mirror of
https://github.com/ARM-software/arm-trusted-firmware.git
synced 2025-04-16 09:34:18 +00:00
Merge changes from topic "provencore-spd" into integration
* changes: feat(zynqmp): add support for ProvenCore feat(services): add a SPD for ProvenCore feat(gic): add APIs to raise NS and S-EL1 SGIs
This commit is contained in:
Joanna Farley
TrustedFirmware Code Review
commit
b86cbe10d2
22 changed files with 926 additions and 14 deletions
|
|
@ -46,8 +46,8 @@ Current features
|
|||
- A Test SP and SPD to demonstrate AArch64 Secure Monitor functionality and SP
|
||||
interaction with PSCI.
|
||||
|
||||
- SPDs for the `OP-TEE Secure OS`_, `NVIDIA Trusted Little Kernel`_
|
||||
and `Trusty Secure OS`_.
|
||||
- SPDs for the `OP-TEE Secure OS`_, `NVIDIA Trusted Little Kernel`_,
|
||||
`Trusty Secure OS`_ and `ProvenCore Secure OS`_.
|
||||
|
||||
- A Trusted Board Boot implementation, conforming to all mandatory TBBR
|
||||
requirements. This includes image authentication, Firmware Update (or
|
||||
|
|
@ -121,6 +121,7 @@ Still to come
|
|||
.. _OP-TEE Secure OS: https://github.com/OP-TEE/optee_os
|
||||
.. _NVIDIA Trusted Little Kernel: http://nv-tegra.nvidia.com/gitweb/?p=3rdparty/ote_partner/tlk.git;a=summary
|
||||
.. _Trusty Secure OS: https://source.android.com/security/trusty
|
||||
.. _ProvenCore Secure OS: https://provenrun.com/products/provencore/
|
||||
|
||||
--------------
|
||||
|
||||
|
|
|
|||
|
|
@ -772,6 +772,13 @@ Test Secure Payload (TSP)
|
|||
:|F|: bl32/tsp/
|
||||
:|F|: services/spd/tspd/
|
||||
|
||||
ProvenCore Secure Payload Dispatcher
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
:|M|: Jérémie Corbier <jeremie.corbier@provenrun.com>
|
||||
:|G|: `jcorbier`_
|
||||
:|F|: docs/components/spd/pnc-dispatcher.rst
|
||||
:|F|: services/spd/pncd/
|
||||
|
||||
Tools
|
||||
~~~~~
|
||||
|
||||
|
|
@ -842,6 +849,7 @@ Conventional Changelog Extensions
|
|||
.. _grandpaul: https://github.com/grandpaul
|
||||
.. _hzhuang1: https://github.com/hzhuang1
|
||||
.. _JackyBai: https://github.com/JackyBai
|
||||
.. _jcorbier: https://github.com/jcorbier
|
||||
.. _jenswi-linaro: https://github.com/jenswi-linaro
|
||||
.. _jwerner-chromium: https://github.com/jwerner-chromium
|
||||
.. _kostapr: https://github.com/kostapr
|
||||
|
|
|
|||
|
|
@ -8,3 +8,4 @@ Secure Payload Dispatcher (SPD)
|
|||
optee-dispatcher
|
||||
tlk-dispatcher
|
||||
trusty-dispatcher
|
||||
pnc-dispatcher
|
||||
|
|
|
|||
10
docs/components/spd/pnc-dispatcher.rst
Normal file
10
docs/components/spd/pnc-dispatcher.rst
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
ProvenCore Dispatcher
|
||||
=====================
|
||||
|
||||
ProvenCore dispatcher (PnC-D) adds support for ProvenRun's ProvenCore micro-kernel
|
||||
to work with Trusted Firmware-A (TF-A).
|
||||
|
||||
ProvenCore is a secure OS developed by ProvenRun S.A.S. using deductive formal methods.
|
||||
|
||||
Once a BL32 is ready, PnC-D can be included in the image by adding "SPD=pncd"
|
||||
to the build command.
|
||||
|
|
@ -1,5 +1,6 @@
|
|||
/*
|
||||
* Copyright (c) 2015-2020, ARM Limited and Contributors. All rights reserved.
|
||||
* Portions copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
|
@ -417,7 +418,7 @@ void gicv2_set_interrupt_type(unsigned int id, unsigned int type)
|
|||
* The proc_num parameter must be the linear index of the target PE in the
|
||||
* system.
|
||||
******************************************************************************/
|
||||
void gicv2_raise_sgi(int sgi_num, int proc_num)
|
||||
void gicv2_raise_sgi(int sgi_num, bool ns, int proc_num)
|
||||
{
|
||||
unsigned int sgir_val, target;
|
||||
|
||||
|
|
@ -437,7 +438,7 @@ void gicv2_raise_sgi(int sgi_num, int proc_num)
|
|||
target = driver_data->target_masks[proc_num];
|
||||
assert(target != 0U);
|
||||
|
||||
sgir_val = GICV2_SGIR_VALUE(SGIR_TGT_SPECIFIC, target, sgi_num);
|
||||
sgir_val = GICV2_SGIR_VALUE(SGIR_TGT_SPECIFIC, target, ns, sgi_num);
|
||||
|
||||
/*
|
||||
* Ensure that any shared variable updates depending on out of band
|
||||
|
|
|
|||
|
|
@ -1095,11 +1095,12 @@ void gicv3_set_interrupt_type(unsigned int id, unsigned int proc_num,
|
|||
}
|
||||
|
||||
/*******************************************************************************
|
||||
* This function raises the specified Secure Group 0 SGI.
|
||||
* This function raises the specified SGI of the specified group.
|
||||
*
|
||||
* The target parameter must be a valid MPIDR in the system.
|
||||
******************************************************************************/
|
||||
void gicv3_raise_secure_g0_sgi(unsigned int sgi_num, u_register_t target)
|
||||
void gicv3_raise_sgi(unsigned int sgi_num, gicv3_irq_group_t group,
|
||||
u_register_t target)
|
||||
{
|
||||
unsigned int tgt, aff3, aff2, aff1, aff0;
|
||||
uint64_t sgi_val;
|
||||
|
|
@ -1129,7 +1130,22 @@ void gicv3_raise_secure_g0_sgi(unsigned int sgi_num, u_register_t target)
|
|||
* interrupt trigger are observed before raising SGI.
|
||||
*/
|
||||
dsbishst();
|
||||
write_icc_sgi0r_el1(sgi_val);
|
||||
|
||||
switch (group) {
|
||||
case GICV3_G0:
|
||||
write_icc_sgi0r_el1(sgi_val);
|
||||
break;
|
||||
case GICV3_G1NS:
|
||||
write_icc_asgi1r(sgi_val);
|
||||
break;
|
||||
case GICV3_G1S:
|
||||
write_icc_sgi1r(sgi_val);
|
||||
break;
|
||||
default:
|
||||
assert(false);
|
||||
break;
|
||||
}
|
||||
|
||||
isb();
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
/*
|
||||
* Copyright (c) 2016-2021, ARM Limited and Contributors. All rights reserved.
