SPM: PSA API working under Thread mode when level 1
This patch redirects PSA API into a customized 'thread call' ABI to
make it execute in thread mode, when:
- Runtime backend IPC and Isolation Level 1.
This 'thread call' ABI happens in 'Thread mode', and:
- Switch to SPM stack after PSA APIs are called. The working stack
re-uses the NS Agent stack to save runtime memory or allocated a
dedicated stack for it if no Trustzone NS Agent is available. No
need to make SPM working under 'Handler mode' in this case.
- Lock scheduler to ensure PSA API context is not nested because of
scheduling. The locking is performed by setting a flag, and the
scheduler entry checks this flag to decide schedule or not.
- When PSA API returns, switch back to the caller stack. And trigger
scheduler in the caller stack if a scheduling is expected. This
helps the scheduler context management.
- SPM functionalities other than PSA API are still using SVC-based
implementation, such as SPM initialization and log info flushing.
The content of this patch:
- Define interfaces, ABI dispatcher and architecture modifications
to support handling PSA API under thread mode.
- Related header file and source path adjustment to help the build pass.
- Adjust IDLE partition stack size to make runtime execution work, the
original size is too compact to run under debug build of specific
platforms.
Change-Id: I52add3f57ef0f958d25725efb4eb702617586907
Signed-off-by: Ken Liu <Ken.Liu@arm.com>
Co-authored-by: Mingyang Sun <Mingyang.Sun@arm.com>
diff --git a/secure_fw/spm/ffm/backend_ipc.c b/secure_fw/spm/ffm/backend_ipc.c
index 3b23e1e..cd35e36 100644
--- a/secure_fw/spm/ffm/backend_ipc.c
+++ b/secure_fw/spm/ffm/backend_ipc.c
@@ -6,6 +6,7 @@
*/
#include <stdint.h>
+#include "compiler_ext_defs.h"
#include "spm_ipc.h"
#include "tfm_hal_isolation.h"
#include "tfm_rpc.h"
@@ -20,6 +21,24 @@
/* Declare the global component list */
struct partition_head_t partition_listhead;
+#ifdef CONFIG_TFM_PSA_API_THREAD_CALL
+
+#ifdef TFM_MULTI_CORE_TOPOLOGY
+/* TODO: To be checked when RPC design updates. */
+static uint8_t spm_stack_local[CONFIG_TFM_SPM_THREAD_STACK_SIZE] __aligned(8);
+struct context_ctrl_t spm_thread_context = {
+ .sp = (uint32_t)&spm_stack_local[CONFIG_TFM_SPM_THREAD_STACK_SIZE],
+ .sp_limit = (uint32_t)spm_stack_local,
+ .reserved = 0,
+ .exc_ret = 0,
+};
+struct context_ctrl_t *p_spm_thread_context = &spm_thread_context;
+#else
+struct context_ctrl_t *p_spm_thread_context;
+#endif
+
+#endif
+
/*
* Send message and wake up the SP who is waiting on message queue, block the
* current thread and triggere scheduler.
@@ -78,6 +97,11 @@
if (p_pldi->pid == TFM_SP_NON_SECURE_ID) {
p_param = (void *)tfm_spm_hal_get_ns_entry_point();
+
+#ifdef CONFIG_TFM_PSA_API_THREAD_CALL
+ SPM_THREAD_CONTEXT = &p_pt->ctx_ctrl;
+#endif
+
}
thrd_start(&p_pt->thrd,
diff --git a/secure_fw/spm/ffm/psa_api.c b/secure_fw/spm/ffm/psa_api.c
index c11fce5..62ccb7c 100644
--- a/secure_fw/spm/ffm/psa_api.c
+++ b/secure_fw/spm/ffm/psa_api.c
@@ -15,9 +15,9 @@
#include "load/partition_defs.h"
#include "load/service_defs.h"
#include "load/interrupt_defs.h"
-#include "psa_api.h"
#include "utilities.h"
#include "ffm/backend.h"
+#include "ffm/psa_api.h"
#include "ffm/spm_error_base.h"
#include "tfm_rpc.h"
#include "tfm_spm_hal.h"
diff --git a/secure_fw/spm/ffm/psa_api.h b/secure_fw/spm/ffm/psa_api.h
deleted file mode 100644
index 9ed6d0f..0000000
--- a/secure_fw/spm/ffm/psa_api.h
+++ /dev/null
@@ -1,352 +0,0 @@
-/*
- * Copyright (c) 2019-2021, Arm Limited. All rights reserved.
