blob: 6fee9dfe7c050d69042b82dcb548c079c4b1f4bc [file] [log] [blame]
Karl Meakin8e58ddc2024-11-08 23:19:34 +00001/*
2 * Copyright 2024 The Hafnium Authors.
3 *
4 * Use of this source code is governed by a BSD-style
5 * license that can be found in the LICENSE file or at
6 * https://opensource.org/licenses/BSD-3-Clause.
7 */
8
9#include "hf/plat/interrupts.h"
10
11#include "hf/arch/gicv3.h"
12#include "hf/arch/host_timer.h"
Karl Meakin8e58ddc2024-11-08 23:19:34 +000013
14#include "hf/api.h"
15#include "hf/check.h"
Karl Meakinfa1dcb82025-02-10 16:47:50 +000016#include "hf/ffa/direct_messaging.h"
Karl Meakin902af082024-11-28 14:58:38 +000017#include "hf/ffa/vm.h"
Karl Meakin8e58ddc2024-11-08 23:19:34 +000018#include "hf/hf_ipi.h"
19#include "hf/vm.h"
20
21/**
Daniel Boulbyaa386fd2025-02-07 15:01:20 +000022 * This function has been deprecated and it's contents moved into
23 * api_interrupt_get in order to align the bitmap and queue for tracking
24 * interupts.
Karl Meakin8e58ddc2024-11-08 23:19:34 +000025 * Returns 0 on success, or -1 otherwise.
26 */
Karl Meakin117c8082024-12-04 16:03:28 +000027int64_t ffa_interrupts_deactivate(uint32_t pint_id, uint32_t vint_id,
28 struct vcpu *current)
Karl Meakin8e58ddc2024-11-08 23:19:34 +000029{
Daniel Boulby3c1506b2025-02-25 10:49:51 +000030 (void)pint_id;
31 (void)vint_id;
Daniel Boulbyaa386fd2025-02-07 15:01:20 +000032 (void)current;
33 return 0;
Karl Meakin8e58ddc2024-11-08 23:19:34 +000034}
35
Karl Meakinca38ef92025-02-13 14:20:23 +000036static struct vcpu *ffa_interrupts_find_target_vcpu_secure_interrupt(
Karl Meakin8e58ddc2024-11-08 23:19:34 +000037 struct vcpu *current, uint32_t interrupt_id)
38{
39 /*
40 * Find which VM/SP owns this interrupt. We then find the
41 * corresponding vCPU context for this CPU.
42 */
43 for (ffa_vm_count_t index = 0; index < vm_get_count(); ++index) {
44 struct vm *vm = vm_find_index(index);
45
46 for (uint32_t j = 0; j < HF_NUM_INTIDS; j++) {
47 struct interrupt_descriptor int_desc =
48 vm->interrupt_desc[j];
49
50 /*
51 * Interrupt descriptors are populated
52 * contiguously.
53 */
54 if (!int_desc.valid) {
55 break;
56 }
57 if (int_desc.interrupt_id == interrupt_id) {
58 return api_ffa_get_vm_vcpu(vm, current);
59 }
60 }
61 }
62
63 return NULL;
64}
65
Karl Meakinca38ef92025-02-13 14:20:23 +000066static struct vcpu *ffa_interrupts_find_target_vcpu(struct vcpu *current,
J-Alvesde211782025-02-07 14:44:39 +000067 uint32_t interrupt_id,
68 uint32_t *v_intid)
Karl Meakin8e58ddc2024-11-08 23:19:34 +000069{
70 struct vcpu *target_vcpu;
71
J-Alvesde211782025-02-07 14:44:39 +000072 assert(current != NULL);
73 assert(v_intid != NULL);
74
75 *v_intid = interrupt_id;
76
Karl Meakin8e58ddc2024-11-08 23:19:34 +000077 switch (interrupt_id) {
J-Alvesde211782025-02-07 14:44:39 +000078 case SPURIOUS_INTID_OTHER_WORLD:
79 /*
80 * Spurious interrupt ID indicating that there are no pending
81 * interrupts to acknowledge. For such scenarios, resume the
82 * current vCPU.
83 */
84 target_vcpu = NULL;
85 break;
Karl Meakin8e58ddc2024-11-08 23:19:34 +000086 case HF_IPI_INTID:
Daniel Boulby7011b5a2024-10-15 18:27:26 +010087 /*
88 * Get the next vCPU with a pending IPI. If all vCPUs
89 * have had their IPIs handled this will return NULL.
