core: Refactor console_init() and introduce plat_console_init()

Since there are some cross-platform console drivers, we let
console_init() be common code to have a chance to initialize those
console

core: Refactor console_init() and introduce plat_console_init()

Since there are some cross-platform console drivers, we let
console_init() be common code to have a chance to initialize those
console drivers (e.g., semihosting console).

If the cross-platform console drivers are not configured to be compiled,
plat_console_init() will be invoked to initialize platform-specific
console driver.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

plat-zynq7k: use gic_init_per_cpu()

Call gic_init_per_cpu() instead of the now deprecated gic_cpu_init().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: arm: Rename primary_init_intc() to boot_primary_init_intc()

Since interrupt controllers are usually initialized in boot stage,
rename primary_init_intc() to boot_primary_init_intc().

Signed-o

core: arm: Rename primary_init_intc() to boot_primary_init_intc()

Since interrupt controllers are usually initialized in boot stage,
rename primary_init_intc() to boot_primary_init_intc().

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: arm: Rename main_secondary_init_intc() to boot_secondary_init_intc()

main_secondary_*() is an ambiguous name since it conveys no meaning
relative to the purpose of the function. Fix it by rena

core: arm: Rename main_secondary_init_intc() to boot_secondary_init_intc()

main_secondary_*() is an ambiguous name since it conveys no meaning
relative to the purpose of the function. Fix it by renameing to
boot_secondary_init_intc(), since interrupt controllers are always
initialized in boot stage.

Signed-off-by: Alvin Chang <alvinga@andestech.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: rename interrupt controller functions

This commit renames interrupt controller function names
to be more generic:
- Rename main_init_gic() to primary_init_intc()
- Rename secondary_init_gic()

core: rename interrupt controller functions

This commit renames interrupt controller function names
to be more generic:
- Rename main_init_gic() to primary_init_intc()
- Rename secondary_init_gic() to secondary_init_intc()

Signed-off-by: Marouene Boubakri <marouene.boubakri@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: define main interrupt controller data from its driver

All but one platforms define CPU core interrupt controller from their
platform main.c source file next to its main interrupt handler.
This

core: define main interrupt controller data from its driver

All but one platforms define CPU core interrupt controller from their
platform main.c source file next to its main interrupt handler.
This change factorize these implementation by moving the definition
of the controller data instance straight in the controller driver
source file. This change makes each controller driver to implement
straight itr_core_handler() function, preventing a extra branch on
interrupt execution. Interrupt controller driver initialization
function now straight calls itr_core_init().

This changes treats case when CFG_CORE_WORKAROUND_ARM_NMFI is enable
to not conflict with core/arch/arm/kernel/thread.c that already
overrides itr_core_handler() weak implementation.

With this change, the main controller initialization function
(gic_init(), gic_init_base_addr(), gic_cpu_init() and hfic_init())
no more gets the controller data as input argument.

As a consequence, definition of struct hfic_data and struct gic_data
moves from their respective driver header file to the respective
driver source file.

As a consequence, gic_dump() no more requires an argument.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat: arm: refactor GIC initialization

All platforms (except STM32MP1) follow the same pattern during GIC
initialization: get virtual addresses for distributor (and optionally,
for CPU interface), c

plat: arm: refactor GIC initialization

All platforms (except STM32MP1) follow the same pattern during GIC
initialization: get virtual addresses for distributor (and optionally,
for CPU interface), check that they are not NULL, call either
gic_init() or gic_init_base_addr().

We can move most of this logic into gic_init_base_addr(), while
platform-specific code will supply only base physical addresses for
distributor and CPU interface. This will simplify and align platform
code.

