Merge pull request #1707 from antonio-nino-diaz-arm/an/spm

SPM: Initial prototype based on SPCI and SPRT

lib/sprt/sprt_queue.h

+/*
+ * Copyright (c) 2018, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef SPRT_QUEUE_H
+#define SPRT_QUEUE_H
+
+#include <stdint.h>
+
+/* Struct that defines a queue. Not to be used directly. */
+struct __attribute__((__packed__)) sprt_queue {
+	uint32_t entry_num;	/* Number of entries */
+	uint32_t entry_size;	/* Size of an entry */
+	uint32_t idx_write;	/* Index of first empty entry */
+	uint32_t idx_read;	/* Index of first entry to read */
+	uint8_t  data[0];	/* Start of data */
+};
+
+#define SPRT_QUEUE_HEADER_SIZE	(sizeof(struct sprt_queue))
+
+/*
+ * Initializes a memory region to be used as a queue of the given number of
+ * entries with the specified size.
+ */
+void sprt_queue_init(void *queue_base, uint32_t entry_num, uint32_t entry_size);
+
+/* Returns 1 if the queue is empty, 0 otherwise */
+int sprt_queue_is_empty(void *queue_base);
+
+/* Returns 1 if the queue is full, 0 otherwise */
+int sprt_queue_is_full(void *queue_base);
+
+/*
+ * Pushes a new entry intro the queue. Returns 0 on success, -ENOMEM if the
+ * queue is full.
+ */
+int sprt_queue_push(void *queue_base, const void *entry);
+
+/*
+ * Pops an entry from the queue. Returns 0 on success, -ENOENT if the queue is
+ * empty.
+ */
+int sprt_queue_pop(void *queue_base, void *entry);
+
+#endif /* SPRT_QUEUE_H */

lib/xlat_tables_v2/xlat_tables_core.c

@@ -1101,6 +1101,36 @@ int mmap_remove_dynamic_region_ctx(xlat_ctx_t *ctx, uintptr_t base_va,
 	return 0;
 }
 
+void xlat_setup_dynamic_ctx(xlat_ctx_t *ctx, unsigned long long pa_max,
+			    uintptr_t va_max, struct mmap_region *mmap,
+			    unsigned int mmap_num, uint64_t **tables,
+			    unsigned int tables_num, uint64_t *base_table,
+			    int xlat_regime, int *mapped_regions)
+{
+	ctx->xlat_regime = xlat_regime;
+
+	ctx->pa_max_address = pa_max;
+	ctx->va_max_address = va_max;
+
+	ctx->mmap = mmap;
+	ctx->mmap_num = mmap_num;
+	memset(ctx->mmap, 0, sizeof(struct mmap_region) * mmap_num);
+
+	ctx->tables = (void *) tables;
+	ctx->tables_num = tables_num;
+
+	uintptr_t va_space_size = va_max + 1;
+	ctx->base_level = GET_XLAT_TABLE_LEVEL_BASE(va_space_size);
+	ctx->base_table = base_table;
+	ctx->base_table_entries = GET_NUM_BASE_LEVEL_ENTRIES(va_space_size);
+
+	ctx->tables_mapped_regions = mapped_regions;
+
+	ctx->max_pa = 0;
+	ctx->max_va = 0;
+	ctx->initialized = 0;
+}
+
 #endif /* PLAT_XLAT_TABLES_DYNAMIC */
 
 void __init init_xlat_tables_ctx(xlat_ctx_t *ctx)

make_helpers/defaults.mk

@@ -162,6 +162,9 @@ SPD				:= none
 # For including the Secure Partition Manager
 ENABLE_SPM			:= 0
 
+# Use the deprecated SPM based on MM
+SPM_DEPRECATED			:= 1
+
 # Flag to introduce an infinite loop in BL1 just before it exits into the next
 # image. This is meant to help debugging the post-BL2 phase.
 SPIN_ON_BL1_EXIT		:= 0

plat/arm/board/fvp/fvp_common.c

@@ -96,9 +96,12 @@ const mmap_region_t plat_arm_mmap[] = {
 	ARM_MAP_BL1_RW,
 #endif
 #endif /* TRUSTED_BOARD_BOOT */
-#if ENABLE_SPM
+#if ENABLE_SPM && SPM_DEPRECATED
 	ARM_SP_IMAGE_MMAP,
 #endif
+#if ENABLE_SPM && !SPM_DEPRECATED
+	PLAT_MAP_SP_PACKAGE_MEM_RW,
+#endif
 #if ARM_BL31_IN_DRAM
 	ARM_MAP_BL31_SEC_DRAM,
 #endif
@@ -124,13 +127,16 @@ const mmap_region_t plat_arm_mmap[] = {
 	MAP_DEVICE0,
 	MAP_DEVICE1,
 	ARM_V2M_MAP_MEM_PROTECT,
-#if ENABLE_SPM
+#if ENABLE_SPM && SPM_DEPRECATED
 	ARM_SPM_BUF_EL3_MMAP,
+#endif
+#if ENABLE_SPM && !SPM_DEPRECATED
+	PLAT_MAP_SP_PACKAGE_MEM_RO,
 #endif
 	{0}
 };
 
-#if ENABLE_SPM && defined(IMAGE_BL31)
+#if ENABLE_SPM && defined(IMAGE_BL31) && SPM_DEPRECATED
 const mmap_region_t plat_arm_secure_partition_mmap[] = {
 	V2M_MAP_IOFPGA_EL0, /* for the UART */
 	MAP_REGION_FLAT(DEVICE0_BASE,				\
@@ -184,7 +190,7 @@ static unsigned int get_interconnect_master(void)
 }
 #endif
 
-#if ENABLE_SPM && defined(IMAGE_BL31)
+#if ENABLE_SPM && defined(IMAGE_BL31) && SPM_DEPRECATED
 /*
  * Boot information passed to a secure partition during initialisation. Linear
  * indices in MP information will be filled at runtime.
@@ -232,7 +238,6 @@ const struct secure_partition_boot_info *plat_get_secure_partition_boot_info(
 {
 	return &plat_arm_secure_partition_boot_info;
 }
-
 #endif
 
 /*******************************************************************************

plat/arm/board/fvp/include/platform_def.h

@@ -13,7 +13,7 @@
 #  define PLAT_XLAT_TABLES_DYNAMIC     1
 # endif
 #else
-# if defined(IMAGE_BL31) && RESET_TO_BL31
+# if defined(IMAGE_BL31) && (RESET_TO_BL31 || (ENABLE_SPM && !SPM_DEPRECATED))
 #  define PLAT_XLAT_TABLES_DYNAMIC     1
 # endif
 #endif /* AARCH32 */
@@ -72,8 +72,8 @@
 #if defined(IMAGE_BL31)
 # if ENABLE_SPM
 #  define PLAT_ARM_MMAP_ENTRIES		9
-#  define MAX_XLAT_TABLES		7
-#  define PLAT_SP_IMAGE_MMAP_REGIONS	7
+#  define MAX_XLAT_TABLES		9
+#  define PLAT_SP_IMAGE_MMAP_REGIONS	30
 #  define PLAT_SP_IMAGE_MAX_XLAT_TABLES	10
 # else
 #  define PLAT_ARM_MMAP_ENTRIES		8
@@ -123,7 +123,11 @@
  * calculated using the current BL31 PROGBITS debug size plus the sizes of
  * BL2 and BL1-RW
  */
+#if ENABLE_SPM && !SPM_DEPRECATED
+#define PLAT_ARM_MAX_BL31_SIZE		UL(0x60000)
+#else
 #define PLAT_ARM_MAX_BL31_SIZE		UL(0x3B000)
+#endif
 
 #ifdef AARCH32
 /*
@@ -153,7 +157,7 @@
 # define PLATFORM_STACK_SIZE		UL(0x400)
 #elif defined(IMAGE_BL31)
 # if ENABLE_SPM
-#  define PLATFORM_STACK_SIZE		UL(0x500)
+#  define PLATFORM_STACK_SIZE		UL(0x600)
 # elif PLAT_XLAT_TABLES_DYNAMIC
 #  define PLATFORM_STACK_SIZE		UL(0x800)
 # else

plat/arm/common/arm_common.mk

@@ -244,6 +244,16 @@ BL31_SOURCES		+=	lib/extensions/ras/std_err_record.c		\
 				lib/extensions/ras/ras_common.c
 endif
 
+# SPM uses libfdt in Arm platforms
+ifeq (${SPM_DEPRECATED},0)
+ifeq (${ENABLE_SPM},1)
+BL31_SOURCES		+=	common/fdt_wrappers.c			\
+				plat/common/plat_spm_rd.c		\
+				plat/common/plat_spm_sp.c		\
+				${LIBFDT_SRCS}
+endif
+endif
+
 ifneq (${TRUSTED_BOARD_BOOT},0)
 
