core: define main interrupt controller data from its driver

All but one platforms define CPU core interrupt controller from their
platform main.c source file next to its main interrupt handler.
This

core: define main interrupt controller data from its driver

All but one platforms define CPU core interrupt controller from their
platform main.c source file next to its main interrupt handler.
This change factorize these implementation by moving the definition
of the controller data instance straight in the controller driver
source file. This change makes each controller driver to implement
straight itr_core_handler() function, preventing a extra branch on
interrupt execution. Interrupt controller driver initialization
function now straight calls itr_core_init().

This changes treats case when CFG_CORE_WORKAROUND_ARM_NMFI is enable
to not conflict with core/arch/arm/kernel/thread.c that already
overrides itr_core_handler() weak implementation.

With this change, the main controller initialization function
(gic_init(), gic_init_base_addr(), gic_cpu_init() and hfic_init())
no more gets the controller data as input argument.

As a consequence, definition of struct hfic_data and struct gic_data
moves from their respective driver header file to the respective
driver source file.

As a consequence, gic_dump() no more requires an argument.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

drivers: gic: replace spaces with tabs

No functional changes.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etie

drivers: gic: replace spaces with tabs

No functional changes.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

plat: arm: refactor GIC initialization

All platforms (except STM32MP1) follow the same pattern during GIC
initialization: get virtual addresses for distributor (and optionally,
for CPU interface), c

plat: arm: refactor GIC initialization

All platforms (except STM32MP1) follow the same pattern during GIC
initialization: get virtual addresses for distributor (and optionally,
for CPU interface), check that they are not NULL, call either
gic_init() or gic_init_base_addr().

We can move most of this logic into gic_init_base_addr(), while
platform-specific code will supply only base physical addresses for
distributor and CPU interface. This will simplify and align platform
code.

ST32MP1 had more complex logic, as it used io_pa_or_va_secure() to get
MMIO range addresses. However, as main_init_gic() called
assert(cpu_mmu_enabled()), there is no sense in using
io_pa_or_va_secure(), because we already ensured that VA will be
always used. Thus assert() call was moved to gic_init_base_addr(), and
STM32MP1 were aligned with other platforms.

Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: kernel: interrupt: add type and prio for interrupts

When describing a device in the device tree, it is sometimes necessary
to parse the interrupts properties and propagates them until adding
t

core: kernel: interrupt: add type and prio for interrupts

When describing a device in the device tree, it is sometimes necessary
to parse the interrupts properties and propagates them until adding
the interrupt. For instance some interrupt-cells allows to describe
priority and type of interrupt:

interrupts = <67 IRQ_TYPE_LEVEL_HIGH 2>;

With existing support, only the interrupt number is returned by
`dt_get_irq()`. This patch adds type and prio parameter which are passed
to `dt_get_irq_type_prio()` and `itr_add_type_prio()`. This allows
interrupt drivers to fill this from devicetree in `dt_get_irq()` but also
use these information in the `add()` callback. Additionally, it allows to
specify these flags manually when not using devicetree.

These parameters can then be used by the interrupt controller driver to
setup the irq line correctly.

Signed-off-by: Clément Léger <clement.leger@bootlin.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: kernel: interrupt: rename len argument of dt_get_irq to count

len can be missleading, use a more descriptive name.

Signed-off-by: Clément Léger <clement.leger@bootlin.com>
Reviewed-by: Etienn

core: kernel: interrupt: rename len argument of dt_get_irq to count

len can be missleading, use a more descriptive name.

Signed-off-by: Clément Léger <clement.leger@bootlin.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

drivers: gic_it_enable(): remove assert that itr is disabled

Prior to this patch there was an assert in gic_it_enable() that non-SGI
interrupts where disabled before this function would enable that

drivers: gic_it_enable(): remove assert that itr is disabled

Prior to this patch there was an assert in gic_it_enable() that non-SGI
interrupts where disabled before this function would enable that
interrupt. This forces the caller to keep track of the state of the
interrupt in question and may also require additional locking to avoid
races around this assert. Enabling an interrupt twice is unnecessary,
but quite harmless. So remove the assert to simplify things for the
caller where possible.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: dt: take account type of interrupt in dt_get_irq()

