1 /*
2 * Copyright (c) 2020-2024, Arm Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <errno.h>
9 #include <inttypes.h>
10 #include <stdint.h>
11 #include <string.h>
12
13 #include <arch_helpers.h>
14 #include <arch/aarch64/arch_features.h>
15 #include <bl31/bl31.h>
16 #include <bl31/interrupt_mgmt.h>
17 #include <common/debug.h>
18 #include <common/runtime_svc.h>
19 #include <common/tbbr/tbbr_img_def.h>
20 #include <lib/el3_runtime/context_mgmt.h>
21 #include <lib/fconf/fconf.h>
22 #include <lib/fconf/fconf_dyn_cfg_getter.h>
23 #include <lib/smccc.h>
24 #include <lib/spinlock.h>
25 #include <lib/utils.h>
26 #include <lib/xlat_tables/xlat_tables_v2.h>
27 #include <plat/common/common_def.h>
28 #include <plat/common/platform.h>
29 #include <platform_def.h>
30 #include <services/el3_spmd_logical_sp.h>
31 #include <services/ffa_svc.h>
32 #include <services/spmc_svc.h>
33 #include <services/spmd_svc.h>
34 #include <smccc_helpers.h>
35 #include "spmd_private.h"
36
37 /*******************************************************************************
38 * SPM Core context information.
39 ******************************************************************************/
40 static spmd_spm_core_context_t spm_core_context[PLATFORM_CORE_COUNT];
41
42 /*******************************************************************************
43 * SPM Core attribute information is read from its manifest if the SPMC is not
44 * at EL3. Else, it is populated from the SPMC directly.
45 ******************************************************************************/
46 static spmc_manifest_attribute_t spmc_attrs;
47
48 /*******************************************************************************
49 * SPM Core entry point information. Discovered on the primary core and reused
50 * on secondary cores.
51 ******************************************************************************/
52 static entry_point_info_t *spmc_ep_info;
53
54 /*******************************************************************************
55 * SPM Core context on CPU based on mpidr.
56 ******************************************************************************/
spmd_get_context_by_mpidr(uint64_t mpidr)57 spmd_spm_core_context_t *spmd_get_context_by_mpidr(uint64_t mpidr)
58 {
59 int core_idx = plat_core_pos_by_mpidr(mpidr);
60
61 if (core_idx < 0) {
62 ERROR("Invalid mpidr: %" PRIx64 ", returned ID: %d\n", mpidr, core_idx);
63 panic();
64 }
65
66 return &spm_core_context[core_idx];
67 }
68
69 /*******************************************************************************
70 * SPM Core context on current CPU get helper.
71 ******************************************************************************/
spmd_get_context(void)72 spmd_spm_core_context_t *spmd_get_context(void)
73 {
74 return spmd_get_context_by_mpidr(read_mpidr());
75 }
76
77 /*******************************************************************************
78 * SPM Core ID getter.
79 ******************************************************************************/
spmd_spmc_id_get(void)80 uint16_t spmd_spmc_id_get(void)
81 {
82 return spmc_attrs.spmc_id;
83 }
84
85 /*******************************************************************************
86 * Static function declaration.
87 ******************************************************************************/
88 static int32_t spmd_init(void);
89 static int spmd_spmc_init(void *pm_addr);
90
91 static uint64_t spmd_smc_forward(uint32_t smc_fid,
92 bool secure_origin,
93 uint64_t x1,
94 uint64_t x2,
95 uint64_t x3,
96 uint64_t x4,
97 void *cookie,
98 void *handle,
99 uint64_t flags);
100
101 /******************************************************************************
102 * Builds an SPMD to SPMC direct message request.
103 *****************************************************************************/
spmd_build_spmc_message(gp_regs_t * gpregs,uint8_t target_func,unsigned long long message)104 void spmd_build_spmc_message(gp_regs_t *gpregs, uint8_t target_func,
105 unsigned long long message)
106 {
107 write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_MSG_SEND_DIRECT_REQ_SMC32);
108 write_ctx_reg(gpregs, CTX_GPREG_X1,
109 (SPMD_DIRECT_MSG_ENDPOINT_ID << FFA_DIRECT_MSG_SOURCE_SHIFT) |
110 spmd_spmc_id_get());
111 write_ctx_reg(gpregs, CTX_GPREG_X2, BIT(31) | target_func);
112 write_ctx_reg(gpregs, CTX_GPREG_X3, message);
113
114 /* Zero out x4-x7 for the direct request emitted towards the SPMC. */
115 write_ctx_reg(gpregs, CTX_GPREG_X4, 0);
116 write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
117 write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
118 write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
119 }
120
121
122 /*******************************************************************************
123 * This function takes an SPMC context pointer and performs a synchronous
124 * SPMC entry.
125 ******************************************************************************/
spmd_spm_core_sync_entry(spmd_spm_core_context_t * spmc_ctx)126 uint64_t spmd_spm_core_sync_entry(spmd_spm_core_context_t *spmc_ctx)
127 {
128 uint64_t rc;
129
130 assert(spmc_ctx != NULL);
131
132 cm_set_context(&(spmc_ctx->cpu_ctx), SECURE);
133
134 /* Restore the context assigned above */
135 #if SPMD_SPM_AT_SEL2
136 cm_el2_sysregs_context_restore(SECURE);
137 #else
138 cm_el1_sysregs_context_restore(SECURE);
139 #endif
140 cm_set_next_eret_context(SECURE);
141
142 /* Enter SPMC */
143 rc = spmd_spm_core_enter(&spmc_ctx->c_rt_ctx);
144
145 /* Save secure state */
146 #if SPMD_SPM_AT_SEL2
147 cm_el2_sysregs_context_save(SECURE);
148 #else
149 cm_el1_sysregs_context_save(SECURE);
150 #endif
151
152 return rc;
153 }
154
155 /*******************************************************************************
156 * This function returns to the place where spmd_spm_core_sync_entry() was
157 * called originally.
158 ******************************************************************************/
spmd_spm_core_sync_exit(uint64_t rc)159 __dead2 void spmd_spm_core_sync_exit(uint64_t rc)
160 {
161 spmd_spm_core_context_t *ctx = spmd_get_context();
162
163 /* Get current CPU context from SPMC context */
164 assert(cm_get_context(SECURE) == &(ctx->cpu_ctx));
165
166 /*
167 * The SPMD must have initiated the original request through a
168 * synchronous entry into SPMC. Jump back to the original C runtime
169 * context with the value of rc in x0;
170 */
171 spmd_spm_core_exit(ctx->c_rt_ctx, rc);
172
173 panic();
174 }
175
176 /*******************************************************************************
177 * Jump to the SPM Core for the first time.
