1 /*
2 * Copyright (c) 2020-2023, Arm Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <errno.h>
9 #include <inttypes.h>
10 #include <stdint.h>
11 #include <string.h>
12
13 #include <arch_helpers.h>
14 #include <arch/aarch64/arch_features.h>
15 #include <bl31/bl31.h>
16 #include <bl31/interrupt_mgmt.h>
17 #include <common/debug.h>
18 #include <common/runtime_svc.h>
19 #include <common/tbbr/tbbr_img_def.h>
20 #include <lib/el3_runtime/context_mgmt.h>
21 #include <lib/fconf/fconf.h>
22 #include <lib/fconf/fconf_dyn_cfg_getter.h>
23 #include <lib/smccc.h>
24 #include <lib/spinlock.h>
25 #include <lib/utils.h>
26 #include <lib/xlat_tables/xlat_tables_v2.h>
27 #include <plat/common/common_def.h>
28 #include <plat/common/platform.h>
29 #include <platform_def.h>
30 #include <services/el3_spmd_logical_sp.h>
31 #include <services/ffa_svc.h>
32 #include <services/spmc_svc.h>
33 #include <services/spmd_svc.h>
34 #include <smccc_helpers.h>
35 #include "spmd_private.h"
36
37 /*******************************************************************************
38 * SPM Core context information.
39 ******************************************************************************/
40 static spmd_spm_core_context_t spm_core_context[PLATFORM_CORE_COUNT];
41
42 /*******************************************************************************
43 * SPM Core attribute information is read from its manifest if the SPMC is not
44 * at EL3. Else, it is populated from the SPMC directly.
45 ******************************************************************************/
46 static spmc_manifest_attribute_t spmc_attrs;
47
48 /*******************************************************************************
49 * SPM Core entry point information. Discovered on the primary core and reused
50 * on secondary cores.
51 ******************************************************************************/
52 static entry_point_info_t *spmc_ep_info;
53
54 /*******************************************************************************
55 * SPM Core context on CPU based on mpidr.
56 ******************************************************************************/
spmd_get_context_by_mpidr(uint64_t mpidr)57 spmd_spm_core_context_t *spmd_get_context_by_mpidr(uint64_t mpidr)
58 {
59 int core_idx = plat_core_pos_by_mpidr(mpidr);
60
61 if (core_idx < 0) {
62 ERROR("Invalid mpidr: %" PRIx64 ", returned ID: %d\n", mpidr, core_idx);
63 panic();
64 }
65
66 return &spm_core_context[core_idx];
67 }
68
69 /*******************************************************************************
70 * SPM Core context on current CPU get helper.
71 ******************************************************************************/
spmd_get_context(void)72 spmd_spm_core_context_t *spmd_get_context(void)
73 {
74 return spmd_get_context_by_mpidr(read_mpidr());
75 }
76
77 /*******************************************************************************
78 * SPM Core ID getter.
79 ******************************************************************************/
spmd_spmc_id_get(void)80 uint16_t spmd_spmc_id_get(void)
81 {
82 return spmc_attrs.spmc_id;
83 }
84
85 /*******************************************************************************
86 * Static function declaration.
87 ******************************************************************************/
88 static int32_t spmd_init(void);
89 static int spmd_spmc_init(void *pm_addr);
90
91 static uint64_t spmd_smc_forward(uint32_t smc_fid,
92 bool secure_origin,
93 uint64_t x1,
94 uint64_t x2,
95 uint64_t x3,
96 uint64_t x4,
97 void *cookie,
98 void *handle,
99 uint64_t flags);
100
101 /******************************************************************************
102 * Builds an SPMD to SPMC direct message request.
103 *****************************************************************************/
spmd_build_spmc_message(gp_regs_t * gpregs,uint8_t target_func,unsigned long long message)104 void spmd_build_spmc_message(gp_regs_t *gpregs, uint8_t target_func,
105 unsigned long long message)
106 {
107 write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_MSG_SEND_DIRECT_REQ_SMC32);
108 write_ctx_reg(gpregs, CTX_GPREG_X1,
109 (SPMD_DIRECT_MSG_ENDPOINT_ID << FFA_DIRECT_MSG_SOURCE_SHIFT) |
110 spmd_spmc_id_get());
111 write_ctx_reg(gpregs, CTX_GPREG_X2, BIT(31) | target_func);
112 write_ctx_reg(gpregs, CTX_GPREG_X3, message);
113
114 /* Zero out x4-x7 for the direct request emitted towards the SPMC. */
115 write_ctx_reg(gpregs, CTX_GPREG_X4, 0);
116 write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
117 write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
118 write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
119 }
120
121
122 /*******************************************************************************
123 * This function takes an SPMC context pointer and performs a synchronous
124 * SPMC entry.
125 ******************************************************************************/
spmd_spm_core_sync_entry(spmd_spm_core_context_t * spmc_ctx)126 uint64_t spmd_spm_core_sync_entry(spmd_spm_core_context_t *spmc_ctx)
127 {
128 uint64_t rc;
129
130 assert(spmc_ctx != NULL);
131
132 cm_set_context(&(spmc_ctx->cpu_ctx), SECURE);
133
134 /* Restore the context assigned above */
135 #if SPMD_SPM_AT_SEL2
136 cm_el2_sysregs_context_restore(SECURE);
137 #else
138 cm_el1_sysregs_context_restore(SECURE);
139 #endif
140 cm_set_next_eret_context(SECURE);
141
142 /* Enter SPMC */
143 rc = spmd_spm_core_enter(&spmc_ctx->c_rt_ctx);
144
145 /* Save secure state */
146 #if SPMD_SPM_AT_SEL2
147 cm_el2_sysregs_context_save(SECURE);
148 #else
149 cm_el1_sysregs_context_save(SECURE);
150 #endif
151
152 return rc;
153 }
154
155 /*******************************************************************************
156 * This function returns to the place where spmd_spm_core_sync_entry() was
157 * called originally.
158 ******************************************************************************/
spmd_spm_core_sync_exit(uint64_t rc)159 __dead2 void spmd_spm_core_sync_exit(uint64_t rc)
160 {
161 spmd_spm_core_context_t *ctx = spmd_get_context();
162
163 /* Get current CPU context from SPMC context */
164 assert(cm_get_context(SECURE) == &(ctx->cpu_ctx));
165
166 /*
167 * The SPMD must have initiated the original request through a
168 * synchronous entry into SPMC. Jump back to the original C runtime
169 * context with the value of rc in x0;
170 */
171 spmd_spm_core_exit(ctx->c_rt_ctx, rc);
172
173 panic();
174 }
175
176 /*******************************************************************************
177 * Jump to the SPM Core for the first time.
