blob: dafef21b6ccb9334b4af4b4e0e89446ceec660eb [file] [log] [blame]
Karl Meakin5a365d32024-11-08 23:55:03 +00001/*
2 * Copyright 2024 The Hafnium Authors.
3 *
4 * Use of this source code is governed by a BSD-style
5 * license that can be found in the LICENSE file or at
6 * https://opensource.org/licenses/BSD-3-Clause.
7 */
8
9#include "hf/arch/gicv3.h"
Karl Meakin5a365d32024-11-08 23:55:03 +000010
11#include "hf/api.h"
12#include "hf/check.h"
Karl Meakin902af082024-11-28 14:58:38 +000013#include "hf/ffa.h"
14#include "hf/ffa/interrupts.h"
Karl Meakin936ec1e2025-01-31 13:17:11 +000015#include "hf/ffa/vm.h"
16#include "hf/ffa_internal.h"
Karl Meakin5a365d32024-11-08 23:55:03 +000017#include "hf/plat/interrupts.h"
18#include "hf/vm.h"
19
20void plat_ffa_vcpu_allow_interrupts(struct vcpu *current);
Karl Meakin5a365d32024-11-08 23:55:03 +000021
Karl Meakin117c8082024-12-04 16:03:28 +000022bool ffa_cpu_cycles_run_forward(ffa_id_t vm_id, ffa_vcpu_index_t vcpu_idx,
23 struct ffa_value *ret)
Karl Meakin5a365d32024-11-08 23:55:03 +000024{
25 (void)vm_id;
26 (void)vcpu_idx;
27 (void)ret;
28
29 return false;
30}
31
32/**
33 * Check if current VM can resume target VM using FFA_RUN ABI.
34 */
Karl Meakin117c8082024-12-04 16:03:28 +000035bool ffa_cpu_cycles_run_checks(struct vcpu_locked current_locked,
36 ffa_id_t target_vm_id, ffa_vcpu_index_t vcpu_idx,
37 struct ffa_value *run_ret, struct vcpu **next)
Karl Meakin5a365d32024-11-08 23:55:03 +000038{
39 /*
40 * Under the Partition runtime model specified in FF-A v1.1-Beta0 spec,
41 * SP can invoke FFA_RUN to resume target SP.
42 */
43 struct vcpu *target_vcpu;
44 struct vcpu *current = current_locked.vcpu;
45 bool ret = true;
46 struct vm *vm;
47 struct vcpu_locked target_locked;
48 struct two_vcpu_locked vcpus_locked;
49
50 vm = vm_find(target_vm_id);
51 if (vm == NULL) {
52 return false;
53 }
54
55 if (vm_is_mp(vm) && vm_is_mp(current->vm) &&
56 vcpu_idx != cpu_index(current->cpu)) {
57 dlog_verbose("vcpu_idx (%d) != pcpu index (%zu)\n", vcpu_idx,
58 cpu_index(current->cpu));
59 return false;
60 }
61
62 target_vcpu = api_ffa_get_vm_vcpu(vm, current);
63
64 vcpu_unlock(&current_locked);
65
66 /* Lock both vCPUs at once to avoid deadlock. */
67 vcpus_locked = vcpu_lock_both(current, target_vcpu);
68 current_locked = vcpus_locked.vcpu1;
69 target_locked = vcpus_locked.vcpu2;
70
71 /* Only the primary VM can turn ON a vCPU that is currently OFF. */
72 if (!vm_is_primary(current->vm) &&
73 target_vcpu->state == VCPU_STATE_OFF) {
74 run_ret->arg2 = FFA_DENIED;
75 ret = false;
76 goto out;
77 }
78
79 /*
80 * An SPx can resume another SPy only when SPy is in PREEMPTED or
81 * BLOCKED state.
82 */
83 if (vm_id_is_current_world(current->vm->id) &&
84 vm_id_is_current_world(target_vm_id)) {
85 /* Target SP must be in preempted or blocked state. */
86 if (target_vcpu->state != VCPU_STATE_PREEMPTED &&
87 target_vcpu->state != VCPU_STATE_BLOCKED) {
88 run_ret->arg2 = FFA_DENIED;
89 ret = false;
90 goto out;
91 }
92 }
93
94 /* A SP cannot invoke FFA_RUN to resume a normal world VM. */
95 if (!vm_id_is_current_world(target_vm_id)) {
96 run_ret->arg2 = FFA_DENIED;
97 ret = false;
98 goto out;
99 }
100
Karl Meakin5a365d32024-11-08 23:55:03 +0000101 if (vm_id_is_current_world(current->vm->id)) {
102 /*
103 * Refer FF-A v1.1 EAC0 spec section 8.3.2.2.1
104 * Signaling an Other S-Int in blocked state
105 */
106 if (current->preempted_vcpu != NULL) {
107 /*
108 * After the target SP execution context has handled
109 * the interrupt, it uses the FFA_RUN ABI to resume
110 * the request due to which it had entered the blocked
111 * state earlier.