178 ******************************************************************************/
spmd_init(void)179 static int32_t spmd_init(void)
180 {
181 spmd_spm_core_context_t *ctx = spmd_get_context();
182 uint64_t rc;
183
184 VERBOSE("SPM Core init start.\n");
185
186 /* Primary boot core enters the SPMC for initialization. */
187 ctx->state = SPMC_STATE_ON_PENDING;
188
189 rc = spmd_spm_core_sync_entry(ctx);
190 if (rc != 0ULL) {
191 ERROR("SPMC initialisation failed 0x%" PRIx64 "\n", rc);
192 return 0;
193 }
194
195 ctx->state = SPMC_STATE_ON;
196
197 VERBOSE("SPM Core init end.\n");
198
199 spmd_logical_sp_set_spmc_initialized();
200 rc = spmd_logical_sp_init();
201 if (rc != 0) {
202 WARN("SPMD Logical partitions failed init.\n");
203 }
204
205 return 1;
206 }
207
208 /*******************************************************************************
209 * spmd_secure_interrupt_handler
210 * Enter the SPMC for further handling of the secure interrupt by the SPMC
211 * itself or a Secure Partition.
212 ******************************************************************************/
spmd_secure_interrupt_handler(uint32_t id,uint32_t flags,void * handle,void * cookie)213 static uint64_t spmd_secure_interrupt_handler(uint32_t id,
214 uint32_t flags,
215 void *handle,
216 void *cookie)
217 {
218 spmd_spm_core_context_t *ctx = spmd_get_context();
219 gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx);
220 unsigned int linear_id = plat_my_core_pos();
221 int64_t rc;
222
223 /* Sanity check the security state when the exception was generated */
224 assert(get_interrupt_src_ss(flags) == NON_SECURE);
225
226 /* Sanity check the pointer to this cpu's context */
227 assert(handle == cm_get_context(NON_SECURE));
228
229 /* Save the non-secure context before entering SPMC */
230 #if SPMD_SPM_AT_SEL2
231 cm_el2_sysregs_context_save(NON_SECURE);
232 #else
233 cm_el1_sysregs_context_save(NON_SECURE);
234 #endif
235
236 /* Convey the event to the SPMC through the FFA_INTERRUPT interface. */
237 write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_INTERRUPT);
238 write_ctx_reg(gpregs, CTX_GPREG_X1, 0);
239 write_ctx_reg(gpregs, CTX_GPREG_X2, 0);
240 write_ctx_reg(gpregs, CTX_GPREG_X3, 0);
241 write_ctx_reg(gpregs, CTX_GPREG_X4, 0);
242 write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
243 write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
244 write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
245
246 /* Mark current core as handling a secure interrupt. */
247 ctx->secure_interrupt_ongoing = true;
248
249 rc = spmd_spm_core_sync_entry(ctx);
250 if (rc != 0ULL) {
251 ERROR("%s failed (%" PRId64 ") on CPU%u\n", __func__, rc, linear_id);
252 }
253
254 ctx->secure_interrupt_ongoing = false;
255
256 #if SPMD_SPM_AT_SEL2
257 cm_el2_sysregs_context_restore(NON_SECURE);
258 #else
259 cm_el1_sysregs_context_restore(NON_SECURE);
260 #endif
261 cm_set_next_eret_context(NON_SECURE);
262
263 SMC_RET0(&ctx->cpu_ctx);
264 }
265
266 #if (EL3_EXCEPTION_HANDLING == 0)
267 /*******************************************************************************
268 * spmd_group0_interrupt_handler_nwd
269 * Group0 secure interrupt in the normal world are trapped to EL3. Delegate the
270 * handling of the interrupt to the platform handler, and return only upon
271 * successfully handling the Group0 interrupt.
272 ******************************************************************************/
spmd_group0_interrupt_handler_nwd(uint32_t id,uint32_t flags,void * handle,void * cookie)273 static uint64_t spmd_group0_interrupt_handler_nwd(uint32_t id,
274 uint32_t flags,
275 void *handle,
276 void *cookie)
277 {
278 uint32_t intid;
279
280 /* Sanity check the security state when the exception was generated. */
281 assert(get_interrupt_src_ss(flags) == NON_SECURE);
282
283 /* Sanity check the pointer to this cpu's context. */
284 assert(handle == cm_get_context(NON_SECURE));
285
286 assert(id == INTR_ID_UNAVAILABLE);
287
288 assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3);
289
290 intid = plat_ic_acknowledge_interrupt();
291
292 if (plat_spmd_handle_group0_interrupt(intid) < 0) {
293 ERROR("Group0 interrupt %u not handled\n", intid);
294 panic();
295 }
296
297 /* Deactivate the corresponding Group0 interrupt. */
298 plat_ic_end_of_interrupt(intid);
299
300 return 0U;
301 }
302 #endif
303
304 /*******************************************************************************
305 * spmd_handle_group0_intr_swd
306 * SPMC delegates handling of Group0 secure interrupt to EL3 firmware using
307 * FFA_EL3_INTR_HANDLE SMC call. Further, SPMD delegates the handling of the
308 * interrupt to the platform handler, and returns only upon successfully
309 * handling the Group0 interrupt.
310 ******************************************************************************/
spmd_handle_group0_intr_swd(void * handle)311 static uint64_t spmd_handle_group0_intr_swd(void *handle)
312 {
313 uint32_t intid;
314
315 /* Sanity check the pointer to this cpu's context */
316 assert(handle == cm_get_context(SECURE));
317
318 assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3);
319
320 intid = plat_ic_acknowledge_interrupt();
321
322 /*
323 * TODO: Currently due to a limitation in SPMD implementation, the
324 * platform handler is expected to not delegate handling to NWd while
325 * processing Group0 secure interrupt.