     # Include common TBB sources

plat/common/plat_spm_rd.c

+/*
+ * Copyright (c) 2018, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <debug.h>
+#include <fdt_wrappers.h>
+#include <libfdt.h>
+#include <platform_def.h>
+#include <sp_res_desc.h>
+#include <string.h>
+#include <object_pool.h>
+
+/*******************************************************************************
+ * Resource pool
+ ******************************************************************************/
+static struct sp_rd_sect_mem_region rd_mem_regions[PLAT_SPM_MEM_REGIONS_MAX];
+static OBJECT_POOL_ARRAY(rd_mem_regions_pool, rd_mem_regions);
+
+static struct sp_rd_sect_notification rd_notifs[PLAT_SPM_NOTIFICATIONS_MAX];
+static OBJECT_POOL_ARRAY(rd_notifs_pool, rd_notifs);
+
+static struct sp_rd_sect_service rd_services[PLAT_SPM_SERVICES_MAX];
+static OBJECT_POOL_ARRAY(rd_services_pool, rd_services);
+
+/*******************************************************************************
+ * Attribute section handler
+ ******************************************************************************/
+static void rd_parse_attribute(struct sp_rd_sect_attribute *attr,
+			       const void *fdt, int node)
+{
+	int rc = 0;
+
+	/* The minimum size that can be read from the DTB is 32-bit. */
+	uint32_t version, sp_type, runtime_el, exec_type;
+	uint32_t panic_policy, xlat_granule;
+
+	rc |= fdtw_read_cells(fdt, node, "version", 1, &version);
+
+	if (version != 1) {
+		ERROR("Unsupported resource description version: 0x%x\n",
+		      version);
+		panic();
+	}
+
+	rc |= fdtw_read_cells(fdt, node, "sp_type", 1, &sp_type);
+	rc |= fdtw_read_cells(fdt, node, "pe_mpidr", 1, &attr->pe_mpidr);
+	rc |= fdtw_read_cells(fdt, node, "runtime_el", 1, &runtime_el);
+	rc |= fdtw_read_cells(fdt, node, "exec_type", 1, &exec_type);
+	rc |= fdtw_read_cells(fdt, node, "panic_policy", 1, &panic_policy);
+	rc |= fdtw_read_cells(fdt, node, "xlat_granule", 1, &xlat_granule);
+	rc |= fdtw_read_cells(fdt, node, "binary_size", 1, &attr->binary_size);
+	rc |= fdtw_read_cells(fdt, node, "load_address", 2, &attr->load_address);
+	rc |= fdtw_read_cells(fdt, node, "entrypoint", 2, &attr->entrypoint);
+
+	attr->version = version;
+	attr->sp_type = sp_type;
+	attr->runtime_el = runtime_el;
+	attr->exec_type = exec_type;
+	attr->panic_policy = panic_policy;
+	attr->xlat_granule = xlat_granule;
+
+	VERBOSE(" Attribute Section:\n");
+	VERBOSE("  version: 0x%x\n", version);
+	VERBOSE("  sp_type: 0x%x\n", sp_type);
+	VERBOSE("  pe_mpidr: 0x%x\n", attr->pe_mpidr);
+	VERBOSE("  runtime_el: 0x%x\n", runtime_el);
+	VERBOSE("  exec_type: 0x%x\n", exec_type);
+	VERBOSE("  panic_policy: 0x%x\n", panic_policy);
+	VERBOSE("  xlat_granule: 0x%x\n", xlat_granule);
+	VERBOSE("  binary_size: 0x%x\n", attr->binary_size);
+	VERBOSE("  load_address: 0x%llx\n", attr->load_address);
+	VERBOSE("  entrypoint: 0x%llx\n", attr->entrypoint);
+
+	if (rc) {
+		ERROR("Failed to read attribute node elements.\n");
+		panic();
+	}
+}
+
+/*******************************************************************************
+ * Memory regions section handlers
+ ******************************************************************************/
+static void rd_parse_memory_region(struct sp_rd_sect_mem_region *rdmem,
+				   const void *fdt, int node)
+{
+	int rc = 0;
+	char name[RD_MEM_REGION_NAME_LEN];
+
+	rc |= fdtw_read_string(fdt, node, "str", (char *)&name, sizeof(name));
+	rc |= fdtw_read_cells(fdt, node, "attr", 1, &rdmem->attr);
+	rc |= fdtw_read_cells(fdt, node, "base", 2, &rdmem->base);
+	rc |= fdtw_read_cells(fdt, node, "size", 2, &rdmem->size);
+
+	size_t len = strlcpy(rdmem->name, name, RD_MEM_REGION_NAME_LEN);
+
+	if (len >= RD_MEM_REGION_NAME_LEN) {
+		WARN("Memory region name truncated: '%s'\n", name);
+	}
+
+	VERBOSE(" Memory Region:\n");
+	VERBOSE("  name: '%s'\n", rdmem->name);
+	VERBOSE("  attr: 0x%x\n", rdmem->attr);
+	VERBOSE("  base: 0x%llx\n", rdmem->base);
+	VERBOSE("  size: 0x%llx\n", rdmem->size);
+
+	if (rc) {
+		ERROR("Failed to read mem_region node elements.\n");
+		panic();
+	}
+}
+
+static void rd_parse_memory_regions(struct sp_res_desc *rd, const void *fdt,
+				    int node)
+{
+	int child;
+	struct sp_rd_sect_mem_region *rdmem, *old_rdmem;
+
+	fdt_for_each_subnode(child, fdt, node) {
+		rdmem = pool_alloc(&rd_mem_regions_pool);
+
+		/* Add element to the start of the list */
+		old_rdmem = rd->mem_region;
+		rd->mem_region = rdmem;
+		rdmem->next = old_rdmem;
+
+		rd_parse_memory_region(rdmem, fdt, child);
+	}
+
+	if ((child < 0) && (child != -FDT_ERR_NOTFOUND)) {
+		ERROR("%d: fdt_for_each_subnode(): %d\n", __LINE__, node);
+		panic();
+	}
+}
+
+/*******************************************************************************
+ * Notifications section handlers
+ ******************************************************************************/
+static void rd_parse_notification(struct sp_rd_sect_notification *rdnot,
+				   const void *fdt, int node)
+{
+	int rc = 0;
+
+	rc |= fdtw_read_cells(fdt, node, "attr", 1, &rdnot->attr);
+	rc |= fdtw_read_cells(fdt, node, "pe", 1, &rdnot->pe);
+
+	VERBOSE(" Notification:\n");
+	VERBOSE("  attr: 0x%x\n", rdnot->attr);
+	VERBOSE("  pe: 0x%x\n", rdnot->pe);
+
+	if (rc) {
+		ERROR("Failed to read notification node elements.\n");
+		panic();
+	}
+}
+
+static void rd_parse_notifications(struct sp_res_desc *rd, const void *fdt, int node)
+{
+	int child;
+	struct sp_rd_sect_notification *rdnot, *old_rdnot;
+
+	fdt_for_each_subnode(child, fdt, node) {
+		rdnot = pool_alloc(&rd_notifs_pool);
+
+		/* Add element to the start of the list */
+		old_rdnot = rd->notification;
+		rd->notification = rdnot;
+		rdnot->next = old_rdnot;
+
+		rd_parse_notification(rdnot, fdt, child);
+	}
+
+	if ((child < 0) && (child != -FDT_ERR_NOTFOUND)) {
+		ERROR("%d: fdt_for_each_subnode(): %d\n", __LINE__, child);
+		panic();
+	}
+}
+
+/*******************************************************************************
+ * Services section handlers
+ ******************************************************************************/
+static void rd_parse_service(struct sp_rd_sect_service *rdsvc, const void *fdt,
+			     int node)
+{
+	int rc = 0;
+
+	/* The minimum size that can be read from the DTB is 32-bit. */
+	uint32_t accessibility, request_type, connection_quota;
+
+	rc |= fdtw_read_array(fdt, node, "uuid", 4, &rdsvc->uuid);
+	rc |= fdtw_read_cells(fdt, node, "accessibility", 1, &accessibility);
+	rc |= fdtw_read_cells(fdt, node, "request_type", 1, &request_type);
+	rc |= fdtw_read_cells(fdt, node, "connection_quota", 1, &connection_quota);
+	rc |= fdtw_read_cells(fdt, node, "sec_mem_size", 1, &rdsvc->secure_mem_size);
+	rc |= fdtw_read_cells(fdt, node, "interrupt_num", 1, &rdsvc->interrupt_num);
+
+	rdsvc->accessibility = accessibility;
+	rdsvc->request_type = request_type;
+	rdsvc->connection_quota = connection_quota;
+
+	VERBOSE(" Service:\n");
+	VERBOSE("  uuid: 0x%08x 0x%08x 0x%08x 0x%08x\n", rdsvc->uuid[0],
+		rdsvc->uuid[1], rdsvc->uuid[2], rdsvc->uuid[3]);
+	VERBOSE("  accessibility: 0x%x\n", accessibility);
+	VERBOSE("  request_type: 0x%x\n", request_type);
+	VERBOSE("  connection_quota: 0x%x\n", connection_quota);
+	VERBOSE("  secure_memory_size: 0x%x\n", rdsvc->secure_mem_size);
+	VERBOSE("  interrupt_num: 0x%x\n", rdsvc->interrupt_num);
+
+	if (rc) {
+		ERROR("Failed to read attribute node elements.\n");
+		panic();
+	}
+}
+
+static void rd_parse_services(struct sp_res_desc *rd, const void *fdt, int node)
+{
+	int child;
+	struct sp_rd_sect_service *rdsvc, *old_rdsvc;
+
+	fdt_for_each_subnode(child, fdt, node) {
+		rdsvc = pool_alloc(&rd_services_pool);
+
+		/* Add element to the start of the list */
+		old_rdsvc = rd->service;
+		rd->service = rdsvc;
+		rdsvc->next = old_rdsvc;
+
+		rd_parse_service(rdsvc, fdt, child);
+	}
+
+	if ((child < 0) && (child != -FDT_ERR_NOTFOUND)) {
+		ERROR("%d: fdt_for_each_subnode(): %d\n", __LINE__, node);
+		panic();
+	}
+}
+
+/*******************************************************************************
+ * Root node handler
+ ******************************************************************************/
+static void rd_parse_root(struct sp_res_desc *rd, const void *fdt, int root)
+{
+	int node;
+	char *str;
+
+	str = "attribute";
+	node = fdt_subnode_offset_namelen(fdt, root, str, strlen(str));
+	if (node < 0) {
+		ERROR("Root node doesn't contain subnode '%s'\n", str);
+		panic();
+	} else {
+		rd_parse_attribute(&rd->attribute, fdt, node);
+	}
+
+	str = "memory_regions";
+	node = fdt_subnode_offset_namelen(fdt, root, str, strlen(str));
+	if (node < 0) {
+		ERROR("Root node doesn't contain subnode '%s'\n", str);
+		panic();
+	} else {
+		rd_parse_memory_regions(rd, fdt, node);
+	}
+
+	str = "notifications";
+	node = fdt_subnode_offset_namelen(fdt, root, str, strlen(str));
+	if (node < 0) {
+		WARN("Root node doesn't contain subnode '%s'\n", str);
+	} else {
+		rd_parse_notifications(rd, fdt, node);
+	}
+
+	str = "services";
+	node = fdt_subnode_offset_namelen(fdt, root, str, strlen(str));
+	if (node < 0) {
+		WARN("Root node doesn't contain subnode '%s'\n", str);
+	} else {
+		rd_parse_services(rd, fdt, node);
+	}
+}
+
+/*******************************************************************************
+ * Platform handler to load resource descriptor blobs into the active Secure
+ * Partition context.
+ ******************************************************************************/
+int plat_spm_sp_rd_load(struct sp_res_desc *rd, const void *ptr, size_t size)
+{
+	int rc;
+	int root_node;
+
+	assert(rd != NULL);
+	assert(ptr != NULL);
+
+	INFO("Reading RD blob at address %p\n", ptr);
+
+	rc = fdt_check_header(ptr);
+	if (rc != 0) {
+		ERROR("Wrong format for resource descriptor blob (%d).\n", rc);
+		return -1;
+	}
+
+	root_node = fdt_node_offset_by_compatible(ptr, -1, "arm,sp_rd");
+	if (root_node < 0) {
+		ERROR("Unrecognized resource descriptor blob (%d)\n", rc);
+		return -1;
+	}
+
+	rd_parse_root(rd, ptr, root_node);
+
+	return 0;
+}

