1 /*
2  * Copyright (c) 2020-2023, Arm Limited and Contributors. All rights reserved.
3  *
4  * SPDX-License-Identifier: BSD-3-Clause
5  */
6 
7 #include <assert.h>
8 #include <errno.h>
9 #include <inttypes.h>
10 #include <stdint.h>
11 #include <string.h>
12 
13 #include <arch_helpers.h>
14 #include <arch/aarch64/arch_features.h>
15 #include <bl31/bl31.h>
16 #include <bl31/interrupt_mgmt.h>
17 #include <common/debug.h>
18 #include <common/runtime_svc.h>
19 #include <common/tbbr/tbbr_img_def.h>
20 #include <lib/el3_runtime/context_mgmt.h>
21 #include <lib/fconf/fconf.h>
22 #include <lib/fconf/fconf_dyn_cfg_getter.h>
23 #include <lib/smccc.h>
24 #include <lib/spinlock.h>
25 #include <lib/utils.h>
26 #include <lib/xlat_tables/xlat_tables_v2.h>
27 #include <plat/common/common_def.h>
28 #include <plat/common/platform.h>
29 #include <platform_def.h>
30 #include <services/el3_spmd_logical_sp.h>
31 #include <services/ffa_svc.h>
32 #include <services/spmc_svc.h>
33 #include <services/spmd_svc.h>
34 #include <smccc_helpers.h>
35 #include "spmd_private.h"
36 
37 /*******************************************************************************
38  * SPM Core context information.
39  ******************************************************************************/
40 static spmd_spm_core_context_t spm_core_context[PLATFORM_CORE_COUNT];
41 
42 /*******************************************************************************
43  * SPM Core attribute information is read from its manifest if the SPMC is not
44  * at EL3. Else, it is populated from the SPMC directly.
45  ******************************************************************************/
46 static spmc_manifest_attribute_t spmc_attrs;
47 
48 /*******************************************************************************
49  * SPM Core entry point information. Discovered on the primary core and reused
50  * on secondary cores.
51  ******************************************************************************/
52 static entry_point_info_t *spmc_ep_info;
53 
54 /*******************************************************************************
55  * SPM Core context on CPU based on mpidr.
56  ******************************************************************************/
spmd_get_context_by_mpidr(uint64_t mpidr)57 spmd_spm_core_context_t *spmd_get_context_by_mpidr(uint64_t mpidr)
58 {
59 	int core_idx = plat_core_pos_by_mpidr(mpidr);
60 
61 	if (core_idx < 0) {
62 		ERROR("Invalid mpidr: %" PRIx64 ", returned ID: %d\n", mpidr, core_idx);
63 		panic();
64 	}
65 
66 	return &spm_core_context[core_idx];
67 }
68 
69 /*******************************************************************************
70  * SPM Core context on current CPU get helper.
71  ******************************************************************************/
spmd_get_context(void)72 spmd_spm_core_context_t *spmd_get_context(void)
73 {
74 	return spmd_get_context_by_mpidr(read_mpidr());
75 }
76 
77 /*******************************************************************************
78  * SPM Core ID getter.
79  ******************************************************************************/
spmd_spmc_id_get(void)80 uint16_t spmd_spmc_id_get(void)
81 {
82 	return spmc_attrs.spmc_id;
83 }
84 
85 /*******************************************************************************
86  * Static function declaration.
87  ******************************************************************************/
88 static int32_t spmd_init(void);
89 static int spmd_spmc_init(void *pm_addr);
90 
91 static uint64_t spmd_smc_forward(uint32_t smc_fid,
92 				 bool secure_origin,
93 				 uint64_t x1,
94 				 uint64_t x2,
95 				 uint64_t x3,
96 				 uint64_t x4,
97 				 void *cookie,
98 				 void *handle,
99 				 uint64_t flags);
100 
101 /******************************************************************************
102  * Builds an SPMD to SPMC direct message request.
103  *****************************************************************************/
spmd_build_spmc_message(gp_regs_t * gpregs,uint8_t target_func,unsigned long long message)104 void spmd_build_spmc_message(gp_regs_t *gpregs, uint8_t target_func,
105 			     unsigned long long message)
106 {
107 	write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_MSG_SEND_DIRECT_REQ_SMC32);
108 	write_ctx_reg(gpregs, CTX_GPREG_X1,
109 		(SPMD_DIRECT_MSG_ENDPOINT_ID << FFA_DIRECT_MSG_SOURCE_SHIFT) |
110 		 spmd_spmc_id_get());
111 	write_ctx_reg(gpregs, CTX_GPREG_X2, BIT(31) | target_func);
112 	write_ctx_reg(gpregs, CTX_GPREG_X3, message);
113 
114 	/* Zero out x4-x7 for the direct request emitted towards the SPMC. */
115 	write_ctx_reg(gpregs, CTX_GPREG_X4, 0);
116 	write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
117 	write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
118 	write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
119 }
120 
121 
122 /*******************************************************************************
123  * This function takes an SPMC context pointer and performs a synchronous
124  * SPMC entry.
125  ******************************************************************************/
spmd_spm_core_sync_entry(spmd_spm_core_context_t * spmc_ctx)126 uint64_t spmd_spm_core_sync_entry(spmd_spm_core_context_t *spmc_ctx)
127 {
128 	uint64_t rc;
129 
130 	assert(spmc_ctx != NULL);
131 
132 	cm_set_context(&(spmc_ctx->cpu_ctx), SECURE);
133 
134 	/* Restore the context assigned above */
135 #if SPMD_SPM_AT_SEL2
136 	cm_el2_sysregs_context_restore(SECURE);
137 #else
138 	cm_el1_sysregs_context_restore(SECURE);
139 #endif
140 	cm_set_next_eret_context(SECURE);
141 
142 	/* Enter SPMC */
143 	rc = spmd_spm_core_enter(&spmc_ctx->c_rt_ctx);
144 
145 	/* Save secure state */
146 #if SPMD_SPM_AT_SEL2
147 	cm_el2_sysregs_context_save(SECURE);
148 #else
149 	cm_el1_sysregs_context_save(SECURE);
150 #endif
151 
152 	return rc;
153 }
154 
155 /*******************************************************************************
156  * This function returns to the place where spmd_spm_core_sync_entry() was
157  * called originally.
158  ******************************************************************************/
spmd_spm_core_sync_exit(uint64_t rc)159 __dead2 void spmd_spm_core_sync_exit(uint64_t rc)
160 {
161 	spmd_spm_core_context_t *ctx = spmd_get_context();
162 
163 	/* Get current CPU context from SPMC context */
164 	assert(cm_get_context(SECURE) == &(ctx->cpu_ctx));
165 
166 	/*
167 	 * The SPMD must have initiated the original request through a
168 	 * synchronous entry into SPMC. Jump back to the original C runtime
169 	 * context with the value of rc in x0;
170 	 */
171 	spmd_spm_core_exit(ctx->c_rt_ctx, rc);
172 
173 	panic();
174 }
175 
176 /*******************************************************************************
177  * Jump to the SPM Core for the first time.
