1 /* 2 * Copyright (c) 2020, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <errno.h> 9 #include <string.h> 10 11 #include <arch_helpers.h> 12 #include <bl31/bl31.h> 13 #include <common/debug.h> 14 #include <common/runtime_svc.h> 15 #include <lib/el3_runtime/context_mgmt.h> 16 #include <lib/smccc.h> 17 #include <lib/spinlock.h> 18 #include <lib/utils.h> 19 #include <lib/xlat_tables/xlat_tables_v2.h> 20 #include <plat/common/common_def.h> 21 #include <plat/common/platform.h> 22 #include <platform_def.h> 23 #include <services/spci_svc.h> 24 #include <services/spmd_svc.h> 25 #include <smccc_helpers.h> 26 #include "spmd_private.h" 27 28 /******************************************************************************* 29 * SPM Core context information. 30 ******************************************************************************/ 31 spmd_spm_core_context_t spm_core_context[PLATFORM_CORE_COUNT]; 32 33 /******************************************************************************* 34 * SPM Core attribute information read from its manifest. 35 ******************************************************************************/ 36 spmc_manifest_sect_attribute_t spmc_attrs; 37 38 /******************************************************************************* 39 * This function takes an SP context pointer and performs a synchronous entry 40 * into it. 41 ******************************************************************************/ 42 uint64_t spmd_spm_core_sync_entry(spmd_spm_core_context_t *spmc_ctx) 43 { 44 uint64_t rc; 45 46 assert(spmc_ctx != NULL); 47 48 cm_set_context(&(spmc_ctx->cpu_ctx), SECURE); 49 50 /* Restore the context assigned above */ 51 cm_el1_sysregs_context_restore(SECURE); 52 cm_set_next_eret_context(SECURE); 53 54 /* Invalidate TLBs at EL1. */ 55 tlbivmalle1(); 56 dsbish(); 57 58 /* Enter Secure Partition */ 59 rc = spmd_spm_core_enter(&spmc_ctx->c_rt_ctx); 60 61 /* Save secure state */ 62 cm_el1_sysregs_context_save(SECURE); 63 64 return rc; 65 } 66 67 /******************************************************************************* 68 * This function returns to the place where spm_sp_synchronous_entry() was 69 * called originally. 70 ******************************************************************************/ 71 __dead2 void spmd_spm_core_sync_exit(uint64_t rc) 72 { 73 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 74 75 /* Get context of the SP in use by this CPU. */ 76 assert(cm_get_context(SECURE) == &(ctx->cpu_ctx)); 77 78 /* 79 * The SPMD must have initiated the original request through a 80 * synchronous entry into SPMC. Jump back to the original C runtime 81 * context with the value of rc in x0; 82 */ 83 spmd_spm_core_exit(ctx->c_rt_ctx, rc); 84 85 panic(); 86 } 87 88 /******************************************************************************* 89 * Jump to the SPM core for the first time. 90 ******************************************************************************/ 91 static int32_t spmd_init(void) 92 { 93 uint64_t rc = 0; 94 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 95 96 INFO("SPM Core init start.