|
||||
* Portions copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
|
@ -282,6 +283,7 @@ DEFINE_COPROCR_RW_FUNCS(icc_eoir0_el1, ICC_EOIR0)
|
|||
DEFINE_COPROCR_RW_FUNCS(icc_eoir1_el1, ICC_EOIR1)
|
||||
DEFINE_COPROCR_RW_FUNCS_64(icc_sgi0r_el1, ICC_SGI0R_EL1_64)
|
||||
DEFINE_COPROCR_WRITE_FUNC_64(icc_sgi1r, ICC_SGI1R_EL1_64)
|
||||
DEFINE_COPROCR_WRITE_FUNC_64(icc_asgi1r, ICC_ASGI1R_EL1_64)
|
||||
|
||||
DEFINE_COPROCR_RW_FUNCS(sdcr, SDCR)
|
||||
DEFINE_COPROCR_RW_FUNCS(hdcr, HDCR)
|
||||
|
|
@ -402,6 +404,8 @@ static inline unsigned int get_current_el(void)
|
|||
#define read_ctr_el0() read_ctr()
|
||||
|
||||
#define write_icc_sgi0r_el1(_v) write64_icc_sgi0r_el1(_v)
|
||||
#define write_icc_sgi1r(_v) write64_icc_sgi1r(_v)
|
||||
#define write_icc_asgi1r(_v) write64_icc_asgi1r(_v)
|
||||
|
||||
#define read_daif() read_cpsr()
|
||||
#define write_daif(flags) write_cpsr(flags)
|
||||
|
|
|
|||
|
|
@ -79,6 +79,7 @@
|
|||
******************************************************************************/
|
||||
#define ICC_IGRPEN1_EL1 S3_0_C12_C12_7
|
||||
#define ICC_SGI1R S3_0_C12_C11_5
|
||||
#define ICC_ASGI1R S3_0_C12_C11_6
|
||||
#define ICC_SRE_EL1 S3_0_C12_C12_5
|
||||
#define ICC_SRE_EL2 S3_4_C12_C9_5
|
||||
#define ICC_SRE_EL3 S3_6_C12_C12_5
|
||||
|
|
|
|||
|
|
@ -492,6 +492,7 @@ DEFINE_RENAME_SYSREG_WRITE_FUNC(icc_eoir0_el1, ICC_EOIR0_EL1)
|
|||
DEFINE_RENAME_SYSREG_WRITE_FUNC(icc_eoir1_el1, ICC_EOIR1_EL1)
|
||||
DEFINE_RENAME_SYSREG_WRITE_FUNC(icc_sgi0r_el1, ICC_SGI0R_EL1)
|
||||
DEFINE_RENAME_SYSREG_RW_FUNCS(icc_sgi1r, ICC_SGI1R)
|
||||
DEFINE_RENAME_SYSREG_RW_FUNCS(icc_asgi1r, ICC_ASGI1R)
|
||||
|
||||
DEFINE_RENAME_SYSREG_READ_FUNC(amcfgr_el0, AMCFGR_EL0)
|
||||
DEFINE_RENAME_SYSREG_READ_FUNC(amcgcr_el0, AMCGCR_EL0)
|
||||
|
|
|
|||
29
include/bl32/pnc/pnc.h
Normal file
29
include/bl32/pnc/pnc.h
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
/*
|
||||
* Copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
#ifndef __PNC_H__
|
||||
#define __PNC_H__
|
||||
|
||||
#define SMC_YIELD 0xbf000000
|
||||
#define SMC_ACTION_FROM_S 0xbf000001
|
||||
#define SMC_GET_SHAREDMEM 0xbf000002
|
||||
#define SMC_CONFIG_SHAREDMEM 0xbf000003
|
||||
#define SMC_ACTION_FROM_NS 0xbf000004
|
||||
|
||||
#ifndef __ASSEMBLER__
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
void *pncd_context_switch_to(unsigned long security_state);
|
||||
int plat_pncd_setup(void);
|
||||
uintptr_t plat_pncd_smc_handler(uint32_t smc_fid, u_register_t x1,
|
||||
u_register_t x2, u_register_t x3,
|
||||
u_register_t x4, void *cookie, void *handle,
|
||||
u_register_t flags);
|
||||
|
||||
#endif /* __ASSEMBLER__ */
|
||||
|
||||
#endif /* __PNC_H__ */
|
||||
|
|
@ -1,5 +1,6 @@
|
|||
/*
|
||||
* Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
|
||||
* Portions copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
|
@ -50,13 +51,15 @@
|
|||
#define SGIR_TGTLSTFLT_MASK U(0x3)
|
||||
#define SGIR_TGTLST_SHIFT 16
|
||||
#define SGIR_TGTLST_MASK U(0xff)
|
||||
#define SGIR_NSATT (U(0x1) << 16)
|
||||
#define SGIR_INTID_MASK ULL(0xf)
|
||||
|
||||
#define SGIR_TGT_SPECIFIC U(0)
|
||||
|
||||
#define GICV2_SGIR_VALUE(tgt_lst_flt, tgt, intid) \
|
||||
#define GICV2_SGIR_VALUE(tgt_lst_flt, tgt, nsatt, intid) \
|
||||
((((tgt_lst_flt) & SGIR_TGTLSTFLT_MASK) << SGIR_TGTLSTFLT_SHIFT) | \
|
||||
(((tgt) & SGIR_TGTLST_MASK) << SGIR_TGTLST_SHIFT) | \
|
||||
((nsatt) ? SGIR_NSATT : U(0)) | \
|
||||
((intid) & SGIR_INTID_MASK))
|
||||
|
||||
/*******************************************************************************
|
||||
|
|
@ -127,6 +130,7 @@
|
|||
#ifndef __ASSEMBLER__
|
||||
|
||||
#include <cdefs.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include <common/interrupt_props.h>
|
||||
|
|
@ -185,7 +189,7 @@ void gicv2_enable_interrupt(unsigned int id);
|
|||
void gicv2_disable_interrupt(unsigned int id);
|
||||
void gicv2_set_interrupt_priority(unsigned int id, unsigned int priority);
|
||||
void gicv2_set_interrupt_type(unsigned int id, unsigned int type);
|
||||
void gicv2_raise_sgi(int sgi_num, int proc_num);
|
||||
void gicv2_raise_sgi(int sgi_num, bool ns, int proc_num);
|
||||
void gicv2_set_spi_routing(unsigned int id, int proc_num);
|
||||
void gicv2_set_interrupt_pending(unsigned int id);
|
||||
void gicv2_clear_interrupt_pending(unsigned int id);
|
||||
|
|
|
|||
|
|
@ -354,6 +354,12 @@
|
|||
#include <drivers/arm/gic_common.h>
|
||||
#include <lib/utils_def.h>
|
||||
|
||||
typedef enum {
|
||||
GICV3_G1S,
|
||||
GICV3_G1NS,
|
||||
GICV3_G0
|
||||
} gicv3_irq_group_t;
|
||||
|
||||
static inline uintptr_t gicv3_redist_size(uint64_t typer_val)
|
||||
{
|
||||
#if GIC_ENABLE_V4_EXTN
|
||||
|
|
@ -575,7 +581,8 @@ void gicv3_set_interrupt_priority(unsigned int id, unsigned int proc_num,
|
|||
unsigned int priority);
|
||||
void gicv3_set_interrupt_type(unsigned int id, unsigned int proc_num,
|
||||
unsigned int type);
|
||||
void gicv3_raise_secure_g0_sgi(unsigned int sgi_num, u_register_t target);
