1 /* 2 * Copyright (c) 2020-2023, Arm Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <inttypes.h> 10 #include <stdint.h> 11 #include <string.h> 12 13 #include <arch_helpers.h> 14 #include <arch/aarch64/arch_features.h> 15 #include <bl31/bl31.h> 16 #include <bl31/interrupt_mgmt.h> 17 #include <common/debug.h> 18 #include <common/runtime_svc.h> 19 #include <common/tbbr/tbbr_img_def.h> 20 #include <lib/el3_runtime/context_mgmt.h> 21 #include <lib/fconf/fconf.h> 22 #include <lib/fconf/fconf_dyn_cfg_getter.h> 23 #include <lib/smccc.h> 24 #include <lib/spinlock.h> 25 #include <lib/utils.h> 26 #include <lib/xlat_tables/xlat_tables_v2.h> 27 #include <plat/common/common_def.h> 28 #include <plat/common/platform.h> 29 #include <platform_def.h> 30 #include <services/ffa_svc.h> 31 #include <services/spmc_svc.h> 32 #include <services/spmd_svc.h> 33 #include <smccc_helpers.h> 34 #include "spmd_private.h" 35 36 /******************************************************************************* 37 * SPM Core context information. 38 ******************************************************************************/ 39 static spmd_spm_core_context_t spm_core_context[PLATFORM_CORE_COUNT]; 40 41 /******************************************************************************* 42 * SPM Core attribute information is read from its manifest if the SPMC is not 43 * at EL3. Else, it is populated from the SPMC directly. 44 ******************************************************************************/ 45 static spmc_manifest_attribute_t spmc_attrs; 46 47 /******************************************************************************* 48 * SPM Core entry point information. Discovered on the primary core and reused 49 * on secondary cores. 50 ******************************************************************************/ 51 static entry_point_info_t *spmc_ep_info; 52 53 /******************************************************************************* 54 * SPM Core context on CPU based on mpidr. 55 ******************************************************************************/ 56 spmd_spm_core_context_t *spmd_get_context_by_mpidr(uint64_t mpidr) 57 { 58 int core_idx = plat_core_pos_by_mpidr(mpidr); 59 60 if (core_idx < 0) { 61 ERROR("Invalid mpidr: %" PRIx64 ", returned ID: %d\n", mpidr, core_idx); 62 panic(); 63 } 64 65 return &spm_core_context[core_idx]; 66 } 67 68 /******************************************************************************* 69 * SPM Core context on current CPU get helper. 70 ******************************************************************************/ 71 spmd_spm_core_context_t *spmd_get_context(void) 72 { 73 return spmd_get_context_by_mpidr(read_mpidr()); 74 } 75 76 /******************************************************************************* 77 * SPM Core ID getter. 78 ******************************************************************************/ 79 uint16_t spmd_spmc_id_get(void) 80 { 81 return spmc_attrs.spmc_id; 82 } 83 84 /******************************************************************************* 85 * Static function declaration. 86 ******************************************************************************/ 87 static int32_t spmd_init(void); 88 static int spmd_spmc_init(void *pm_addr); 89 static uint64_t spmd_ffa_error_return(void *handle, 90 int error_code); 91 static uint64_t spmd_smc_forward(uint32_t smc_fid, 92 bool secure_origin, 93 uint64_t x1, 94 uint64_t x2, 95 uint64_t x3, 96 uint64_t x4, 97 void *cookie, 98 void *handle, 99 uint64_t flags); 100 101 /****************************************************************************** 102 * Builds an SPMD to SPMC direct message request. 103 *****************************************************************************/ 104 void spmd_build_spmc_message(gp_regs_t *gpregs, uint8_t target_func, 105 unsigned long long message) 106 { 107 write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_MSG_SEND_DIRECT_REQ_SMC32); 108 write_ctx_reg(gpregs, CTX_GPREG_X1, 109 (SPMD_DIRECT_MSG_ENDPOINT_ID << FFA_DIRECT_MSG_SOURCE_SHIFT) | 110 spmd_spmc_id_get()); 111 write_ctx_reg(gpregs, CTX_GPREG_X2, BIT(31) | target_func); 112 write_ctx_reg(gpregs, CTX_GPREG_X3, message); 113 } 114 115 116 /******************************************************************************* 117 * This function takes an SPMC context pointer and performs a synchronous 118 * SPMC entry. 119 ******************************************************************************/ 120 uint64_t spmd_spm_core_sync_entry(spmd_spm_core_context_t *spmc_ctx) 121 { 122 uint64_t rc; 123 124 assert(spmc_ctx != NULL); 125 126 cm_set_context(&(spmc_ctx->cpu_ctx), SECURE); 127 128 /* Restore the context assigned above */ 129 #if SPMD_SPM_AT_SEL2 130 cm_el2_sysregs_context_restore(SECURE); 131 #else 132 cm_el1_sysregs_context_restore(SECURE); 133 #endif 134 cm_set_next_eret_context(SECURE); 135 136 /* Enter SPMC */ 137 rc = spmd_spm_core_enter(&spmc_ctx->c_rt_ctx); 138 139 /* Save secure state */ 140 #if SPMD_SPM_AT_SEL2 141 cm_el2_sysregs_context_save(SECURE); 142 #else 143 cm_el1_sysregs_context_save(SECURE); 144 #endif 145 146 return rc; 147 } 148 149 /******************************************************************************* 150 * This function returns to the place where spmd_spm_core_sync_entry() was 151 * called originally. 