178  ******************************************************************************/
spmd_init(void)179 static int32_t spmd_init(void)
180 {
181 	spmd_spm_core_context_t *ctx = spmd_get_context();
182 	uint64_t rc;
183 
184 	VERBOSE("SPM Core init start.\n");
185 
186 	/* Primary boot core enters the SPMC for initialization. */
187 	ctx->state = SPMC_STATE_ON_PENDING;
188 
189 	rc = spmd_spm_core_sync_entry(ctx);
190 	if (rc != 0ULL) {
191 		ERROR("SPMC initialisation failed 0x%" PRIx64 "\n", rc);
192 		return 0;
193 	}
194 
195 	ctx->state = SPMC_STATE_ON;
196 
197 	VERBOSE("SPM Core init end.\n");
198 
199 	spmd_logical_sp_set_spmc_initialized();
200 	rc = spmd_logical_sp_init();
201 	if (rc != 0) {
202 		WARN("SPMD Logical partitions failed init.\n");
203 	}
204 
205 	return 1;
206 }
207 
208 /*******************************************************************************
209  * spmd_secure_interrupt_handler
210  * Enter the SPMC for further handling of the secure interrupt by the SPMC
211  * itself or a Secure Partition.
212  ******************************************************************************/
spmd_secure_interrupt_handler(uint32_t id,uint32_t flags,void * handle,void * cookie)213 static uint64_t spmd_secure_interrupt_handler(uint32_t id,
214 					      uint32_t flags,
215 					      void *handle,
216 					      void *cookie)
217 {
218 	spmd_spm_core_context_t *ctx = spmd_get_context();
219 	gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx);
220 	unsigned int linear_id = plat_my_core_pos();
221 	int64_t rc;
222 
223 	/* Sanity check the security state when the exception was generated */
224 	assert(get_interrupt_src_ss(flags) == NON_SECURE);
225 
226 	/* Sanity check the pointer to this cpu's context */
227 	assert(handle == cm_get_context(NON_SECURE));
228 
229 	/* Save the non-secure context before entering SPMC */
230 	cm_el1_sysregs_context_save(NON_SECURE);
231 #if SPMD_SPM_AT_SEL2
232 	cm_el2_sysregs_context_save(NON_SECURE);
233 #endif
234 
235 	/* Convey the event to the SPMC through the FFA_INTERRUPT interface. */
236 	write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_INTERRUPT);
237 	write_ctx_reg(gpregs, CTX_GPREG_X1, 0);
238 	write_ctx_reg(gpregs, CTX_GPREG_X2, 0);
239 	write_ctx_reg(gpregs, CTX_GPREG_X3, 0);
240 	write_ctx_reg(gpregs, CTX_GPREG_X4, 0);
241 	write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
242 	write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
243 	write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
244 
245 	/* Mark current core as handling a secure interrupt. */
246 	ctx->secure_interrupt_ongoing = true;
247 
248 	rc = spmd_spm_core_sync_entry(ctx);
249 	if (rc != 0ULL) {
250 		ERROR("%s failed (%" PRId64 ") on CPU%u\n", __func__, rc, linear_id);
251 	}
252 
253 	ctx->secure_interrupt_ongoing = false;
254 
255 	cm_el1_sysregs_context_restore(NON_SECURE);
256 #if SPMD_SPM_AT_SEL2
257 	cm_el2_sysregs_context_restore(NON_SECURE);
258 #endif
259 	cm_set_next_eret_context(NON_SECURE);
260 
261 	SMC_RET0(&ctx->cpu_ctx);
262 }
263 
264 #if (EL3_EXCEPTION_HANDLING == 0)
265 /*******************************************************************************
266  * spmd_group0_interrupt_handler_nwd
267  * Group0 secure interrupt in the normal world are trapped to EL3. Delegate the
268  * handling of the interrupt to the platform handler, and return only upon
269  * successfully handling the Group0 interrupt.
270  ******************************************************************************/
spmd_group0_interrupt_handler_nwd(uint32_t id,uint32_t flags,void * handle,void * cookie)271 static uint64_t spmd_group0_interrupt_handler_nwd(uint32_t id,
272 						  uint32_t flags,
273 						  void *handle,
274 						  void *cookie)
275 {
276 	uint32_t intid;
277 
278 	/* Sanity check the security state when the exception was generated. */
279 	assert(get_interrupt_src_ss(flags) == NON_SECURE);
280 
281 	/* Sanity check the pointer to this cpu's context. */
282 	assert(handle == cm_get_context(NON_SECURE));
283 
284 	assert(id == INTR_ID_UNAVAILABLE);
285 
286 	assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3);
287 
288 	intid = plat_ic_acknowledge_interrupt();
289 
290 	if (plat_spmd_handle_group0_interrupt(intid) < 0) {
291 		ERROR("Group0 interrupt %u not handled\n", intid);
292 		panic();
293 	}
294 
295 	/* Deactivate the corresponding Group0 interrupt. */
296 	plat_ic_end_of_interrupt(intid);
297 
298 	return 0U;
299 }
300 #endif
301 
302 /*******************************************************************************
303  * spmd_handle_group0_intr_swd
304  * SPMC delegates handling of Group0 secure interrupt to EL3 firmware using
305  * FFA_EL3_INTR_HANDLE SMC call. Further, SPMD delegates the handling of the
306  * interrupt to the platform handler, and returns only upon successfully
307  * handling the Group0 interrupt.
308  ******************************************************************************/
spmd_handle_group0_intr_swd(void * handle)309 static uint64_t spmd_handle_group0_intr_swd(void *handle)
310 {
311 	uint32_t intid;
312 
313 	/* Sanity check the pointer to this cpu's context */
314 	assert(handle == cm_get_context(SECURE));
315 
316 	assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3);
317 
318 	intid = plat_ic_acknowledge_interrupt();
319 
320 	/*
321 	 * TODO: Currently due to a limitation in SPMD implementation, the
322 	 * platform handler is expected to not delegate handling to NWd while
323 	 * processing Group0 secure interrupt.
