Added SiP calls to FVP platform to protect/unprotect a
memory range.
These leverage rme features to change the PAS of a given
memory range from non-secure to secure.
The mentioned call is leveraged by the SPMC in the memory
sharing flow, when memory is shared from the normal world
onto the secure world.
More details in the SPM related patches.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: Iaf15d8603a549d247ffb1fc14c16bfb94d0e178a
Add handling for FF-A 1.2 FFA_MSG_SEND_DIR_REQ2 interface.
Handler validates security states of sender/receiver pairs
and forwards the call to other world if necessary.
Signed-off-by: Kathleen Capella <kathleen.capella@arm.com>
Change-Id: I02a60362d8d9a50fcc0b6a84753cba274ba5eb1b
Add support for FFA_CONSOLE_LOG in EL3 SPMC,
Disallow forwarding FFA_CONSOLE_LOG across worlds.
Add support for FFA_CONSOLE_LOG in FFA_FEATURES.
Input parameters:
w0/x0 - FFA_CONSOLE_LOG_32/64
w1/x1 - Character count
w2/x2-w7/x7 - 24 or 48 characters depending upon whether a SMC32 or
SMC64 FID was used.
Output parameters in case of success:
w0/x0 - FFA_SUCCESS
Output parameters in case of error:
w0/x0 - FFA_ERROR
w2/x2 - NOT_SUPPORTED: ABI is not implemented
INVALID_PARAMETERS: Parameters are incorrectly encoded
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>
Change-Id: I004c043729e77d1b9aa396c42d25c73d9268169a
When FFA_VERSION is forwarded from SPMD to SPMC, ensure that the full
NS GP regs context incl. x8-x17 is carried when building the SPMD to
SPMC direct message.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I3467c0e04de95ab80f7c86a0763021a5fa961e4d
This patch enables FF-A secure partitions and the SPMC to query EL3 SPMD
logical partitions that are present in the system via partition get info
regs abi. Note that normal world will not be able to see EL3 SPMD
logical partitions as per the spec.
Signed-off-by: Raghu Krishnamurthy <raghu.ncstate@gmail.com>
Change-Id: I3fca8aed8ae156a559a74521803324c13ae3d55a
This patch adds support for an EL3 SPMD logical partition to discover
secure partitions using the FFA_PARTITION_INFO_GET_REGS abi. It also
adds helper functions for a logical partition to use the information
returned in registers in a meaningful way.
Signed-off-by: Raghu Krishnamurthy <raghu.ncstate@gmail.com>
Change-Id: Id69488e7367e17e2dfa6c8e332be3c8d41f6c773
This patch implements an API that is exposed to SPMD logical partitions
that can be used to send direct messages to a secure partition.
It also adds required code in the SPMD smc handler to complete the
direct response appropriately.
Change-Id: I2d0e38415f13ad4fd28f8984d565036b7d3a9e71
Signed-off-by: Raghu Krishnamurthy <raghu.ncstate@gmail.com>
Add header file to help with creation of SPMD logical partitions. Also
update linker files to create sections to record SPMD logical partitions
declared. This follows the same pattern as the EL3 SPMC's logical
partitions. This patch also adds initialization of SPMD logical
partitions when the SPMD comes up.
ENABLE_SPMD_LP is a build flag that is used to enable support for
SPMD logical partitions.
Note that the approach chosen is to keep SPMD and SPMC logical
partition support separate, as opposed to extend the existing SPMC
logical partition support since the code would need to have a number of
ifdefs and the interactions with various build options such as
SPMC_AT_EL3 needs to be accounted for, which would make code more
complicated.
Signed-off-by: Raghu Krishnamurthy <raghu.ncstate@gmail.com>
Change-Id: I9642ddbf6ea26dd3f4a283baec598d61c07e3661
Prior to delegating handling of Group0 secure interrupt to platform
handler, SPMD framework must acknowledge the highest pending interrupt.
Moreover, once the platform has handled the interrupt successfully,
SPMD must deactivate the interrupt.
The rationale behind this decision is SPMD framework is well suited to
perform interrupt management at GIC boundary while the platform handler
is well equipped to deal with the device interface related to the
interrupt.
This patch also fixes a bug in the error code returned upon invocation
of FFA_EL3_INTR_HANDLE from normal world.