Interrupt DT binding is defined by at least 2 cells as per DT binding
documentation [1]:
```
-The 1st cell is the interrupt type; 0 for SPI i

core: dt: take account type of interrupt in dt_get_irq()

Interrupt DT binding is defined by at least 2 cells as per DT binding
documentation [1]:
```
-The 1st cell is the interrupt type; 0 for SPI interrupts,
1 for PPI interrupts.
-The 2nd cell contains the interrupt number for the interrupt type.
SPI interrupts are in the range [0-987].
PPI interrupts are in the range [0-15].
```

This patch takes the first cell into account to return absolute value
required for itr_enable() interface.

Update CAAM crypto driver accordingly.

Link: [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/devicetree/bindings/interrupt-controller/arm,gic.yaml?h=v5.9#n66
Signed-off-by: Ludovic Barre <ludovic.barre@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

core: dt: split dt_get_irq() between interrupt framework and drivers

To welcome other interrupt drivers (coming from other platform for
example), we need to rework dt_get_irq() which was dedicated t

core: dt: split dt_get_irq() between interrupt framework and drivers

To welcome other interrupt drivers (coming from other platform for
example), we need to rework dt_get_irq() which was dedicated to ARM
platform more specifically GIC driver.
This change moves dt_get_irq() in interrupt framework, this manages the
generic part of interrupt bindings (specified by devicetree.org [1]) and
then call a driver callback to translate specific properties.
This callback is registered by drivers while its init step.

Update CAAM crypto driver accordingly.

Link: [1] https://www.devicetree.org/specifications/
Signed-off-by: Ludovic Barre <ludovic.barre@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

show more ...

drivers: gic: fix the off-by-one error

The gd->max_it should refer to the largest support interrupt id.
Fix the off-by-one errors so that the interrupt with the largest
id can be correctly handled.

drivers: gic: fix the off-by-one error

The gd->max_it should refer to the largest support interrupt id.
Fix the off-by-one errors so that the interrupt with the largest
id can be correctly handled.

Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Fangsuo Wu <fangsuowu@asrmicro.com>

show more ...

core: rename KEEP_INIT() and KEEP_PAGER()

The KEEP_INIT() and KEEP_PAGER() macros are quite often used in C files
immediately after the definition of a function or a structure without a
blank line i

core: rename KEEP_INIT() and KEEP_PAGER()

The KEEP_INIT() and KEEP_PAGER() macros are quite often used in C files
immediately after the definition of a function or a structure without a
blank line in between. This style mimics what the Linux kernel does for
a similar use cases: EXPORT_SYMBOL().

Unfortunately, the checkpatch.pl tool expects a blank line after
structure and function definitions, except for a few special cases such
as EXPORT_SYMBOL(). As a result we often get unwanted warnings when we
use KEEP_INIT() and KEEP_PAGER(). Among the exceptions are all words
starting with DECLARE_ or DEFINE_, so by renaming our macros we could
avoid the checkpatch warnings.

This commit renames KEEP_INIT() and KEEP_PAGER() to DECLARE_KEEP_INIT()
and DECLARE_KEEP_PAGER(), respectively. The assembler macros are also
renamed for consistency. No functional change is expected.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: gic: allow set pending a non-secure SGI

Remove assertion in GIC driver function gic_it_set_pending()
preventing Core from setting as pending a non-secure SGI.

Reviewed-by: Etienne Carriere

drivers: gic: allow set pending a non-secure SGI

Remove assertion in GIC driver function gic_it_set_pending()
preventing Core from setting as pending a non-secure SGI.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Fangsuo Wu <fangsuowu@asrmicro.com>

show more ...

drivers: GICv3: Configure native secure interrupt

OP-TEE dispatcher registers with TF-A to handle EL1S interrupts
by design. OP-TEE should own the G1S interrupts in GICv3.
-gic_it_add() should resul

drivers: GICv3: Configure native secure interrupt

OP-TEE dispatcher registers with TF-A to handle EL1S interrupts
by design. OP-TEE should own the G1S interrupts in GICv3.
-gic_it_add() should result in configuring a given interrupt to
G1S instead of G0 for GICv3.
-G1S interrupts to be enabled at distributor interface.
-system interface register ICC_IGRPEN1_EL1 to be used to enable
G1S interrupts.

Signed-off-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>
