blob: 29fc238aef2fc4307a30e62ac96e3a8c19b4459c [file] [log] [blame]
Achin Gupta375f5382014-02-18 18:12:48 +00001/*
Madhukar Pappireddyae34f4d2020-09-18 17:50:26 -05002 * Copyright (c) 2013-2021, ARM Limited and Contributors. All rights reserved.
Achin Gupta375f5382014-02-18 18:12:48 +00003 *
dp-armfa3cf0b2017-05-03 09:38:09 +01004 * SPDX-License-Identifier: BSD-3-Clause
Achin Gupta375f5382014-02-18 18:12:48 +00005 */
6
7
8/*******************************************************************************
9 * This is the Secure Payload Dispatcher (SPD). The dispatcher is meant to be a
10 * plug-in component to the Secure Monitor, registered as a runtime service. The
11 * SPD is expected to be a functional extension of the Secure Payload (SP) that
12 * executes in Secure EL1. The Secure Monitor will delegate all SMCs targeting
13 * the Trusted OS/Applications range to the dispatcher. The SPD will either
14 * handle the request locally or delegate it to the Secure Payload. It is also
15 * responsible for initialising and maintaining communication with the SP.
16 ******************************************************************************/
Dan Handley2bd4ef22014-04-09 13:14:54 +010017#include <assert.h>
Achin Guptaaeaab682014-05-09 13:21:31 +010018#include <errno.h>
Dan Handley2bd4ef22014-04-09 13:14:54 +010019#include <stddef.h>
Soby Mathew47903c02015-01-13 15:48:26 +000020#include <string.h>
Antonio Nino Diaze0f90632018-12-14 00:18:21 +000021
22#include <arch_helpers.h>
23#include <bl31/bl31.h>
24#include <bl31/ehf.h>
25#include <bl32/tsp/tsp.h>
26#include <common/bl_common.h>
27#include <common/debug.h>
28#include <common/runtime_svc.h>
29#include <lib/el3_runtime/context_mgmt.h>
30#include <plat/common/platform.h>
31#include <tools_share/uuid.h>
32
Dan Handley714a0d22014-04-09 13:13:04 +010033#include "tspd_private.h"
Achin Gupta375f5382014-02-18 18:12:48 +000034
35/*******************************************************************************
Andrew Thoelke891c4ca2014-05-20 21:43:27 +010036 * Address of the entrypoint vector table in the Secure Payload. It is
37 * initialised once on the primary core after a cold boot.
Achin Gupta375f5382014-02-18 18:12:48 +000038 ******************************************************************************/
Andrew Thoelke891c4ca2014-05-20 21:43:27 +010039tsp_vectors_t *tsp_vectors;
Achin Gupta375f5382014-02-18 18:12:48 +000040
41/*******************************************************************************
42 * Array to keep track of per-cpu Secure Payload state
43 ******************************************************************************/
Dan Handleye2712bc2014-04-10 15:37:22 +010044tsp_context_t tspd_sp_context[TSPD_CORE_COUNT];
Achin Gupta375f5382014-02-18 18:12:48 +000045
Jeenu Viswambharan7f366602014-02-20 17:11:00 +000046
Jeenu Viswambharandf1ddb52014-02-28 11:23:35 +000047/* TSP UID */
Roberto Vargaseace8f12018-04-26 13:36:53 +010048DEFINE_SVC_UUID2(tsp_uuid,
49 0xa056305b, 0x9132, 0x7b42, 0x98, 0x11,
50 0x71, 0x68, 0xca, 0x50, 0xf3, 0xfa);
Jeenu Viswambharandf1ddb52014-02-28 11:23:35 +000051
Vikram Kanigirid8c9d262014-05-16 18:48:12 +010052int32_t tspd_init(void);
Jeenu Viswambharan7f366602014-02-20 17:11:00 +000053
Soby Mathewbc912822015-09-22 12:01:18 +010054/*
55 * This helper function handles Secure EL1 preemption. The preemption could be
56 * due Non Secure interrupts or EL3 interrupts. In both the cases we context
57 * switch to the normal world and in case of EL3 interrupts, it will again be
58 * routed to EL3 which will get handled at the exception vectors.
59 */
Soby Mathew47903c02015-01-13 15:48:26 +000060uint64_t tspd_handle_sp_preemption(void *handle)
61{
62 cpu_context_t *ns_cpu_context;
Soby Mathewbc912822015-09-22 12:01:18 +010063
Soby Mathew47903c02015-01-13 15:48:26 +000064 assert(handle == cm_get_context(SECURE));
65 cm_el1_sysregs_context_save(SECURE);
66 /* Get a reference to the non-secure context */
67 ns_cpu_context = cm_get_context(NON_SECURE);
68 assert(ns_cpu_context);
69
70 /*
Soby Mathew78664242015-11-13 02:08:43 +000071 * To allow Secure EL1 interrupt handler to re-enter TSP while TSP
72 * is preempted, the secure system register context which will get
73 * overwritten must be additionally saved. This is currently done
74 * by the TSPD S-EL1 interrupt handler.
75 */
76
77 /*
78 * Restore non-secure state.
Soby Mathew47903c02015-01-13 15:48:26 +000079 */
80 cm_el1_sysregs_context_restore(NON_SECURE);
81 cm_set_next_eret_context(NON_SECURE);
82
Soby Mathewbc912822015-09-22 12:01:18 +010083 /*
David Cunado28f69ab2017-04-05 11:34:03 +010084 * The TSP was preempted during execution of a Yielding SMC Call.
Soby Mathew78664242015-11-13 02:08:43 +000085 * Return back to the normal world with SMC_PREEMPTED as error
86 * code in x0.
Soby Mathewbc912822015-09-22 12:01:18 +010087 */
Soby Mathew47903c02015-01-13 15:48:26 +000088 SMC_RET1(ns_cpu_context, SMC_PREEMPTED);
89}
Soby Mathewbc912822015-09-22 12:01:18 +010090
Achin Guptaaeaab682014-05-09 13:21:31 +010091/*******************************************************************************
92 * This function is the handler registered for S-EL1 interrupts by the TSPD. It
93 * validates the interrupt and upon success arranges entry into the TSP at
Soby Mathewbec98512015-09-03 18:29:38 +010094 * 'tsp_sel1_intr_entry()' for handling the interrupt.