plat/common/plat_spm_sp.c

+/*
+ * Copyright (c) 2018, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <assert.h>
+#include <debug.h>
+#include <platform_def.h>
+#include <sptool.h>
+
+static unsigned int sp_next;
+
+/*******************************************************************************
+ * Platform handler get the address of a Secure Partition and its resource
+ * description blob. It iterates through all SPs detected by the platform. If
+ * there is information for another SP, it returns 0. If there are no more SPs,
+ * it returns -1.
+ ******************************************************************************/
+int plat_spm_sp_get_next_address(void **sp_base, size_t *sp_size,
+				 void **rd_base, size_t *rd_size)
+{
+	assert((sp_base != NULL) && (sp_size != NULL));
+	assert((rd_base != NULL) && (rd_base != NULL));
+
+	const uint64_t *pkg_base = (uint64_t *)PLAT_SP_PACKAGE_BASE;
+
+	struct sp_pkg_header *pkg_header = (struct sp_pkg_header *)pkg_base;
+
+	if (sp_next == 0) {
+		if (pkg_header->version != 0x1) {
+			ERROR("SP package has an unsupported version 0x%llx\n",
+			      pkg_header->version);
+			panic();
+		}
+	}
+
+	if (sp_next >= pkg_header->number_of_sp) {
+		/* No more partitions in the package */
+		return -1;
+	}
+
+	const struct sp_pkg_entry *entry_list =
+		(const struct sp_pkg_entry *)((uintptr_t)pkg_base
+					       + sizeof(struct sp_pkg_header));
+
+	const struct sp_pkg_entry *entry = &(entry_list[sp_next]);
+
+	uint64_t sp_offset = entry->sp_offset;
+	uint64_t rd_offset = entry->rd_offset;
+
+	uintptr_t pkg_sp_base = ((uintptr_t)PLAT_SP_PACKAGE_BASE + sp_offset);
+	uintptr_t pkg_rd_base = ((uintptr_t)PLAT_SP_PACKAGE_BASE + rd_offset);
+
+	uint64_t pkg_sp_size = entry->sp_size;
+	uint64_t pkg_rd_size = entry->rd_size;
+
+	uintptr_t pkg_end = (uintptr_t)PLAT_SP_PACKAGE_BASE
+			  + (uintptr_t)PLAT_SP_PACKAGE_SIZE - 1U;
+
+	/*
+	 * Check for overflows. The package header isn't trusted, so assert()
+	 * can't be used here.
+	 */
+
+	uintptr_t pkg_sp_end = pkg_sp_base + pkg_sp_size - 1U;
+	uintptr_t pkg_rd_end = pkg_rd_base + pkg_rd_size - 1U;
+
+	if ((pkg_sp_end > pkg_end) || (pkg_sp_end < pkg_sp_base)) {
+		ERROR("Invalid Secure Partition size (0x%llx)\n", pkg_sp_size);
+		panic();
+	}
+
+	if ((pkg_rd_end > pkg_end) || (pkg_rd_end < pkg_rd_base)) {
+		ERROR("Invalid Resource Description blob size (0x%llx)\n",
+		      pkg_rd_size);
+		panic();
+	}
+
+	/* Return location of the binaries. */
+
+	*sp_base = (void *)pkg_sp_base;
+	*sp_size = pkg_sp_size;
+	*rd_base = (void *)pkg_rd_base;
+	*rd_size = pkg_rd_size;
+
+	sp_next++;
+
+	return 0;
+}

services/std_svc/spm/README.rst

+This is a prototype loosely based on the SPCI Alpha and SPRT pre-alpha
+specifications. Any interface / platform API introduced for this is subject to
+change as it evolves.

services/std_svc/spm/spm.mk

@@ -11,13 +11,23 @@ ifneq (${ARCH},aarch64)
         $(error "Error: SPM is only supported on aarch64.")
 endif
 
+include lib/sprt/sprt_host.mk
+
 SPM_SOURCES	:=	$(addprefix services/std_svc/spm/,	\
 			${ARCH}/spm_helpers.S			\
 			${ARCH}/spm_shim_exceptions.S		\
+			spci.c					\
+			spm_buffers.c				\
 			spm_main.c				\
-			sp_setup.c				\
-			sp_xlat.c)
+			spm_setup.c				\
+			spm_xlat.c				\
+			sprt.c)					\
+			${SPRT_LIB_SOURCES}
+
+INCLUDES	+=	${SPRT_LIB_INCLUDES}
 
+# Force SMC Calling Convention 2 when using SPM
+SMCCC_MAJOR_VERSION	:=	2
 
 # Let the top-level Makefile know that we intend to include a BL32 image
 NEED_BL32		:=	yes

services/std_svc/spm/spm_buffers.c

+/*
+ * Copyright (c) 2018, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch_helpers.h>
+#include <platform_def.h>
+#include <spinlock.h>
+#include <utils_def.h>
+
+/*******************************************************************************
+ * Secure Service response global array. All the responses to the requests done
+ * to the Secure Partition are stored here. They are removed from the array as
+ * soon as their value is read.
+ ******************************************************************************/
+struct sprt_response {
+	int is_valid;
+	uint32_t token;
+	uint16_t client_id, handle;
+	u_register_t x1, x2, x3;
+};
+
+static struct sprt_response responses[PLAT_SPM_RESPONSES_MAX];
+
+static spinlock_t responses_lock;
+
+/* Add response to the global response buffer. Returns 0 on success else -1. */
+int spm_response_add(uint16_t client_id, uint16_t handle, uint32_t token,
+		     u_register_t x1, u_register_t x2, u_register_t x3)
+{
+	spin_lock(&responses_lock);
+
+	/* Make sure that there isn't any other response with the same token. */
+	for (unsigned int i = 0U; i < ARRAY_SIZE(responses); i++) {
+		struct sprt_response *resp = &(responses[i]);
+
+		if ((resp->is_valid == 1) && (resp->token == token)) {
+			return -1;
+		}
+	}
+
+	for (int i = 0; i < ARRAY_SIZE(responses); i++) {
+		struct sprt_response *resp = &(responses[i]);
+
+		if (resp->is_valid == 0) {
+			resp->token = token;
+			resp->client_id = client_id;
+			resp->handle = handle;
+			resp->x1 = x1;
+			resp->x2 = x2;
+			resp->x3 = x3;
+
+			dmbish();
+
+			resp->is_valid = 1;
+
+			spin_unlock(&responses_lock);
+
+			return 0;
+		}
+	}
+
+	spin_unlock(&responses_lock);
+
+	return -1;
+}
+
+/*
+ * Returns a response from the requests array and removes it from it. Returns 0
+ * on success, -1 if it wasn't found.
+ */
+int spm_response_get(uint16_t client_id, uint16_t handle, uint32_t token,
+		     u_register_t *x1, u_register_t *x2, u_register_t *x3)
+{
+	spin_lock(&responses_lock);
+
+	for (unsigned int i = 0U; i < ARRAY_SIZE(responses); i++) {
+		struct sprt_response *resp = &(responses[i]);
+
+		/* Ignore invalid entries */
+		if (resp->is_valid == 0) {
+			continue;
+		}
+
+		/* Make sure that all the information matches the stored one */
+		if ((resp->token != token) || (resp->client_id != client_id) ||
+		    (resp->handle != handle)) {
+			continue;
+		}
+
+		*x1 = resp->x1;
+		*x2 = resp->x2;
+		*x3 = resp->x3;
+
+		dmbish();
+
+		resp->is_valid = 0;
+
+		spin_unlock(&responses_lock);
+
+		return 0;
+	}
+
+	spin_unlock(&responses_lock);
+
+	return -1;
+}

services/std_svc/spm/spm_main.c

@@ -11,14 +11,14 @@
 #include <debug.h>
 #include <ehf.h>
 #include <errno.h>
-#include <mm_svc.h>
+#include <interrupt_mgmt.h>
 #include <platform.h>
 #include <runtime_svc.h>
-#include <secure_partition.h>
 #include <smccc.h>
 #include <smccc_helpers.h>
 #include <spinlock.h>
-#include <spm_svc.h>
+#include <string.h>
+#include <sprt_svc.h>
 #include <utils.h>
 #include <xlat_tables_v2.h>
 
@@ -27,7 +27,89 @@
 /*******************************************************************************
  * Secure Partition context information.
  ******************************************************************************/
-static sp_context_t sp_ctx;
+sp_context_t sp_ctx_array[PLAT_SPM_MAX_PARTITIONS];
+
+/* Last Secure Partition last used by the CPU */
+sp_context_t *cpu_sp_ctx[PLATFORM_CORE_COUNT];
+
+void spm_cpu_set_sp_ctx(unsigned int linear_id, sp_context_t *sp_ctx)
+{
+	assert(linear_id < PLATFORM_CORE_COUNT);
+
+	cpu_sp_ctx[linear_id] = sp_ctx;
+}
+
+sp_context_t *spm_cpu_get_sp_ctx(unsigned int linear_id)
+{
+	assert(linear_id < PLATFORM_CORE_COUNT);
+
+	return cpu_sp_ctx[linear_id];
+}
+
+/*******************************************************************************
+ * Functions to keep track of how many requests a Secure Partition has received
+ * and hasn't finished.
+ ******************************************************************************/
+void spm_sp_request_increase(sp_context_t *sp_ctx)
+{
+	spin_lock(&(sp_ctx->request_count_lock));
+	sp_ctx->request_count++;
+	spin_unlock(&(sp_ctx->request_count_lock));
+}
+
+void spm_sp_request_decrease(sp_context_t *sp_ctx)
+{
+	spin_lock(&(sp_ctx->request_count_lock));
+	sp_ctx->request_count--;
+	spin_unlock(&(sp_ctx->request_count_lock));
+}
+
+/* Returns 0 if it was originally 0, -1 otherwise. */
+int spm_sp_request_increase_if_zero(sp_context_t *sp_ctx)
+{
+	int ret = -1;
+
+	spin_lock(&(sp_ctx->request_count_lock));
+	if (sp_ctx->request_count == 0U) {
+		sp_ctx->request_count++;
+		ret = 0U;
+	}
+	spin_unlock(&(sp_ctx->request_count_lock));
+
+	return ret;
+}
+
+/*******************************************************************************
+ * This function returns a pointer to the context of the Secure Partition that
+ * handles the service specified by an UUID. It returns NULL if the UUID wasn't
+ * found.
+ ******************************************************************************/
+sp_context_t *spm_sp_get_by_uuid(const uint32_t (*svc_uuid)[4])
+{
+	unsigned int i;
+
+	for (i = 0U; i < PLAT_SPM_MAX_PARTITIONS; i++) {
+
+		sp_context_t *sp_ctx = &sp_ctx_array[i];
+
+		if (sp_ctx->is_present == 0) {
+			continue;
+		}
+
+		struct sp_rd_sect_service *rdsvc;
+
+		for (rdsvc = sp_ctx->rd.service; rdsvc != NULL;
+		     rdsvc = rdsvc->next) {
+			uint32_t *rd_uuid = (uint32_t *)(rdsvc->uuid);
+
+			if (memcmp(rd_uuid, svc_uuid, sizeof(rd_uuid)) == 0) {
+				return sp_ctx;
+			}
+		}
+	}
+
+	return NULL;
+}
 
