plat-stm32mp1: add inline descriptions in pmic drivers

Add a bit of inline description comments in STM32MP1 PMIC driver.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jero

plat-stm32mp1: add inline descriptions in pmic drivers

Add a bit of inline description comments in STM32MP1 PMIC driver.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

plat-stm32mp1: factorize FDT parsing in pmic driver

Factorize looping into the FDT regulator nodes for STM32MP1 PMIC driver.
Boot-on, low power and non-secure access configuration are done for
each

plat-stm32mp1: factorize FDT parsing in pmic driver

Factorize looping into the FDT regulator nodes for STM32MP1 PMIC driver.
Boot-on, low power and non-secure access configuration are done for
each regulator sub-node of the PMIC node.

This change merges save_power_configurations() sequence into
parse_regulator_fdt_nodes() implementation. The sequence panics on
error as the previous implementation did. Some error level traces
are changed to debug level.

No functional changes.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

plat-stm32mp1: store PMIC regulators secure assignment

Implement stm32mp_nsec_can_access_regu() for non-secure service to
get whether a voltage regulator driven by PMIC can be accessed.
The status i

plat-stm32mp1: store PMIC regulators secure assignment

Implement stm32mp_nsec_can_access_regu() for non-secure service to
get whether a voltage regulator driven by PMIC can be accessed.
The status is set according to embedded FDT, based status value.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: non-lpae: allocate one more translation table for ASLR

Commit 1579bdf39b3e ("core: lpae: allocate one more translation table
for ASLR") has fixed an issue with LPAE (QEMUv8), but a similar one

core: non-lpae: allocate one more translation table for ASLR

Commit 1579bdf39b3e ("core: lpae: allocate one more translation table
for ASLR") has fixed an issue with LPAE (QEMUv8), but a similar one
occurs with non-LPAE. More specifically, running xtest 1013 on QEMU
with CFG_ULIBS_SHARED=y:

E/TC:0 0 Panic 'Failed to spread pgdir on small tables' at core/arch/arm/mm/core_mmu.c:1737 <core_mmu_map_pages>
E/TC:0 0 TEE load address @ 0x5a9b5000
E/TC:0 0 Call stack:
E/TC:0 0 0x5a9bcba1 print_kernel_stack at optee_os/core/arch/arm/kernel/unwind_arm32.c:109
E/TC:0 0 0x5a9c8293 __do_panic at optee_os/core/kernel/panic.c:31
E/TC:0 0 0x5a9bf357 core_mmu_map_pages at optee_os/core/arch/arm/mm/core_mmu.c:1737
E/TC:0 0 0x5a9c2a2f mobj_reg_shm_inc_map at optee_os/core/arch/arm/mm/mobj_dyn_shm.c:200
E/TC:0 0 0x5a9e9067 mobj_inc_map at optee_os/core/arch/arm/include/mm/mobj.h:93
E/TC:0 0 0x5a9e92b1 mobj_mapped_shm_alloc at optee_os/core/arch/arm/mm/mobj_dyn_shm.c:412
E/TC:0 0 0x5a9ee9d9 msg_param_mobj_from_noncontig at optee_os/core/kernel/msg_param.c:141
E/TC:0 0 0x5a9b9d43 get_rpc_alloc_res at optee_os/core/arch/arm/kernel/thread_optee_smc.c:541
E/TC:0 0 0x5a9e479b thread_rpc_alloc at optee_os/core/arch/arm/kernel/thread_optee_smc.c:580
E/TC:0 0 0x5a9e47bf thread_rpc_alloc_payload at optee_os/core/arch/arm/kernel/thread_optee_smc.c:585
E/TC:0 0 0x5a9b67db rpc_load at optee_os/core/arch/arm/kernel/ree_fs_ta.c:99
E/TC:0 0 0x5a9e28e9 ree_fs_ta_open at optee_os/core/arch/arm/kernel/ree_fs_ta.c:146
E/TC:0 0 0x5a9c9f77 system_open_ta_binary at optee_os/core/pta/system.c:259
E/TC:0 0 0x5a9ca873 invoke_command at optee_os/core/pta/system.c:890
E/TC:0 0 0x5a9e3553 pseudo_ta_enter_invoke_cmd at optee_os/core/arch/arm/kernel/pseudo_ta.c:198
E/TC:0 0 0x5a9ef059 tee_ta_invoke_command at optee_os/core/kernel/tee_ta_manager.c:767
E/TC:0 0 0x5a9f345f syscall_invoke_ta_command at optee_os/core/tee/tee_svc.c:887
E/TC:0 0 0x5a9c3128 tee_svc_do_call at optee_os/core/arch/arm/tee/arch_svc_a32.S:54