|
||||
void gicv3_raise_sgi(unsigned int sgi_num, gicv3_irq_group_t group,
|
||||
u_register_t target);
|
||||
void gicv3_set_spi_routing(unsigned int id, unsigned int irm,
|
||||
u_register_t mpidr);
|
||||
void gicv3_set_interrupt_pending(unsigned int id, unsigned int proc_num);
|
||||
|
|
|
|||
|
|
@ -104,6 +104,8 @@ int plat_ic_has_interrupt_type(unsigned int type);
|
|||
void plat_ic_set_interrupt_type(unsigned int id, unsigned int type);
|
||||
void plat_ic_set_interrupt_priority(unsigned int id, unsigned int priority);
|
||||
void plat_ic_raise_el3_sgi(int sgi_num, u_register_t target);
|
||||
void plat_ic_raise_ns_sgi(int sgi_num, u_register_t target);
|
||||
void plat_ic_raise_s_el1_sgi(int sgi_num, u_register_t target);
|
||||
void plat_ic_set_spi_routing(unsigned int id, unsigned int routing_mode,
|
||||
u_register_t mpidr);
|
||||
void plat_ic_set_interrupt_pending(unsigned int id);
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
/*
|
||||
* Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
|
||||
* Portions copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
|
@ -34,6 +35,8 @@
|
|||
#pragma weak plat_ic_set_interrupt_priority
|
||||
#pragma weak plat_ic_set_interrupt_type
|
||||
#pragma weak plat_ic_raise_el3_sgi
|
||||
#pragma weak plat_ic_raise_ns_sgi
|
||||
#pragma weak plat_ic_raise_s_el1_sgi
|
||||
#pragma weak plat_ic_set_spi_routing
|
||||
|
||||
/*
|
||||
|
|
@ -247,12 +250,44 @@ void plat_ic_raise_el3_sgi(int sgi_num, u_register_t target)
|
|||
/* Verify that this is a secure SGI */
|
||||
assert(plat_ic_get_interrupt_type(sgi_num) == INTR_TYPE_EL3);
|
||||
|
||||
gicv2_raise_sgi(sgi_num, id);
|
||||
gicv2_raise_sgi(sgi_num, false, id);
|
||||
#else
|
||||
assert(false);
|
||||
#endif
|
||||
}
|
||||
|
||||
void plat_ic_raise_ns_sgi(int sgi_num, u_register_t target)
|
||||
{
|
||||
int id;
|
||||
|
||||
/* Target must be a valid MPIDR in the system */
|
||||
id = plat_core_pos_by_mpidr(target);
|
||||
assert(id >= 0);
|
||||
|
||||
/* Verify that this is a non-secure SGI */
|
||||
assert(plat_ic_get_interrupt_type(sgi_num) == INTR_TYPE_NS);
|
||||
|
||||
gicv2_raise_sgi(sgi_num, true, id);
|
||||
}
|
||||
|
||||
void plat_ic_raise_s_el1_sgi(int sgi_num, u_register_t target)
|
||||
{
|
||||
#if GICV2_G0_FOR_EL3
|
||||
assert(false);
|
||||
#else
|
||||
int id;
|
||||
|
||||
/* Target must be a valid MPIDR in the system */
|
||||
id = plat_core_pos_by_mpidr(target);
|
||||
assert(id >= 0);
|
||||
|
||||
/* Verify that this is a secure EL1 SGI */
|
||||
assert(plat_ic_get_interrupt_type(sgi_num) == INTR_TYPE_S_EL1);
|
||||
|
||||
gicv2_raise_sgi(sgi_num, false, id);
|
||||
#endif
|
||||
}
|
||||
|
||||
void plat_ic_set_spi_routing(unsigned int id, unsigned int routing_mode,
|
||||
u_register_t mpidr)
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
/*
|
||||
* Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
|
||||
* Portions copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
|
@ -39,6 +40,8 @@
|
|||
#pragma weak plat_ic_set_interrupt_priority
|
||||
#pragma weak plat_ic_set_interrupt_type
|
||||
#pragma weak plat_ic_raise_el3_sgi
|
||||
#pragma weak plat_ic_raise_ns_sgi
|
||||
#pragma weak plat_ic_raise_s_el1_sgi
|
||||
#pragma weak plat_ic_set_spi_routing
|
||||
#pragma weak plat_ic_set_interrupt_pending
|
||||
#pragma weak plat_ic_clear_interrupt_pending
|
||||
|
|
@ -242,7 +245,31 @@ void plat_ic_raise_el3_sgi(int sgi_num, u_register_t target)
|
|||
assert(plat_ic_get_interrupt_type((unsigned int)sgi_num) ==
|
||||
INTR_TYPE_EL3);
|
||||
|
||||
gicv3_raise_secure_g0_sgi((unsigned int)sgi_num, target);
|
||||
gicv3_raise_sgi((unsigned int)sgi_num, GICV3_G0, target);
|
||||
}
|
||||
|
||||
void plat_ic_raise_ns_sgi(int sgi_num, u_register_t target)
|
||||
{
|
||||
/* Target must be a valid MPIDR in the system */
|
||||
assert(plat_core_pos_by_mpidr(target) >= 0);
|
||||
|
||||
/* Verify that this is a non-secure SGI */
|
||||
assert(plat_ic_get_interrupt_type((unsigned int)sgi_num) ==
|
||||
INTR_TYPE_NS);
|
||||
|
||||
gicv3_raise_sgi((unsigned int)sgi_num, GICV3_G1NS, target);
|
||||
}
|
||||
|
||||
void plat_ic_raise_s_el1_sgi(int sgi_num, u_register_t target)
|
||||
{
|
||||
/* Target must be a valid MPIDR in the system */
|
||||
assert(plat_core_pos_by_mpidr(target) >= 0);
|
||||
|
||||
/* Verify that this is a secure EL1 SGI */
|
||||
assert(plat_ic_get_interrupt_type((unsigned int)sgi_num) ==
|
||||
INTR_TYPE_S_EL1);
|
||||
|
||||
gicv3_raise_sgi((unsigned int)sgi_num, GICV3_G1S, target);
|
||||
}
|
||||
|
||||
void plat_ic_set_spi_routing(unsigned int id, unsigned int routing_mode,
|
||||
|
|
|
|||
|
|
@ -87,7 +87,7 @@ static int stm32_pwr_domain_on(u_register_t mpidr)
|
|||
clk_disable(RTCAPB);
|
||||
|
||||
/* Generate an IT to core 1 */
|
||||
gicv2_raise_sgi(ARM_IRQ_SEC_SGI_0, STM32MP_SECONDARY_CPU);
|
||||
gicv2_raise_sgi(ARM_IRQ_SEC_SGI_0, false, STM32MP_SECONDARY_CPU);