90 */
91 target_vcpu = hf_ipi_get_pending_target_vcpu(current);
Karl Meakin8e58ddc2024-11-08 23:19:34 +000092 break;
J-Alvesde211782025-02-07 14:44:39 +000093 case ARM_SEL2_TIMER_PHYS_INT:
94 /* Disable the S-EL2 physical timer */
95 host_timer_disable();
96 target_vcpu = timer_find_target_vcpu(current);
97
98 if (target_vcpu != NULL) {
99 *v_intid = HF_VIRTUAL_TIMER_INTID;
100 }
101 /*
102 * It is possible for target_vcpu to be NULL in case of spurious
103 * timer interrupt.
104 */
105 break;
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000106 case ARM_EL1_VIRT_TIMER_PHYS_INT:
107 /* Fall through */
108 case ARM_EL1_PHYS_TIMER_PHYS_INT:
109 panic("Timer interrupt not expected to fire: %u\n",
110 interrupt_id);
111 default:
Karl Meakinca38ef92025-02-13 14:20:23 +0000112 target_vcpu = ffa_interrupts_find_target_vcpu_secure_interrupt(
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000113 current, interrupt_id);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000114
Daniel Boulby7011b5a2024-10-15 18:27:26 +0100115 /* The target vCPU for a secure interrupt cannot be NULL. */
116 CHECK(target_vcpu != NULL);
117 }
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000118
119 return target_vcpu;
120}
121
122/*
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000123 * If the current vCPU is being preempted, record this in the target vCPU
124 * and set the current states to VCPU_STATE_PREEMPTED.
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000125 */
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000126static void ffa_interrupts_set_preempted_vcpu(
127 struct vcpu_locked target_vcpu_locked,
128 struct vcpu_locked current_locked)
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000129{
130 struct vcpu *target_vcpu = target_vcpu_locked.vcpu;
131 struct vcpu *preempted_vcpu = current_locked.vcpu;
132
133 if (preempted_vcpu != NULL) {
134 target_vcpu->preempted_vcpu = preempted_vcpu;
135 preempted_vcpu->state = VCPU_STATE_PREEMPTED;
136 }
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000137}
138
139/**
Karl Meakinfa1dcb82025-02-10 16:47:50 +0000140 * If the interrupts were indeed masked by SPMC before an SP's vCPU was resumed,
141 * restore the priority mask thereby allowing the interrupts to be delivered.
142 */
143void ffa_interrupts_unmask(struct vcpu *current)
144{
145 plat_interrupts_set_priority_mask(current->prev_interrupt_priority);
146}
147
148/**
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000149 * Enforce action of an SP in response to non-secure or other-secure interrupt
150 * by changing the priority mask. Effectively, physical interrupts shall not
151 * trigger which has the same effect as queueing interrupts.
152 */
Karl Meakinfa1dcb82025-02-10 16:47:50 +0000153void ffa_interrupts_mask(struct vcpu_locked receiver_vcpu_locked)
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000154{
155 struct vcpu *receiver_vcpu = receiver_vcpu_locked.vcpu;
156 uint8_t current_priority;
157
158 /* Save current value of priority mask. */
159 current_priority = plat_interrupts_get_priority_mask();
160 receiver_vcpu->prev_interrupt_priority = current_priority;
161
162 if (receiver_vcpu->vm->other_s_interrupts_action ==
163 OTHER_S_INT_ACTION_QUEUED ||
164 receiver_vcpu->scheduling_mode == SPMC_MODE) {
165 /*
166 * If secure interrupts not masked yet, mask them now. We could
167 * enter SPMC scheduled mode when an EL3 SPMD Logical partition
168 * sends a direct request, and we are making the IMPDEF choice
169 * to mask interrupts when such a situation occurs. This keeps
170 * design simple.
171 */
172 if (current_priority > SWD_MASK_ALL_INT) {
173 plat_interrupts_set_priority_mask(SWD_MASK_ALL_INT);
174 }
175 } else if (receiver_vcpu->vm->ns_interrupts_action ==
176 NS_ACTION_QUEUED) {
177 /* If non secure interrupts not masked yet, mask them now. */
178 if (current_priority > SWD_MASK_NS_INT) {
179 plat_interrupts_set_priority_mask(SWD_MASK_NS_INT);
180 }
181 }
182}
183
J-Alves20160602025-02-07 17:46:22 +0000184static struct vcpu *interrupt_resume_waiting(
185 struct vcpu_locked current_locked,
186 struct vcpu_locked target_vcpu_locked, uint32_t v_intid)
187{
188 struct vcpu *next = NULL;
189 struct ffa_value ret_interrupt = api_ffa_interrupt_return(v_intid);
190 struct vcpu *target_vcpu = target_vcpu_locked.vcpu;
191
192 /* FF-A v1.1 EAC0 Table 8.2 case 1 and Table 12.10. */
193 vcpu_enter_secure_interrupt_rtm(target_vcpu_locked);
194 ffa_interrupts_mask(target_vcpu_locked);
195
196 if (target_vcpu_locked.vcpu->vm->el0_partition) {
197 /*
198 * Since S-EL0 partitions will not receive the interrupt through
199 * a vIRQ signal in addition to the FFA_INTERRUPT ERET, make the
200 * interrupt no longer pending at this point.