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: non-lpae: increase PGT_CACHE_SIZE when CFG_NUM_THREADS=2

xtest on QEMU shows allocation errors when CFG_ULIBS_SHARED=y:

# xtest 1010
...
o regression_1010.10 Invalid memory access 5 with 1

core: non-lpae: increase PGT_CACHE_SIZE when CFG_NUM_THREADS=2

xtest on QEMU shows allocation errors when CFG_ULIBS_SHARED=y:

# xtest 1010
...
o regression_1010.10 Invalid memory access 5 with 1024 bytes memref
regression_1000.c:500: [...] 0xffff000c = TEEC_ERROR_OUT_OF_MEMORY [...]
regression_1000.c:505: [...] 0xffff000c = TEEC_ERROR_OUT_OF_MEMORY [...]
regression_1010.10 FAILED
...
E/TC:? 0 alloc_pgt:147 5 page tables not available
E/TC:? 0 alloc_pgt:147 5 page tables not available

This configuration needs at least 5 page tables. Use 8 to avoid wasting
space.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

plat-stm32mp1: use SCMI reset to manage MCU hold boot

Adding the MCU hold boot management through a SCMI dedicated
reset domain. MCU hold boot controls the MCU reboot sequence together
with MCU rese

plat-stm32mp1: use SCMI reset to manage MCU hold boot

Adding the MCU hold boot management through a SCMI dedicated
reset domain. MCU hold boot controls the MCU reboot sequence together
with MCU reset controller already exposed to SCMI agent 0.

Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

plat-stm32mp1: prevent panicking when secure clock has no parent

Remove the Core panic instruction when looking for parents of a
clock to be secure. If the clock has no parent, there is no parent
cl

plat-stm32mp1: prevent panicking when secure clock has no parent

Remove the Core panic instruction when looking for parents of a
clock to be secure. If the clock has no parent, there is no parent
clock to secure, no need to panic.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

plat-stm32mp1: disable RTCAPB clock when not needed

Disable RTCAPB clock when not used. The clock is currently needed
when enabling or disabling the secondary code since this one reads
secure entry

plat-stm32mp1: disable RTCAPB clock when not needed

Disable RTCAPB clock when not used. The clock is currently needed
when enabling or disabling the secondary code since this one reads
secure entry point address from a SoC interface relying on this clock.

Prior this change was RTCAPB clock enabled at boot time and never
disabled. This change disables the clock when secondary core is brought
to life and enables it back before secondary core enters its
power down sequence.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

drivers: scmi-msg: fix clock rates query

Fix implementation of the clock rate query platform functions to
consider rates start index which was missing.

Fixes: a7a9e3ba71dd ("drivers/scmi-msg: suppo

drivers: scmi-msg: fix clock rates query

Fix implementation of the clock rate query platform functions to
consider rates start index which was missing.