|
||||
|
||||
return PSCI_E_SUCCESS;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
#
|
||||
# Copyright (c) 2013-2021, ARM Limited and Contributors. All rights reserved.
|
||||
# Portions copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
#
|
||||
# SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
|
|
@ -11,11 +12,20 @@ SEPARATE_CODE_AND_RODATA := 1
|
|||
ZYNQMP_WDT_RESTART := 0
|
||||
IPI_CRC_CHECK := 0
|
||||
override RESET_TO_BL31 := 1
|
||||
override GICV2_G0_FOR_EL3 := 1
|
||||
override WARMBOOT_ENABLE_DCACHE_EARLY := 1
|
||||
|
||||
EL3_EXCEPTION_HANDLING := $(SDEI_SUPPORT)
|
||||
|
||||
# pncd SPD requires secure SGI to be handled at EL1
|
||||
ifeq (${SPD},pncd)
|
||||
ifeq (${ZYNQMP_WDT_RESTART},1)
|
||||
$(error "Error: ZYNQMP_WDT_RESTART and SPD=pncd are incompatible")
|
||||
endif
|
||||
override GICV2_G0_FOR_EL3 := 0
|
||||
else
|
||||
override GICV2_G0_FOR_EL3 := 1
|
||||
endif
|
||||
|
||||
# Do not enable SVE
|
||||
ENABLE_SVE_FOR_NS := 0
|
||||
|
||||
|
|
|
|||
24
services/spd/pncd/pncd.mk
Normal file
24
services/spd/pncd/pncd.mk
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
# Copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
#
|
||||
# SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
PNCD_DIR := services/spd/pncd
|
||||
SPD_INCLUDES := -Iinclude/bl32/pnc
|
||||
SPD_INCLUDES += -Iinclude/common/
|
||||
|
||||
SPD_SOURCES := services/spd/pncd/pncd_common.c \
|
||||
services/spd/pncd/pncd_helpers.S \
|
||||
services/spd/pncd/pncd_main.c
|
||||
|
||||
NEED_BL32 := yes
|
||||
|
||||
# The following constants need to be defined:
|
||||
# - SPD_PNCD_NS_IRQ: IRQ number used to notify NS world when SMC_ACTION_FROM_S is received
|
||||
# - SPD_PNCD_S_IRQ: IRQ number used to notify S world when SMC_ACTION_FROM_NS is received
|
||||
$(eval $(call assert_numerics, SPD_PNCD_NS_IRQ SPD_PNCD_S_IRQ))
|
||||
|
||||
$(eval $(call add_defines,\
|
||||
$(sort \
|
||||
SPD_PNCD_NS_IRQ \
|
||||
SPD_PNCD_S_IRQ \
|
||||
)))
|
||||
102
services/spd/pncd/pncd_common.c
Normal file
102
services/spd/pncd/pncd_common.c
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
/*
|
||||
* Copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
#include <assert.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <arch_helpers.h>
|
||||
#include <common/bl_common.h>
|
||||
#include <common/debug.h>
|
||||
#include <lib/el3_runtime/context_mgmt.h>
|
||||
#include <lib/utils.h>
|
||||
#include <plat/common/platform.h>
|
||||
|
||||
#include "pncd_private.h"
|
||||
|
||||
/*******************************************************************************
|
||||
* Given a secure payload entrypoint info pointer, entry point PC & pointer to a
|
||||
* context data structure, this function will initialize pnc context and entry
|
||||
* point info for the secure payload
|
||||
******************************************************************************/
|
||||
void pncd_init_pnc_ep_state(struct entry_point_info *pnc_entry_point,
|
||||
uint64_t pc,
|
||||
pnc_context_t *pnc_ctx)
|
||||
{
|
||||
uint32_t ep_attr;
|
||||
|
||||
/* Passing a NULL context is a critical programming error */
|
||||
assert(pnc_ctx);
|
||||
assert(pnc_entry_point);
|
||||
assert(pc);
|
||||
|
||||
/* Associate this context with the current cpu */
|
||||
pnc_ctx->mpidr = read_mpidr();
|
||||
|
||||
cm_set_context(&pnc_ctx->cpu_ctx, SECURE);
|
||||
|
||||
/* initialise an entrypoint to set up the CPU context */
|
||||
ep_attr = SECURE | EP_ST_ENABLE;
|
||||
if (read_sctlr_el3() & SCTLR_EE_BIT) {
|
||||
ep_attr |= EP_EE_BIG;
|
||||
}
|
||||
SET_PARAM_HEAD(pnc_entry_point, PARAM_EP, VERSION_1, ep_attr);
|
||||
|
||||
pnc_entry_point->pc = pc;
|
||||
pnc_entry_point->spsr = SPSR_64(MODE_EL1,
|
||||
MODE_SP_ELX,
|
||||
DISABLE_ALL_EXCEPTIONS);
|
||||
memset(&pnc_entry_point->args, 0, sizeof(pnc_entry_point->args));
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
* This function takes an SP context pointer and:
|
||||
* 1. Applies the S-EL1 system register context from pnc_ctx->cpu_ctx.
|
||||
* 2. Saves the current C runtime state (callee saved registers) on the stack
|
||||
* frame and saves a reference to this state.
|
||||
* 3. Calls el3_exit() so that the EL3 system and general purpose registers
|
||||
* from the pnc_ctx->cpu_ctx are used to enter the secure payload image.
|
||||
******************************************************************************/
|
||||
uint64_t pncd_synchronous_sp_entry(pnc_context_t *pnc_ctx)
|
||||
{
|
||||
assert(pnc_ctx != NULL);
|
||||
assert(pnc_ctx->c_rt_ctx == 0U);
|
||||
|
||||
/* Apply the Secure EL1 system register context and switch to it */
|
||||
assert(cm_get_context(SECURE) == &pnc_ctx->cpu_ctx);
|
||||
cm_el1_sysregs_context_restore(SECURE);
|
||||
#if CTX_INCLUDE_FPREGS
|
||||
fpregs_context_restore(get_fpregs_ctx(cm_get_context(SECURE)));
|
||||
#endif
|
||||
cm_set_next_eret_context(SECURE);
|
||||
|
||||
return pncd_enter_sp(&pnc_ctx->c_rt_ctx);
|
||||
}
|
||||
|
||||
|
||||
/*******************************************************************************
|
||||
* This function takes an SP context pointer and:
|
||||
* 1. Saves the S-EL1 system register context tp pnc_ctx->cpu_ctx.
|
||||
* 2. Restores the current C runtime state (callee saved registers) from the
|
||||
* stack frame using the reference to this state saved in pncd_enter_sp().
|
||||
* 3. It does not need to save any general purpose or EL3 system register state
|
||||
* as the generic smc entry routine should have saved those.
