2192 { 2193 int32_t rc = 0; 2194 struct el3_lp_desc *el3_lp_descs; 2195 2196 /* Perform initial validation of the Logical Partitions. */ 2197 rc = el3_sp_desc_validate(); 2198 if (rc != 0) { 2199 ERROR("Logical Partition validation failed!\n"); 2200 return rc; 2201 } 2202 2203 el3_lp_descs = get_el3_lp_array(); 2204 2205 INFO("Logical Secure Partition init start.\n"); 2206 for (unsigned int i = 0U; i < EL3_LP_DESCS_COUNT; i++) { 2207 rc = el3_lp_descs[i].init(); 2208 if (rc != 0) { 2209 ERROR("Logical SP (0x%x) Failed to Initialize\n", 2210 el3_lp_descs[i].sp_id); 2211 return rc; 2212 } 2213 VERBOSE("Logical SP (0x%x) Initialized\n", 2214 el3_lp_descs[i].sp_id); 2215 } 2216 2217 INFO("Logical Secure Partition init completed.\n"); 2218 2219 return rc; 2220 } 2221 2222 uint64_t spmc_sp_synchronous_entry(struct sp_exec_ctx *ec) 2223 { 2224 uint64_t rc; 2225 2226 assert(ec != NULL); 2227 2228 /* Assign the context of the SP to this CPU */ 2229 cm_set_context(&(ec->cpu_ctx), SECURE); 2230 2231 /* Restore the context assigned above */ 2232 cm_el1_sysregs_context_restore(SECURE); 2233 cm_set_next_eret_context(SECURE); 2234 2235 /* Invalidate TLBs at EL1. */ 2236 tlbivmalle1(); 2237 dsbish(); 2238 2239 /* Enter Secure Partition */ 2240 rc = spm_secure_partition_enter(&ec->c_rt_ctx); 2241 2242 /* Save secure state */ 2243 cm_el1_sysregs_context_save(SECURE); 2244 2245 return rc; 2246 } 2247 2248 /******************************************************************************* 2249 * SPMC Helper Functions. 2250 ******************************************************************************/ 2251 static int32_t sp_init(void) 2252 { 2253 uint64_t rc; 2254 struct secure_partition_desc *sp; 2255 struct sp_exec_ctx *ec; 2256 2257 sp = spmc_get_current_sp_ctx(); 2258 ec = spmc_get_sp_ec(sp); 2259 ec->rt_model = RT_MODEL_INIT; 2260 ec->rt_state = RT_STATE_RUNNING; 2261 2262 INFO("Secure Partition (0x%x) init start.\n", sp->sp_id); 2263 2264 rc = spmc_sp_synchronous_entry(ec); 2265 if (rc != 0) { 2266 /* Indicate SP init was not successful. */ 2267 ERROR("SP (0x%x) failed to initialize (%lu).\n", 2268 sp->sp_id, rc); 2269 return 0; 2270 } 2271 2272 ec->rt_state = RT_STATE_WAITING; 2273 INFO("Secure Partition initialized.\n"); 2274 2275 return 1; 2276 } 2277 2278 static void initalize_sp_descs(void) 2279 { 2280 struct secure_partition_desc *sp; 2281 2282 for (unsigned int i = 0U; i < SECURE_PARTITION_COUNT; i++) { 2283 sp = &sp_desc[i]; 2284 sp->sp_id = INV_SP_ID; 2285 sp->mailbox.rx_buffer = NULL; 2286 sp->mailbox.tx_buffer = NULL; 2287 sp->mailbox.state = MAILBOX_STATE_EMPTY; 2288 sp->secondary_ep = 0; 2289 } 2290 } 2291 2292 static void initalize_ns_ep_descs(void) 2293 { 2294 struct ns_endpoint_desc *ns_ep; 2295 2296 for (unsigned int i = 0U; i < NS_PARTITION_COUNT; i++) { 2297 ns_ep = &ns_ep_desc[i]; 2298 /* 2299 * Clashes with the Hypervisor ID but will not be a 2300 * problem in practice. 