152 ******************************************************************************/ 153 __dead2 void spmd_spm_core_sync_exit(uint64_t rc) 154 { 155 spmd_spm_core_context_t *ctx = spmd_get_context(); 156 157 /* Get current CPU context from SPMC context */ 158 assert(cm_get_context(SECURE) == &(ctx->cpu_ctx)); 159 160 /* 161 * The SPMD must have initiated the original request through a 162 * synchronous entry into SPMC. Jump back to the original C runtime 163 * context with the value of rc in x0; 164 */ 165 spmd_spm_core_exit(ctx->c_rt_ctx, rc); 166 167 panic(); 168 } 169 170 /******************************************************************************* 171 * Jump to the SPM Core for the first time. 172 ******************************************************************************/ 173 static int32_t spmd_init(void) 174 { 175 spmd_spm_core_context_t *ctx = spmd_get_context(); 176 uint64_t rc; 177 178 VERBOSE("SPM Core init start.\n"); 179 180 /* Primary boot core enters the SPMC for initialization. */ 181 ctx->state = SPMC_STATE_ON_PENDING; 182 183 rc = spmd_spm_core_sync_entry(ctx); 184 if (rc != 0ULL) { 185 ERROR("SPMC initialisation failed 0x%" PRIx64 "\n", rc); 186 return 0; 187 } 188 189 ctx->state = SPMC_STATE_ON; 190 191 VERBOSE("SPM Core init end.\n"); 192 193 return 1; 194 } 195 196 /******************************************************************************* 197 * spmd_secure_interrupt_handler 198 * Enter the SPMC for further handling of the secure interrupt by the SPMC 199 * itself or a Secure Partition. 200 ******************************************************************************/ 201 static uint64_t spmd_secure_interrupt_handler(uint32_t id, 202 uint32_t flags, 203 void *handle, 204 void *cookie) 205 { 206 spmd_spm_core_context_t *ctx = spmd_get_context(); 207 gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx); 208 unsigned int linear_id = plat_my_core_pos(); 209 int64_t rc; 210 211 /* Sanity check the security state when the exception was generated */ 212 assert(get_interrupt_src_ss(flags) == NON_SECURE); 213 214 /* Sanity check the pointer to this cpu's context */ 215 assert(handle == cm_get_context(NON_SECURE)); 216 217 /* Save the non-secure context before entering SPMC */ 218 cm_el1_sysregs_context_save(NON_SECURE); 219 #if SPMD_SPM_AT_SEL2 220 cm_el2_sysregs_context_save(NON_SECURE); 221 #endif 222 223 /* Convey the event to the SPMC through the FFA_INTERRUPT interface. */ 224 write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_INTERRUPT); 225 write_ctx_reg(gpregs, CTX_GPREG_X1, 0); 226 write_ctx_reg(gpregs, CTX_GPREG_X2, 0); 227 write_ctx_reg(gpregs, CTX_GPREG_X3, 0); 228 write_ctx_reg(gpregs, CTX_GPREG_X4, 0); 229 write_ctx_reg(gpregs, CTX_GPREG_X5, 0); 230 write_ctx_reg(gpregs, CTX_GPREG_X6, 0); 231 write_ctx_reg(gpregs, CTX_GPREG_X7, 0); 232 233 /* Mark current core as handling a secure interrupt. */ 234 ctx->secure_interrupt_ongoing = true; 235 236 rc = spmd_spm_core_sync_entry(ctx); 237 if (rc != 0ULL) { 238 ERROR("%s failed (%" PRId64 ") on CPU%u\n", __func__, rc, linear_id); 239 } 240 241 ctx->secure_interrupt_ongoing = false; 242 243 cm_el1_sysregs_context_restore(NON_SECURE); 244 #if SPMD_SPM_AT_SEL2 245 cm_el2_sysregs_context_restore(NON_SECURE); 246 #endif 247 cm_set_next_eret_context(NON_SECURE); 248 249 SMC_RET0(&ctx->cpu_ctx); 250 } 251 252 #if (EL3_EXCEPTION_HANDLING == 0) 253 /******************************************************************************* 254 * spmd_group0_interrupt_handler_nwd 255 * Group0 secure interrupt in the normal world are trapped to EL3. Delegate the 256 * handling of the interrupt to the platform handler, and return only upon 257 * successfully handling the Group0 interrupt. 258 ******************************************************************************/ 259 static uint64_t spmd_group0_interrupt_handler_nwd(uint32_t id, 260 uint32_t flags, 261 void *handle, 262 void *cookie) 263 { 264 uint32_t intid; 265 266 /* Sanity check the security state when the exception was generated. */ 267 assert(get_interrupt_src_ss(flags) == NON_SECURE); 268 269 /* Sanity check the pointer to this cpu's context. */ 270 assert(handle == cm_get_context(NON_SECURE)); 271 272 assert(id == INTR_ID_UNAVAILABLE); 273 274 assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3); 275 276 intid = plat_ic_acknowledge_interrupt(); 277 278 if (plat_spmd_handle_group0_interrupt(intid) < 0) { 279 ERROR("Group0 interrupt %u not handled\n", intid); 280 panic(); 281 } 282 283 /* Deactivate the corresponding Group0 interrupt. */ 284 plat_ic_end_of_interrupt(intid); 285 286 return 0U; 287 } 288 #endif 289 290 /******************************************************************************* 291 * spmd_handle_group0_intr_swd 292 * SPMC delegates handling of Group0 secure interrupt to EL3 firmware using 293 * FFA_EL3_INTR_HANDLE SMC call. Further, SPMD delegates the handling of the 294 * interrupt to the platform handler, and returns only upon successfully 295 * handling the Group0 interrupt. 