1 /* 2 * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <string.h> 10 11 #include <arch_helpers.h> 12 #include <bl31/bl31.h> 13 #include <common/debug.h> 14 #include <common/runtime_svc.h> 15 #include <lib/el3_runtime/context_mgmt.h> 16 #include <lib/smccc.h> 17 #include <lib/spinlock.h> 18 #include <lib/utils.h> 19 #include <lib/xlat_tables/xlat_tables_v2.h> 20 #include <plat/common/common_def.h> 21 #include <plat/common/platform.h> 22 #include <platform_def.h> 23 #include <services/spci_svc.h> 24 #include <services/spmd_svc.h> 25 #include <smccc_helpers.h> 26 #include "spmd_private.h" 27 28 /******************************************************************************* 29 * SPM Core context information. 30 ******************************************************************************/ 31 spmd_spm_core_context_t spm_core_context[PLATFORM_CORE_COUNT]; 32 33 /******************************************************************************* 34 * SPM Core attribute information read from its manifest. 35 ******************************************************************************/ 36 static spmc_manifest_sect_attribute_t spmc_attrs; 37 38 /******************************************************************************* 39 * SPM Core entry point information. Discovered on the primary core and reused 40 * on secondary cores. 41 ******************************************************************************/ 42 static entry_point_info_t *spmc_ep_info; 43 44 /******************************************************************************* 45 * Static function declaration. 46 ******************************************************************************/ 47 static int32_t spmd_init(void); 48 static int spmd_spmc_init(void *rd_base, size_t rd_size); 49 static uint64_t spmd_spci_error_return(void *handle, int error_code); 50 static uint64_t spmd_smc_forward(uint32_t smc_fid, uint32_t in_sstate, 51 uint32_t out_sstate, uint64_t x1, 52 uint64_t x2, uint64_t x3, uint64_t x4, 53 void *handle); 54 55 /******************************************************************************* 56 * This function takes an SP context pointer and performs a synchronous entry 57 * into it. 58 ******************************************************************************/ 59 uint64_t spmd_spm_core_sync_entry(spmd_spm_core_context_t *spmc_ctx) 60 { 61 uint64_t rc; 62 63 assert(spmc_ctx != NULL); 64 65 cm_set_context(&(spmc_ctx->cpu_ctx), SECURE); 66 67 /* Restore the context assigned above */ 68 cm_el1_sysregs_context_restore(SECURE); 69 cm_el2_sysregs_context_restore(SECURE); 70 cm_set_next_eret_context(SECURE); 71 72 /* Invalidate TLBs at EL1. */ 73 tlbivmalle1(); 74 dsbish(); 75 76 /* Enter Secure Partition */ 77 rc = spmd_spm_core_enter(&spmc_ctx->c_rt_ctx); 78 79 /* Save secure state */ 80 cm_el1_sysregs_context_save(SECURE); 81 cm_el2_sysregs_context_save(SECURE); 82 83 return rc; 84 } 85 86 /******************************************************************************* 87 * This function returns to the place where spm_sp_synchronous_entry() was 88 * called originally. 