1 /* 2 * Copyright (c) 2020-2025, Arm Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <inttypes.h> 10 #include <stdint.h> 11 #include <string.h> 12 13 #include <arch_helpers.h> 14 #include <arch/aarch64/arch_features.h> 15 #include <bl31/bl31.h> 16 #include <bl31/interrupt_mgmt.h> 17 #include <common/debug.h> 18 #include <common/runtime_svc.h> 19 #include <common/tbbr/tbbr_img_def.h> 20 #include <lib/el3_runtime/context_mgmt.h> 21 #include <lib/fconf/fconf.h> 22 #include <lib/fconf/fconf_dyn_cfg_getter.h> 23 #include <lib/smccc.h> 24 #include <lib/spinlock.h> 25 #include <lib/utils.h> 26 #include <lib/xlat_tables/xlat_tables_v2.h> 27 #include <plat/common/common_def.h> 28 #include <plat/common/platform.h> 29 #include <platform_def.h> 30 #include <services/el3_spmd_logical_sp.h> 31 #include <services/ffa_svc.h> 32 #include <services/spmc_svc.h> 33 #include <services/spmd_svc.h> 34 #include <smccc_helpers.h> 35 #include "spmd_private.h" 36 37 /******************************************************************************* 38 * SPM Core context information. 39 ******************************************************************************/ 40 static spmd_spm_core_context_t spm_core_context[PLATFORM_CORE_COUNT]; 41 42 /******************************************************************************* 43 * SPM Core attribute information is read from its manifest if the SPMC is not 44 * at EL3. Else, it is populated from the SPMC directly. 45 ******************************************************************************/ 46 static spmc_manifest_attribute_t spmc_attrs; 47 48 /******************************************************************************* 49 * FFA version used by nonsecure endpoint. 50 ******************************************************************************/ 51 static uint32_t nonsecure_ffa_version; 52 53 /******************************************************************************* 54 * Whether the normal world finished negotiating its version. 55 ******************************************************************************/ 56 static bool nonsecure_version_negotiated; 57 58 /******************************************************************************* 59 * FFA version used by SPMC, as seen by the normal world. 60 ******************************************************************************/ 61 static uint32_t spmc_nwd_ffa_version; 62 63 /******************************************************************************* 64 * SPM Core entry point information. Discovered on the primary core and reused 65 * on secondary cores. 66 ******************************************************************************/ 67 static entry_point_info_t *spmc_ep_info; 68 69 /******************************************************************************* 70 * SPM Core context on current CPU get helper. 71 ******************************************************************************/ 72 spmd_spm_core_context_t *spmd_get_context(void) 73 { 74 return &spm_core_context[plat_my_core_pos()]; 75 } 76 77 /******************************************************************************* 78 * SPM Core ID getter. 79 ******************************************************************************/ 80 uint16_t spmd_spmc_id_get(void) 81 { 82 return spmc_attrs.spmc_id; 83 } 84 85 /******************************************************************************* 86 * Static function declaration. 87 ******************************************************************************/ 88 static int32_t spmd_init(void); 89 static int spmd_spmc_init(void *pm_addr); 90 91 static uint64_t spmd_smc_forward(uint32_t smc_fid, 92 bool secure_origin, 93 uint64_t x1, 94 uint64_t x2, 95 uint64_t x3, 96 uint64_t x4, 97 void *cookie, 98 void *handle, 99 uint64_t flags, 100 uint32_t secure_ffa_version); 101 102 /****************************************************************************** 103 * Builds an SPMD to SPMC direct message request. 104 *****************************************************************************/ 105 void spmd_build_spmc_message(gp_regs_t *gpregs, uint8_t target_func, 106 unsigned long long message) 107 { 108 write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_MSG_SEND_DIRECT_REQ_SMC32); 109 write_ctx_reg(gpregs, CTX_GPREG_X1, 110 (SPMD_DIRECT_MSG_ENDPOINT_ID << FFA_DIRECT_MSG_SOURCE_SHIFT) | 111 spmd_spmc_id_get()); 112 write_ctx_reg(gpregs, CTX_GPREG_X2, BIT(31) | target_func); 113 write_ctx_reg(gpregs, CTX_GPREG_X3, message); 114 115 /* Zero out x4-x7 for the direct request emitted towards the SPMC. */ 116 write_ctx_reg(gpregs, CTX_GPREG_X4, 0); 117 write_ctx_reg(gpregs, CTX_GPREG_X5, 0); 118 write_ctx_reg(gpregs, CTX_GPREG_X6, 0); 119 write_ctx_reg(gpregs, CTX_GPREG_X7, 0); 120 } 121 122 123 /******************************************************************************* 124 * This function takes an SPMC context pointer and performs a synchronous 125 * SPMC entry. 126 ******************************************************************************/ 127 uint64_t spmd_spm_core_sync_entry(spmd_spm_core_context_t *spmc_ctx) 128 { 129 uint64_t rc; 130 131 assert(spmc_ctx != NULL); 132 133 cm_set_context(&(spmc_ctx->cpu_ctx), SECURE); 134 135 /* Restore the context assigned above */ 136 #if SPMD_SPM_AT_SEL2 137 cm_el2_sysregs_context_restore(SECURE); 138 #else 139 cm_el1_sysregs_context_restore(SECURE); 140 #endif 141 cm_set_next_eret_context(SECURE); 142 143 /* Enter SPMC */ 144 rc = spmd_spm_core_enter(&spmc_ctx->c_rt_ctx); 145 146 /* Save secure state */ 147 #if SPMD_SPM_AT_SEL2 148 cm_el2_sysregs_context_save(SECURE); 149 #else 150 cm_el1_sysregs_context_save(SECURE); 151 #endif 152 153 return rc; 154 } 155 156 /******************************************************************************* 157 * This function returns to the place where spmd_spm_core_sync_entry() was 158 * called originally. 