324 	 */
325 	if (plat_spmd_handle_group0_interrupt(intid) < 0) {
326 		/* Group0 interrupt was not handled by the platform. */
327 		ERROR("Group0 interrupt %u not handled\n", intid);
328 		panic();
329 	}
330 
331 	/* Deactivate the corresponding Group0 interrupt. */
332 	plat_ic_end_of_interrupt(intid);
333 
334 	/* Return success. */
335 	SMC_RET8(handle, FFA_SUCCESS_SMC32, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
336 		 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
337 		 FFA_PARAM_MBZ);
338 }
339 
340 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31
spmd_dynamic_map_mem(uintptr_t base_addr,size_t size,unsigned int attr,uintptr_t * align_addr,size_t * align_size)341 static int spmd_dynamic_map_mem(uintptr_t base_addr, size_t size,
342 				 unsigned int attr, uintptr_t *align_addr,
343 				 size_t *align_size)
344 {
345 	uintptr_t base_addr_align;
346 	size_t mapped_size_align;
347 	int rc;
348 
349 	/* Page aligned address and size if necessary */
350 	base_addr_align = page_align(base_addr, DOWN);
351 	mapped_size_align = page_align(size, UP);
352 
353 	if ((base_addr != base_addr_align) &&
354 	    (size == mapped_size_align)) {
355 		mapped_size_align += PAGE_SIZE;
356 	}
357 
358 	/*
359 	 * Map dynamically given region with its aligned base address and
360 	 * size
361 	 */
362 	rc = mmap_add_dynamic_region((unsigned long long)base_addr_align,
363 				     base_addr_align,
364 				     mapped_size_align,
365 				     attr);
366 	if (rc == 0) {
367 		*align_addr = base_addr_align;
368 		*align_size = mapped_size_align;
369 	}
370 
371 	return rc;
372 }
373 
spmd_do_sec_cpy(uintptr_t root_base_addr,uintptr_t sec_base_addr,size_t size)374 static void spmd_do_sec_cpy(uintptr_t root_base_addr, uintptr_t sec_base_addr,
375 			    size_t size)
376 {
377 	uintptr_t root_base_addr_align, sec_base_addr_align;
378 	size_t root_mapped_size_align, sec_mapped_size_align;
379 	int rc;
380 
381 	assert(root_base_addr != 0UL);
382 	assert(sec_base_addr != 0UL);
383 	assert(size != 0UL);
384 
385 	/* Map the memory with required attributes */
386 	rc = spmd_dynamic_map_mem(root_base_addr, size, MT_RO_DATA | MT_ROOT,
387 				  &root_base_addr_align,
388 				  &root_mapped_size_align);
389 	if (rc != 0) {
390 		ERROR("%s %s %lu (%d)\n", "Error while mapping", "root region",
391 		      root_base_addr, rc);
392 		panic();
393 	}
394 
395 	rc = spmd_dynamic_map_mem(sec_base_addr, size, MT_RW_DATA | MT_SECURE,
396 				  &sec_base_addr_align, &sec_mapped_size_align);
397 	if (rc != 0) {
398 		ERROR("%s %s %lu (%d)\n", "Error while mapping",
399 		      "secure region", sec_base_addr, rc);
400 		panic();
401 	}
402 
403 	/* Do copy operation */
404 	(void)memcpy((void *)sec_base_addr, (void *)root_base_addr, size);
405 
406 	/* Unmap root memory region */
407 	rc = mmap_remove_dynamic_region(root_base_addr_align,
408 					root_mapped_size_align);
409 	if (rc != 0) {
410 		ERROR("%s %s %lu (%d)\n", "Error while unmapping",
411 		      "root region", root_base_addr_align, rc);
412 		panic();
413 	}
414 
415 	/* Unmap secure memory region */
416 	rc = mmap_remove_dynamic_region(sec_base_addr_align,
417 					sec_mapped_size_align);
418 	if (rc != 0) {
419 		ERROR("%s %s %lu (%d)\n", "Error while unmapping",
420 		      "secure region", sec_base_addr_align, rc);
421 		panic();
422 	}
423 }
424 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */
425 
426 /*******************************************************************************
427  * Loads SPMC manifest and inits SPMC.
428  ******************************************************************************/
spmd_spmc_init(void * pm_addr)429 static int spmd_spmc_init(void *pm_addr)
430 {
431 	cpu_context_t *cpu_ctx;
432 	unsigned int core_id;
433 	uint32_t ep_attr, flags;
434 	int rc;
435 	const struct dyn_cfg_dtb_info_t *image_info __unused;
436 
437 	/* Load the SPM Core manifest */
438 	rc = plat_spm_core_manifest_load(&spmc_attrs, pm_addr);
439 	if (rc != 0) {
440 		WARN("No or invalid SPM Core manifest image provided by BL2\n");
441 		return rc;
442 	}
443 
444 	/*
445 	 * Ensure that the SPM Core version is compatible with the SPM
446 	 * Dispatcher version.
447 	 */
448 	if ((spmc_attrs.major_version != FFA_VERSION_MAJOR) ||
449 	    (spmc_attrs.minor_version > FFA_VERSION_MINOR)) {
450 		WARN("Unsupported FFA version (%u.%u)\n",
451 		     spmc_attrs.major_version, spmc_attrs.minor_version);
452 		return -EINVAL;
453 	}
454 
455 	VERBOSE("FFA version (%u.%u)\n", spmc_attrs.major_version,
456 	     spmc_attrs.minor_version);
457 
458 	VERBOSE("SPM Core run time EL%x.\n",
459 	     SPMD_SPM_AT_SEL2 ? MODE_EL2 : MODE_EL1);
460 
461 	/* Validate the SPMC ID, Ensure high bit is set */
462 	if (((spmc_attrs.spmc_id >> SPMC_SECURE_ID_SHIFT) &
463 			SPMC_SECURE_ID_MASK) == 0U) {
464 		WARN("Invalid ID (0x%x) for SPMC.\n", spmc_attrs.spmc_id);
465 		return -EINVAL;
466 	}
467 
468 	/* Validate the SPM Core execution state */
469 	if ((spmc_attrs.exec_state != MODE_RW_64) &&
470 	    (spmc_attrs.exec_state != MODE_RW_32)) {
471 		WARN("Unsupported %s%x.\n", "SPM Core execution state 0x",
472 		     spmc_attrs.exec_state);
473 		return -EINVAL;
474 	}
475 
476 	VERBOSE("%s%x.\n", "SPM Core execution state 0x",
477 		spmc_attrs.exec_state);
478 
479 #if SPMD_SPM_AT_SEL2
480 	/* Ensure manifest has not requested AArch32 state in S-EL2 */
481 	if (spmc_attrs.exec_state == MODE_RW_32) {
482 		WARN("AArch32 state at S-EL2 is not supported.\n");
483 		return -EINVAL;
484 	}
485 
486 	/*
487 	 * Check if S-EL2 is supported on this system if S-EL2
488 	 * is required for SPM
489 	 */
490 	if (!is_feat_sel2_supported()) {
491 		WARN("SPM Core run time S-EL2 is not supported.\n");
492 		return -EINVAL;
493 	}
494 #endif /* SPMD_SPM_AT_SEL2 */
495 
496 	/* Initialise an entrypoint to set up the CPU context */
497 	ep_attr = SECURE | EP_ST_ENABLE;
498 	if ((read_sctlr_el3() & SCTLR_EE_BIT) != 0ULL) {
499 		ep_attr |= EP_EE_BIG;
500 	}
501 
502 	SET_PARAM_HEAD(spmc_ep_info, PARAM_EP, VERSION_1, ep_attr);
503 
504 	/*
505 	 * Populate SPSR for SPM Core based upon validated parameters from the
506 	 * manifest.