89 ******************************************************************************/ 90 __dead2 void spmd_spm_core_sync_exit(uint64_t rc) 91 { 92 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 93 94 /* Get context of the SP in use by this CPU. */ 95 assert(cm_get_context(SECURE) == &(ctx->cpu_ctx)); 96 97 /* 98 * The SPMD must have initiated the original request through a 99 * synchronous entry into SPMC. Jump back to the original C runtime 100 * context with the value of rc in x0; 101 */ 102 spmd_spm_core_exit(ctx->c_rt_ctx, rc); 103 104 panic(); 105 } 106 107 /******************************************************************************* 108 * Jump to the SPM core for the first time. 109 ******************************************************************************/ 110 static int32_t spmd_init(void) 111 { 112 uint64_t rc = 0; 113 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 114 115 INFO("SPM Core init start.\n"); 116 ctx->state = SPMC_STATE_RESET; 117 118 rc = spmd_spm_core_sync_entry(ctx); 119 if (rc) { 120 ERROR("SPMC initialisation failed 0x%llx\n", rc); 121 panic(); 122 } 123 124 ctx->state = SPMC_STATE_IDLE; 125 INFO("SPM Core init end.\n"); 126 127 return 1; 128 } 129 130 /******************************************************************************* 131 * Load SPMC manifest, init SPMC. 132 ******************************************************************************/ 133 static int spmd_spmc_init(void *rd_base, size_t rd_size) 134 { 135 int rc; 136 uint32_t ep_attr; 137 unsigned int linear_id = plat_my_core_pos(); 138 spmd_spm_core_context_t *spm_ctx = &spm_core_context[linear_id]; 139 140 /* Load the SPM core manifest */ 141 rc = plat_spm_core_manifest_load(&spmc_attrs, rd_base, rd_size); 142 if (rc != 0) { 143 WARN("No or invalid SPM core manifest image provided by BL2 " 144 "boot loader. "); 145 return 1; 146 } 147 148 /* 149 * Ensure that the SPM core version is compatible with the SPM 150 * dispatcher version 151 */ 152 if ((spmc_attrs.major_version != SPCI_VERSION_MAJOR) || 153 (spmc_attrs.minor_version > SPCI_VERSION_MINOR)) { 154 WARN("Unsupported SPCI version (%x.%x) specified in SPM core " 155 "manifest image provided by BL2 boot loader.\n", 156 spmc_attrs.major_version, spmc_attrs.minor_version); 157 return 1; 158 } 159 160 INFO("SPCI version (%x.%x).\n", spmc_attrs.major_version, 161 spmc_attrs.minor_version); 162 163 /* Validate the SPM core runtime EL */ 164 if ((spmc_attrs.runtime_el != MODE_EL1) && 165 (spmc_attrs.runtime_el != MODE_EL2)) { 166 WARN("Unsupported SPM core run time EL%x specified in " 167 "manifest image provided by BL2 boot loader.\n", 168 spmc_attrs.runtime_el); 169 return 1; 170 } 171 172 INFO("SPM core run time EL%x.\n", spmc_attrs.runtime_el); 173 174 /* Validate the SPM core execution state */ 175 if ((spmc_attrs.exec_state != MODE_RW_64) && 176 (spmc_attrs.exec_state != MODE_RW_32)) { 177 WARN("Unsupported SPM core execution state %x specified in " 178 "manifest image provided by BL2 boot loader.\n", 179 spmc_attrs.exec_state); 180 return 1; 181 } 182 183 INFO("SPM core execution state %x.\n", spmc_attrs.exec_state); 184 185 /* Ensure manifest has not requested S-EL2 in AArch32 state */ 186 if ((spmc_attrs.exec_state == MODE_RW_32) && 187 (spmc_attrs.runtime_el == MODE_EL2)) { 188 WARN("Invalid combination of SPM core execution state (%x) " 189 "and run time EL (%x).\n", spmc_attrs.exec_state, 190 spmc_attrs.runtime_el); 191 return 1; 192 } 193 194 /* 195 * Check if S-EL2 is supported on this system if S-EL2 196 * is required for SPM 197 */ 198 if (spmc_attrs.runtime_el == MODE_EL2) { 199 uint64_t sel2 = read_id_aa64pfr0_el1(); 200 201 sel2 >>= ID_AA64PFR0_SEL2_SHIFT; 202 sel2 &= ID_AA64PFR0_SEL2_MASK; 203 204 if (!sel2) { 205 WARN("SPM core run time EL: S-EL%x is not supported " 206 "but specified in manifest image provided by " 207 "BL2 boot loader.