326 */
327 if (plat_spmd_handle_group0_interrupt(intid) < 0) {
328 /* Group0 interrupt was not handled by the platform. */
329 ERROR("Group0 interrupt %u not handled\n", intid);
330 panic();
331 }
332
333 /* Deactivate the corresponding Group0 interrupt. */
334 plat_ic_end_of_interrupt(intid);
335
336 /* Return success. */
337 SMC_RET8(handle, FFA_SUCCESS_SMC32, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
338 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
339 FFA_PARAM_MBZ);
340 }
341
342 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31
spmd_dynamic_map_mem(uintptr_t base_addr,size_t size,unsigned int attr,uintptr_t * align_addr,size_t * align_size)343 static int spmd_dynamic_map_mem(uintptr_t base_addr, size_t size,
344 unsigned int attr, uintptr_t *align_addr,
345 size_t *align_size)
346 {
347 uintptr_t base_addr_align;
348 size_t mapped_size_align;
349 int rc;
350
351 /* Page aligned address and size if necessary */
352 base_addr_align = page_align(base_addr, DOWN);
353 mapped_size_align = page_align(size, UP);
354
355 if ((base_addr != base_addr_align) &&
356 (size == mapped_size_align)) {
357 mapped_size_align += PAGE_SIZE;
358 }
359
360 /*
361 * Map dynamically given region with its aligned base address and
362 * size
363 */
364 rc = mmap_add_dynamic_region((unsigned long long)base_addr_align,
365 base_addr_align,
366 mapped_size_align,
367 attr);
368 if (rc == 0) {
369 *align_addr = base_addr_align;
370 *align_size = mapped_size_align;
371 }
372
373 return rc;
374 }
375
spmd_do_sec_cpy(uintptr_t root_base_addr,uintptr_t sec_base_addr,size_t size)376 static void spmd_do_sec_cpy(uintptr_t root_base_addr, uintptr_t sec_base_addr,
377 size_t size)
378 {
379 uintptr_t root_base_addr_align, sec_base_addr_align;
380 size_t root_mapped_size_align, sec_mapped_size_align;
381 int rc;
382
383 assert(root_base_addr != 0UL);
384 assert(sec_base_addr != 0UL);
385 assert(size != 0UL);
386
387 /* Map the memory with required attributes */
388 rc = spmd_dynamic_map_mem(root_base_addr, size, MT_RO_DATA | MT_ROOT,
389 &root_base_addr_align,
390 &root_mapped_size_align);
391 if (rc != 0) {
392 ERROR("%s %s %lu (%d)\n", "Error while mapping", "root region",
393 root_base_addr, rc);
394 panic();
395 }
396
397 rc = spmd_dynamic_map_mem(sec_base_addr, size, MT_RW_DATA | MT_SECURE,
398 &sec_base_addr_align, &sec_mapped_size_align);
399 if (rc != 0) {
400 ERROR("%s %s %lu (%d)\n", "Error while mapping",
401 "secure region", sec_base_addr, rc);
402 panic();
403 }
404
405 /* Do copy operation */
406 (void)memcpy((void *)sec_base_addr, (void *)root_base_addr, size);
407
408 /* Unmap root memory region */
409 rc = mmap_remove_dynamic_region(root_base_addr_align,
410 root_mapped_size_align);
411 if (rc != 0) {
412 ERROR("%s %s %lu (%d)\n", "Error while unmapping",
413 "root region", root_base_addr_align, rc);
414 panic();
415 }
416
417 /* Unmap secure memory region */
418 rc = mmap_remove_dynamic_region(sec_base_addr_align,
419 sec_mapped_size_align);
420 if (rc != 0) {
421 ERROR("%s %s %lu (%d)\n", "Error while unmapping",
422 "secure region", sec_base_addr_align, rc);
423 panic();
424 }
425 }
426 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */
427
428 /*******************************************************************************
429 * Loads SPMC manifest and inits SPMC.
430 ******************************************************************************/
spmd_spmc_init(void * pm_addr)431 static int spmd_spmc_init(void *pm_addr)
432 {
433 cpu_context_t *cpu_ctx;
434 unsigned int core_id;
435 uint32_t ep_attr, flags;
436 int rc;
437 const struct dyn_cfg_dtb_info_t *image_info __unused;
438
439 /* Load the SPM Core manifest */
440 rc = plat_spm_core_manifest_load(&spmc_attrs, pm_addr);
441 if (rc != 0) {
442 WARN("No or invalid SPM Core manifest image provided by BL2\n");
443 return rc;
444 }
445
446 /*
447 * Ensure that the SPM Core version is compatible with the SPM
448 * Dispatcher version.
449 */
450 if ((spmc_attrs.major_version != FFA_VERSION_MAJOR) ||
451 (spmc_attrs.minor_version > FFA_VERSION_MINOR)) {
452 WARN("Unsupported FFA version (%u.%u)\n",
453 spmc_attrs.major_version, spmc_attrs.minor_version);
454 return -EINVAL;
455 }
456
457 VERBOSE("FFA version (%u.%u)\n", spmc_attrs.major_version,
458 spmc_attrs.minor_version);
459
460 VERBOSE("SPM Core run time EL%x.\n",
461 SPMD_SPM_AT_SEL2 ? MODE_EL2 : MODE_EL1);
462
463 /* Validate the SPMC ID, Ensure high bit is set */
464 if (((spmc_attrs.spmc_id >> SPMC_SECURE_ID_SHIFT) &
465 SPMC_SECURE_ID_MASK) == 0U) {
466 WARN("Invalid ID (0x%x) for SPMC.\n", spmc_attrs.spmc_id);
467 return -EINVAL;
468 }
469
470 /* Validate the SPM Core execution state */
471 if ((spmc_attrs.exec_state != MODE_RW_64) &&
472 (spmc_attrs.exec_state != MODE_RW_32)) {
473 WARN("Unsupported %s%x.\n", "SPM Core execution state 0x",
474 spmc_attrs.exec_state);
475 return -EINVAL;
476 }
477
478 VERBOSE("%s%x.\n", "SPM Core execution state 0x",
479 spmc_attrs.exec_state);
480
481 #if SPMD_SPM_AT_SEL2
482 /* Ensure manifest has not requested AArch32 state in S-EL2 */
483 if (spmc_attrs.exec_state == MODE_RW_32) {
484 WARN("AArch32 state at S-EL2 is not supported.\n");
485 return -EINVAL;
486 }
487
488 /*
489 * Check if S-EL2 is supported on this system if S-EL2
490 * is required for SPM
491 */
492 if (!is_feat_sel2_supported()) {
493 WARN("SPM Core run time S-EL2 is not supported.\n");
494 return -EINVAL;
495 }
496 #endif /* SPMD_SPM_AT_SEL2 */
497
498 /* Initialise an entrypoint to set up the CPU context */
499 ep_attr = SECURE | EP_ST_ENABLE;
500 if ((read_sctlr_el3() & SCTLR_EE_BIT) != 0ULL) {
501 ep_attr |= EP_EE_BIG;
502 }
503
504 SET_PARAM_HEAD(spmc_ep_info, PARAM_EP, VERSION_1, ep_attr);
505
506 /*
507 * Populate SPSR for SPM Core based upon validated parameters from the
508 * manifest.