112 * Deny the state transition if the SP didnt perform the
113 * deactivation of the secure virtual interrupt.
114 */
115 if (!vcpu_is_interrupt_queue_empty(current_locked)) {
116 run_ret->arg2 = FFA_DENIED;
117 ret = false;
118 goto out;
119 }
120
121 /*
122 * Refer Figure 8.13 Scenario 1: Implementation choice:
123 * SPMC left all intermediate SP execution contexts in
124 * blocked state. Hence, SPMC now bypasses the
125 * intermediate these execution contexts and resumes the
126 * SP execution context that was originally preempted.
127 */
128 *next = current->preempted_vcpu;
129 if (target_vcpu != current->preempted_vcpu) {
130 dlog_verbose("Skipping intermediate vCPUs\n");
131 }
132 /*
133 * This flag should not have been set by SPMC when it
134 * signaled the virtual interrupt to the SP while SP was
135 * in WAITING or BLOCKED states. Refer the embedded
136 * comment in vcpu.h file for further description.
137 */
138 assert(!current->requires_deactivate_call);
139
140 /*
141 * Clear fields corresponding to secure interrupt
142 * handling.
143 */
144 vcpu_secure_interrupt_complete(current_locked);
145 }
146 }
147
148 /* Check if a vCPU of SP is being resumed. */
149 if (vm_id_is_current_world(target_vm_id)) {
150 /*
151 * A call chain cannot span CPUs. The target vCPU can only be
152 * resumed by FFA_RUN on present CPU.
153 */
154 if ((target_vcpu->call_chain.prev_node != NULL ||
155 target_vcpu->call_chain.next_node != NULL) &&
156 (target_vcpu->cpu != current->cpu)) {
157 run_ret->arg2 = FFA_DENIED;
158 ret = false;
159 goto out;
160 }
161
162 if (!vcpu_is_interrupt_queue_empty(target_locked)) {
163 /*
164 * Consider the following scenarios: a secure interrupt
165 * triggered in normal world and is targeted to an SP.
166 * Scenario A): The target SP's vCPU was preempted by a
167 * non secure interrupt.
168 * Scenario B): The target SP's vCPU was in blocked
169 * state after it yielded CPU cycles to
170 * normal world using FFA_YIELD.
171 * In both the scenarios, SPMC would have injected a
172 * virtual interrupt and set the appropriate flags after
173 * de-activating the secure physical interrupt. SPMC did
174 * not resume the target vCPU at that moment.
175 */
176 assert(target_vcpu->state == VCPU_STATE_PREEMPTED ||
177 target_vcpu->state == VCPU_STATE_BLOCKED);
178 assert(vcpu_interrupt_count_get(target_locked) > 0);
179
180 /*
181 * This check is to ensure the target SP vCPU could
182 * only be a part of NWd scheduled call chain. FF-A v1.1
183 * spec prohibits an SPMC scheduled call chain to be
184 * preempted by a non secure interrupt.
185 */
186 CHECK(target_vcpu->scheduling_mode == NWD_MODE);
187 }
188 }
189
190out:
191 vcpu_unlock(&target_locked);
192 return ret;
193}
194
195/**
196 * SPMC scheduled call chain is completely unwound.
197 */
198static void plat_ffa_exit_spmc_schedule_mode(struct vcpu_locked current_locked)
199{
200 struct vcpu *current;
201
202 current = current_locked.vcpu;
203 assert(current->call_chain.next_node == NULL);
204 CHECK(current->scheduling_mode == SPMC_MODE);
205
206 current->scheduling_mode = NONE;
207 current->rt_model = RTM_NONE;
208}
209
210/**
211 * A SP in running state could have been pre-empted by a secure interrupt. SPM
212 * would switch the execution to the vCPU of target SP responsible for interupt
213 * handling. Upon completion of interrupt handling, vCPU performs interrupt
214 * signal completion through FFA_MSG_WAIT ABI (provided it was in waiting state
215 * when interrupt was signaled).
216 *
217 * SPM then resumes the original SP that was initially pre-empted.