159 ******************************************************************************/ 160 __dead2 void spmd_spm_core_sync_exit(uint64_t rc) 161 { 162 spmd_spm_core_context_t *ctx = spmd_get_context(); 163 164 /* Get current CPU context from SPMC context */ 165 assert(cm_get_context(SECURE) == &(ctx->cpu_ctx)); 166 167 /* 168 * The SPMD must have initiated the original request through a 169 * synchronous entry into SPMC. Jump back to the original C runtime 170 * context with the value of rc in x0; 171 */ 172 spmd_spm_core_exit(ctx->c_rt_ctx, rc); 173 174 panic(); 175 } 176 177 /******************************************************************************* 178 * Jump to the SPM Core for the first time. 179 ******************************************************************************/ 180 static int32_t spmd_init(void) 181 { 182 spmd_spm_core_context_t *ctx = spmd_get_context(); 183 uint64_t rc; 184 185 VERBOSE("SPM Core init start.\n"); 186 187 /* Primary boot core enters the SPMC for initialization. */ 188 ctx->state = SPMC_STATE_ON_PENDING; 189 190 rc = spmd_spm_core_sync_entry(ctx); 191 if (rc != 0ULL) { 192 ERROR("SPMC initialisation failed 0x%" PRIx64 "\n", rc); 193 return 0; 194 } 195 196 ctx->state = SPMC_STATE_ON; 197 198 VERBOSE("SPM Core init end.\n"); 199 200 spmd_logical_sp_set_spmc_initialized(); 201 rc = spmd_logical_sp_init(); 202 if (rc != 0) { 203 WARN("SPMD Logical partitions failed init.\n"); 204 } 205 206 return 1; 207 } 208 209 /******************************************************************************* 210 * spmd_secure_interrupt_handler 211 * Enter the SPMC for further handling of the secure interrupt by the SPMC 212 * itself or a Secure Partition. 213 ******************************************************************************/ 214 static uint64_t spmd_secure_interrupt_handler(uint32_t id, 215 uint32_t flags, 216 void *handle, 217 void *cookie) 218 { 219 spmd_spm_core_context_t *ctx = spmd_get_context(); 220 gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx); 221 int64_t rc; 222 223 /* Sanity check the security state when the exception was generated */ 224 assert(get_interrupt_src_ss(flags) == NON_SECURE); 225 226 /* Sanity check the pointer to this cpu's context */ 227 assert(handle == cm_get_context(NON_SECURE)); 228 229 /* Save the non-secure context before entering SPMC */ 230 #if SPMD_SPM_AT_SEL2 231 cm_el2_sysregs_context_save(NON_SECURE); 232 #else 233 cm_el1_sysregs_context_save(NON_SECURE); 234 235 #if CTX_INCLUDE_FPREGS || CTX_INCLUDE_SVE_REGS 236 /* 237 * The hint bit denoting absence of SVE live state is effectively false 238 * in this scenario where execution was trapped to EL3 due to FIQ. 239 */ 240 simd_ctx_save(NON_SECURE, false); 241 simd_ctx_restore(SECURE); 242 #endif 243 #endif 244 245 /* Convey the event to the SPMC through the FFA_INTERRUPT interface. */ 246 write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_INTERRUPT); 247 write_ctx_reg(gpregs, CTX_GPREG_X1, 0); 248 write_ctx_reg(gpregs, CTX_GPREG_X2, 0); 249 write_ctx_reg(gpregs, CTX_GPREG_X3, 0); 250 write_ctx_reg(gpregs, CTX_GPREG_X4, 0); 251 write_ctx_reg(gpregs, CTX_GPREG_X5, 0); 252 write_ctx_reg(gpregs, CTX_GPREG_X6, 0); 253 write_ctx_reg(gpregs, CTX_GPREG_X7, 0); 254 255 /* Mark current core as handling a secure interrupt. */ 256 ctx->secure_interrupt_ongoing = true; 257 258 rc = spmd_spm_core_sync_entry(ctx); 259 260 if (rc != 0ULL) { 261 ERROR("%s failed (%" PRId64 ") on CPU%u\n", __func__, rc, plat_my_core_pos()); 262 } 263 264 ctx->secure_interrupt_ongoing = false; 265 266 #if SPMD_SPM_AT_SEL2 267 cm_el2_sysregs_context_restore(NON_SECURE); 268 #else 269 cm_el1_sysregs_context_restore(NON_SECURE); 270 271 #if CTX_INCLUDE_FPREGS || CTX_INCLUDE_SVE_REGS 272 simd_ctx_save(SECURE, false); 273 simd_ctx_restore(NON_SECURE); 274 #endif 275 #endif 276 cm_set_next_eret_context(NON_SECURE); 277 278 SMC_RET0(&ctx->cpu_ctx); 279 } 280 281 #if (EL3_EXCEPTION_HANDLING == 0) 282 /******************************************************************************* 283 * spmd_group0_interrupt_handler_nwd 284 * Group0 secure interrupt in the normal world are trapped to EL3. Delegate the 285 * handling of the interrupt to the platform handler, and return only upon 286 * successfully handling the Group0 interrupt. 287 ******************************************************************************/ 288 static uint64_t spmd_group0_interrupt_handler_nwd(uint32_t id, 289 uint32_t flags, 290 void *handle, 291 void *cookie) 292 { 293 uint32_t intid; 294 295 /* Sanity check the security state when the exception was generated. */ 296 assert(get_interrupt_src_ss(flags) == NON_SECURE); 297 298 /* Sanity check the pointer to this cpu's context. */ 299 assert(handle == cm_get_context(NON_SECURE)); 300 301 assert(id == INTR_ID_UNAVAILABLE); 302 303 assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3); 304 305 intid = plat_ic_acknowledge_interrupt(); 306 307 if (plat_spmd_handle_group0_interrupt(intid) < 0) { 308 ERROR("Group0 interrupt %u not handled\n", intid); 309 panic(); 310 } 311 312 /* Deactivate the corresponding Group0 interrupt. */ 313 plat_ic_end_of_interrupt(intid); 314 315 return 0U; 316 } 317 #endif 318 319 /******************************************************************************* 320 * spmd_handle_group0_intr_swd 321 * SPMC delegates handling of Group0 secure interrupt to EL3 firmware using 322 * FFA_EL3_INTR_HANDLE SMC call. Further, SPMD delegates the handling of the 323 * interrupt to the platform handler, and returns only upon successfully 324 * handling the Group0 interrupt. 