TEE-OS学习轨迹第十七篇： 深入解析NS-EL1调用SMC的BL31异常处理流程

.globl	sync_exception_aarch64
.globl	irq_aarch64
.globl	fiq_aarch64
.globl	serror_aarch64


vector_entry sync_exception_aarch64   // 0x400 ~ 0x600 区间：Lower EL using AArch64 的同步异常

sync_handler64:
	/* NOTE: The code below must preserve x0-x4 */

	/*
	 * Save general purpose and ARMv8.3-PAuth registers (if enabled).
	 * Also save PMCR_EL0 and  set the PSTATE to a known state.
	 */
	bl	prepare_el3_entry

#if ENABLE_PAUTH
	/* Load and program APIAKey firmware key */
	bl	pauth_load_bl31_apiakey
#endif

	/*
	 * Populate the parameters for the SMC handler.
	 * We already have x0-x4 in place. x5 will point to a cookie (not used
	 * now). x6 will point to the context structure (SP_EL3) and x7 will
	 * contain flags we need to pass to the handler.
	 */
	mov	x5, xzr
	mov	x6, sp

	/*
	 * Restore the saved C runtime stack value which will become the new
	 * SP_EL0 i.e. EL3 runtime stack. It was saved in the 'cpu_context'
	 * structure prior to the last ERET from EL3.
	 */
	ldr	x12, [x6, #CTX_EL3STATE_OFFSET + CTX_RUNTIME_SP]

	/* Switch to SP_EL0 */
	msr	spsel, #MODE_SP_EL0

	/*
	 * Save the SPSR_EL3 and ELR_EL3 in case there is a world
	 * switch during SMC handling.
	 * TODO: Revisit if all system registers can be saved later.
	 */
	mrs	x16, spsr_el3
	mrs	x17, elr_el3
	stp	x16, x17, [x6, #CTX_EL3STATE_OFFSET + CTX_SPSR_EL3]

	/* Load SCR_EL3 */
	mrs	x18, scr_el3

	/* check for system register traps */
	mrs	x16, esr_el3
	ubfx	x17, x16, #ESR_EC_SHIFT, #ESR_EC_LENGTH
	cmp	x17, #EC_AARCH64_SYS
	b.eq	sysreg_handler64

	/* Clear flag register */
	mov	x7, xzr

#if ENABLE_RME
	/* Copy SCR_EL3.NSE bit to the flag to indicate caller's security */
	ubfx	x7, x18, #SCR_NSE_SHIFT, #1

	/*
	 * Shift copied SCR_EL3.NSE bit by 5 to create space for
	 * SCR_EL3.NS bit. Bit 5 of the flag corresponds to
	 * the SCR_EL3.NSE bit.
	 */
	lsl	x7, x7, #5
#endif /* ENABLE_RME */

	/* Copy SCR_EL3.NS bit to the flag to indicate caller's security */
	bfi	x7, x18, #0, #1

	mov	sp, x12

	/*
	 * Per SMCCC documentation, bits [23:17] must be zero for Fast
	 * SMCs. Other values are reserved for future use. Ensure that
	 * these bits are zeroes, if not report as unknown SMC.
	 */
	tbz	x0, #FUNCID_TYPE_SHIFT, 2f  /* Skip check if its a Yield Call*/
	tst	x0, #(FUNCID_FC_RESERVED_MASK << FUNCID_FC_RESERVED_SHIFT)
	b.ne	smc_unknown

	/*
	 * Per SMCCCv1.3 a caller can set the SVE hint bit in the SMC FID
	 * passed through x0. Copy the SVE hint bit to flags and mask the
	 * bit in smc_fid passed to the standard service dispatcher.
	 * A service/dispatcher can retrieve the SVE hint bit state from
	 * flags using the appropriate helper.
	 */
2:
	and	x16, x0, #(FUNCID_SVE_HINT_MASK << FUNCID_SVE_HINT_SHIFT)
	orr	x7, x7, x16
	bic	x0, x0, #(FUNCID_SVE_HINT_MASK << FUNCID_SVE_HINT_SHIFT)