509 */
510 if (spmc_attrs.exec_state == MODE_RW_32) {
511 spmc_ep_info->spsr = SPSR_MODE32(MODE32_svc, SPSR_T_ARM,
512 SPSR_E_LITTLE,
513 DAIF_FIQ_BIT |
514 DAIF_IRQ_BIT |
515 DAIF_ABT_BIT);
516 } else {
517
518 #if SPMD_SPM_AT_SEL2
519 static const uint32_t runtime_el = MODE_EL2;
520 #else
521 static const uint32_t runtime_el = MODE_EL1;
522 #endif
523 spmc_ep_info->spsr = SPSR_64(runtime_el,
524 MODE_SP_ELX,
525 DISABLE_ALL_EXCEPTIONS);
526 }
527
528 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31
529 image_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TOS_FW_CONFIG_ID);
530 assert(image_info != NULL);
531
532 if ((image_info->config_addr == 0UL) ||
533 (image_info->secondary_config_addr == 0UL) ||
534 (image_info->config_max_size == 0UL)) {
535 return -EINVAL;
536 }
537
538 /* Copy manifest from root->secure region */
539 spmd_do_sec_cpy(image_info->config_addr,
540 image_info->secondary_config_addr,
541 image_info->config_max_size);
542
543 /* Update ep info of BL32 */
544 assert(spmc_ep_info != NULL);
545 spmc_ep_info->args.arg0 = image_info->secondary_config_addr;
546 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */
547
548 /* Set an initial SPMC context state for all cores. */
549 for (core_id = 0U; core_id < PLATFORM_CORE_COUNT; core_id++) {
550 spm_core_context[core_id].state = SPMC_STATE_OFF;
551
552 /* Setup an initial cpu context for the SPMC. */
553 cpu_ctx = &spm_core_context[core_id].cpu_ctx;
554 cm_setup_context(cpu_ctx, spmc_ep_info);
555
556 /*
557 * Pass the core linear ID to the SPMC through x4.
558 * (TF-A implementation defined behavior helping
559 * a legacy TOS migration to adopt FF-A).
560 */
561 write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X4, core_id);
562 }
563
564 /* Register power management hooks with PSCI */
565 psci_register_spd_pm_hook(&spmd_pm);
566
567 /* Register init function for deferred init. */
568 bl31_register_bl32_init(&spmd_init);
569
570 INFO("SPM Core setup done.\n");
571
572 /*
573 * Register an interrupt handler routing secure interrupts to SPMD
574 * while the NWd is running.
575 */
576 flags = 0;
577 set_interrupt_rm_flag(flags, NON_SECURE);
578 rc = register_interrupt_type_handler(INTR_TYPE_S_EL1,
579 spmd_secure_interrupt_handler,
580 flags);
581 if (rc != 0) {
582 panic();
583 }
584
585 /*
586 * Permit configurations where the SPM resides at S-EL1/2 and upon a
587 * Group0 interrupt triggering while the normal world runs, the
588 * interrupt is routed either through the EHF or directly to the SPMD:
589 *
590 * EL3_EXCEPTION_HANDLING=0: the Group0 interrupt is routed to the SPMD
591 * for handling by spmd_group0_interrupt_handler_nwd.
592 *
593 * EL3_EXCEPTION_HANDLING=1: the Group0 interrupt is routed to the EHF.
594 *
595 */
596 #if (EL3_EXCEPTION_HANDLING == 0)
597 /*
598 * If EL3 interrupts are supported by the platform, register an
599 * interrupt handler routing Group0 interrupts to SPMD while the NWd is
600 * running.
601 */
602 if (plat_ic_has_interrupt_type(INTR_TYPE_EL3)) {
603 rc = register_interrupt_type_handler(INTR_TYPE_EL3,
604 spmd_group0_interrupt_handler_nwd,
605 flags);
606 if (rc != 0) {
607 panic();
608 }
609 }
610 #endif
611
612 return 0;
613 }
614
615 /*******************************************************************************
616 * Initialize context of SPM Core.
617 ******************************************************************************/
spmd_setup(void)618 int spmd_setup(void)
619 {
620 int rc;
621 void *spmc_manifest;
622
623 /*
624 * If the SPMC is at EL3, then just initialise it directly. The
625 * shenanigans of when it is at a lower EL are not needed.
626 */
627 if (is_spmc_at_el3()) {
628 /* Allow the SPMC to populate its attributes directly. */
629 spmc_populate_attrs(&spmc_attrs);
630
631 rc = spmc_setup();
632 if (rc != 0) {
633 WARN("SPMC initialisation failed 0x%x.\n", rc);
634 }
635 return 0;
636 }
637
638 spmc_ep_info = bl31_plat_get_next_image_ep_info(SECURE);
639 if (spmc_ep_info == NULL) {
640 WARN("No SPM Core image provided by BL2 boot loader.\n");
641 return 0;
642 }
643
644 /* Under no circumstances will this parameter be 0 */
645 assert(spmc_ep_info->pc != 0ULL);
646
647 /*
648 * Check if BL32 ep_info has a reference to 'tos_fw_config'. This will
649 * be used as a manifest for the SPM Core at the next lower EL/mode.
650 */
651 spmc_manifest = (void *)spmc_ep_info->args.arg0;
652 if (spmc_manifest == NULL) {
653 WARN("Invalid or absent SPM Core manifest.\n");
654 return 0;
655 }
656
657 /* Load manifest, init SPMC */
658 rc = spmd_spmc_init(spmc_manifest);
659 if (rc != 0) {
660 WARN("Booting device without SPM initialization.\n");
661 }
662
663 return 0;
664 }
665
666 /*******************************************************************************
667 * Forward FF-A SMCs to the other security state.
668 ******************************************************************************/
spmd_smc_switch_state(uint32_t smc_fid,bool secure_origin,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * handle,uint64_t flags)669 uint64_t spmd_smc_switch_state(uint32_t smc_fid,
670 bool secure_origin,
671 uint64_t x1,
672 uint64_t x2,
673 uint64_t x3,
674 uint64_t x4,
675 void *handle,
676 uint64_t flags)
677 {
678 unsigned int secure_state_in = (secure_origin) ? SECURE : NON_SECURE;
679 unsigned int secure_state_out = (!secure_origin) ? SECURE : NON_SECURE;
680
681 #if SPMD_SPM_AT_SEL2
682 if ((secure_state_out == SECURE) && (is_sve_hint_set(flags) == true)) {
683 /*
684 * Set the SVE hint bit in x0 and pass to the lower secure EL,
685 * if it was set by the caller.