Change-Id: If8fef51899e25f966038cc01ec58c84ee25e88eb
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
Follow up to [1] and [2], for systems implementing the SPMC at S-EL2,
it is necessary to leave the option for handling Group0 interrupts
(while the normal world runs) through the EHF by the use of the
EL3_EXCEPTION_HANDLING option.
Specifically for RAS, the handling through EHF is still required because
the platform function provided by the SPMD doesn't provide the facility
to link back to the RAS handling framework.
[1] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/16047
[2] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/19897
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Idf8741887904a286fb3f5ab2d754afd2fc78d3b0
When Group0 Secure interrupts in secure world get trapped to S-EL2
SPMC, FFA_EL3_INTR_HANDLE ABI is invoked by SPMC to delegate
interrupt handling to EL3 firmware (i.e., SPMD).
SPMD further delegates to platform handler which successfully handles
the Group0 secure interrupt before returning control to SPMC.
Change-Id: I8cc0fec20803b96c81582910ad2668e38b167fb8
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
SPMD registers a generic handler with the interrupt management
framework to handle Group0 secure interrupt from normal world.
The handler further delegates to the platform for successful
handling of the interrupt.
Change-Id: I9cdc721810b09e01190cdcab42c50830792a26e2
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
In ARMv8.4, the EL2 exception level got added to the secure world.
Adapt and rename the existing is_armv8_4_sel2_present() function, to
align its handling with the other CPU features.
Change-Id: If11e1942fdeb63c63f36ab9e89be810347d1a952
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
The spmd_setup function is made fail safe in that a failure in the
SPMC manifest parsing, SPMD or SPMC initialization returns a success
code to the standard services initialization routine (std_svc_setup).
This permits continuing the boot process and initialize services
beyond the SPMD to succeed for the system to operate in the normal
world. It operates in a degraded mode for the secure world.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Ida0ac91c17925279a79f112d190f9ad038f518e7
Add code in SPMD to forward calls to FFA_PARTITION_INFO_GET_REGS. This
is a new ABI that allows getting partition information without the need
for rx/tx buffer, that helps in situations where having an rx/tx buffer
mapped and available is difficult (ex. uefi runtime services).
Currently, the spmc at el3 does not support this new ABI.
The new ABI uses registers x8-x17 to return partition information so
changes are made to ensure those registers are passed through to the
SPMC and restored on the return path.
Signed-off-by: Raghu Krishnamurthy <raghu.ncstate@gmail.com>
Change-Id: I1fe5956763e054e4f8d62292fc1247e7120bb5a4
The tos_fw_config is currently loaded into memory by BL2 and
consumed by SPMD (part of BL31) and BL32 firmwares. This does
not work in RME-enabled systems as BL31 uses the root PAS memory
and does not trust secure PAS memory.
A first attempt was made to map the TOS_FW_CONFIG region as root PAS,
and then to remap to secure PAS after SPMD consumption, but this was
not suitable for RME systems where memory encryption is enabled.
This can be solved by copying the TOS FW config (SPMC manifest) from
the Root PAS region to the Secure PAS region so that BL32 can consume
it.
Change-Id: I8eef8345366199cb0e367db883c34a5b5136465d
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Compiling with -Wimplicit-fallthrough=3 (enabled by -Wextra) produces
many warnings about fallthrough comments either missing or being wrong.
Unify the comments so we comply with -Wextra.
Note that Coverity recommends against using the __attribute__ directive.
Also, zlib does not build with a higher value of -Wimplicit-fallthrough.
Finally, compilers strip comments before expanding macros. As such,
checkpatch's fallthrough annotation (or higher levels of the flag) isn't
really possible.
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I060cf4f8dc04c02cbb45cf4ceb69569a8369ccee
Validate that non-secure caller does not spoof
SPMD, SPMC or any secure endpoint ID
in FFA_MSG_SEND_DIRECT_REQ.
Change-Id: I7eadb8886142d94bef107cf485462dfcda828895
Signed-off-by: Shruti <shruti.gupta@arm.com>
Enable the SPMD to forward FFA_FRAG_RX/TX calls between
the normal world and the SPMC.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I097a48552827a8527dd3efe1155bc601d7cbf887
This patch adds support for forwarding the following PSCI messages
received by the SPMC at EL3 to the S-EL1 SP if the SP has indicated
that it wishes to receive the appropriate message via its manifest.