2301 */ 2302 ns_ep->ns_ep_id = 0; 2303 ns_ep->ffa_version = 0; 2304 ns_ep->mailbox.rx_buffer = NULL; 2305 ns_ep->mailbox.tx_buffer = NULL; 2306 ns_ep->mailbox.state = MAILBOX_STATE_EMPTY; 2307 } 2308 } 2309 2310 /******************************************************************************* 2311 * Initialize SPMC attributes for the SPMD. 2312 ******************************************************************************/ 2313 void spmc_populate_attrs(spmc_manifest_attribute_t *spmc_attrs) 2314 { 2315 spmc_attrs->major_version = FFA_VERSION_MAJOR; 2316 spmc_attrs->minor_version = FFA_VERSION_MINOR; 2317 spmc_attrs->exec_state = MODE_RW_64; 2318 spmc_attrs->spmc_id = FFA_SPMC_ID; 2319 } 2320 2321 /******************************************************************************* 2322 * Initialize contexts of all Secure Partitions. 2323 ******************************************************************************/ 2324 int32_t spmc_setup(void) 2325 { 2326 int32_t ret; 2327 uint32_t flags; 2328 2329 /* Initialize endpoint descriptors */ 2330 initalize_sp_descs(); 2331 initalize_ns_ep_descs(); 2332 2333 /* 2334 * Retrieve the information of the datastore for tracking shared memory 2335 * requests allocated by platform code and zero the region if available. 2336 */ 2337 ret = plat_spmc_shmem_datastore_get(&spmc_shmem_obj_state.data, 2338 &spmc_shmem_obj_state.data_size); 2339 if (ret != 0) { 2340 ERROR("Failed to obtain memory descriptor backing store!\n"); 2341 return ret; 2342 } 2343 memset(spmc_shmem_obj_state.data, 0, spmc_shmem_obj_state.data_size); 2344 2345 /* Setup logical SPs. */ 2346 ret = logical_sp_init(); 2347 if (ret != 0) { 2348 ERROR("Failed to initialize Logical Partitions.\n"); 2349 return ret; 2350 } 2351 2352 /* Perform physical SP setup. */ 2353 2354 /* Disable MMU at EL1 (initialized by BL2) */ 2355 disable_mmu_icache_el1(); 2356 2357 /* Initialize context of the SP */ 2358 INFO("Secure Partition context setup start.\n"); 2359 2360 ret = find_and_prepare_sp_context(); 2361 if (ret != 0) { 2362 ERROR("Error in SP finding and context preparation.\n"); 2363 return ret; 2364 } 2365 2366 /* Register power management hooks with PSCI */ 2367 psci_register_spd_pm_hook(&spmc_pm); 2368 2369 /* 2370 * Register an interrupt handler for S-EL1 interrupts 2371 * when generated during code executing in the 2372 * non-secure state. 2373 */ 2374 flags = 0; 2375 set_interrupt_rm_flag(flags, NON_SECURE); 2376 ret = register_interrupt_type_handler(INTR_TYPE_S_EL1, 2377 spmc_sp_interrupt_handler, 2378 flags); 2379 if (ret != 0) { 2380 ERROR("Failed to register interrupt handler! (%d)\n", ret); 2381 panic(); 2382 } 2383 2384 /* Register init function for deferred init. */ 2385 bl31_register_bl32_init(&sp_init); 2386 2387 INFO("Secure Partition setup done.\n"); 2388 2389 return 0; 2390 } 2391 2392 /******************************************************************************* 2393 * Secure Partition Manager SMC handler. 