507 	 */
508 	if (spmc_attrs.exec_state == MODE_RW_32) {
509 		spmc_ep_info->spsr = SPSR_MODE32(MODE32_svc, SPSR_T_ARM,
510 						 SPSR_E_LITTLE,
511 						 DAIF_FIQ_BIT |
512 						 DAIF_IRQ_BIT |
513 						 DAIF_ABT_BIT);
514 	} else {
515 
516 #if SPMD_SPM_AT_SEL2
517 		static const uint32_t runtime_el = MODE_EL2;
518 #else
519 		static const uint32_t runtime_el = MODE_EL1;
520 #endif
521 		spmc_ep_info->spsr = SPSR_64(runtime_el,
522 					     MODE_SP_ELX,
523 					     DISABLE_ALL_EXCEPTIONS);
524 	}
525 
526 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31
527 	image_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TOS_FW_CONFIG_ID);
528 	assert(image_info != NULL);
529 
530 	if ((image_info->config_addr == 0UL) ||
531 	    (image_info->secondary_config_addr == 0UL) ||
532 	    (image_info->config_max_size == 0UL)) {
533 		return -EINVAL;
534 	}
535 
536 	/* Copy manifest from root->secure region */
537 	spmd_do_sec_cpy(image_info->config_addr,
538 			image_info->secondary_config_addr,
539 			image_info->config_max_size);
540 
541 	/* Update ep info of BL32 */
542 	assert(spmc_ep_info != NULL);
543 	spmc_ep_info->args.arg0 = image_info->secondary_config_addr;
544 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */
545 
546 	/* Set an initial SPMC context state for all cores. */
547 	for (core_id = 0U; core_id < PLATFORM_CORE_COUNT; core_id++) {
548 		spm_core_context[core_id].state = SPMC_STATE_OFF;
549 
550 		/* Setup an initial cpu context for the SPMC. */
551 		cpu_ctx = &spm_core_context[core_id].cpu_ctx;
552 		cm_setup_context(cpu_ctx, spmc_ep_info);
553 
554 		/*
555 		 * Pass the core linear ID to the SPMC through x4.
556 		 * (TF-A implementation defined behavior helping
557 		 * a legacy TOS migration to adopt FF-A).
558 		 */
559 		write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X4, core_id);
560 	}
561 
562 	/* Register power management hooks with PSCI */
563 	psci_register_spd_pm_hook(&spmd_pm);
564 
565 	/* Register init function for deferred init. */
566 	bl31_register_bl32_init(&spmd_init);
567 
568 	INFO("SPM Core setup done.\n");
569 
570 	/*
571 	 * Register an interrupt handler routing secure interrupts to SPMD
572 	 * while the NWd is running.
573 	 */
574 	flags = 0;
575 	set_interrupt_rm_flag(flags, NON_SECURE);
576 	rc = register_interrupt_type_handler(INTR_TYPE_S_EL1,
577 					     spmd_secure_interrupt_handler,
578 					     flags);
579 	if (rc != 0) {
580 		panic();
581 	}
582 
583 	/*
584 	 * Permit configurations where the SPM resides at S-EL1/2 and upon a
585 	 * Group0 interrupt triggering while the normal world runs, the
586 	 * interrupt is routed either through the EHF or directly to the SPMD:
587 	 *
588 	 * EL3_EXCEPTION_HANDLING=0: the Group0 interrupt is routed to the SPMD
589 	 *                   for handling by spmd_group0_interrupt_handler_nwd.
590 	 *
591 	 * EL3_EXCEPTION_HANDLING=1: the Group0 interrupt is routed to the EHF.
592 	 *
593 	 */
594 #if (EL3_EXCEPTION_HANDLING == 0)
595 	/*
596 	 * Register an interrupt handler routing Group0 interrupts to SPMD
597 	 * while the NWd is running.
598 	 */
599 	rc = register_interrupt_type_handler(INTR_TYPE_EL3,
600 					     spmd_group0_interrupt_handler_nwd,
601 					     flags);
602 	if (rc != 0) {
603 		panic();
604 	}
605 #endif
606 
607 	return 0;
608 }
609 
610 /*******************************************************************************
611  * Initialize context of SPM Core.
612  ******************************************************************************/
spmd_setup(void)613 int spmd_setup(void)
614 {
615 	int rc;
616 	void *spmc_manifest;
617 
618 	/*
619 	 * If the SPMC is at EL3, then just initialise it directly. The
620 	 * shenanigans of when it is at a lower EL are not needed.
621 	 */
622 	if (is_spmc_at_el3()) {
623 		/* Allow the SPMC to populate its attributes directly. */
624 		spmc_populate_attrs(&spmc_attrs);
625 
626 		rc = spmc_setup();
627 		if (rc != 0) {
628 			WARN("SPMC initialisation failed 0x%x.\n", rc);
629 		}
630 		return 0;
631 	}
632 
633 	spmc_ep_info = bl31_plat_get_next_image_ep_info(SECURE);
634 	if (spmc_ep_info == NULL) {
635 		WARN("No SPM Core image provided by BL2 boot loader.\n");
636 		return 0;
637 	}
638 
639 	/* Under no circumstances will this parameter be 0 */
640 	assert(spmc_ep_info->pc != 0ULL);
641 
642 	/*
643 	 * Check if BL32 ep_info has a reference to 'tos_fw_config'. This will
644 	 * be used as a manifest for the SPM Core at the next lower EL/mode.
645 	 */
646 	spmc_manifest = (void *)spmc_ep_info->args.arg0;
647 	if (spmc_manifest == NULL) {
648 		WARN("Invalid or absent SPM Core manifest.\n");
649 		return 0;
650 	}
651 
652 	/* Load manifest, init SPMC */
653 	rc = spmd_spmc_init(spmc_manifest);
654 	if (rc != 0) {
655 		WARN("Booting device without SPM initialization.\n");
656 	}
657 
658 	return 0;
659 }
660 
661 /*******************************************************************************
662  * Forward FF-A SMCs to the other security state.