 /*******************************************************************************
  * Set state of a Secure Partition context.
@@ -85,13 +167,15 @@ int sp_state_try_switch(sp_context_t *sp_ptr, sp_state_t from, sp_state_t to)
  * This function takes an SP context pointer and performs a synchronous entry
  * into it.
  ******************************************************************************/
-static uint64_t spm_sp_synchronous_entry(sp_context_t *sp_ctx)
+uint64_t spm_sp_synchronous_entry(sp_context_t *sp_ctx, int can_preempt)
 {
 	uint64_t rc;
+	unsigned int linear_id = plat_my_core_pos();
 
 	assert(sp_ctx != NULL);
 
 	/* Assign the context of the SP to this CPU */
+	spm_cpu_set_sp_ctx(linear_id, sp_ctx);
 	cm_set_context(&(sp_ctx->cpu_ctx), SECURE);
 
 	/* Restore the context assigned above */
@@ -102,6 +186,12 @@ static uint64_t spm_sp_synchronous_entry(sp_context_t *sp_ctx)
 	tlbivmalle1();
 	dsbish();
 
+	if (can_preempt == 1) {
+		enable_intr_rm_local(INTR_TYPE_NS, SECURE);
+	} else {
+		disable_intr_rm_local(INTR_TYPE_NS, SECURE);
+	}
+
 	/* Enter Secure Partition */
 	rc = spm_secure_partition_enter(&sp_ctx->c_rt_ctx);
 
@@ -115,9 +205,11 @@ static uint64_t spm_sp_synchronous_entry(sp_context_t *sp_ctx)
  * This function returns to the place where spm_sp_synchronous_entry() was
  * called originally.
  ******************************************************************************/
-__dead2 static void spm_sp_synchronous_exit(uint64_t rc)
+__dead2 void spm_sp_synchronous_exit(uint64_t rc)
 {
-	sp_context_t *ctx = &sp_ctx;
+	/* Get context of the SP in use by this CPU. */
+	unsigned int linear_id = plat_my_core_pos();
+	sp_context_t *ctx = spm_cpu_get_sp_ctx(linear_id);
 
 	/*
 	 * The SPM must have initiated the original request through a
@@ -129,26 +221,50 @@ __dead2 static void spm_sp_synchronous_exit(uint64_t rc)
 	panic();
 }
 
+/*******************************************************************************
+ * This function is the handler registered for Non secure interrupts by the SPM.
+ * It validates the interrupt and upon success arranges entry into the normal
+ * world for handling the interrupt.
+ ******************************************************************************/
+static uint64_t spm_ns_interrupt_handler(uint32_t id, uint32_t flags,
+					  void *handle, void *cookie)
+{
+	/* Check the security state when the exception was generated */
+	assert(get_interrupt_src_ss(flags) == SECURE);
+
+	spm_sp_synchronous_exit(SPM_SECURE_PARTITION_PREEMPTED);
+}
+
 /*******************************************************************************
  * Jump to each Secure Partition for the first time.
  ******************************************************************************/
 static int32_t spm_init(void)
 {
-	uint64_t rc;
+	uint64_t rc = 0;
 	sp_context_t *ctx;
 
-	INFO("Secure Partition init...\n");
+	for (unsigned int i = 0U; i < PLAT_SPM_MAX_PARTITIONS; i++) {
+
+		ctx = &sp_ctx_array[i];
+
+		if (ctx->is_present == 0) {
+			continue;
+		}
 
-	ctx = &sp_ctx;
+		INFO("Secure Partition %u init...\n", i);
 
 		ctx->state = SP_STATE_RESET;
 
-	rc = spm_sp_synchronous_entry(ctx);
-	assert(rc == 0);
+		rc = spm_sp_synchronous_entry(ctx, 0);
+		if (rc != SPRT_YIELD_AARCH64) {
+			ERROR("Unexpected return value 0x%llx\n", rc);
+			panic();
+		}
 
 		ctx->state = SP_STATE_IDLE;
 
-	INFO("Secure Partition initialized.\n");
+		INFO("Secure Partition %u initialized.\n", i);
+	}
 
 	return rc;
 }
@@ -158,196 +274,84 @@ static int32_t spm_init(void)
  ******************************************************************************/
 int32_t spm_setup(void)
 {
+	int rc;
 	sp_context_t *ctx;
+	void *sp_base, *rd_base;
+	size_t sp_size, rd_size;
+	uint64_t flags = 0U;
 
 	/* Disable MMU at EL1 (initialized by BL2) */
 	disable_mmu_icache_el1();
 
-	/* Initialize context of the SP */
-	INFO("Secure Partition context setup start...\n");
-
-	ctx = &sp_ctx;
-
-	/* Assign translation tables context. */
-	ctx->xlat_ctx_handle = spm_get_sp_xlat_context();
-
-	spm_sp_setup(ctx);
-
-	/* Register init function for deferred init.  */
-	bl31_register_bl32_init(&spm_init);
-
-	INFO("Secure Partition setup done.\n");
-
-	return 0;
-}
-
-/*******************************************************************************
- * Function to perform a call to a Secure Partition.
- ******************************************************************************/
-uint64_t spm_sp_call(uint32_t smc_fid, uint64_t x1, uint64_t x2, uint64_t x3)
-{
-	uint64_t rc;
-	sp_context_t *sp_ptr = &sp_ctx;
-
-	/* Wait until the Secure Partition is idle and set it to busy. */
-	sp_state_wait_switch(sp_ptr, SP_STATE_IDLE, SP_STATE_BUSY);
-
-	/* Set values for registers on SP entry */
-	cpu_context_t *cpu_ctx = &(sp_ptr->cpu_ctx);
-
-	write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X0, smc_fid);
-	write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X1, x1);
-	write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X2, x2);
-	write_ctx_reg(get_gpregs_ctx(cpu_ctx), CTX_GPREG_X3, x3);
-
-	/* Jump to the Secure Partition. */
-	rc = spm_sp_synchronous_entry(sp_ptr);
-
-	/* Flag Secure Partition as idle. */
-	assert(sp_ptr->state == SP_STATE_BUSY);
-	sp_state_set(sp_ptr, SP_STATE_IDLE);
-
-	return rc;
-}
-
-/*******************************************************************************
- * MM_COMMUNICATE handler
- ******************************************************************************/
-static uint64_t mm_communicate(uint32_t smc_fid, uint64_t mm_cookie,
-			       uint64_t comm_buffer_address,
-			       uint64_t comm_size_address, void *handle)
-{
-	uint64_t rc;
-
-	/* Cookie. Reserved for future use. It must be zero. */
-	if (mm_cookie != 0U) {
-		ERROR("MM_COMMUNICATE: cookie is not zero\n");
-		SMC_RET1(handle, SPM_INVALID_PARAMETER);
-	}
-
-	if (comm_buffer_address == 0U) {
-		ERROR("MM_COMMUNICATE: comm_buffer_address is zero\n");
-		SMC_RET1(handle, SPM_INVALID_PARAMETER);
-	}
-
-	if (comm_size_address != 0U) {
-		VERBOSE("MM_COMMUNICATE: comm_size_address is not 0 as recommended.\n");
-	}
-
 	/*
-	 * The current secure partition design mandates
-	 * - at any point, only a single core can be
-	 *   executing in the secure partiton.
-	 * - a core cannot be preempted by an interrupt
-	 *   while executing in secure partition.
-	 * Raise the running priority of the core to the
-	 * interrupt level configured for secure partition
-	 * so as to block any interrupt from preempting this
-	 * core.
+	 * Non-blocking services can be interrupted by Non-secure interrupts.
+	 * Register an interrupt handler for NS interrupts when generated while
+	 * the CPU is in secure state. They are routed to EL3.
 	 */
-	ehf_activate_priority(PLAT_SP_PRI);
-
-	/* Save the Normal world context */
-	cm_el1_sysregs_context_save(NON_SECURE);
-
-	rc = spm_sp_call(smc_fid, comm_buffer_address, comm_size_address,
-			 plat_my_core_pos());
+	set_interrupt_rm_flag(flags, SECURE);
 
-	/* Restore non-secure state */
-	cm_el1_sysregs_context_restore(NON_SECURE);
-	cm_set_next_eret_context(NON_SECURE);
+	uint64_t rc_int = register_interrupt_type_handler(INTR_TYPE_NS,
+				spm_ns_interrupt_handler, flags);
+	if (rc_int) {
+		ERROR("SPM: Failed to register NS interrupt handler with rc = %llx\n",
+		      rc_int);
+		panic();
+	}
 
 	/*
-	 * Exited from secure partition. This core can take
-	 * interrupts now.
+	 * Setup all Secure Partitions.
 	 */
-	ehf_deactivate_priority(PLAT_SP_PRI);
+	unsigned int i = 0U;
 
-	SMC_RET1(handle, rc);
-}
+	while (1) {
+		rc = plat_spm_sp_get_next_address(&sp_base, &sp_size,
+						&rd_base, &rd_size);
+		if (rc < 0) {
+			/* Reached the end of the package. */
+			break;
+		}
 
-/*******************************************************************************
- * Secure Partition Manager SMC handler.
- ******************************************************************************/
-uint64_t spm_smc_handler(uint32_t smc_fid,
-			 uint64_t x1,
-			 uint64_t x2,
-			 uint64_t x3,
-			 uint64_t x4,
-			 void *cookie,
-			 void *handle,
-			 uint64_t flags)
-{
-	unsigned int ns;
+		if (i >= PLAT_SPM_MAX_PARTITIONS) {
+			ERROR("Too many partitions in the package.\n");
+			panic();
+		}
 
-	/* Determine which security state this SMC originated from */
-	ns = is_caller_non_secure(flags);
+		ctx = &sp_ctx_array[i];
 
-	if (ns == SMC_FROM_SECURE) {
+		assert(ctx->is_present == 0);
 
-		/* Handle SMCs from Secure world. */
+		/* Initialize context of the SP */
+		INFO("Secure Partition %u context setup start...\n", i);
 
-		assert(handle == cm_get_context(SECURE));
+		/* Assign translation tables context. */
+		ctx->xlat_ctx_handle = spm_sp_xlat_context_alloc();
 
-		/* Make next ERET jump to S-EL0 instead of S-EL1. */
-		cm_set_elr_spsr_el3(SECURE, read_elr_el1(), read_spsr_el1());
+		/* Save location of the image in physical memory */
+		ctx->image_base = (uintptr_t)sp_base;
+		ctx->image_size = sp_size;
 
-		switch (smc_fid) {
+		rc = plat_spm_sp_rd_load(&ctx->rd, rd_base, rd_size);
+		if (rc < 0) {
+			ERROR("Error while loading RD blob.\n");
+			panic();
+		}
 