178 ******************************************************************************/
spmd_init(void)179 static int32_t spmd_init(void)
180 {
181 spmd_spm_core_context_t *ctx = spmd_get_context();
182 uint64_t rc;
183
184 VERBOSE("SPM Core init start.\n");
185
186 /* Primary boot core enters the SPMC for initialization. */
187 ctx->state = SPMC_STATE_ON_PENDING;
188
189 rc = spmd_spm_core_sync_entry(ctx);
190 if (rc != 0ULL) {
191 ERROR("SPMC initialisation failed 0x%" PRIx64 "\n", rc);
192 return 0;
193 }
194
195 ctx->state = SPMC_STATE_ON;
196
197 VERBOSE("SPM Core init end.\n");
198
199 spmd_logical_sp_set_spmc_initialized();
200 rc = spmd_logical_sp_init();
201 if (rc != 0) {
202 WARN("SPMD Logical partitions failed init.\n");
203 }
204
205 return 1;
206 }
207
208 /*******************************************************************************
209 * spmd_secure_interrupt_handler
210 * Enter the SPMC for further handling of the secure interrupt by the SPMC
211 * itself or a Secure Partition.
212 ******************************************************************************/
spmd_secure_interrupt_handler(uint32_t id,uint32_t flags,void * handle,void * cookie)213 static uint64_t spmd_secure_interrupt_handler(uint32_t id,
214 uint32_t flags,
215 void *handle,
216 void *cookie)
217 {
218 spmd_spm_core_context_t *ctx = spmd_get_context();
219 gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx);
220 unsigned int linear_id = plat_my_core_pos();
221 int64_t rc;
222
223 /* Sanity check the security state when the exception was generated */
224 assert(get_interrupt_src_ss(flags) == NON_SECURE);
225
226 /* Sanity check the pointer to this cpu's context */
227 assert(handle == cm_get_context(NON_SECURE));
228
229 /* Save the non-secure context before entering SPMC */
230 cm_el1_sysregs_context_save(NON_SECURE);
231 #if SPMD_SPM_AT_SEL2
232 cm_el2_sysregs_context_save(NON_SECURE);
233 #endif
234
235 /* Convey the event to the SPMC through the FFA_INTERRUPT interface. */
236 write_ctx_reg(gpregs, CTX_GPREG_X0, FFA_INTERRUPT);
237 write_ctx_reg(gpregs, CTX_GPREG_X1, 0);
238 write_ctx_reg(gpregs, CTX_GPREG_X2, 0);
239 write_ctx_reg(gpregs, CTX_GPREG_X3, 0);
240 write_ctx_reg(gpregs, CTX_GPREG_X4, 0);
241 write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
242 write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
243 write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
244
245 /* Mark current core as handling a secure interrupt. */
246 ctx->secure_interrupt_ongoing = true;
247
248 rc = spmd_spm_core_sync_entry(ctx);
249 if (rc != 0ULL) {
250 ERROR("%s failed (%" PRId64 ") on CPU%u\n", __func__, rc, linear_id);
251 }
252
253 ctx->secure_interrupt_ongoing = false;
254
255 cm_el1_sysregs_context_restore(NON_SECURE);
256 #if SPMD_SPM_AT_SEL2
257 cm_el2_sysregs_context_restore(NON_SECURE);
258 #endif
259 cm_set_next_eret_context(NON_SECURE);
260
261 SMC_RET0(&ctx->cpu_ctx);
262 }
263
264 #if (EL3_EXCEPTION_HANDLING == 0)
265 /*******************************************************************************
266 * spmd_group0_interrupt_handler_nwd
267 * Group0 secure interrupt in the normal world are trapped to EL3. Delegate the
268 * handling of the interrupt to the platform handler, and return only upon
269 * successfully handling the Group0 interrupt.
270 ******************************************************************************/
spmd_group0_interrupt_handler_nwd(uint32_t id,uint32_t flags,void * handle,void * cookie)271 static uint64_t spmd_group0_interrupt_handler_nwd(uint32_t id,
272 uint32_t flags,
273 void *handle,
274 void *cookie)
275 {
276 uint32_t intid;
277
278 /* Sanity check the security state when the exception was generated. */
279 assert(get_interrupt_src_ss(flags) == NON_SECURE);
280
281 /* Sanity check the pointer to this cpu's context. */
282 assert(handle == cm_get_context(NON_SECURE));
283
284 assert(id == INTR_ID_UNAVAILABLE);
285
286 assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3);
287
288 intid = plat_ic_acknowledge_interrupt();
289
290 if (plat_spmd_handle_group0_interrupt(intid) < 0) {
291 ERROR("Group0 interrupt %u not handled\n", intid);
292 panic();
293 }
294
295 /* Deactivate the corresponding Group0 interrupt. */
296 plat_ic_end_of_interrupt(intid);
297
298 return 0U;
299 }
300 #endif
301
302 /*******************************************************************************
303 * spmd_handle_group0_intr_swd
304 * SPMC delegates handling of Group0 secure interrupt to EL3 firmware using
305 * FFA_EL3_INTR_HANDLE SMC call. Further, SPMD delegates the handling of the
306 * interrupt to the platform handler, and returns only upon successfully
307 * handling the Group0 interrupt.
308 ******************************************************************************/
spmd_handle_group0_intr_swd(void * handle)309 static uint64_t spmd_handle_group0_intr_swd(void *handle)
310 {
311 uint32_t intid;
312
313 /* Sanity check the pointer to this cpu's context */
314 assert(handle == cm_get_context(SECURE));
315
316 assert(plat_ic_get_pending_interrupt_type() == INTR_TYPE_EL3);
317
318 intid = plat_ic_acknowledge_interrupt();
319
320 /*
321 * TODO: Currently due to a limitation in SPMD implementation, the
322 * platform handler is expected to not delegate handling to NWd while
323 * processing Group0 secure interrupt.