296 ******************************************************************************/ 297 static uint64_t spmd_handle_group0_intr_swd(void *handle) 298 { 299 uint32_t intid; 300 301 /* Sanity check the pointer to this cpu's context */ 302 assert(handle == cm_get_context(SECURE)); 303 304 assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3); 305 306 intid = plat_ic_acknowledge_interrupt(); 307 308 /* 309 * TODO: Currently due to a limitation in SPMD implementation, the 310 * platform handler is expected to not delegate handling to NWd while 311 * processing Group0 secure interrupt. 312 */ 313 if (plat_spmd_handle_group0_interrupt(intid) < 0) { 314 /* Group0 interrupt was not handled by the platform. */ 315 ERROR("Group0 interrupt %u not handled\n", intid); 316 panic(); 317 } 318 319 /* Deactivate the corresponding Group0 interrupt. */ 320 plat_ic_end_of_interrupt(intid); 321 322 /* Return success. */ 323 SMC_RET8(handle, FFA_SUCCESS_SMC32, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 324 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 325 FFA_PARAM_MBZ); 326 } 327 328 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 329 static int spmd_dynamic_map_mem(uintptr_t base_addr, size_t size, 330 unsigned int attr, uintptr_t *align_addr, 331 size_t *align_size) 332 { 333 uintptr_t base_addr_align; 334 size_t mapped_size_align; 335 int rc; 336 337 /* Page aligned address and size if necessary */ 338 base_addr_align = page_align(base_addr, DOWN); 339 mapped_size_align = page_align(size, UP); 340 341 if ((base_addr != base_addr_align) && 342 (size == mapped_size_align)) { 343 mapped_size_align += PAGE_SIZE; 344 } 345 346 /* 347 * Map dynamically given region with its aligned base address and 348 * size 349 */ 350 rc = mmap_add_dynamic_region((unsigned long long)base_addr_align, 351 base_addr_align, 352 mapped_size_align, 353 attr); 354 if (rc == 0) { 355 *align_addr = base_addr_align; 356 *align_size = mapped_size_align; 357 } 358 359 return rc; 360 } 361 362 static void spmd_do_sec_cpy(uintptr_t root_base_addr, uintptr_t sec_base_addr, 363 size_t size) 364 { 365 uintptr_t root_base_addr_align, sec_base_addr_align; 366 size_t root_mapped_size_align, sec_mapped_size_align; 367 int rc; 368 369 assert(root_base_addr != 0UL); 370 assert(sec_base_addr != 0UL); 371 assert(size != 0UL); 372 373 /* Map the memory with required attributes */ 374 rc = spmd_dynamic_map_mem(root_base_addr, size, MT_RO_DATA | MT_ROOT, 375 &root_base_addr_align, 376 &root_mapped_size_align); 377 if (rc != 0) { 378 ERROR("%s %s %lu (%d)\n", "Error while mapping", "root region", 379 root_base_addr, rc); 380 panic(); 381 } 382 383 rc = spmd_dynamic_map_mem(sec_base_addr, size, MT_RW_DATA | MT_SECURE, 384 &sec_base_addr_align, &sec_mapped_size_align); 385 if (rc != 0) { 386 ERROR("%s %s %lu (%d)\n", "Error while mapping", 387 "secure region", sec_base_addr, rc); 388 panic(); 389 } 390 391 /* Do copy operation */ 392 (void)memcpy((void *)sec_base_addr, (void *)root_base_addr, size); 393 394 /* Unmap root memory region */ 395 rc = mmap_remove_dynamic_region(root_base_addr_align, 396 root_mapped_size_align); 397 if (rc != 0) { 398 ERROR("%s %s %lu (%d)\n", "Error while unmapping", 399 "root region", root_base_addr_align, rc); 400 panic(); 401 } 402 403 /* Unmap secure memory region */ 404 rc = mmap_remove_dynamic_region(sec_base_addr_align, 405 sec_mapped_size_align); 406 if (rc != 0) { 407 ERROR("%s %s %lu (%d)\n", "Error while unmapping", 408 "secure region", sec_base_addr_align, rc); 409 panic(); 410 } 411 } 412 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */ 413 414 /******************************************************************************* 415 * Loads SPMC manifest and inits SPMC. 416 ******************************************************************************/ 417 static int spmd_spmc_init(void *pm_addr) 418 { 419 cpu_context_t *cpu_ctx; 420 unsigned int core_id; 421 uint32_t ep_attr, flags; 422 int rc; 423 const struct dyn_cfg_dtb_info_t *image_info __unused; 424 425 /* Load the SPM Core manifest */ 426 rc = plat_spm_core_manifest_load(&spmc_attrs, pm_addr); 427 if (rc != 0) { 428 WARN("No or invalid SPM Core manifest image provided by BL2\n"); 429 return rc; 430 } 431 432 /* 433 * Ensure that the SPM Core version is compatible with the SPM 434 * Dispatcher version. 435 */ 436 if ((spmc_attrs.major_version != FFA_VERSION_MAJOR) || 437 (spmc_attrs.minor_version > FFA_VERSION_MINOR)) { 438 WARN("Unsupported FFA version (%u.