- *
- * SPDX-License-Identifier: BSD-3-Clause
- *
- */
-
-#ifndef __PSA_API_H__
-#define __PSA_API_H__
-
-#include <stdint.h>
-#include <stdbool.h>
-#include "psa/client.h"
-#include "psa/service.h"
-
-#define PROGRAMMER_ERROR_NULL
-#define TFM_PROGRAMMER_ERROR(ns_caller, error_status) \
- do { \
- if (ns_caller) { \
- return error_status; \
- } else { \
- tfm_core_panic(); \
- } \
- } while (0)
-
-/**
- * \brief This function get the current PSA RoT lifecycle state.
- *
- * \return state The current security lifecycle state of the PSA
- * RoT. The PSA state and implementation state are
- * encoded as follows:
- * \arg state[15:8] – PSA lifecycle state
- * \arg state[7:0] – IMPLEMENTATION DEFINED state
- */
-uint32_t tfm_spm_get_lifecycle_state(void);
-
-/* PSA Client API function body, for privileged use only. */
-
-/**
- * \brief handler for \ref psa_framework_version.
- *
- * \return version The version of the PSA Framework implementation
- * that is providing the runtime services.
- */
-uint32_t tfm_spm_client_psa_framework_version(void);
-
-/**
- * \brief handler for \ref psa_version.
- *
- * \param[in] sid RoT Service identity.
- *
- * \retval PSA_VERSION_NONE The RoT Service is not implemented, or the
- * caller is not permitted to access the service.
- * \retval > 0 The version of the implemented RoT Service.
- */
-uint32_t tfm_spm_client_psa_version(uint32_t sid);
-
-/**
- * \brief handler for \ref psa_connect.
- *
- * \param[in] sid RoT Service identity.
- * \param[in] version The version of the RoT Service.
- *
- * \retval PSA_SUCCESS Success.
- * \retval PSA_ERROR_CONNECTION_REFUSED The SPM or RoT Service has refused the
- * connection.
- * \retval PSA_ERROR_CONNECTION_BUSY The SPM or RoT Service cannot make the
- * connection at the moment.
- * \retval "Does not return" The RoT Service ID and version are not
- * supported, or the caller is not permitted to
- * access the service.
- */
-psa_status_t tfm_spm_client_psa_connect(uint32_t sid, uint32_t version);
-
-/**
- * \brief handler for \ref psa_call.
- *
- * \param[in] handle Service handle to the established connection,
- * \ref psa_handle_t
- * \param[in] ctrl_param Parameters combined in uint32_t,
- * includes request type, in_num and out_num.
- * \param[in] inptr Array of input psa_invec structures.
- * \ref psa_invec
- * \param[in] outptr Array of output psa_outvec structures.
- * \ref psa_outvec
- *
- * \retval PSA_SUCCESS Success.
- * \retval "Does not return" The call is invalid, one or more of the
- * following are true:
- * \arg An invalid handle was passed.
- * \arg The connection is already handling a request.
- * \arg An invalid memory reference was provided.
- * \arg in_num + out_num > PSA_MAX_IOVEC.
- * \arg The message is unrecognized by the RoT
- * Service or incorrectly formatted.
- */
-psa_status_t tfm_spm_client_psa_call(psa_handle_t handle,
- uint32_t ctrl_param,
- const psa_invec *inptr,
- psa_outvec *outptr);
-
-/**
- * \brief handler for \ref psa_close.
- *
- * \param[in] handle Service handle to the connection to be closed,
- * \ref psa_handle_t
- *
- * \retval void Success.
- * \retval "Does not return" The call is invalid, one or more of the
- * following are true:
- * \arg An invalid handle was provided that is not
- * the null handle.
- * \arg The connection is handling a request.
- */
-void tfm_spm_client_psa_close(psa_handle_t handle);
-
-/* PSA Partition API function body, for privileged use only. */
-
-/**
- * \brief Function body of \ref psa_wait.
- *
- * \param[in] signal_mask A set of signals to query. Signals that are not
- * in this set will be ignored.