218 */
219static struct ffa_value plat_ffa_preempted_vcpu_resume(
220 struct vcpu_locked current_locked, struct vcpu **next)
221{
222 struct ffa_value ffa_ret = (struct ffa_value){.func = FFA_MSG_WAIT_32};
223 struct vcpu *target_vcpu;
224 struct vcpu *current = current_locked.vcpu;
225 struct vcpu_locked target_locked;
226 struct two_vcpu_locked vcpus_locked;
227
228 CHECK(current->preempted_vcpu != NULL);
229 CHECK(current->preempted_vcpu->state == VCPU_STATE_PREEMPTED);
230
231 target_vcpu = current->preempted_vcpu;
232 vcpu_unlock(&current_locked);
233
234 /* Lock both vCPUs at once to avoid deadlock. */
235 vcpus_locked = vcpu_lock_both(current, target_vcpu);
236 current_locked = vcpus_locked.vcpu1;
237 target_locked = vcpus_locked.vcpu2;
238
239 /* Reset the fields tracking secure interrupt processing. */
240 vcpu_secure_interrupt_complete(current_locked);
241
242 /* SPMC scheduled call chain is completely unwound. */
243 plat_ffa_exit_spmc_schedule_mode(current_locked);
244 assert(current->call_chain.prev_node == NULL);
245
246 current->state = VCPU_STATE_WAITING;
247
248 vcpu_set_running(target_locked, NULL);
249
250 vcpu_unlock(&target_locked);
251
252 /* Restore interrupt priority mask. */
253 plat_ffa_vcpu_allow_interrupts(current);
254
255 /* The pre-empted vCPU should be run. */
256 *next = target_vcpu;
257
258 return ffa_ret;
259}
260
261static struct ffa_value ffa_msg_wait_complete(struct vcpu_locked current_locked,
262 struct vcpu **next)
263{
264 struct vcpu *current = current_locked.vcpu;
265
266 current->scheduling_mode = NONE;
267 current->rt_model = RTM_NONE;
268
269 /* Relinquish control back to the NWd. */
270 *next = api_switch_to_other_world(
271 current_locked, (struct ffa_value){.func = FFA_MSG_WAIT_32},
272 VCPU_STATE_WAITING);
273
274 return api_ffa_interrupt_return(0);
275}
276
277/**
278 * Deals with the common case of intercepting an FFA_MSG_WAIT call.
279 */
280static bool plat_ffa_msg_wait_intercept(struct vcpu_locked current_locked,
281 struct vcpu **next,
282 struct ffa_value *ffa_ret)
283{
284 struct two_vcpu_locked both_vcpu_locks;
285 struct vcpu *current = current_locked.vcpu;
286 bool ret = false;
287
288 assert(next != NULL);
289 assert(*next != NULL);
290
291 vcpu_unlock(&current_locked);
292
293 both_vcpu_locks = vcpu_lock_both(current, *next);
294
295 /*
296 * Check if there are any pending secure virtual interrupts to
297 * be handled. The `next` should have a pointer to the current
298 * vCPU. Intercept call will set `ret` to FFA_INTERRUPT and the
299 * respective interrupt id.
300 */
Karl Meakin117c8082024-12-04 16:03:28 +0000301 if (ffa_interrupts_intercept_call(both_vcpu_locks.vcpu1,
302 both_vcpu_locks.vcpu2, ffa_ret)) {
Karl Meakin5a365d32024-11-08 23:55:03 +0000303 *next = NULL;
304 ret = true;
305 }
306
307 vcpu_unlock(&both_vcpu_locks.vcpu2);
308
309 return ret;
310}
311
Karl Meakin936ec1e2025-01-31 13:17:11 +0000312static bool sp_boot_next(struct vcpu_locked current_locked, struct vcpu **next)
313{
314 struct vcpu *vcpu_next = NULL;
315 struct vcpu *current = current_locked.vcpu;
316 struct vm *next_vm;
317 size_t cpu_indx = cpu_index(current->cpu);
318
319 if (current->cpu->last_sp_initialized) {
320 return false;
321 }
322
323 if (!atomic_load_explicit(&current->vm->aborting,
324 memory_order_relaxed)) {
325 /* vCPU has just returned from successful initialization. */
326 dlog_verbose(
327 "Initialized execution context of VM: %#x on CPU: %zu, "
328 "boot_order: %u\n",
329 current->vm->id, cpu_index(current->cpu),
330 current->vm->boot_order);
331 }
332
333 if (cpu_index(current_locked.vcpu->cpu) == PRIMARY_CPU_IDX) {
334 next_vm = vm_get_next_boot(current->vm);
335 } else {
336 /* SP boot chain on secondary CPU. */
337 next_vm = vm_get_next_boot_secondary_core(current->vm);
338 }
339
340 current->state = VCPU_STATE_WAITING;
341 current->rt_model = RTM_NONE;
342 current->scheduling_mode = NONE;
343
344 /*
345 * Pick next SP's vCPU to be booted. Once all SPs have booted
346 * (next_vm is NULL), then return execution to NWd.