201 */
202 uint32_t pending_intid =
203 vcpu_virt_interrupt_get_pending_and_enabled(
204 target_vcpu_locked);
205 assert(pending_intid == v_intid);
206 }
207
208 /*
209 * Ideally, we have to mask non-secure interrupts here
210 * since the spec mandates that SPMC should make sure
211 * SPMC scheduled call chain cannot be preempted by a
212 * non-secure interrupt. However, our current design
213 * takes care of it implicitly.
214 */
215 vcpu_set_running(target_vcpu_locked, &ret_interrupt);
216
217 ffa_interrupts_set_preempted_vcpu(target_vcpu_locked, current_locked);
218
219 next = target_vcpu;
220
221 if (target_vcpu->cpu != current_locked.vcpu->cpu) {
222 /*
223 * The target vcpu could have migrated to a different
224 * physical CPU. SPMC will migrate it to current
225 * physical CPU and resume it.
226 */
227 assert(target_vcpu->vm->vcpu_count == 1);
228 target_vcpu->cpu = current_locked.vcpu->cpu;
229 }
230
231 return next;
232}
233
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000234/**
235 * Handles the secure interrupt according to the target vCPU's state
236 * in the case the owner of the interrupt is an S-EL0 partition.
237 */
Karl Meakinca38ef92025-02-13 14:20:23 +0000238static struct vcpu *ffa_interrupts_signal_secure_interrupt_sel0(
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000239 struct vcpu_locked current_locked,
240 struct vcpu_locked target_vcpu_locked, uint32_t v_intid)
241{
242 struct vcpu *target_vcpu = target_vcpu_locked.vcpu;
243 struct vcpu *next;
244
245 /* Secure interrupt signaling and queuing for S-EL0 SP. */
246 switch (target_vcpu->state) {
J-Alves20160602025-02-07 17:46:22 +0000247 case VCPU_STATE_WAITING:
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000248
Madhukar Pappireddyfe60d092025-01-24 06:42:54 -0600249 /* FF-A v1.1 EAC0 Table 8.1 case 1 and Table 12.10. */
250 dlog_verbose("S-EL0: Secure interrupt signaled: %x\n",
251 target_vcpu->vm->id);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000252
J-Alves20160602025-02-07 17:46:22 +0000253 next = interrupt_resume_waiting(current_locked,
254 target_vcpu_locked, v_intid);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000255 break;
256 case VCPU_STATE_BLOCKED:
257 case VCPU_STATE_PREEMPTED:
258 case VCPU_STATE_RUNNING:
259 dlog_verbose("S-EL0: Secure interrupt queued: %x\n",
260 target_vcpu->vm->id);
261 /*
262 * The target vCPU cannot be resumed, SPMC resumes current
263 * vCPU.
264 */
265 next = NULL;
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000266 ffa_interrupts_set_preempted_vcpu(
267 target_vcpu_locked, (struct vcpu_locked){.vcpu = NULL});
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000268 break;
269 default:
270 panic("Secure interrupt cannot be signaled to target SP\n");
271 break;
272 }
273
274 return next;
275}
276
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000277/**
278 * Handles the secure interrupt according to the target vCPU's state
279 * in the case the owner of the interrupt is an S-EL1 partition.
280 */
Karl Meakinca38ef92025-02-13 14:20:23 +0000281static struct vcpu *ffa_interrupts_signal_secure_interrupt_sel1(
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000282 struct vcpu_locked current_locked,
283 struct vcpu_locked target_vcpu_locked, uint32_t v_intid)
284{
285 struct vcpu *target_vcpu = target_vcpu_locked.vcpu;
286 struct vcpu *current = current_locked.vcpu;
287 struct vcpu *next = NULL;
288
J-Alves7e7fce02025-02-07 15:14:56 +0000289 /*
290 * The target vcpu has migrated to a different physical
291 * CPU. Hence, it cannot be resumed on this CPU, SPMC
292 * resumes current vCPU.