-		case SPM_VERSION_AARCH32:
-			SMC_RET1(handle, SPM_VERSION_COMPILED);
+		spm_sp_setup(ctx);
 
-		case SP_EVENT_COMPLETE_AARCH64:
-			spm_sp_synchronous_exit(x1);
+		ctx->is_present = 1;
 
-		case SP_MEMORY_ATTRIBUTES_GET_AARCH64:
-			INFO("Received SP_MEMORY_ATTRIBUTES_GET_AARCH64 SMC\n");
+		INFO("Secure Partition %u setup done.\n", i);
 
-			if (sp_ctx.state != SP_STATE_RESET) {
-				WARN("SP_MEMORY_ATTRIBUTES_GET_AARCH64 is available at boot time only\n");
-				SMC_RET1(handle, SPM_NOT_SUPPORTED);
+		i++;
 	}
-			SMC_RET1(handle,
-				 spm_memory_attributes_get_smc_handler(
-					 &sp_ctx, x1));
-
-		case SP_MEMORY_ATTRIBUTES_SET_AARCH64:
-			INFO("Received SP_MEMORY_ATTRIBUTES_SET_AARCH64 SMC\n");
 
-			if (sp_ctx.state != SP_STATE_RESET) {
-				WARN("SP_MEMORY_ATTRIBUTES_SET_AARCH64 is available at boot time only\n");
-				SMC_RET1(handle, SPM_NOT_SUPPORTED);
-			}
-			SMC_RET1(handle,
-				 spm_memory_attributes_set_smc_handler(
-					&sp_ctx, x1, x2, x3));
-		default:
-			break;
+	if (i == 0U) {
+		ERROR("No present partitions in the package.\n");
+		panic();
 	}
-	} else {
-
-		/* Handle SMCs from Non-secure world. */
-
-		assert(handle == cm_get_context(NON_SECURE));
-
-		switch (smc_fid) {
-
-		case MM_VERSION_AARCH32:
-			SMC_RET1(handle, MM_VERSION_COMPILED);
 
-		case MM_COMMUNICATE_AARCH32:
-		case MM_COMMUNICATE_AARCH64:
-			return mm_communicate(smc_fid, x1, x2, x3, handle);
-
-		case SP_MEMORY_ATTRIBUTES_GET_AARCH64:
-		case SP_MEMORY_ATTRIBUTES_SET_AARCH64:
-			/* SMC interfaces reserved for secure callers. */
-			SMC_RET1(handle, SPM_NOT_SUPPORTED);
-
-		default:
-			break;
-		}
-	}
+	/* Register init function for deferred init.  */
+	bl31_register_bl32_init(&spm_init);
 
-	SMC_RET1(handle, SMC_UNK);
+	return 0;
 }

services/std_svc/spm/spm_private.h

@@ -29,9 +29,13 @@
 #define SP_C_RT_CTX_SIZE	0x60
 #define SP_C_RT_CTX_ENTRIES	(SP_C_RT_CTX_SIZE >> DWORD_SHIFT)
 
+/* Value returned by spm_sp_synchronous_entry() when a partition is preempted */
+#define SPM_SECURE_PARTITION_PREEMPTED	U(0x1234)
+
 #ifndef __ASSEMBLY__
 
 #include <spinlock.h>
+#include <sp_res_desc.h>
 #include <stdint.h>
 #include <xlat_tables_v2.h>
 
@@ -42,28 +46,68 @@ typedef enum sp_state {
 } sp_state_t;
 
 typedef struct sp_context {
+	/* 1 if the partition is present, 0 otherwise */
+	int is_present;
+
+	/* Location of the image in physical memory */
+	unsigned long long image_base;
+	size_t image_size;
+
 	uint64_t c_rt_ctx;
 	cpu_context_t cpu_ctx;
+	struct sp_res_desc rd;
+
+	/* Translation tables context */
 	xlat_ctx_t *xlat_ctx_handle;
+	spinlock_t xlat_ctx_lock;
 
 	sp_state_t state;
 	spinlock_t state_lock;
+
+	unsigned int request_count;
+	spinlock_t request_count_lock;
+
+	/* Base and size of the shared SPM<->SP buffer */
+	uintptr_t spm_sp_buffer_base;
+	size_t spm_sp_buffer_size;
+	spinlock_t spm_sp_buffer_lock;
 } sp_context_t;
 
+/* Functions used to enter/exit a Secure Partition synchronously */
+uint64_t spm_sp_synchronous_entry(sp_context_t *sp_ctx, int can_preempt);
+__dead2 void spm_sp_synchronous_exit(uint64_t rc);
+
 /* Assembly helpers */
 uint64_t spm_secure_partition_enter(uint64_t *c_rt_ctx);
 void __dead2 spm_secure_partition_exit(uint64_t c_rt_ctx, uint64_t ret);
 
+/* Secure Partition setup */
 void spm_sp_setup(sp_context_t *sp_ctx);
 
-xlat_ctx_t *spm_get_sp_xlat_context(void);
+/* Secure Partition state management helpers */
+void sp_state_set(sp_context_t *sp_ptr, sp_state_t state);
+void sp_state_wait_switch(sp_context_t *sp_ptr, sp_state_t from, sp_state_t to);
+int sp_state_try_switch(sp_context_t *sp_ptr, sp_state_t from, sp_state_t to);
+
+/* Functions to keep track of the number of active requests per SP */
+void spm_sp_request_increase(sp_context_t *sp_ctx);
+void spm_sp_request_decrease(sp_context_t *sp_ctx);
+int spm_sp_request_increase_if_zero(sp_context_t *sp_ctx);
+
+/* Functions related to the translation tables management */
+xlat_ctx_t *spm_sp_xlat_context_alloc(void);
+void sp_map_memory_regions(sp_context_t *sp_ctx);
+
+/* Functions to handle Secure Partition contexts */
+void spm_cpu_set_sp_ctx(unsigned int linear_id, sp_context_t *sp_ctx);
+sp_context_t *spm_cpu_get_sp_ctx(unsigned int linear_id);
+sp_context_t *spm_sp_get_by_uuid(const uint32_t (*svc_uuid)[4]);
 
-int32_t spm_memory_attributes_get_smc_handler(sp_context_t *sp_ctx,
-					      uintptr_t base_va);
-int spm_memory_attributes_set_smc_handler(sp_context_t *sp_ctx,
-					  u_register_t page_address,
-					  u_register_t pages_count,
-					  u_register_t smc_attributes);
+/* Functions to manipulate response and requests buffers */
+int spm_response_add(uint16_t client_id, uint16_t handle, uint32_t token,
+		     u_register_t x1, u_register_t x2, u_register_t x3);
+int spm_response_get(uint16_t client_id, uint16_t handle, uint32_t token,
+		     u_register_t *x1, u_register_t *x2, u_register_t *x3);
 
 #endif /* __ASSEMBLY__ */
 

services/std_svc/spm/spm_setup.c

+/*
+ * Copyright (c) 2017-2018, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch.h>
+#include <arch_helpers.h>
+#include <assert.h>
+#include <common_def.h>
+#include <context.h>
+#include <context_mgmt.h>
+#include <debug.h>
+#include <platform_def.h>
+#include <platform.h>
+#include <sp_res_desc.h>
+#include <sprt_host.h>
+#include <string.h>
+#include <xlat_tables_v2.h>
+
+#include "spm_private.h"
+#include "spm_shim_private.h"
+
+/* Setup context of the Secure Partition */
+void spm_sp_setup(sp_context_t *sp_ctx)
+{
+	cpu_context_t *ctx = &(sp_ctx->cpu_ctx);
+
+	/*
+	 * Initialize CPU context
+	 * ----------------------
+	 */
+
+	entry_point_info_t ep_info = {0};
+
+	SET_PARAM_HEAD(&ep_info, PARAM_EP, VERSION_1, SECURE | EP_ST_ENABLE);
+
+	/* Setup entrypoint and SPSR */
+	ep_info.pc = sp_ctx->rd.attribute.entrypoint;
+	ep_info.spsr = SPSR_64(MODE_EL0, MODE_SP_EL0, DISABLE_ALL_EXCEPTIONS);
+
+	/*
+	 * X0: Unused (MBZ).
+	 * X1: Unused (MBZ).
+	 * X2: cookie value (Implementation Defined)
+	 * X3: cookie value (Implementation Defined)
+	 * X4 to X7 = 0
+	 */
+	ep_info.args.arg0 = 0;
+	ep_info.args.arg1 = 0;
+	ep_info.args.arg2 = PLAT_SPM_COOKIE_0;
+	ep_info.args.arg3 = PLAT_SPM_COOKIE_1;
+
+	cm_setup_context(ctx, &ep_info);
+
+	/*
+	 * Setup translation tables
+	 * ------------------------
+	 */
+
+	sp_map_memory_regions(sp_ctx);
+
+	/*
+	 * MMU-related registers
+	 * ---------------------
+	 */
+	xlat_ctx_t *xlat_ctx = sp_ctx->xlat_ctx_handle;
+
+	uint64_t mmu_cfg_params[MMU_CFG_PARAM_MAX];
+
+	setup_mmu_cfg((uint64_t *)&mmu_cfg_params, 0, xlat_ctx->base_table,
+		      xlat_ctx->pa_max_address, xlat_ctx->va_max_address,
+		      EL1_EL0_REGIME);
+
+	write_ctx_reg(get_sysregs_ctx(ctx), CTX_MAIR_EL1,
+		      mmu_cfg_params[MMU_CFG_MAIR]);
+
+	write_ctx_reg(get_sysregs_ctx(ctx), CTX_TCR_EL1,
+		      mmu_cfg_params[MMU_CFG_TCR]);
+
+	write_ctx_reg(get_sysregs_ctx(ctx), CTX_TTBR0_EL1,
+		      mmu_cfg_params[MMU_CFG_TTBR0]);
+
+	/* Setup SCTLR_EL1 */
+	u_register_t sctlr_el1 = read_ctx_reg(get_sysregs_ctx(ctx), CTX_SCTLR_EL1);
+
+	sctlr_el1 |=
+		/*SCTLR_EL1_RES1 |*/
+		/* Don't trap DC CVAU, DC CIVAC, DC CVAC, DC CVAP, or IC IVAU */
+		SCTLR_UCI_BIT							|
+		/* RW regions at xlat regime EL1&0 are forced to be XN. */
+		SCTLR_WXN_BIT							|
+		/* Don't trap to EL1 execution of WFI or WFE at EL0. */
+		SCTLR_NTWI_BIT | SCTLR_NTWE_BIT					|
+		/* Don't trap to EL1 accesses to CTR_EL0 from EL0. */
+		SCTLR_UCT_BIT							|
+		/* Don't trap to EL1 execution of DZ ZVA at EL0. */
+		SCTLR_DZE_BIT							|
+		/* Enable SP Alignment check for EL0 */
+		SCTLR_SA0_BIT							|
+		/* Allow cacheable data and instr. accesses to normal memory. */
+		SCTLR_C_BIT | SCTLR_I_BIT					|
+		/* Alignment fault checking enabled when at EL1 and EL0. */
+		SCTLR_A_BIT							|
+		/* Enable MMU. */
+		SCTLR_M_BIT
+	;
+
+	sctlr_el1 &= ~(
+		/* Explicit data accesses at EL0 are little-endian. */
+		SCTLR_E0E_BIT							|
+		/* Accesses to DAIF from EL0 are trapped to EL1. */
+		SCTLR_UMA_BIT
+	);
+
+	write_ctx_reg(get_sysregs_ctx(ctx), CTX_SCTLR_EL1, sctlr_el1);
+
+	/*
+	 * Setup other system registers
+	 * ----------------------------
+	 */
+
+	/* Shim Exception Vector Base Address */
+	write_ctx_reg(get_sysregs_ctx(ctx), CTX_VBAR_EL1,
+			SPM_SHIM_EXCEPTIONS_PTR);
+
+	/*
+	 * FPEN: Allow the Secure Partition to access FP/SIMD registers.
+	 * Note that SPM will not do any saving/restoring of these registers on
+	 * behalf of the SP. This falls under the SP's responsibility.
+	 * TTA: Enable access to trace registers.
+	 * ZEN (v8.2): Trap SVE instructions and access to SVE registers.
+	 */
+	write_ctx_reg(get_sysregs_ctx(ctx), CTX_CPACR_EL1,
+			CPACR_EL1_FPEN(CPACR_EL1_FP_TRAP_NONE));
+
+	/*
+	 * Prepare shared buffers
+	 * ----------------------
+	 */
+
+	/* Initialize SPRT queues */
+	sprt_initialize_queues((void *)sp_ctx->spm_sp_buffer_base,
+			       sp_ctx->spm_sp_buffer_size);
+}