Madhukar Pappireddyae34f4d2020-09-18 17:50:26 -050095 * Typically, interrupts for a specific security state get handled in the same
96 * security execption level if the execution is in the same security state. For
97 * example, if a non-secure interrupt gets fired when CPU is executing in NS-EL2
98 * it gets handled in the non-secure world.
99 * However, interrupts belonging to the opposite security state typically demand
100 * a world(context) switch. This is inline with the security principle which
101 * states a secure interrupt has to be handled in the secure world.
102 * Hence, the TSPD in EL3 expects the context(handle) for a secure interrupt to
103 * be non-secure and vice versa.
104 * However, a race condition between non-secure and secure interrupts can lead to
105 * a scenario where the above assumptions do not hold true. This is demonstrated
106 * below through Note 1.
Achin Guptaaeaab682014-05-09 13:21:31 +0100107 ******************************************************************************/
108static uint64_t tspd_sel1_interrupt_handler(uint32_t id,
109 uint32_t flags,
110 void *handle,
111 void *cookie)
112{
113 uint32_t linear_id;
Achin Guptaaeaab682014-05-09 13:21:31 +0100114 tsp_context_t *tsp_ctx;
115
Madhukar Pappireddyae34f4d2020-09-18 17:50:26 -0500116 /* Get a reference to this cpu's TSP context */
117 linear_id = plat_my_core_pos();
118 tsp_ctx = &tspd_sp_context[linear_id];
119
120#if TSP_NS_INTR_ASYNC_PREEMPT
121
122 /*
123 * Note 1:
124 * Under the current interrupt routing model, interrupts from other
125 * world are routed to EL3 when TSP_NS_INTR_ASYNC_PREEMPT is enabled.
126 * Consider the following scenario:
127 * 1/ A non-secure payload(like tftf) requests a secure service from
128 * TSP by invoking a yielding SMC call.
129 * 2/ Later, execution jumps to TSP in S-EL1 with the help of TSP
130 * Dispatcher in Secure Monitor(EL3).
131 * 3/ While CPU is executing TSP, a Non-secure interrupt gets fired.
132 * this demands a context switch to the non-secure world through
133 * secure monitor.
134 * 4/ Consequently, TSP in S-EL1 get asynchronously pre-empted and
135 * execution switches to secure monitor(EL3).
136 * 5/ EL3 tries to triage the (Non-secure) interrupt based on the
137 * highest pending interrupt.
138 * 6/ However, while the NS Interrupt was pending, secure timer gets
139 * fired which makes a S-EL1 interrupt to be pending.
140 * 7/ Hence, execution jumps to this companion handler of S-EL1
141 * interrupt (i.e., tspd_sel1_interrupt_handler) even though the TSP
142 * was pre-empted due to non-secure interrupt.
143 * 8/ The above sequence of events explain how TSP was pre-empted by
144 * S-EL1 interrupt indirectly in an asynchronous way.
145 * 9/ Hence, we track the TSP pre-emption by S-EL1 interrupt using a
146 * boolean variable per each core.
147 * 10/ This helps us to indicate that SMC call for TSP service was
148 * pre-empted when execution resumes in non-secure world.
149 */
150
151 /* Check the security state when the exception was generated */
152 if (get_interrupt_src_ss(flags) == NON_SECURE) {
153 /* Sanity check the pointer to this cpu's context */
154 assert(handle == cm_get_context(NON_SECURE));
155
156 /* Save the non-secure context before entering the TSP */
157 cm_el1_sysregs_context_save(NON_SECURE);
158 tsp_ctx->preempted_by_sel1_intr = false;
159 } else {
160 /* Sanity check the pointer to this cpu's context */
161 assert(handle == cm_get_context(SECURE));
162
163 /* Save the secure context before entering the TSP for S-EL1
164 * interrupt handling
165 */
166 cm_el1_sysregs_context_save(SECURE);
167 tsp_ctx->preempted_by_sel1_intr = true;
168 }
169#else
Achin Guptaaeaab682014-05-09 13:21:31 +0100170 /* Check the security state when the exception was generated */
171 assert(get_interrupt_src_ss(flags) == NON_SECURE);
172
Achin Guptaaeaab682014-05-09 13:21:31 +0100173 /* Sanity check the pointer to this cpu's context */
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100174 assert(handle == cm_get_context(NON_SECURE));
Achin Guptaaeaab682014-05-09 13:21:31 +0100175
176 /* Save the non-secure context before entering the TSP */
177 cm_el1_sysregs_context_save(NON_SECURE);
Madhukar Pappireddyae34f4d2020-09-18 17:50:26 -0500178#endif
Achin Guptaaeaab682014-05-09 13:21:31 +0100179
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100180 assert(&tsp_ctx->cpu_ctx == cm_get_context(SECURE));
Achin Guptaaeaab682014-05-09 13:21:31 +0100181
182 /*
183 * Determine if the TSP was previously preempted. Its last known
184 * context has to be preserved in this case.
185 * The TSP should return control to the TSPD after handling this
Soby Mathewbec98512015-09-03 18:29:38 +0100186 * S-EL1 interrupt. Preserve essential EL3 context to allow entry into
187 * the TSP at the S-EL1 interrupt entry point using the 'cpu_context'
188 * structure. There is no need to save the secure system register
189 * context since the TSP is supposed to preserve it during S-EL1
190 * interrupt handling.