325 ******************************************************************************/ 326 static uint64_t spmd_handle_group0_intr_swd(void *handle) 327 { 328 uint32_t intid; 329 330 /* Sanity check the pointer to this cpu's context */ 331 assert(handle == cm_get_context(SECURE)); 332 333 assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3); 334 335 intid = plat_ic_acknowledge_interrupt(); 336 337 /* 338 * TODO: Currently due to a limitation in SPMD implementation, the 339 * platform handler is expected to not delegate handling to NWd while 340 * processing Group0 secure interrupt. 341 */ 342 if (plat_spmd_handle_group0_interrupt(intid) < 0) { 343 /* Group0 interrupt was not handled by the platform. */ 344 ERROR("Group0 interrupt %u not handled\n", intid); 345 panic(); 346 } 347 348 /* Deactivate the corresponding Group0 interrupt. */ 349 plat_ic_end_of_interrupt(intid); 350 351 /* Return success. */ 352 SMC_RET8(handle, FFA_SUCCESS_SMC32, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 353 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 354 FFA_PARAM_MBZ); 355 } 356 357 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 358 static int spmd_dynamic_map_mem(uintptr_t base_addr, size_t size, 359 unsigned int attr, uintptr_t *align_addr, 360 size_t *align_size) 361 { 362 uintptr_t base_addr_align; 363 size_t mapped_size_align; 364 int rc; 365 366 /* Page aligned address and size if necessary */ 367 base_addr_align = page_align(base_addr, DOWN); 368 mapped_size_align = page_align(size, UP); 369 370 if ((base_addr != base_addr_align) && 371 (size == mapped_size_align)) { 372 mapped_size_align += PAGE_SIZE; 373 } 374 375 /* 376 * Map dynamically given region with its aligned base address and 377 * size 378 */ 379 rc = mmap_add_dynamic_region((unsigned long long)base_addr_align, 380 base_addr_align, 381 mapped_size_align, 382 attr); 383 if (rc == 0) { 384 *align_addr = base_addr_align; 385 *align_size = mapped_size_align; 386 } 387 388 return rc; 389 } 390 391 static void spmd_do_sec_cpy(uintptr_t root_base_addr, uintptr_t sec_base_addr, 392 size_t size) 393 { 394 uintptr_t root_base_addr_align, sec_base_addr_align; 395 size_t root_mapped_size_align, sec_mapped_size_align; 396 int rc; 397 398 assert(root_base_addr != 0UL); 399 assert(sec_base_addr != 0UL); 400 assert(size != 0UL); 401 402 /* Map the memory with required attributes */ 403 rc = spmd_dynamic_map_mem(root_base_addr, size, MT_RO_DATA | MT_ROOT, 404 &root_base_addr_align, 405 &root_mapped_size_align); 406 if (rc != 0) { 407 ERROR("%s %s %lu (%d)\n", "Error while mapping", "root region", 408 root_base_addr, rc); 409 panic(); 410 } 411 412 rc = spmd_dynamic_map_mem(sec_base_addr, size, MT_RW_DATA | MT_SECURE, 413 &sec_base_addr_align, &sec_mapped_size_align); 414 if (rc != 0) { 415 ERROR("%s %s %lu (%d)\n", "Error while mapping", 416 "secure region", sec_base_addr, rc); 417 panic(); 418 } 419 420 /* Do copy operation */ 421 (void)memcpy((void *)sec_base_addr, (void *)root_base_addr, size); 422 423 /* Unmap root memory region */ 424 rc = mmap_remove_dynamic_region(root_base_addr_align, 425 root_mapped_size_align); 426 if (rc != 0) { 427 ERROR("%s %s %lu (%d)\n", "Error while unmapping", 428 "root region", root_base_addr_align, rc); 429 panic(); 430 } 431 432 /* Unmap secure memory region */ 433 rc = mmap_remove_dynamic_region(sec_base_addr_align, 434 sec_mapped_size_align); 435 if (rc != 0) { 436 ERROR("%s %s %lu (%d)\n", "Error while unmapping", 437 "secure region", sec_base_addr_align, rc); 438 panic(); 439 } 440 } 441 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */ 442 443 /******************************************************************************* 444 * Loads SPMC manifest and inits SPMC. 445 ******************************************************************************/ 446 static int spmd_spmc_init(void *pm_addr) 447 { 448 cpu_context_t *cpu_ctx; 449 unsigned int core_id; 450 uint32_t ep_attr, flags; 451 int rc; 452 const struct dyn_cfg_dtb_info_t *image_info __unused; 453 454 /* Load the SPM Core manifest */ 455 rc = plat_spm_core_manifest_load(&spmc_attrs, pm_addr); 456 if (rc != 0) { 457 WARN("No or invalid SPM Core manifest image provided by BL2\n"); 458 return rc; 459 } 460 461 /* 462 * Ensure that the SPM Core version is compatible with the SPM 463 * Dispatcher version. 464 */ 465 if ((spmc_attrs.major_version != FFA_VERSION_MAJOR) || 466 (spmc_attrs.minor_version > FFA_VERSION_MINOR)) { 467 WARN("Unsupported FFA version (%u.%u)\n", 468 spmc_attrs.major_version, spmc_attrs.minor_version); 469 return -EINVAL; 470 } 471 472 VERBOSE("FFA version (%u.%u)\n", spmc_attrs.major_version, 473 spmc_attrs.minor_version); 474 475 VERBOSE("SPM Core run time EL%x.\n", 476 SPMD_SPM_AT_SEL2 ? MODE_EL2 : MODE_EL1); 477 478 /* Validate the SPMC ID, Ensure high bit is set */ 479 if (((spmc_attrs.spmc_id >> SPMC_SECURE_ID_SHIFT) & 480 SPMC_SECURE_ID_MASK) == 0U) { 481 WARN("Invalid ID (0x%x) for SPMC.\n", spmc_attrs.spmc_id); 482 return -EINVAL; 483 } 484 485 /* Validate the SPM Core execution state */ 486 if ((spmc_attrs.exec_state != MODE_RW_64) && 487 (spmc_attrs.exec_state != MODE_RW_32)) { 488 WARN("Unsupported %s%x.\n", "SPM Core execution state 0x", 489 spmc_attrs.exec_state); 490 return -EINVAL; 491 } 492 493 VERBOSE("%s%x.\n", "SPM Core execution state 0x", 494 spmc_attrs.exec_state); 495 496 #if SPMD_SPM_AT_SEL2 497 /* Ensure manifest has not requested AArch32 state in S-EL2 */ 498 if (spmc_attrs.exec_state == MODE_RW_32) { 499 WARN("AArch32 state at S-EL2 is not supported.\n"); 500 return -EINVAL; 501 } 502 503 /* 504 * Check if S-EL2 is supported on this system if S-EL2 505 * is required for SPM 506 */ 507 if (!is_feat_sel2_supported()) { 508 WARN("SPM Core run time S-EL2 is not supported.