cee7ef865deb476cdfef782a7fb9771f59df6fb4
2 * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
4 * SPDX-License-Identifier: BSD-3-Clause
7 /*******************************************************************************
8 * This is the Secure Payload Dispatcher (SPD). The dispatcher is meant to be a
9 * plug-in component to the Secure Monitor, registered as a runtime service. The
10 * SPD is expected to be a functional extension of the Secure Payload (SP) that
11 * executes in Secure EL1. The Secure Monitor will delegate all SMCs targeting
12 * the Trusted OS/Applications range to the dispatcher. The SPD will either
13 * handle the request locally or delegate it to the Secure Payload. It is also
14 * responsible for initialising and maintaining communication with the SP.
15 ******************************************************************************/
16 #include <arch_helpers.h>
19 #include <bl_common.h>
20 #include <context_mgmt.h>
24 #include <runtime_svc.h>
28 #include "tlkd_private.h"
30 extern const spd_pm_ops_t tlkd_pm_ops
;
32 /*******************************************************************************
33 * Per-cpu Secure Payload state
34 ******************************************************************************/
35 tlk_context_t tlk_ctx
;
37 /*******************************************************************************
38 * CPU number on which TLK booted up
39 ******************************************************************************/
40 static uint32_t boot_cpu
;
42 /* TLK UID: RFC-4122 compliant UUID (version-5, sha-1) */
43 DEFINE_SVC_UUID2(tlk_uuid
,
44 0xc9e911bd, 0xba2b, 0xee52, 0xb1, 0x72,
45 0x46, 0x1f, 0xba, 0x97, 0x7f, 0x63);
47 static int32_t tlkd_init(void);
49 /*******************************************************************************
50 * Secure Payload Dispatcher setup. The SPD finds out the SP entrypoint and type
51 * (aarch32/aarch64) if not already known and initialises the context for entry
52 * into the SP for its initialisation.
53 ******************************************************************************/
54 static int32_t tlkd_setup(void)
56 entry_point_info_t
*tlk_ep_info
;
59 * Get information about the Secure Payload (BL32) image. Its
60 * absence is a critical failure.
62 tlk_ep_info
= bl31_plat_get_next_image_ep_info(SECURE
);
64 WARN("No SP provided. Booting device without SP"
65 " initialization. SMC`s destined for SP"
66 " will return SMC_UNK\n");
71 * If there's no valid entry point for SP, we return a non-zero value
72 * signalling failure initializing the service. We bail out without
73 * registering any handlers
79 * Inspect the SP image's SPSR and determine it's execution state
80 * i.e whether AArch32 or AArch64.
82 tlkd_init_tlk_ep_state(tlk_ep_info
,
83 (tlk_ep_info
->spsr
>> MODE_RW_SHIFT
) & MODE_RW_MASK
,
88 * All TLK SPD initialization done. Now register our init function
89 * with BL31 for deferred invocation
91 bl31_register_bl32_init(&tlkd_init
);
96 /*******************************************************************************
97 * This function passes control to the Secure Payload image (BL32) for the first
98 * time on the primary cpu after a cold boot. It assumes that a valid secure
99 * context has already been created by tlkd_setup() which can be directly
100 * used. This function performs a synchronous entry into the Secure payload.
101 * The SP passes control back to this routine through a SMC.
102 ******************************************************************************/
103 static int32_t tlkd_init(void)
105 entry_point_info_t
*tlk_entry_point
;
108 * Get information about the Secure Payload (BL32) image. Its
109 * absence is a critical failure.
111 tlk_entry_point
= bl31_plat_get_next_image_ep_info(SECURE
);
112 assert(tlk_entry_point
);
114 cm_init_my_context(tlk_entry_point
);
117 * TLK runs only on a single CPU. Store the value of the boot
118 * CPU for sanity checking later.
120 boot_cpu
= plat_my_core_pos();
123 * Arrange for an entry into the test secure payload.
125 return tlkd_synchronous_sp_entry(&tlk_ctx
);
128 /*******************************************************************************
129 * This function is responsible for handling all SMCs in the Trusted OS/App
130 * range from the non-secure state as defined in the SMC Calling Convention
131 * Document. It is also responsible for communicating with the Secure payload
132 * to delegate work and return results back to the non-secure state. Lastly it
133 * will also return any information that the secure payload needs to do the
134 * work assigned to it.