Achin Guptaaeaab682014-05-09 13:21:31 +0100191 */
David Cunado28f69ab2017-04-05 11:34:03 +0100192 if (get_yield_smc_active_flag(tsp_ctx->state)) {
Zelalem91d80612020-02-12 10:37:03 -0600193 tsp_ctx->saved_spsr_el3 = (uint32_t)SMC_GET_EL3(&tsp_ctx->cpu_ctx,
Achin Guptaaeaab682014-05-09 13:21:31 +0100194 CTX_SPSR_EL3);
195 tsp_ctx->saved_elr_el3 = SMC_GET_EL3(&tsp_ctx->cpu_ctx,
196 CTX_ELR_EL3);
Soby Mathewbec98512015-09-03 18:29:38 +0100197#if TSP_NS_INTR_ASYNC_PREEMPT
Soby Mathew47903c02015-01-13 15:48:26 +0000198 memcpy(&tsp_ctx->sp_ctx, &tsp_ctx->cpu_ctx, TSPD_SP_CTX_SIZE);
199#endif
Achin Guptaaeaab682014-05-09 13:21:31 +0100200 }
201
Achin Guptaaeaab682014-05-09 13:21:31 +0100202 cm_el1_sysregs_context_restore(SECURE);
Soby Mathewbec98512015-09-03 18:29:38 +0100203 cm_set_elr_spsr_el3(SECURE, (uint64_t) &tsp_vectors->sel1_intr_entry,
Andrew Thoelke4e126072014-06-04 21:10:52 +0100204 SPSR_64(MODE_EL1, MODE_SP_ELX, DISABLE_ALL_EXCEPTIONS));
Soby Mathew47903c02015-01-13 15:48:26 +0000205
Achin Guptaaeaab682014-05-09 13:21:31 +0100206 cm_set_next_eret_context(SECURE);
207
208 /*
Soby Mathewbec98512015-09-03 18:29:38 +0100209 * Tell the TSP that it has to handle a S-EL1 interrupt synchronously.
210 * Also the instruction in normal world where the interrupt was
211 * generated is passed for debugging purposes. It is safe to retrieve
212 * this address from ELR_EL3 as the secure context will not take effect
213 * until el3_exit().
Achin Guptaaeaab682014-05-09 13:21:31 +0100214 */
Soby Mathewbec98512015-09-03 18:29:38 +0100215 SMC_RET2(&tsp_ctx->cpu_ctx, TSP_HANDLE_SEL1_INTR_AND_RETURN, read_elr_el3());
Achin Guptaaeaab682014-05-09 13:21:31 +0100216}
Soby Mathew47903c02015-01-13 15:48:26 +0000217
Soby Mathewbec98512015-09-03 18:29:38 +0100218#if TSP_NS_INTR_ASYNC_PREEMPT
Soby Mathew47903c02015-01-13 15:48:26 +0000219/*******************************************************************************
Soby Mathewbec98512015-09-03 18:29:38 +0100220 * This function is the handler registered for Non secure interrupts by the
221 * TSPD. It validates the interrupt and upon success arranges entry into the
222 * normal world for handling the interrupt.
Soby Mathew47903c02015-01-13 15:48:26 +0000223 ******************************************************************************/
224static uint64_t tspd_ns_interrupt_handler(uint32_t id,
225 uint32_t flags,
226 void *handle,
227 void *cookie)
228{
229 /* Check the security state when the exception was generated */
230 assert(get_interrupt_src_ss(flags) == SECURE);
231
Soby Mathew47903c02015-01-13 15:48:26 +0000232 /*
233 * Disable the routing of NS interrupts from secure world to EL3 while
234 * interrupted on this core.
235 */
236 disable_intr_rm_local(INTR_TYPE_NS, SECURE);
237
238 return tspd_handle_sp_preemption(handle);
239}
240#endif
Jeenu Viswambharan7f366602014-02-20 17:11:00 +0000241
Achin Gupta375f5382014-02-18 18:12:48 +0000242/*******************************************************************************
243 * Secure Payload Dispatcher setup. The SPD finds out the SP entrypoint and type
244 * (aarch32/aarch64) if not already known and initialises the context for entry
245 * into the SP for its initialisation.
246 ******************************************************************************/
Masahiro Yamada56212752018-04-19 01:14:42 +0900247static int32_t tspd_setup(void)
Achin Gupta375f5382014-02-18 18:12:48 +0000248{
Vikram Kanigiri9d70f0f2014-07-15 16:46:43 +0100249 entry_point_info_t *tsp_ep_info;
Achin Gupta375f5382014-02-18 18:12:48 +0000250 uint32_t linear_id;
251
Soby Mathewda43b662015-07-08 21:45:46 +0100252 linear_id = plat_my_core_pos();
Achin Gupta375f5382014-02-18 18:12:48 +0000253
254 /*
255 * Get information about the Secure Payload (BL32) image. Its
256 * absence is a critical failure. TODO: Add support to
257 * conditionally include the SPD service
258 */
Vikram Kanigiri9d70f0f2014-07-15 16:46:43 +0100259 tsp_ep_info = bl31_plat_get_next_image_ep_info(SECURE);
260 if (!tsp_ep_info) {
261 WARN("No TSP provided by BL2 boot loader, Booting device"
262 " without TSP initialization. SMC`s destined for TSP"
263 " will return SMC_UNK\n");
264 return 1;
265 }
Achin Gupta375f5382014-02-18 18:12:48 +0000266
267 /*
Jeenu Viswambharan7f366602014-02-20 17:11:00 +0000268 * If there's no valid entry point for SP, we return a non-zero value
269 * signalling failure initializing the service. We bail out without
270 * registering any handlers
271 */
Vikram Kanigiri9d70f0f2014-07-15 16:46:43 +0100272 if (!tsp_ep_info->pc)
Jeenu Viswambharan7f366602014-02-20 17:11:00 +0000273 return 1;
274
275 /*
Sandrine Bailleuxf4119ec2015-12-17 13:58:58 +0000276 * We could inspect the SP image and determine its execution
Achin Gupta375f5382014-02-18 18:12:48 +0000277 * state i.e whether AArch32 or AArch64. Assuming it's AArch64
278 * for the time being.