	/* Get the unique owning entity number */
	ubfx	x16, x0, #FUNCID_OEN_SHIFT, #FUNCID_OEN_WIDTH
	ubfx	x15, x0, #FUNCID_TYPE_SHIFT, #FUNCID_TYPE_WIDTH
	orr	x16, x16, x15, lsl #FUNCID_OEN_WIDTH

	/* Load descriptor index from array of indices */
	adrp	x14, rt_svc_descs_indices
	add	x14, x14, :lo12:rt_svc_descs_indices
	ldrb	w15, [x14, x16]

	/* Any index greater than 127 is invalid. Check bit 7. */
	tbnz	w15, 7, smc_unknown

	/*
	 * Get the descriptor using the index
	 * x11 = (base + off), w15 = index
	 *
	 * handler = (base + off) + (index << log2(size))
	 */
	adr	x11, (__RT_SVC_DESCS_START__ + RT_SVC_DESC_HANDLE)
	lsl	w10, w15, #RT_SVC_SIZE_LOG2
	ldr	x15, [x11, w10, uxtw]

	/*
	 * Call the Secure Monitor Call handler and then drop directly into
	 * el3_exit() which will program any remaining architectural state
	 * prior to issuing the ERET to the desired lower EL.
	 */
#if DEBUG
	cbz	x15, rt_svc_fw_critical_error
#endif
	blr	x15

	b	el3_exit

1.上下文保存：调用 prepare_el3_entry，将 NS 世界的通用寄存器、PAuth 寄存器完整保存到 CPU 上下文结构

2.栈切换：从 SP_EL3（异常专用栈）切换到 SP_EL0（EL3 C 语言运行时栈），为调用 C 函数做准备

2.参数封装：保留 x0~x4 的 SMC 入参，x6 指向 CPU 上下文，x7 携带安全状态、SVE 提示等标志位

4.服务索引计算：

ubfx x16, x0, #FUNCID_OEN_SHIFT, #FUNCID_OEN_WIDTH  // 提取 SMC FID 的 OEN（所属服务组）
ubfx x15, x0, #FUNCID_TYPE_SHIFT, #FUNCID_TYPE_WIDTH // 提取调用类型：Fast / Yielding
orr  x16, x16, x15, lsl #FUNCID_OEN_WIDTH            // 组合成服务索引

5.查表分发：

adrp x14, rt_svc_descs_indices
ldrb w15, [x14, x16]        // 从索引表查对应服务的描述符下标
adr  x11, (__RT_SVC_DESCS_START__ + RT_SVC_DESC_HANDLE)
lsl  w10, w15, #RT_SVC_SIZE_LOG2
ldr  x15, [x11, w10, uxtw]  // 取出对应服务的 handler 函数指针
blr  x15                     // 调用对应运行时服务的处理函数

6.异常返回：服务处理完成后，调用 el3_exit 恢复上下文，通过 ERET 指令返回 NS-EL1。

// 快速 SMC 服务：不可中断，用于简单控制指令
DECLARE_RT_SVC(
    optee_fast,
    OEN_TOS_START, OEN_TOS_END,    // OEN 范围：50 ~ 63（SMCCC 规定的 Trusted OS 组）
    SMC_TYPE_FAST,
    opteed_setup,
    opteed_smc_handler
);

// 标准 Yielding SMC 服务：可中断挂起，用于 TA 调用等复杂业务
DECLARE_RT_SVC(
    optee_std,
    OEN_TOS_START, OEN_TOS_END,
    SMC_TYPE_YIELD,
    NULL,
    opteed_smc_handler
);

（2）切换到 OP-TEE 安全上下文

（3）配置返回目标与安全状态

（4）el3_exit 完成最终跳转

• Fast SMC：关中断执行，不支持挂起，用于简单操作（如版本查询、状态控制），全程不涉及 OP-TEE 线程调度
• Yielding SMC：开中断执行，支持线程挂起与 RPC 交互，是业务层 TA 调用、加密服务的主路径，也是最常用的类型