|
||||
******************************************************************************/
|
||||
void pncd_synchronous_sp_exit(pnc_context_t *pnc_ctx, uint64_t ret)
|
||||
{
|
||||
assert(pnc_ctx != NULL);
|
||||
/* Save the Secure EL1 system register context */
|
||||
assert(cm_get_context(SECURE) == &pnc_ctx->cpu_ctx);
|
||||
cm_el1_sysregs_context_save(SECURE);
|
||||
#if CTX_INCLUDE_FPREGS
|
||||
fpregs_context_save(get_fpregs_ctx(cm_get_context(SECURE)));
|
||||
#endif
|
||||
|
||||
assert(pnc_ctx->c_rt_ctx != 0);
|
||||
pncd_exit_sp(pnc_ctx->c_rt_ctx, ret);
|
||||
|
||||
/* Should never reach here */
|
||||
panic();
|
||||
}
|
||||
79
services/spd/pncd/pncd_helpers.S
Normal file
79
services/spd/pncd/pncd_helpers.S
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
/*
|
||||
* Copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
#include <asm_macros.S>
|
||||
#include "pncd_private.h"
|
||||
|
||||
.global pncd_enter_sp
|
||||
/* ---------------------------------------------
|
||||
* This function is called with SP_EL0 as stack.
|
||||
* Here we stash our EL3 callee-saved registers
|
||||
* on to the stack as a part of saving the C
|
||||
* runtime and enter the secure payload.
|
||||
* 'x0' contains a pointer to the memory where
|
||||
* the address of the C runtime context is to be
|
||||
* saved.
|
||||
* ---------------------------------------------
|
||||
*/
|
||||
func pncd_enter_sp
|
||||
/* Make space for the registers that we're going to save */
|
||||
mov x3, sp
|
||||
str x3, [x0, #0]
|
||||
sub sp, sp, #PNCD_C_RT_CTX_SIZE
|
||||
|
||||
/* Save callee-saved registers on to the stack */
|
||||
stp x19, x20, [sp, #PNCD_C_RT_CTX_X19]
|
||||
stp x21, x22, [sp, #PNCD_C_RT_CTX_X21]
|
||||
stp x23, x24, [sp, #PNCD_C_RT_CTX_X23]
|
||||
stp x25, x26, [sp, #PNCD_C_RT_CTX_X25]
|
||||
stp x27, x28, [sp, #PNCD_C_RT_CTX_X27]
|
||||
stp x29, x30, [sp, #PNCD_C_RT_CTX_X29]
|
||||
|
||||
/* ---------------------------------------------
|
||||
* Everything is setup now. el3_exit() will
|
||||
* use the secure context to restore to the
|
||||
* general purpose and EL3 system registers to
|
||||
* ERET into the secure payload.
|
||||
* ---------------------------------------------
|
||||
*/
|
||||
b el3_exit
|
||||
endfunc pncd_enter_sp
|
||||
|
||||
/* ---------------------------------------------
|
||||
* This function is called 'x0' pointing to a C
|
||||
* runtime context saved in pncd_enter_sp(). It
|
||||
* restores the saved registers and jumps to
|
||||
* that runtime with 'x0' as the new sp. This
|
||||
* destroys the C runtime context that had been
|
||||
* built on the stack below the saved context by
|
||||
* the caller. Later the second parameter 'x1'
|
||||
* is passed as return value to the caller
|
||||
* ---------------------------------------------
|
||||
*/
|
||||
.global pncd_exit_sp
|
||||
func pncd_exit_sp
|
||||
/* Restore the previous stack */
|
||||
mov sp, x0
|
||||
|
||||
/* Restore callee-saved registers on to the stack */
|
||||
ldp x19, x20, [x0, #(PNCD_C_RT_CTX_X19 - PNCD_C_RT_CTX_SIZE)]
|
||||
ldp x21, x22, [x0, #(PNCD_C_RT_CTX_X21 - PNCD_C_RT_CTX_SIZE)]
|
||||
ldp x23, x24, [x0, #(PNCD_C_RT_CTX_X23 - PNCD_C_RT_CTX_SIZE)]
|
||||
ldp x25, x26, [x0, #(PNCD_C_RT_CTX_X25 - PNCD_C_RT_CTX_SIZE)]
|
||||
ldp x27, x28, [x0, #(PNCD_C_RT_CTX_X27 - PNCD_C_RT_CTX_SIZE)]
|
||||
ldp x29, x30, [x0, #(PNCD_C_RT_CTX_X29 - PNCD_C_RT_CTX_SIZE)]
|
||||
|
||||
/* ---------------------------------------------
|
||||
* This should take us back to the instruction
|
||||
* after the call to the last pncd_enter_sp().
|
||||
* Place the second parameter to x0 so that the
|
||||
* caller will see it as a return value from the
|
||||
* original entry call
|
||||
* ---------------------------------------------
|
||||
*/
|
||||
mov x0, x1
|
||||
ret
|
||||
endfunc pncd_exit_sp
|
||||
471
services/spd/pncd/pncd_main.c
Normal file
471
services/spd/pncd/pncd_main.c
Normal file
|
|
@ -0,0 +1,471 @@
|
|||
/*
|
||||
* Copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
/*******************************************************************************
|
||||
* This is the Secure Payload Dispatcher (SPD). The dispatcher is meant to be a
|
||||
* plug-in component to the Secure Monitor, registered as a runtime service. The
|
||||
* SPD is expected to be a functional extension of the Secure Payload (SP) that
|
||||
* executes in Secure EL1. The Secure Monitor will delegate all SMCs targeting
|
||||
* the Trusted OS/Applications range to the dispatcher. The SPD will either
|
||||
* handle the request locally or delegate it to the Secure Payload. It is also
|
||||
* responsible for initialising and maintaining communication with the SP.