Fixes: a7a9e3ba71dd ("drivers/scmi-msg: support for clock protocol")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: lpae: allocate one more translation table for ASLR

Depending on the ASLR seed, the MMU code may run out of translation
tables and panic. For instance with seed = 0x71dfb000 in init_mem_map()
t

core: lpae: allocate one more translation table for ASLR

Depending on the ASLR seed, the MMU code may run out of translation
tables and panic. For instance with seed = 0x71dfb000 in init_mem_map()
the following crash is reproducible:

D/TC:0 core_mmu_entry_to_finer_grained:761 xlat tables used 7 / 7
...
D/TC:0 tee_entry_exchange_capabilities:102 Dynamic shared memory is enabled
E/TC:0 0 Panic 'Failed to spread pgdir on small tables' at core/arch/arm/mm/core_mmu.c:1739 <core_mmu_map_pages>
E/TC:0 0 TEE load address @ 0x7fefb000
E/TC:0 0 Call stack:
E/TC:0 0 0x000000007ff06688 print_kernel_stack at optee_os/core/arch/arm/kernel/unwind_arm64.c:79
E/TC:0 0 0x000000007ff13d24 __do_panic at optee_os/core/kernel/panic.c:24
E/TC:0 0 0x000000007ff083d8 core_mmu_map_pages at optee_os/core/arch/arm/mm/core_mmu.c:1719
E/TC:0 0 0x000000007ff0cf8c mobj_reg_shm_inc_map at optee_os/core/arch/arm/mm/mobj_dyn_shm.c:200
E/TC:0 0 0x000000007ff0d5a0 mobj_inc_map at optee_os/core/arch/arm/include/mm/mobj.h:92
E/TC:0 0 0x000000007ff03960 map_cmd_buffer at optee_os/core/arch/arm/kernel/thread_optee_smc.c:128

Fix the issue by allocating one more translation table when CFG_ASLR=y.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: use C locale when generating the build date

The build date included in the version string depends on the current
locale (language), which is not very good. Force LANG=C so that english
abbrevi

core: use C locale when generating the build date

The build date included in the version string depends on the current
locale (language), which is not very good. Force LANG=C so that english
abbreviations are used for the day and month.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: configuration switches to tune stack sizes

Enabling certain configuration options might increase the TMP and
THREAD stack requirements.

This commit defines CFG_ options so that the sizes of t

core: configuration switches to tune stack sizes

Enabling certain configuration options might increase the TMP and
THREAD stack requirements.

This commit defines CFG_ options so that the sizes of those two stacks
can be fine tuned at build time.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: dt: discover_nsec_memory(): consider only non-secure memory

QEMU has a /secram@e000000 DT node with secure-status = "okay" and
status = "disabled", in other words: some secure-only memory is
d

core: dt: discover_nsec_memory(): consider only non-secure memory

QEMU has a /secram@e000000 DT node with secure-status = "okay" and
status = "disabled", in other words: some secure-only memory is
described in the DT. Memory that is not accessible from non-secure
world should not be added to the nsec map. Unfortunately, the commit
referenced below inadvertently added such memory, resulting in a panic
on boot:

I/TC: Non-secure external DT found
E/TC:0 0 check_phys_mem_is_outside:332 Non-sec mem (0xe000000:0x100000) overlaps map (type 14 0xe000000:0x100000)
E/TC:0 0 Panic at core/arch/arm/mm/core_mmu.c:336 <check_phys_mem_is_outside>

Change the DT status test to consider only memory accessible from non-
secure and secure world. Also, rename a couple of functions to make their
purpose clear.

Fixes: 721619e8890e ("core: Parse all memory DT nodes")
Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat: rcar: Enable parsing DT from TFA

Enable support for reading and processing DT passed in by TFA,
this is useful to read out the DRAM configuration and layout.

Signed-off-by: Marek Vasut <marek

plat: rcar: Enable parsing DT from TFA

Enable support for reading and processing DT passed in by TFA,
this is useful to read out the DRAM configuration and layout.

Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: Parse all memory DT nodes

The current code for parsing /memory* DT nodes does not work at all
on systems with multiple memory nodes. The code cannot handle e.g.

/ {
memory@480000000 {
r

core: Parse all memory DT nodes

The current code for parsing /memory* DT nodes does not work at all
on systems with multiple memory nodes. The code cannot handle e.g.

