1 /* 2 * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <string.h> 10 11 #include <arch_helpers.h> 12 #include <bl31/bl31.h> 13 #include <common/debug.h> 14 #include <common/runtime_svc.h> 15 #include <lib/el3_runtime/context_mgmt.h> 16 #include <lib/smccc.h> 17 #include <lib/spinlock.h> 18 #include <lib/utils.h> 19 #include <lib/xlat_tables/xlat_tables_v2.h> 20 #include <plat/common/common_def.h> 21 #include <plat/common/platform.h> 22 #include <platform_def.h> 23 #include <services/spci_svc.h> 24 #include <services/spmd_svc.h> 25 #include <smccc_helpers.h> 26 #include "spmd_private.h" 27 28 /******************************************************************************* 29 * SPM Core context information. 30 ******************************************************************************/ 31 spmd_spm_core_context_t spm_core_context[PLATFORM_CORE_COUNT]; 32 33 /******************************************************************************* 34 * SPM Core attribute information read from its manifest. 35 ******************************************************************************/ 36 spmc_manifest_sect_attribute_t spmc_attrs; 37 38 /******************************************************************************* 39 * This function takes an SP context pointer and performs a synchronous entry 40 * into it. 41 ******************************************************************************/ 42 uint64_t spmd_spm_core_sync_entry(spmd_spm_core_context_t *spmc_ctx) 43 { 44 uint64_t rc; 45 46 assert(spmc_ctx != NULL); 47 48 cm_set_context(&(spmc_ctx->cpu_ctx), SECURE); 49 50 /* Restore the context assigned above */ 51 cm_el1_sysregs_context_restore(SECURE); 52 cm_el2_sysregs_context_restore(SECURE); 53 cm_set_next_eret_context(SECURE); 54 55 /* Invalidate TLBs at EL1. */ 56 tlbivmalle1(); 57 dsbish(); 58 59 /* Enter Secure Partition */ 60 rc = spmd_spm_core_enter(&spmc_ctx->c_rt_ctx); 61 62 /* Save secure state */ 63 cm_el1_sysregs_context_save(SECURE); 64 cm_el2_sysregs_context_save(SECURE); 65 66 return rc; 67 } 68 69 /******************************************************************************* 70 * This function returns to the place where spm_sp_synchronous_entry() was 71 * called originally. 72 ******************************************************************************/ 73 __dead2 void spmd_spm_core_sync_exit(uint64_t rc) 74 { 75 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 76 77 /* Get context of the SP in use by this CPU. */ 78 assert(cm_get_context(SECURE) == &(ctx->cpu_ctx)); 79 80 /* 81 * The SPMD must have initiated the original request through a 82 * synchronous entry into SPMC. Jump back to the original C runtime 83 * context with the value of rc in x0; 84 */ 85 spmd_spm_core_exit(ctx->c_rt_ctx, rc); 86 87 panic(); 88 } 89 90 /******************************************************************************* 91 * Jump to the SPM core for the first time. 92 ******************************************************************************/ 93 static int32_t spmd_init(void) 94 { 95 uint64_t rc = 0; 96 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 97 98 INFO("SPM Core init start.