279 */
Vikram Kanigiri9d70f0f2014-07-15 16:46:43 +0100280 tspd_init_tsp_ep_state(tsp_ep_info,
281 TSP_AARCH64,
282 tsp_ep_info->pc,
283 &tspd_sp_context[linear_id]);
Achin Gupta375f5382014-02-18 18:12:48 +0000284
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100285#if TSP_INIT_ASYNC
286 bl31_set_next_image_type(SECURE);
287#else
Jeenu Viswambharan7f366602014-02-20 17:11:00 +0000288 /*
289 * All TSPD initialization done. Now register our init function with
290 * BL31 for deferred invocation
291 */
292 bl31_register_bl32_init(&tspd_init);
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100293#endif
Vikram Kanigiri9d70f0f2014-07-15 16:46:43 +0100294 return 0;
Achin Gupta375f5382014-02-18 18:12:48 +0000295}
296
297/*******************************************************************************
298 * This function passes control to the Secure Payload image (BL32) for the first
299 * time on the primary cpu after a cold boot. It assumes that a valid secure
300 * context has already been created by tspd_setup() which can be directly used.
301 * It also assumes that a valid non-secure context has been initialised by PSCI
302 * so it does not need to save and restore any non-secure state. This function
303 * performs a synchronous entry into the Secure payload. The SP passes control
Vikram Kanigirid8c9d262014-05-16 18:48:12 +0100304 * back to this routine through a SMC.
Achin Gupta375f5382014-02-18 18:12:48 +0000305 ******************************************************************************/
Vikram Kanigirid8c9d262014-05-16 18:48:12 +0100306int32_t tspd_init(void)
Achin Gupta375f5382014-02-18 18:12:48 +0000307{
Soby Mathewda43b662015-07-08 21:45:46 +0100308 uint32_t linear_id = plat_my_core_pos();
Dan Handleye2712bc2014-04-10 15:37:22 +0100309 tsp_context_t *tsp_ctx = &tspd_sp_context[linear_id];
Vikram Kanigiri9d70f0f2014-07-15 16:46:43 +0100310 entry_point_info_t *tsp_entry_point;
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100311 uint64_t rc;
Vikram Kanigiri9d70f0f2014-07-15 16:46:43 +0100312
313 /*
314 * Get information about the Secure Payload (BL32) image. Its
315 * absence is a critical failure.
316 */
317 tsp_entry_point = bl31_plat_get_next_image_ep_info(SECURE);
318 assert(tsp_entry_point);
319
Soby Mathewda43b662015-07-08 21:45:46 +0100320 cm_init_my_context(tsp_entry_point);
Achin Gupta375f5382014-02-18 18:12:48 +0000321
322 /*
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100323 * Arrange for an entry into the test secure payload. It will be
324 * returned via TSP_ENTRY_DONE case
Achin Gupta607084e2014-02-09 18:24:19 +0000325 */
Achin Gupta375f5382014-02-18 18:12:48 +0000326 rc = tspd_synchronous_sp_entry(tsp_ctx);
327 assert(rc != 0);
Achin Guptaaeaab682014-05-09 13:21:31 +0100328
Achin Gupta375f5382014-02-18 18:12:48 +0000329 return rc;
330}
331
Jeenu Viswambharan7f366602014-02-20 17:11:00 +0000332
Achin Gupta375f5382014-02-18 18:12:48 +0000333/*******************************************************************************
334 * This function is responsible for handling all SMCs in the Trusted OS/App
335 * range from the non-secure state as defined in the SMC Calling Convention
336 * Document. It is also responsible for communicating with the Secure payload
337 * to delegate work and return results back to the non-secure state. Lastly it
338 * will also return any information that the secure payload needs to do the
339 * work assigned to it.
340 ******************************************************************************/
Masahiro Yamada5ac9d962018-04-19 01:18:48 +0900341static uintptr_t tspd_smc_handler(uint32_t smc_fid,
342 u_register_t x1,
343 u_register_t x2,
344 u_register_t x3,
345 u_register_t x4,
Achin Gupta375f5382014-02-18 18:12:48 +0000346 void *cookie,
347 void *handle,
Masahiro Yamada5ac9d962018-04-19 01:18:48 +0900348 u_register_t flags)
Achin Gupta375f5382014-02-18 18:12:48 +0000349{
Dan Handleye2712bc2014-04-10 15:37:22 +0100350 cpu_context_t *ns_cpu_context;
Soby Mathewda43b662015-07-08 21:45:46 +0100351 uint32_t linear_id = plat_my_core_pos(), ns;
Dan Handleye2712bc2014-04-10 15:37:22 +0100352 tsp_context_t *tsp_ctx = &tspd_sp_context[linear_id];
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100353 uint64_t rc;
354#if TSP_INIT_ASYNC
355 entry_point_info_t *next_image_info;
356#endif
Achin Gupta375f5382014-02-18 18:12:48 +0000357
358 /* Determine which security state this SMC originated from */
359 ns = is_caller_non_secure(flags);
360
361 switch (smc_fid) {
362
363 /*
Soby Mathew9f71f702014-05-09 20:49:17 +0100364 * This function ID is used by TSP to indicate that it was
365 * preempted by a normal world IRQ.
366 *
367 */
368 case TSP_PREEMPTED:
369 if (ns)
370 SMC_RET1(handle, SMC_UNK);
371
Soby Mathew47903c02015-01-13 15:48:26 +0000372 return tspd_handle_sp_preemption(handle);
Soby Mathew9f71f702014-05-09 20:49:17 +0100373
374 /*
Achin Guptaaeaab682014-05-09 13:21:31 +0100375 * This function ID is used only by the TSP to indicate that it has
Soby Mathew78664242015-11-13 02:08:43 +0000376 * finished handling a S-EL1 interrupt or was preempted by a higher
377 * priority pending EL3 interrupt. Execution should resume
Achin Guptaaeaab682014-05-09 13:21:31 +0100378 * in the normal world.
379 */
Soby Mathewbec98512015-09-03 18:29:38 +0100380 case TSP_HANDLED_S_EL1_INTR:
Achin Guptaaeaab682014-05-09 13:21:31 +0100381 if (ns)
382 SMC_RET1(handle, SMC_UNK);
383
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100384 assert(handle == cm_get_context(SECURE));
Achin Guptaaeaab682014-05-09 13:21:31 +0100385
386 /*
387 * Restore the relevant EL3 state which saved to service
388 * this SMC.