%u)\n", 439 spmc_attrs.major_version, spmc_attrs.minor_version); 440 return -EINVAL; 441 } 442 443 VERBOSE("FFA version (%u.%u)\n", spmc_attrs.major_version, 444 spmc_attrs.minor_version); 445 446 VERBOSE("SPM Core run time EL%x.\n", 447 SPMD_SPM_AT_SEL2 ? MODE_EL2 : MODE_EL1); 448 449 /* Validate the SPMC ID, Ensure high bit is set */ 450 if (((spmc_attrs.spmc_id >> SPMC_SECURE_ID_SHIFT) & 451 SPMC_SECURE_ID_MASK) == 0U) { 452 WARN("Invalid ID (0x%x) for SPMC.\n", spmc_attrs.spmc_id); 453 return -EINVAL; 454 } 455 456 /* Validate the SPM Core execution state */ 457 if ((spmc_attrs.exec_state != MODE_RW_64) && 458 (spmc_attrs.exec_state != MODE_RW_32)) { 459 WARN("Unsupported %s%x.\n", "SPM Core execution state 0x", 460 spmc_attrs.exec_state); 461 return -EINVAL; 462 } 463 464 VERBOSE("%s%x.\n", "SPM Core execution state 0x", 465 spmc_attrs.exec_state); 466 467 #if SPMD_SPM_AT_SEL2 468 /* Ensure manifest has not requested AArch32 state in S-EL2 */ 469 if (spmc_attrs.exec_state == MODE_RW_32) { 470 WARN("AArch32 state at S-EL2 is not supported.\n"); 471 return -EINVAL; 472 } 473 474 /* 475 * Check if S-EL2 is supported on this system if S-EL2 476 * is required for SPM 477 */ 478 if (!is_feat_sel2_supported()) { 479 WARN("SPM Core run time S-EL2 is not supported.\n"); 480 return -EINVAL; 481 } 482 #endif /* SPMD_SPM_AT_SEL2 */ 483 484 /* Initialise an entrypoint to set up the CPU context */ 485 ep_attr = SECURE | EP_ST_ENABLE; 486 if ((read_sctlr_el3() & SCTLR_EE_BIT) != 0ULL) { 487 ep_attr |= EP_EE_BIG; 488 } 489 490 SET_PARAM_HEAD(spmc_ep_info, PARAM_EP, VERSION_1, ep_attr); 491 492 /* 493 * Populate SPSR for SPM Core based upon validated parameters from the 494 * manifest. 495 */ 496 if (spmc_attrs.exec_state == MODE_RW_32) { 497 spmc_ep_info->spsr = SPSR_MODE32(MODE32_svc, SPSR_T_ARM, 498 SPSR_E_LITTLE, 499 DAIF_FIQ_BIT | 500 DAIF_IRQ_BIT | 501 DAIF_ABT_BIT); 502 } else { 503 504 #if SPMD_SPM_AT_SEL2 505 static const uint32_t runtime_el = MODE_EL2; 506 #else 507 static const uint32_t runtime_el = MODE_EL1; 508 #endif 509 spmc_ep_info->spsr = SPSR_64(runtime_el, 510 MODE_SP_ELX, 511 DISABLE_ALL_EXCEPTIONS); 512 } 513 514 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 515 image_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TOS_FW_CONFIG_ID); 516 assert(image_info != NULL); 517 518 if ((image_info->config_addr == 0UL) || 519 (image_info->secondary_config_addr == 0UL) || 520 (image_info->config_max_size == 0UL)) { 521 return -EINVAL; 522 } 523 524 /* Copy manifest from root->secure region */ 525 spmd_do_sec_cpy(image_info->config_addr, 526 image_info->secondary_config_addr, 527 image_info->config_max_size); 528 529 /* Update ep info of BL32 */ 530 assert(spmc_ep_info != NULL); 531 spmc_ep_info->args.arg0 = image_info->secondary_config_addr; 532 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */ 533 534 /* Set an initial SPMC context state for all cores. */ 535 for (core_id = 0U; core_id < PLATFORM_CORE_COUNT; core_id++) { 536 spm_core_context[core_id].state = SPMC_STATE_OFF; 537 538 /* Setup an initial cpu context for the SPMC. */ 539 cpu_ctx = &spm_core_context[core_id].cpu_ctx; 540 cm_setup_context(cpu_ctx, spmc_ep_info); 541 542 /* 543 * Pass the core linear ID to the SPMC through x4. 544 * (TF-A implementation defined behavior helping 545 * a legacy TOS migration to adopt FF-A). 546 */ 547 write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X4, core_id); 548 } 549 550 /* Register power management hooks with PSCI */ 551 psci_register_spd_pm_hook(&spmd_pm); 552 553 /* Register init function for deferred init. */ 554 bl31_register_bl32_init(&spmd_init); 555 556 INFO("SPM Core setup done.\n"); 557 558 /* 559 * Register an interrupt handler routing secure interrupts to SPMD 560 * while the NWd is running. 561 */ 562 flags = 0; 563 set_interrupt_rm_flag(flags, NON_SECURE); 564 rc = register_interrupt_type_handler(INTR_TYPE_S_EL1, 565 spmd_secure_interrupt_handler, 566 flags); 567 if (rc != 0) { 568 panic(); 569 } 570 571 /* 572 * Permit configurations where the SPM resides at S-EL1/2 and upon a 573 * Group0 interrupt triggering while the normal world runs, the 574 * interrupt is routed either through the EHF or directly to the SPMD: 575 * 576 * EL3_EXCEPTION_HANDLING=0: the Group0 interrupt is routed to the SPMD 577 * for handling by spmd_group0_interrupt_handler_nwd. 578 * 579 * EL3_EXCEPTION_HANDLING=1: the Group0 interrupt is routed to the EHF. 580 * 581 */ 582 #if (EL3_EXCEPTION_HANDLING == 0) 583 /* 584 * Register an interrupt handler routing Group0 interrupts to SPMD 585 * while the NWd is running. 586 */ 587 rc = register_interrupt_type_handler(INTR_TYPE_EL3, 588 spmd_group0_interrupt_handler_nwd, 589 flags); 590 if (rc != 0) { 591 panic(); 592 } 593 #endif 594 595 return 0; 596 } 597 598 /******************************************************************************* 599 * Initialize context of SPM Core. 600 ******************************************************************************/ 601 int spmd_setup(void) 602 { 603 int rc; 604 void *spmc_manifest; 605 606 /* 607 * If the SPMC is at EL3, then just initialise it directly. The 608 * shenanigans of when it is at a lower EL are not needed. 