\n"); 509 return -EINVAL; 510 } 511 #endif /* SPMD_SPM_AT_SEL2 */ 512 513 /* Initialise an entrypoint to set up the CPU context */ 514 ep_attr = SECURE | EP_ST_ENABLE; 515 if ((read_sctlr_el3() & SCTLR_EE_BIT) != 0ULL) { 516 ep_attr |= EP_EE_BIG; 517 } 518 519 SET_PARAM_HEAD(spmc_ep_info, PARAM_EP, VERSION_1, ep_attr); 520 521 /* 522 * Populate SPSR for SPM Core based upon validated parameters from the 523 * manifest. 524 */ 525 if (spmc_attrs.exec_state == MODE_RW_32) { 526 spmc_ep_info->spsr = SPSR_MODE32(MODE32_svc, SPSR_T_ARM, 527 SPSR_E_LITTLE, 528 DAIF_FIQ_BIT | 529 DAIF_IRQ_BIT | 530 DAIF_ABT_BIT); 531 } else { 532 533 #if SPMD_SPM_AT_SEL2 534 static const uint32_t runtime_el = MODE_EL2; 535 #else 536 static const uint32_t runtime_el = MODE_EL1; 537 #endif 538 spmc_ep_info->spsr = SPSR_64(runtime_el, 539 MODE_SP_ELX, 540 DISABLE_ALL_EXCEPTIONS); 541 } 542 543 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 544 image_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TOS_FW_CONFIG_ID); 545 assert(image_info != NULL); 546 547 if ((image_info->config_addr == 0UL) || 548 (image_info->secondary_config_addr == 0UL) || 549 (image_info->config_max_size == 0UL)) { 550 return -EINVAL; 551 } 552 553 /* Copy manifest from root->secure region */ 554 spmd_do_sec_cpy(image_info->config_addr, 555 image_info->secondary_config_addr, 556 image_info->config_max_size); 557 558 /* Update ep info of BL32 */ 559 assert(spmc_ep_info != NULL); 560 spmc_ep_info->args.arg0 = image_info->secondary_config_addr; 561 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */ 562 563 /* Set an initial SPMC context state for all cores. */ 564 for (core_id = 0U; core_id < PLATFORM_CORE_COUNT; core_id++) { 565 spm_core_context[core_id].state = SPMC_STATE_OFF; 566 567 /* Setup an initial cpu context for the SPMC. */ 568 cpu_ctx = &spm_core_context[core_id].cpu_ctx; 569 cm_setup_context(cpu_ctx, spmc_ep_info); 570 571 /* 572 * Pass the core linear ID to the SPMC through x4. 573 * (TF-A implementation defined behavior helping 574 * a legacy TOS migration to adopt FF-A). 575 */ 576 write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X4, core_id); 577 } 578 579 /* Register power management hooks with PSCI */ 580 psci_register_spd_pm_hook(&spmd_pm); 581 582 /* Register init function for deferred init. */ 583 bl31_register_bl32_init(&spmd_init); 584 585 INFO("SPM Core setup done.\n"); 586 587 /* 588 * Register an interrupt handler routing secure interrupts to SPMD 589 * while the NWd is running. 590 */ 591 flags = 0; 592 set_interrupt_rm_flag(flags, NON_SECURE); 593 rc = register_interrupt_type_handler(INTR_TYPE_S_EL1, 594 spmd_secure_interrupt_handler, 595 flags); 596 if (rc != 0) { 597 panic(); 598 } 599 600 /* 601 * Permit configurations where the SPM resides at S-EL1/2 and upon a 602 * Group0 interrupt triggering while the normal world runs, the 603 * interrupt is routed either through the EHF or directly to the SPMD: 604 * 605 * EL3_EXCEPTION_HANDLING=0: the Group0 interrupt is routed to the SPMD 606 * for handling by spmd_group0_interrupt_handler_nwd. 607 * 608 * EL3_EXCEPTION_HANDLING=1: the Group0 interrupt is routed to the EHF. 609 * 610 */ 611 #if (EL3_EXCEPTION_HANDLING == 0) 612 /* 613 * If EL3 interrupts are supported by the platform, register an 614 * interrupt handler routing Group0 interrupts to SPMD while the NWd is 615 * running. 616 */ 617 if (plat_ic_has_interrupt_type(INTR_TYPE_EL3)) { 618 rc = register_interrupt_type_handler(INTR_TYPE_EL3, 619 spmd_group0_interrupt_handler_nwd, 620 flags); 621 if (rc != 0) { 622 panic(); 623 } 624 } 625 #endif 626 627 return 0; 628 } 629 630 /******************************************************************************* 631 * Initialize context of SPM Core. 632 ******************************************************************************/ 633 int spmd_setup(void) 634 { 635 int rc; 636 void *spmc_manifest; 637 638 /* 639 * If the SPMC is at EL3, then just initialise it directly. The 640 * shenanigans of when it is at a lower EL are not needed. 641 */ 642 if (is_spmc_at_el3()) { 643 /* Allow the SPMC to populate its attributes directly. */ 644 spmc_populate_attrs(&spmc_attrs); 645 646 rc = spmc_setup(); 647 if (rc != 0) { 648 WARN("SPMC initialisation failed 0x%x.\n", rc); 649 } 650 return 0; 651 } 652 653 spmc_ep_info = bl31_plat_get_next_image_ep_info(SECURE); 654 if (spmc_ep_info == NULL) { 655 WARN("No SPM Core image provided by BL2 boot loader.\n"); 656 return 0; 657 } 658 659 /* Under no circumstances will this parameter be 0 */ 660 assert(spmc_ep_info->pc != 0ULL); 661 662 /* 663 * Check if BL32 ep_info has a reference to 'tos_fw_config'. This will 664 * be used as a manifest for the SPM Core at the next lower EL/mode. 665 */ 666 spmc_manifest = (void *)spmc_ep_info->args.arg0; 667 if (spmc_manifest == NULL) { 668 WARN("Invalid or absent SPM Core manifest.\n"); 669 return 0; 670 } 671 672 /* Load manifest, init SPMC */ 673 rc = spmd_spmc_init(spmc_manifest); 674 if (rc != 0) { 675 WARN("Booting device without SPM initialization.\n"); 676 } 677 678 return 0; 679 } 680 681 /******************************************************************************* 682 * Forward FF-A SMCs to the other security state. 683 ******************************************************************************/ 684 uint64_t spmd_smc_switch_state(uint32_t smc_fid, 685 bool secure_origin, 686 uint64_t x1, 687 uint64_t x2, 688 uint64_t x3, 689 uint64_t x4, 690 void *handle, 691 uint64_t flags, 692 uint32_t secure_ffa_version) 693 { 694 unsigned int secure_state_in = (secure_origin) ? SECURE : NON_SECURE; 695 unsigned int secure_state_out = (!secure_origin) ? SECURE : NON_SECURE; 696 uint32_t version_in = (secure_origin) ? secure_ffa_version : nonsecure_ffa_version; 697 uint32_t version_out = (!secure_origin) ? secure_ffa_version : nonsecure_ffa_version; 698 void *ctx_out; 699 700 #if SPMD_SPM_AT_SEL2 701 if ((secure_state_out == SECURE) && (is_sve_hint_set(flags) == true)) { 702 /* 703 * Set the SVE hint bit in x0 and pass to the lower secure EL, 704 * if it was set by the caller. 