\n"); 99 ctx->state = SPMC_STATE_RESET; 100 101 rc = spmd_spm_core_sync_entry(ctx); 102 if (rc) { 103 ERROR("SPMC initialisation failed 0x%llx\n", rc); 104 panic(); 105 } 106 107 ctx->state = SPMC_STATE_IDLE; 108 INFO("SPM Core init end.\n"); 109 110 return 1; 111 } 112 113 /******************************************************************************* 114 * Initialize context of SPM core. 115 ******************************************************************************/ 116 int32_t spmd_setup(void) 117 { 118 int rc; 119 void *rd_base; 120 size_t rd_size; 121 entry_point_info_t *spmc_ep_info; 122 uintptr_t rd_base_align; 123 uintptr_t rd_size_align; 124 uint32_t ep_attr; 125 126 spmc_ep_info = bl31_plat_get_next_image_ep_info(SECURE); 127 if (!spmc_ep_info) { 128 WARN("No SPM core image provided by BL2 boot loader, Booting " 129 "device without SP initialization. SMC`s destined for SPM " 130 "core will return SMC_UNK\n"); 131 return 1; 132 } 133 134 /* Under no circumstances will this parameter be 0 */ 135 assert(spmc_ep_info->pc != 0U); 136 137 /* 138 * Check if BL32 ep_info has a reference to 'tos_fw_config'. This will 139 * be used as a manifest for the SPM core at the next lower EL/mode. 140 */ 141 if (spmc_ep_info->args.arg0 == 0U || spmc_ep_info->args.arg2 == 0U) { 142 ERROR("Invalid or absent SPM core manifest\n"); 143 panic(); 144 } 145 146 /* Obtain whereabouts of SPM core manifest */ 147 rd_base = (void *) spmc_ep_info->args.arg0; 148 rd_size = spmc_ep_info->args.arg2; 149 150 rd_base_align = page_align((uintptr_t) rd_base, DOWN); 151 rd_size_align = page_align((uintptr_t) rd_size, UP); 152 153 /* Map the manifest in the SPMD translation regime first */ 154 VERBOSE("SPM core manifest base : 0x%lx\n", rd_base_align); 155 VERBOSE("SPM core manifest size : 0x%lx\n", rd_size_align); 156 rc = mmap_add_dynamic_region((unsigned long long) rd_base_align, 157 (uintptr_t) rd_base_align, 158 rd_size_align, 159 MT_RO_DATA); 160 if (rc < 0) { 161 ERROR("Error while mapping SPM core manifest (%d).\n", rc); 162 panic(); 163 } 164 165 /* Load the SPM core manifest */ 166 rc = plat_spm_core_manifest_load(&spmc_attrs, rd_base, rd_size); 167 if (rc < 0) { 168 WARN("No or invalid SPM core manifest image provided by BL2 " 169 "boot loader. "); 170 goto error; 171 } 172 173 /* 174 * Ensure that the SPM core version is compatible with the SPM 175 * dispatcher version 176 */ 177 if ((spmc_attrs.major_version != SPCI_VERSION_MAJOR) || 178 (spmc_attrs.minor_version > SPCI_VERSION_MINOR)) { 179 WARN("Unsupported SPCI version (%x.%x) specified in SPM core " 180 "manifest image provided by BL2 boot loader.\n", 181 spmc_attrs.major_version, spmc_attrs.minor_version); 182 goto error; 183 } 184 185 INFO("SPCI version (%x.%x).\n", spmc_attrs.major_version, 186 spmc_attrs.minor_version); 187 188 /* Validate the SPM core runtime EL */ 189 if ((spmc_attrs.runtime_el != MODE_EL1) && 190 (spmc_attrs.runtime_el != MODE_EL2)) { 191 WARN("Unsupported SPM core run time EL%x specified in " 192 "manifest image provided by BL2 boot loader.\n", 193 spmc_attrs.runtime_el); 194 goto error; 195 } 196 197 INFO("SPM core run time EL%x.\n", spmc_attrs.runtime_el); 198 199 /* Validate the SPM core execution state */ 200 if ((spmc_attrs.exec_state != MODE_RW_64) && 201 (spmc_attrs.exec_state != MODE_RW_32)) { 202 WARN("Unsupported SPM core execution state %x specified in " 203 "manifest image provided by BL2 boot loader.