609 */ 610 if (is_spmc_at_el3()) { 611 /* Allow the SPMC to populate its attributes directly. */ 612 spmc_populate_attrs(&spmc_attrs); 613 614 rc = spmc_setup(); 615 if (rc != 0) { 616 WARN("SPMC initialisation failed 0x%x.\n", rc); 617 } 618 return 0; 619 } 620 621 spmc_ep_info = bl31_plat_get_next_image_ep_info(SECURE); 622 if (spmc_ep_info == NULL) { 623 WARN("No SPM Core image provided by BL2 boot loader.\n"); 624 return 0; 625 } 626 627 /* Under no circumstances will this parameter be 0 */ 628 assert(spmc_ep_info->pc != 0ULL); 629 630 /* 631 * Check if BL32 ep_info has a reference to 'tos_fw_config'. This will 632 * be used as a manifest for the SPM Core at the next lower EL/mode. 633 */ 634 spmc_manifest = (void *)spmc_ep_info->args.arg0; 635 if (spmc_manifest == NULL) { 636 WARN("Invalid or absent SPM Core manifest.\n"); 637 return 0; 638 } 639 640 /* Load manifest, init SPMC */ 641 rc = spmd_spmc_init(spmc_manifest); 642 if (rc != 0) { 643 WARN("Booting device without SPM initialization.\n"); 644 } 645 646 return 0; 647 } 648 649 /******************************************************************************* 650 * Forward FF-A SMCs to the other security state. 651 ******************************************************************************/ 652 uint64_t spmd_smc_switch_state(uint32_t smc_fid, 653 bool secure_origin, 654 uint64_t x1, 655 uint64_t x2, 656 uint64_t x3, 657 uint64_t x4, 658 void *handle) 659 { 660 unsigned int secure_state_in = (secure_origin) ? SECURE : NON_SECURE; 661 unsigned int secure_state_out = (!secure_origin) ? SECURE : NON_SECURE; 662 663 /* Save incoming security state */ 664 #if SPMD_SPM_AT_SEL2 665 if (secure_state_in == NON_SECURE) { 666 cm_el1_sysregs_context_save(secure_state_in); 667 } 668 cm_el2_sysregs_context_save(secure_state_in); 669 #else 670 cm_el1_sysregs_context_save(secure_state_in); 671 #endif 672 673 /* Restore outgoing security state */ 674 #if SPMD_SPM_AT_SEL2 675 if (secure_state_out == NON_SECURE) { 676 cm_el1_sysregs_context_restore(secure_state_out); 677 } 678 cm_el2_sysregs_context_restore(secure_state_out); 679 #else 680 cm_el1_sysregs_context_restore(secure_state_out); 681 #endif 682 cm_set_next_eret_context(secure_state_out); 683 684 #if SPMD_SPM_AT_SEL2 685 /* 686 * If SPMC is at SEL2, save additional registers x8-x17, which may 687 * be used in FF-A calls such as FFA_PARTITION_INFO_GET_REGS. 688 * Note that technically, all SPMCs can support this, but this code is 689 * under ifdef to minimize breakage in case other SPMCs do not save 690 * and restore x8-x17. 691 * We also need to pass through these registers since not all FF-A ABIs 692 * modify x8-x17, in which case, SMCCC requires that these registers be 693 * preserved, so the SPMD passes through these registers and expects the 694 * SPMC to save and restore (potentially also modify) them. 695 */ 696 SMC_RET18(cm_get_context(secure_state_out), smc_fid, x1, x2, x3, x4, 697 SMC_GET_GP(handle, CTX_GPREG_X5), 698 SMC_GET_GP(handle, CTX_GPREG_X6), 699 SMC_GET_GP(handle, CTX_GPREG_X7), 700 SMC_GET_GP(handle, CTX_GPREG_X8), 701 SMC_GET_GP(handle, CTX_GPREG_X9), 702 SMC_GET_GP(handle, CTX_GPREG_X10), 703 SMC_GET_GP(handle, CTX_GPREG_X11), 704 SMC_GET_GP(handle, CTX_GPREG_X12), 705 SMC_GET_GP(handle, CTX_GPREG_X13), 706 SMC_GET_GP(handle, CTX_GPREG_X14), 707 SMC_GET_GP(handle, CTX_GPREG_X15), 708 SMC_GET_GP(handle, CTX_GPREG_X16), 709 SMC_GET_GP(handle, CTX_GPREG_X17) 710 ); 711 712 #else 713 SMC_RET8(cm_get_context(secure_state_out), smc_fid, x1, x2, x3, x4, 714 SMC_GET_GP(handle, CTX_GPREG_X5), 715 SMC_GET_GP(handle, CTX_GPREG_X6), 716 SMC_GET_GP(handle, CTX_GPREG_X7)); 717 #endif 718 } 719 720 /******************************************************************************* 721 * Forward SMCs to the other security state. 722 ******************************************************************************/ 723 static uint64_t spmd_smc_forward(uint32_t smc_fid, 724 bool secure_origin, 725 uint64_t x1, 726 uint64_t x2, 727 uint64_t x3, 728 uint64_t x4, 729 void *cookie, 730 void *handle, 731 uint64_t flags) 732 { 733 if (is_spmc_at_el3() && !secure_origin) { 734 return spmc_smc_handler(smc_fid, secure_origin, x1, x2, x3, x4, 735 cookie, handle, flags); 736 } 737 return spmd_smc_switch_state(smc_fid, secure_origin, x1, x2, x3, x4, 738 handle); 739 740 } 741 742 /******************************************************************************* 743 * Return FFA_ERROR with specified error code 744 ******************************************************************************/ 745 static uint64_t spmd_ffa_error_return(void *handle, int error_code) 746 { 747 SMC_RET8(handle, (uint32_t) FFA_ERROR, 748 FFA_TARGET_INFO_MBZ, (uint32_t)error_code, 749 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 750 