services/std_svc/spm/spm_xlat.c

+/*
+ * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch.h>
+#include <arch_helpers.h>
+#include <assert.h>
+#include <errno.h>
+#include <object_pool.h>
+#include <platform_def.h>
+#include <platform.h>
+#include <sp_res_desc.h>
+#include <string.h>
+#include <utils.h>
+#include <utils_def.h>
+#include <xlat_tables_v2.h>
+
+#include "spm_private.h"
+#include "spm_shim_private.h"
+
+/*******************************************************************************
+ * Instantiation of translation table context
+ ******************************************************************************/
+
+/* Place translation tables by default along with the ones used by BL31. */
+#ifndef PLAT_SP_IMAGE_XLAT_SECTION_NAME
+#define PLAT_SP_IMAGE_XLAT_SECTION_NAME	"xlat_table"
+#endif
+
+/*
+ * Allocate elements of the translation contexts for the Secure Partitions.
+ */
+
+/* Allocate an array of mmap_region per partition. */
+static struct mmap_region sp_mmap_regions[PLAT_SP_IMAGE_MMAP_REGIONS + 1]
+	[PLAT_SPM_MAX_PARTITIONS];
+static OBJECT_POOL(sp_mmap_regions_pool, sp_mmap_regions,
+	sizeof(mmap_region_t) * (PLAT_SP_IMAGE_MMAP_REGIONS + 1),
+	PLAT_SPM_MAX_PARTITIONS);
+
+/* Allocate individual translation tables. */
+static uint64_t sp_xlat_tables[XLAT_TABLE_ENTRIES]
+	[(PLAT_SP_IMAGE_MAX_XLAT_TABLES + 1) * PLAT_SPM_MAX_PARTITIONS]
+	__aligned(XLAT_TABLE_SIZE) __section(PLAT_SP_IMAGE_XLAT_SECTION_NAME);
+static OBJECT_POOL(sp_xlat_tables_pool, sp_xlat_tables,
+	XLAT_TABLE_ENTRIES * sizeof(uint64_t),
+	(PLAT_SP_IMAGE_MAX_XLAT_TABLES + 1) * PLAT_SPM_MAX_PARTITIONS);
+
+/* Allocate base translation tables. */
+static uint64_t sp_xlat_base_tables
+	[GET_NUM_BASE_LEVEL_ENTRIES(PLAT_VIRT_ADDR_SPACE_SIZE)]
+	[PLAT_SPM_MAX_PARTITIONS]
+	__aligned(GET_NUM_BASE_LEVEL_ENTRIES(PLAT_VIRT_ADDR_SPACE_SIZE)
+		  * sizeof(uint64_t))
+	__section(PLAT_SP_IMAGE_XLAT_SECTION_NAME);
+static OBJECT_POOL(sp_xlat_base_tables_pool, sp_xlat_base_tables,
+	GET_NUM_BASE_LEVEL_ENTRIES(PLAT_VIRT_ADDR_SPACE_SIZE) * sizeof(uint64_t),
+	PLAT_SPM_MAX_PARTITIONS);
+
+/* Allocate arrays. */
+static int sp_xlat_mapped_regions[PLAT_SP_IMAGE_MAX_XLAT_TABLES]
+	[PLAT_SPM_MAX_PARTITIONS];
+static OBJECT_POOL(sp_xlat_mapped_regions_pool, sp_xlat_mapped_regions,
+	sizeof(int) * PLAT_SP_IMAGE_MAX_XLAT_TABLES, PLAT_SPM_MAX_PARTITIONS);
+
+/* Allocate individual contexts. */
+static xlat_ctx_t sp_xlat_ctx[PLAT_SPM_MAX_PARTITIONS];
+static OBJECT_POOL(sp_xlat_ctx_pool, sp_xlat_ctx, sizeof(xlat_ctx_t),
+	PLAT_SPM_MAX_PARTITIONS);
+
+/* Get handle of Secure Partition translation context */
+xlat_ctx_t *spm_sp_xlat_context_alloc(void)
+{
+	xlat_ctx_t *ctx = pool_alloc(&sp_xlat_ctx_pool);
+
+	struct mmap_region *mmap = pool_alloc(&sp_mmap_regions_pool);
+
+	uint64_t *base_table = pool_alloc(&sp_xlat_base_tables_pool);
+	uint64_t **tables = pool_alloc_n(&sp_xlat_tables_pool,
+					PLAT_SP_IMAGE_MAX_XLAT_TABLES);
+
+	int *mapped_regions = pool_alloc(&sp_xlat_mapped_regions_pool);
+
+	xlat_setup_dynamic_ctx(ctx, PLAT_PHY_ADDR_SPACE_SIZE - 1,
+			       PLAT_VIRT_ADDR_SPACE_SIZE - 1, mmap,
+			       PLAT_SP_IMAGE_MMAP_REGIONS, tables,
+			       PLAT_SP_IMAGE_MAX_XLAT_TABLES, base_table,
+			       EL1_EL0_REGIME, mapped_regions);
+
+	return ctx;
+};
+
+/*******************************************************************************
+ * Functions to allocate memory for regions.
+ ******************************************************************************/
+
+/*
+ * The region with base PLAT_SPM_HEAP_BASE and size PLAT_SPM_HEAP_SIZE is
+ * reserved for SPM to use as heap to allocate memory regions of Secure
+ * Partitions. This is only done at boot.
+ */
+static OBJECT_POOL(spm_heap_mem, (void *)PLAT_SPM_HEAP_BASE, 1U,
+		   PLAT_SPM_HEAP_SIZE);
+
+static uintptr_t spm_alloc_heap(size_t size)
+{
+	return (uintptr_t)pool_alloc_n(&spm_heap_mem, size);
+}
+
+/*******************************************************************************
+ * Functions to map memory regions described in the resource description.
+ ******************************************************************************/
+static unsigned int rdmem_attr_to_mmap_attr(uint32_t attr)
+{
+	unsigned int index = attr & RD_MEM_MASK;
+
+	const unsigned int mmap_attr_arr[8] = {
+		MT_DEVICE | MT_RW | MT_SECURE,	/* RD_MEM_DEVICE */
+		MT_CODE | MT_SECURE,		/* RD_MEM_NORMAL_CODE */
+		MT_MEMORY | MT_RW | MT_SECURE,	/* RD_MEM_NORMAL_DATA */
+		MT_MEMORY | MT_RW | MT_SECURE,	/* RD_MEM_NORMAL_BSS */
+		MT_RO_DATA | MT_SECURE,		/* RD_MEM_NORMAL_RODATA */
+		MT_MEMORY | MT_RW | MT_SECURE,	/* RD_MEM_NORMAL_SPM_SP_SHARED_MEM */
+		MT_MEMORY | MT_RW | MT_SECURE,	/* RD_MEM_NORMAL_CLIENT_SHARED_MEM */
+		MT_MEMORY | MT_RW | MT_SECURE	/* RD_MEM_NORMAL_MISCELLANEOUS */
+	};
+
+	if (index >= ARRAY_SIZE(mmap_attr_arr)) {
+		ERROR("Unsupported RD memory attributes 0x%x\n", attr);
+		panic();
+	}
+
+	return mmap_attr_arr[index];
+}
+
+/*
+ * The data provided in the resource description structure is not directly
+ * compatible with a mmap_region structure. This function handles the conversion
+ * and maps it.
+ */
+static void map_rdmem(sp_context_t *sp_ctx, struct sp_rd_sect_mem_region *rdmem)
+{
+	int rc;
+	mmap_region_t mmap;
+
+	/* Location of the SP image */
+	uintptr_t sp_size = sp_ctx->image_size;
+	uintptr_t sp_base_va = sp_ctx->rd.attribute.load_address;
+	unsigned long long sp_base_pa = sp_ctx->image_base;
+
+	/* Location of the memory region to map */
+	size_t rd_size = rdmem->size;
+	uintptr_t rd_base_va = rdmem->base;
+	unsigned long long rd_base_pa;
+
+	unsigned int memtype = rdmem->attr & RD_MEM_MASK;
+
+	VERBOSE("Adding memory region '%s'\n", rdmem->name);
+
+	mmap.granularity = REGION_DEFAULT_GRANULARITY;
+
+	/* Check if the RD region is inside of the SP image or not */
+	int is_outside = (rd_base_va + rd_size <= sp_base_va) ||
+			 (sp_base_va + sp_size <= rd_base_va);
+
+	/* Set to 1 if it is needed to zero this region */
+	int zero_region = 0;
+
+	switch (memtype) {
+	case RD_MEM_DEVICE:
+		/* Device regions are mapped 1:1 */
+		rd_base_pa = rd_base_va;
+		break;
+
+	case RD_MEM_NORMAL_CODE:
+	case RD_MEM_NORMAL_RODATA:
+	{
+		if (is_outside == 1) {
+			ERROR("Code and rodata sections must be fully contained in the image.");
+			panic();
+		}
+
+		/* Get offset into the image */
+		rd_base_pa = sp_base_pa + rd_base_va - sp_base_va;
+		break;
+	}
+	case RD_MEM_NORMAL_DATA:
+	{
+		if (is_outside == 1) {
+			ERROR("Data sections must be fully contained in the image.");
+			panic();
+		}
+
+		rd_base_pa = spm_alloc_heap(rd_size);
+
+		/* Get offset into the image */
+		void *img_pa = (void *)(sp_base_pa + rd_base_va - sp_base_va);
+
+		VERBOSE("  Copying data from %p to 0x%llx\n", img_pa, rd_base_pa);
+
+		/* Map destination */
+		rc = mmap_add_dynamic_region(rd_base_pa, rd_base_pa,
+				rd_size, MT_MEMORY | MT_RW | MT_SECURE);
+		if (rc != 0) {
+			ERROR("Unable to map data region at EL3: %d\n", rc);
+			panic();
+		}
+
+		/* Copy original data to destination */
+		memcpy((void *)rd_base_pa, img_pa, rd_size);
+
+		/* Unmap destination region */
+		rc = mmap_remove_dynamic_region(rd_base_pa, rd_size);
+		if (rc != 0) {
+			ERROR("Unable to remove data region at EL3: %d\n", rc);
+			panic();
+		}
+
+		break;
+	}
+	case RD_MEM_NORMAL_MISCELLANEOUS:
+		/* Allow SPM to change the attributes of the region. */
+		mmap.granularity = PAGE_SIZE;
+		rd_base_pa = spm_alloc_heap(rd_size);
+		zero_region = 1;
+		break;
+
+	case RD_MEM_NORMAL_SPM_SP_SHARED_MEM:
+		if ((sp_ctx->spm_sp_buffer_base != 0) ||
+		    (sp_ctx->spm_sp_buffer_size != 0)) {
+			ERROR("A partition must have only one SPM<->SP buffer.\n");
+			panic();
+		}
+		rd_base_pa = spm_alloc_heap(rd_size);
+		zero_region = 1;
+		/* Save location of this buffer, it is needed by SPM */
+		sp_ctx->spm_sp_buffer_base = rd_base_pa;
+		sp_ctx->spm_sp_buffer_size = rd_size;
+		break;
+
+	case RD_MEM_NORMAL_CLIENT_SHARED_MEM:
+		/* Fallthrough */
+	case RD_MEM_NORMAL_BSS:
+		rd_base_pa = spm_alloc_heap(rd_size);
+		zero_region = 1;
+		break;
+
+	default:
+		panic();
+	}
+
+	mmap.base_pa = rd_base_pa;
+	mmap.base_va = rd_base_va;
+	mmap.size = rd_size;
+
+	/* Only S-EL0 mappings supported for now */
+	mmap.attr = rdmem_attr_to_mmap_attr(rdmem->attr) | MT_USER;
+
+	VERBOSE("  VA: 0x%lx PA: 0x%llx (0x%lx, attr: 0x%x)\n",
+		mmap.base_va, mmap.base_pa, mmap.size, mmap.attr);
+
+	/* Map region in the context of the Secure Partition */
+	mmap_add_region_ctx(sp_ctx->xlat_ctx_handle, &mmap);
+
+	if (zero_region == 1) {
+		VERBOSE("  Zeroing region...\n");
+
+		rc = mmap_add_dynamic_region(mmap.base_pa, mmap.base_pa,
+				mmap.size, MT_MEMORY | MT_RW | MT_SECURE);
+		if (rc != 0) {
+			ERROR("Unable to map memory at EL3 to zero: %d\n",
+			      rc);
+			panic();
+		}
+
+		zeromem((void *)mmap.base_pa, mmap.size);
+
+		/*
+		 * Unmap destination region unless it is the SPM<->SP buffer,
+		 * which must be used by SPM.
+		 */
+		if (memtype != RD_MEM_NORMAL_SPM_SP_SHARED_MEM) {
+			rc = mmap_remove_dynamic_region(rd_base_pa, rd_size);
+			if (rc != 0) {
+				ERROR("Unable to remove region at EL3: %d\n", rc);
+				panic();
+			}
+		}
+	}
+}
+
+void sp_map_memory_regions(sp_context_t *sp_ctx)
+{
+	/* This region contains the exception vectors used at S-EL1. */
+	const mmap_region_t sel1_exception_vectors =
+		MAP_REGION_FLAT(SPM_SHIM_EXCEPTIONS_START,
+				SPM_SHIM_EXCEPTIONS_SIZE,
+				MT_CODE | MT_SECURE | MT_PRIVILEGED);
+
+	mmap_add_region_ctx(sp_ctx->xlat_ctx_handle,
+			    &sel1_exception_vectors);
+
+	struct sp_rd_sect_mem_region *rdmem;
+
+	for (rdmem = sp_ctx->rd.mem_region; rdmem != NULL; rdmem = rdmem->next) {
+		map_rdmem(sp_ctx, rdmem);
+	}
+
+	init_xlat_tables_ctx(sp_ctx->xlat_ctx_handle);
+}