135 ******************************************************************************/
136 static uintptr_t tlkd_smc_handler(uint32_t smc_fid
,
145 cpu_context_t
*ns_cpu_context
;
150 /* Passing a NULL context is a critical programming error */
153 /* These SMCs are only supported by a single CPU */
154 if (boot_cpu
!= plat_my_core_pos())
155 SMC_RET1(handle
, SMC_UNK
);
157 /* Determine which security state this SMC originated from */
158 ns
= is_caller_non_secure(flags
);
163 * This function ID is used by SP to indicate that it was
164 * preempted by a non-secure world IRQ.
169 SMC_RET1(handle
, SMC_UNK
);
171 assert(handle
== cm_get_context(SECURE
));
172 cm_el1_sysregs_context_save(SECURE
);
174 /* Get a reference to the non-secure context */
175 ns_cpu_context
= cm_get_context(NON_SECURE
);
176 assert(ns_cpu_context
);
179 * Restore non-secure state. There is no need to save the
180 * secure system register context since the SP was supposed
181 * to preserve it during S-EL1 interrupt handling.
183 cm_el1_sysregs_context_restore(NON_SECURE
);
184 cm_set_next_eret_context(NON_SECURE
);
186 SMC_RET1(ns_cpu_context
, x1
);
189 * This is a request from the non-secure context to:
191 * a. register shared memory with the SP for storing it's
193 * b. register shared memory with the SP for passing args
194 * required for maintaining sessions with the Trusted
196 * c. register non-secure world's memory map with the OS
197 * d. open/close sessions
198 * e. issue commands to the Trusted Apps
199 * f. resume the preempted yielding SMC call.
201 case TLK_REGISTER_LOGBUF
:
202 case TLK_REGISTER_REQBUF
:
203 case TLK_REGISTER_NS_DRAM
:
204 case TLK_OPEN_TA_SESSION
:
205 case TLK_CLOSE_TA_SESSION
:
206 case TLK_TA_LAUNCH_OP
:
207 case TLK_TA_SEND_EVENT
:
211 SMC_RET1(handle
, SMC_UNK
);
214 * This is a fresh request from the non-secure client.
215 * The parameters are in x1 and x2. Figure out which
216 * registers need to be preserved, save the non-secure
217 * state and send the request to the secure payload.
219 assert(handle
== cm_get_context(NON_SECURE
));
222 * Check if we are already processing a yielding SMC
223 * call. Of all the supported fids, only the "resume"
224 * fid expects the flag to be set.
226 if (smc_fid
== TLK_RESUME_FID
) {
227 if (!get_yield_smc_active_flag(tlk_ctx
.state
))
228 SMC_RET1(handle
, SMC_UNK
);
230 if (get_yield_smc_active_flag(tlk_ctx
.state
))
231 SMC_RET1(handle
, SMC_UNK
);
234 cm_el1_sysregs_context_save(NON_SECURE
);
237 * Verify if there is a valid context to use.
239 assert(&tlk_ctx
.cpu_ctx
== cm_get_context(SECURE
));
242 * Mark the SP state as active.
244 set_yield_smc_active_flag(tlk_ctx
.state
);
247 * We are done stashing the non-secure context. Ask the
248 * secure payload to do the work now.
250 cm_el1_sysregs_context_restore(SECURE
);
251 cm_set_next_eret_context(SECURE
);
254 * TLK is a 32-bit Trusted OS and so expects the SMC
255 * arguments via r0-r7. TLK expects the monitor frame
256 * registers to be 64-bits long. Hence, we pass x0 in
257 * r0-r1, x1 in r2-r3, x3 in r4-r5 and x4 in r6-r7.
259 * As smc_fid is a uint32 value, r1 contains 0.