686 */
687 smc_fid |= (FUNCID_SVE_HINT_MASK << FUNCID_SVE_HINT_SHIFT);
688 }
689 #endif
690
691 /* Save incoming security state */
692 #if SPMD_SPM_AT_SEL2
693 cm_el2_sysregs_context_save(secure_state_in);
694 #else
695 cm_el1_sysregs_context_save(secure_state_in);
696 #endif
697
698 /* Restore outgoing security state */
699 #if SPMD_SPM_AT_SEL2
700 cm_el2_sysregs_context_restore(secure_state_out);
701 #else
702 cm_el1_sysregs_context_restore(secure_state_out);
703 #endif
704 cm_set_next_eret_context(secure_state_out);
705
706 #if SPMD_SPM_AT_SEL2
707 /*
708 * If SPMC is at SEL2, save additional registers x8-x17, which may
709 * be used in FF-A calls such as FFA_PARTITION_INFO_GET_REGS.
710 * Note that technically, all SPMCs can support this, but this code is
711 * under ifdef to minimize breakage in case other SPMCs do not save
712 * and restore x8-x17.
713 * We also need to pass through these registers since not all FF-A ABIs
714 * modify x8-x17, in which case, SMCCC requires that these registers be
715 * preserved, so the SPMD passes through these registers and expects the
716 * SPMC to save and restore (potentially also modify) them.
717 */
718 SMC_RET18(cm_get_context(secure_state_out), smc_fid, x1, x2, x3, x4,
719 SMC_GET_GP(handle, CTX_GPREG_X5),
720 SMC_GET_GP(handle, CTX_GPREG_X6),
721 SMC_GET_GP(handle, CTX_GPREG_X7),
722 SMC_GET_GP(handle, CTX_GPREG_X8),
723 SMC_GET_GP(handle, CTX_GPREG_X9),
724 SMC_GET_GP(handle, CTX_GPREG_X10),
725 SMC_GET_GP(handle, CTX_GPREG_X11),
726 SMC_GET_GP(handle, CTX_GPREG_X12),
727 SMC_GET_GP(handle, CTX_GPREG_X13),
728 SMC_GET_GP(handle, CTX_GPREG_X14),
729 SMC_GET_GP(handle, CTX_GPREG_X15),
730 SMC_GET_GP(handle, CTX_GPREG_X16),
731 SMC_GET_GP(handle, CTX_GPREG_X17)
732 );
733
734 #else
735 SMC_RET8(cm_get_context(secure_state_out), smc_fid, x1, x2, x3, x4,
736 SMC_GET_GP(handle, CTX_GPREG_X5),
737 SMC_GET_GP(handle, CTX_GPREG_X6),
738 SMC_GET_GP(handle, CTX_GPREG_X7));
739 #endif
740 }
741
742 /*******************************************************************************
743 * Forward SMCs to the other security state.
744 ******************************************************************************/
spmd_smc_forward(uint32_t smc_fid,bool secure_origin,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)745 static uint64_t spmd_smc_forward(uint32_t smc_fid,
746 bool secure_origin,
747 uint64_t x1,
748 uint64_t x2,
749 uint64_t x3,
750 uint64_t x4,
751 void *cookie,
752 void *handle,
753 uint64_t flags)
754 {
755 if (is_spmc_at_el3() && !secure_origin) {
756 return spmc_smc_handler(smc_fid, secure_origin, x1, x2, x3, x4,
757 cookie, handle, flags);
758 }
759
760 return spmd_smc_switch_state(smc_fid, secure_origin, x1, x2, x3, x4,
761 handle, flags);
762
763 }
764
765 /*******************************************************************************
766 * Return FFA_ERROR with specified error code
767 ******************************************************************************/
spmd_ffa_error_return(void * handle,int error_code)768 uint64_t spmd_ffa_error_return(void *handle, int error_code)
769 {
770 SMC_RET8(handle, (uint32_t) FFA_ERROR,
771 FFA_TARGET_INFO_MBZ, (uint32_t)error_code,
772 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
773 FFA_PARAM_MBZ, FFA_PARAM_MBZ);
774 }
775
776 /*******************************************************************************
777 * spmd_check_address_in_binary_image
778 ******************************************************************************/
spmd_check_address_in_binary_image(uint64_t address)779 bool spmd_check_address_in_binary_image(uint64_t address)
780 {
781 assert(!check_uptr_overflow(spmc_attrs.load_address, spmc_attrs.binary_size));
782
783 return ((address >= spmc_attrs.load_address) &&
784 (address < (spmc_attrs.load_address + spmc_attrs.binary_size)));
785 }
786
787 /******************************************************************************
788 * spmd_is_spmc_message
789 *****************************************************************************/
spmd_is_spmc_message(unsigned int ep)790 static bool spmd_is_spmc_message(unsigned int ep)
791 {
792 if (is_spmc_at_el3()) {
793 return false;
794 }
795
796 return ((ffa_endpoint_destination(ep) == SPMD_DIRECT_MSG_ENDPOINT_ID)
797 && (ffa_endpoint_source(ep) == spmc_attrs.spmc_id));
798 }
799
800 /******************************************************************************
801 * spmd_handle_spmc_message
802 *****************************************************************************/
spmd_handle_spmc_message(unsigned long long msg,unsigned long long parm1,unsigned long long parm2,unsigned long long parm3,unsigned long long parm4)803 static int spmd_handle_spmc_message(unsigned long long msg,
804 unsigned long long parm1, unsigned long long parm2,
805 unsigned long long parm3, unsigned long long parm4)
806 {
807 VERBOSE("%s %llx %llx %llx %llx %llx\n", __func__,
808 msg, parm1, parm2, parm3, parm4);
809
810 return -EINVAL;
811 }
812
813 /*******************************************************************************
814 * This function forwards FF-A SMCs to either the main SPMD handler or the
815 * SPMC at EL3, depending on the origin security state, if enabled.
816 ******************************************************************************/
spmd_ffa_smc_handler(uint32_t smc_fid,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)817 uint64_t spmd_ffa_smc_handler(uint32_t smc_fid,
818 uint64_t x1,
819 uint64_t x2,
820 uint64_t x3,
821 uint64_t x4,
822 void *cookie,
823 void *handle,
824 uint64_t flags)
825 {
826 if (is_spmc_at_el3()) {
827 /*
828 * If we have an SPMC at EL3 allow handling of the SMC first.
829 * The SPMC will call back through to SPMD handler if required.