services/std_svc/spm/sprt.c

+/*
+ * Copyright (c) 2018, Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch_helpers.h>
+#include <assert.h>
+#include <context_mgmt.h>
+#include <debug.h>
+#include <errno.h>
+#include <limits.h>
+#include <platform.h>
+#include <smccc.h>
+#include <smccc_helpers.h>
+#include <sprt_svc.h>
+#include <utils.h>
+
+#include "spm_private.h"
+
+/*******************************************************************************
+ * Functions to manipulate memory regions
+ ******************************************************************************/
+
+/*
+ * Attributes are encoded using a different format in the SMC interface than in
+ * the Trusted Firmware, where the mmap_attr_t enum type is used. This function
+ * converts an attributes value from the SMC format to the mmap_attr_t format by
+ * setting MT_RW/MT_RO, MT_USER/MT_PRIVILEGED and MT_EXECUTE/MT_EXECUTE_NEVER.
+ * The other fields are left as 0 because they are ignored by the function
+ * xlat_change_mem_attributes_ctx().
+ */
+static unsigned int smc_attr_to_mmap_attr(unsigned int attributes)
+{
+	unsigned int perm = attributes & SPRT_MEMORY_PERM_ATTR_MASK;
+
+	if (perm == SPRT_MEMORY_PERM_ATTR_RW) {
+		return MT_RW | MT_EXECUTE_NEVER | MT_USER;
+	} else if (perm ==  SPRT_MEMORY_PERM_ATTR_RO) {
+		return MT_RO | MT_EXECUTE_NEVER | MT_USER;
+	} else if (perm == SPRT_MEMORY_PERM_ATTR_RO_EXEC) {
+		return MT_RO | MT_USER;
+	} else {
+		return UINT_MAX;
+	}
+}
+
+/*
+ * This function converts attributes from the Trusted Firmware format into the
+ * SMC interface format.
+ */
+static unsigned int mmap_attr_to_smc_attr(unsigned int attr)
+{
+	unsigned int perm;
+
+	/* No access from EL0. */
+	if ((attr & MT_USER) == 0U)
+		return UINT_MAX;
+
+	if ((attr & MT_RW) != 0) {
+		assert(MT_TYPE(attr) != MT_DEVICE);
+		perm = SPRT_MEMORY_PERM_ATTR_RW;
+	} else {
+		if ((attr & MT_EXECUTE_NEVER) != 0U) {
+			perm = SPRT_MEMORY_PERM_ATTR_RO;
+		} else {
+			perm = SPRT_MEMORY_PERM_ATTR_RO_EXEC;
+		}
+	}
+
+	return perm << SPRT_MEMORY_PERM_ATTR_SHIFT;
+}
+
+static int32_t sprt_memory_perm_attr_get(sp_context_t *sp_ctx, uintptr_t base_va)
+{
+	uint32_t attributes;
+
+	spin_lock(&(sp_ctx->xlat_ctx_lock));
+
+	int ret = xlat_get_mem_attributes_ctx(sp_ctx->xlat_ctx_handle,
+				     base_va, &attributes);
+
+	spin_unlock(&(sp_ctx->xlat_ctx_lock));
+
+	/* Convert error codes of xlat_get_mem_attributes_ctx() into SPM. */
+	assert((ret == 0) || (ret == -EINVAL));
+
+	if (ret != 0)
+		return SPRT_INVALID_PARAMETER;
+
+	unsigned int perm = mmap_attr_to_smc_attr(attributes);
+
+	if (perm == UINT_MAX)
+		return SPRT_INVALID_PARAMETER;
+
+	return SPRT_SUCCESS | perm;
+}
+
+static int32_t sprt_memory_perm_attr_set(sp_context_t *sp_ctx,
+		u_register_t page_address, u_register_t pages_count,
+		u_register_t smc_attributes)
+{
+	int ret;
+	uintptr_t base_va = (uintptr_t) page_address;
+	size_t size = pages_count * PAGE_SIZE;
+
+	VERBOSE("  Start address  : 0x%lx\n", base_va);
+	VERBOSE("  Number of pages: %i (%zi bytes)\n", (int) pages_count, size);
+	VERBOSE("  Attributes     : 0x%lx\n", smc_attributes);
+
+	uint32_t mmap_attr = smc_attr_to_mmap_attr(smc_attributes);
+
+	if (mmap_attr == UINT_MAX) {
+		WARN("%s: Invalid memory attributes: 0x%lx\n", __func__,
+		     smc_attributes);
+		return SPRT_INVALID_PARAMETER;
+	}
+
+	/*
+	 * Perform some checks before actually trying to change the memory
+	 * attributes.
+	 */
+
+	spin_lock(&(sp_ctx->xlat_ctx_lock));
+
+	uint32_t attributes;
+
+	ret = xlat_get_mem_attributes_ctx(sp_ctx->xlat_ctx_handle,
+				     base_va, &attributes);
+
+	if (ret != 0) {
+		spin_unlock(&(sp_ctx->xlat_ctx_lock));
+		return SPRT_INVALID_PARAMETER;
+	}
+
+	if ((attributes & MT_USER) == 0U) {
+		/* Prohibit changing attributes of S-EL1 regions */
+		spin_unlock(&(sp_ctx->xlat_ctx_lock));
+		return SPRT_INVALID_PARAMETER;
+	}
+
+	ret = xlat_change_mem_attributes_ctx(sp_ctx->xlat_ctx_handle,
+					base_va, size, mmap_attr);
+
+	spin_unlock(&(sp_ctx->xlat_ctx_lock));
+
+	/* Convert error codes of xlat_change_mem_attributes_ctx() into SPM. */
+	assert((ret == 0) || (ret == -EINVAL));
+
+	return (ret == 0) ? SPRT_SUCCESS : SPRT_INVALID_PARAMETER;
+}
+
+/*******************************************************************************
+ * This function handles all SMCs in the range reserved for SPRT.
+ ******************************************************************************/
+uint64_t sprt_smc_handler(uint32_t smc_fid, uint64_t x1, uint64_t x2,
+			  uint64_t x3, uint64_t x4, void *cookie, void *handle,
+			  uint64_t flags)
+{
+	/* SPRT only supported from the Secure world */
+	if (is_caller_non_secure(flags) == SMC_FROM_NON_SECURE) {
+		SMC_RET1(handle, SMC_UNK);
+	}
+
+	assert(handle == cm_get_context(SECURE));
+
+	/*
+	 * Only S-EL0 partitions are supported for now. Make the next ERET into
+	 * the partition jump directly to S-EL0 instead of S-EL1.
+	 */
+	cm_set_elr_spsr_el3(SECURE, read_elr_el1(), read_spsr_el1());
+
+	switch (smc_fid) {
+	case SPRT_VERSION:
+		SMC_RET1(handle, SPRT_VERSION_COMPILED);
+
+	case SPRT_PUT_RESPONSE_AARCH64:
+		/*
+		 * Registers x1-x3 aren't saved by default to the context,
+		 * but they are needed after spm_sp_synchronous_exit() because
+		 * they hold return values.
+		 */
+		SMC_SET_GP(handle, CTX_GPREG_X1, x1);
+		SMC_SET_GP(handle, CTX_GPREG_X2, x2);
+		SMC_SET_GP(handle, CTX_GPREG_X3, x3);
+		spm_sp_synchronous_exit(SPRT_PUT_RESPONSE_AARCH64);
+
+	case SPRT_YIELD_AARCH64:
+		spm_sp_synchronous_exit(SPRT_YIELD_AARCH64);
+
+	case SPRT_MEMORY_PERM_ATTR_GET_AARCH64:
+	{
+		/* Get context of the SP in use by this CPU. */
+		unsigned int linear_id = plat_my_core_pos();
+		sp_context_t *sp_ctx = spm_cpu_get_sp_ctx(linear_id);
+
+		SMC_RET1(handle, sprt_memory_perm_attr_get(sp_ctx, x1));
+	}
+
+	case SPRT_MEMORY_PERM_ATTR_SET_AARCH64:
+	{
+		/* Get context of the SP in use by this CPU. */
+		unsigned int linear_id = plat_my_core_pos();
+		sp_context_t *sp_ctx = spm_cpu_get_sp_ctx(linear_id);
+
+		SMC_RET1(handle, sprt_memory_perm_attr_set(sp_ctx, x1, x2, x3));
+	}
+
+	default:
+		break;
+	}
+
+	WARN("SPRT: Unsupported call 0x%08x\n", smc_fid);
+	SMC_RET1(handle, SPRT_NOT_SUPPORTED);
+}