ST32MP1 had more complex logic, as it used io_pa_or_va_secure() to get
MMIO range addresses. However, as main_init_gic() called
assert(cpu_mmu_enabled()), there is no sense in using
io_pa_or_va_secure(), because we already ensured that VA will be
always used. Thus assert() call was moved to gic_init_base_addr(), and
STM32MP1 were aligned with other platforms.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core_mmu: fix phys_to_virt() to check length

phys_to_virt() function without length parameter doesn`t
always have ability to find the correct mapping for
requested physical address. This is because

core_mmu: fix phys_to_virt() to check length

phys_to_virt() function without length parameter doesn`t
always have ability to find the correct mapping for
requested physical address. This is because physical
address can be mapped in the same time in different virtual
regions with different length. So the first found region
which contains the requested physical address possibly
doesn`t have enough mapped data. This is fixed by adding
the length parameter to phys_to_virt() function. Length
parameter can be set to 1 if caller knows that requested
(pa + len) doesn`t cross mapping granule boundary.

core_mmu_get_va() and io_pa_or_va() functions now are
take length parameter too as they based on phys_to_virt()
in case of MMU enabled.

Signed-off-by: Anton Rybakov <a.rybakov@omp.ru>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (stm32mp1-157C_DK2)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx6dlsabreauto)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx6dlsabresd)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx6qpsabreauto)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx6sllevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx6ulevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx6ullevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx6ulzevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx7dsabresd)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx7ulpevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx8mmevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx8mnevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx8mqevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx8mpevk)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx8qmmek)
Tested-by: Clement Faure <clement.faure@nxp.com> (imx-mx8qxpmek)

show more ...

plat-zynq7k: fix wrong argument ordering in NS world unlocking

A defect was introduced in 3.5.0 where the register value and address
in io_write32 are displaced, which eventually led to failure swit

plat-zynq7k: fix wrong argument ordering in NS world unlocking

A defect was introduced in 3.5.0 where the register value and address
in io_write32 are displaced, which eventually led to failure switching
to NS world.

Fixes: af4c7f4b3ad2 ("zynq7k: upgrade from write32() to io_write32() and friends")
Signed-off-by: Yan Yan <yan.yan@windriver.com>
Tested-by: Yan Yan <yan.yan@windriver.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: remove boot_get_handlers()

struct thread_handlers is used to pass the entry functions
for different power management events. In practice only .cpu_on is used
and with the default function at t

core: remove boot_get_handlers()

struct thread_handlers is used to pass the entry functions
for different power management events. In practice only .cpu_on is used
and with the default function at that. In the ARMv7 case where the
secure monitor replaces TF-A not even that function entry is used.

Remove struct thread_handlers and boot_get_handlers(). When configured
with TF-A initialize thread_*_handler_ptr with __weak default functions.

The __weak default PM functions
- thread_cpu_off_handler()
- thread_cpu_suspend_handler()
- thread_cpu_resume_handler()
- thread_system_off_handler()
- thread_system_reset_handler()
can be overridden by platforms when needed.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove generic_ from generic_boot

Now that the CFG_GENERIC_BOOT configuration flag has been removed also
remove "generic_" prefix from and in the related files.

Acked-by: Etienne Carriere <et

core: remove generic_ from generic_boot

Now that the CFG_GENERIC_BOOT configuration flag has been removed also
remove "generic_" prefix from and in the related files.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add plat_primary_init_early()

Adds plat_primary_init_early() which replaces plat_cpu_reset_late().
plat_cpu_reset_late() was called for each cpu, but
plat_primary_init_early() is only called o

core: add plat_primary_init_early()

Adds plat_primary_init_early() which replaces plat_cpu_reset_late().
plat_cpu_reset_late() was called for each cpu, but
plat_primary_init_early() is only called on the primary cpu.

In practice that's not a problem (except for plat-stm, more on that
later) since all the platform specific plat_cpu_reset_late() only does
something if get_core_pos() returns 0, that is on the primary cpu.

On plat-stm SCR is now updated in plat_cpu_reset_early() instead.

This patch is needed because ASLR may relocate OP-TEE to a virtual base
address which differs from the physical base address. This means that
it's not possible to execute C code before MMU has been enabled.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: replace thread_nintr_handler_ptr with weak function

Removes registration of platform specific secure interrupt handler in
thread_nintr_handler_ptr. Instead a __weak overridable
itr_core_handle

core: replace thread_nintr_handler_ptr with weak function

Removes registration of platform specific secure interrupt handler in
thread_nintr_handler_ptr. Instead a __weak overridable
itr_core_handler() is provided. Platforms which expects to receive
secure interrupts must override the default function. The default
function calls panic() if called.