663  ******************************************************************************/
spmd_smc_switch_state(uint32_t smc_fid,bool secure_origin,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * handle)664 uint64_t spmd_smc_switch_state(uint32_t smc_fid,
665 			       bool secure_origin,
666 			       uint64_t x1,
667 			       uint64_t x2,
668 			       uint64_t x3,
669 			       uint64_t x4,
670 			       void *handle)
671 {
672 	unsigned int secure_state_in = (secure_origin) ? SECURE : NON_SECURE;
673 	unsigned int secure_state_out = (!secure_origin) ? SECURE : NON_SECURE;
674 
675 	/* Save incoming security state */
676 #if SPMD_SPM_AT_SEL2
677 	if (secure_state_in == NON_SECURE) {
678 		cm_el1_sysregs_context_save(secure_state_in);
679 	}
680 	cm_el2_sysregs_context_save(secure_state_in);
681 #else
682 	cm_el1_sysregs_context_save(secure_state_in);
683 #endif
684 
685 	/* Restore outgoing security state */
686 #if SPMD_SPM_AT_SEL2
687 	if (secure_state_out == NON_SECURE) {
688 		cm_el1_sysregs_context_restore(secure_state_out);
689 	}
690 	cm_el2_sysregs_context_restore(secure_state_out);
691 #else
692 	cm_el1_sysregs_context_restore(secure_state_out);
693 #endif
694 	cm_set_next_eret_context(secure_state_out);
695 
696 #if SPMD_SPM_AT_SEL2
697 	/*
698 	 * If SPMC is at SEL2, save additional registers x8-x17, which may
699 	 * be used in FF-A calls such as FFA_PARTITION_INFO_GET_REGS.
700 	 * Note that technically, all SPMCs can support this, but this code is
701 	 * under ifdef to minimize breakage in case other SPMCs do not save
702 	 * and restore x8-x17.
703 	 * We also need to pass through these registers since not all FF-A ABIs
704 	 * modify x8-x17, in which case, SMCCC requires that these registers be
705 	 * preserved, so the SPMD passes through these registers and expects the
706 	 * SPMC to save and restore (potentially also modify) them.
707 	 */
708 	SMC_RET18(cm_get_context(secure_state_out), smc_fid, x1, x2, x3, x4,
709 			SMC_GET_GP(handle, CTX_GPREG_X5),
710 			SMC_GET_GP(handle, CTX_GPREG_X6),
711 			SMC_GET_GP(handle, CTX_GPREG_X7),
712 			SMC_GET_GP(handle, CTX_GPREG_X8),
713 			SMC_GET_GP(handle, CTX_GPREG_X9),
714 			SMC_GET_GP(handle, CTX_GPREG_X10),
715 			SMC_GET_GP(handle, CTX_GPREG_X11),
716 			SMC_GET_GP(handle, CTX_GPREG_X12),
717 			SMC_GET_GP(handle, CTX_GPREG_X13),
718 			SMC_GET_GP(handle, CTX_GPREG_X14),
719 			SMC_GET_GP(handle, CTX_GPREG_X15),
720 			SMC_GET_GP(handle, CTX_GPREG_X16),
721 			SMC_GET_GP(handle, CTX_GPREG_X17)
722 			);
723 
724 #else
725 	SMC_RET8(cm_get_context(secure_state_out), smc_fid, x1, x2, x3, x4,
726 			SMC_GET_GP(handle, CTX_GPREG_X5),
727 			SMC_GET_GP(handle, CTX_GPREG_X6),
728 			SMC_GET_GP(handle, CTX_GPREG_X7));
729 #endif
730 }
731 
732 /*******************************************************************************
733  * Forward SMCs to the other security state.
734  ******************************************************************************/
spmd_smc_forward(uint32_t smc_fid,bool secure_origin,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)735 static uint64_t spmd_smc_forward(uint32_t smc_fid,
736 				 bool secure_origin,
737 				 uint64_t x1,
738 				 uint64_t x2,
739 				 uint64_t x3,
740 				 uint64_t x4,
741 				 void *cookie,
742 				 void *handle,
743 				 uint64_t flags)
744 {
745 	if (is_spmc_at_el3() && !secure_origin) {
746 		return spmc_smc_handler(smc_fid, secure_origin, x1, x2, x3, x4,
747 					cookie, handle, flags);
748 	}
749 	return spmd_smc_switch_state(smc_fid, secure_origin, x1, x2, x3, x4,
750 				     handle);
751 
752 }
753 
754 /*******************************************************************************
755  * Return FFA_ERROR with specified error code
756  ******************************************************************************/
spmd_ffa_error_return(void * handle,int error_code)757 uint64_t spmd_ffa_error_return(void *handle, int error_code)
758 {
759 	SMC_RET8(handle, (uint32_t) FFA_ERROR,
760 		 FFA_TARGET_INFO_MBZ, (uint32_t)error_code,
761 		 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
762 		 FFA_PARAM_MBZ, FFA_PARAM_MBZ);
763 }
764 
765 /*******************************************************************************
766  * spmd_check_address_in_binary_image
767  ******************************************************************************/
spmd_check_address_in_binary_image(uint64_t address)768 bool spmd_check_address_in_binary_image(uint64_t address)
769 {
770 	assert(!check_uptr_overflow(spmc_attrs.load_address, spmc_attrs.binary_size));
771 
772 	return ((address >= spmc_attrs.load_address) &&
773 		(address < (spmc_attrs.load_address + spmc_attrs.binary_size)));
774 }
775 
776 /******************************************************************************
777  * spmd_is_spmc_message
778  *****************************************************************************/
spmd_is_spmc_message(unsigned int ep)779 static bool spmd_is_spmc_message(unsigned int ep)
780 {
781 	if (is_spmc_at_el3()) {
782 		return false;
783 	}
784 
785 	return ((ffa_endpoint_destination(ep) == SPMD_DIRECT_MSG_ENDPOINT_ID)
786 		&& (ffa_endpoint_source(ep) == spmc_attrs.spmc_id));
787 }
788 
789 /******************************************************************************
790  * spmd_handle_spmc_message
791  *****************************************************************************/
spmd_handle_spmc_message(unsigned long long msg,unsigned long long parm1,unsigned long long parm2,unsigned long long parm3,unsigned long long parm4)792 static int spmd_handle_spmc_message(unsigned long long msg,
793 		unsigned long long parm1, unsigned long long parm2,
794 		unsigned long long parm3, unsigned long long parm4)
795 {
796 	VERBOSE("%s %llx %llx %llx %llx %llx\n", __func__,
797 		msg, parm1, parm2, parm3, parm4);
798 
799 	return -EINVAL;
800 }
801 
802 /*******************************************************************************
803  * This function forwards FF-A SMCs to either the main SPMD handler or the
804  * SPMC at EL3, depending on the origin security state, if enabled.
805  ******************************************************************************/
spmd_ffa_smc_handler(uint32_t smc_fid,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)806 uint64_t spmd_ffa_smc_handler(uint32_t smc_fid,
807 			      uint64_t x1,
808 			      uint64_t x2,
809 			      uint64_t x3,
810 			      uint64_t x4,
811 			      void *cookie,
812 			      void *handle,
813 			      uint64_t flags)
814 {
815 	if (is_spmc_at_el3()) {
816 		/*
817 		 * If we have an SPMC at EL3 allow handling of the SMC first.
818 		 * The SPMC will call back through to SPMD handler if required.