\n", 204 spmc_attrs.exec_state); 205 goto error; 206 } 207 208 INFO("SPM core execution state %x.\n", spmc_attrs.exec_state); 209 210 /* Ensure manifest has not requested S-EL2 in AArch32 state */ 211 if ((spmc_attrs.exec_state == MODE_RW_32) && 212 (spmc_attrs.runtime_el == MODE_EL2)) { 213 WARN("Invalid combination of SPM core execution state (%x) " 214 "and run time EL (%x).\n", spmc_attrs.exec_state, 215 spmc_attrs.runtime_el); 216 goto error; 217 } 218 219 /* 220 * Check if S-EL2 is supported on this system if S-EL2 221 * is required for SPM 222 */ 223 if (spmc_attrs.runtime_el == MODE_EL2) { 224 uint64_t sel2 = read_id_aa64pfr0_el1(); 225 226 sel2 >>= ID_AA64PFR0_SEL2_SHIFT; 227 sel2 &= ID_AA64PFR0_SEL2_MASK; 228 229 if (!sel2) { 230 WARN("SPM core run time EL: S-EL%x is not supported " 231 "but specified in manifest image provided by " 232 "BL2 boot loader.\n", spmc_attrs.runtime_el); 233 goto error; 234 } 235 } 236 237 /* Initialise an entrypoint to set up the CPU context */ 238 ep_attr = SECURE | EP_ST_ENABLE; 239 if (read_sctlr_el3() & SCTLR_EE_BIT) 240 ep_attr |= EP_EE_BIG; 241 SET_PARAM_HEAD(spmc_ep_info, PARAM_EP, VERSION_1, ep_attr); 242 assert(spmc_ep_info->pc == BL32_BASE); 243 244 /* 245 * Populate SPSR for SPM core based upon validated parameters from the 246 * manifest 247 */ 248 if (spmc_attrs.exec_state == MODE_RW_32) { 249 spmc_ep_info->spsr = SPSR_MODE32(MODE32_svc, SPSR_T_ARM, 250 SPSR_E_LITTLE, 251 DAIF_FIQ_BIT | 252 DAIF_IRQ_BIT | 253 DAIF_ABT_BIT); 254 } else { 255 spmc_ep_info->spsr = SPSR_64(spmc_attrs.runtime_el, 256 MODE_SP_ELX, 257 DISABLE_ALL_EXCEPTIONS); 258 } 259 260 /* Initialise SPM core context with this entry point information */ 261 cm_setup_context(&(spm_core_context[plat_my_core_pos()].cpu_ctx), 262 spmc_ep_info); 263 264 INFO("SPM core setup done.\n"); 265 266 /* Register init function for deferred init. */ 267 bl31_register_bl32_init(&spmd_init); 268 269 return 0; 270 271 error: 272 WARN("Booting device without SPM initialization. " 273 "SPCI SMCs destined for SPM core will return " 274 "ENOTSUPPORTED\n"); 275 276 rc = mmap_remove_dynamic_region(rd_base_align, rd_size_align); 277 if (rc < 0) { 278 ERROR("Error while unmapping SPM core manifest (%d).\n", 279 rc); 280 panic(); 281 } 282 283 return 1; 284 } 285 286 /******************************************************************************* 287 * This function handles all SMCs in the range reserved for SPCI. Each call is 288 * either forwarded to the other security state or handled by the SPM dispatcher 289 ******************************************************************************/ 290 uint64_t spmd_smc_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2, 291 uint64_t x3, uint64_t x4, void *cookie, void *handle, 292 uint64_t flags) 293 { 294 uint32_t in_sstate; 295 uint32_t out_sstate; 296 int32_t ret; 297 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 298 299 /* Determine which security state this SMC originated from */ 300 if (is_caller_secure(flags)) { 301 in_sstate = SECURE; 302 out_sstate = NON_SECURE; 303 } else { 304 in_sstate = NON_SECURE; 305 out_sstate = SECURE; 306 } 307 308 INFO("SPM: 0x%x, 0x%llx, 0x%llx, 0x%llx, 0x%llx, " 309 "0x%llx, 0x%llx, 0x%llx\n", 310 smc_fid, x1, x2, x3, x4, SMC_GET_GP(handle, CTX_GPREG_X5), 311 SMC_GET_GP(handle, CTX_GPREG_X6), 312 SMC_GET_GP(handle, CTX_GPREG_X7)); 313 314 switch (smc_fid) { 315 case SPCI_ERROR: 316 /* 317 * Check if this is the first invocation of this interface on 318 * this CPU. If so, then indicate that the SPM core initialised 319 * unsuccessfully. 