324 */
325 if (plat_spmd_handle_group0_interrupt(intid) < 0) {
326 /* Group0 interrupt was not handled by the platform. */
327 ERROR("Group0 interrupt %u not handled\n", intid);
328 panic();
329 }
330
331 /* Deactivate the corresponding Group0 interrupt. */
332 plat_ic_end_of_interrupt(intid);
333
334 /* Return success. */
335 SMC_RET8(handle, FFA_SUCCESS_SMC32, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
336 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
337 FFA_PARAM_MBZ);
338 }
339
340 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31
spmd_dynamic_map_mem(uintptr_t base_addr,size_t size,unsigned int attr,uintptr_t * align_addr,size_t * align_size)341 static int spmd_dynamic_map_mem(uintptr_t base_addr, size_t size,
342 unsigned int attr, uintptr_t *align_addr,
343 size_t *align_size)
344 {
345 uintptr_t base_addr_align;
346 size_t mapped_size_align;
347 int rc;
348
349 /* Page aligned address and size if necessary */
350 base_addr_align = page_align(base_addr, DOWN);
351 mapped_size_align = page_align(size, UP);
352
353 if ((base_addr != base_addr_align) &&
354 (size == mapped_size_align)) {
355 mapped_size_align += PAGE_SIZE;
356 }
357
358 /*
359 * Map dynamically given region with its aligned base address and
360 * size
361 */
362 rc = mmap_add_dynamic_region((unsigned long long)base_addr_align,
363 base_addr_align,
364 mapped_size_align,
365 attr);
366 if (rc == 0) {
367 *align_addr = base_addr_align;
368 *align_size = mapped_size_align;
369 }
370
371 return rc;
372 }
373
spmd_do_sec_cpy(uintptr_t root_base_addr,uintptr_t sec_base_addr,size_t size)374 static void spmd_do_sec_cpy(uintptr_t root_base_addr, uintptr_t sec_base_addr,
375 size_t size)
376 {
377 uintptr_t root_base_addr_align, sec_base_addr_align;
378 size_t root_mapped_size_align, sec_mapped_size_align;
379 int rc;
380
381 assert(root_base_addr != 0UL);
382 assert(sec_base_addr != 0UL);
383 assert(size != 0UL);
384
385 /* Map the memory with required attributes */
386 rc = spmd_dynamic_map_mem(root_base_addr, size, MT_RO_DATA | MT_ROOT,
387 &root_base_addr_align,
388 &root_mapped_size_align);
389 if (rc != 0) {
390 ERROR("%s %s %lu (%d)\n", "Error while mapping", "root region",
391 root_base_addr, rc);
392 panic();
393 }
394
395 rc = spmd_dynamic_map_mem(sec_base_addr, size, MT_RW_DATA | MT_SECURE,
396 &sec_base_addr_align, &sec_mapped_size_align);
397 if (rc != 0) {
398 ERROR("%s %s %lu (%d)\n", "Error while mapping",
399 "secure region", sec_base_addr, rc);
400 panic();
401 }
402
403 /* Do copy operation */
404 (void)memcpy((void *)sec_base_addr, (void *)root_base_addr, size);
405
406 /* Unmap root memory region */
407 rc = mmap_remove_dynamic_region(root_base_addr_align,
408 root_mapped_size_align);
409 if (rc != 0) {
410 ERROR("%s %s %lu (%d)\n", "Error while unmapping",
411 "root region", root_base_addr_align, rc);
412 panic();
413 }
414
415 /* Unmap secure memory region */
416 rc = mmap_remove_dynamic_region(sec_base_addr_align,
417 sec_mapped_size_align);
418 if (rc != 0) {
419 ERROR("%s %s %lu (%d)\n", "Error while unmapping",
420 "secure region", sec_base_addr_align, rc);
421 panic();
422 }
423 }
424 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */
425
426 /*******************************************************************************
427 * Loads SPMC manifest and inits SPMC.
428 ******************************************************************************/
spmd_spmc_init(void * pm_addr)429 static int spmd_spmc_init(void *pm_addr)
430 {
431 cpu_context_t *cpu_ctx;
432 unsigned int core_id;
433 uint32_t ep_attr, flags;
434 int rc;
435 const struct dyn_cfg_dtb_info_t *image_info __unused;
436
437 /* Load the SPM Core manifest */
438 rc = plat_spm_core_manifest_load(&spmc_attrs, pm_addr);
439 if (rc != 0) {
440 WARN("No or invalid SPM Core manifest image provided by BL2\n");
441 return rc;
442 }
443
444 /*
445 * Ensure that the SPM Core version is compatible with the SPM
446 * Dispatcher version.
447 */
448 if ((spmc_attrs.major_version != FFA_VERSION_MAJOR) ||
449 (spmc_attrs.minor_version > FFA_VERSION_MINOR)) {
450 WARN("Unsupported FFA version (%u.%u)\n",
451 spmc_attrs.major_version, spmc_attrs.minor_version);
452 return -EINVAL;
453 }
454
455 VERBOSE("FFA version (%u.%u)\n", spmc_attrs.major_version,
456 spmc_attrs.minor_version);
457
458 VERBOSE("SPM Core run time EL%x.\n",
459 SPMD_SPM_AT_SEL2 ? MODE_EL2 : MODE_EL1);
460
461 /* Validate the SPMC ID, Ensure high bit is set */
462 if (((spmc_attrs.spmc_id >> SPMC_SECURE_ID_SHIFT) &
463 SPMC_SECURE_ID_MASK) == 0U) {
464 WARN("Invalid ID (0x%x) for SPMC.\n", spmc_attrs.spmc_id);
465 return -EINVAL;
466 }
467
468 /* Validate the SPM Core execution state */
469 if ((spmc_attrs.exec_state != MODE_RW_64) &&
470 (spmc_attrs.exec_state != MODE_RW_32)) {
471 WARN("Unsupported %s%x.\n", "SPM Core execution state 0x",
472 spmc_attrs.exec_state);
473 return -EINVAL;
474 }
475
476 VERBOSE("%s%x.\n", "SPM Core execution state 0x",
477 spmc_attrs.exec_state);
478
479 #if SPMD_SPM_AT_SEL2
480 /* Ensure manifest has not requested AArch32 state in S-EL2 */
481 if (spmc_attrs.exec_state == MODE_RW_32) {
482 WARN("AArch32 state at S-EL2 is not supported.\n");
483 return -EINVAL;
484 }
485
486 /*
487 * Check if S-EL2 is supported on this system if S-EL2
488 * is required for SPM
489 */
490 if (!is_feat_sel2_supported()) {
491 WARN("SPM Core run time S-EL2 is not supported.\n");
492 return -EINVAL;
493 }
494 #endif /* SPMD_SPM_AT_SEL2 */
495
496 /* Initialise an entrypoint to set up the CPU context */
497 ep_attr = SECURE | EP_ST_ENABLE;
498 if ((read_sctlr_el3() & SCTLR_EE_BIT) != 0ULL) {
499 ep_attr |= EP_EE_BIG;
500 }
501
502 SET_PARAM_HEAD(spmc_ep_info, PARAM_EP, VERSION_1, ep_attr);
503
504 /*
505 * Populate SPSR for SPM Core based upon validated parameters from the
506 * manifest.