389 */
David Cunado28f69ab2017-04-05 11:34:03 +0100390 if (get_yield_smc_active_flag(tsp_ctx->state)) {
Achin Guptaaeaab682014-05-09 13:21:31 +0100391 SMC_SET_EL3(&tsp_ctx->cpu_ctx,
392 CTX_SPSR_EL3,
393 tsp_ctx->saved_spsr_el3);
394 SMC_SET_EL3(&tsp_ctx->cpu_ctx,
395 CTX_ELR_EL3,
396 tsp_ctx->saved_elr_el3);
Soby Mathewbec98512015-09-03 18:29:38 +0100397#if TSP_NS_INTR_ASYNC_PREEMPT
Soby Mathew47903c02015-01-13 15:48:26 +0000398 /*
399 * Need to restore the previously interrupted
400 * secure context.
401 */
402 memcpy(&tsp_ctx->cpu_ctx, &tsp_ctx->sp_ctx,
403 TSPD_SP_CTX_SIZE);
404#endif
Achin Guptaaeaab682014-05-09 13:21:31 +0100405 }
406
407 /* Get a reference to the non-secure context */
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100408 ns_cpu_context = cm_get_context(NON_SECURE);
Achin Guptaaeaab682014-05-09 13:21:31 +0100409 assert(ns_cpu_context);
410
411 /*
412 * Restore non-secure state. There is no need to save the
413 * secure system register context since the TSP was supposed
414 * to preserve it during S-EL1 interrupt handling.
415 */
416 cm_el1_sysregs_context_restore(NON_SECURE);
417 cm_set_next_eret_context(NON_SECURE);
418
Madhukar Pappireddyae34f4d2020-09-18 17:50:26 -0500419 /* Refer to Note 1 in function tspd_sel1_interrupt_handler()*/
420#if TSP_NS_INTR_ASYNC_PREEMPT
421 if (tsp_ctx->preempted_by_sel1_intr) {
422 /* Reset the flag */
423 tsp_ctx->preempted_by_sel1_intr = false;
424
425 SMC_RET1(ns_cpu_context, SMC_PREEMPTED);
426 } else {
427 SMC_RET0((uint64_t) ns_cpu_context);
428 }
429#else
Achin Guptaaeaab682014-05-09 13:21:31 +0100430 SMC_RET0((uint64_t) ns_cpu_context);
Madhukar Pappireddyae34f4d2020-09-18 17:50:26 -0500431#endif
432
Achin Guptaaeaab682014-05-09 13:21:31 +0100433
Achin Guptaaeaab682014-05-09 13:21:31 +0100434 /*
Achin Gupta375f5382014-02-18 18:12:48 +0000435 * This function ID is used only by the SP to indicate it has
436 * finished initialising itself after a cold boot
437 */
438 case TSP_ENTRY_DONE:
439 if (ns)
440 SMC_RET1(handle, SMC_UNK);
441
442 /*
443 * Stash the SP entry points information. This is done
444 * only once on the primary cpu
445 */
Andrew Thoelke891c4ca2014-05-20 21:43:27 +0100446 assert(tsp_vectors == NULL);
447 tsp_vectors = (tsp_vectors_t *) x1;
Achin Gupta375f5382014-02-18 18:12:48 +0000448
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100449 if (tsp_vectors) {
450 set_tsp_pstate(tsp_ctx->state, TSP_PSTATE_ON);
451
452 /*
453 * TSP has been successfully initialized. Register power
Paul Beesley1fbc97b2019-01-11 18:26:51 +0000454 * management hooks with PSCI
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100455 */
456 psci_register_spd_pm_hook(&tspd_pm);
457
458 /*
459 * Register an interrupt handler for S-EL1 interrupts
460 * when generated during code executing in the
461 * non-secure state.
462 */
463 flags = 0;
464 set_interrupt_rm_flag(flags, NON_SECURE);
465 rc = register_interrupt_type_handler(INTR_TYPE_S_EL1,
466 tspd_sel1_interrupt_handler,
467 flags);
468 if (rc)
469 panic();
Soby Mathew47903c02015-01-13 15:48:26 +0000470
Soby Mathewbec98512015-09-03 18:29:38 +0100471#if TSP_NS_INTR_ASYNC_PREEMPT
Soby Mathew47903c02015-01-13 15:48:26 +0000472 /*
473 * Register an interrupt handler for NS interrupts when
474 * generated during code executing in secure state are
475 * routed to EL3.
476 */
477 flags = 0;
478 set_interrupt_rm_flag(flags, SECURE);
479
480 rc = register_interrupt_type_handler(INTR_TYPE_NS,
481 tspd_ns_interrupt_handler,
482 flags);
483 if (rc)
484 panic();
485
486 /*
Soby Mathewbc912822015-09-22 12:01:18 +0100487 * Disable the NS interrupt locally.
Soby Mathew47903c02015-01-13 15:48:26 +0000488 */
489 disable_intr_rm_local(INTR_TYPE_NS, SECURE);
490#endif
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100491 }
492
493
494#if TSP_INIT_ASYNC
495 /* Save the Secure EL1 system register context */
496 assert(cm_get_context(SECURE) == &tsp_ctx->cpu_ctx);
497 cm_el1_sysregs_context_save(SECURE);
498
499 /* Program EL3 registers to enable entry into the next EL */
500 next_image_info = bl31_plat_get_next_image_ep_info(NON_SECURE);
501 assert(next_image_info);
502 assert(NON_SECURE ==
503 GET_SECURITY_STATE(next_image_info->h.attr));
504
Soby Mathewda43b662015-07-08 21:45:46 +0100505 cm_init_my_context(next_image_info);
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100506 cm_prepare_el3_exit(NON_SECURE);
507 SMC_RET0(cm_get_context(NON_SECURE));
508#else
Achin Gupta375f5382014-02-18 18:12:48 +0000509 /*
510 * SP reports completion. The SPD must have initiated
511 * the original request through a synchronous entry
512 * into the SP. Jump back to the original C runtime
513 * context.