819 		 */
820 		if (is_caller_secure(flags)) {
821 			return spmc_smc_handler(smc_fid,
822 						is_caller_secure(flags),
823 						x1, x2, x3, x4, cookie,
824 						handle, flags);
825 		}
826 	}
827 	return spmd_smc_handler(smc_fid, x1, x2, x3, x4, cookie,
828 				handle, flags);
829 }
830 
831 /*******************************************************************************
832  * This function handles all SMCs in the range reserved for FFA. Each call is
833  * either forwarded to the other security state or handled by the SPM dispatcher
834  ******************************************************************************/
spmd_smc_handler(uint32_t smc_fid,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)835 uint64_t spmd_smc_handler(uint32_t smc_fid,
836 			  uint64_t x1,
837 			  uint64_t x2,
838 			  uint64_t x3,
839 			  uint64_t x4,
840 			  void *cookie,
841 			  void *handle,
842 			  uint64_t flags)
843 {
844 	unsigned int linear_id = plat_my_core_pos();
845 	spmd_spm_core_context_t *ctx = spmd_get_context();
846 	bool secure_origin;
847 	int32_t ret;
848 	uint32_t input_version;
849 
850 	/* Determine which security state this SMC originated from */
851 	secure_origin = is_caller_secure(flags);
852 
853 	VERBOSE("SPM(%u): 0x%x 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64
854 		" 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 "\n",
855 		    linear_id, smc_fid, x1, x2, x3, x4,
856 		    SMC_GET_GP(handle, CTX_GPREG_X5),
857 		    SMC_GET_GP(handle, CTX_GPREG_X6),
858 		    SMC_GET_GP(handle, CTX_GPREG_X7));
859 
860 	/*
861 	 * If there is an on-going info regs from EL3 SPMD LP, unconditionally
862 	 * return, we don't expect any other FF-A ABIs to be called between
863 	 * calls to FFA_PARTITION_INFO_GET_REGS.
864 	 */
865 	if (is_spmd_logical_sp_info_regs_req_in_progress(ctx)) {
866 		assert(secure_origin);
867 		spmd_spm_core_sync_exit(0ULL);
868 	}
869 
870 	switch (smc_fid) {
871 	case FFA_ERROR:
872 		/*
873 		 * Check if this is the first invocation of this interface on
874 		 * this CPU. If so, then indicate that the SPM Core initialised
875 		 * unsuccessfully.
876 		 */
877 		if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) {
878 			spmd_spm_core_sync_exit(x2);
879 		}
880 
881 		/*
882 		 * If there was an SPMD logical partition direct request on-going,
883 		 * return back to the SPMD logical partition so the error can be
884 		 * consumed.
885 		 */
886 		if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
887 			assert(secure_origin);
888 			spmd_spm_core_sync_exit(0ULL);
889 		}
890 
891 		return spmd_smc_forward(smc_fid, secure_origin,
892 					x1, x2, x3, x4, cookie,
893 					handle, flags);
894 		break; /* not reached */
895 
896 	case FFA_VERSION:
897 		input_version = (uint32_t)(0xFFFFFFFF & x1);
898 		/*
899 		 * If caller is secure and SPMC was initialized,
900 		 * return FFA_VERSION of SPMD.
901 		 * If caller is non secure and SPMC was initialized,
902 		 * forward to the EL3 SPMC if enabled, otherwise return
903 		 * the SPMC version if implemented at a lower EL.
904 		 * Sanity check to "input_version".
905 		 * If the EL3 SPMC is enabled, ignore the SPMC state as
906 		 * this is not used.
907 		 */
908 		if ((input_version & FFA_VERSION_BIT31_MASK) ||
909 		    (!is_spmc_at_el3() && (ctx->state == SPMC_STATE_RESET))) {
910 			ret = FFA_ERROR_NOT_SUPPORTED;
911 		} else if (!secure_origin) {
912 			if (is_spmc_at_el3()) {
913 				/*
914 				 * Forward the call directly to the EL3 SPMC, if
915 				 * enabled, as we don't need to wrap the call in
916 				 * a direct request.
917 				 */
918 				return spmd_smc_forward(smc_fid, secure_origin,
919 							x1, x2, x3, x4, cookie,
920 							handle, flags);
921 			}
922 
923 			gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx);
924 			uint64_t rc;
925 
926 			if (spmc_attrs.major_version == 1 &&
927 			    spmc_attrs.minor_version == 0) {
928 				ret = MAKE_FFA_VERSION(spmc_attrs.major_version,
929 						       spmc_attrs.minor_version);
930 				SMC_RET8(handle, (uint32_t)ret,
931 					 FFA_TARGET_INFO_MBZ,
932 					 FFA_TARGET_INFO_MBZ,
933 					 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
934 					 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
935 					 FFA_PARAM_MBZ);
936 				break;
937 			}
938 			/* Save non-secure system registers context */
939 			cm_el1_sysregs_context_save(NON_SECURE);
940 #if SPMD_SPM_AT_SEL2
941 			cm_el2_sysregs_context_save(NON_SECURE);
942 #endif
943 
944 			/*
945 			 * The incoming request has FFA_VERSION as X0 smc_fid
946 			 * and requested version in x1. Prepare a direct request
947 			 * from SPMD to SPMC with FFA_VERSION framework function
948 			 * identifier in X2 and requested version in X3.
949 			 */
950 			spmd_build_spmc_message(gpregs,
951 						SPMD_FWK_MSG_FFA_VERSION_REQ,
952 						input_version);
953 
954 			/*
955 			 * Ensure x8-x17 NS GP register values are untouched when returning
956 			 * from the SPMC.
957 			 */
958 			write_ctx_reg(gpregs, CTX_GPREG_X8, SMC_GET_GP(handle, CTX_GPREG_X8));
959 			write_ctx_reg(gpregs, CTX_GPREG_X9, SMC_GET_GP(handle, CTX_GPREG_X9));
960 			write_ctx_reg(gpregs, CTX_GPREG_X10, SMC_GET_GP(handle, CTX_GPREG_X10));
961 			write_ctx_reg(gpregs, CTX_GPREG_X11, SMC_GET_GP(handle, CTX_GPREG_X11));
962 			write_ctx_reg(gpregs, CTX_GPREG_X12, SMC_GET_GP(handle, CTX_GPREG_X12));
963 			write_ctx_reg(gpregs, CTX_GPREG_X13, SMC_GET_GP(handle, CTX_GPREG_X13));
964 			write_ctx_reg(gpregs, CTX_GPREG_X14, SMC_GET_GP(handle, CTX_GPREG_X14));
965 			write_ctx_reg(gpregs, CTX_GPREG_X15, SMC_GET_GP(handle, CTX_GPREG_X15));
966 			write_ctx_reg(gpregs, CTX_GPREG_X16, SMC_GET_GP(handle, CTX_GPREG_X16));
967 			write_ctx_reg(gpregs, CTX_GPREG_X17, SMC_GET_GP(handle, CTX_GPREG_X17));
968 
969 			rc = spmd_spm_core_sync_entry(ctx);
970 
971 			if ((rc != 0ULL) ||
972 			    (SMC_GET_GP(gpregs, CTX_GPREG_X0) !=
973 				FFA_MSG_SEND_DIRECT_RESP_SMC32) ||
974 			    (SMC_GET_GP(gpregs, CTX_GPREG_X2) !=
975 				(FFA_FWK_MSG_BIT |
976 				 SPMD_FWK_MSG_FFA_VERSION_RESP))) {
977 				ERROR("Failed to forward FFA_VERSION\n");
978 				ret = FFA_ERROR_NOT_SUPPORTED;
979 			} else {
980 				ret = SMC_GET_GP(gpregs, CTX_GPREG_X3);
981 			}
982 
983 			/*
984 			 * x0-x4 are updated by spmd_smc_forward below.