320 */ 321 if ((in_sstate == SECURE) && (ctx->state == SPMC_STATE_RESET)) 322 spmd_spm_core_sync_exit(x2); 323 324 /* Save incoming security state */ 325 cm_el1_sysregs_context_save(in_sstate); 326 cm_el2_sysregs_context_save(in_sstate); 327 328 /* Restore outgoing security state */ 329 cm_el1_sysregs_context_restore(out_sstate); 330 cm_el2_sysregs_context_restore(out_sstate); 331 cm_set_next_eret_context(out_sstate); 332 333 SMC_RET8(cm_get_context(out_sstate), smc_fid, x1, x2, x3, x4, 334 SMC_GET_GP(handle, CTX_GPREG_X5), 335 SMC_GET_GP(handle, CTX_GPREG_X6), 336 SMC_GET_GP(handle, CTX_GPREG_X7)); 337 break; /* not reached */ 338 339 case SPCI_VERSION: 340 /* 341 * TODO: This is an optimization that the version information 342 * provided by the SPM core manifest is returned by the SPM 343 * dispatcher. It might be a better idea to simply forward this 344 * call to the SPM core and wash our hands completely. 345 */ 346 ret = MAKE_SPCI_VERSION(spmc_attrs.major_version, 347 spmc_attrs.minor_version); 348 SMC_RET8(handle, SPCI_SUCCESS_SMC32, SPCI_TARGET_INFO_MBZ, ret, 349 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 350 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 351 break; /* not reached */ 352 353 case SPCI_FEATURES: 354 /* 355 * This is an optional interface. Do the minimal checks and 356 * forward to SPM core which will handle it if implemented. 357 */ 358 359 /* 360 * Check if w1 holds a valid SPCI fid. This is an 361 * optimization. 362 */ 363 if (!is_spci_fid(x1)) 364 SMC_RET8(handle, SPCI_ERROR, 365 SPCI_TARGET_INFO_MBZ, SPCI_ERROR_NOT_SUPPORTED, 366 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 367 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 368 369 /* Forward SMC from Normal world to the SPM core */ 370 if (in_sstate == NON_SECURE) { 371 /* Save incoming security state */ 372 cm_el1_sysregs_context_save(in_sstate); 373 cm_el2_sysregs_context_save(in_sstate); 374 375 /* Restore outgoing security state */ 376 cm_el1_sysregs_context_restore(out_sstate); 377 cm_el2_sysregs_context_restore(out_sstate); 378 cm_set_next_eret_context(out_sstate); 379 380 SMC_RET8(cm_get_context(out_sstate), smc_fid, 381 x1, x2, x3, x4, 382 SMC_GET_GP(handle, CTX_GPREG_X5), 383 SMC_GET_GP(handle, CTX_GPREG_X6), 384 SMC_GET_GP(handle, CTX_GPREG_X7)); 385 } else { 386 /* 387 * Return success if call was from secure world i.e. all 388 * SPCI functions are supported. This is essentially a 389 * nop. 390 */ 391 SMC_RET8(handle, SPCI_SUCCESS_SMC32, x1, x2, x3, x4, 392 SMC_GET_GP(handle, CTX_GPREG_X5), 393 SMC_GET_GP(handle, CTX_GPREG_X6), 394 SMC_GET_GP(handle, CTX_GPREG_X7)); 395 } 396 break; /* not reached */ 397 398 case SPCI_RX_RELEASE: 399 case SPCI_RXTX_MAP_SMC32: 400 case SPCI_RXTX_MAP_SMC64: 401 case SPCI_RXTX_UNMAP: 402 case SPCI_MSG_RUN: 403 /* This interface must be invoked only by