/ {
memory@480000000 {
reg = <0x00000000 0x48000000 0x00000000 0x78000000>;
device_type = "memory";
};
memory@600000000 {
reg = <0x00000006 0x00000000 0x00000000 0x80000000>;
device_type = "memory";
};
};

This patch fixes the code such that it iterates over all enabled
memory nodes instead of reading out the first /memory node only.
The code iterates over the DT twice, which is faster than constant
calls to realloc() to allocate more entries in core_mmu_phys_mem().

Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: separate copy_from_user() and friends

Removes the tee_svc_ prefix and moves tee_svc_copy_from_user() and
friends into <kernel/user_access.h> and core/kernel/user/access.c

Reviewed-by: Jerome

core: separate copy_from_user() and friends

Removes the tee_svc_ prefix and moves tee_svc_copy_from_user() and
friends into <kernel/user_access.h> and core/kernel/user/access.c

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Introduce CFG_CC_OPT_LEVEL and deprecate CFG_CC_OPTIMIZE_FOR_SIZE

The influence on the performance of the C optimization flag (-O) can be
significant as shown by the output of "time xtest":

|

Introduce CFG_CC_OPT_LEVEL and deprecate CFG_CC_OPTIMIZE_FOR_SIZE

The influence on the performance of the C optimization flag (-O) can be
significant as shown by the output of "time xtest":

| QEMUv8 | HiKey960 (A73 cores only)
-----+----------------+--------------------------
-O0 | 2m 54s, 2m 49s | 42.28s, 42.07s
-Os | 2m 03s, 2m 03s | 25.57s, 25.60s
-O2 | 1m 36s, 1m 35s | 24.01s, 23.93s

This commit introduces CFG_CC_OPT_LEVEL (default: s) which may be set to
0, s, 2 or any value accepted by the compiler. This gives better
flexibility to chose the best level depending on the use case.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: thread: add compiler barrier to thread_set_exceptions()

With compiler optimizer enable (-O2) compiler generate invalid code
for thread_get_id_may_fail(). The curr_thread read got re-order
afte

core: thread: add compiler barrier to thread_set_exceptions()

With compiler optimizer enable (-O2) compiler generate invalid code
for thread_get_id_may_fail(). The curr_thread read got re-order
after exceptions unmask.

Signed-off-by: Khoa Hoang <admin@khoahoang.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Add a parameter to vm_map_pad() to specify alignment requirement

There are cases where the virtual address returned for a requested
mapping needs to satisfy certain alignment requirements. All

core: Add a parameter to vm_map_pad() to specify alignment requirement

There are cases where the virtual address returned for a requested
mapping needs to satisfy certain alignment requirements. Allow the
calling functions to specify the required alignment as a parameter
to vm_map_pad().

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: load stmm via secure partition

Secure variable storage for EFI variables is critical for enabling and
protecting UEFI Secure Boot. Unfortunately due to the fact that SPD and
SPM are mutually e

core: load stmm via secure partition

Secure variable storage for EFI variables is critical for enabling and
protecting UEFI Secure Boot. Unfortunately due to the fact that SPD and
SPM are mutually exclusive, we can't run StMM from EDK2 and OP-TEE.
An advantage of doing so is that different firmware implementations
can leverage EDK2's StandAloneMM and in cooperation with OP-TEE RPMB
APIs can store UEFI variables in a secure storage.
This makes the variable storage quite generic in any device with an RPMB
partition.

Using a well debugged application is preferable over rewriting the whole
application as a TA. Another advantage is that this inherits the Fault
Tolerant Writes (FTW) functionality built-in on StMM to protect
variables against corruptions during writing. Considering the FFA
changes of the future Arm architectures using an SP that includes
everything seems like a better choice at the moment.
The 'SPM emulation' currently added into OP-TEE only supports
a single SP to be launched. This means that the StMM embedded
application has the RPMB driver built in at the moment. In the future we
can add code (evolving FFA) to launch multiple SPs. So the StMM variable
handling can be decoupled from the RPMB driver, which will reside in a
different SP.