293 */
294 if (target_vcpu->cpu != current_locked.vcpu->cpu) {
295 assert(target_vcpu->vm->vcpu_count == 1);
296 }
297
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000298 /* Secure interrupt signaling and queuing for S-EL1 SP. */
299 switch (target_vcpu->state) {
J-Alves20160602025-02-07 17:46:22 +0000300 case VCPU_STATE_WAITING:
301 next = interrupt_resume_waiting(current_locked,
302 target_vcpu_locked, v_intid);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000303 break;
304 case VCPU_STATE_BLOCKED:
J-Alves7e7fce02025-02-07 15:14:56 +0000305
306 if (target_vcpu->cpu == current_locked.vcpu->cpu &&
307 ffa_direct_msg_precedes_in_call_chain(current_locked,
308 target_vcpu_locked)) {
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000309 struct ffa_value ret_interrupt =
310 api_ffa_interrupt_return(0);
311
312 /*
313 * If the target vCPU ran earlier in the same call
314 * chain as the current vCPU, SPMC leaves all
315 * intermediate execution contexts in blocked state and
316 * resumes the target vCPU for handling secure
317 * interrupt.
318 * Under the current design, there is only one possible
319 * scenario in which this could happen: both the
320 * preempted (i.e. current) and target vCPU are in the
321 * same NWd scheduled call chain and is described in the
322 * Scenario 1 of Table 8.4 in EAC0 spec.
323 */
324 assert(current_locked.vcpu->scheduling_mode ==
325 NWD_MODE);
326 assert(target_vcpu->scheduling_mode == NWD_MODE);
327
328 /*
329 * The execution preempted the call chain that involved
330 * the targeted and the current SPs.
331 * The targetted SP is set running, whilst the
332 * preempted SP is set PREEMPTED.
333 */
334 vcpu_set_running(target_vcpu_locked, &ret_interrupt);
335
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000336 ffa_interrupts_set_preempted_vcpu(target_vcpu_locked,
337 current_locked);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000338 next = target_vcpu;
339 } else {
340 /*
J-Alves7e7fce02025-02-07 15:14:56 +0000341 * Either:
342 * - The target vCPU has migrated to a different
343 * physical CPU. Hence, it cannot be resumed on this
344 * CPU, SPMC resumes current vCPU.
345 * - The target vCPU cannot be resumed now because it is
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000346 * in BLOCKED state (it yielded CPU cycles using
347 * FFA_YIELD). SPMC queues the virtual interrupt and
348 * resumes the current vCPU which could belong to either
349 * a VM or a SP.
350 */
351 next = NULL;
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000352 ffa_interrupts_set_preempted_vcpu(
353 target_vcpu_locked,
Karl Meakinca38ef92025-02-13 14:20:23 +0000354 (struct vcpu_locked){.vcpu = NULL});
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000355 }
356 break;
357 case VCPU_STATE_PREEMPTED:
J-Alves7e7fce02025-02-07 15:14:56 +0000358 /*
359 * We do not resume a target vCPU that has been already
360 * pre-empted by an interrupt. Make the vIRQ pending for
361 * target SP(i.e., queue the interrupt) and continue to
362 * resume current vCPU. Refer to section 8.3.2.1 bullet
363 * 3 in the FF-A v1.1 EAC0 spec.
364 */
365 if (target_vcpu->cpu == current_locked.vcpu->cpu &&
366 current->vm->id == HF_OTHER_WORLD_ID) {
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000367 /*
J-Alves7e7fce02025-02-07 15:14:56 +0000368 * The target vCPU must have been preempted by a
369 * non secure interrupt. It could not have been
370 * preempted by a secure interrupt as current
371 * SPMC implementation does not allow secure
372 * interrupt prioritization. Moreover, the
373 * target vCPU should have been in Normal World
374 * scheduled mode as SPMC scheduled mode call
375 * chain cannot be preempted by a non secure
376 * interrupt.
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000377 */
J-Alves7e7fce02025-02-07 15:14:56 +0000378 CHECK(target_vcpu->scheduling_mode == NWD_MODE);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000379 }
380
381 next = NULL;
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000382 ffa_interrupts_set_preempted_vcpu(
383 target_vcpu_locked, (struct vcpu_locked){.vcpu = NULL});
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000384
385 break;
386 case VCPU_STATE_RUNNING:
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000387 next = NULL;
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000388 ffa_interrupts_set_preempted_vcpu(
389 target_vcpu_locked, (struct vcpu_locked){.vcpu = NULL});
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000390 break;
391 case VCPU_STATE_BLOCKED_INTERRUPT:
392 /* WFI is no-op for SP. Fall through. */
393 default:
394 /*
395 * vCPU of Target SP cannot be in OFF/ABORTED state if it has
396 * to handle secure interrupt.