705 */ 706 smc_fid |= (FUNCID_SVE_HINT_MASK << FUNCID_SVE_HINT_SHIFT); 707 } 708 #endif 709 710 /* Save incoming security state */ 711 #if SPMD_SPM_AT_SEL2 712 cm_el2_sysregs_context_save(secure_state_in); 713 #else 714 cm_el1_sysregs_context_save(secure_state_in); 715 #if CTX_INCLUDE_FPREGS || CTX_INCLUDE_SVE_REGS 716 /* Forward the hint bit denoting the absence of SVE live state. */ 717 simd_ctx_save(secure_state_in, (!secure_origin && (is_sve_hint_set(flags) == true))); 718 #endif 719 #endif 720 721 /* Restore outgoing security state */ 722 #if SPMD_SPM_AT_SEL2 723 cm_el2_sysregs_context_restore(secure_state_out); 724 #else 725 cm_el1_sysregs_context_restore(secure_state_out); 726 #if CTX_INCLUDE_FPREGS || CTX_INCLUDE_SVE_REGS 727 simd_ctx_restore(secure_state_out); 728 #endif 729 #endif 730 cm_set_next_eret_context(secure_state_out); 731 732 ctx_out = cm_get_context(secure_state_out); 733 if (smc_fid == FFA_NORMAL_WORLD_RESUME) { 734 SMC_RET0(ctx_out); 735 } 736 737 if ((GET_SMC_CC(smc_fid) == SMC_64) && (version_out >= MAKE_FFA_VERSION(U(1), U(2)))) { 738 if (version_in < MAKE_FFA_VERSION(U(1), U(2))) { 739 /* FFA version mismatch, with dest >= 1.2 - set outgoing x8-x17 to zero */ 740 SMC_RET18(ctx_out, smc_fid, x1, x2, x3, x4, 741 SMC_GET_GP(handle, CTX_GPREG_X5), 742 SMC_GET_GP(handle, CTX_GPREG_X6), 743 SMC_GET_GP(handle, CTX_GPREG_X7), 744 0, 0, 0, 0, 0, 0, 0, 0, 0, 0); 745 } else { 746 /* Both FFA versions >= 1.2 - pass incoming x8-x17 to dest */ 747 SMC_RET18(ctx_out, smc_fid, x1, x2, x3, x4, 748 SMC_GET_GP(handle, CTX_GPREG_X5), 749 SMC_GET_GP(handle, CTX_GPREG_X6), 750 SMC_GET_GP(handle, CTX_GPREG_X7), 751 SMC_GET_GP(handle, CTX_GPREG_X8), 752 SMC_GET_GP(handle, CTX_GPREG_X9), 753 SMC_GET_GP(handle, CTX_GPREG_X10), 754 SMC_GET_GP(handle, CTX_GPREG_X11), 755 SMC_GET_GP(handle, CTX_GPREG_X12), 756 SMC_GET_GP(handle, CTX_GPREG_X13), 757 SMC_GET_GP(handle, CTX_GPREG_X14), 758 SMC_GET_GP(handle, CTX_GPREG_X15), 759 SMC_GET_GP(handle, CTX_GPREG_X16), 760 SMC_GET_GP(handle, CTX_GPREG_X17) 761 ); 762 } 763 } else { 764 /* 32 bit call or dest has FFA version < 1.2 or unknown */ 765 SMC_RET8(ctx_out, smc_fid, x1, x2, x3, x4, 766 SMC_GET_GP(handle, CTX_GPREG_X5), 767 SMC_GET_GP(handle, CTX_GPREG_X6), 768 SMC_GET_GP(handle, CTX_GPREG_X7)); 769 } 770 } 771 772 /******************************************************************************* 773 * Forward SMCs to the other security state. 774 ******************************************************************************/ 775 static uint64_t spmd_smc_forward(uint32_t smc_fid, 776 bool secure_origin, 777 uint64_t x1, 778 uint64_t x2, 779 uint64_t x3, 780 uint64_t x4, 781 void *cookie, 782 void *handle, 783 uint64_t flags, 784 uint32_t secure_ffa_version) 785 { 786 if (is_spmc_at_el3() && !secure_origin) { 787 return spmc_smc_handler(smc_fid, secure_origin, x1, x2, x3, x4, 788 cookie, handle, flags); 789 } 790 791 return spmd_smc_switch_state(smc_fid, secure_origin, x1, x2, x3, x4, 792 handle, flags, secure_ffa_version); 793 794 } 795 796 /******************************************************************************* 797 * Return FFA_ERROR with specified error code 798 ******************************************************************************/ 799 uint64_t spmd_ffa_error_return(void *handle, int error_code) 800 { 801 SMC_RET8(handle, (uint32_t) FFA_ERROR, 802 FFA_TARGET_INFO_MBZ, (uint32_t)error_code, 803 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 804 FFA_PARAM_MBZ, FFA_PARAM_MBZ); 805 } 806 807 /******************************************************************************* 808 * spmd_check_address_in_binary_image 809 ******************************************************************************/ 810 bool spmd_check_address_in_binary_image(uint64_t address) 811 { 812 assert(!check_uptr_overflow(spmc_attrs.load_address, spmc_attrs.binary_size)); 813 814 return ((address >= spmc_attrs.load_address) && 815 (address < (spmc_attrs.load_address + spmc_attrs.binary_size))); 816 } 817 818 /****************************************************************************** 819 * spmd_is_spmc_message 820 *****************************************************************************/ 821 static bool spmd_is_spmc_message(unsigned int ep) 822 { 823 if (is_spmc_at_el3()) { 824 return false; 825 } 826 827 return ((ffa_endpoint_destination(ep) == SPMD_DIRECT_MSG_ENDPOINT_ID) 828 && (ffa_endpoint_source(ep) == spmc_attrs.spmc_id)); 829 } 830 831 /******************************************************************************* 832 * This function forwards FF-A SMCs to either the main SPMD handler or the 833 * SPMC at EL3, depending on the origin security state, if enabled. 834 ******************************************************************************/ 835 uint64_t spmd_ffa_smc_handler(uint32_t smc_fid, 836 uint64_t x1, 837 uint64_t x2, 838 uint64_t x3, 839 uint64_t x4, 840 void *cookie, 841 void *handle, 842 uint64_t flags) 843 { 844 if (is_spmc_at_el3()) { 845 /* 846 * If we have an SPMC at EL3 allow handling of the SMC first. 847 * The SPMC will call back through to SPMD handler if required. 