830 */
831 if (is_caller_secure(flags)) {
832 return spmc_smc_handler(smc_fid,
833 is_caller_secure(flags),
834 x1, x2, x3, x4, cookie,
835 handle, flags);
836 }
837 }
838 return spmd_smc_handler(smc_fid, x1, x2, x3, x4, cookie,
839 handle, flags);
840 }
841
842 /*******************************************************************************
843 * This function handles all SMCs in the range reserved for FFA. Each call is
844 * either forwarded to the other security state or handled by the SPM dispatcher
845 ******************************************************************************/
spmd_smc_handler(uint32_t smc_fid,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)846 uint64_t spmd_smc_handler(uint32_t smc_fid,
847 uint64_t x1,
848 uint64_t x2,
849 uint64_t x3,
850 uint64_t x4,
851 void *cookie,
852 void *handle,
853 uint64_t flags)
854 {
855 unsigned int linear_id = plat_my_core_pos();
856 spmd_spm_core_context_t *ctx = spmd_get_context();
857 bool secure_origin;
858 int ret;
859 uint32_t input_version;
860
861 /* Determine which security state this SMC originated from */
862 secure_origin = is_caller_secure(flags);
863
864 VERBOSE("SPM(%u): 0x%x 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64
865 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 "\n",
866 linear_id, smc_fid, x1, x2, x3, x4,
867 SMC_GET_GP(handle, CTX_GPREG_X5),
868 SMC_GET_GP(handle, CTX_GPREG_X6),
869 SMC_GET_GP(handle, CTX_GPREG_X7));
870
871 /*
872 * If there is an on-going info regs from EL3 SPMD LP, unconditionally
873 * return, we don't expect any other FF-A ABIs to be called between
874 * calls to FFA_PARTITION_INFO_GET_REGS.
875 */
876 if (is_spmd_logical_sp_info_regs_req_in_progress(ctx)) {
877 assert(secure_origin);
878 spmd_spm_core_sync_exit(0ULL);
879 }
880
881 switch (smc_fid) {
882 case FFA_ERROR:
883 /*
884 * Check if this is the first invocation of this interface on
885 * this CPU. If so, then indicate that the SPM Core initialised
886 * unsuccessfully.
887 */
888 if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) {
889 spmd_spm_core_sync_exit(x2);
890 }
891
892 /*
893 * If there was an SPMD logical partition direct request on-going,
894 * return back to the SPMD logical partition so the error can be
895 * consumed.
896 */
897 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
898 assert(secure_origin);
899 spmd_spm_core_sync_exit(0ULL);
900 }
901
902 return spmd_smc_forward(smc_fid, secure_origin,
903 x1, x2, x3, x4, cookie,
904 handle, flags);
905 break; /* not reached */
906
907 case FFA_VERSION:
908 input_version = (uint32_t)(0xFFFFFFFF & x1);
909 /*
910 * If caller is secure and SPMC was initialized,
911 * return FFA_VERSION of SPMD.
912 * If caller is non secure and SPMC was initialized,
913 * forward to the EL3 SPMC if enabled, otherwise return
914 * the SPMC version if implemented at a lower EL.
915 * Sanity check to "input_version".
916 * If the EL3 SPMC is enabled, ignore the SPMC state as
917 * this is not used.
918 */
919 if ((input_version & FFA_VERSION_BIT31_MASK) ||
920 (!is_spmc_at_el3() && (ctx->state == SPMC_STATE_RESET))) {
921 ret = FFA_ERROR_NOT_SUPPORTED;
922 } else if (!secure_origin) {
923 if (is_spmc_at_el3()) {
924 /*
925 * Forward the call directly to the EL3 SPMC, if
926 * enabled, as we don't need to wrap the call in
927 * a direct request.
928 */
929 return spmd_smc_forward(smc_fid, secure_origin,
930 x1, x2, x3, x4, cookie,
931 handle, flags);
932 }
933
934 gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx);
935 uint64_t rc;
936
937 if (spmc_attrs.major_version == 1 &&
938 spmc_attrs.minor_version == 0) {
939 ret = MAKE_FFA_VERSION(spmc_attrs.major_version,
940 spmc_attrs.minor_version);
941 SMC_RET8(handle, (uint32_t)ret,
942 FFA_TARGET_INFO_MBZ,
943 FFA_TARGET_INFO_MBZ,
944 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
945 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
946 FFA_PARAM_MBZ);
947 break;
948 }
949 /* Save non-secure system registers context */
950 #if SPMD_SPM_AT_SEL2
951 cm_el2_sysregs_context_save(NON_SECURE);
952 #else
953 cm_el1_sysregs_context_save(NON_SECURE);
954 #endif
955
956 /*
957 * The incoming request has FFA_VERSION as X0 smc_fid
958 * and requested version in x1. Prepare a direct request
959 * from SPMD to SPMC with FFA_VERSION framework function
960 * identifier in X2 and requested version in X3.
961 */
962 spmd_build_spmc_message(gpregs,
963 SPMD_FWK_MSG_FFA_VERSION_REQ,
964 input_version);
965
966 /*
967 * Ensure x8-x17 NS GP register values are untouched when returning
968 * from the SPMC.
969 */
970 write_ctx_reg(gpregs, CTX_GPREG_X8, SMC_GET_GP(handle, CTX_GPREG_X8));
971 write_ctx_reg(gpregs, CTX_GPREG_X9, SMC_GET_GP(handle, CTX_GPREG_X9));
972 write_ctx_reg(gpregs, CTX_GPREG_X10, SMC_GET_GP(handle, CTX_GPREG_X10));
973 write_ctx_reg(gpregs, CTX_GPREG_X11, SMC_GET_GP(handle, CTX_GPREG_X11));
974 write_ctx_reg(gpregs, CTX_GPREG_X12, SMC_GET_GP(handle, CTX_GPREG_X12));
975 write_ctx_reg(gpregs, CTX_GPREG_X13, SMC_GET_GP(handle, CTX_GPREG_X13));
976 write_ctx_reg(gpregs, CTX_GPREG_X14, SMC_GET_GP(handle, CTX_GPREG_X14));
977 write_ctx_reg(gpregs, CTX_GPREG_X15, SMC_GET_GP(handle, CTX_GPREG_X15));
978 write_ctx_reg(gpregs, CTX_GPREG_X16, SMC_GET_GP(handle, CTX_GPREG_X16));
979 write_ctx_reg(gpregs, CTX_GPREG_X17, SMC_GET_GP(handle, CTX_GPREG_X17));
980
981 rc = spmd_spm_core_sync_entry(ctx);
982
983 if ((rc != 0ULL) ||
984 (SMC_GET_GP(gpregs, CTX_GPREG_X0) !=
985 FFA_MSG_SEND_DIRECT_RESP_SMC32) ||
986 (SMC_GET_GP(gpregs, CTX_GPREG_X2) !=
987 (FFA_FWK_MSG_BIT |
988 SPMD_FWK_MSG_FFA_VERSION_RESP))) {
989 ERROR("Failed to forward FFA_VERSION\n");
990 ret = FFA_ERROR_NOT_SUPPORTED;
991 } else {
992 ret = SMC_GET_GP(gpregs, CTX_GPREG_X3);
993 }
994
995 /*
996 * x0-x4 are updated by spmd_smc_forward below.