397 */
398 panic("Secure interrupt cannot be signaled to target SP\n");
399 break;
400 }
401
402 return next;
403}
404
405/**
406 * Obtain the physical interrupt that triggered from the interrupt controller,
407 * and inject the corresponding virtual interrupt to the target vCPU.
408 * When PEs executing in the Normal World, and secure interrupts trigger,
409 * execution is trapped into EL3. SPMD then routes the interrupt to SPMC
410 * through FFA_INTERRUPT_32 ABI synchronously using eret conduit.
411 */
Karl Meakin117c8082024-12-04 16:03:28 +0000412void ffa_interrupts_handle_secure_interrupt(struct vcpu *current,
413 struct vcpu **next)
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000414{
415 struct vcpu *target_vcpu;
416 struct vcpu_locked target_vcpu_locked =
417 (struct vcpu_locked){.vcpu = NULL};
418 struct vcpu_locked current_locked;
419 uint32_t intid;
420 struct vm_locked target_vm_locked;
421 uint32_t v_intid;
422
423 /* Find pending interrupt id. This also activates the interrupt. */
424 intid = plat_interrupts_get_pending_interrupt_id();
425 v_intid = intid;
426
J-Alvesde211782025-02-07 14:44:39 +0000427 /* Get the target vCPU and get the virtual interrupt ID. */
428 target_vcpu = ffa_interrupts_find_target_vcpu(current, intid, &v_intid);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000429
430 /*
J-Alvesde211782025-02-07 14:44:39 +0000431 * Spurious interrupt ID indicates there is no pending interrupt to
432 * acknowledge so we do not need to call end of interrupt.
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000433 */
J-Alvesde211782025-02-07 14:44:39 +0000434 if (v_intid != SPURIOUS_INTID_OTHER_WORLD) {
435 /*
436 * End the interrupt to drop the running priority. It also
437 * deactivates the physical interrupt. If not, the interrupt
438 * could trigger again after resuming current vCPU.
439 */
440 plat_interrupts_end_of_interrupt(intid);
441 }
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000442
Daniel Boulby7011b5a2024-10-15 18:27:26 +0100443 if (target_vcpu == NULL) {
444 /* No further handling required. Resume the current vCPU. */
445 *next = NULL;
446 return;
447 }
448
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000449 target_vm_locked = vm_lock(target_vcpu->vm);
450
451 if (target_vcpu == current) {
452 current_locked = vcpu_lock(current);
453 target_vcpu_locked = current_locked;
454 } else {
455 struct two_vcpu_locked vcpus_locked;
456 /* Lock both vCPUs at once to avoid deadlock. */
457 vcpus_locked = vcpu_lock_both(current, target_vcpu);
458 current_locked = vcpus_locked.vcpu1;
459 target_vcpu_locked = vcpus_locked.vcpu2;
460 }
461
462 /*
463 * A race condition can occur with the execution contexts belonging to
464 * an MP SP. An interrupt targeting the execution context on present
465 * core can trigger while the execution context of this SP on a
466 * different core is being aborted. In such scenario, the physical
467 * interrupts beloning to the aborted SP are disabled and the current
468 * execution context is resumed.
469 */
470 if (target_vcpu->state == VCPU_STATE_ABORTED ||
471 atomic_load_explicit(&target_vcpu->vm->aborting,
472 memory_order_relaxed)) {
473 /* Clear fields corresponding to secure interrupt handling. */
474 vcpu_secure_interrupt_complete(target_vcpu_locked);
Karl Meakin117c8082024-12-04 16:03:28 +0000475 ffa_vm_disable_interrupts(target_vm_locked);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000476
477 /* Resume current vCPU. */
478 *next = NULL;
479 } else {
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000480 /* Set the interrupt pending in the target vCPU. */
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000481 vcpu_virt_interrupt_inject(target_vcpu_locked, v_intid);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000482
483 switch (intid) {
484 case HF_IPI_INTID:
485 if (hf_ipi_handle(target_vcpu_locked)) {
486 *next = NULL;
487 break;
488 }
489 /*
490 * Fall through in the case handling has not been fully
491 * completed.
492 */
493 default:
494 /*
495 * Either invoke the handler related to partitions from
496 * S-EL0 or from S-EL1.