347 */
348 if (next_vm == NULL) {
349 current->cpu->last_sp_initialized = true;
350 goto out;
351 }
352
353 vcpu_next = vm_get_vcpu(next_vm, cpu_indx);
354
355 /*
356 * An SP's execution context needs to be bootstrapped if:
357 * - It has never been initialized before.
358 * - Or it was turned off when the CPU, on which it was pinned, was
359 * powered down.
360 */
361 if (vcpu_next->rt_model == RTM_SP_INIT ||
362 vcpu_next->state == VCPU_STATE_OFF) {
363 vcpu_next->rt_model = RTM_SP_INIT;
364 arch_regs_reset(vcpu_next);
365 vcpu_next->cpu = current->cpu;
366 vcpu_next->state = VCPU_STATE_RUNNING;
367 vcpu_next->regs_available = false;
368 vcpu_set_phys_core_idx(vcpu_next);
369 arch_regs_set_pc_arg(&vcpu_next->regs,
370 vcpu_next->vm->secondary_ep, 0ULL);
371
372 if (cpu_index(current_locked.vcpu->cpu) == PRIMARY_CPU_IDX) {
373 /*
374 * Boot information is passed by the SPMC to the SP's
375 * execution context only on the primary CPU.
376 */
377 vcpu_set_boot_info_gp_reg(vcpu_next);
378 }
379
380 *next = vcpu_next;
381
382 return true;
383 }
384out:
385 dlog_notice("Finished bootstrapping all SPs on CPU%lx\n", cpu_indx);
386 return false;
387}
388
Karl Meakin5a365d32024-11-08 23:55:03 +0000389/**
390 * The invocation of FFA_MSG_WAIT at secure virtual FF-A instance is compliant
391 * with FF-A v1.1 EAC0 specification. It only performs the state transition
392 * from RUNNING to WAITING for the following Partition runtime models:
393 * RTM_FFA_RUN, RTM_SEC_INTERRUPT, RTM_SP_INIT.
394 */
Karl Meakin117c8082024-12-04 16:03:28 +0000395struct ffa_value ffa_cpu_cycles_msg_wait_prepare(
396 struct vcpu_locked current_locked, struct vcpu **next)
Karl Meakin5a365d32024-11-08 23:55:03 +0000397{
398 struct ffa_value ret = api_ffa_interrupt_return(0);
399 struct vcpu *current = current_locked.vcpu;
400
401 switch (current->rt_model) {
402 case RTM_SP_INIT:
403 if (!sp_boot_next(current_locked, next)) {
404 ret = ffa_msg_wait_complete(current_locked, next);
405
406 if (plat_ffa_msg_wait_intercept(current_locked, next,
407 &ret)) {
408 }
409 }
410 break;
411 case RTM_SEC_INTERRUPT:
412 /*
413 * Either resume the preempted SP or complete the FFA_MSG_WAIT.
414 */
415 assert(current->preempted_vcpu != NULL);
416 plat_ffa_preempted_vcpu_resume(current_locked, next);
417
418 if (plat_ffa_msg_wait_intercept(current_locked, next, &ret)) {
419 break;
420 }
421
422 /*
423 * If CPU cycles were allocated through FFA_RUN interface,
424 * allow the interrupts(if they were masked earlier) before
425 * returning control to NWd.
426 */
427 plat_ffa_vcpu_allow_interrupts(current);
428 break;
429 case RTM_FFA_RUN:
430 ret = ffa_msg_wait_complete(current_locked, next);
431
432 if (plat_ffa_msg_wait_intercept(current_locked, next, &ret)) {
433 break;
434 }
435
436 /*
437 * If CPU cycles were allocated through FFA_RUN interface,
438 * allow the interrupts(if they were masked earlier) before
439 * returning control to NWd.
440 */
441 plat_ffa_vcpu_allow_interrupts(current);
442
443 break;
444 default:
445 panic("%s: unexpected runtime model %x for [%x %x]",
446 current->rt_model, current->vm->id,
447 cpu_index(current->cpu));
448 }
449
450 vcpu_unlock(&current_locked);
451
452 return ret;
453}
454
455/**
456 * Enforce action of an SP in response to non-secure or other-secure interrupt
457 * by changing the priority mask. Effectively, physical interrupts shall not
458 * trigger which has the same effect as queueing interrupts.