848 */ 849 if (is_caller_secure(flags)) { 850 return spmc_smc_handler(smc_fid, 851 is_caller_secure(flags), 852 x1, x2, x3, x4, cookie, 853 handle, flags); 854 } 855 } 856 return spmd_smc_handler(smc_fid, x1, x2, x3, x4, cookie, 857 handle, flags, spmc_nwd_ffa_version); 858 } 859 860 static uint32_t get_common_ffa_version(uint32_t secure_ffa_version) 861 { 862 if (secure_ffa_version <= nonsecure_ffa_version) { 863 return secure_ffa_version; 864 } else { 865 return nonsecure_ffa_version; 866 } 867 } 868 869 /******************************************************************************* 870 * This function handles all SMCs in the range reserved for FFA. Each call is 871 * either forwarded to the other security state or handled by the SPM dispatcher 872 ******************************************************************************/ 873 uint64_t spmd_smc_handler(uint32_t smc_fid, 874 uint64_t x1, 875 uint64_t x2, 876 uint64_t x3, 877 uint64_t x4, 878 void *cookie, 879 void *handle, 880 uint64_t flags, 881 uint32_t secure_ffa_version) 882 { 883 spmd_spm_core_context_t *ctx = spmd_get_context(); 884 bool secure_origin; 885 int ret; 886 uint32_t input_version; 887 888 /* Determine which security state this SMC originated from */ 889 secure_origin = is_caller_secure(flags); 890 891 VERBOSE("SPM(%u): 0x%x 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 892 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 "\n", 893 plat_my_core_pos(), smc_fid, x1, x2, x3, x4, 894 SMC_GET_GP(handle, CTX_GPREG_X5), 895 SMC_GET_GP(handle, CTX_GPREG_X6), 896 SMC_GET_GP(handle, CTX_GPREG_X7)); 897 898 /* 899 * If there is an on-going info regs from EL3 SPMD LP, unconditionally 900 * return, we don't expect any other FF-A ABIs to be called between 901 * calls to FFA_PARTITION_INFO_GET_REGS. 902 */ 903 if (is_spmd_logical_sp_info_regs_req_in_progress(ctx)) { 904 assert(secure_origin); 905 spmd_spm_core_sync_exit(0ULL); 906 } 907 908 if ((!secure_origin) && (smc_fid != FFA_VERSION)) { 909 /* 910 * Once the caller invokes any FF-A ABI other than FFA_VERSION, 911 * the version negotiation phase is complete. 912 */ 913 nonsecure_version_negotiated = true; 914 } 915 916 switch (smc_fid) { 917 case FFA_ERROR: 918 /* 919 * Check if this is the first invocation of this interface on 920 * this CPU. If so, then indicate that the SPM Core initialised 921 * unsuccessfully. 922 */ 923 if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) { 924 spmd_spm_core_sync_exit(x2); 925 } 926 927 /* 928 * Perform a synchronous exit: 929 * 1. If there was an SPMD logical partition direct request on-going, 930 * return back to the SPMD logical partition so the error can be 931 * consumed. 932 * 2. SPMC sent FFA_ERROR in response to a power management 933 * operation sent through direct request. 934 */ 935 if (is_spmd_logical_sp_dir_req_in_progress(ctx) || 936 ctx->psci_operation_ongoing) { 937 assert(secure_origin); 938 spmd_spm_core_sync_exit(0ULL); 939 } 940 941 return spmd_smc_forward(smc_fid, secure_origin, 942 x1, x2, x3, x4, cookie, 943 handle, flags, secure_ffa_version); 944 break; /* not reached */ 945 946 case FFA_VERSION: 947 input_version = (uint32_t)(0xFFFFFFFF & x1); 948 /* 949 * If caller is secure and SPMC was initialized, 950 * return FFA_VERSION of SPMD. 951 * If caller is non secure and SPMC was initialized, 952 * forward to the EL3 SPMC if enabled, otherwise send a 953 * framework message to the SPMC at the lower EL to 954 * negotiate a version that is compatible between the 955 * normal world and the SPMC. 956 * Sanity check to "input_version". 957 * If the EL3 SPMC is enabled, ignore the SPMC state as 958 * this is not used. 959 */ 960 if ((input_version & FFA_VERSION_BIT31_MASK) || 961 (!is_spmc_at_el3() && (ctx->state == SPMC_STATE_RESET))) { 962 ret = FFA_ERROR_NOT_SUPPORTED; 963 } else if (!secure_origin) { 964 if (!nonsecure_version_negotiated) { 965 /* 966 * Once an FF-A version has been negotiated 967 * between a caller and a callee, the version 968 * may not be changed for the lifetime of 969 * the calling component. 970 */ 971 nonsecure_ffa_version = input_version; 972 } 973 974 if (is_spmc_at_el3()) { 975 /* 976 * Forward the call directly to the EL3 SPMC, if 977 * enabled, as we don't need to wrap the call in 978 * a direct request. 979 */ 980 spmc_nwd_ffa_version = 981 MAKE_FFA_VERSION(FFA_VERSION_MAJOR, FFA_VERSION_MINOR); 982 return spmc_smc_handler(smc_fid, secure_origin, 983 x1, x2, x3, x4, cookie, 984 handle, flags); 985 } 986 987 gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx); 988 uint64_t rc; 989 990 if (spmc_attrs.major_version == 1 && 991 spmc_attrs.minor_version == 0) { 992 ret = MAKE_FFA_VERSION(spmc_attrs.major_version, 993 spmc_attrs.minor_version); 994 spmc_nwd_ffa_version = (uint32_t)ret; 995 SMC_RET8(handle, (uint32_t)ret, 996 FFA_TARGET_INFO_MBZ, 997 FFA_TARGET_INFO_MBZ, 998 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 999 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1000 FFA_PARAM_MBZ); 1001 break; 1002 } 1003 /* Save non-secure system registers context */ 1004 #if SPMD_SPM_AT_SEL2 1005 cm_el2_sysregs_context_save(NON_SECURE); 1006 #else 1007 cm_el1_sysregs_context_save(NON_SECURE); 1008 #endif 1009 1010 /* 1011 * The incoming request has FFA_VERSION as X0 smc_fid 1012 * and requested version in x1. Prepare a direct request 1013 * from SPMD to SPMC with FFA_VERSION framework function 1014 * identifier in X2 and requested version in X3. 