FFA_PARAM_MBZ, FFA_PARAM_MBZ); 751 } 752 753 /******************************************************************************* 754 * spmd_check_address_in_binary_image 755 ******************************************************************************/ 756 bool spmd_check_address_in_binary_image(uint64_t address) 757 { 758 assert(!check_uptr_overflow(spmc_attrs.load_address, spmc_attrs.binary_size)); 759 760 return ((address >= spmc_attrs.load_address) && 761 (address < (spmc_attrs.load_address + spmc_attrs.binary_size))); 762 } 763 764 /****************************************************************************** 765 * spmd_is_spmc_message 766 *****************************************************************************/ 767 static bool spmd_is_spmc_message(unsigned int ep) 768 { 769 if (is_spmc_at_el3()) { 770 return false; 771 } 772 773 return ((ffa_endpoint_destination(ep) == SPMD_DIRECT_MSG_ENDPOINT_ID) 774 && (ffa_endpoint_source(ep) == spmc_attrs.spmc_id)); 775 } 776 777 /****************************************************************************** 778 * spmd_handle_spmc_message 779 *****************************************************************************/ 780 static int spmd_handle_spmc_message(unsigned long long msg, 781 unsigned long long parm1, unsigned long long parm2, 782 unsigned long long parm3, unsigned long long parm4) 783 { 784 VERBOSE("%s %llx %llx %llx %llx %llx\n", __func__, 785 msg, parm1, parm2, parm3, parm4); 786 787 return -EINVAL; 788 } 789 790 /******************************************************************************* 791 * This function forwards FF-A SMCs to either the main SPMD handler or the 792 * SPMC at EL3, depending on the origin security state, if enabled. 793 ******************************************************************************/ 794 uint64_t spmd_ffa_smc_handler(uint32_t smc_fid, 795 uint64_t x1, 796 uint64_t x2, 797 uint64_t x3, 798 uint64_t x4, 799 void *cookie, 800 void *handle, 801 uint64_t flags) 802 { 803 if (is_spmc_at_el3()) { 804 /* 805 * If we have an SPMC at EL3 allow handling of the SMC first. 806 * The SPMC will call back through to SPMD handler if required. 807 */ 808 if (is_caller_secure(flags)) { 809 return spmc_smc_handler(smc_fid, 810 is_caller_secure(flags), 811 x1, x2, x3, x4, cookie, 812 handle, flags); 813 } 814 } 815 return spmd_smc_handler(smc_fid, x1, x2, x3, x4, cookie, 816 handle, flags); 817 } 818 819 /******************************************************************************* 820 * This function handles all SMCs in the range reserved for FFA. Each call is 821 * either forwarded to the other security state or handled by the SPM dispatcher 822 ******************************************************************************/ 823 uint64_t spmd_smc_handler(uint32_t smc_fid, 824 uint64_t x1, 825 uint64_t x2, 826 uint64_t x3, 827 uint64_t x4, 828 void *cookie, 829 void *handle, 830 uint64_t flags) 831 { 832 unsigned int linear_id = plat_my_core_pos(); 833 spmd_spm_core_context_t *ctx = spmd_get_context(); 834 bool secure_origin; 835 int32_t ret; 836 uint32_t input_version; 837 838 /* Determine which security state this SMC originated from */ 839 secure_origin = is_caller_secure(flags); 840 841 VERBOSE("SPM(%u): 0x%x 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 842 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 "\n", 843 linear_id, smc_fid, x1, x2, x3, x4, 844 SMC_GET_GP(handle, CTX_GPREG_X5), 845 SMC_GET_GP(handle, CTX_GPREG_X6), 846 SMC_GET_GP(handle, CTX_GPREG_X7)); 847 848 switch (smc_fid) { 849 case FFA_ERROR: 850 /* 851 * Check if this is the first invocation of this interface on 852 * this CPU. If so, then indicate that the SPM Core initialised 853 * unsuccessfully. 854 */ 855 if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) { 856 spmd_spm_core_sync_exit(x2); 857 } 858 859 return spmd_smc_forward(smc_fid, secure_origin, 860 x1, x2, x3, x4, cookie, 861 handle, flags); 862 break; /* not reached */ 863 864 case FFA_VERSION: 865 input_version = (uint32_t)(0xFFFFFFFF & x1); 866 /* 867 * If caller is secure and SPMC was initialized, 868 * return FFA_VERSION of SPMD. 869 * If caller is non secure and SPMC was initialized, 870 * forward to the EL3 SPMC if enabled, otherwise return 871 * the SPMC version if implemented at a lower EL. 872 * Sanity check to "input_version". 873 * If the EL3 SPMC is enabled, ignore the SPMC state as 874 * this is not used. 875 */ 876 if ((input_version & FFA_VERSION_BIT31_MASK) || 877 (!is_spmc_at_el3() && (ctx->state == SPMC_STATE_RESET))) { 878 ret = FFA_ERROR_NOT_SUPPORTED; 879 } else if (!secure_origin) { 880 if (is_spmc_at_el3()) { 881 /* 882 * Forward the call directly to the EL3 SPMC, if 883 * enabled, as we don't need to wrap the call in 884 * a direct request. 