\n"); 97 ctx->state = SPMC_STATE_RESET; 98 99 rc = spmd_spm_core_sync_entry(ctx); 100 if (rc) { 101 ERROR("SPMC initialisation failed 0x%llx\n", rc); 102 panic(); 103 } 104 105 ctx->state = SPMC_STATE_IDLE; 106 INFO("SPM Core init end.\n"); 107 108 return 1; 109 } 110 111 /******************************************************************************* 112 * Initialize context of SPM core. 113 ******************************************************************************/ 114 int32_t spmd_setup(void) 115 { 116 int rc; 117 void *rd_base; 118 size_t rd_size; 119 entry_point_info_t *spmc_ep_info; 120 uintptr_t rd_base_align; 121 uintptr_t rd_size_align; 122 uint32_t ep_attr; 123 124 spmc_ep_info = bl31_plat_get_next_image_ep_info(SECURE); 125 if (!spmc_ep_info) { 126 WARN("No SPM core image provided by BL2 boot loader, Booting " 127 "device without SP initialization. SMC`s destined for SPM " 128 "core will return SMC_UNK\n"); 129 return 1; 130 } 131 132 /* Under no circumstances will this parameter be 0 */ 133 assert(spmc_ep_info->pc != 0U); 134 135 /* 136 * Check if BL32 ep_info has a reference to 'tos_fw_config'. This will 137 * be used as a manifest for the SPM core at the next lower EL/mode. 138 */ 139 if (spmc_ep_info->args.arg0 == 0U || spmc_ep_info->args.arg2 == 0U) { 140 ERROR("Invalid or absent SPM core manifest\n"); 141 panic(); 142 } 143 144 /* Obtain whereabouts of SPM core manifest */ 145 rd_base = (void *) spmc_ep_info->args.arg0; 146 rd_size = spmc_ep_info->args.arg2; 147 148 rd_base_align = page_align((uintptr_t) rd_base, DOWN); 149 rd_size_align = page_align((uintptr_t) rd_size, UP); 150 151 /* Map the manifest in the SPMD translation regime first */ 152 VERBOSE("SPM core manifest base : 0x%lx\n", rd_base_align); 153 VERBOSE("SPM core manifest size : 0x%lx\n", rd_size_align); 154 rc = mmap_add_dynamic_region((unsigned long long) rd_base_align, 155 (uintptr_t) rd_base_align, 156 rd_size_align, 157 MT_RO_DATA); 158 if (rc < 0) { 159 ERROR("Error while mapping SPM core manifest (%d).\n", rc); 160 panic(); 161 } 162 163 /* Load the SPM core manifest */ 164 rc = plat_spm_core_manifest_load(&spmc_attrs, rd_base, rd_size); 165 if (rc < 0) { 166 WARN("No or invalid SPM core manifest image provided by BL2 " 167 "boot loader. "); 168 goto error; 169 } 170 171 /* 172 * Ensure that the SPM core version is compatible with the SPM 173 * dispatcher version 174 */ 175 if ((spmc_attrs.major_version != SPCI_VERSION_MAJOR) || 176 (spmc_attrs.minor_version > SPCI_VERSION_MINOR)) { 177 WARN("Unsupported SPCI version (%x.%x) specified in SPM core " 178 "manifest image provided by BL2 boot loader.\n", 179 spmc_attrs.major_version, spmc_attrs.minor_version); 180 goto error; 181 } 182 183 INFO("SPCI version (%x.%x).\n", spmc_attrs.major_version, 184 spmc_attrs.minor_version); 185 186 /* Validate the SPM core runtime EL */ 187 if ((spmc_attrs.runtime_el != MODE_EL1) && 188 (spmc_attrs.runtime_el != MODE_EL2)) { 189 WARN("Unsupported SPM core run time EL%x specified in " 190 "manifest image provided by BL2 boot loader.\n", 191 spmc_attrs.runtime_el); 192 goto error; 193 } 194 195 INFO("SPM core run time EL%x.