|
||||
******************************************************************************/
|
||||
|
||||
#include <assert.h>
|
||||
#include <errno.h>
|
||||
#include <stddef.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <arch_helpers.h>
|
||||
#include <bl31/bl31.h>
|
||||
#include <bl31/interrupt_mgmt.h>
|
||||
#include <bl_common.h>
|
||||
#include <common/debug.h>
|
||||
#include <common/ep_info.h>
|
||||
#include <drivers/arm/gic_common.h>
|
||||
#include <lib/el3_runtime/context_mgmt.h>
|
||||
#include <lib/spinlock.h>
|
||||
#include <plat/common/platform.h>
|
||||
#include <pnc.h>
|
||||
#include "pncd_private.h"
|
||||
#include <runtime_svc.h>
|
||||
#include <tools_share/uuid.h>
|
||||
|
||||
/*******************************************************************************
|
||||
* Structure to keep track of ProvenCore state
|
||||
******************************************************************************/
|
||||
static pnc_context_t pncd_sp_context;
|
||||
|
||||
static bool ree_info;
|
||||
static uint64_t ree_base_addr;
|
||||
static uint64_t ree_length;
|
||||
static uint64_t ree_tag;
|
||||
|
||||
static bool pnc_initialized;
|
||||
|
||||
static spinlock_t smc_handler_lock;
|
||||
|
||||
static int pncd_init(void);
|
||||
|
||||
static void context_save(unsigned long security_state)
|
||||
{
|
||||
assert(sec_state_is_valid(security_state));
|
||||
|
||||
cm_el1_sysregs_context_save((uint32_t) security_state);
|
||||
#if CTX_INCLUDE_FPREGS
|
||||
fpregs_context_save(get_fpregs_ctx(cm_get_context(security_state)));
|
||||
#endif
|
||||
}
|
||||
|
||||
static void *context_restore(unsigned long security_state)
|
||||
{
|
||||
void *handle;
|
||||
|
||||
assert(sec_state_is_valid(security_state));
|
||||
|
||||
/* Get a reference to the next context */
|
||||
handle = cm_get_context((uint32_t) security_state);
|
||||
assert(handle);
|
||||
|
||||
/* Restore state */
|
||||
cm_el1_sysregs_context_restore((uint32_t) security_state);
|
||||
#if CTX_INCLUDE_FPREGS
|
||||
fpregs_context_restore(get_fpregs_ctx(cm_get_context(security_state)));
|
||||
#endif
|
||||
|
||||
cm_set_next_eret_context((uint32_t) security_state);
|
||||
|
||||
return handle;
|
||||
}
|
||||
|
||||
static uint64_t pncd_sel1_interrupt_handler(uint32_t id,
|
||||
uint32_t flags, void *handle, void *cookie);
|
||||
|
||||
/*******************************************************************************
|
||||
* Switch context to the specified security state and return the targeted
|
||||
* handle. Note that the context may remain unchanged if the switch is not
|
||||
* allowed.
|
||||
******************************************************************************/
|
||||
void *pncd_context_switch_to(unsigned long security_state)
|
||||
{
|
||||
unsigned long sec_state_from =
|
||||
security_state == SECURE ? NON_SECURE : SECURE;
|
||||
|
||||
assert(sec_state_is_valid(security_state));
|
||||
|
||||
/* Check if this is the first world switch */
|
||||
if (!pnc_initialized) {
|
||||
int rc;
|
||||
uint32_t flags;
|
||||
|
||||
assert(sec_state_from == SECURE);
|
||||
|
||||
INFO("PnC initialization done\n");
|
||||
|
||||
/*
|
||||
* Register an interrupt handler for S-EL1 interrupts
|
||||
* when generated during code executing in the
|
||||
* non-secure state.
|
||||
*/
|
||||
flags = 0U;
|
||||
set_interrupt_rm_flag(flags, NON_SECURE);
|
||||
rc = register_interrupt_type_handler(INTR_TYPE_S_EL1,
|
||||
pncd_sel1_interrupt_handler,
|
||||
flags);
|
||||
if (rc != 0) {
|
||||
ERROR("Failed to register S-EL1 interrupt handler (%d)\n",
|
||||
rc);
|
||||
panic();
|
||||
}
|
||||
|
||||
context_save(SECURE);
|
||||
|
||||
pnc_initialized = true;
|
||||
|
||||
/*
|
||||
* Release the lock before restoring the EL3 context to
|
||||
* bl31_main.
|
||||
*/
|
||||
spin_unlock(&smc_handler_lock);
|
||||
|
||||
/*
|
||||
* SP reports completion. The SPD must have initiated
|
||||
* the original request through a synchronous entry
|
||||
* into the SP. Jump back to the original C runtime
|
||||
* context.
|
||||
*/
|
||||
pncd_synchronous_sp_exit(&pncd_sp_context, (uint64_t) 0x0);
|
||||
|
||||
/* Unreachable */
|
||||
ERROR("Returned from pncd_synchronous_sp_exit... Should not happen\n");
|
||||
panic();
|
||||
}
|
||||
|
||||
/* Check that the world switch is allowed */
|
||||
if (read_mpidr() != pncd_sp_context.mpidr) {
|
||||
if (sec_state_from == SECURE) {
|
||||
/*
|
||||
* Secure -> Non-Secure world switch initiated on a CPU where there
|
||||
* should be no Trusted OS running
|
||||
*/
|
||||
WARN("Secure to Non-Secure switch requested on CPU where ProvenCore is not supposed to be running...\n");
|
||||
}
|
||||
|
||||
/*
|
||||
* Secure or Non-Secure world wants to switch world but there is no Secure
|
||||
* software on this core
|
||||
*/
|
||||
return cm_get_context((uint32_t) sec_state_from);
|
||||
}
|
||||
|
||||
context_save(sec_state_from);
|
||||
|
||||
return context_restore(security_state);
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
* This function is the handler registered for S-EL1 interrupts by the PNCD. It
|
||||
* validates the interrupt and upon success arranges entry into the PNC at
|
||||
* 'pnc_sel1_intr_entry()' for handling the interrupt.
|
||||
******************************************************************************/
|
||||
static uint64_t pncd_sel1_interrupt_handler(uint32_t id,
|
||||
uint32_t flags,
|
||||
void *handle,
|
||||
void *cookie)
|
||||
{
|
||||
/* Check the security state when the exception was generated */
|
||||
assert(get_interrupt_src_ss(flags) == NON_SECURE);
|
||||
|
||||
/* Sanity check the pointer to this cpu's context */
|
||||
assert(handle == cm_get_context(NON_SECURE));
|
||||
|
||||
/* switch to PnC */
|
||||
handle = pncd_context_switch_to(SECURE);
|
||||
|
||||
assert(handle != NULL);
|
||||
|
||||
SMC_RET0(handle);
|
||||
}
|
||||
|
||||
#pragma weak plat_pncd_setup
|
||||
int plat_pncd_setup(void)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
* Secure Payload Dispatcher setup. The SPD finds out the SP entrypoint and type
|
||||
* (aarch32/aarch64) if not already known and initialises the context for entry
|
||||
* into the SP for its initialisation.
|
||||
******************************************************************************/
|
||||
static int pncd_setup(void)
|
||||
{
|
||||
entry_point_info_t *pnc_ep_info;
|
||||
|
||||
/*
|
||||
* Get information about the Secure Payload (BL32) image. Its
|
||||
* absence is a critical failure.
|
||||
*
|
||||
* TODO: Add support to conditionally include the SPD service
|
||||
*/
|
||||
pnc_ep_info = bl31_plat_get_next_image_ep_info(SECURE);
|
||||
if (!pnc_ep_info) {
|
||||
WARN("No PNC provided by BL2 boot loader, Booting device without PNC initialization. SMC`s destined for PNC will return SMC_UNK\n");
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* If there's no valid entry point for SP, we return a non-zero value
|
||||
* signalling failure initializing the service. We bail out without
|
||||
* registering any handlers
|
||||
*/
|
||||
if (!pnc_ep_info->pc) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
pncd_init_pnc_ep_state(pnc_ep_info,
|
||||
pnc_ep_info->pc,
|
||||
&pncd_sp_context);
|
||||
|
||||
/*
|
||||
* All PNCD initialization done. Now register our init function with
|
||||
* BL31 for deferred invocation
|
||||
*/
|
||||
bl31_register_bl32_init(&pncd_init);
|
||||
bl31_set_next_image_type(NON_SECURE);
|
||||
|
||||
return plat_pncd_setup();
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
* This function passes control to the Secure Payload image (BL32) for the first
|
||||
* time on the primary cpu after a cold boot. It assumes that a valid secure
|
||||
* context has already been created by pncd_setup() which can be directly used.