459 */
460static void plat_ffa_vcpu_queue_interrupts(
461 struct vcpu_locked receiver_vcpu_locked)
462{
463 struct vcpu *receiver_vcpu = receiver_vcpu_locked.vcpu;
464 uint8_t current_priority;
465
466 /* Save current value of priority mask. */
467 current_priority = plat_interrupts_get_priority_mask();
468 receiver_vcpu->prev_interrupt_priority = current_priority;
469
470 if (receiver_vcpu->vm->other_s_interrupts_action ==
471 OTHER_S_INT_ACTION_QUEUED ||
472 receiver_vcpu->scheduling_mode == SPMC_MODE) {
473 /*
474 * If secure interrupts not masked yet, mask them now. We could
475 * enter SPMC scheduled mode when an EL3 SPMD Logical partition
476 * sends a direct request, and we are making the IMPDEF choice
477 * to mask interrupts when such a situation occurs. This keeps
478 * design simple.
479 */
480 if (current_priority > SWD_MASK_ALL_INT) {
481 plat_interrupts_set_priority_mask(SWD_MASK_ALL_INT);
482 }
483 } else if (receiver_vcpu->vm->ns_interrupts_action ==
484 NS_ACTION_QUEUED) {
485 /* If non secure interrupts not masked yet, mask them now. */
486 if (current_priority > SWD_MASK_NS_INT) {
487 plat_interrupts_set_priority_mask(SWD_MASK_NS_INT);
488 }
489 }
490}
491
492/*
493 * Initialize the scheduling mode and/or Partition Runtime model of the target
494 * SP upon being resumed by an FFA_RUN ABI.
495 */
Karl Meakin117c8082024-12-04 16:03:28 +0000496void ffa_cpu_cycles_init_schedule_mode_ffa_runeld_prepare(
497 struct vcpu_locked current_locked, struct vcpu_locked target_locked)
Karl Meakin5a365d32024-11-08 23:55:03 +0000498{
499 struct vcpu *vcpu = target_locked.vcpu;
500 struct vcpu *current = current_locked.vcpu;
501
502 /*
503 * Scenario 1 in Table 8.4; Therefore SPMC could be resuming a vCPU
504 * that was part of NWd scheduled mode.
505 */
506 CHECK(vcpu->scheduling_mode != SPMC_MODE);
507
508 /* Section 8.2.3 bullet 4.2 of spec FF-A v1.1 EAC0. */
509 if (vcpu->state == VCPU_STATE_WAITING) {
510 assert(vcpu->rt_model == RTM_SP_INIT ||
511 vcpu->rt_model == RTM_NONE);
512 vcpu->rt_model = RTM_FFA_RUN;
513
514 if (!vm_id_is_current_world(current->vm->id) ||
515 (current->scheduling_mode == NWD_MODE)) {
516 vcpu->scheduling_mode = NWD_MODE;
517 }
518 } else {
519 /* SP vCPU would have been pre-empted earlier or blocked. */
520 CHECK(vcpu->state == VCPU_STATE_PREEMPTED ||
521 vcpu->state == VCPU_STATE_BLOCKED);
522 }
523
524 plat_ffa_vcpu_queue_interrupts(target_locked);
525}
526
527/*
528 * Prepare to yield execution back to the VM/SP that allocated CPU cycles and
529 * move to BLOCKED state. If the CPU cycles were allocated to the current
530 * execution context by the SPMC to handle secure virtual interrupt, then
531 * FFA_YIELD invocation is essentially a no-op.
532 */
Karl Meakin117c8082024-12-04 16:03:28 +0000533struct ffa_value ffa_cpu_cycles_yield_prepare(struct vcpu_locked current_locked,
534 struct vcpu **next,
535 uint32_t timeout_low,
536 uint32_t timeout_high)
Karl Meakin5a365d32024-11-08 23:55:03 +0000537{
538 struct ffa_value ret_args = (struct ffa_value){.func = FFA_SUCCESS_32};
539 struct vcpu *current = current_locked.vcpu;
540 struct ffa_value ret = {
541 .func = FFA_YIELD_32,
542 .arg1 = ffa_vm_vcpu(current->vm->id, vcpu_index(current)),
543 .arg2 = timeout_low,
544 .arg3 = timeout_high,
545 };
546
547 switch (current->rt_model) {
548 case RTM_FFA_DIR_REQ:
549 assert(current->direct_request_origin.vm_id !=
550 HF_INVALID_VM_ID);
551 if (current->call_chain.prev_node == NULL) {
552 /*
553 * Relinquish cycles to the NWd VM that sent direct
554 * request message to the current SP.