\n", spmc_attrs.runtime_el); 196 197 /* Validate the SPM core execution state */ 198 if ((spmc_attrs.exec_state != MODE_RW_64) && 199 (spmc_attrs.exec_state != MODE_RW_32)) { 200 WARN("Unsupported SPM core execution state %x specified in " 201 "manifest image provided by BL2 boot loader.\n", 202 spmc_attrs.exec_state); 203 goto error; 204 } 205 206 INFO("SPM core execution state %x.\n", spmc_attrs.exec_state); 207 208 /* Ensure manifest has not requested S-EL2 in AArch32 state */ 209 if ((spmc_attrs.exec_state == MODE_RW_32) && 210 (spmc_attrs.runtime_el == MODE_EL2)) { 211 WARN("Invalid combination of SPM core execution state (%x) " 212 "and run time EL (%x).\n", spmc_attrs.exec_state, 213 spmc_attrs.runtime_el); 214 goto error; 215 } 216 217 /* 218 * Check if S-EL2 is supported on this system if S-EL2 219 * is required for SPM 220 */ 221 if (spmc_attrs.runtime_el == MODE_EL2) { 222 uint64_t sel2 = read_id_aa64pfr0_el1(); 223 224 sel2 >>= ID_AA64PFR0_SEL2_SHIFT; 225 sel2 &= ID_AA64PFR0_SEL2_MASK; 226 227 if (!sel2) { 228 WARN("SPM core run time EL: S-EL%x is not supported " 229 "but specified in manifest image provided by " 230 "BL2 boot loader.\n", spmc_attrs.runtime_el); 231 goto error; 232 } 233 } 234 235 /* Initialise an entrypoint to set up the CPU context */ 236 ep_attr = SECURE | EP_ST_ENABLE; 237 if (read_sctlr_el3() & SCTLR_EE_BIT) 238 ep_attr |= EP_EE_BIG; 239 SET_PARAM_HEAD(spmc_ep_info, PARAM_EP, VERSION_1, ep_attr); 240 assert(spmc_ep_info->pc == BL32_BASE); 241 242 /* 243 * Populate SPSR for SPM core based upon validated parameters from the 244 * manifest 245 */ 246 if (spmc_attrs.exec_state == MODE_RW_32) { 247 spmc_ep_info->spsr = SPSR_MODE32(MODE32_svc, SPSR_T_ARM, 248 SPSR_E_LITTLE, 249 DAIF_FIQ_BIT | 250 DAIF_IRQ_BIT | 251 DAIF_ABT_BIT); 252 } else { 253 spmc_ep_info->spsr = SPSR_64(spmc_attrs.runtime_el, 254 MODE_SP_ELX, 255 DISABLE_ALL_EXCEPTIONS); 256 } 257 258 /* Initialise SPM core context with this entry point information */ 259 cm_setup_context(&(spm_core_context[plat_my_core_pos()].cpu_ctx), 260 spmc_ep_info); 261 262 INFO("SPM core setup done.\n"); 263 264 /* Register init function for deferred init. */ 265 bl31_register_bl32_init(&spmd_init); 266 267 return 0; 268 269 error: 270 WARN("Booting device without SPM initialization. " 271 "SPCI SMCs destined for SPM core will return " 272 "ENOTSUPPORTED\n"); 273 274 rc = mmap_remove_dynamic_region(rd_base_align, rd_size_align); 275 if (rc < 0) { 276 ERROR("Error while unmapping SPM core manifest (%d).\n", 277 rc); 278 panic(); 279 } 280 281 return 1; 282 } 283 284 /******************************************************************************* 285 * This function handles all SMCs in the range reserved for SPCI. Each call is 286 * either forwarded to the other security state or handled by the SPM dispatcher 287 ******************************************************************************/ 288 uint64_t spmd_smc_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2, 289 uint64_t x3, uint64_t x4, void *cookie, void *handle, 290 uint64_t flags) 291 { 292 uint32_t in_sstate; 293 uint32_t out_sstate; 294 int32_t ret; 295 spmd_spm_core_context_t *ctx = &spm_core_context[plat_my_core_pos()]; 296 297 /* Determine which security state this SMC