the Normal world */ 404 if (in_sstate == SECURE) { 405 SMC_RET8(handle, SPCI_ERROR, 406 SPCI_TARGET_INFO_MBZ, SPCI_ERROR_NOT_SUPPORTED, 407 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 408 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 409 } 410 411 /* Fall through to forward the call to the other world */ 412 413 case SPCI_PARTITION_INFO_GET: 414 case SPCI_MSG_SEND: 415 case SPCI_MSG_SEND_DIRECT_REQ_SMC32: 416 case SPCI_MSG_SEND_DIRECT_REQ_SMC64: 417 case SPCI_MSG_SEND_DIRECT_RESP_SMC32: 418 case SPCI_MSG_SEND_DIRECT_RESP_SMC64: 419 case SPCI_MEM_DONATE_SMC32: 420 case SPCI_MEM_DONATE_SMC64: 421 case SPCI_MEM_LEND_SMC32: 422 case SPCI_MEM_LEND_SMC64: 423 case SPCI_MEM_SHARE_SMC32: 424 case SPCI_MEM_SHARE_SMC64: 425 case SPCI_MEM_RETRIEVE_REQ_SMC32: 426 case SPCI_MEM_RETRIEVE_REQ_SMC64: 427 case SPCI_MEM_RETRIEVE_RESP: 428 case SPCI_MEM_RELINQUISH: 429 case SPCI_MEM_RECLAIM: 430 case SPCI_SUCCESS_SMC32: 431 case SPCI_SUCCESS_SMC64: 432 /* 433 * TODO: Assume that no requests originate from EL3 at the 434 * moment. This will change if a SP service is required in 435 * response to secure interrupts targeted to EL3. Until then 436 * simply forward the call to the Normal world. 437 */ 438 439 /* Save incoming security state */ 440 cm_el1_sysregs_context_save(in_sstate); 441 cm_el2_sysregs_context_save(in_sstate); 442 443 /* Restore outgoing security state */ 444 cm_el1_sysregs_context_restore(out_sstate); 445 cm_el2_sysregs_context_restore(out_sstate); 446 cm_set_next_eret_context(out_sstate); 447 448 SMC_RET8(cm_get_context(out_sstate), smc_fid, x1, x2, x3, x4, 449 SMC_GET_GP(handle, CTX_GPREG_X5), 450 SMC_GET_GP(handle, CTX_GPREG_X6), 451 SMC_GET_GP(handle, CTX_GPREG_X7)); 452 break; /* not reached */ 453 454 case SPCI_MSG_WAIT: 455 /* 456 * Check if this is the first invocation of this interface on 457 * this CPU from the Secure world. If so, then indicate that the 458 * SPM core initialised successfully. 459 */ 460 if ((in_sstate == SECURE) && (ctx->state == SPMC_STATE_RESET)) { 461 spmd_spm_core_sync_exit(0); 462 } 463 464 /* Intentional fall-through */ 465 466 case SPCI_MSG_YIELD: 467 /* This interface must be invoked only by the Secure world */ 468 if (in_sstate == NON_SECURE) { 469 SMC_RET8(handle, SPCI_ERROR, 470 SPCI_TARGET_INFO_MBZ, SPCI_ERROR_NOT_SUPPORTED, 471 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 472 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 473 } 474 475 /* Save incoming security state */ 476 cm_el1_sysregs_context_save(in_sstate); 477 cm_el2_sysregs_context_save(in_sstate); 478 479 /* Restore outgoing security state */ 480 cm_el1_sysregs_context_restore(out_sstate); 481 cm_el2_sysregs_context_restore(out_sstate); 482 cm_set_next_eret_context(out_sstate); 483 484 SMC_RET8(cm_get_context(out_sstate), smc_fid, x1, x2, x3, x4, 485 SMC_GET_GP(handle, CTX_GPREG_X5), 486 SMC_GET_GP(handle, CTX_GPREG_X6), 487 SMC_GET_GP(handle, CTX_GPREG_X7)); 488 break; /* not reached */ 489 490 default: 491 WARN("SPM: Unsupported call 0x%08x\n", smc_fid); 492 SMC_RET8(handle, SPCI_ERROR, 493 SPCI_TARGET_INFO_MBZ, SPCI_ERROR_NOT_SUPPORTED, 494 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 495 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 496 } 497 } 498