555 */
556 *next = api_switch_to_other_world(current_locked, ret,
557 VCPU_STATE_BLOCKED);
558 } else {
559 /*
560 * Relinquish cycles to the SP that sent direct request
561 * message to the current SP.
562 */
563 *next = api_switch_to_vm(
564 current_locked, ret, VCPU_STATE_BLOCKED,
565 current->direct_request_origin.vm_id);
566 }
567 break;
568 case RTM_SEC_INTERRUPT: {
569 /*
570 * SPMC does not implement a scheduler needed to resume the
571 * current vCPU upon timeout expiration. Hence, SPMC makes the
572 * implementation defined choice to treat FFA_YIELD invocation
573 * as a no-op if the SP execution context is in the secure
574 * interrupt runtime model. This does not violate FF-A spec as
575 * the spec does not mandate timeout to be honored. Moreover,
576 * timeout specified by an endpoint is just a hint to the
577 * partition manager which allocated CPU cycles.
578 * Resume the current vCPU.
579 */
580 *next = NULL;
581 break;
582 }
583 default:
584 CHECK(current->rt_model == RTM_FFA_RUN);
585 *next = api_switch_to_primary(current_locked, ret,
586 VCPU_STATE_BLOCKED);
587 break;
588 }
589
590 /*
591 * Before yielding CPU cycles, allow the interrupts(if they were
592 * masked earlier).
593 */
594 if (*next != NULL) {
595 plat_ffa_vcpu_allow_interrupts(current);
596 }
597
598 return ret_args;
599}
Karl Meakin936ec1e2025-01-31 13:17:11 +0000600
601static bool is_predecessor_in_call_chain(struct vcpu_locked current_locked,
602 struct vcpu_locked target_locked)
603{
604 struct vcpu *prev_node;
605 struct vcpu *current = current_locked.vcpu;
606 struct vcpu *target = target_locked.vcpu;
607
608 assert(current != NULL);
609 assert(target != NULL);
610
611 prev_node = current->call_chain.prev_node;
612
613 while (prev_node != NULL) {
614 if (prev_node == target) {
615 return true;
616 }
617
618 /* The target vCPU is not it's immediate predecessor. */
619 prev_node = prev_node->call_chain.prev_node;
620 }
621
622 /* Search terminated. Reached start of call chain. */
623 return false;
624}
625
626/**
627 * Validates the Runtime model for FFA_RUN. Refer to section 7.2 of the FF-A
628 * v1.1 EAC0 spec.
629 */
630static bool plat_ffa_check_rtm_ffa_run(struct vcpu_locked current_locked,
631 struct vcpu_locked locked_vcpu,
632 uint32_t func,
633 enum vcpu_state *next_state)
634{
635 switch (func) {
636 case FFA_MSG_SEND_DIRECT_REQ_64:
637 case FFA_MSG_SEND_DIRECT_REQ_32:
638 case FFA_MSG_SEND_DIRECT_REQ2_64:
639 /* Fall through. */
640 case FFA_RUN_32: {
641 /* Rules 1,2 section 7.2 EAC0 spec. */
642 if (is_predecessor_in_call_chain(current_locked, locked_vcpu)) {
643 return false;
644 }
645 *next_state = VCPU_STATE_BLOCKED;
646 return true;
647 }
648 case FFA_MSG_WAIT_32:
649 /* Rule 4 section 7.2 EAC0 spec. Fall through. */
650 *next_state = VCPU_STATE_WAITING;
651 return true;
652 case FFA_YIELD_32:
653 /* Rule 5 section 7.2 EAC0 spec. */
654 *next_state = VCPU_STATE_BLOCKED;
655 return true;
656 case FFA_MSG_SEND_DIRECT_RESP_64:
657 case FFA_MSG_SEND_DIRECT_RESP_32:
658 case FFA_MSG_SEND_DIRECT_RESP2_64:
659 /* Rule 3 section 7.2 EAC0 spec. Fall through. */
660 default:
661 /* Deny state transitions by default. */
662 return false;
663 }
664}
665
666/**
667 * Validates the Runtime model for FFA_MSG_SEND_DIRECT_REQ and
668 * FFA_MSG_SEND_DIRECT_REQ2. Refer to section 8.3 of the FF-A
669 * v1.2 spec.