514 */
Achin Gupta916a2c12014-02-09 23:11:46 +0000515 tspd_synchronous_sp_exit(tsp_ctx, x1);
Jonathan Wright75a5d8b2018-03-14 15:56:21 +0000516 break;
Vikram Kanigiri4e813412014-07-15 16:49:22 +0100517#endif
Douglas Raillardf2129652016-11-24 15:43:19 +0000518 /*
519 * This function ID is used only by the SP to indicate it has finished
David Cunado28f69ab2017-04-05 11:34:03 +0100520 * aborting a preempted Yielding SMC Call.
Douglas Raillardf2129652016-11-24 15:43:19 +0000521 */
522 case TSP_ABORT_DONE:
Achin Gupta375f5382014-02-18 18:12:48 +0000523
Achin Gupta607084e2014-02-09 18:24:19 +0000524 /*
Sandrine Bailleuxf4119ec2015-12-17 13:58:58 +0000525 * These function IDs are used only by the SP to indicate it has
Achin Gupta607084e2014-02-09 18:24:19 +0000526 * finished:
527 * 1. turning itself on in response to an earlier psci
528 * cpu_on request
529 * 2. resuming itself after an earlier psci cpu_suspend
530 * request.
531 */
532 case TSP_ON_DONE:
533 case TSP_RESUME_DONE:
534
535 /*
Sandrine Bailleuxf4119ec2015-12-17 13:58:58 +0000536 * These function IDs are used only by the SP to indicate it has
Achin Gupta607084e2014-02-09 18:24:19 +0000537 * finished:
538 * 1. suspending itself after an earlier psci cpu_suspend
539 * request.
540 * 2. turning itself off in response to an earlier psci
541 * cpu_off request.
542 */
543 case TSP_OFF_DONE:
544 case TSP_SUSPEND_DONE:
Juan Castillo4dc4a472014-08-12 11:17:06 +0100545 case TSP_SYSTEM_OFF_DONE:
546 case TSP_SYSTEM_RESET_DONE:
Achin Gupta607084e2014-02-09 18:24:19 +0000547 if (ns)
548 SMC_RET1(handle, SMC_UNK);
549
550 /*
551 * SP reports completion. The SPD must have initiated the
552 * original request through a synchronous entry into the SP.
553 * Jump back to the original C runtime context, and pass x1 as
554 * return value to the caller
555 */
Achin Gupta916a2c12014-02-09 23:11:46 +0000556 tspd_synchronous_sp_exit(tsp_ctx, x1);
Jonathan Wright75a5d8b2018-03-14 15:56:21 +0000557 break;
Achin Gupta607084e2014-02-09 18:24:19 +0000558
Achin Gupta916a2c12014-02-09 23:11:46 +0000559 /*
560 * Request from non-secure client to perform an
561 * arithmetic operation or response from secure
562 * payload to an earlier request.
563 */
Soby Mathew9f71f702014-05-09 20:49:17 +0100564 case TSP_FAST_FID(TSP_ADD):
565 case TSP_FAST_FID(TSP_SUB):
566 case TSP_FAST_FID(TSP_MUL):
567 case TSP_FAST_FID(TSP_DIV):
568
David Cunado28f69ab2017-04-05 11:34:03 +0100569 case TSP_YIELD_FID(TSP_ADD):
570 case TSP_YIELD_FID(TSP_SUB):
571 case TSP_YIELD_FID(TSP_MUL):
572 case TSP_YIELD_FID(TSP_DIV):
Achin Gupta916a2c12014-02-09 23:11:46 +0000573 if (ns) {
574 /*
575 * This is a fresh request from the non-secure client.
576 * The parameters are in x1 and x2. Figure out which
577 * registers need to be preserved, save the non-secure
578 * state and send the request to the secure payload.
579 */
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100580 assert(handle == cm_get_context(NON_SECURE));
Soby Mathew9f71f702014-05-09 20:49:17 +0100581
582 /* Check if we are already preempted */
David Cunado28f69ab2017-04-05 11:34:03 +0100583 if (get_yield_smc_active_flag(tsp_ctx->state))
Soby Mathew9f71f702014-05-09 20:49:17 +0100584 SMC_RET1(handle, SMC_UNK);
585
Achin Gupta916a2c12014-02-09 23:11:46 +0000586 cm_el1_sysregs_context_save(NON_SECURE);
587
588 /* Save x1 and x2 for use by TSP_GET_ARGS call below */
Soby Mathew9f71f702014-05-09 20:49:17 +0100589 store_tsp_args(tsp_ctx, x1, x2);
Achin Gupta916a2c12014-02-09 23:11:46 +0000590
591 /*
592 * We are done stashing the non-secure context. Ask the
593 * secure payload to do the work now.
594 */
595
596 /*
597 * Verify if there is a valid context to use, copy the
598 * operation type and parameters to the secure context
599 * and jump to the fast smc entry point in the secure
600 * payload. Entry into S-EL1 will take place upon exit
601 * from this function.
602 */
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100603 assert(&tsp_ctx->cpu_ctx == cm_get_context(SECURE));
Soby Mathew9f71f702014-05-09 20:49:17 +0100604
605 /* Set appropriate entry for SMC.
606 * We expect the TSP to manage the PSTATE.I and PSTATE.F
607 * flags as appropriate.
608 */
609 if (GET_SMC_TYPE(smc_fid) == SMC_TYPE_FAST) {
610 cm_set_elr_el3(SECURE, (uint64_t)
Andrew Thoelke891c4ca2014-05-20 21:43:27 +0100611 &tsp_vectors->fast_smc_entry);
Soby Mathew9f71f702014-05-09 20:49:17 +0100612 } else {
David Cunado28f69ab2017-04-05 11:34:03 +0100613 set_yield_smc_active_flag(tsp_ctx->state);
Soby Mathew9f71f702014-05-09 20:49:17 +0100614 cm_set_elr_el3(SECURE, (uint64_t)
David Cunado28f69ab2017-04-05 11:34:03 +0100615 &tsp_vectors->yield_smc_entry);
Soby Mathewbec98512015-09-03 18:29:38 +0100616#if TSP_NS_INTR_ASYNC_PREEMPT
Soby Mathew47903c02015-01-13 15:48:26 +0000617 /*
618 * Enable the routing of NS interrupts to EL3
David Cunado28f69ab2017-04-05 11:34:03 +0100619 * during processing of a Yielding SMC Call on
620 * this core.