- * \param[in] timeout Specify either blocking \ref PSA_BLOCK or
- * polling \ref PSA_POLL operation.
- *
- * \retval >0 At least one signal is asserted.
- * \retval 0 No signals are asserted. This is only seen when
- * a polling timeout is used.
- */
-psa_signal_t tfm_spm_partition_psa_wait(psa_signal_t signal_mask,
- uint32_t timeout);
-
-/**
- * \brief Function body of \ref psa_get.
- *
- * \param[in] signal The signal value for an asserted RoT Service.
- * \param[out] msg Pointer to \ref psa_msg_t object for receiving
- * the message.
- *
- * \retval PSA_SUCCESS Success, *msg will contain the delivered
- * message.
- * \retval PSA_ERROR_DOES_NOT_EXIST Message could not be delivered.
- * \retval "PROGRAMMER ERROR" The call is invalid because one or more of the
- * following are true:
- * \arg signal has more than a single bit set.
- * \arg signal does not correspond to an RoT Service.
- * \arg The RoT Service signal is not currently
- * asserted.
- * \arg The msg pointer provided is not a valid memory
- * reference.
- */
-psa_status_t tfm_spm_partition_psa_get(psa_signal_t signal, psa_msg_t *msg);
-
-/**
- * \brief Function body of \ref psa_set_rhandle.
- *
- * \param[in] msg_handle Handle for the client's message.
- * \param[in] rhandle Reverse handle allocated by the RoT Service.
- *
- * \retval void Success, rhandle will be provided with all
- * subsequent messages delivered on this
- * connection.
- * \retval "PROGRAMMER ERROR" msg_handle is invalid.
- */
-void tfm_spm_partition_psa_set_rhandle(psa_handle_t msg_handle, void *rhandle);
-
-/**
- * \brief Function body of \ref psa_read.
- *
- * \param[in] msg_handle Handle for the client's message.
- * \param[in] invec_idx Index of the input vector to read from. Must be
- * less than \ref PSA_MAX_IOVEC.
- * \param[out] buffer Buffer in the Secure Partition to copy the
- * requested data to.
- * \param[in] num_bytes Maximum number of bytes to be read from the
- * client input vector.
- *
- * \retval >0 Number of bytes copied.
- * \retval 0 There was no remaining data in this input
- * vector.
- * \retval "PROGRAMMER ERROR" The call is invalid, one or more of the
- * following are true:
- * \arg msg_handle is invalid.
- * \arg msg_handle does not refer to a
- * \ref PSA_IPC_CALL message.
- * \arg invec_idx is equal to or greater than
- * \ref PSA_MAX_IOVEC.
- * \arg the memory reference for buffer is invalid or
- * not writable.
- */
-size_t tfm_spm_partition_psa_read(psa_handle_t msg_handle, uint32_t invec_idx,
- void *buffer, size_t num_bytes);
-
-/**
- * \brief Function body of psa_skip.
- *
- * \param[in] msg_handle Handle for the client's message.
- * \param[in] invec_idx Index of input vector to skip from. Must be
- * less than \ref PSA_MAX_IOVEC.
- * \param[in] num_bytes Maximum number of bytes to skip in the client
- * input vector.
- *
- * \retval >0 Number of bytes skipped.
- * \retval 0 There was no remaining data in this input
- * vector.
- * \retval "PROGRAMMER ERROR" The call is invalid, one or more of the
- * following are true:
- * \arg msg_handle is invalid.
- * \arg msg_handle does not refer to a request
- * message.
- * \arg invec_idx is equal to or greater than
- * \ref PSA_MAX_IOVEC.
- */
-size_t tfm_spm_partition_psa_skip(psa_handle_t msg_handle, uint32_t invec_idx,
- size_t num_bytes);
-
-/**
- * \brief Function body of \ref psa_write.
- *
- * \param[in] msg_handle Handle for the client's message.
- * \param[out] outvec_idx Index of output vector in message to write to.
- * Must be less than \ref PSA_MAX_IOVEC.
- * \param[in] buffer Buffer with the data to write.
- * \param[in] num_bytes Number of bytes to write to the client output
- * vector.
- *
- * \retval void Success
- * \retval "PROGRAMMER ERROR" The call is invalid, one or more of the
- * following are true:
- * \arg msg_handle is invalid.
- * \arg msg_handle does not refer to a request
- * message.