|
||||
* It also assumes that a valid non-secure context has been initialised by PSCI
|
||||
* so it does not need to save and restore any non-secure state. This function
|
||||
* performs a synchronous entry into the Secure payload. The SP passes control
|
||||
* back to this routine through a SMC.
|
||||
******************************************************************************/
|
||||
static int32_t pncd_init(void)
|
||||
{
|
||||
entry_point_info_t *pnc_entry_point;
|
||||
uint64_t rc = 0;
|
||||
|
||||
/*
|
||||
* Get information about the Secure Payload (BL32) image. Its
|
||||
* absence is a critical failure.
|
||||
*/
|
||||
pnc_entry_point = bl31_plat_get_next_image_ep_info(SECURE);
|
||||
assert(pnc_entry_point);
|
||||
|
||||
cm_init_my_context(pnc_entry_point);
|
||||
|
||||
/*
|
||||
* Arrange for an entry into the test secure payload. It will be
|
||||
* returned via PNC_ENTRY_DONE case
|
||||
*/
|
||||
rc = pncd_synchronous_sp_entry(&pncd_sp_context);
|
||||
|
||||
/*
|
||||
* If everything went well at this point, the return value should be 0.
|
||||
*/
|
||||
return rc == 0;
|
||||
}
|
||||
|
||||
#pragma weak plat_pncd_smc_handler
|
||||
/*******************************************************************************
|
||||
* This function is responsible for handling the platform-specific SMCs in the
|
||||
* Trusted OS/App range as defined in the SMC Calling Convention Document.
|
||||
******************************************************************************/
|
||||
uintptr_t plat_pncd_smc_handler(uint32_t smc_fid,
|
||||
u_register_t x1,
|
||||
u_register_t x2,
|
||||
u_register_t x3,
|
||||
u_register_t x4,
|
||||
void *cookie,
|
||||
void *handle,
|
||||
u_register_t flags)
|
||||
{
|
||||
(void) smc_fid;
|
||||
(void) x1;
|
||||
(void) x2;
|
||||
(void) x3;
|
||||
(void) x4;
|
||||
(void) cookie;
|
||||
(void) flags;
|
||||
|
||||
SMC_RET1(handle, SMC_UNK);
|
||||
}
|
||||
|
||||
/*******************************************************************************
|
||||
* This function is responsible for handling all SMCs in the Trusted OS/App
|
||||
* range as defined in the SMC Calling Convention Document. It is also
|
||||
* responsible for communicating with the Secure payload to delegate work and
|
||||
* return results back to the non-secure state. Lastly it will also return any
|
||||
* information that the secure payload needs to do the work assigned to it.
|
||||
*
|
||||
* It should only be called with the smc_handler_lock held.
|
||||
******************************************************************************/
|
||||
static uintptr_t pncd_smc_handler_unsafe(uint32_t smc_fid,
|
||||
u_register_t x1,
|
||||
u_register_t x2,
|
||||
u_register_t x3,
|
||||
u_register_t x4,
|
||||
void *cookie,
|
||||
void *handle,
|
||||
u_register_t flags)
|
||||
{
|
||||
uint32_t ns;
|
||||
|
||||
/* Determine which security state this SMC originated from */
|
||||
ns = is_caller_non_secure(flags);
|
||||
|
||||
assert(ns != 0 || read_mpidr() == pncd_sp_context.mpidr);
|
||||
|
||||
switch (smc_fid) {
|
||||
case SMC_CONFIG_SHAREDMEM:
|
||||
if (ree_info) {
|
||||
/* Do not Yield */
|
||||
SMC_RET0(handle);
|
||||
}
|
||||
|
||||
/*
|
||||
* Fetch the physical base address (x1) and size (x2) of the
|
||||
* shared memory allocated by the Non-Secure world. This memory
|
||||
* will be used by PNC to communicate with the Non-Secure world.
|
||||
* Verifying the validity of these values is up to the Trusted
|
||||
* OS.
|
||||
*/
|
||||
ree_base_addr = x1 | (x2 << 32);
|
||||
ree_length = x3;
|
||||
ree_tag = x4;
|
||||
|
||||
INFO("IN SMC_CONFIG_SHAREDMEM: addr=%lx, length=%lx, tag=%lx\n",
|
||||
(unsigned long) ree_base_addr,
|
||||
(unsigned long) ree_length,
|
||||
(unsigned long) ree_tag);
|
||||
|
||||
if ((ree_base_addr % 0x200000) != 0) {
|
||||
SMC_RET1(handle, SMC_UNK);
|
||||
}
|
||||
|
||||
if ((ree_length % 0x200000) != 0) {
|
||||
SMC_RET1(handle, SMC_UNK);
|
||||
}
|
||||
|
||||
ree_info = true;
|
||||
|
||||
/* Do not Yield */
|
||||
SMC_RET4(handle, 0, 0, 0, 0);
|
||||
|
||||
break;
|
||||
|
||||
case SMC_GET_SHAREDMEM:
|
||||
if (ree_info) {
|
||||
x1 = (1U << 16) | ree_tag;
|
||||
x2 = ree_base_addr & 0xFFFFFFFF;
|
||||
x3 = (ree_base_addr >> 32) & 0xFFFFFFFF;
|
||||
x4 = ree_length & 0xFFFFFFFF;
|
||||
SMC_RET4(handle, x1, x2, x3, x4);
|
||||
} else {
|
||||
SMC_RET4(handle, 0, 0, 0, 0);
|
||||
}
|
||||
|
||||
break;
|
||||
|
||||
case SMC_ACTION_FROM_NS:
|
||||
if (ns == 0) {
|
||||
SMC_RET1(handle, SMC_UNK);
|
||||
}
|
||||
|
||||
if (SPD_PNCD_S_IRQ < MIN_PPI_ID) {
|
||||
plat_ic_raise_s_el1_sgi(SPD_PNCD_S_IRQ,
|
||||
pncd_sp_context.mpidr);
|
||||
} else {
|
||||
plat_ic_set_interrupt_pending(SPD_PNCD_S_IRQ);
|
||||
}
|
||||
|
||||
SMC_RET0(handle);
|
||||
|
||||
break;
|
||||
|
||||
case SMC_ACTION_FROM_S:
|
||||
if (ns != 0) {
|
||||
SMC_RET1(handle, SMC_UNK);
|
||||
}
|
||||
|
||||
if (SPD_PNCD_NS_IRQ < MIN_PPI_ID) {
|
||||
/*
|
||||
* NS SGI is sent to the same core as the one running
|
||||
* PNC
|
||||
*/
|
||||
plat_ic_raise_ns_sgi(SPD_PNCD_NS_IRQ, read_mpidr());
|
||||