2394 ******************************************************************************/ 2395 uint64_t spmc_smc_handler(uint32_t smc_fid, 2396 bool secure_origin, 2397 uint64_t x1, 2398 uint64_t x2, 2399 uint64_t x3, 2400 uint64_t x4, 2401 void *cookie, 2402 void *handle, 2403 uint64_t flags) 2404 { 2405 switch (smc_fid) { 2406 2407 case FFA_VERSION: 2408 return ffa_version_handler(smc_fid, secure_origin, x1, x2, x3, 2409 x4, cookie, handle, flags); 2410 2411 case FFA_SPM_ID_GET: 2412 return ffa_spm_id_get_handler(smc_fid, secure_origin, x1, x2, 2413 x3, x4, cookie, handle, flags); 2414 2415 case FFA_ID_GET: 2416 return ffa_id_get_handler(smc_fid, secure_origin, x1, x2, x3, 2417 x4, cookie, handle, flags); 2418 2419 case FFA_FEATURES: 2420 return ffa_features_handler(smc_fid, secure_origin, x1, x2, x3, 2421 x4, cookie, handle, flags); 2422 2423 case FFA_SECONDARY_EP_REGISTER_SMC64: 2424 return ffa_sec_ep_register_handler(smc_fid, secure_origin, x1, 2425 x2, x3, x4, cookie, handle, 2426 flags); 2427 2428 case FFA_MSG_SEND_DIRECT_REQ_SMC32: 2429 case FFA_MSG_SEND_DIRECT_REQ_SMC64: 2430 case FFA_MSG_SEND_DIRECT_REQ2_SMC64: 2431 return direct_req_smc_handler(smc_fid, secure_origin, x1, x2, 2432 x3, x4, cookie, handle, flags); 2433 2434 case FFA_MSG_SEND_DIRECT_RESP_SMC32: 2435 case FFA_MSG_SEND_DIRECT_RESP_SMC64: 2436 case FFA_MSG_SEND_DIRECT_RESP2_SMC64: 2437 return direct_resp_smc_handler(smc_fid, secure_origin, x1, x2, 2438 x3, x4, cookie, handle, flags); 2439 2440 case FFA_RXTX_MAP_SMC32: 2441 case FFA_RXTX_MAP_SMC64: 2442 return rxtx_map_handler(smc_fid, secure_origin, x1, x2, x3, x4, 2443 cookie, handle, flags); 2444 2445 case FFA_RXTX_UNMAP: 2446 return rxtx_unmap_handler(smc_fid, secure_origin, x1, x2, x3, 2447 x4, cookie, handle, flags); 2448 2449 case FFA_PARTITION_INFO_GET: 2450 return partition_info_get_handler(smc_fid, secure_origin, x1, 2451 x2, x3, x4, cookie, handle, 2452 flags); 2453 2454 case FFA_RX_RELEASE: 2455 return rx_release_handler(smc_fid, secure_origin, x1, x2, x3, 2456 x4, cookie, handle, flags); 2457 2458 case FFA_MSG_WAIT: 2459 return msg_wait_handler(smc_fid, secure_origin, x1, x2, x3, x4, 2460 cookie, handle, flags); 2461 2462 case FFA_ERROR: 2463 return ffa_error_handler(smc_fid, secure_origin, x1, x2, x3, x4, 2464 cookie, handle, flags); 2465 2466 case FFA_MSG_RUN: 2467 return ffa_run_handler(smc_fid, secure_origin, x1, x2, x3, x4, 2468 cookie, handle, flags); 2469 2470 case FFA_MEM_SHARE_SMC32: 2471 case FFA_MEM_SHARE_SMC64: 2472 case FFA_MEM_LEND_SMC32: 2473 case FFA_MEM_LEND_SMC64: 2474 return spmc_ffa_mem_send(smc_fid, secure_origin, x1, x2, x3, x4, 2475 cookie, handle, flags); 2476 2477 case FFA_MEM_FRAG_TX: 2478 return spmc_ffa_mem_frag_tx(smc_fid, secure_origin, x1, x2, x3, 2479 x4, cookie, handle, flags); 2480 2481 case FFA_MEM_FRAG_RX: 2482 return spmc_ffa_mem_frag_rx(smc_fid, secure_origin, x1, x2, x3, 2483 x4, cookie, handle, flags); 2484 2485 case FFA_MEM_RETRIEVE_REQ_SMC32: 2486 case FFA_MEM_RETRIEVE_REQ_SMC64: 2487 return spmc_ffa_mem_retrieve_req(smc_fid, secure_origin, x1, x2, 2488 x3, x4, cookie, handle, flags); 2489 2490 case FFA_MEM_RELINQUISH: 2491 return