997 * Zero out x5-x7 in the FFA_VERSION response.
998 */
999 write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
1000 write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
1001 write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
1002
1003 /*
1004 * Return here after SPMC has handled FFA_VERSION.
1005 * The returned SPMC version is held in X3.
1006 * Forward this version in X0 to the non-secure caller.
1007 */
1008 return spmd_smc_forward(ret, true, FFA_PARAM_MBZ,
1009 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1010 FFA_PARAM_MBZ, cookie, gpregs,
1011 flags);
1012 } else {
1013 ret = MAKE_FFA_VERSION(FFA_VERSION_MAJOR,
1014 FFA_VERSION_MINOR);
1015 }
1016
1017 SMC_RET8(handle, (uint32_t)ret, FFA_TARGET_INFO_MBZ,
1018 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1019 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ);
1020 break; /* not reached */
1021
1022 case FFA_FEATURES:
1023 /*
1024 * This is an optional interface. Do the minimal checks and
1025 * forward to SPM Core which will handle it if implemented.
1026 */
1027
1028 /* Forward SMC from Normal world to the SPM Core */
1029 if (!secure_origin) {
1030 return spmd_smc_forward(smc_fid, secure_origin,
1031 x1, x2, x3, x4, cookie,
1032 handle, flags);
1033 }
1034
1035 /*
1036 * Return success if call was from secure world i.e. all
1037 * FFA functions are supported. This is essentially a
1038 * nop.
1039 */
1040 SMC_RET8(handle, FFA_SUCCESS_SMC32, x1, x2, x3, x4,
1041 SMC_GET_GP(handle, CTX_GPREG_X5),
1042 SMC_GET_GP(handle, CTX_GPREG_X6),
1043 SMC_GET_GP(handle, CTX_GPREG_X7));
1044
1045 break; /* not reached */
1046
1047 case FFA_ID_GET:
1048 /*
1049 * Returns the ID of the calling FFA component.
1050 */
1051 if (!secure_origin) {
1052 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1053 FFA_TARGET_INFO_MBZ, FFA_NS_ENDPOINT_ID,
1054 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1055 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1056 FFA_PARAM_MBZ);
1057 }
1058
1059 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1060 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id,
1061 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1062 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1063 FFA_PARAM_MBZ);
1064
1065 break; /* not reached */
1066
1067 case FFA_SECONDARY_EP_REGISTER_SMC64:
1068 if (secure_origin) {
1069 ret = spmd_pm_secondary_ep_register(x1);
1070
1071 if (ret < 0) {
1072 SMC_RET8(handle, FFA_ERROR_SMC64,
1073 FFA_TARGET_INFO_MBZ, ret,
1074 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1075 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1076 FFA_PARAM_MBZ);
1077 } else {
1078 SMC_RET8(handle, FFA_SUCCESS_SMC64,
1079 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ,
1080 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1081 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1082 FFA_PARAM_MBZ);
1083 }
1084 }
1085
1086 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1087 break; /* Not reached */
1088
1089 case FFA_SPM_ID_GET:
1090 if (MAKE_FFA_VERSION(1, 1) > FFA_VERSION_COMPILED) {
1091 return spmd_ffa_error_return(handle,
1092 FFA_ERROR_NOT_SUPPORTED);
1093 }
1094 /*
1095 * Returns the ID of the SPMC or SPMD depending on the FF-A
1096 * instance where this function is invoked
1097 */
1098 if (!secure_origin) {
1099 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1100 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id,
1101 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1102 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1103 FFA_PARAM_MBZ);
1104 }
1105 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1106 FFA_TARGET_INFO_MBZ, SPMD_DIRECT_MSG_ENDPOINT_ID,
1107 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1108 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1109 FFA_PARAM_MBZ);
1110
1111 break; /* not reached */
1112
1113 case FFA_MSG_SEND_DIRECT_REQ_SMC32:
1114 case FFA_MSG_SEND_DIRECT_REQ_SMC64:
1115 /*
1116 * Regardless of secure_origin, SPMD logical partitions cannot
1117 * handle direct messages. They can only initiate direct
1118 * messages and consume direct responses or errors.
1119 */
1120 if (is_spmd_lp_id(ffa_endpoint_source(x1)) ||
1121 is_spmd_lp_id(ffa_endpoint_destination(x1))) {
1122 return spmd_ffa_error_return(handle,
1123 FFA_ERROR_INVALID_PARAMETER
1124 );
1125 }
1126
1127 /*
1128 * When there is an ongoing SPMD logical partition direct
1129 * request, there cannot be another direct request. Return
1130 * error in this case. Panic'ing is an option but that does
1131 * not provide the opportunity for caller to abort based on
1132 * error codes.