services/std_svc/spm_deprecated/aarch64/spm_helpers.S

+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <asm_macros.S>
+#include "../spm_private.h"
+
+	.global spm_secure_partition_enter
+	.global spm_secure_partition_exit
+
+	/* ---------------------------------------------------------------------
+	 * This function is called with SP_EL0 as stack. Here we stash our EL3
+	 * callee-saved registers on to the stack as a part of saving the C
+	 * runtime and enter the secure payload.
+	 * 'x0' contains a pointer to the memory where the address of the C
+	 *  runtime context is to be saved.
+	 * ---------------------------------------------------------------------
+	 */
+func spm_secure_partition_enter
+	/* Make space for the registers that we're going to save */
+	mov	x3, sp
+	str	x3, [x0, #0]
+	sub	sp, sp, #SP_C_RT_CTX_SIZE
+
+	/* Save callee-saved registers on to the stack */
+	stp	x19, x20, [sp, #SP_C_RT_CTX_X19]
+	stp	x21, x22, [sp, #SP_C_RT_CTX_X21]
+	stp	x23, x24, [sp, #SP_C_RT_CTX_X23]
+	stp	x25, x26, [sp, #SP_C_RT_CTX_X25]
+	stp	x27, x28, [sp, #SP_C_RT_CTX_X27]
+	stp	x29, x30, [sp, #SP_C_RT_CTX_X29]
+
+	/* ---------------------------------------------------------------------
+	 * Everything is setup now. el3_exit() will use the secure context to
+	 * restore to the general purpose and EL3 system registers to ERET
+	 * into the secure payload.
+	 * ---------------------------------------------------------------------
+	 */
+	b	el3_exit
+endfunc spm_secure_partition_enter
+
+	/* ---------------------------------------------------------------------
+	 * This function is called with 'x0' pointing to a C runtime context
+	 * saved in spm_secure_partition_enter().
+	 * It restores the saved registers and jumps to that runtime with 'x0'
+	 * as the new SP register. This destroys the C runtime context that had
+	 * been built on the stack below the saved context by the caller. Later
+	 * the second parameter 'x1' is passed as a return value to the caller.
+	 * ---------------------------------------------------------------------
+	 */
+func spm_secure_partition_exit
+	/* Restore the previous stack */
+	mov	sp, x0
+
+	/* Restore callee-saved registers on to the stack */
+	ldp	x19, x20, [x0, #(SP_C_RT_CTX_X19 - SP_C_RT_CTX_SIZE)]
+	ldp	x21, x22, [x0, #(SP_C_RT_CTX_X21 - SP_C_RT_CTX_SIZE)]
+	ldp	x23, x24, [x0, #(SP_C_RT_CTX_X23 - SP_C_RT_CTX_SIZE)]
+	ldp	x25, x26, [x0, #(SP_C_RT_CTX_X25 - SP_C_RT_CTX_SIZE)]
+	ldp	x27, x28, [x0, #(SP_C_RT_CTX_X27 - SP_C_RT_CTX_SIZE)]
+	ldp	x29, x30, [x0, #(SP_C_RT_CTX_X29 - SP_C_RT_CTX_SIZE)]
+
+	/* ---------------------------------------------------------------------
+	 * This should take us back to the instruction after the call to the
+	 * last spm_secure_partition_enter().* Place the second parameter to x0
+	 * so that the caller will see it as a return value from the original
+	 * entry call.
+	 * ---------------------------------------------------------------------
+	 */
+	mov	x0, x1
+	ret
+endfunc spm_secure_partition_exit

services/std_svc/spm_deprecated/aarch64/spm_shim_exceptions.S

+/*
+ * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <arch.h>
+#include <asm_macros.S>
+#include <bl_common.h>
+#include <context.h>
+
+/* -----------------------------------------------------------------------------
+ * Very simple stackless exception handlers used by the spm shim layer.
+ * -----------------------------------------------------------------------------
+ */
+	.globl	spm_shim_exceptions_ptr
+
+vector_base spm_shim_exceptions_ptr, .spm_shim_exceptions
+
+	/* -----------------------------------------------------
+	 * Current EL with SP0 : 0x0 - 0x200
+	 * -----------------------------------------------------
+	 */
+vector_entry SynchronousExceptionSP0, .spm_shim_exceptions
+	b	.
+end_vector_entry SynchronousExceptionSP0
+
+vector_entry IrqSP0, .spm_shim_exceptions
+	b	.
+end_vector_entry IrqSP0
+
+vector_entry FiqSP0, .spm_shim_exceptions
+	b	.
+end_vector_entry FiqSP0
+
+vector_entry SErrorSP0, .spm_shim_exceptions
+	b	.
+end_vector_entry SErrorSP0
+
+	/* -----------------------------------------------------
+	 * Current EL with SPx: 0x200 - 0x400
+	 * -----------------------------------------------------
+	 */
+vector_entry SynchronousExceptionSPx, .spm_shim_exceptions
+	b	.
+end_vector_entry SynchronousExceptionSPx
+
+vector_entry IrqSPx, .spm_shim_exceptions
+	b	.
+end_vector_entry IrqSPx
+
+vector_entry FiqSPx, .spm_shim_exceptions
+	b	.
+end_vector_entry FiqSPx
+
+vector_entry SErrorSPx, .spm_shim_exceptions
+	b	.
+end_vector_entry SErrorSPx
+
+	/* -----------------------------------------------------
+	 * Lower EL using AArch64 : 0x400 - 0x600. No exceptions
+	 * are handled since secure_partition does not implement
+	 * a lower EL
+	 * -----------------------------------------------------
+	 */
+vector_entry SynchronousExceptionA64, .spm_shim_exceptions
+	msr	tpidr_el1, x30
+	mrs	x30, esr_el1
+	ubfx	x30, x30, #ESR_EC_SHIFT, #ESR_EC_LENGTH
+
+	cmp	x30, #EC_AARCH64_SVC
+	b.eq 	do_smc
+
+	cmp	x30, #EC_AARCH32_SVC
+	b.eq	do_smc
+
+	cmp	x30, #EC_AARCH64_SYS
+	b.eq	handle_sys_trap
+
+	/* Fail in all the other cases */
+	b	panic
+
+	/* ---------------------------------------------
+	 * Tell SPM that we are done initialising
+	 * ---------------------------------------------
+	 */
+do_smc:
+	mrs	x30, tpidr_el1
+	smc	#0
+	eret
+
+	/* AArch64 system instructions trap are handled as a panic for now */
+handle_sys_trap:
+panic:
+	b	panic
+end_vector_entry SynchronousExceptionA64
+
+vector_entry IrqA64, .spm_shim_exceptions
+	b	.
+end_vector_entry IrqA64
+
+vector_entry FiqA64, .spm_shim_exceptions
+	b	.
+end_vector_entry FiqA64
+
+vector_entry SErrorA64, .spm_shim_exceptions
+	b	.
+end_vector_entry SErrorA64
+
+	/* -----------------------------------------------------
+	 * Lower EL using AArch32 : 0x600 - 0x800
+	 * -----------------------------------------------------
+	 */
+vector_entry SynchronousExceptionA32, .spm_shim_exceptions
+	b	.
+end_vector_entry SynchronousExceptionA32
+
+vector_entry IrqA32, .spm_shim_exceptions
+	b	.
+end_vector_entry IrqA32
+
+vector_entry FiqA32, .spm_shim_exceptions
+	b	.
+end_vector_entry FiqA32
+
+vector_entry SErrorA32, .spm_shim_exceptions
+	b	.
+end_vector_entry SErrorA32

services/std_svc/spm_deprecated/spm.mk

+#
+# Copyright (c) 2017-2018, ARM Limited and Contributors. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+
+ifneq (${SPD},none)
+        $(error "Error: SPD and SPM are incompatible build options.")
+endif
+ifneq (${ARCH},aarch64)
+        $(error "Error: SPM is only supported on aarch64.")
+endif
+
+SPM_SOURCES	:=	$(addprefix services/std_svc/spm_deprecated/, \
+			${ARCH}/spm_helpers.S			\
+			${ARCH}/spm_shim_exceptions.S		\
+			spm_main.c				\
+			spm_setup.c				\
+			spm_xlat.c)
+
+
+# Let the top-level Makefile know that we intend to include a BL32 image
+NEED_BL32		:=	yes