1015 */ 1016 spmd_build_spmc_message(gpregs, 1017 SPMD_FWK_MSG_FFA_VERSION_REQ, 1018 input_version); 1019 1020 /* 1021 * Ensure x8-x17 NS GP register values are untouched when returning 1022 * from the SPMC. 1023 */ 1024 write_ctx_reg(gpregs, CTX_GPREG_X8, SMC_GET_GP(handle, CTX_GPREG_X8)); 1025 write_ctx_reg(gpregs, CTX_GPREG_X9, SMC_GET_GP(handle, CTX_GPREG_X9)); 1026 write_ctx_reg(gpregs, CTX_GPREG_X10, SMC_GET_GP(handle, CTX_GPREG_X10)); 1027 write_ctx_reg(gpregs, CTX_GPREG_X11, SMC_GET_GP(handle, CTX_GPREG_X11)); 1028 write_ctx_reg(gpregs, CTX_GPREG_X12, SMC_GET_GP(handle, CTX_GPREG_X12)); 1029 write_ctx_reg(gpregs, CTX_GPREG_X13, SMC_GET_GP(handle, CTX_GPREG_X13)); 1030 write_ctx_reg(gpregs, CTX_GPREG_X14, SMC_GET_GP(handle, CTX_GPREG_X14)); 1031 write_ctx_reg(gpregs, CTX_GPREG_X15, SMC_GET_GP(handle, CTX_GPREG_X15)); 1032 write_ctx_reg(gpregs, CTX_GPREG_X16, SMC_GET_GP(handle, CTX_GPREG_X16)); 1033 write_ctx_reg(gpregs, CTX_GPREG_X17, SMC_GET_GP(handle, CTX_GPREG_X17)); 1034 1035 rc = spmd_spm_core_sync_entry(ctx); 1036 1037 if ((rc != 0ULL) || 1038 (SMC_GET_GP(gpregs, CTX_GPREG_X0) != 1039 FFA_MSG_SEND_DIRECT_RESP_SMC32) || 1040 (SMC_GET_GP(gpregs, CTX_GPREG_X2) != 1041 (FFA_FWK_MSG_BIT | 1042 SPMD_FWK_MSG_FFA_VERSION_RESP))) { 1043 ERROR("Failed to forward FFA_VERSION\n"); 1044 ret = FFA_ERROR_NOT_SUPPORTED; 1045 } else { 1046 ret = SMC_GET_GP(gpregs, CTX_GPREG_X3); 1047 spmc_nwd_ffa_version = (uint32_t)ret; 1048 } 1049 1050 /* 1051 * x0-x4 are updated by spmd_smc_forward below. 1052 * Zero out x5-x7 in the FFA_VERSION response. 1053 */ 1054 write_ctx_reg(gpregs, CTX_GPREG_X5, 0); 1055 write_ctx_reg(gpregs, CTX_GPREG_X6, 0); 1056 write_ctx_reg(gpregs, CTX_GPREG_X7, 0); 1057 1058 /* 1059 * Return here after SPMC has handled FFA_VERSION. 1060 * The returned SPMC version is held in X3. 1061 * Forward this version in X0 to the non-secure caller. 1062 */ 1063 return spmd_smc_forward(ret, true, FFA_PARAM_MBZ, 1064 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1065 FFA_PARAM_MBZ, cookie, gpregs, 1066 flags, spmc_nwd_ffa_version); 1067 } else { 1068 ret = MAKE_FFA_VERSION(FFA_VERSION_MAJOR, 1069 FFA_VERSION_MINOR); 1070 } 1071 1072 SMC_RET8(handle, (uint32_t)ret, FFA_TARGET_INFO_MBZ, 1073 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1074 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ); 1075 break; /* not reached */ 1076 1077 case FFA_FEATURES: 1078 /* 1079 * This is an optional interface. Do the minimal checks and 1080 * forward to SPM Core which will handle it if implemented. 1081 */ 1082 1083 /* Forward SMC from Normal world to the SPM Core */ 1084 if (!secure_origin) { 1085 return spmd_smc_forward(smc_fid, secure_origin, 1086 x1, x2, x3, x4, cookie, 1087 handle, flags, secure_ffa_version); 1088 } 1089 1090 /* 1091 * Return success if call was from secure world i.e. all 1092 * FFA functions are supported. This is essentially a 1093 * nop. 1094 */ 1095 SMC_RET8(handle, FFA_SUCCESS_SMC32, x1, x2, x3, x4, 1096 SMC_GET_GP(handle, CTX_GPREG_X5), 1097 SMC_GET_GP(handle, CTX_GPREG_X6), 1098 SMC_GET_GP(handle, CTX_GPREG_X7)); 1099 1100 break; /* not reached */ 1101 1102 case FFA_ID_GET: 1103 /* 1104 * Returns the ID of the calling FFA component. 1105 */ 1106 if (!secure_origin) { 1107 SMC_RET8(handle, FFA_SUCCESS_SMC32, 1108 FFA_TARGET_INFO_MBZ, FFA_NS_ENDPOINT_ID, 1109 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1110 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1111 FFA_PARAM_MBZ); 1112 } 1113 1114 SMC_RET8(handle, FFA_SUCCESS_SMC32, 1115 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id, 1116 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1117 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1118 FFA_PARAM_MBZ); 1119 1120 break; /* not reached */ 1121 1122 case FFA_SECONDARY_EP_REGISTER_SMC64: 1123 if (secure_origin) { 1124 ret = spmd_pm_secondary_ep_register(x1); 1125 1126 if (ret < 0) { 1127 SMC_RET8(handle, FFA_ERROR_SMC64, 1128 FFA_TARGET_INFO_MBZ, ret, 1129 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1130 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1131 FFA_PARAM_MBZ); 1132 } else { 1133 SMC_RET8(handle, FFA_SUCCESS_SMC64, 1134 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ, 1135 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1136 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1137 FFA_PARAM_MBZ); 1138 } 1139 } 1140 1141 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1142 break; /* Not reached */ 1143 1144 case FFA_SPM_ID_GET: 1145 if (MAKE_FFA_VERSION(1, 1) > FFA_VERSION_COMPILED) { 1146 return spmd_ffa_error_return(handle, 1147 FFA_ERROR_NOT_SUPPORTED); 1148 } 1149 /* 1150 * Returns the ID of the SPMC or SPMD depending on the FF-A 1151 * instance where this function is invoked 1152 */ 1153 if (!secure_origin) { 1154 SMC_RET8(handle, FFA_SUCCESS_SMC32, 1155 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id, 1156 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1157 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1158 FFA_PARAM_MBZ); 1159 } 1160 SMC_RET8(handle, FFA_SUCCESS_SMC32, 1161 FFA_TARGET_INFO_MBZ, SPMD_DIRECT_MSG_ENDPOINT_ID, 1162 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1163 FFA_PARAM_MBZ, FFA_PARAM_MBZ, 1164 FFA_PARAM_MBZ); 1165 1166 break; /* not reached */ 1167 1168 case FFA_MSG_SEND_DIRECT_REQ2_SMC64: 1169 if (get_common_ffa_version(secure_ffa_version) < MAKE_FFA_VERSION(U(1), U(2))) { 1170 /* Call not supported at this version */ 1171 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1172 } 1173 /* fallthrough */ 1174 case FFA_MSG_SEND_DIRECT_REQ_SMC32: 1175 case FFA_MSG_SEND_DIRECT_REQ_SMC64: 1176 /* 1177 * Regardless of secure_origin, SPMD logical partitions cannot 1178 * handle direct messages. They can only initiate direct 1179 * messages and consume direct responses or errors. 1180 */ 1181 if (is_spmd_lp_id(ffa_endpoint_source(x1)) || 1182 is_spmd_lp_id(ffa_endpoint_destination(x1))) { 1183 return spmd_ffa_error_return(handle, 1184 FFA_ERROR_INVALID_PARAMETER 1185 ); 1186 } 1187 1188 /* 1189 * When there is an ongoing SPMD logical partition direct 1190 * request, there cannot be another direct request. Return 1191 * error in this case. Panic'ing is an option but that does 1192 * not provide the opportunity for caller to abort based on 1193 * error codes. 