985 			 * Zero out x5-x7 in the FFA_VERSION response.
986 			 */
987 			write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
988 			write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
989 			write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
990 
991 			/*
992 			 * Return here after SPMC has handled FFA_VERSION.
993 			 * The returned SPMC version is held in X3.
994 			 * Forward this version in X0 to the non-secure caller.
995 			 */
996 			return spmd_smc_forward(ret, true, FFA_PARAM_MBZ,
997 						FFA_PARAM_MBZ, FFA_PARAM_MBZ,
998 						FFA_PARAM_MBZ, cookie, gpregs,
999 						flags);
1000 		} else {
1001 			ret = MAKE_FFA_VERSION(FFA_VERSION_MAJOR,
1002 					       FFA_VERSION_MINOR);
1003 		}
1004 
1005 		SMC_RET8(handle, (uint32_t)ret, FFA_TARGET_INFO_MBZ,
1006 			 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1007 			 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ);
1008 		break; /* not reached */
1009 
1010 	case FFA_FEATURES:
1011 		/*
1012 		 * This is an optional interface. Do the minimal checks and
1013 		 * forward to SPM Core which will handle it if implemented.
1014 		 */
1015 
1016 		/* Forward SMC from Normal world to the SPM Core */
1017 		if (!secure_origin) {
1018 			return spmd_smc_forward(smc_fid, secure_origin,
1019 						x1, x2, x3, x4, cookie,
1020 						handle, flags);
1021 		}
1022 
1023 		/*
1024 		 * Return success if call was from secure world i.e. all
1025 		 * FFA functions are supported. This is essentially a
1026 		 * nop.
1027 		 */
1028 		SMC_RET8(handle, FFA_SUCCESS_SMC32, x1, x2, x3, x4,
1029 			 SMC_GET_GP(handle, CTX_GPREG_X5),
1030 			 SMC_GET_GP(handle, CTX_GPREG_X6),
1031 			 SMC_GET_GP(handle, CTX_GPREG_X7));
1032 
1033 		break; /* not reached */
1034 
1035 	case FFA_ID_GET:
1036 		/*
1037 		 * Returns the ID of the calling FFA component.
1038 		 */
1039 		if (!secure_origin) {
1040 			SMC_RET8(handle, FFA_SUCCESS_SMC32,
1041 				 FFA_TARGET_INFO_MBZ, FFA_NS_ENDPOINT_ID,
1042 				 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1043 				 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1044 				 FFA_PARAM_MBZ);
1045 		}
1046 
1047 		SMC_RET8(handle, FFA_SUCCESS_SMC32,
1048 			 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id,
1049 			 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1050 			 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1051 			 FFA_PARAM_MBZ);
1052 
1053 		break; /* not reached */
1054 
1055 	case FFA_SECONDARY_EP_REGISTER_SMC64:
1056 		if (secure_origin) {
1057 			ret = spmd_pm_secondary_ep_register(x1);
1058 
1059 			if (ret < 0) {
1060 				SMC_RET8(handle, FFA_ERROR_SMC64,
1061 					FFA_TARGET_INFO_MBZ, ret,
1062 					FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1063 					FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1064 					FFA_PARAM_MBZ);
1065 			} else {
1066 				SMC_RET8(handle, FFA_SUCCESS_SMC64,
1067 					FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ,
1068 					FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1069 					FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1070 					FFA_PARAM_MBZ);
1071 			}
1072 		}
1073 
1074 		return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1075 		break; /* Not reached */
1076 
1077 	case FFA_SPM_ID_GET:
1078 		if (MAKE_FFA_VERSION(1, 1) > FFA_VERSION_COMPILED) {
1079 			return spmd_ffa_error_return(handle,
1080 						     FFA_ERROR_NOT_SUPPORTED);
1081 		}
1082 		/*
1083 		 * Returns the ID of the SPMC or SPMD depending on the FF-A
1084 		 * instance where this function is invoked
1085 		 */
1086 		if (!secure_origin) {
1087 			SMC_RET8(handle, FFA_SUCCESS_SMC32,
1088 				 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id,
1089 				 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1090 				 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1091 				 FFA_PARAM_MBZ);
1092 		}
1093 		SMC_RET8(handle, FFA_SUCCESS_SMC32,
1094 			 FFA_TARGET_INFO_MBZ, SPMD_DIRECT_MSG_ENDPOINT_ID,
1095 			 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1096 			 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1097 			 FFA_PARAM_MBZ);
1098 
1099 		break; /* not reached */
1100 
1101 	case FFA_MSG_SEND_DIRECT_REQ_SMC32:
1102 	case FFA_MSG_SEND_DIRECT_REQ_SMC64:
1103 		/*
1104 		 * Regardless of secure_origin, SPMD logical partitions cannot
1105 		 * handle direct messages. They can only initiate direct
1106 		 * messages and consume direct responses or errors.
1107 		 */
1108 		if (is_spmd_lp_id(ffa_endpoint_source(x1)) ||
1109 				  is_spmd_lp_id(ffa_endpoint_destination(x1))) {
1110 			return spmd_ffa_error_return(handle,
1111 						     FFA_ERROR_INVALID_PARAMETER
1112 						     );
1113 		}
1114 
1115 		/*
1116 		 * When there is an ongoing SPMD logical partition direct
1117 		 * request, there cannot be another direct request. Return
1118 		 * error in this case. Panic'ing is an option but that does
1119 		 * not provide the opportunity for caller to abort based on
1120 		 * error codes.