670 */
671static bool plat_ffa_check_rtm_ffa_dir_req(struct vcpu_locked current_locked,
672 struct vcpu_locked locked_vcpu,
673 ffa_id_t receiver_vm_id,
674 uint32_t func,
675 enum vcpu_state *next_state)
676{
677 switch (func) {
678 case FFA_MSG_SEND_DIRECT_REQ_64:
679 case FFA_MSG_SEND_DIRECT_REQ_32:
680 case FFA_MSG_SEND_DIRECT_REQ2_64:
681 /* Fall through. */
682 case FFA_RUN_32: {
683 /* Rules 1,2. */
684 if (is_predecessor_in_call_chain(current_locked, locked_vcpu)) {
685 return false;
686 }
687
688 *next_state = VCPU_STATE_BLOCKED;
689 return true;
690 }
691 case FFA_MSG_SEND_DIRECT_RESP_64:
692 case FFA_MSG_SEND_DIRECT_RESP_32: {
693 case FFA_MSG_SEND_DIRECT_RESP2_64:
694 /* Rule 3. */
695 if (current_locked.vcpu->direct_request_origin.vm_id ==
696 receiver_vm_id) {
697 *next_state = VCPU_STATE_WAITING;
698 return true;
699 }
700
701 return false;
702 }
703 case FFA_YIELD_32:
704 /* Rule 3, section 8.3 of FF-A v1.2 spec. */
705 *next_state = VCPU_STATE_BLOCKED;
706 return true;
707 case FFA_MSG_WAIT_32:
708 /* Rule 4. Fall through. */
709 default:
710 /* Deny state transitions by default. */
711 return false;
712 }
713}
714
715/**
716 * Validates the Runtime model for Secure interrupt handling. Refer to section
717 * 8.4 of the FF-A v1.2 ALP0 spec.
718 */
719static bool plat_ffa_check_rtm_sec_interrupt(struct vcpu_locked current_locked,
720 struct vcpu_locked locked_vcpu,
721 uint32_t func,
722 enum vcpu_state *next_state)
723{
724 struct vcpu *current = current_locked.vcpu;
725 struct vcpu *vcpu = locked_vcpu.vcpu;
726
727 CHECK(current->scheduling_mode == SPMC_MODE);
728
729 switch (func) {
730 case FFA_MSG_SEND_DIRECT_REQ_64:
731 case FFA_MSG_SEND_DIRECT_REQ_32:
732 case FFA_MSG_SEND_DIRECT_REQ2_64:
733 /* Rule 3. */
734 *next_state = VCPU_STATE_BLOCKED;
735 return true;
736 case FFA_RUN_32: {
737 /* Rule 6. */
738 if (vcpu->state == VCPU_STATE_PREEMPTED) {
739 *next_state = VCPU_STATE_BLOCKED;
740 return true;
741 }
742
743 return false;
744 }
745 case FFA_MSG_WAIT_32:
746 /* Rule 2. */
747 *next_state = VCPU_STATE_WAITING;
748 return true;
749 case FFA_YIELD_32:
750 /* Rule 3, section 8.4 of FF-A v1.2 spec. */
751 *next_state = VCPU_STATE_BLOCKED;
752 return true;
753 case FFA_MSG_SEND_DIRECT_RESP_64:
754 case FFA_MSG_SEND_DIRECT_RESP_32:
755 case FFA_MSG_SEND_DIRECT_RESP2_64:
756 /* Rule 5. Fall through. */
757 default:
758 /* Deny state transitions by default. */
759 return false;
760 }
761}
762
763/**
764 * Validates the Runtime model for SP initialization. Refer to section
765 * 8.3 of the FF-A v1.2 ALP0 spec.