507 */
508 if (spmc_attrs.exec_state == MODE_RW_32) {
509 spmc_ep_info->spsr = SPSR_MODE32(MODE32_svc, SPSR_T_ARM,
510 SPSR_E_LITTLE,
511 DAIF_FIQ_BIT |
512 DAIF_IRQ_BIT |
513 DAIF_ABT_BIT);
514 } else {
515
516 #if SPMD_SPM_AT_SEL2
517 static const uint32_t runtime_el = MODE_EL2;
518 #else
519 static const uint32_t runtime_el = MODE_EL1;
520 #endif
521 spmc_ep_info->spsr = SPSR_64(runtime_el,
522 MODE_SP_ELX,
523 DISABLE_ALL_EXCEPTIONS);
524 }
525
526 #if ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31
527 image_info = FCONF_GET_PROPERTY(dyn_cfg, dtb, TOS_FW_CONFIG_ID);
528 assert(image_info != NULL);
529
530 if ((image_info->config_addr == 0UL) ||
531 (image_info->secondary_config_addr == 0UL) ||
532 (image_info->config_max_size == 0UL)) {
533 return -EINVAL;
534 }
535
536 /* Copy manifest from root->secure region */
537 spmd_do_sec_cpy(image_info->config_addr,
538 image_info->secondary_config_addr,
539 image_info->config_max_size);
540
541 /* Update ep info of BL32 */
542 assert(spmc_ep_info != NULL);
543 spmc_ep_info->args.arg0 = image_info->secondary_config_addr;
544 #endif /* ENABLE_RME && SPMD_SPM_AT_SEL2 && !RESET_TO_BL31 */
545
546 /* Set an initial SPMC context state for all cores. */
547 for (core_id = 0U; core_id < PLATFORM_CORE_COUNT; core_id++) {
548 spm_core_context[core_id].state = SPMC_STATE_OFF;
549
550 /* Setup an initial cpu context for the SPMC. */
551 cpu_ctx = &spm_core_context[core_id].cpu_ctx;
552 cm_setup_context(cpu_ctx, spmc_ep_info);
553
554 /*
555 * Pass the core linear ID to the SPMC through x4.
556 * (TF-A implementation defined behavior helping
557 * a legacy TOS migration to adopt FF-A).
558 */
559 write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X4, core_id);
560 }
561
562 /* Register power management hooks with PSCI */
563 psci_register_spd_pm_hook(&spmd_pm);
564
565 /* Register init function for deferred init. */
566 bl31_register_bl32_init(&spmd_init);
567
568 INFO("SPM Core setup done.\n");
569
570 /*
571 * Register an interrupt handler routing secure interrupts to SPMD
572 * while the NWd is running.
573 */
574 flags = 0;
575 set_interrupt_rm_flag(flags, NON_SECURE);
576 rc = register_interrupt_type_handler(INTR_TYPE_S_EL1,
577 spmd_secure_interrupt_handler,
578 flags);
579 if (rc != 0) {
580 panic();
581 }
582
583 /*
584 * Permit configurations where the SPM resides at S-EL1/2 and upon a
585 * Group0 interrupt triggering while the normal world runs, the
586 * interrupt is routed either through the EHF or directly to the SPMD:
587 *
588 * EL3_EXCEPTION_HANDLING=0: the Group0 interrupt is routed to the SPMD
589 * for handling by spmd_group0_interrupt_handler_nwd.
590 *
591 * EL3_EXCEPTION_HANDLING=1: the Group0 interrupt is routed to the EHF.
592 *
593 */
594 #if (EL3_EXCEPTION_HANDLING == 0)
595 /*
596 * Register an interrupt handler routing Group0 interrupts to SPMD
597 * while the NWd is running.
598 */
599 rc = register_interrupt_type_handler(INTR_TYPE_EL3,
600 spmd_group0_interrupt_handler_nwd,
601 flags);
602 if (rc != 0) {
603 panic();
604 }
605 #endif
606
607 return 0;
608 }
609
610 /*******************************************************************************
611 * Initialize context of SPM Core.
612 ******************************************************************************/
spmd_setup(void)613 int spmd_setup(void)
614 {
615 int rc;
616 void *spmc_manifest;
617
618 /*
619 * If the SPMC is at EL3, then just initialise it directly. The
620 * shenanigans of when it is at a lower EL are not needed.
621 */
622 if (is_spmc_at_el3()) {
623 /* Allow the SPMC to populate its attributes directly. */
624 spmc_populate_attrs(&spmc_attrs);
625
626 rc = spmc_setup();
627 if (rc != 0) {
628 WARN("SPMC initialisation failed 0x%x.\n", rc);
629 }
630 return 0;
631 }
632
633 spmc_ep_info = bl31_plat_get_next_image_ep_info(SECURE);
634 if (spmc_ep_info == NULL) {
635 WARN("No SPM Core image provided by BL2 boot loader.\n");
636 return 0;
637 }
638
639 /* Under no circumstances will this parameter be 0 */
640 assert(spmc_ep_info->pc != 0ULL);
641
642 /*
643 * Check if BL32 ep_info has a reference to 'tos_fw_config'. This will
644 * be used as a manifest for the SPM Core at the next lower EL/mode.
645 */
646 spmc_manifest = (void *)spmc_ep_info->args.arg0;
647 if (spmc_manifest == NULL) {
648 WARN("Invalid or absent SPM Core manifest.\n");
649 return 0;
650 }
651
652 /* Load manifest, init SPMC */
653 rc = spmd_spmc_init(spmc_manifest);
654 if (rc != 0) {
655 WARN("Booting device without SPM initialization.\n");
656 }
657
658 return 0;
659 }
660
661 /*******************************************************************************
662 * Forward FF-A SMCs to the other security state.