spmc_ffa_mem_relinquish(smc_fid, secure_origin, x1, x2, 2492 x3, x4, cookie, handle, flags); 2493 2494 case FFA_MEM_RECLAIM: 2495 return spmc_ffa_mem_reclaim(smc_fid, secure_origin, x1, x2, x3, 2496 x4, cookie, handle, flags); 2497 case FFA_CONSOLE_LOG_SMC32: 2498 case FFA_CONSOLE_LOG_SMC64: 2499 return spmc_ffa_console_log(smc_fid, secure_origin, x1, x2, x3, 2500 x4, cookie, handle, flags); 2501 2502 case FFA_MEM_PERM_GET_SMC32: 2503 case FFA_MEM_PERM_GET_SMC64: 2504 return ffa_mem_perm_get_handler(smc_fid, secure_origin, x1, x2, 2505 x3, x4, cookie, handle, flags); 2506 2507 case FFA_MEM_PERM_SET_SMC32: 2508 case FFA_MEM_PERM_SET_SMC64: 2509 return ffa_mem_perm_set_handler(smc_fid, secure_origin, x1, x2, 2510 x3, x4, cookie, handle, flags); 2511 2512 default: 2513 WARN("Unsupported FF-A call 0x%08x.\n", smc_fid); 2514 break; 2515 } 2516 return spmc_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 2517 } 2518 2519 /******************************************************************************* 2520 * This function is the handler registered for S-EL1 interrupts by the SPMC. It 2521 * validates the interrupt and upon success arranges entry into the SP for 2522 * handling the interrupt. 2523 ******************************************************************************/ 2524 static uint64_t spmc_sp_interrupt_handler(uint32_t id, 2525 uint32_t flags, 2526 void *handle, 2527 void *cookie) 2528 { 2529 struct secure_partition_desc *sp = spmc_get_current_sp_ctx(); 2530 struct sp_exec_ctx *ec; 2531 uint32_t linear_id = plat_my_core_pos(); 2532 2533 /* Sanity check for a NULL pointer dereference. */ 2534 assert(sp != NULL); 2535 2536 /* Check the security state when the exception was generated. */ 2537 assert(get_interrupt_src_ss(flags) == NON_SECURE); 2538 2539 /* Panic if not an S-EL1 Partition. */ 2540 if (sp->runtime_el != S_EL1) { 2541 ERROR("Interrupt received for a non S-EL1 SP on core%u.\n", 2542 linear_id); 2543 panic(); 2544 } 2545 2546 /* Obtain a reference to the SP execution context. */ 2547 ec = spmc_get_sp_ec(sp); 2548 2549 /* Ensure that the execution context is in waiting state else panic. */ 2550 if (ec->rt_state != RT_STATE_WAITING) { 2551 ERROR("SP EC on core%u is not waiting (%u), it is (%u).\n", 2552 linear_id, RT_STATE_WAITING, ec->rt_state); 2553 panic(); 2554 } 2555 2556 /* Update the runtime model and state of the partition. */ 2557 ec->rt_model = RT_MODEL_INTR; 2558 ec->rt_state = RT_STATE_RUNNING; 2559 2560 VERBOSE("SP (0x%x) interrupt start on core%u.\n", sp->sp_id, linear_id); 2561 2562 /* 2563 * Forward the interrupt to the S-EL1 SP. The interrupt ID is not 2564 * populated as the SP can determine this by itself. 2565 * The flags field is forced to 0 mainly to pass the SVE hint bit 2566 * cleared for consumption by the lower EL. 2567 */ 2568 return spmd_smc_switch_state(FFA_INTERRUPT, false, 2569 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 2570 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 2571 handle, 0ULL); 2572 } 2573