1121 		 */
1122 		if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1123 			assert(secure_origin);
1124 			return spmd_ffa_error_return(handle,
1125 						     FFA_ERROR_DENIED);
1126 		}
1127 
1128 		if (!secure_origin) {
1129 			/* Validate source endpoint is non-secure for non-secure caller. */
1130 			if (ffa_is_secure_world_id(ffa_endpoint_source(x1))) {
1131 				return spmd_ffa_error_return(handle,
1132 						FFA_ERROR_INVALID_PARAMETER);
1133 			}
1134 		}
1135 		if (secure_origin && spmd_is_spmc_message(x1)) {
1136 			ret = spmd_handle_spmc_message(x3, x4,
1137 				SMC_GET_GP(handle, CTX_GPREG_X5),
1138 				SMC_GET_GP(handle, CTX_GPREG_X6),
1139 				SMC_GET_GP(handle, CTX_GPREG_X7));
1140 
1141 			SMC_RET8(handle, FFA_SUCCESS_SMC32,
1142 				FFA_TARGET_INFO_MBZ, ret,
1143 				FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1144 				FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1145 				FFA_PARAM_MBZ);
1146 		} else {
1147 			/* Forward direct message to the other world */
1148 			return spmd_smc_forward(smc_fid, secure_origin,
1149 						x1, x2, x3, x4, cookie,
1150 						handle, flags);
1151 		}
1152 		break; /* Not reached */
1153 
1154 	case FFA_MSG_SEND_DIRECT_RESP_SMC32:
1155 	case FFA_MSG_SEND_DIRECT_RESP_SMC64:
1156 		if (secure_origin && (spmd_is_spmc_message(x1) ||
1157 		    is_spmd_logical_sp_dir_req_in_progress(ctx))) {
1158 			spmd_spm_core_sync_exit(0ULL);
1159 		} else {
1160 			/* Forward direct message to the other world */
1161 			return spmd_smc_forward(smc_fid, secure_origin,
1162 						x1, x2, x3, x4, cookie,
1163 						handle, flags);
1164 		}
1165 		break; /* Not reached */
1166 
1167 	case FFA_RX_RELEASE:
1168 	case FFA_RXTX_MAP_SMC32:
1169 	case FFA_RXTX_MAP_SMC64:
1170 	case FFA_RXTX_UNMAP:
1171 	case FFA_PARTITION_INFO_GET:
1172 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED
1173 	case FFA_NOTIFICATION_BITMAP_CREATE:
1174 	case FFA_NOTIFICATION_BITMAP_DESTROY:
1175 	case FFA_NOTIFICATION_BIND:
1176 	case FFA_NOTIFICATION_UNBIND:
1177 	case FFA_NOTIFICATION_SET:
1178 	case FFA_NOTIFICATION_GET:
1179 	case FFA_NOTIFICATION_INFO_GET:
1180 	case FFA_NOTIFICATION_INFO_GET_SMC64:
1181 	case FFA_MSG_SEND2:
1182 	case FFA_RX_ACQUIRE:
1183 #endif
1184 	case FFA_MSG_RUN:
1185 		/*
1186 		 * Above calls should be invoked only by the Normal world and
1187 		 * must not be forwarded from Secure world to Normal world.
1188 		 */
1189 		if (secure_origin) {
1190 			return spmd_ffa_error_return(handle,
1191 						     FFA_ERROR_NOT_SUPPORTED);
1192 		}
1193 
1194 		/* Forward the call to the other world */
1195 		/* fallthrough */
1196 	case FFA_MSG_SEND:
1197 	case FFA_MEM_DONATE_SMC32:
1198 	case FFA_MEM_DONATE_SMC64:
1199 	case FFA_MEM_LEND_SMC32:
1200 	case FFA_MEM_LEND_SMC64:
1201 	case FFA_MEM_SHARE_SMC32:
1202 	case FFA_MEM_SHARE_SMC64:
1203 	case FFA_MEM_RETRIEVE_REQ_SMC32:
1204 	case FFA_MEM_RETRIEVE_REQ_SMC64:
1205 	case FFA_MEM_RETRIEVE_RESP:
1206 	case FFA_MEM_RELINQUISH:
1207 	case FFA_MEM_RECLAIM:
1208 	case FFA_MEM_FRAG_TX:
1209 	case FFA_MEM_FRAG_RX:
1210 	case FFA_SUCCESS_SMC32:
1211 	case FFA_SUCCESS_SMC64:
1212 		/*
1213 		 * If there is an ongoing direct request from an SPMD logical
1214 		 * partition, return an error.
1215 		 */
1216 		if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1217 			assert(secure_origin);
1218 			return spmd_ffa_error_return(handle,
1219 					FFA_ERROR_DENIED);
1220 		}
1221 
1222 		return spmd_smc_forward(smc_fid, secure_origin,
1223 					x1, x2, x3, x4, cookie,
1224 					handle, flags);
1225 		break; /* not reached */
1226 
1227 	case FFA_MSG_WAIT:
1228 		/*
1229 		 * Check if this is the first invocation of this interface on
1230 		 * this CPU from the Secure world. If so, then indicate that the
1231 		 * SPM Core initialised successfully.
1232 		 */
1233 		if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) {
1234 			spmd_spm_core_sync_exit(0ULL);
1235 		}
1236 
1237 		/* Forward the call to the other world */
1238 		/* fallthrough */
1239 	case FFA_INTERRUPT:
1240 	case FFA_MSG_YIELD:
1241 		/* This interface must be invoked only by the Secure world */
1242 		if (!secure_origin) {
1243 			return spmd_ffa_error_return(handle,
1244 						      FFA_ERROR_NOT_SUPPORTED);
1245 		}
1246 
1247 		if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1248 			assert(secure_origin);
1249 			return spmd_ffa_error_return(handle,
1250 					FFA_ERROR_DENIED);
1251 		}
1252 
1253 		return spmd_smc_forward(smc_fid, secure_origin,
1254 					x1, x2, x3, x4, cookie,
1255 					handle, flags);
1256 		break; /* not reached */
1257 
1258 	case FFA_NORMAL_WORLD_RESUME:
1259 		if (secure_origin && ctx->secure_interrupt_ongoing) {
1260 			spmd_spm_core_sync_exit(0ULL);
1261 		} else {
1262 			return spmd_ffa_error_return(handle, FFA_ERROR_DENIED);
1263 		}
1264 		break; /* Not reached */
1265 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED
1266 	case FFA_PARTITION_INFO_GET_REGS_SMC64:
1267 		if (secure_origin) {
1268 			return spmd_el3_populate_logical_partition_info(handle, x1,
1269 								   x2, x3);
1270 		}
1271 
1272 		/* Call only supported with SMCCC 1.2+ */
1273 		if (MAKE_SMCCC_VERSION(SMCCC_MAJOR_VERSION, SMCCC_MINOR_VERSION) < 0x10002) {
1274 			return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1275 		}
1276 
1277 		return spmd_smc_forward(smc_fid, secure_origin,
1278 					x1, x2, x3, x4, cookie,
1279 					handle, flags);
1280 		break; /* Not reached */
1281 #endif
1282 	case FFA_EL3_INTR_HANDLE:
1283 		if (secure_origin) {
1284 			return spmd_handle_group0_intr_swd(handle);
1285 		} else {
1286 			return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1287 		}
1288 	default:
1289 		WARN("SPM: Unsupported call 0x%08x\n", smc_fid);
1290 		return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1291 	}
1292 }
1293