1133 */
1134 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1135 assert(secure_origin);
1136 return spmd_ffa_error_return(handle,
1137 FFA_ERROR_DENIED);
1138 }
1139
1140 if (!secure_origin) {
1141 /* Validate source endpoint is non-secure for non-secure caller. */
1142 if (ffa_is_secure_world_id(ffa_endpoint_source(x1))) {
1143 return spmd_ffa_error_return(handle,
1144 FFA_ERROR_INVALID_PARAMETER);
1145 }
1146 }
1147 if (secure_origin && spmd_is_spmc_message(x1)) {
1148 ret = spmd_handle_spmc_message(x3, x4,
1149 SMC_GET_GP(handle, CTX_GPREG_X5),
1150 SMC_GET_GP(handle, CTX_GPREG_X6),
1151 SMC_GET_GP(handle, CTX_GPREG_X7));
1152
1153 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1154 FFA_TARGET_INFO_MBZ, ret,
1155 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1156 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1157 FFA_PARAM_MBZ);
1158 } else {
1159 /* Forward direct message to the other world */
1160 return spmd_smc_forward(smc_fid, secure_origin,
1161 x1, x2, x3, x4, cookie,
1162 handle, flags);
1163 }
1164 break; /* Not reached */
1165
1166 case FFA_MSG_SEND_DIRECT_REQ2_SMC64:
1167 if (!secure_origin) {
1168 /* Validate source endpoint is non-secure for non-secure caller. */
1169 if (ffa_is_secure_world_id(ffa_endpoint_source(x1))) {
1170 return spmd_ffa_error_return(handle,
1171 FFA_ERROR_INVALID_PARAMETER);
1172 }
1173 }
1174 /* FFA_MSG_SEND_DIRECT_REQ2 not used for framework messages. */
1175 if (secure_origin && spmd_is_spmc_message(x1)) {
1176 return spmd_ffa_error_return(handle, FFA_ERROR_INVALID_PARAMETER);
1177 } else {
1178 /* Forward direct message to the other world */
1179 return spmd_smc_forward(smc_fid, secure_origin,
1180 x1, x2, x3, x4, cookie,
1181 handle, flags);
1182 }
1183 break; /* Not reached */
1184
1185 case FFA_MSG_SEND_DIRECT_RESP_SMC32:
1186 case FFA_MSG_SEND_DIRECT_RESP_SMC64:
1187 if (secure_origin && (spmd_is_spmc_message(x1) ||
1188 is_spmd_logical_sp_dir_req_in_progress(ctx))) {
1189 spmd_spm_core_sync_exit(0ULL);
1190 } else {
1191 /* Forward direct message to the other world */
1192 return spmd_smc_forward(smc_fid, secure_origin,
1193 x1, x2, x3, x4, cookie,
1194 handle, flags);
1195 }
1196 break; /* Not reached */
1197 case FFA_MSG_SEND_DIRECT_RESP2_SMC64:
1198 /* Forward direct message to the other world */
1199 return spmd_smc_forward(smc_fid, secure_origin,
1200 x1, x2, x3, x4, cookie,
1201 handle, flags);
1202 break; /* Not reached */
1203 case FFA_RX_RELEASE:
1204 case FFA_RXTX_MAP_SMC32:
1205 case FFA_RXTX_MAP_SMC64:
1206 case FFA_RXTX_UNMAP:
1207 case FFA_PARTITION_INFO_GET:
1208 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED
1209 case FFA_NOTIFICATION_BITMAP_CREATE:
1210 case FFA_NOTIFICATION_BITMAP_DESTROY:
1211 case FFA_NOTIFICATION_BIND:
1212 case FFA_NOTIFICATION_UNBIND:
1213 case FFA_NOTIFICATION_SET:
1214 case FFA_NOTIFICATION_GET:
1215 case FFA_NOTIFICATION_INFO_GET:
1216 case FFA_NOTIFICATION_INFO_GET_SMC64:
1217 case FFA_MSG_SEND2:
1218 case FFA_RX_ACQUIRE:
1219 #endif
1220 case FFA_MSG_RUN:
1221 /*
1222 * Above calls should be invoked only by the Normal world and
1223 * must not be forwarded from Secure world to Normal world.
1224 */
1225 if (secure_origin) {
1226 return spmd_ffa_error_return(handle,
1227 FFA_ERROR_NOT_SUPPORTED);
1228 }
1229
1230 /* Forward the call to the other world */
1231 /* fallthrough */
1232 case FFA_MSG_SEND:
1233 case FFA_MEM_DONATE_SMC32:
1234 case FFA_MEM_DONATE_SMC64:
1235 case FFA_MEM_LEND_SMC32:
1236 case FFA_MEM_LEND_SMC64:
1237 case FFA_MEM_SHARE_SMC32:
1238 case FFA_MEM_SHARE_SMC64:
1239 case FFA_MEM_RETRIEVE_REQ_SMC32:
1240 case FFA_MEM_RETRIEVE_REQ_SMC64:
1241 case FFA_MEM_RETRIEVE_RESP:
1242 case FFA_MEM_RELINQUISH:
1243 case FFA_MEM_RECLAIM:
1244 case FFA_MEM_FRAG_TX:
1245 case FFA_MEM_FRAG_RX:
1246 case FFA_SUCCESS_SMC32:
1247 case FFA_SUCCESS_SMC64:
1248 /*
1249 * If there is an ongoing direct request from an SPMD logical
1250 * partition, return an error.
1251 */
1252 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1253 assert(secure_origin);
1254 return spmd_ffa_error_return(handle,
1255 FFA_ERROR_DENIED);
1256 }
1257
1258 return spmd_smc_forward(smc_fid, secure_origin,
1259 x1, x2, x3, x4, cookie,
1260 handle, flags);
1261 break; /* not reached */
1262
1263 case FFA_MSG_WAIT:
1264 /*
1265 * Check if this is the first invocation of this interface on
1266 * this CPU from the Secure world. If so, then indicate that the
1267 * SPM Core initialised successfully.
1268 */
1269 if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) {
1270 spmd_spm_core_sync_exit(0ULL);
1271 }
1272
1273 /* Forward the call to the other world */
1274 /* fallthrough */
1275 case FFA_INTERRUPT:
1276 case FFA_MSG_YIELD:
1277 /* This interface must be invoked only by the Secure world */
1278 if (!secure_origin) {
1279 return spmd_ffa_error_return(handle,
1280 FFA_ERROR_NOT_SUPPORTED);
1281 }
1282
1283 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1284 assert(secure_origin);
1285 return spmd_ffa_error_return(handle,
1286 FFA_ERROR_DENIED);
1287 }
1288
1289 return spmd_smc_forward(smc_fid, secure_origin,
1290 x1, x2, x3, x4, cookie,
1291 handle, flags);
1292 break; /* not reached */
1293
1294 case FFA_NORMAL_WORLD_RESUME:
1295 if (secure_origin && ctx->secure_interrupt_ongoing) {
1296 spmd_spm_core_sync_exit(0ULL);
1297 } else {
1298 return spmd_ffa_error_return(handle, FFA_ERROR_DENIED);
1299 }
1300 break; /* Not reached */
1301 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED
1302 case FFA_PARTITION_INFO_GET_REGS_SMC64:
1303 if (secure_origin) {
1304 return spmd_el3_populate_logical_partition_info(handle, x1,
1305 x2, x3);
1306 }
1307
1308 /* Call only supported with SMCCC 1.2+ */
1309 if (MAKE_SMCCC_VERSION(SMCCC_MAJOR_VERSION, SMCCC_MINOR_VERSION) < 0x10002) {
1310 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1311 }
1312
1313 return spmd_smc_forward(smc_fid, secure_origin,
1314 x1, x2, x3, x4, cookie,
1315 handle, flags);
1316 break; /* Not reached */
1317 #endif
1318 case FFA_CONSOLE_LOG_SMC32:
1319 case FFA_CONSOLE_LOG_SMC64:
1320 /* This interface must not be forwarded to other worlds. */
1321 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1322 break; /* not reached */
1323
1324 case FFA_EL3_INTR_HANDLE:
1325 if (secure_origin) {
1326 return spmd_handle_group0_intr_swd(handle);
1327 } else {
1328 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1329 }
1330 default:
1331 WARN("SPM: Unsupported call 0x%08x\n", smc_fid);
1332 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1333 }
1334 }
1335