\n", spmc_attrs.runtime_el); 208 return 1; 209 } 210 } 211 212 /* Initialise an entrypoint to set up the CPU context */ 213 ep_attr = SECURE | EP_ST_ENABLE; 214 if (read_sctlr_el3() & SCTLR_EE_BIT) { 215 ep_attr |= EP_EE_BIG; 216 } 217 218 SET_PARAM_HEAD(spmc_ep_info, PARAM_EP, VERSION_1, ep_attr); 219 assert(spmc_ep_info->pc == BL32_BASE); 220 221 /* 222 * Populate SPSR for SPM core based upon validated parameters from the 223 * manifest 224 */ 225 if (spmc_attrs.exec_state == MODE_RW_32) { 226 spmc_ep_info->spsr = SPSR_MODE32(MODE32_svc, SPSR_T_ARM, 227 SPSR_E_LITTLE, 228 DAIF_FIQ_BIT | 229 DAIF_IRQ_BIT | 230 DAIF_ABT_BIT); 231 } else { 232 spmc_ep_info->spsr = SPSR_64(spmc_attrs.runtime_el, 233 MODE_SP_ELX, 234 DISABLE_ALL_EXCEPTIONS); 235 } 236 237 /* Initialise SPM core context with this entry point information */ 238 cm_setup_context(&spm_ctx->cpu_ctx, spmc_ep_info); 239 240 /* Reuse PSCI affinity states to mark this SPMC context as off */ 241 spm_ctx->state = AFF_STATE_OFF; 242 243 INFO("SPM core setup done.\n"); 244 245 /* Register init function for deferred init. */ 246 bl31_register_bl32_init(&spmd_init); 247 248 return 0; 249 } 250 251 /******************************************************************************* 252 * Initialize context of SPM core. 253 ******************************************************************************/ 254 int spmd_setup(void) 255 { 256 int rc; 257 void *rd_base; 258 size_t rd_size; 259 uintptr_t rd_base_align; 260 uintptr_t rd_size_align; 261 262 spmc_ep_info = bl31_plat_get_next_image_ep_info(SECURE); 263 if (!spmc_ep_info) { 264 WARN("No SPM core image provided by BL2 boot loader, Booting " 265 "device without SP initialization. SMC`s destined for SPM " 266 "core will return SMC_UNK\n"); 267 return 1; 268 } 269 270 /* Under no circumstances will this parameter be 0 */ 271 assert(spmc_ep_info->pc != 0U); 272 273 /* 274 * Check if BL32 ep_info has a reference to 'tos_fw_config'. This will 275 * be used as a manifest for the SPM core at the next lower EL/mode. 276 */ 277 if (spmc_ep_info->args.arg0 == 0U || spmc_ep_info->args.arg2 == 0U) { 278 ERROR("Invalid or absent SPM core manifest\n"); 279 panic(); 280 } 281 282 /* Obtain whereabouts of SPM core manifest */ 283 rd_base = (void *) spmc_ep_info->args.arg0; 284 rd_size = spmc_ep_info->args.arg2; 285 286 rd_base_align = page_align((uintptr_t) rd_base, DOWN); 287 rd_size_align = page_align((uintptr_t) rd_size, UP); 288 289 /* Map the manifest in the SPMD translation regime first */ 290 VERBOSE("SPM core manifest base : 0x%lx\n", rd_base_align); 291 VERBOSE("SPM core manifest size : 0x%lx\n", rd_size_align); 292 rc = mmap_add_dynamic_region((unsigned long long) rd_base_align, 293 (uintptr_t) rd_base_align, 294 rd_size_align, 295 MT_RO_DATA); 296 if (rc != 0) { 297 ERROR("Error while mapping SPM core manifest (%d).\n", rc); 298 panic(); 299 } 300 301 /* Load manifest, init SPMC */ 302 rc = spmd_spmc_init(rd_base, rd_size); 303 if (rc != 0) { 304 int mmap_rc; 305 306 WARN("Booting device without SPM initialization. " 307 "SPCI SMCs destined for SPM core will return " 308 "ENOTSUPPORTED\n"); 309 310 mmap_rc = mmap_remove_dynamic_region(rd_base_align, 311 rd_size_align); 312 if (mmap_rc != 0) { 313 ERROR("Error while unmapping SPM core manifest (%d).