663 ******************************************************************************/
spmd_smc_switch_state(uint32_t smc_fid,bool secure_origin,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * handle)664 uint64_t spmd_smc_switch_state(uint32_t smc_fid,
665 bool secure_origin,
666 uint64_t x1,
667 uint64_t x2,
668 uint64_t x3,
669 uint64_t x4,
670 void *handle)
671 {
672 unsigned int secure_state_in = (secure_origin) ? SECURE : NON_SECURE;
673 unsigned int secure_state_out = (!secure_origin) ? SECURE : NON_SECURE;
674
675 /* Save incoming security state */
676 #if SPMD_SPM_AT_SEL2
677 if (secure_state_in == NON_SECURE) {
678 cm_el1_sysregs_context_save(secure_state_in);
679 }
680 cm_el2_sysregs_context_save(secure_state_in);
681 #else
682 cm_el1_sysregs_context_save(secure_state_in);
683 #endif
684
685 /* Restore outgoing security state */
686 #if SPMD_SPM_AT_SEL2
687 if (secure_state_out == NON_SECURE) {
688 cm_el1_sysregs_context_restore(secure_state_out);
689 }
690 cm_el2_sysregs_context_restore(secure_state_out);
691 #else
692 cm_el1_sysregs_context_restore(secure_state_out);
693 #endif
694 cm_set_next_eret_context(secure_state_out);
695
696 #if SPMD_SPM_AT_SEL2
697 /*
698 * If SPMC is at SEL2, save additional registers x8-x17, which may
699 * be used in FF-A calls such as FFA_PARTITION_INFO_GET_REGS.
700 * Note that technically, all SPMCs can support this, but this code is
701 * under ifdef to minimize breakage in case other SPMCs do not save
702 * and restore x8-x17.
703 * We also need to pass through these registers since not all FF-A ABIs
704 * modify x8-x17, in which case, SMCCC requires that these registers be
705 * preserved, so the SPMD passes through these registers and expects the
706 * SPMC to save and restore (potentially also modify) them.
707 */
708 SMC_RET18(cm_get_context(secure_state_out), smc_fid, x1, x2, x3, x4,
709 SMC_GET_GP(handle, CTX_GPREG_X5),
710 SMC_GET_GP(handle, CTX_GPREG_X6),
711 SMC_GET_GP(handle, CTX_GPREG_X7),
712 SMC_GET_GP(handle, CTX_GPREG_X8),
713 SMC_GET_GP(handle, CTX_GPREG_X9),
714 SMC_GET_GP(handle, CTX_GPREG_X10),
715 SMC_GET_GP(handle, CTX_GPREG_X11),
716 SMC_GET_GP(handle, CTX_GPREG_X12),
717 SMC_GET_GP(handle, CTX_GPREG_X13),
718 SMC_GET_GP(handle, CTX_GPREG_X14),
719 SMC_GET_GP(handle, CTX_GPREG_X15),
720 SMC_GET_GP(handle, CTX_GPREG_X16),
721 SMC_GET_GP(handle, CTX_GPREG_X17)
722 );
723
724 #else
725 SMC_RET8(cm_get_context(secure_state_out), smc_fid, x1, x2, x3, x4,
726 SMC_GET_GP(handle, CTX_GPREG_X5),
727 SMC_GET_GP(handle, CTX_GPREG_X6),
728 SMC_GET_GP(handle, CTX_GPREG_X7));
729 #endif
730 }
731
732 /*******************************************************************************
733 * Forward SMCs to the other security state.
734 ******************************************************************************/
spmd_smc_forward(uint32_t smc_fid,bool secure_origin,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)735 static uint64_t spmd_smc_forward(uint32_t smc_fid,
736 bool secure_origin,
737 uint64_t x1,
738 uint64_t x2,
739 uint64_t x3,
740 uint64_t x4,
741 void *cookie,
742 void *handle,
743 uint64_t flags)
744 {
745 if (is_spmc_at_el3() && !secure_origin) {
746 return spmc_smc_handler(smc_fid, secure_origin, x1, x2, x3, x4,
747 cookie, handle, flags);
748 }
749 return spmd_smc_switch_state(smc_fid, secure_origin, x1, x2, x3, x4,
750 handle);
751
752 }
753
754 /*******************************************************************************
755 * Return FFA_ERROR with specified error code
756 ******************************************************************************/
spmd_ffa_error_return(void * handle,int error_code)757 uint64_t spmd_ffa_error_return(void *handle, int error_code)
758 {
759 SMC_RET8(handle, (uint32_t) FFA_ERROR,
760 FFA_TARGET_INFO_MBZ, (uint32_t)error_code,
761 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
762 FFA_PARAM_MBZ, FFA_PARAM_MBZ);
763 }
764
765 /*******************************************************************************
766 * spmd_check_address_in_binary_image
767 ******************************************************************************/
spmd_check_address_in_binary_image(uint64_t address)768 bool spmd_check_address_in_binary_image(uint64_t address)
769 {
770 assert(!check_uptr_overflow(spmc_attrs.load_address, spmc_attrs.binary_size));
771
772 return ((address >= spmc_attrs.load_address) &&
773 (address < (spmc_attrs.load_address + spmc_attrs.binary_size)));
774 }
775
776 /******************************************************************************
777 * spmd_is_spmc_message
778 *****************************************************************************/
spmd_is_spmc_message(unsigned int ep)779 static bool spmd_is_spmc_message(unsigned int ep)
780 {
781 if (is_spmc_at_el3()) {
782 return false;
783 }
784
785 return ((ffa_endpoint_destination(ep) == SPMD_DIRECT_MSG_ENDPOINT_ID)
786 && (ffa_endpoint_source(ep) == spmc_attrs.spmc_id));
787 }
788
789 /******************************************************************************
790 * spmd_handle_spmc_message
791 *****************************************************************************/
spmd_handle_spmc_message(unsigned long long msg,unsigned long long parm1,unsigned long long parm2,unsigned long long parm3,unsigned long long parm4)792 static int spmd_handle_spmc_message(unsigned long long msg,
793 unsigned long long parm1, unsigned long long parm2,
794 unsigned long long parm3, unsigned long long parm4)
795 {
796 VERBOSE("%s %llx %llx %llx %llx %llx\n", __func__,
797 msg, parm1, parm2, parm3, parm4);
798
799 return -EINVAL;
800 }
801
802 /*******************************************************************************
803 * This function forwards FF-A SMCs to either the main SPMD handler or the
804 * SPMC at EL3, depending on the origin security state, if enabled.
805 ******************************************************************************/
spmd_ffa_smc_handler(uint32_t smc_fid,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)806 uint64_t spmd_ffa_smc_handler(uint32_t smc_fid,
807 uint64_t x1,
808 uint64_t x2,
809 uint64_t x3,
810 uint64_t x4,
811 void *cookie,
812 void *handle,
813 uint64_t flags)
814 {
815 if (is_spmc_at_el3()) {
816 /*
817 * If we have an SPMC at EL3 allow handling of the SMC first.
818 * The SPMC will call back through to SPMD handler if required.