1194 */ 1195 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) { 1196 assert(secure_origin); 1197 return spmd_ffa_error_return(handle, 1198 FFA_ERROR_DENIED); 1199 } 1200 1201 if (!secure_origin) { 1202 /* Validate source endpoint is non-secure for non-secure caller. */ 1203 if (ffa_is_secure_world_id(ffa_endpoint_source(x1))) { 1204 return spmd_ffa_error_return(handle, 1205 FFA_ERROR_INVALID_PARAMETER); 1206 } 1207 } 1208 if (secure_origin && spmd_is_spmc_message(x1)) { 1209 return spmd_ffa_error_return(handle, 1210 FFA_ERROR_DENIED); 1211 } else { 1212 /* Forward direct message to the other world */ 1213 return spmd_smc_forward(smc_fid, secure_origin, 1214 x1, x2, x3, x4, cookie, 1215 handle, flags, secure_ffa_version); 1216 } 1217 break; /* Not reached */ 1218 1219 case FFA_MSG_SEND_DIRECT_RESP2_SMC64: 1220 if (get_common_ffa_version(secure_ffa_version) < MAKE_FFA_VERSION(U(1), U(2))) { 1221 /* Call not supported at this version */ 1222 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1223 } 1224 /* fallthrough */ 1225 case FFA_MSG_SEND_DIRECT_RESP_SMC32: 1226 case FFA_MSG_SEND_DIRECT_RESP_SMC64: 1227 if (secure_origin && (spmd_is_spmc_message(x1) || 1228 is_spmd_logical_sp_dir_req_in_progress(ctx))) { 1229 spmd_spm_core_sync_exit(0ULL); 1230 } else { 1231 /* Forward direct message to the other world */ 1232 return spmd_smc_forward(smc_fid, secure_origin, 1233 x1, x2, x3, x4, cookie, 1234 handle, flags, secure_ffa_version); 1235 } 1236 break; /* Not reached */ 1237 case FFA_RX_RELEASE: 1238 case FFA_RXTX_MAP_SMC32: 1239 case FFA_RXTX_MAP_SMC64: 1240 case FFA_RXTX_UNMAP: 1241 case FFA_PARTITION_INFO_GET: 1242 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED 1243 case FFA_NOTIFICATION_BITMAP_CREATE: 1244 case FFA_NOTIFICATION_BITMAP_DESTROY: 1245 case FFA_NOTIFICATION_BIND: 1246 case FFA_NOTIFICATION_UNBIND: 1247 case FFA_NOTIFICATION_SET: 1248 case FFA_NOTIFICATION_GET: 1249 case FFA_NOTIFICATION_INFO_GET: 1250 case FFA_NOTIFICATION_INFO_GET_SMC64: 1251 case FFA_MSG_SEND2: 1252 case FFA_RX_ACQUIRE: 1253 #endif 1254 case FFA_MSG_RUN: 1255 /* 1256 * Above calls should be invoked only by the Normal world and 1257 * must not be forwarded from Secure world to Normal world. 1258 */ 1259 if (secure_origin) { 1260 return spmd_ffa_error_return(handle, 1261 FFA_ERROR_NOT_SUPPORTED); 1262 } 1263 1264 /* Forward the call to the other world */ 1265 /* fallthrough */ 1266 case FFA_MSG_SEND: 1267 case FFA_MEM_DONATE_SMC32: 1268 case FFA_MEM_DONATE_SMC64: 1269 case FFA_MEM_LEND_SMC32: 1270 case FFA_MEM_LEND_SMC64: 1271 case FFA_MEM_SHARE_SMC32: 1272 case FFA_MEM_SHARE_SMC64: 1273 case FFA_MEM_RETRIEVE_REQ_SMC32: 1274 case FFA_MEM_RETRIEVE_REQ_SMC64: 1275 case FFA_MEM_RETRIEVE_RESP: 1276 case FFA_MEM_RELINQUISH: 1277 case FFA_MEM_RECLAIM: 1278 case FFA_MEM_FRAG_TX: 1279 case FFA_MEM_FRAG_RX: 1280 case FFA_SUCCESS_SMC32: 1281 case FFA_SUCCESS_SMC64: 1282 /* 1283 * If there is an ongoing direct request from an SPMD logical 1284 * partition, return an error. 1285 */ 1286 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) { 1287 assert(secure_origin); 1288 return spmd_ffa_error_return(handle, 1289 FFA_ERROR_DENIED); 1290 } 1291 1292 return spmd_smc_forward(smc_fid, secure_origin, 1293 x1, x2, x3, x4, cookie, 1294 handle, flags, secure_ffa_version); 1295 break; /* not reached */ 1296 1297 case FFA_MSG_WAIT: 1298 /* 1299 * Check if this is the first invocation of this interface on 1300 * this CPU from the Secure world. If so, then indicate that the 1301 * SPM Core initialised successfully. 1302 */ 1303 if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) { 1304 spmd_spm_core_sync_exit(0ULL); 1305 } 1306 1307 /* Forward the call to the other world */ 1308 /* fallthrough */ 1309 case FFA_INTERRUPT: 1310 case FFA_MSG_YIELD: 1311 /* This interface must be invoked only by the Secure world */ 1312 if (!secure_origin) { 1313 return spmd_ffa_error_return(handle, 1314 FFA_ERROR_NOT_SUPPORTED); 1315 } 1316 1317 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) { 1318 assert(secure_origin); 1319 return spmd_ffa_error_return(handle, 1320 FFA_ERROR_DENIED); 1321 } 1322 1323 return spmd_smc_forward(smc_fid, secure_origin, 1324 x1, x2, x3, x4, cookie, 1325 handle, flags, secure_ffa_version); 1326 break; /* not reached */ 1327 1328 case FFA_NORMAL_WORLD_RESUME: 1329 if (secure_origin && ctx->secure_interrupt_ongoing) { 1330 spmd_spm_core_sync_exit(0ULL); 1331 } else { 1332 return spmd_ffa_error_return(handle, FFA_ERROR_DENIED); 1333 } 1334 break; /* Not reached */ 1335 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED 1336 case FFA_PARTITION_INFO_GET_REGS_SMC64: 1337 if (secure_origin) { 1338 return spmd_el3_populate_logical_partition_info(handle, x1, 1339 x2, x3); 1340 } 1341 1342 /* Call only supported with SMCCC 1.2+ */ 1343 if (MAKE_SMCCC_VERSION(SMCCC_MAJOR_VERSION, SMCCC_MINOR_VERSION) < 0x10002) { 1344 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1345 } 1346 1347 return spmd_smc_forward(smc_fid, secure_origin, 1348 x1, x2, x3, x4, cookie, 1349 handle, flags, secure_ffa_version); 1350 break; /* Not reached */ 1351 #endif 1352 case FFA_CONSOLE_LOG_SMC32: 1353 case FFA_CONSOLE_LOG_SMC64: 1354 /* This interface must not be forwarded to other worlds. */ 1355 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1356 break; /* not reached */ 1357 1358 case FFA_EL3_INTR_HANDLE: 1359 if (secure_origin) { 1360 return spmd_handle_group0_intr_swd(handle); 1361 } else { 1362 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1363 } 1364 default: 1365 WARN("SPM: Unsupported call 0x%08x\n", smc_fid); 1366 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED); 1367 } 1368 } 1369