1. A PSCI CPU_OFF message in response to a cpu hot unplug request
from the OS.
2. A message to indicate warm boot of a cpu in response to a cpu
hot plug request from the OS.
3. A PSCI CPU_SUSPEND message in response to a cpu idle event
initiated from the OS.
4. A message to indicate warm boot of a cpu from a shallow power
state in response to a cpu resume power event.
This patch also implements the FFA_SECONDARY_EP_REGISTER function to
enable the SP specify its secondary entrypoint.
Signed-off-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I375d0655b2c6fc27445facc39213d1d0678557f4
In order to allow the EL3 SPMC to know the FF-A version of the
entity running in the normal world, allow the SPMD to
forward the call rather than replying on its behalf.
This solution works as the EL3 can ERET directly back to
the calling partition however this is not an option
when the SPMC resides in a lower exception level. A new
approach will be required to support such scenario.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: Ic2d6e49c06340167eadefe893c6e1e20b67ab498
* changes:
feat(spmc): add support for direct req/resp
feat(spmc): add support for handling FFA_ERROR ABI
feat(spmc): add support for FFA_MSG_WAIT
feat(spmc): add function to determine the return path from the SPMC
feat(spmd): enable handling of FF-A SMCs with the SPMC at EL3
feat(spmd): update SPMC init flow to use EL3 implementation
feat(spmc): add FF-A secure partition manager core
feat(spmc): prevent read only xlat tables with the EL3 SPMC
feat(spmc): enable building of the SPMC at EL3
refactor(spm_mm): reorganize secure partition manager code
Any FF-A SMC that arrives from the normal world is handled by the
SPMD before being forwarded to the SPMC. Similarly any SMC
arriving from the secure world will hit the SPMC first and be
forwarded to the SPMD if required, otherwise the SPMC will
respond directly.
This allows for the existing flow of handling FF-A ABI's when
the SPMC resides at a lower EL to be preserved.
In order to facilitate this flow the spmd_smc_forward function
has been split and control is either passed to the SPMC or it is
forwarded as before. To allow this the flags and cookie parameters
must now also be passed into this method as the SPMC must be able to
provide these when calling back into the SPMD handler as appropriate.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I84fee8390023295b9689067e14cd25cba23ca39b
Allow the SPMD to initialise an SPMC implementation at EL3 directly
rather than at a lower EL.
This includes removing the requirement to parse an SPMC manifest to
obtain information about the SPMC implementation, in this case since the
SPMD and SPMC reside in the same EL we can hardcode the required
information directly.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I66d1e1b3ec2d0abbfc28b011a32445ee890a331d
Add FF-A v1.1 FFA_RX_ACQUIRE ABI forwarding to SPMD.
RX acquire interface is used by Hypervisor to acquire ownership of a
VM's RX buffer from SPMC when it needs to deliver a message to the VM.
Change-Id: I5f57240a9c9e94eb696a5a394ec0644170380026
Signed-off-by: Federico Recanati <federico.recanati@arm.com>
Introduced by FF-A v1.1 we must forward a call to FFA_VERSION
to the SPMC so that the ffa version of the caller can be stored
for later use. Since the return of FFA_VERSION is not wrapped in
a FF-A call we need to use a direct message request to do this
forwarding. For the spmd_handler in the SPMC to hand off to the
correct function we use w2 to specify a target framework function.
Therefore we must update PSCI CPU_OFF to do this as well.
Change-Id: Ibaa6832b66f1597b3d65aa8986034f0c5916016d
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
Use long instead of long long on aarch64 for 64_t stdint types.
Introduce inttypes.h to properly support printf format specifiers for
fixed width types for such change.
Change-Id: I0bca594687a996fde0a9702d7a383055b99f10a1
Signed-off-by: Scott Branden <scott.branden@broadcom.com>
Updated FFA_FEATURES according to FF-A v1.1 in SPMC can also be used
to retrieve feature information, and should now accept other arguments
than just FF-A call IDs.
Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I02cc24a31ab3092ec1ce6fed1a9649ffe7136782
Define a handler in the SPMD to route secure interrupts occurring while
the normal world runs. On a Group1 Secure interrupt (with a GICv3 or a
Group0 interrupt on GICv2), the normal world is pre-empted to EL3 and
redirected to the SPMD/SPMC for further handling.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
Change-Id: I1350d74048c5549a2af8da0ba004c08512cc006a
Defining SMC IDs for FF-A v1.1 notifications functionality, and adding
them to SPMD SMC handler, to ensure calls are forwarded to the SPMC.
Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: Icc88aded0fd33507f7795e996bd4ff1c2fe679c8
This change refactors the SPMD to setup SPMC CPU contexts once and early
from spmd_spmc_init (single call to cm_setup_context rather than on each
and every warm boot).
Pass the core linear ID through a GP register as an implementation
defined behavior helping FF-A adoption to legacy TOSes (essentially
when secure virtualization is not used).
A first version of this change was originally submitted by Lukas [1].
Pasting below the original justification:
Our TEE, Kinibi, is used to receive the core linear ID in the x3
register of booting secondary cores.
This patch is necessary to bring up secondary cores with Kinibi as an
SPMC in SEL1.
In Kinibi, the TEE is mostly platform-independent and all platform-
specifics like topology is concentrated in TF-A of our customers.
That is why we don't have the MPIDR - linear ID mapping in Kinibi.
We need the correct linear ID to program the GICv2 target register,
for example in power management case.
It is not needed on GICv3/v4, because of using a fixed mapping from
MPIDR to ICDIPTR/GICD_ITARGETSRn register.
For debug and power management purpose, we also want a unified view to
linear id between Linux and the TEE.
E.g. to disable a core, to see what cores are printing a trace /
an event.
In the past, Kinibi had several other designs, but the complexity was
getting out of control:
* Platform-specific assembler macros in the kernel.
* A per-core SMC from Linux to tell the linear ID after the boot.
* With DynamiQ, it seems SIPs were playing with MPIDR register values,
reusing them between cores and changing them during boot.
[1] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/10235
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Signed-off-by: Lukas Hanel <lukas.hanel@trustonic.com>
Change-Id: Ifa8fa208e9b8eb1642c80b5f7b54152dadafa75e
The SPMC at S-EL2 manages S-EL1 execution contexts for SPs. The
currently running SP vCPU state is always saved when the SPMC exits to
SPMD. A fresh vCPU context is always restored when the SPMC is entered
from the SPMD and a SP resumed. For performance optimization reasons
this permits omitting the saving/restoring of the S-EL1 context from
within the EL3 SPMD on entering/exiting the SPMC. The S-EL2 SPMC and
NS-EL1 context save/restore remain done in the SPMD.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I66413ed5983913791ff5c9fc03c590ee65c6ccd7
Handle calls to the FFA_SPM_ID_GET interface. If FFA_SPM_ID_GET is
invoked from the non-secure physical FF-A instance, return the SPMC id
(defined in the SPMC manifest). If FFA_SPM_ID_GET is invoked from
the secure physical FF-A instance (e.g. the SPMC), return the SPMD id.
Change-Id: Id6d4e96b1da2510386d344e09c4553dba01227ec
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
In the case of a SP pre-empted by a non-secure interrupt, the SPMC
returns to the SPMD through the FFA_INTERRUPT ABI. It is then forwarded
to the normal world driver hinting the SP has to be resumed after the
non-secure interrupt has been serviced.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I51a694dddcb8ea30fa84e1f11d018bc2abec0a56
FF-A specification states that error codes should be typed int32_t.
SPMD's uses uint64_t for return values, which if assigned with a signed
type would have sign extension, and change the size of the return from
32-bit to 64-bit.
Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I288ab2ffec8330a2fe1f21df14e22c34bd83ced3
Remove the former impdef SPMD service for SPMC entry point
registration. Replace with FFA_SECONDARY_EP_REGISTER ABI
providing a single entry point address into the SPMC for
primary and secondary cold boot.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I067adeec25fc12cdae90c15a616903b4ac4d4d83
spmd_get_context_by_mpidr was using potentially negative value as an
array index. plat_core_pos_by_mpidr could return -1 on failure which is
utilized by some platforms.
Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
Change-Id: I7f8827e77f18da389c9cafdc1fc841aba9f03120
This patch removes the assert that expects the SPMC PC
value to be same as BL32_BASE. This assumption is not
true for all platforms e.g. Tegra, and so will be removed
from the SPMD.
Platforms can always add this check to the platform files,
if required.
Change-Id: Ic40620b43d160feb4f72f4af18e6d01861d4bf37
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