819 */
820 if (is_caller_secure(flags)) {
821 return spmc_smc_handler(smc_fid,
822 is_caller_secure(flags),
823 x1, x2, x3, x4, cookie,
824 handle, flags);
825 }
826 }
827 return spmd_smc_handler(smc_fid, x1, x2, x3, x4, cookie,
828 handle, flags);
829 }
830
831 /*******************************************************************************
832 * This function handles all SMCs in the range reserved for FFA. Each call is
833 * either forwarded to the other security state or handled by the SPM dispatcher
834 ******************************************************************************/
spmd_smc_handler(uint32_t smc_fid,uint64_t x1,uint64_t x2,uint64_t x3,uint64_t x4,void * cookie,void * handle,uint64_t flags)835 uint64_t spmd_smc_handler(uint32_t smc_fid,
836 uint64_t x1,
837 uint64_t x2,
838 uint64_t x3,
839 uint64_t x4,
840 void *cookie,
841 void *handle,
842 uint64_t flags)
843 {
844 unsigned int linear_id = plat_my_core_pos();
845 spmd_spm_core_context_t *ctx = spmd_get_context();
846 bool secure_origin;
847 int32_t ret;
848 uint32_t input_version;
849
850 /* Determine which security state this SMC originated from */
851 secure_origin = is_caller_secure(flags);
852
853 VERBOSE("SPM(%u): 0x%x 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64
854 " 0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 "\n",
855 linear_id, smc_fid, x1, x2, x3, x4,
856 SMC_GET_GP(handle, CTX_GPREG_X5),
857 SMC_GET_GP(handle, CTX_GPREG_X6),
858 SMC_GET_GP(handle, CTX_GPREG_X7));
859
860 /*
861 * If there is an on-going info regs from EL3 SPMD LP, unconditionally
862 * return, we don't expect any other FF-A ABIs to be called between
863 * calls to FFA_PARTITION_INFO_GET_REGS.
864 */
865 if (is_spmd_logical_sp_info_regs_req_in_progress(ctx)) {
866 assert(secure_origin);
867 spmd_spm_core_sync_exit(0ULL);
868 }
869
870 switch (smc_fid) {
871 case FFA_ERROR:
872 /*
873 * Check if this is the first invocation of this interface on
874 * this CPU. If so, then indicate that the SPM Core initialised
875 * unsuccessfully.
876 */
877 if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) {
878 spmd_spm_core_sync_exit(x2);
879 }
880
881 /*
882 * If there was an SPMD logical partition direct request on-going,
883 * return back to the SPMD logical partition so the error can be
884 * consumed.
885 */
886 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
887 assert(secure_origin);
888 spmd_spm_core_sync_exit(0ULL);
889 }
890
891 return spmd_smc_forward(smc_fid, secure_origin,
892 x1, x2, x3, x4, cookie,
893 handle, flags);
894 break; /* not reached */
895
896 case FFA_VERSION:
897 input_version = (uint32_t)(0xFFFFFFFF & x1);
898 /*
899 * If caller is secure and SPMC was initialized,
900 * return FFA_VERSION of SPMD.
901 * If caller is non secure and SPMC was initialized,
902 * forward to the EL3 SPMC if enabled, otherwise return
903 * the SPMC version if implemented at a lower EL.
904 * Sanity check to "input_version".
905 * If the EL3 SPMC is enabled, ignore the SPMC state as
906 * this is not used.
907 */
908 if ((input_version & FFA_VERSION_BIT31_MASK) ||
909 (!is_spmc_at_el3() && (ctx->state == SPMC_STATE_RESET))) {
910 ret = FFA_ERROR_NOT_SUPPORTED;
911 } else if (!secure_origin) {
912 if (is_spmc_at_el3()) {
913 /*
914 * Forward the call directly to the EL3 SPMC, if
915 * enabled, as we don't need to wrap the call in
916 * a direct request.
917 */
918 return spmd_smc_forward(smc_fid, secure_origin,
919 x1, x2, x3, x4, cookie,
920 handle, flags);
921 }
922
923 gp_regs_t *gpregs = get_gpregs_ctx(&ctx->cpu_ctx);
924 uint64_t rc;
925
926 if (spmc_attrs.major_version == 1 &&
927 spmc_attrs.minor_version == 0) {
928 ret = MAKE_FFA_VERSION(spmc_attrs.major_version,
929 spmc_attrs.minor_version);
930 SMC_RET8(handle, (uint32_t)ret,
931 FFA_TARGET_INFO_MBZ,
932 FFA_TARGET_INFO_MBZ,
933 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
934 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
935 FFA_PARAM_MBZ);
936 break;
937 }
938 /* Save non-secure system registers context */
939 cm_el1_sysregs_context_save(NON_SECURE);
940 #if SPMD_SPM_AT_SEL2
941 cm_el2_sysregs_context_save(NON_SECURE);
942 #endif
943
944 /*
945 * The incoming request has FFA_VERSION as X0 smc_fid
946 * and requested version in x1. Prepare a direct request
947 * from SPMD to SPMC with FFA_VERSION framework function
948 * identifier in X2 and requested version in X3.
949 */
950 spmd_build_spmc_message(gpregs,
951 SPMD_FWK_MSG_FFA_VERSION_REQ,
952 input_version);
953
954 /*
955 * Ensure x8-x17 NS GP register values are untouched when returning
956 * from the SPMC.
957 */
958 write_ctx_reg(gpregs, CTX_GPREG_X8, SMC_GET_GP(handle, CTX_GPREG_X8));
959 write_ctx_reg(gpregs, CTX_GPREG_X9, SMC_GET_GP(handle, CTX_GPREG_X9));
960 write_ctx_reg(gpregs, CTX_GPREG_X10, SMC_GET_GP(handle, CTX_GPREG_X10));
961 write_ctx_reg(gpregs, CTX_GPREG_X11, SMC_GET_GP(handle, CTX_GPREG_X11));
962 write_ctx_reg(gpregs, CTX_GPREG_X12, SMC_GET_GP(handle, CTX_GPREG_X12));
963 write_ctx_reg(gpregs, CTX_GPREG_X13, SMC_GET_GP(handle, CTX_GPREG_X13));
964 write_ctx_reg(gpregs, CTX_GPREG_X14, SMC_GET_GP(handle, CTX_GPREG_X14));
965 write_ctx_reg(gpregs, CTX_GPREG_X15, SMC_GET_GP(handle, CTX_GPREG_X15));
966 write_ctx_reg(gpregs, CTX_GPREG_X16, SMC_GET_GP(handle, CTX_GPREG_X16));
967 write_ctx_reg(gpregs, CTX_GPREG_X17, SMC_GET_GP(handle, CTX_GPREG_X17));
968
969 rc = spmd_spm_core_sync_entry(ctx);
970
971 if ((rc != 0ULL) ||
972 (SMC_GET_GP(gpregs, CTX_GPREG_X0) !=
973 FFA_MSG_SEND_DIRECT_RESP_SMC32) ||
974 (SMC_GET_GP(gpregs, CTX_GPREG_X2) !=
975 (FFA_FWK_MSG_BIT |
976 SPMD_FWK_MSG_FFA_VERSION_RESP))) {
977 ERROR("Failed to forward FFA_VERSION\n");
978 ret = FFA_ERROR_NOT_SUPPORTED;
979 } else {
980 ret = SMC_GET_GP(gpregs, CTX_GPREG_X3);
981 }
982
983 /*
984 * x0-x4 are updated by spmd_smc_forward below.