766 */
767static bool plat_ffa_check_rtm_sp_init(struct vcpu_locked locked_vcpu,
768 uint32_t func,
769 enum vcpu_state *next_state)
770{
771 switch (func) {
772 case FFA_MSG_SEND_DIRECT_REQ_64:
773 case FFA_MSG_SEND_DIRECT_REQ_32:
774 case FFA_MSG_SEND_DIRECT_REQ2_64: {
775 struct vcpu *vcpu = locked_vcpu.vcpu;
776
777 assert(vcpu != NULL);
778 /* Rule 1. */
779 if (vcpu->rt_model != RTM_SP_INIT) {
780 *next_state = VCPU_STATE_BLOCKED;
781 return true;
782 }
783
784 return false;
785 }
786 case FFA_MSG_WAIT_32:
787 /* Rule 2. Fall through. */
788 case FFA_ERROR_32:
789 /* Rule 3. */
790 *next_state = VCPU_STATE_WAITING;
791 return true;
792 case FFA_YIELD_32:
793 /* Rule 4. Fall through. */
794 case FFA_RUN_32:
795 /* Rule 6. Fall through. */
796 case FFA_MSG_SEND_DIRECT_RESP_64:
797 case FFA_MSG_SEND_DIRECT_RESP_32:
798 case FFA_MSG_SEND_DIRECT_RESP2_64:
799 /* Rule 5. Fall through. */
800 default:
801 /* Deny state transitions by default. */
802 return false;
803 }
804}
805
806/**
807 * Check if the runtime model (state machine) of the current SP supports the
808 * given FF-A ABI invocation. If yes, next_state represents the state to which
809 * the current vcpu would transition upon the FF-A ABI invocation as determined
810 * by the Partition runtime model.
811 */
812bool ffa_cpu_cycles_check_runtime_state_transition(
813 struct vcpu_locked current_locked, ffa_id_t vm_id,
814 ffa_id_t receiver_vm_id, struct vcpu_locked locked_vcpu, uint32_t func,
815 enum vcpu_state *next_state)
816{
817 bool allowed = false;
818 struct vcpu *current = current_locked.vcpu;
819
820 assert(current != NULL);
821
822 /* Perform state transition checks only for Secure Partitions. */
823 if (!vm_id_is_current_world(vm_id)) {
824 return true;
825 }
826
827 switch (current->rt_model) {
828 case RTM_FFA_RUN:
829 allowed = plat_ffa_check_rtm_ffa_run(
830 current_locked, locked_vcpu, func, next_state);
831 break;
832 case RTM_FFA_DIR_REQ:
833 allowed = plat_ffa_check_rtm_ffa_dir_req(
834 current_locked, locked_vcpu, receiver_vm_id, func,
835 next_state);
836 break;
837 case RTM_SEC_INTERRUPT:
838 allowed = plat_ffa_check_rtm_sec_interrupt(
839 current_locked, locked_vcpu, func, next_state);
840 break;
841 case RTM_SP_INIT:
842 allowed = plat_ffa_check_rtm_sp_init(locked_vcpu, func,
843 next_state);
844 break;
845 default:
846 dlog_error(
847 "Illegal Runtime Model specified by SP%x on CPU%zx\n",
848 current->vm->id, cpu_index(current->cpu));
849 allowed = false;
850 break;
851 }
852
853 if (!allowed) {
854 dlog_verbose("State transition denied\n");
855 }
856
857 return allowed;
858}
859
860/*
861 * Handle FFA_ERROR_32 call according to the given error code.
862 *
863 * Error codes other than FFA_ABORTED, and cases of FFA_ABORTED not
864 * in RTM_SP_INIT runtime model, not implemented. Refer to section 8.5
865 * of FF-A 1.2 spec.
866 */
867struct ffa_value plat_ffa_error_32(struct vcpu *current, struct vcpu **next,
868 enum ffa_error error_code)
869{
870 struct vcpu_locked current_locked;
871 struct vm_locked vm_locked;
872 enum partition_runtime_model rt_model;
873 struct ffa_value ret = api_ffa_interrupt_return(0);
874
875 vm_locked = vm_lock(current->vm);
876 current_locked = vcpu_lock(current);
877 rt_model = current_locked.vcpu->rt_model;
878
879 if (error_code == FFA_ABORTED && rt_model == RTM_SP_INIT) {
880 dlog_error("Aborting SP %#x from vCPU %u\n", current->vm->id,
881 vcpu_index(current));
882
883 atomic_store_explicit(&current->vm->aborting, true,
884 memory_order_relaxed);
885
886 ffa_vm_free_resources(vm_locked);
887
888 if (sp_boot_next(current_locked, next)) {
889 goto out;
890 }
891
892 /*
893 * Relinquish control back to the NWd. Return
894 * FFA_MSG_WAIT_32 to indicate to SPMD that SPMC
895 * has successfully finished initialization.
896 */
897 *next = api_switch_to_other_world(
898 current_locked,
899 (struct ffa_value){.func = FFA_MSG_WAIT_32},
900 VCPU_STATE_ABORTED);
901
902 goto out;
903 }
904 ret = ffa_error(FFA_NOT_SUPPORTED);
905out:
906 vcpu_unlock(&current_locked);
907 vm_unlock(&vm_locked);
908 return ret;
909}