- * \arg outvec_idx is equal to or greater than
- * \ref PSA_MAX_IOVEC.
- * \arg The memory reference for buffer is invalid.
- * \arg The call attempts to write data past the end
- * of the client output vector.
- */
-void tfm_spm_partition_psa_write(psa_handle_t msg_handle, uint32_t outvec_idx,
- const void *buffer, size_t num_bytes);
-
-/**
- * \brief Function body of \ref psa_reply.
- *
- * \param[in] msg_handle Handle for the client's message.
- * \param[in] status Message result value to be reported to the
- * client.
- *
- * \retval void Success.
- * \retval "PROGRAMMER ERROR" The call is invalid, one or more of the
- * following are true:
- * \arg msg_handle is invalid.
- * \arg An invalid status code is specified for the
- * type of message.
- */
-void tfm_spm_partition_psa_reply(psa_handle_t msg_handle, psa_status_t status);
-
-/**
- * \brief Function body of \ref psa_norify.
- *
- * \param[in] partition_id Secure Partition ID of the target partition.
- *
- * \retval void Success.
- * \retval "PROGRAMMER ERROR" partition_id does not correspond to a Secure
- * Partition.
- */
-void tfm_spm_partition_psa_notify(int32_t partition_id);
-
-/**
- * \brief Function body of \ref psa_clear.
- *
- * \retval void Success.
- * \retval "PROGRAMMER ERROR" The Secure Partition's doorbell signal is not
- * currently asserted.
- */
-void tfm_spm_partition_psa_clear(void);
-
-/**
- * \brief Function body of \ref psa_eoi.
- *
- * \param[in] irq_signal The interrupt signal that has been processed.
- *
- * \retval void Success.
- * \retval "PROGRAMMER ERROR" The call is invalid, one or more of the
- * following are true:
- * \arg irq_signal is not an interrupt signal.
- * \arg irq_signal indicates more than one signal.
- * \arg irq_signal is not currently asserted.
- * \arg The interrupt is not using SLIH.
- */
-void tfm_spm_partition_psa_eoi(psa_signal_t irq_signal);
-
-/**
- * \brief Function body of \ref psa_panic.
- *
- * \retval "Does not return"
- */
-void tfm_spm_partition_psa_panic(void);
-
-/**
- * \brief Function body of \ref psa_irq_enable.
- *
- * \param[in] irq_signal The signal for the interrupt to be enabled.
- * This must have a single bit set, which must be the
- * signal value for an interrupt in the calling Secure
- * Partition.
- *
- * \retval void
- * \retval "PROGRAMMER ERROR" If one or more of the following are true:
- * \arg \a irq_signal is not an interrupt signal.
- * \arg \a irq_signal indicates more than one signal.
- */
-void tfm_spm_partition_irq_enable(psa_signal_t irq_signal);
-
-/**
- * \brief Function body of psa_irq_disable.
- *
- * \param[in] irq_signal The signal for the interrupt to be disabled.
- * This must have a single bit set, which must be the
- * signal value for an interrupt in the calling Secure
- * Partition.
- *
- * \retval 0 The interrupt was disabled prior to this call.
- * 1 The interrupt was enabled prior to this call.
- * \retval "PROGRAMMER ERROR" If one or more of the following are true:
- * \arg \a irq_signal is not an interrupt signal.
- * \arg \a irq_signal indicates more than one signal.
- *
- * \note The current implementation always return 1. Do not use the return.
- */
-psa_irq_status_t tfm_spm_partition_irq_disable(psa_signal_t irq_signal);
-
-/**
- * \brief Function body of \ref psa_reset_signal.
- *
- * \param[in] irq_signal The interrupt signal to be reset.
- * This must have a single bit set, corresponding to a
- * currently asserted signal for an interrupt that is
- * defined to use FLIH handling.
- *
- * \retval void
- * \retval "Programmer Error" if one or more of the following are true:
- * \arg \a irq_signal is not a signal for an interrupt
- * that is specified with FLIH handling in the Secure
- * Partition manifest.
- * \arg \a irq_signal indicates more than one signal.
- * \arg \a irq_signal is not currently asserted.
- */
-void tfm_spm_partition_psa_reset_signal(psa_signal_t irq_signal);
-
-#endif /* __PSA_API_H__ */