With this also nintr is removed from struct thread_handlers and
consequently all platforms are updated to stop using that field.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: replace thread_fast_smc_handler_ptr with weak function

Removes registration of platform specific fast SMC entry function in
thread_fast_smc_handler_ptr. Instead a __weak overridable
tee_entry_

core: replace thread_fast_smc_handler_ptr with weak function

Removes registration of platform specific fast SMC entry function in
thread_fast_smc_handler_ptr. Instead a __weak overridable
tee_entry_fast() is provided. Platforms that need a special
tee_entry_fast() (currently on plat-zynq7k) provides their own
tee_entry_fast() instead which at the end should call __tee_entry_fast()
which does the generic fast call handling.

With this also fast_smc is removed from struct thread_handlers and
consequently all platforms are updated to stop using that field.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: replace thread_std_smc_handler_ptr with weak function

Removes registration of platform specific standard SMC entry function in
thread_std_smc_handler_ptr. Instead a __weak overridable tee_entr

core: replace thread_std_smc_handler_ptr with weak function

Removes registration of platform specific standard SMC entry function in
thread_std_smc_handler_ptr. Instead a __weak overridable tee_entry_std()
is provided. Platforms that need a special tee_entry_std() (currently on
some STM platform) provides their own tee_entry_std() instead which at
the end should call __tee_entry_std() which does the generic standard
call handling.

With this also std_smc is removed from struct thread_handlers and
consequently all platforms are updated to stop using that field.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

zynq7k: upgrade from write32() to io_write32() and friends

Replace use of readX() and writeX() with io_readX() and io_writeX().
The former are about to be deprecated in favor to the later.

Signed-o

zynq7k: upgrade from write32() to io_write32() and friends

Replace use of readX() and writeX() with io_readX() and io_writeX().
The former are about to be deprecated in favor to the later.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core_mmu: do not restrict device memory mapping to PGDIR_SIZE granularity

Device memory registered via register_phys_mem() is currently rounded
up/down to CORE_MMU_PGDIR_SIZE (1 MiB, or 2 MiB for LP

core_mmu: do not restrict device memory mapping to PGDIR_SIZE granularity

Device memory registered via register_phys_mem() is currently rounded
up/down to CORE_MMU_PGDIR_SIZE (1 MiB, or 2 MiB for LPAE). This is not
needed and possibly incorrect for SoCs that define I/O memory maps with
regions aligned on a small page (4 KiB), because using a larger
granularity could result in overlaps between secure and non-secure
mappings. This could cause issues depending on the type of memory
firewall used by the SoC and its configuration. In any case, memory
types other than MEM_AREA_IO_{SEC,NSEC} *can* be mapped with small page
granularity using register_phys_mem(), so the situation is a bit
inconsistent.

This commit removes the rounding by default and provides a new macro:
register_phys_mem_pgdir(). Platforms that still need to use PGDIR_SIZE
granularity (typically because it consumes less page table space) need
to replace register_phys_mem() by register_phys_mem_pgdir().

In order to avoid any functional change in platform code, all calls to
register_phys_mem() with device memory are replaced with
register_phys_mem_pgdir(). In addition, CORE_MMU_DEVICE_SIZE is removed
and replaced with CORE_MMU_PGDIR_SIZE since there is no unique mapping
size for device memory anymore.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reported-by: Zeng Tao <prime.zeng@hisilicon.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove CFG_ prefix from CFG_TEE_LOAD_ADDR

TEE_LOAD_ADDR is now local to source files. It is set to CFG_TEE_LOAD_ADDR
value if defined only for the platforms that previously allowed build
to ov

core: remove CFG_ prefix from CFG_TEE_LOAD_ADDR

TEE_LOAD_ADDR is now local to source files. It is set to CFG_TEE_LOAD_ADDR
value if defined only for the platforms that previously allowed build
to override the value. Few platform did hardcod CFG_TEE_LOAD_ADDR, this
change preserve these configurations.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add SPDX license identifiers

Adds one SPDX-License-Identifier line [1] to each source files that
contains license text.

Generated by [2]:
spdxify.py --add-spdx optee_os/

The scancode tool [3] wa

Add SPDX license identifiers

Adds one SPDX-License-Identifier line [1] to each source files that
contains license text.