\n", 314 mmap_rc); 315 panic(); 316 } 317 318 return rc; 319 } 320 321 return 0; 322 } 323 324 /******************************************************************************* 325 * Forward SMC to the other security state 326 ******************************************************************************/ 327 static uint64_t spmd_smc_forward(uint32_t smc_fid, uint32_t in_sstate, 328 uint32_t out_sstate, uint64_t x1, 329 uint64_t x2, uint64_t x3, uint64_t x4, 330 void *handle) 331 { 332 /* Save incoming security state */ 333 cm_el1_sysregs_context_save(in_sstate); 334 cm_el2_sysregs_context_save(in_sstate); 335 336 /* Restore outgoing security state */ 337 cm_el1_sysregs_context_restore(out_sstate); 338 cm_el2_sysregs_context_restore(out_sstate); 339 cm_set_next_eret_context(out_sstate); 340 341 SMC_RET8(cm_get_context(out_sstate), smc_fid, x1, x2, x3, x4, 342 SMC_GET_GP(handle, CTX_GPREG_X5), 343 SMC_GET_GP(handle, CTX_GPREG_X6), 344 SMC_GET_GP(handle, CTX_GPREG_X7)); 345 } 346 347 /******************************************************************************* 348 * Return SPCI_ERROR with specified error code 349 ******************************************************************************/ 350 static uint64_t spmd_spci_error_return(void *handle, int error_code) 351 { 352 SMC_RET8(handle, SPCI_ERROR, 353 SPCI_TARGET_INFO_MBZ, error_code, 354 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 355 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 356 } 357 358 /******************************************************************************* 359 * This function handles all SMCs in the range reserved for SPCI. Each call is 360 * either forwarded to the other security state or handled by the SPM dispatcher 361 ******************************************************************************/ 362 uint64_t spmd_smc_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2, 363 uint64_t x3, uint64_t x4, void *cookie, void *handle, 364 uint64_t flags) 365 { 366 uint32_t in_sstate; 367 uint32_t out_sstate; 368 int32_t ret; 369 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 370 371 /* Determine which security state this SMC originated from */ 372 if (is_caller_secure(flags)) { 373 in_sstate = SECURE; 374 out_sstate = NON_SECURE; 375 } else { 376 in_sstate = NON_SECURE; 377 out_sstate = SECURE; 378 } 379 380 INFO("SPM: 0x%x, 0x%llx, 0x%llx, 0x%llx, 0x%llx, " 381 "0x%llx, 0x%llx, 0x%llx\n", 382 smc_fid, x1, x2, x3, x4, SMC_GET_GP(handle, CTX_GPREG_X5), 383 SMC_GET_GP(handle, CTX_GPREG_X6), 384 SMC_GET_GP(handle, CTX_GPREG_X7)); 385 386 switch (smc_fid) { 387 case SPCI_ERROR: 388 /* 389 * Check if this is the first invocation of this interface on 390 * this CPU. If so, then indicate that the SPM core initialised 391 * unsuccessfully. 392 */ 393 if ((in_sstate == SECURE) && 394 (ctx->state == SPMC_STATE_RESET)) { 395 spmd_spm_core_sync_exit(x2); 396 } 397 398 return spmd_smc_forward(smc_fid, in_sstate, out_sstate, 399 x1, x2, x3, x4, handle); 400 break; /* not reached */ 401 402 case SPCI_VERSION: 403 /* 404 * TODO: This is an optimization that the version information 405 * provided by the SPM core manifest is returned by the SPM 406 * dispatcher. It might be a better idea to simply forward this 407 * call to the SPM core and wash our hands completely. 