985 * Zero out x5-x7 in the FFA_VERSION response.
986 */
987 write_ctx_reg(gpregs, CTX_GPREG_X5, 0);
988 write_ctx_reg(gpregs, CTX_GPREG_X6, 0);
989 write_ctx_reg(gpregs, CTX_GPREG_X7, 0);
990
991 /*
992 * Return here after SPMC has handled FFA_VERSION.
993 * The returned SPMC version is held in X3.
994 * Forward this version in X0 to the non-secure caller.
995 */
996 return spmd_smc_forward(ret, true, FFA_PARAM_MBZ,
997 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
998 FFA_PARAM_MBZ, cookie, gpregs,
999 flags);
1000 } else {
1001 ret = MAKE_FFA_VERSION(FFA_VERSION_MAJOR,
1002 FFA_VERSION_MINOR);
1003 }
1004
1005 SMC_RET8(handle, (uint32_t)ret, FFA_TARGET_INFO_MBZ,
1006 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1007 FFA_PARAM_MBZ, FFA_PARAM_MBZ, FFA_PARAM_MBZ);
1008 break; /* not reached */
1009
1010 case FFA_FEATURES:
1011 /*
1012 * This is an optional interface. Do the minimal checks and
1013 * forward to SPM Core which will handle it if implemented.
1014 */
1015
1016 /* Forward SMC from Normal world to the SPM Core */
1017 if (!secure_origin) {
1018 return spmd_smc_forward(smc_fid, secure_origin,
1019 x1, x2, x3, x4, cookie,
1020 handle, flags);
1021 }
1022
1023 /*
1024 * Return success if call was from secure world i.e. all
1025 * FFA functions are supported. This is essentially a
1026 * nop.
1027 */
1028 SMC_RET8(handle, FFA_SUCCESS_SMC32, x1, x2, x3, x4,
1029 SMC_GET_GP(handle, CTX_GPREG_X5),
1030 SMC_GET_GP(handle, CTX_GPREG_X6),
1031 SMC_GET_GP(handle, CTX_GPREG_X7));
1032
1033 break; /* not reached */
1034
1035 case FFA_ID_GET:
1036 /*
1037 * Returns the ID of the calling FFA component.
1038 */
1039 if (!secure_origin) {
1040 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1041 FFA_TARGET_INFO_MBZ, FFA_NS_ENDPOINT_ID,
1042 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1043 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1044 FFA_PARAM_MBZ);
1045 }
1046
1047 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1048 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id,
1049 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1050 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1051 FFA_PARAM_MBZ);
1052
1053 break; /* not reached */
1054
1055 case FFA_SECONDARY_EP_REGISTER_SMC64:
1056 if (secure_origin) {
1057 ret = spmd_pm_secondary_ep_register(x1);
1058
1059 if (ret < 0) {
1060 SMC_RET8(handle, FFA_ERROR_SMC64,
1061 FFA_TARGET_INFO_MBZ, ret,
1062 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1063 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1064 FFA_PARAM_MBZ);
1065 } else {
1066 SMC_RET8(handle, FFA_SUCCESS_SMC64,
1067 FFA_TARGET_INFO_MBZ, FFA_PARAM_MBZ,
1068 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1069 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1070 FFA_PARAM_MBZ);
1071 }
1072 }
1073
1074 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1075 break; /* Not reached */
1076
1077 case FFA_SPM_ID_GET:
1078 if (MAKE_FFA_VERSION(1, 1) > FFA_VERSION_COMPILED) {
1079 return spmd_ffa_error_return(handle,
1080 FFA_ERROR_NOT_SUPPORTED);
1081 }
1082 /*
1083 * Returns the ID of the SPMC or SPMD depending on the FF-A
1084 * instance where this function is invoked
1085 */
1086 if (!secure_origin) {
1087 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1088 FFA_TARGET_INFO_MBZ, spmc_attrs.spmc_id,
1089 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1090 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1091 FFA_PARAM_MBZ);
1092 }
1093 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1094 FFA_TARGET_INFO_MBZ, SPMD_DIRECT_MSG_ENDPOINT_ID,
1095 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1096 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1097 FFA_PARAM_MBZ);
1098
1099 break; /* not reached */
1100
1101 case FFA_MSG_SEND_DIRECT_REQ_SMC32:
1102 case FFA_MSG_SEND_DIRECT_REQ_SMC64:
1103 /*
1104 * Regardless of secure_origin, SPMD logical partitions cannot
1105 * handle direct messages. They can only initiate direct
1106 * messages and consume direct responses or errors.
1107 */
1108 if (is_spmd_lp_id(ffa_endpoint_source(x1)) ||
1109 is_spmd_lp_id(ffa_endpoint_destination(x1))) {
1110 return spmd_ffa_error_return(handle,
1111 FFA_ERROR_INVALID_PARAMETER
1112 );
1113 }
1114
1115 /*
1116 * When there is an ongoing SPMD logical partition direct
1117 * request, there cannot be another direct request. Return
1118 * error in this case. Panic'ing is an option but that does
1119 * not provide the opportunity for caller to abort based on
1120 * error codes.