Generated by [2]:
spdxify.py --add-spdx optee_os/

The scancode tool [3] was used to double check the license matching
code in the Python script. All the licenses detected by scancode are
either detected by spdxify.py, or have no SPDX identifier, or are false
matches.

Link: [1] https://spdx.org/licenses/
Link: [2] https://github.com/jforissier/misc/blob/f7b56c8/spdxify.py
Link: [3] https://github.com/nexB/scancode-toolkit
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

core: remove __early_bss

Initialize the .bss section early from assembler before entering C
code. As a result, the __early_bss qualifier is not needed anymore.
Remove it, as well as the related symb

core: remove __early_bss

Initialize the .bss section early from assembler before entering C
code. As a result, the __early_bss qualifier is not needed anymore.
Remove it, as well as the related symbols (__early_bss_start and
__early_bss_end).

This makes the code simpler hence easier to maintain, at the expense
of initialization time, since .bss is cleared before CPU caches are
turned on (and doing it later would mean some C function have been
called already). Here are some performance numbers measured on HiKey.
The "memset" column measures the time it takes to clear .bss in C,
without this patch. The "assembly" column reports the time taken by the
clear_bss loop in this patch. Timings were performed using CNTPCT.
Worst case is a ~1 ms overhead in boot time.

memset(): | assembly:
ms (bytes) | ms (bytes)
--------------+--------------
Aarch64 0.30 (72824) | 0.08 (73528)
Aarch32 0.27 (65016) | 1.24 (65408)
Aarch32/pager 0.03 (11328) | 0.23 (11736)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey 32/64)
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey/pager)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add common implementation for console_putc() and console_flush()

Since most platforms now use the same console_putc() and
console_flush(), move them to core/kernel/console.c. Make them __weak

core: add common implementation for console_putc() and console_flush()

Since most platforms now use the same console_putc() and
console_flush(), move them to core/kernel/console.c. Make them __weak
so that platforms may still provide their own.
The common code expects the platforms to initialize whatever serial
device from console_init() and call register_console().

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

drivers: convert cdns_uart driver to use struct serial_chip

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne

drivers: convert cdns_uart driver to use struct serial_chip

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

Rename the secure and non-secure interrupts

Currently, the secure interrupts are named as FIQ and the non-secure
interrupts are named as IRQ.

In GICv3 mode, the FIQ and IRQ have different definitio

Rename the secure and non-secure interrupts

Currently, the secure interrupts are named as FIQ and the non-secure
interrupts are named as IRQ.

In GICv3 mode, the FIQ and IRQ have different definitions.
* Secure Group 0 interrupts:
Handled by EL3 and triggered by FIQ when running at Secure EL0/1.
* Secure Group 1 interrupts:
Handled by optee_os and triggered by IRQ when running at Secure EL0/1.
* Non-secure Group1 interrupts:
Handled by the rich os and triggered by FIQ when running at Secure
EL0/1.

The "Secure Group 1" interrupts are the "native" interrupts handled by
optee_os. They are same as the "secure" interrupts used in optee_os
for now. But they are triggered by FIQ in GICv2 mode while by IRQ in
GICv3 mode.

The "Secure Group 0" and "Non-secure Group1" interrupts are the
"foreign" interrupts that will cause the exiting of optee_os. (e.g.
switch back to normal world) The "Non-secure Group1" interrupts are
same as the "non-secure"interrupts used in optee_os for now. But they
are triggered by IRQ in GICv2 mode while by FIQ in GICv3 mode.

This patch renames these interrupts to the generic names - "Foreign
interrupts" and "Native interrupts".
For the support of GICv3 mode in the future, we can redefine the macros
of "native interrupt" and "foreign interrupt" to IRQ and FIQ.

Signed-off-by: David Wang <david.wang@arm.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)

show more ...

core: arm: support Xilinx ZYNQ7000 ZC702 (plat-zynq7k)

Signed-off-by: Yan Yan <yan.yan@windriver.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wi

core: arm: support Xilinx ZYNQ7000 ZC702 (plat-zynq7k)

Signed-off-by: Yan Yan <yan.yan@windriver.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...