Reviewed-by: Soby Mathew <soby.mathew@arm.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: upgrade from write32() to io_write32() and friends

Replace use of readX() and writeX() with io_readX() and io_writeX().
The former function are about to be deprecated in favor to the later.

T

core: upgrade from write32() to io_write32() and friends

Replace use of readX() and writeX() with io_readX() and io_writeX().
The former function are about to be deprecated in favor to the later.

This change upgrades core generic code and drivers.
At some place, io_clrbitsX(), io_setbitsX() and io_clrsetbitsX()
replace the writeX(readX() ...) operations when obvious.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

probe_max_it overwrite the value of GICD_ISENABLER

probe_max_it save the original value of GICD_ISENABLER
and write 0xffffffff into GICD_ISENABLER to probe
the largest interrupt number.

Instead of

probe_max_it overwrite the value of GICD_ISENABLER

probe_max_it save the original value of GICD_ISENABLER
and write 0xffffffff into GICD_ISENABLER to probe
the largest interrupt number.

Instead of writing the original GICD_ISENABLER value
into GICD_ISENABLER, probe_max_it write the value into GICD_ICENABLER
and cause the original GICD_ISENABLER value bit flipping.

Signed-off-by: Lin Huang-Sen <r94922102@gmail.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: GICv3: Handle group 1 secure interrupts

As per GICv3 architecture specification (Section 4.6 Interrupt grouping),
secure EL1 (Trusted OS) handles secure group 1 physical interrupts and
EL3

drivers: GICv3: Handle group 1 secure interrupts

As per GICv3 architecture specification (Section 4.6 Interrupt grouping),
secure EL1 (Trusted OS) handles secure group 1 physical interrupts and
EL3 handles group 0 physical interrupts which are considered as FIQs
(foreign interrupt) for Trusted OS.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (FVP)
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>

show more ...

core: correct unpaged constraint on GIC driver

Release of secondary boot cores on 32bit machine use SMC that
issue a SGI on secondary core. Since the interrupt is raised
from the monitor mode, the r

core: correct unpaged constraint on GIC driver

Release of secondary boot cores on 32bit machine use SMC that
issue a SGI on secondary core. Since the interrupt is raised
from the monitor mode, the related GIC driver resources must be
tagged as unpaged.

This change costs around 300 bytes of unpaged resident memory.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove license notice from STMicroelectronics files

Since a while the source files license info are defined by SPDX
identifiers. We can safely remove the verbose license text from the
files that are

Remove license notice from STMicroelectronics files

Since a while the source files license info are defined by SPDX
identifiers. We can safely remove the verbose license text from the
files that are owned by either only STMicroelectronics or only both
Linaro and STMicroelectronics.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Add SPDX license identifiers

Adds one SPDX-License-Identifier line [1] to each source files that
contains license text.

Generated by [2]:
spdxify.py --add-spdx optee_os/

The scancode tool [3] wa

Add SPDX license identifiers

Adds one SPDX-License-Identifier line [1] to each source files that
contains license text.

Generated by [2]:
spdxify.py --add-spdx optee_os/

The scancode tool [3] was used to double check the license matching
code in the Python script. All the licenses detected by scancode are
either detected by spdxify.py, or have no SPDX identifier, or are false
matches.

Link: [1] https://spdx.org/licenses/
Link: [2] https://github.com/jforissier/misc/blob/f7b56c8/spdxify.py
Link: [3] https://github.com/nexB/scancode-toolkit
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

The other bits in GICD_CTLR should not be touched

The gic_init() function enables secure and non-secure group1
interrupts in GICD_CTLR register. But the other bits should
not be modified to avoid `U

The other bits in GICD_CTLR should not be touched

The gic_init() function enables secure and non-secure group1
interrupts in GICD_CTLR register. But the other bits should
not be modified to avoid `UNPREDICTABLE` behaviours as per ARM
GICv3 specification.

Signed-off-by: David Wang <david.wang@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
[jf: minor edits to commit message]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

Support ARM GICv3 mode

In ARM GICv3 mode, the interrupts are used as below for optee_os.
* FIQ - Foreign interrupts not handled by optee_os. This includes