408 */ 409 ret = MAKE_SPCI_VERSION(spmc_attrs.major_version, 410 spmc_attrs.minor_version); 411 SMC_RET8(handle, SPCI_SUCCESS_SMC32, SPCI_TARGET_INFO_MBZ, ret, 412 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 413 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 414 break; /* not reached */ 415 416 case SPCI_FEATURES: 417 /* 418 * This is an optional interface. Do the minimal checks and 419 * forward to SPM core which will handle it if implemented. 420 */ 421 422 /* 423 * Check if x1 holds a valid SPCI fid. This is an 424 * optimization. 425 */ 426 if (!is_spci_fid(x1)) { 427 return spmd_spci_error_return(handle, 428 SPCI_ERROR_NOT_SUPPORTED); 429 } 430 431 /* Forward SMC from Normal world to the SPM core */ 432 if (in_sstate == NON_SECURE) { 433 return spmd_smc_forward(smc_fid, in_sstate, out_sstate, 434 x1, x2, x3, x4, handle); 435 } else { 436 /* 437 * Return success if call was from secure world i.e. all 438 * SPCI functions are supported. This is essentially a 439 * nop. 440 */ 441 SMC_RET8(handle, SPCI_SUCCESS_SMC32, x1, x2, x3, x4, 442 SMC_GET_GP(handle, CTX_GPREG_X5), 443 SMC_GET_GP(handle, CTX_GPREG_X6), 444 SMC_GET_GP(handle, CTX_GPREG_X7)); 445 } 446 447 break; /* not reached */ 448 449 case SPCI_RX_RELEASE: 450 case SPCI_RXTX_MAP_SMC32: 451 case SPCI_RXTX_MAP_SMC64: 452 case SPCI_RXTX_UNMAP: 453 case SPCI_MSG_RUN: 454 /* This interface must be invoked only by the Normal world */ 455 if (in_sstate == SECURE) { 456 return spmd_spci_error_return(handle, 457 SPCI_ERROR_NOT_SUPPORTED); 458 } 459 460 /* Fall through to forward the call to the other world */ 461 462 case SPCI_PARTITION_INFO_GET: 463 case SPCI_MSG_SEND: 464 case SPCI_MSG_SEND_DIRECT_REQ_SMC32: 465 case SPCI_MSG_SEND_DIRECT_REQ_SMC64: 466 case SPCI_MSG_SEND_DIRECT_RESP_SMC32: 467 case SPCI_MSG_SEND_DIRECT_RESP_SMC64: 468 case SPCI_MEM_DONATE_SMC32: 469 case SPCI_MEM_DONATE_SMC64: 470 case SPCI_MEM_LEND_SMC32: 471 case SPCI_MEM_LEND_SMC64: 472 case SPCI_MEM_SHARE_SMC32: 473 case SPCI_MEM_SHARE_SMC64: 474 case SPCI_MEM_RETRIEVE_REQ_SMC32: 475 case SPCI_MEM_RETRIEVE_REQ_SMC64: 476 case SPCI_MEM_RETRIEVE_RESP: 477 case SPCI_MEM_RELINQUISH: 478 case SPCI_MEM_RECLAIM: 479 case SPCI_SUCCESS_SMC32: 480 case SPCI_SUCCESS_SMC64: 481 /* 482 * TODO: Assume that no requests originate from EL3 at the 483 * moment. This will change if a SP service is required in 484 * response to secure interrupts targeted to EL3. Until then 485 * simply forward the call to the Normal world. 486 */ 487 488 return spmd_smc_forward(smc_fid, in_sstate, out_sstate, 489 x1, x2, x3, x4, handle); 490 break; /* not reached */ 491 492 case SPCI_MSG_WAIT: 493 /* 494 * Check if this is the first invocation of this interface on 495 * this CPU from the Secure world. If so, then indicate that the 496 * SPM core initialised successfully. 497 */ 498 if ((in_sstate == SECURE) && (ctx->state == SPMC_STATE_RESET)) { 499 spmd_spm_core_sync_exit(0); 500 } 501 502 /* Fall through to forward the call to the other world */ 503 504 case SPCI_MSG_YIELD: 505 /* This interface must be invoked only by the Secure world */ 506 if (in_sstate == NON_SECURE) { 507 return spmd_spci_error_return(handle, 508 SPCI_ERROR_NOT_SUPPORTED); 509 } 510 511 return spmd_smc_forward(smc_fid, in_sstate, out_sstate, 512 x1, x2, x3, x4, handle); 513 break; /* not reached */ 514 515 default: 516 WARN("SPM: Unsupported call 0x%08x\n", smc_fid); 517 return spmd_spci_error_return(handle, SPCI_ERROR_NOT_SUPPORTED); 518 } 519 } 520