originated from */ 298 if (is_caller_secure(flags)) { 299 in_sstate = SECURE; 300 out_sstate = NON_SECURE; 301 } else { 302 in_sstate = NON_SECURE; 303 out_sstate = SECURE; 304 } 305 306 INFO("SPM: 0x%x, 0x%llx, 0x%llx, 0x%llx, 0x%llx, " 307 "0x%llx, 0x%llx, 0x%llx\n", 308 smc_fid, x1, x2, x3, x4, SMC_GET_GP(handle, CTX_GPREG_X5), 309 SMC_GET_GP(handle, CTX_GPREG_X6), 310 SMC_GET_GP(handle, CTX_GPREG_X7)); 311 312 switch (smc_fid) { 313 case SPCI_ERROR: 314 /* 315 * Check if this is the first invocation of this interface on 316 * this CPU. If so, then indicate that the SPM core initialised 317 * unsuccessfully. 318 */ 319 if ((in_sstate == SECURE) && (ctx->state == SPMC_STATE_RESET)) 320 spmd_spm_core_sync_exit(x2); 321 322 /* Save incoming security state */ 323 cm_el1_sysregs_context_save(in_sstate); 324 325 /* Restore outgoing security state */ 326 cm_el1_sysregs_context_restore(out_sstate); 327 cm_set_next_eret_context(out_sstate); 328 329 SMC_RET8(cm_get_context(out_sstate), smc_fid, x1, x2, x3, x4, 330 SMC_GET_GP(handle, CTX_GPREG_X5), 331 SMC_GET_GP(handle, CTX_GPREG_X6), 332 SMC_GET_GP(handle, CTX_GPREG_X7)); 333 break; /* not reached */ 334 335 case SPCI_VERSION: 336 /* 337 * TODO: This is an optimization that the version information 338 * provided by the SPM core manifest is returned by the SPM 339 * dispatcher. It might be a better idea to simply forward this 340 * call to the SPM core and wash our hands completely. 341 */ 342 ret = MAKE_SPCI_VERSION(spmc_attrs.major_version, 343 spmc_attrs.minor_version); 344 SMC_RET8(handle, SPCI_SUCCESS_SMC32, SPCI_TARGET_INFO_MBZ, ret, 345 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 346 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 347 break; /* not reached */ 348 349 case SPCI_FEATURES: 350 /* 351 * This is an optional interface. Do the minimal checks and 352 * forward to SPM core which will handle it if implemented. 353 */ 354 355 /* 356 * Check if w1 holds a valid SPCI fid. This is an 357 * optimization. 358 */ 359 if (!is_spci_fid(x1)) 360 SMC_RET8(handle, SPCI_ERROR, 361 SPCI_TARGET_INFO_MBZ, SPCI_ERROR_NOT_SUPPORTED, 362 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 363 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 364 365 /* Forward SMC from Normal world to the SPM core */ 366 if (in_sstate == NON_SECURE) { 367 /* Save incoming security state */ 368 cm_el1_sysregs_context_save(in_sstate); 369 370 /* Restore outgoing security state */ 371 cm_el1_sysregs_context_restore(out_sstate); 372 cm_set_next_eret_context(out_sstate); 373 374 SMC_RET8(cm_get_context(out_sstate), smc_fid, 375 x1, x2, x3, x4, 376 SMC_GET_GP(handle, CTX_GPREG_X5), 377 SMC_GET_GP(handle, CTX_GPREG_X6), 378 SMC_GET_GP(handle, CTX_GPREG_X7)); 379 } else { 380 /* 381 * Return success if call was from secure world i.e. all 382 * SPCI functions are supported. This is essentially a 383 * nop. 384 */ 385 SMC_RET8(handle, SPCI_SUCCESS_SMC32, x1, x2, x3, x4, 386 SMC_GET_GP(handle, CTX_GPREG_X5), 387 SMC_GET_GP(handle, CTX_GPREG_X6), 388 SMC_GET_GP(handle, CTX_GPREG_X7)); 389 } 390 break; /* not reached */ 391 392 case SPCI_RX_RELEASE: 393 case SPCI_RXTX_MAP_SMC32: 394 case