497 */
498 *next = target_vcpu_locked.vcpu->vm->el0_partition
Karl Meakinca38ef92025-02-13 14:20:23 +0000499 ? ffa_interrupts_signal_secure_interrupt_sel0(
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000500 current_locked,
501 target_vcpu_locked, v_intid)
Karl Meakinca38ef92025-02-13 14:20:23 +0000502 : ffa_interrupts_signal_secure_interrupt_sel1(
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000503 current_locked,
504 target_vcpu_locked, v_intid);
505 }
506 }
507
508 if (target_vcpu_locked.vcpu != NULL) {
509 vcpu_unlock(&target_vcpu_locked);
510 }
511
512 vcpu_unlock(&current_locked);
513 vm_unlock(&target_vm_locked);
514}
515
Karl Meakin117c8082024-12-04 16:03:28 +0000516bool ffa_interrupts_inject_notification_pending_interrupt(
Daniel Boulbyd49d0772025-01-15 11:19:36 +0000517 struct vcpu_locked target_locked, struct vm_locked receiver_locked)
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000518{
519 struct vm *next_vm = target_locked.vcpu->vm;
520 bool ret = false;
521
522 /*
523 * Inject the NPI if:
524 * - The targeted VM ID is from this world (i.e. if it is an SP).
525 * - The partition has global pending notifications and an NPI hasn't
526 * been injected yet.
527 * - There are pending per-vCPU notifications in the next vCPU.
528 */
529 if (vm_id_is_current_world(next_vm->id) &&
530 (vm_are_per_vcpu_notifications_pending(
531 receiver_locked, vcpu_index(target_locked.vcpu)) ||
532 (vm_are_global_notifications_pending(receiver_locked) &&
533 !vm_notifications_is_npi_injected(receiver_locked)))) {
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000534 vcpu_virt_interrupt_inject(target_locked,
535 HF_NOTIFICATION_PENDING_INTID);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000536 vm_notifications_set_npi_injected(receiver_locked, true);
537 ret = true;
538 }
539
540 return ret;
541}
542
Karl Meakin117c8082024-12-04 16:03:28 +0000543struct vcpu *ffa_interrupts_unwind_nwd_call_chain(struct vcpu *current_vcpu)
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000544{
545 struct vcpu *next;
546 struct two_vcpu_locked both_vcpu_locked;
547
548 /*
549 * The action specified by SP in its manifest is ``Non-secure interrupt
550 * is signaled``. Refer to section 8.2.4 rules and guidelines bullet 4.
551 * Hence, the call chain starts unwinding. The current vCPU must have
552 * been a part of NWd scheduled call chain. Therefore, it is pre-empted
553 * and execution is either handed back to the normal world or to the
554 * previous SP vCPU in the call chain through the FFA_INTERRUPT ABI.
555 * The api_preempt() call is equivalent to calling
556 * api_switch_to_other_world for current vCPU passing FFA_INTERRUPT. The
557 * SP can be resumed later by FFA_RUN.
558 */
559 CHECK(current_vcpu->scheduling_mode == NWD_MODE);
560 assert(current_vcpu->call_chain.next_node == NULL);
561
562 if (current_vcpu->call_chain.prev_node == NULL) {
563 /* End of NWd scheduled call chain */
564 return api_preempt(current_vcpu);
565 }
566
567 next = current_vcpu->call_chain.prev_node;
568 CHECK(next != NULL);
569
570 /*
571 * Lock both vCPUs. Strictly speaking, it may not be necessary since
572 * next is guaranteed to be in BLOCKED state as it is the predecessor of
573 * the current vCPU in the present call chain.
574 */
575 both_vcpu_locked = vcpu_lock_both(current_vcpu, next);
576
577 /* Removing a node from an existing call chain. */
578 current_vcpu->call_chain.prev_node = NULL;
579 current_vcpu->state = VCPU_STATE_PREEMPTED;
580
581 /*
582 * SPMC applies the runtime model till when the vCPU transitions from
583 * running to waiting state. Moreover, the SP continues to remain in
584 * its CPU cycle allocation mode. Hence, rt_model and scheduling_mode
585 * are not changed here.
586 */
587 assert(next->state == VCPU_STATE_BLOCKED);
588 assert(next->call_chain.next_node == current_vcpu);
589
590 next->call_chain.next_node = NULL;
591
592 vcpu_set_running(both_vcpu_locked.vcpu2,
593 &(struct ffa_value){
594 .func = FFA_INTERRUPT_32,
595 .arg1 = ffa_vm_vcpu(current_vcpu->vm->id,
596 vcpu_index(current_vcpu)),
597 });
598
599 sl_unlock(&next->lock);
600 sl_unlock(&current_vcpu->lock);
601
602 return next;
603}
604
Karl Meakinca38ef92025-02-13 14:20:23 +0000605static void ffa_interrupts_enable_virtual_maintenance_interrupts(
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000606 struct vcpu_locked current_locked)
607{
608 struct vcpu *current;
609 struct interrupts *interrupts;
610 struct vm *vm;
611
612 current = current_locked.vcpu;
613 interrupts = &current->interrupts;
614 vm = current->vm;
615
Karl Meakin117c8082024-12-04 16:03:28 +0000616 if (ffa_vm_managed_exit_supported(vm)) {
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000617 vcpu_virt_interrupt_set_enabled(interrupts,
618 HF_MANAGED_EXIT_INTID);
619 /*
620 * SPMC decides the interrupt type for Managed exit signal based
621 * on the partition manifest.