261 gp_regs
= get_gpregs_ctx(&tlk_ctx
.cpu_ctx
);
262 write_ctx_reg(gp_regs
, CTX_GPREG_X4
, (uint32_t)x2
);
263 write_ctx_reg(gp_regs
, CTX_GPREG_X5
, (uint32_t)(x2
>> 32));
264 write_ctx_reg(gp_regs
, CTX_GPREG_X6
, (uint32_t)x3
);
265 write_ctx_reg(gp_regs
, CTX_GPREG_X7
, (uint32_t)(x3
>> 32));
266 SMC_RET4(&tlk_ctx
.cpu_ctx
, smc_fid
, 0, (uint32_t)x1
,
267 (uint32_t)(x1
>> 32));
270 * Translate NS/EL1-S virtual addresses.
272 * x1 = virtual address
275 * Returns PA:lo in r0, PA:hi in r1.
277 case TLK_VA_TRANSLATE
:
279 /* Should be invoked only by secure world */
281 SMC_RET1(handle
, SMC_UNK
);
283 /* NS virtual addresses are 64-bit long */
284 if (x3
& TLK_TRANSLATE_NS_VADDR
)
285 x1
= (uint32_t)x1
| (x2
<< 32);
288 SMC_RET1(handle
, SMC_UNK
);
291 * TODO: Sanity check x1. This would require platform
295 /* virtual address and type: ns/s */
296 par
= tlkd_va_translate(x1
, x3
);
298 /* return physical address in r0-r1 */
299 SMC_RET4(handle
, (uint32_t)par
, (uint32_t)(par
>> 32), 0, 0);
302 * This is a request from the SP to mark completion of
303 * a yielding function ID.
305 case TLK_REQUEST_DONE
:
307 SMC_RET1(handle
, SMC_UNK
);
310 * Mark the SP state as inactive.
312 clr_yield_smc_active_flag(tlk_ctx
.state
);
314 /* Get a reference to the non-secure context */
315 ns_cpu_context
= cm_get_context(NON_SECURE
);
316 assert(ns_cpu_context
);
319 * This is a request completion SMC and we must switch to
320 * the non-secure world to pass the result.
322 cm_el1_sysregs_context_save(SECURE
);
325 * We are done stashing the secure context. Switch to the
326 * non-secure context and return the result.
328 cm_el1_sysregs_context_restore(NON_SECURE
);
329 cm_set_next_eret_context(NON_SECURE
);
330 SMC_RET1(ns_cpu_context
, x1
);
333 * This function ID is used only by the SP to indicate it has
334 * finished initialising itself after a cold boot
338 SMC_RET1(handle
, SMC_UNK
);
341 * SP has been successfully initialized. Register power
342 * managemnt hooks with PSCI
344 psci_register_spd_pm_hook(&tlkd_pm_ops
);
347 * TLK reports completion. The SPD must have initiated
348 * the original request through a synchronous entry
349 * into the SP. Jump back to the original C runtime
352 tlkd_synchronous_sp_exit(&tlk_ctx
, x1
);
356 * These function IDs are used only by TLK to indicate it has
358 * 1. suspending itself after an earlier psci cpu_suspend
360 * 2. resuming itself after an earlier psci cpu_suspend
362 * 3. powering down after an earlier psci system_off/system_reset
365 case TLK_SUSPEND_DONE
:
366 case TLK_RESUME_DONE
:
367 case TLK_SYSTEM_OFF_DONE
:
370 SMC_RET1(handle
, SMC_UNK
);
373 * TLK reports completion. TLKD must have initiated the
374 * original request through a synchronous entry into the SP.
375 * Jump back to the original C runtime context, and pass x1 as
376 * return value to the caller
378 tlkd_synchronous_sp_exit(&tlk_ctx
, x1
);
382 * Return the number of service function IDs implemented to
383 * provide service to non-secure
386 SMC_RET1(handle
, TLK_NUM_FID
);
389 * Return TLK's UID to the caller
392 SMC_UUID_RET(handle
, tlk_uuid
);
395 * Return the version of current implementation
397 case TOS_CALL_VERSION
:
398 SMC_RET2(handle
, TLK_VERSION_MAJOR
, TLK_VERSION_MINOR
);
404 SMC_RET1(handle
, SMC_UNK
);
407 /* Define a SPD runtime service descriptor for fast SMC calls */
418 /* Define a SPD runtime service descriptor for yielding SMC calls */
429 /* Define a SPD runtime service descriptor for fast SMC calls */
440 /* Define a SPD runtime service descriptor for yielding SMC calls */