885 */ 886 return spmd_smc_forward(smc_fid, secure_origin, 887 x1, x2, x3, x4, cookie, 888 handle, flags); 889 } 890 891 gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx); 892 uint64_t rc; 893 894 if (spmc_attrs.major_version == 1 && 895 spmc_attrs.minor_version == 0) { 896 ret = MAKE_FFA_VERSION(spmc_attrs.major_version, 897 spmc_attrs.minor_version); 898 SMC_RET8(handle, (uint32_t)ret, 899 FFA_TARGET_INFO_MBZ, 900 FFA_TARGET_INFO_MBZ, 901 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 902 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 903 FFA_PARAM_MBZ); 904 break; 905 } 906 /* Save non-secure system registers context */ 907 cm_el1_sysregs_context_save(NON_SECURE); 908 #if SPMD_SPM_AT_SEL2 909 cm_el2_sysregs_context_save(NON_SECURE); 910 #endif 911 912 /* 913 * The incoming request has FFA_VERSION as X0 smc_fid 914 * and requested version in x1. Prepare a direct request 915 * from SPMD to SPMC with FFA_VERSION framework function 916 * identifier in X2 and requested version in X3. 917 */ 918 spmd_build_spmc_message(gpregs, 919 SPMD_FWK_MSG_FFA_VERSION_REQ, 920 input_version); 921 922 rc = spmd_spm_core_sync_entry(ctx); 923 924 if ((rc != 0ULL) || 925 (SMC_GET_GP(gpregs, CTX_GPREG_X0) != 926 FFA_MSG_SEND_DIRECT_RESP_SMC32) || 927 (SMC_GET_GP(gpregs, CTX_GPREG_X2) != 928 (FFA_FWK_MSG_BIT | 929 SPMD_FWK_MSG_FFA_VERSION_RESP))) { 930 ERROR("Failed to forward FFA_VERSION\n"); 931 ret = FFA_ERROR_NOT_SUPPORTED; 932 } else { 933 ret = SMC_GET_GP(gpregs, CTX_GPREG_X3); 934 } 935 936 /* 937 * Return here after SPMC has handled FFA_VERSION. 938 * The returned SPMC version is held in X3. 939 * Forward this version in X0 to the non-secure caller. 940 */ 941 return spmd_smc_forward(ret, true, FFA_PARAM_MBZ, 942 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 943 FFA_PARAM_MBZ, cookie, gpregs, 944 flags); 945 } else { 946 ret = MAKE_FFA_VERSION(FFA_VERSION_MAJOR, 947 FFA_VERSION_MINOR); 948 } 949 950 SMC_RET8(handle, (uint32_t)ret, FFA_TARGET_INFO_MBZ, 951 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 952 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ); 953 break; /* not reached */ 954 955 case FFA_FEATURES: 956 /* 957 * This is an optional interface. Do the minimal checks and 958 * forward to SPM Core which will handle it if implemented. 959 */ 960 961 /* Forward SMC from Normal world to the SPM Core */ 962 if (!secure_origin) { 963 return spmd_smc_forward(smc_fid, secure_origin, 964 x1, x2, x3, x4, cookie, 965 handle, flags); 966 } 967 968 /* 969 * Return success if call was from secure world i.e. all 970 * FFA functions are supported. This is essentially a 971 * nop. 972 */ 973 SMC_RET8(handle, FFA_SUCCESS_SMC32, x1, x2, x3, x4, 974 SMC_GET_GP(handle, CTX_GPREG_X5), 975 SMC_GET_GP(handle, CTX_GPREG_X6), 976 SMC_GET_GP(handle, CTX_GPREG_X7)); 977 978 break; /* not reached */ 979 980 case FFA_ID_GET: 981 /* 982 * Returns the ID of the calling FFA component. 983 */ 984 if (!secure_origin) { 985 SMC_RET8(handle, FFA_SUCCESS_SMC32, 986 FFA_TARGET_INFO_MBZ, FFA_NS_ENDPOINT_ID, 987 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 988 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 989 FFA_PARAM_MBZ); 990 } 991 992 SMC_RET8(handle, FFA_SUCCESS_SMC32, 993 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id, 994 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 995 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 996 FFA_PARAM_MBZ); 997 998 break; /* not reached */ 999 1000 case FFA_SECONDARY_EP_REGISTER_SMC64: 1001 if (secure_origin) { 1002 ret = spmd_pm_secondary_ep_register(x1); 1003 1004 if (ret < 0) { 1005 SMC_RET8(handle, FFA_ERROR_SMC64, 1006 FFA_TARGET_INFO_MBZ, ret, 1007 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1008 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1009 FFA_PARAM_MBZ); 1010 } else { 1011 SMC_RET8(handle, FFA_SUCCESS_SMC64, 1012 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ, 1013 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1014 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1015 FFA_PARAM_MBZ); 1016 } 1017 } 1018 1019 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1020 break; /* Not reached */ 1021 1022 case FFA_SPM_ID_GET: 1023 if (MAKE_FFA_VERSION(1, 1) > FFA_VERSION_COMPILED) { 1024 return spmd_ffa_error_return(handle, 1025 FFA_ERROR_NOT_SUPPORTED); 1026 } 1027 /* 1028 * Returns the ID of the SPMC or SPMD depending on the FF-A 1029 * instance where this function is invoked 1030 */ 1031 if (!secure_origin) { 1032 SMC_RET8(handle, FFA_SUCCESS_SMC32, 1033 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id, 1034 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1035 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1036 FFA_PARAM_MBZ); 1037 } 1038 SMC_RET8(handle, FFA_SUCCESS_SMC32, 1039 FFA_TARGET_INFO_MBZ, SPMD_DIRECT_MSG_ENDPOINT_ID, 1040 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1041 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1042 FFA_PARAM_MBZ); 1043 1044 break; /* not reached */ 1045 1046 case FFA_MSG_SEND_DIRECT_REQ_SMC32: 1047 case FFA_MSG_SEND_DIRECT_REQ_SMC64: 1048 if (!secure_origin) { 1049 /* Validate source