622 */
623 if (vm->me_signal_virq) {
624 vcpu_virt_interrupt_set_type(interrupts,
625 HF_MANAGED_EXIT_INTID,
626 INTERRUPT_TYPE_IRQ);
627 } else {
628 vcpu_virt_interrupt_set_type(interrupts,
629 HF_MANAGED_EXIT_INTID,
630 INTERRUPT_TYPE_FIQ);
631 }
632 }
633
634 if (vm->notifications.enabled) {
635 vcpu_virt_interrupt_set_enabled(interrupts,
636 HF_NOTIFICATION_PENDING_INTID);
637 }
638}
639
640/**
641 * Enable relevant virtual interrupts for Secure Partitions.
642 * For all SPs, any applicable virtual maintenance interrupts are enabled.
643 * Additionally, for S-EL0 partitions, all the interrupts declared in the
644 * partition manifest are enabled at the virtual interrupt controller
645 * interface early during the boot stage as an S-EL0 SP need not call
646 * HF_INTERRUPT_ENABLE hypervisor ABI explicitly.
647 */
Karl Meakin117c8082024-12-04 16:03:28 +0000648void ffa_interrupts_enable_virtual_interrupts(struct vcpu_locked current_locked,
649 struct vm_locked vm_locked)
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000650{
651 struct vcpu *current;
652 struct interrupts *interrupts;
653 struct vm *vm;
654
655 current = current_locked.vcpu;
656 interrupts = &current->interrupts;
657 vm = current->vm;
658 assert(vm == vm_locked.vm);
659
660 if (vm->el0_partition) {
661 for (uint32_t k = 0; k < VM_MANIFEST_MAX_INTERRUPTS; k++) {
662 struct interrupt_descriptor int_desc;
663
664 int_desc = vm_locked.vm->interrupt_desc[k];
665
666 /* Interrupt descriptors are populated contiguously. */
667 if (!int_desc.valid) {
668 break;
669 }
670 vcpu_virt_interrupt_set_enabled(interrupts,
671 int_desc.interrupt_id);
672 }
673 }
674
Karl Meakinca38ef92025-02-13 14:20:23 +0000675 ffa_interrupts_enable_virtual_maintenance_interrupts(current_locked);
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000676}
677
678/**
679 * Reconfigure the interrupt belonging to the current partition at runtime.
680 * At present, this paravirtualized interface only allows the following
681 * commands which signify what change is being requested by the current
682 * partition:
683 * - Change the target CPU of the interrupt.
684 * - Change the security state of the interrupt.
685 * - Enable or disable the physical interrupt.
686 */
Karl Meakin117c8082024-12-04 16:03:28 +0000687int64_t ffa_interrupts_reconfigure(uint32_t int_id, uint32_t command,
688 uint32_t value, struct vcpu *current)
Karl Meakin8e58ddc2024-11-08 23:19:34 +0000689{
690 struct vm *vm = current->vm;
691 struct vm_locked vm_locked;
692 int64_t ret = -1;
693 struct interrupt_descriptor *int_desc = NULL;
694
695 /*
696 * Lock VM to protect interrupt descriptor from being modified
697 * concurrently.
698 */
699 vm_locked = vm_lock(vm);
700
701 switch (command) {
702 case INT_RECONFIGURE_TARGET_PE:
703 /* Here, value represents the target PE index. */
704 if (value >= MAX_CPUS) {
705 dlog_verbose(
706 "Illegal target PE index specified while "
707 "reconfiguring interrupt %x\n",
708 int_id);
709 goto out_unlock;
710 }
711
712 /*
713 * An UP SP cannot reconfigure an interrupt to be targetted to
714 * any other physical CPU except the one it is currently
715 * running on.