So let's add a user mode secure partition context and support loading
"Standalone MM" of EDK2 into it. A separate syscall handling is added to
serve as different kind of ABI and syscall IDs. The secure partition has
a TA like interface towards normal world, but requests are routed into
the StMM partition instead.

CFG_STMM_PATH is assigned the path of BL32_AP_MM.fd, for instance:
CFG_STMM_PATH=...Build/QemuVirtMmStandalone/DEBUG_GCC5/FV/BL32_AP_MM.fd

Since this is quite tricky to compile and test you can use this [1].
Just clone the repo and run ./build.sh. The script will pick up edk2,
edk2-platforms, op-tee, atf and U-boot and compile all the necessary
binaries for QEMU. A patch (awful hack) has been added to U-boot to
allow RPMB emulation through it's supplicant, since QEMU RPMB emulation
is not yet available.
After compiling and launching QEMU the usual U-boot commands for EFI
variable management will store the variables on an RPMB device.

[1] https://git.linaro.org/people/ilias.apalodimas/efi_optee_variables.git/

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Co-developed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Co-developed-by: Pipat Methavanitpong <pipat1010@gmail.com>
Signed-off-by: Pipat Methavanitpong <pipat1010@gmail.com>
Co-developed-by: Miklos Balint <Miklos.Balint@arm.com>
Signed-off-by: Miklos Balint <Miklos.Balint@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: add vm_get_prot()

A following commit, related to the StMM functionality needs to read
the current page attributes before modifying them.
So let's add a function to retrieve the current attribu

core: add vm_get_prot()

A following commit, related to the StMM functionality needs to read
the current page attributes before modifying them.
So let's add a function to retrieve the current attributes.

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: use libunw

Reduce core/arch/arm/kernel/unwind_arm{32,64}.c and use common code from
libunw instead.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wi

core: use libunw

Reduce core/arch/arm/kernel/unwind_arm{32,64}.c and use common code from
libunw instead.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros

This change applies to arm32 assembler sources.

Instead of using UNWIND(.fnstart) after FUNC or LOCAL_FUNC and
UNWIND(.fnend) before END_FUN

arm32: fold UNWIND(.fnstart/.fnend) into the FUNC macros

This change applies to arm32 assembler sources.

Instead of using UNWIND(.fnstart) after FUNC or LOCAL_FUNC and
UNWIND(.fnend) before END_FUNC, let's fold these statements into the
FUNC macros.

The .fnstart/.fnend directives mark the start and end of a function
with an unwind table entry (.ARM.exidx) and therefore a function
without them has no entry and cannot be unwound. This means that a
stack dump (on abort or panic) would stop when reaching such a
function.

As a result of this patch, a small number of functions now have an
entry in the unwind table when they had none before (the functions
which were using FUNC or LOCAL_FUNC but had no .fnstart/.fnend). It was
almost always a bug and this pacth only increases the size of the
.ARM.exidx section by a few bytes (tested on QEMU).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

arm32: move the UNWIND() macro to <asm.S>

All the users of the UNWIND() macro include <asm.S> already, which is
therefore a good place to define this macro. Let's move it from
<kernel/unwind.h> to <

arm32: move the UNWIND() macro to <asm.S>

All the users of the UNWIND() macro include <asm.S> already, which is
therefore a good place to define this macro. Let's move it from
<kernel/unwind.h> to <asm.S>, remove a couple of duplicates in
assembler files, and drop the useless includes.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: arm32: remove unused function relocate_exidx()

Since commit d1911a85142d ("core: load TAs using ldelf"), function
relocate_exidx() is not used any more. Remove it, as well as
offset_prel31() w

core: arm32: remove unused function relocate_exidx()

Since commit d1911a85142d ("core: load TAs using ldelf"), function
relocate_exidx() is not used any more. Remove it, as well as
offset_prel31() which was only called from this function.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...