1121 */
1122 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1123 assert(secure_origin);
1124 return spmd_ffa_error_return(handle,
1125 FFA_ERROR_DENIED);
1126 }
1127
1128 if (!secure_origin) {
1129 /* Validate source endpoint is non-secure for non-secure caller. */
1130 if (ffa_is_secure_world_id(ffa_endpoint_source(x1))) {
1131 return spmd_ffa_error_return(handle,
1132 FFA_ERROR_INVALID_PARAMETER);
1133 }
1134 }
1135 if (secure_origin && spmd_is_spmc_message(x1)) {
1136 ret = spmd_handle_spmc_message(x3, x4,
1137 SMC_GET_GP(handle, CTX_GPREG_X5),
1138 SMC_GET_GP(handle, CTX_GPREG_X6),
1139 SMC_GET_GP(handle, CTX_GPREG_X7));
1140
1141 SMC_RET8(handle, FFA_SUCCESS_SMC32,
1142 FFA_TARGET_INFO_MBZ, ret,
1143 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1144 FFA_PARAM_MBZ, FFA_PARAM_MBZ,
1145 FFA_PARAM_MBZ);
1146 } else {
1147 /* Forward direct message to the other world */
1148 return spmd_smc_forward(smc_fid, secure_origin,
1149 x1, x2, x3, x4, cookie,
1150 handle, flags);
1151 }
1152 break; /* Not reached */
1153
1154 case FFA_MSG_SEND_DIRECT_RESP_SMC32:
1155 case FFA_MSG_SEND_DIRECT_RESP_SMC64:
1156 if (secure_origin && (spmd_is_spmc_message(x1) ||
1157 is_spmd_logical_sp_dir_req_in_progress(ctx))) {
1158 spmd_spm_core_sync_exit(0ULL);
1159 } else {
1160 /* Forward direct message to the other world */
1161 return spmd_smc_forward(smc_fid, secure_origin,
1162 x1, x2, x3, x4, cookie,
1163 handle, flags);
1164 }
1165 break; /* Not reached */
1166
1167 case FFA_RX_RELEASE:
1168 case FFA_RXTX_MAP_SMC32:
1169 case FFA_RXTX_MAP_SMC64:
1170 case FFA_RXTX_UNMAP:
1171 case FFA_PARTITION_INFO_GET:
1172 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED
1173 case FFA_NOTIFICATION_BITMAP_CREATE:
1174 case FFA_NOTIFICATION_BITMAP_DESTROY:
1175 case FFA_NOTIFICATION_BIND:
1176 case FFA_NOTIFICATION_UNBIND:
1177 case FFA_NOTIFICATION_SET:
1178 case FFA_NOTIFICATION_GET:
1179 case FFA_NOTIFICATION_INFO_GET:
1180 case FFA_NOTIFICATION_INFO_GET_SMC64:
1181 case FFA_MSG_SEND2:
1182 case FFA_RX_ACQUIRE:
1183 #endif
1184 case FFA_MSG_RUN:
1185 /*
1186 * Above calls should be invoked only by the Normal world and
1187 * must not be forwarded from Secure world to Normal world.
1188 */
1189 if (secure_origin) {
1190 return spmd_ffa_error_return(handle,
1191 FFA_ERROR_NOT_SUPPORTED);
1192 }
1193
1194 /* Forward the call to the other world */
1195 /* fallthrough */
1196 case FFA_MSG_SEND:
1197 case FFA_MEM_DONATE_SMC32:
1198 case FFA_MEM_DONATE_SMC64:
1199 case FFA_MEM_LEND_SMC32:
1200 case FFA_MEM_LEND_SMC64:
1201 case FFA_MEM_SHARE_SMC32:
1202 case FFA_MEM_SHARE_SMC64:
1203 case FFA_MEM_RETRIEVE_REQ_SMC32:
1204 case FFA_MEM_RETRIEVE_REQ_SMC64:
1205 case FFA_MEM_RETRIEVE_RESP:
1206 case FFA_MEM_RELINQUISH:
1207 case FFA_MEM_RECLAIM:
1208 case FFA_MEM_FRAG_TX:
1209 case FFA_MEM_FRAG_RX:
1210 case FFA_SUCCESS_SMC32:
1211 case FFA_SUCCESS_SMC64:
1212 /*
1213 * If there is an ongoing direct request from an SPMD logical
1214 * partition, return an error.
1215 */
1216 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1217 assert(secure_origin);
1218 return spmd_ffa_error_return(handle,
1219 FFA_ERROR_DENIED);
1220 }
1221
1222 return spmd_smc_forward(smc_fid, secure_origin,
1223 x1, x2, x3, x4, cookie,
1224 handle, flags);
1225 break; /* not reached */
1226
1227 case FFA_MSG_WAIT:
1228 /*
1229 * Check if this is the first invocation of this interface on
1230 * this CPU from the Secure world. If so, then indicate that the
1231 * SPM Core initialised successfully.
1232 */
1233 if (secure_origin && (ctx->state == SPMC_STATE_ON_PENDING)) {
1234 spmd_spm_core_sync_exit(0ULL);
1235 }
1236
1237 /* Forward the call to the other world */
1238 /* fallthrough */
1239 case FFA_INTERRUPT:
1240 case FFA_MSG_YIELD:
1241 /* This interface must be invoked only by the Secure world */
1242 if (!secure_origin) {
1243 return spmd_ffa_error_return(handle,
1244 FFA_ERROR_NOT_SUPPORTED);
1245 }
1246
1247 if (is_spmd_logical_sp_dir_req_in_progress(ctx)) {
1248 assert(secure_origin);
1249 return spmd_ffa_error_return(handle,
1250 FFA_ERROR_DENIED);
1251 }
1252
1253 return spmd_smc_forward(smc_fid, secure_origin,
1254 x1, x2, x3, x4, cookie,
1255 handle, flags);
1256 break; /* not reached */
1257
1258 case FFA_NORMAL_WORLD_RESUME:
1259 if (secure_origin && ctx->secure_interrupt_ongoing) {
1260 spmd_spm_core_sync_exit(0ULL);
1261 } else {
1262 return spmd_ffa_error_return(handle, FFA_ERROR_DENIED);
1263 }
1264 break; /* Not reached */
1265 #if MAKE_FFA_VERSION(1, 1) <= FFA_VERSION_COMPILED
1266 case FFA_PARTITION_INFO_GET_REGS_SMC64:
1267 if (secure_origin) {
1268 return spmd_el3_populate_logical_partition_info(handle, x1,
1269 x2, x3);
1270 }
1271
1272 /* Call only supported with SMCCC 1.2+ */
1273 if (MAKE_SMCCC_VERSION(SMCCC_MAJOR_VERSION, SMCCC_MINOR_VERSION) < 0x10002) {
1274 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1275 }
1276
1277 return spmd_smc_forward(smc_fid, secure_origin,
1278 x1, x2, x3, x4, cookie,
1279 handle, flags);
1280 break; /* Not reached */
1281 #endif
1282 case FFA_EL3_INTR_HANDLE:
1283 if (secure_origin) {
1284 return spmd_handle_group0_intr_swd(handle);
1285 } else {
1286 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1287 }
1288 default:
1289 WARN("SPM: Unsupported call 0x%08x\n", smc_fid);
1290 return spmd_ffa_error_return(handle, FFA_ERROR_NOT_SUPPORTED);
1291 }
1292 }
1293