endpoint is non-secure for non-secure caller. */ 1050 if (ffa_is_secure_world_id(ffa_endpoint_source(x1))) { 1051 return spmd_ffa_error_return(handle, 1052 FFA_ERROR_INVALID_PARAMETER); 1053 } 1054 } 1055 if (secure_origin && spmd_is_spmc_message(x1)) { 1056 ret = spmd_handle_spmc_message(x3, x4, 1057 SMC_GET_GP(handle, CTX_GPREG_X5), 1058 SMC_GET_GP(handle, CTX_GPREG_X6), 1059 SMC_GET_GP(handle, CTX_GPREG_X7)); 1060 1061 SMC_RET8(handle, FFA_SUCCESS_SMC32, 1062 FFA_TARGET_INFO_MBZ, ret, 1063 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1064 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1065 FFA_PARAM_MBZ); 1066 } else { 1067 /* Forward direct message to the other world */ 1068 return spmd_smc_forward(smc_fid, secure_origin, 1069 x1, x2, x3, x4, cookie, 1070 handle, flags); 1071 } 1072 break; /* Not reached */ 1073 1074 case FFA_MSG_SEND_DIRECT_RESP_SMC32: 1075 if (secure_origin && spmd_is_spmc_message(x1)) { 1076 spmd_spm_core_sync_exit(0ULL); 1077 } else { 1078 /* Forward direct message to the other world */ 1079 return spmd_smc_forward(smc_fid, secure_origin, 1080 x1, x2, x3, x4, cookie, 1081 handle, flags); 1082 } 1083 break; /* Not reached */ 1084 1085 case FFA_RX_RELEASE: 1086 case FFA_RXTX_MAP_SMC32: 1087 case FFA_RXTX_MAP_SMC64: 1088 case FFA_RXTX_UNMAP: 1089 case FFA_PARTITION_INFO_GET: 1090 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED 1091 case FFA_NOTIFICATION_BITMAP_CREATE: 1092 case FFA_NOTIFICATION_BITMAP_DESTROY: 1093 case FFA_NOTIFICATION_BIND: 1094 case FFA_NOTIFICATION_UNBIND: 1095 case FFA_NOTIFICATION_SET: 1096 case FFA_NOTIFICATION_GET: 1097 case FFA_NOTIFICATION_INFO_GET: 1098 case FFA_NOTIFICATION_INFO_GET_SMC64: 1099 case FFA_MSG_SEND2: 1100 case FFA_RX_ACQUIRE: 1101 #endif 1102 case FFA_MSG_RUN: 1103 /* 1104 * Above calls should be invoked only by the Normal world and 1105 * must not be forwarded from Secure world to Normal world. 1106 */ 1107 if (secure_origin) { 1108 return spmd_ffa_error_return(handle, 1109 FFA_ERROR_NOT_SUPPORTED); 1110 } 1111 1112 /* Forward the call to the other world */ 1113 /* fallthrough */ 1114 case FFA_MSG_SEND: 1115 case FFA_MSG_SEND_DIRECT_RESP_SMC64: 1116 case FFA_MEM_DONATE_SMC32: 1117 case FFA_MEM_DONATE_SMC64: 1118 case FFA_MEM_LEND_SMC32: 1119 case FFA_MEM_LEND_SMC64: 1120 case FFA_MEM_SHARE_SMC32: 1121 case FFA_MEM_SHARE_SMC64: 1122 case FFA_MEM_RETRIEVE_REQ_SMC32: 1123 case FFA_MEM_RETRIEVE_REQ_SMC64: 1124 case FFA_MEM_RETRIEVE_RESP: 1125 case FFA_MEM_RELINQUISH: 1126 case FFA_MEM_RECLAIM: 1127 case FFA_MEM_FRAG_TX: 1128 case FFA_MEM_FRAG_RX: 1129 case FFA_SUCCESS_SMC32: 1130 case FFA_SUCCESS_SMC64: 1131 /* 1132 * TODO: Assume that no requests originate from EL3 at the 1133 * moment. This will change if a SP service is required in 1134 * response to secure interrupts targeted to EL3. Until then 1135 * simply forward the call to the Normal world. 1136 */ 1137 1138 return spmd_smc_forward(smc_fid, secure_origin, 1139 x1, x2, x3, x4, cookie, 1140 handle, flags); 1141 break; /* not reached */ 1142 1143 case FFA_MSG_WAIT: 1144 /* 1145 * Check if this is the first invocation of this interface on 1146 * this CPU from the Secure world. If so, then indicate that the 1147 * SPM Core initialised successfully. 1148 */ 1149 if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) { 1150 spmd_spm_core_sync_exit(0ULL); 1151 } 1152 1153 /* Forward the call to the other world */ 1154 /* fallthrough */ 1155 case FFA_INTERRUPT: 1156 case FFA_MSG_YIELD: 1157 /* This interface must be invoked only by the Secure world */ 1158 if (!secure_origin) { 1159 return spmd_ffa_error_return(handle, 1160 FFA_ERROR_NOT_SUPPORTED); 1161 } 1162 1163 return spmd_smc_forward(smc_fid, secure_origin, 1164 x1, x2, x3, x4, cookie, 1165 handle, flags); 1166 break; /* not reached */ 1167 1168 case FFA_NORMAL_WORLD_RESUME: 1169 if (secure_origin && ctx->secure_interrupt_ongoing) { 1170 spmd_spm_core_sync_exit(0ULL); 1171 } else { 1172 return spmd_ffa_error_return(handle, FFA_ERROR_DENIED); 1173 } 1174 break; /* Not reached */ 1175 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED 1176 case FFA_PARTITION_INFO_GET_REGS_SMC64: 1177 if (secure_origin) { 1178 /* TODO: Future patches to enable support for this */ 1179 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1180 } 1181 1182 /* Call only supported with SMCCC 1.2+ */ 1183 if (MAKE_SMCCC_VERSION(SMCCC_MAJOR_VERSION, SMCCC_MINOR_VERSION) < 0x10002) { 1184 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1185 } 1186 1187 return spmd_smc_forward(smc_fid, secure_origin, 1188 x1, x2, x3, x4, cookie, 1189 handle, flags); 1190 break; /* Not reached */ 1191 #endif 1192 case FFA_EL3_INTR_HANDLE: 1193 if (secure_origin) { 1194 return spmd_handle_group0_intr_swd(handle); 1195 } else { 1196 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1197 } 1198 default: 1199 WARN("SPM: Unsupported call 0x%08x\n", smc_fid); 1200 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1201 } 1202 } 1203