the non-secure interrupts that should be ha

Support ARM GICv3 mode

In ARM GICv3 mode, the interrupts are used as below for optee_os.
* FIQ - Foreign interrupts not handled by optee_os. This includes
the non-secure interrupts that should be handled by the REE and the
secure interrupts assigned to the monitor (aarch32 Monitor mode or
aarch64 EL3).
* IRQ - Native interrupts for optee_os.

And optee_os should use the system register interface to access the GICC
registers in GICv3 mode.

A new build flag `CFG_ARM_GICV3=y` should be set to support GICv3 mode.

Signed-off-by: David Wang <david.wang@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: arm: Do not handle unsupported interrupts

Trying to handle an interrupt with an ID above the maximum will result
in a kernel panic as the itr_handle() function will try to disable this
unhand

core: arm: Do not handle unsupported interrupts

Trying to handle an interrupt with an ID above the maximum will result
in a kernel panic as the itr_handle() function will try to disable this
unhandled interruption.

Interrupts with a high ID will now be simply ignored.

Signed-off-by: Mathieu Briand <mbriand@witekio.com>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: add code for the interrupt framework

With this commit, we add three more GIC APIs for the kernel of OPTEE-OS:
itr_raise_sgi : can raise software generate interrupt(SGI) from secure
world to no

core: add code for the interrupt framework

With this commit, we add three more GIC APIs for the kernel of OPTEE-OS:
itr_raise_sgi : can raise software generate interrupt(SGI) from secure
world to no-secure world, or secure world to secure world. It's a quick
communication between different worlds and different cores. Because SGI
is using the GIC N-N model, so with this API, every core can receive
the interrupt if want.

itr_raise_pi : can trigger the peripheral interrupt with the corresponding
interrupt number. When sending it to N cores, just one core can receive
the effective interrupt.

itr_set_affinity : can target the peripheral interrupt to the core you
want, it means that one can bind the interrupt to the corresponding core
use this API.

The usage may as follow:
itr_raise_sgi(11, 0x1 << 1)
it will raise SGI11 to core 1, and if you want not only core 1 can receive
SGI11 but also core 2, then you can change the code to
itr_raise_sgi(11, 0x1 << 1 || 0x1 << 2).

itr_set_affinity(61, 0x1 << 1)
itr_raise_pi(61)
These two APIs may use together, the operation set_affinity set the PI61
can just sent to core 1, then raise_pi, core 1 will receive the peripheral
interrupt 61.

Signed-off-by: Guanchao Liang <liang.guanchao@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU)
[Update commit author to be same as S-o-b: above]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

plat-stm: enable generic gic support

Change generic boot to call gic_cpu_init() for secondary boot cores.

Attempt (bss cleared?) to assert gic driver was initialized before
gic_pu_init() is called.

plat-stm: enable generic gic support

Change generic boot to call gic_cpu_init() for secondary boot cores.

Attempt (bss cleared?) to assert gic driver was initialized before
gic_pu_init() is called.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: remove TEE_ASSERT()

TEE_ASSERT() can be confusing regarding assert() as assert() can
be disabled through NDEBUG while TEE_ASSERT() can't.
Instead one should explicitly implement "if (cond) { p

core: remove TEE_ASSERT()

TEE_ASSERT() can be confusing regarding assert() as assert() can
be disabled through NDEBUG while TEE_ASSERT() can't.
Instead one should explicitly implement "if (cond) { panic(); }"

This patch removes several inclusions on tee_common_unpg.h as it
used to define TEE_ASSERT() that has been removed.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jen.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (QEMU)

show more ...

assert/panic: fix misuse of assert/panic

Currently implementation of macro assert() does not expand to a
no-op when NDEBUG is defined. This will be done in a later change.
Before that, fix misuses o

assert/panic: fix misuse of assert/panic

Currently implementation of macro assert() does not expand to a
no-op when NDEBUG is defined. This will be done in a later change.
Before that, fix misuses of assert() and TEE_ASSERT():
- Correct misplaced assert() that should panic() whatever NDEBUG.
- Correct misplaced TEE_ASSERT() that should simply assert().

Also cleanup many inclusions of "assert.h" and few calls of assert().

Signed-off-by: Jens Wiklander <jen.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (QEMU)

show more ...