Soby Mathew47903c02015-01-13 15:48:26 +0000621 */
622 enable_intr_rm_local(INTR_TYPE_NS, SECURE);
623#endif
Jeenu Viswambharan339580c2018-01-10 15:22:49 +0000624
625#if EL3_EXCEPTION_HANDLING
626 /*
627 * With EL3 exception handling, while an SMC is
628 * being processed, Non-secure interrupts can't
629 * preempt Secure execution. However, for
630 * yielding SMCs, we want preemption to happen;
631 * so explicitly allow NS preemption in this
Jeenu Viswambharanabf5b062018-01-22 12:42:54 +0000632 * case, and supply the preemption return code
633 * for TSP.
Jeenu Viswambharan339580c2018-01-10 15:22:49 +0000634 */
Jeenu Viswambharanabf5b062018-01-22 12:42:54 +0000635 ehf_allow_ns_preemption(TSP_PREEMPTED);
Jeenu Viswambharan339580c2018-01-10 15:22:49 +0000636#endif
Soby Mathew9f71f702014-05-09 20:49:17 +0100637 }
638
Achin Gupta916a2c12014-02-09 23:11:46 +0000639 cm_el1_sysregs_context_restore(SECURE);
640 cm_set_next_eret_context(SECURE);
Soby Mathew9f71f702014-05-09 20:49:17 +0100641 SMC_RET3(&tsp_ctx->cpu_ctx, smc_fid, x1, x2);
Achin Gupta916a2c12014-02-09 23:11:46 +0000642 } else {
643 /*
644 * This is the result from the secure client of an
Soby Mathew9f71f702014-05-09 20:49:17 +0100645 * earlier request. The results are in x1-x3. Copy it
Achin Gupta916a2c12014-02-09 23:11:46 +0000646 * into the non-secure context, save the secure state
647 * and return to the non-secure state.
648 */
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100649 assert(handle == cm_get_context(SECURE));
Achin Gupta916a2c12014-02-09 23:11:46 +0000650 cm_el1_sysregs_context_save(SECURE);
651
652 /* Get a reference to the non-secure context */
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100653 ns_cpu_context = cm_get_context(NON_SECURE);
Achin Gupta916a2c12014-02-09 23:11:46 +0000654 assert(ns_cpu_context);
Achin Gupta916a2c12014-02-09 23:11:46 +0000655
656 /* Restore non-secure state */
657 cm_el1_sysregs_context_restore(NON_SECURE);
658 cm_set_next_eret_context(NON_SECURE);
David Cunado28f69ab2017-04-05 11:34:03 +0100659 if (GET_SMC_TYPE(smc_fid) == SMC_TYPE_YIELD) {
660 clr_yield_smc_active_flag(tsp_ctx->state);
Soby Mathewbec98512015-09-03 18:29:38 +0100661#if TSP_NS_INTR_ASYNC_PREEMPT
Soby Mathew47903c02015-01-13 15:48:26 +0000662 /*
663 * Disable the routing of NS interrupts to EL3
David Cunado28f69ab2017-04-05 11:34:03 +0100664 * after processing of a Yielding SMC Call on
665 * this core is finished.
Soby Mathew47903c02015-01-13 15:48:26 +0000666 */
667 disable_intr_rm_local(INTR_TYPE_NS, SECURE);
668#endif
669 }
670
Soby Mathew9f71f702014-05-09 20:49:17 +0100671 SMC_RET3(ns_cpu_context, x1, x2, x3);
Achin Gupta916a2c12014-02-09 23:11:46 +0000672 }
Daniel Boulby8942a1b2018-06-22 14:16:03 +0100673 assert(0); /* Unreachable */
Achin Gupta916a2c12014-02-09 23:11:46 +0000674
Douglas Raillardf2129652016-11-24 15:43:19 +0000675 /*
David Cunado28f69ab2017-04-05 11:34:03 +0100676 * Request from the non-secure world to abort a preempted Yielding SMC
677 * Call.
Douglas Raillardf2129652016-11-24 15:43:19 +0000678 */
679 case TSP_FID_ABORT:
680 /* ABORT should only be invoked by normal world */
681 if (!ns) {
682 assert(0);
683 break;
684 }
685
Douglas Raillardbcc3dd32017-02-03 18:01:51 +0000686 assert(handle == cm_get_context(NON_SECURE));
687 cm_el1_sysregs_context_save(NON_SECURE);
688
Douglas Raillardf2129652016-11-24 15:43:19 +0000689 /* Abort the preempted SMC request */
Douglas Raillardbcc3dd32017-02-03 18:01:51 +0000690 if (!tspd_abort_preempted_smc(tsp_ctx)) {
Douglas Raillardf2129652016-11-24 15:43:19 +0000691 /*
692 * If there was no preempted SMC to abort, return
693 * SMC_UNK.
Douglas Raillardbcc3dd32017-02-03 18:01:51 +0000694 *
695 * Restoring the NON_SECURE context is not necessary as
696 * the synchronous entry did not take place if the
697 * return code of tspd_abort_preempted_smc is zero.
Douglas Raillardf2129652016-11-24 15:43:19 +0000698 */
Douglas Raillardbcc3dd32017-02-03 18:01:51 +0000699 cm_set_next_eret_context(NON_SECURE);
700 break;
701 }
Douglas Raillardf2129652016-11-24 15:43:19 +0000702
Douglas Raillardbcc3dd32017-02-03 18:01:51 +0000703 cm_el1_sysregs_context_restore(NON_SECURE);
704 cm_set_next_eret_context(NON_SECURE);
Antonio Nino Diazacb29142017-04-04 17:08:32 +0100705 SMC_RET1(handle, SMC_OK);
Achin Gupta916a2c12014-02-09 23:11:46 +0000706
707 /*
Soby Mathew9f71f702014-05-09 20:49:17 +0100708 * Request from non secure world to resume the preempted
David Cunado28f69ab2017-04-05 11:34:03 +0100709 * Yielding SMC Call.