SPCI_RXTX_MAP_SMC64: 395 case SPCI_RXTX_UNMAP: 396 case SPCI_MSG_RUN: 397 /* This interface must be invoked only by the Normal world */ 398 if (in_sstate == SECURE) { 399 SMC_RET8(handle, SPCI_ERROR, 400 SPCI_TARGET_INFO_MBZ, SPCI_ERROR_NOT_SUPPORTED, 401 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 402 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 403 } 404 405 /* Fall through to forward the call to the other world */ 406 407 case SPCI_PARTITION_INFO_GET: 408 case SPCI_MSG_SEND: 409 case SPCI_MSG_SEND_DIRECT_REQ_SMC32: 410 case SPCI_MSG_SEND_DIRECT_REQ_SMC64: 411 case SPCI_MSG_SEND_DIRECT_RESP_SMC32: 412 case SPCI_MSG_SEND_DIRECT_RESP_SMC64: 413 case SPCI_MEM_DONATE_SMC32: 414 case SPCI_MEM_DONATE_SMC64: 415 case SPCI_MEM_LEND_SMC32: 416 case SPCI_MEM_LEND_SMC64: 417 case SPCI_MEM_SHARE_SMC32: 418 case SPCI_MEM_SHARE_SMC64: 419 case SPCI_MEM_RETRIEVE_REQ_SMC32: 420 case SPCI_MEM_RETRIEVE_REQ_SMC64: 421 case SPCI_MEM_RETRIEVE_RESP: 422 case SPCI_MEM_RELINQUISH: 423 case SPCI_MEM_RECLAIM: 424 case SPCI_SUCCESS_SMC32: 425 case SPCI_SUCCESS_SMC64: 426 /* 427 * TODO: Assume that no requests originate from EL3 at the 428 * moment. This will change if a SP service is required in 429 * response to secure interrupts targeted to EL3. Until then 430 * simply forward the call to the Normal world. 431 */ 432 433 /* Save incoming security state */ 434 cm_el1_sysregs_context_save(in_sstate); 435 436 /* Restore outgoing security state */ 437 cm_el1_sysregs_context_restore(out_sstate); 438 cm_set_next_eret_context(out_sstate); 439 440 SMC_RET8(cm_get_context(out_sstate), smc_fid, x1, x2, x3, x4, 441 SMC_GET_GP(handle, CTX_GPREG_X5), 442 SMC_GET_GP(handle, CTX_GPREG_X6), 443 SMC_GET_GP(handle, CTX_GPREG_X7)); 444 break; /* not reached */ 445 446 case SPCI_MSG_WAIT: 447 /* 448 * Check if this is the first invocation of this interface on 449 * this CPU from the Secure world. If so, then indicate that the 450 * SPM core initialised successfully. 451 */ 452 if ((in_sstate == SECURE) && (ctx->state == SPMC_STATE_RESET)) { 453 spmd_spm_core_sync_exit(0); 454 } 455 456 /* Intentional fall-through */ 457 458 case SPCI_MSG_YIELD: 459 /* This interface must be invoked only by the Secure world */ 460 if (in_sstate == NON_SECURE) { 461 SMC_RET8(handle, SPCI_ERROR, 462 SPCI_TARGET_INFO_MBZ, SPCI_ERROR_NOT_SUPPORTED, 463 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 464 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 465 } 466 467 /* Save incoming security state */ 468 cm_el1_sysregs_context_save(in_sstate); 469 470 /* Restore outgoing security state */ 471 cm_el1_sysregs_context_restore(out_sstate); 472 cm_set_next_eret_context(out_sstate); 473 474 SMC_RET8(cm_get_context(out_sstate), smc_fid, x1, x2, x3, x4, 475 SMC_GET_GP(handle, CTX_GPREG_X5), 476 SMC_GET_GP(handle, CTX_GPREG_X6), 477 SMC_GET_GP(handle, CTX_GPREG_X7)); 478 break; /* not reached */ 479 480 default: 481 WARN("SPM: Unsupported call 0x%08x\n", smc_fid); 482 SMC_RET8(handle, SPCI_ERROR, 483 SPCI_TARGET_INFO_MBZ, SPCI_ERROR_NOT_SUPPORTED, 484 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, SPCI_PARAM_MBZ, 485 SPCI_PARAM_MBZ, SPCI_PARAM_MBZ); 486 } 487 } 488