716 */
717 if (vm_is_up(vm) && value != cpu_index(current->cpu)) {
718 dlog_verbose(
719 "Illegal target PE index specified by current "
720 "UP SP\n");
721 goto out_unlock;
722 }
723
724 /* Configure the interrupt to be routed to a specific CPU. */
725 int_desc = vm_interrupt_set_target_mpidr(
726 vm_locked, int_id, cpu_find_index(value)->id);
727 break;
728 case INT_RECONFIGURE_SEC_STATE:
729 /* Specify the new security state of the interrupt. */
730 if (value != INT_DESC_SEC_STATE_NS &&
731 value != INT_DESC_SEC_STATE_S) {
732 dlog_verbose(
733 "Illegal value %x specified while "
734 "reconfiguring interrupt %x\n",
735 value, int_id);
736 goto out_unlock;
737 }
738 int_desc = vm_interrupt_set_sec_state(vm_locked, int_id, value);
739 break;
740 case INT_RECONFIGURE_ENABLE:
741 /* Enable or disable the interrupt. */
742 if (value != INT_DISABLE && value != INT_ENABLE) {
743 dlog_verbose(
744 "Illegal value %x specified while "
745 "reconfiguring interrupt %x\n",
746 value, int_id);
747 goto out_unlock;
748 } else {
749 int_desc = vm_interrupt_set_enable(vm_locked, int_id,
750 value == INT_ENABLE);
751 }
752 break;
753 default:
754 dlog_verbose("Interrupt reconfigure: Unsupported command %x\n",
755 command);
756 goto out_unlock;
757 }
758
759 /* Check if the interrupt belongs to the current SP. */
760 if (int_desc == NULL) {
761 dlog_verbose("Interrupt %x does not belong to current SP\n",
762 int_id);
763 goto out_unlock;
764 }
765
766 ret = 0;
767 plat_interrupts_reconfigure_interrupt(*int_desc);
768
769out_unlock:
770 vm_unlock(&vm_locked);
771
772 return ret;
773}
774
Karl Meakin8d245542025-01-31 13:19:25 +0000775/**
776 * Run the vCPU in SPMC schedule mode under the runtime model for secure
777 * interrupt handling.
778 */
Karl Meakinca38ef92025-02-13 14:20:23 +0000779static void ffa_interrupts_run_in_sec_interrupt_rtm(
Karl Meakin8d245542025-01-31 13:19:25 +0000780 struct vcpu_locked target_vcpu_locked)
781{
782 struct vcpu *target_vcpu;
783
784 target_vcpu = target_vcpu_locked.vcpu;
785
786 /* Mark the registers as unavailable now. */
787 target_vcpu->regs_available = false;
788 target_vcpu->scheduling_mode = SPMC_MODE;
789 target_vcpu->rt_model = RTM_SEC_INTERRUPT;
790 target_vcpu->state = VCPU_STATE_RUNNING;
Karl Meakin8d245542025-01-31 13:19:25 +0000791}
792
793bool ffa_interrupts_intercept_call(struct vcpu_locked current_locked,
794 struct vcpu_locked next_locked,
795 struct ffa_value *signal_interrupt)
796{
Daniel Boulby4b9add52025-02-25 11:02:00 +0000797 /*
798 * Since S-EL0 partitions will not receive the interrupt through a vIRQ
799 * signal in addition to the FFA_INTERRUPT ERET, make the interrupt no
800 * longer pending at this point. Otherwise keep it as pending for
801 * when the S-EL1 parition calls hf_interrupt_get.
802 */
803 uint32_t intid = current_locked.vcpu->vm->el0_partition
804 ? vcpu_virt_interrupt_get_pending_and_enabled(
805 current_locked)
806 : vcpu_virt_interrupt_peek_pending_and_enabled(
807 current_locked);
Karl Meakin8d245542025-01-31 13:19:25 +0000808
809 /*
810 * Check if there are any pending virtual secure interrupts to be
811 * handled.
812 */
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000813 if (intid != HF_INVALID_INTID) {
Karl Meakin8d245542025-01-31 13:19:25 +0000814 /*
815 * Prepare to signal virtual secure interrupt to S-EL0/S-EL1 SP
816 * in WAITING state. Refer to FF-A v1.2 Table 9.1 and Table 9.2
817 * case 1.
818 */
819 *signal_interrupt = api_ffa_interrupt_return(intid);
820
821 /*
822 * Prepare to resume this partition's vCPU in SPMC
823 * schedule mode to handle virtual secure interrupt.
824 */
Karl Meakinca38ef92025-02-13 14:20:23 +0000825 ffa_interrupts_run_in_sec_interrupt_rtm(current_locked);
Karl Meakin8d245542025-01-31 13:19:25 +0000826
827 current_locked.vcpu->preempted_vcpu = next_locked.vcpu;
828 next_locked.vcpu->state = VCPU_STATE_PREEMPTED;
829
Daniel Boulby3c1506b2025-02-25 10:49:51 +0000830 dlog_verbose(
831 "%s: Pending interrupt %d, intercepting FF-A call.\n",
832 __func__, intid);
Karl Meakin8d245542025-01-31 13:19:25 +0000833
834 return true;
835 }
836
837 return false;
838}