} else {
|
||||
plat_ic_set_interrupt_pending(SPD_PNCD_NS_IRQ);
|
||||
}
|
||||
|
||||
SMC_RET0(handle);
|
||||
|
||||
break;
|
||||
|
||||
case SMC_YIELD:
|
||||
assert(handle == cm_get_context(ns != 0 ? NON_SECURE : SECURE));
|
||||
handle = pncd_context_switch_to(ns != 0 ? SECURE : NON_SECURE);
|
||||
|
||||
assert(handle != NULL);
|
||||
|
||||
SMC_RET0(handle);
|
||||
|
||||
break;
|
||||
|
||||
default:
|
||||
INFO("Unknown smc: %x\n", smc_fid);
|
||||
break;
|
||||
}
|
||||
|
||||
return plat_pncd_smc_handler(smc_fid, x1, x2, x3, x4,
|
||||
cookie, handle, flags);
|
||||
}
|
||||
|
||||
static uintptr_t pncd_smc_handler(uint32_t smc_fid,
|
||||
u_register_t x1,
|
||||
u_register_t x2,
|
||||
u_register_t x3,
|
||||
u_register_t x4,
|
||||
void *cookie,
|
||||
void *handle,
|
||||
u_register_t flags)
|
||||
{
|
||||
uintptr_t ret;
|
||||
|
||||
/* SMC handling is serialized */
|
||||
spin_lock(&smc_handler_lock);
|
||||
ret = pncd_smc_handler_unsafe(smc_fid, x1, x2, x3, x4, cookie, handle,
|
||||
flags);
|
||||
spin_unlock(&smc_handler_lock);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* Define a SPD runtime service descriptor for fast SMC calls */
|
||||
DECLARE_RT_SVC(
|
||||
pncd_fast,
|
||||
OEN_TOS_START,
|
||||
OEN_TOS_END,
|
||||
SMC_TYPE_FAST,
|
||||
pncd_setup,
|
||||
pncd_smc_handler
|
||||
);
|
||||
|
||||
/* Define a SPD runtime service descriptor for standard SMC calls */
|
||||
DECLARE_RT_SVC(
|
||||
pncd_std,
|
||||
OEN_TOS_START,
|
||||
OEN_TOS_END,
|
||||
SMC_TYPE_YIELD,
|
||||
NULL,
|
||||
pncd_smc_handler
|
||||
);
|
||||
79
services/spd/pncd/pncd_private.h
Normal file
79
services/spd/pncd/pncd_private.h
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
/*
|
||||
* Copyright (c) 2021-2022, ARM Limited and Contributors. All rights reserved.
|
||||
* Portions copyright (c) 2021-2022, ProvenRun S.A.S. All rights reserved.
|
||||
*
|
||||
* SPDX-License-Identifier: BSD-3-Clause
|
||||
*/
|
||||
|
||||
#ifndef __PNCD_PRIVATE_H__
|
||||
#define __PNCD_PRIVATE_H__
|
||||
|
||||
#ifndef __ASSEMBLER__
|
||||
#include <stdint.h>
|
||||
#endif /* __ASSEMBLER __ */
|
||||
|
||||
#include <context.h>
|
||||
#ifndef __ASSEMBLER__
|
||||
#include <lib/cassert.h>
|
||||
#endif /* __ASSEMBLER __ */
|
||||
|
||||
#include <platform_def.h>
|
||||
|
||||
/*******************************************************************************
|
||||
* Constants that allow assembler code to preserve callee-saved registers of the
|
||||
* C runtime context while performing a security state switch.
|
||||
******************************************************************************/
|
||||
#define PNCD_C_RT_CTX_X19 U(0x0)
|
||||
#define PNCD_C_RT_CTX_X20 U(0x8)
|
||||
#define PNCD_C_RT_CTX_X21 U(0x10)
|
||||
#define PNCD_C_RT_CTX_X22 U(0x18)
|
||||
#define PNCD_C_RT_CTX_X23 U(0x20)
|
||||
#define PNCD_C_RT_CTX_X24 U(0x28)
|
||||
#define PNCD_C_RT_CTX_X25 U(0x30)
|
||||
#define PNCD_C_RT_CTX_X26 U(0x38)
|
||||
#define PNCD_C_RT_CTX_X27 U(0x40)
|
||||
#define PNCD_C_RT_CTX_X28 U(0x48)
|
||||
#define PNCD_C_RT_CTX_X29 U(0x50)
|
||||
#define PNCD_C_RT_CTX_X30 U(0x58)
|
||||
#define PNCD_C_RT_CTX_SIZE U(0x60)
|
||||
#define PNCD_C_RT_CTX_ENTRIES (PNCD_C_RT_CTX_SIZE >> DWORD_SHIFT)
|
||||
|
||||
#ifndef __ASSEMBLER__
|
||||
|
||||
/* AArch64 callee saved general purpose register context structure. */
|
||||
DEFINE_REG_STRUCT(c_rt_regs, PNCD_C_RT_CTX_ENTRIES);
|
||||
|
||||
/*
|
||||
* Compile time assertion to ensure that both the compiler and linker
|
||||
* have the same double word aligned view of the size of the C runtime
|
||||
* register context.
|
||||
*/
|
||||
CASSERT(sizeof(c_rt_regs_t) == PNCD_C_RT_CTX_SIZE,
|
||||
assert_spd_c_rt_regs_size_mismatch);
|
||||
|
||||
/*******************************************************************************
|
||||
* Structure which helps the SPD to maintain the per-cpu state of the SP.
|
||||
* 'mpidr' - mpidr of the CPU running PNC
|
||||
* 'c_rt_ctx' - stack address to restore C runtime context from after
|
||||
* returning from a synchronous entry into the SP.
|
||||
* 'cpu_ctx' - space to maintain SP architectural state
|
||||
******************************************************************************/
|
||||
typedef struct pnc_context {
|
||||
uint64_t mpidr;
|
||||
uint64_t c_rt_ctx;
|
||||
cpu_context_t cpu_ctx;
|
||||
} pnc_context_t;
|
||||
|
||||
/*******************************************************************************
|
||||
* Function & Data prototypes
|
||||
******************************************************************************/
|
||||
uint64_t pncd_enter_sp(uint64_t *c_rt_ctx);
|
||||
void __dead2 pncd_exit_sp(uint64_t c_rt_ctx, uint64_t ret);
|
||||
uint64_t pncd_synchronous_sp_entry(pnc_context_t *pnc_ctx);
|
||||
void __dead2 pncd_synchronous_sp_exit(pnc_context_t *pnc_ctx, uint64_t ret);
|
||||
void pncd_init_pnc_ep_state(struct entry_point_info *pnc_ep,
|
||||
uint64_t pc,
|
||||
pnc_context_t *pnc_ctx);
|
||||
#endif /* __ASSEMBLER__ */
|
||||
|
||||
#endif /* __PNCD_PRIVATE_H__ */
|
||||
Loading…
Add table
Reference in a new issue