Soby Mathew9f71f702014-05-09 20:49:17 +0100710 */
711 case TSP_FID_RESUME:
Soby Mathew3d578512014-05-27 10:20:01 +0100712 /* RESUME should be invoked only by normal world */
713 if (!ns) {
714 assert(0);
715 break;
716 }
Soby Mathew9f71f702014-05-09 20:49:17 +0100717
Soby Mathew3d578512014-05-27 10:20:01 +0100718 /*
719 * This is a resume request from the non-secure client.
720 * save the non-secure state and send the request to
721 * the secure payload.
722 */
Andrew Thoelkea2f65532014-05-14 17:09:32 +0100723 assert(handle == cm_get_context(NON_SECURE));
Soby Mathew9f71f702014-05-09 20:49:17 +0100724
Soby Mathew3d578512014-05-27 10:20:01 +0100725 /* Check if we are already preempted before resume */
David Cunado28f69ab2017-04-05 11:34:03 +0100726 if (!get_yield_smc_active_flag(tsp_ctx->state))
Soby Mathew3d578512014-05-27 10:20:01 +0100727 SMC_RET1(handle, SMC_UNK);
Soby Mathew9f71f702014-05-09 20:49:17 +0100728
Soby Mathew3d578512014-05-27 10:20:01 +0100729 cm_el1_sysregs_context_save(NON_SECURE);
Soby Mathew9f71f702014-05-09 20:49:17 +0100730
Soby Mathew3d578512014-05-27 10:20:01 +0100731 /*
732 * We are done stashing the non-secure context. Ask the
733 * secure payload to do the work now.
734 */
Soby Mathewbec98512015-09-03 18:29:38 +0100735#if TSP_NS_INTR_ASYNC_PREEMPT
Soby Mathew47903c02015-01-13 15:48:26 +0000736 /*
737 * Enable the routing of NS interrupts to EL3 during resumption
David Cunado28f69ab2017-04-05 11:34:03 +0100738 * of a Yielding SMC Call on this core.
Soby Mathew47903c02015-01-13 15:48:26 +0000739 */
740 enable_intr_rm_local(INTR_TYPE_NS, SECURE);
741#endif
742
Jeenu Viswambharan339580c2018-01-10 15:22:49 +0000743#if EL3_EXCEPTION_HANDLING
744 /*
745 * Allow the resumed yielding SMC processing to be preempted by
Jeenu Viswambharanabf5b062018-01-22 12:42:54 +0000746 * Non-secure interrupts. Also, supply the preemption return
747 * code for TSP.
Jeenu Viswambharan339580c2018-01-10 15:22:49 +0000748 */
Jeenu Viswambharanabf5b062018-01-22 12:42:54 +0000749 ehf_allow_ns_preemption(TSP_PREEMPTED);
Jeenu Viswambharan339580c2018-01-10 15:22:49 +0000750#endif
Soby Mathew9f71f702014-05-09 20:49:17 +0100751
Soby Mathew3d578512014-05-27 10:20:01 +0100752 /* We just need to return to the preempted point in
753 * TSP and the execution will resume as normal.
754 */
755 cm_el1_sysregs_context_restore(SECURE);
756 cm_set_next_eret_context(SECURE);
757 SMC_RET0(&tsp_ctx->cpu_ctx);
Soby Mathew9f71f702014-05-09 20:49:17 +0100758
759 /*
Achin Gupta916a2c12014-02-09 23:11:46 +0000760 * This is a request from the secure payload for more arguments
761 * for an ongoing arithmetic operation requested by the
762 * non-secure world. Simply return the arguments from the non-
763 * secure client in the original call.
764 */
765 case TSP_GET_ARGS:
766 if (ns)
767 SMC_RET1(handle, SMC_UNK);
768
Soby Mathew9f71f702014-05-09 20:49:17 +0100769 get_tsp_args(tsp_ctx, x1, x2);
770 SMC_RET2(handle, x1, x2);
Achin Gupta916a2c12014-02-09 23:11:46 +0000771
Jeenu Viswambharandf1ddb52014-02-28 11:23:35 +0000772 case TOS_CALL_COUNT:
773 /*
774 * Return the number of service function IDs implemented to
775 * provide service to non-secure
776 */
777 SMC_RET1(handle, TSP_NUM_FID);
778
779 case TOS_UID:
780 /* Return TSP UID to the caller */
781 SMC_UUID_RET(handle, tsp_uuid);
782
783 case TOS_CALL_VERSION:
784 /* Return the version of current implementation */
785 SMC_RET2(handle, TSP_VERSION_MAJOR, TSP_VERSION_MINOR);
786
Achin Gupta375f5382014-02-18 18:12:48 +0000787 default:
Achin Gupta607084e2014-02-09 18:24:19 +0000788 break;
Achin Gupta375f5382014-02-18 18:12:48 +0000789 }
790
Achin Gupta607084e2014-02-09 18:24:19 +0000791 SMC_RET1(handle, SMC_UNK);
Achin Gupta375f5382014-02-18 18:12:48 +0000792}
793
Soby Mathew9f71f702014-05-09 20:49:17 +0100794/* Define a SPD runtime service descriptor for fast SMC calls */
Achin Gupta375f5382014-02-18 18:12:48 +0000795DECLARE_RT_SVC(
Soby Mathew9f71f702014-05-09 20:49:17 +0100796 tspd_fast,
Achin Gupta375f5382014-02-18 18:12:48 +0000797
798 OEN_TOS_START,
799 OEN_TOS_END,
800 SMC_TYPE_FAST,
801 tspd_setup,
802 tspd_smc_handler
803);
Soby Mathew9f71f702014-05-09 20:49:17 +0100804
David Cunado28f69ab2017-04-05 11:34:03 +0100805/* Define a SPD runtime service descriptor for Yielding SMC Calls */
Soby Mathew9f71f702014-05-09 20:49:17 +0100806DECLARE_RT_SVC(
807 tspd_std,
808
809 OEN_TOS_START,
810 OEN_TOS_END,
David Cunado28f69ab2017-04-05 11:34:03 +0100811 SMC_TYPE_YIELD,
Soby Mathew9f71f702014-05-09 20:49:17 +0100812 NULL,
813 tspd_smc_handler
814);