Print newline after hex address in aarch64 el3_panic function

Make the aarch64's el3_panic() function print a newline character after
PC address, otherwise the output can get mangled in one line wit

Print newline after hex address in aarch64 el3_panic function

Make the aarch64's el3_panic() function print a newline character after
PC address, otherwise the output can get mangled in one line with output
from other firmware. Here is an example of how the output of el3_panic()
got mangled with Linux' console output:

ERROR: Unhandled External Abort received on 0x80000001 at EL3!
ERROR: exception reason=1 syndrome=0x92000210
PANIC at PC : 0x0000000004027400[13438.473133] rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
[13438.479255] rcu: 1-...0: (4 ticks this GP) idle=35e/1/0x4000000000000000 softirq=146459/146459 fqs=2625

The aarch32 version of this function already does this.

Signed-off-by: Pali Rohár <pali@kernel.org>
Change-Id: I9f0d032c6cd1e2be7a1837f9c8e8244d30633993

show more ...

Merge "Increase type widths to satisfy width requirements" into integration

Increase type widths to satisfy width requirements

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
T

Increase type widths to satisfy width requirements

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
This resolves the following required rule:

bl1/aarch64/bl1_context_mgmt.c:81:[MISRA C-2012 Rule 10.7 (required)]<None>
The width of the composite expression "0U | ((mode & 3U) << 2U) | 1U |
0x3c0U" (32 bits) is less that the right hand operand
"18446744073709547519ULL" (64 bits).

This also resolves MISRA defects such as:

bl2/aarch64/bl2arch_setup.c:18:[MISRA C-2012 Rule 12.2 (required)]
In the expression "3U << 20", shifting more than 7 bits, the number
of bits in the essential type of the left expression, "3U", is
not allowed.

Further, MISRA requires that all shifts don't overflow. The definition of
PAGE_SIZE was (1U << 12), and 1U is 8 bits. This caused about 50 issues.
This fixes the violation by changing the definition to 1UL << 12. Since
this uses 32bits, it should not create any issues for aarch32.

This patch also contains a fix for a build failure in the sun50i_a64
platform. Specifically, these misra fixes removed a single and
instruction,

92407e73 and x19, x19, #0xffffffff

from the cm_setup_context function caused a relocation in
psci_cpus_on_start to require a linker-generated stub. This increased the
size of the .text section and caused an alignment later on to go over a
page boundary and round up to the end of RAM before placing the .data
section. This sectionn is of non-zero size and therefore causes a link
error.

The fix included in this reorders the functions during link time
without changing their ording with respect to alignment.

Change-Id: I76b4b662c3d262296728a8b9aab7a33b02087f16
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

Don't return error information from console_flush

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return typ

Don't return error information from console_flush

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return type to void does not
work around the MISRA violation that this causes. Instead, we collect
the error information from the driver (to avoid changing that API), and
don't return it to the caller.

Change-Id: I1e35afe01764d5c8f0efd04f8949d333ffb688c1
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

fdt: Fix coverity complaint about 32-bit multiplication

Coverity raised an eyebrow over our GICR frame size calculation:
========
CID 362942: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
Po

fdt: Fix coverity complaint about 32-bit multiplication

Coverity raised an eyebrow over our GICR frame size calculation:
========
CID 362942: Integer handling issues (OVERFLOW_BEFORE_WIDEN)
Potentially overflowing expression "nr_cores * gicr_frame_size" with type
"unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic,
and then used in a context that expects an expression of type "uint64_t"
(64 bits, unsigned).
========

Even with a GICv4 (256KB frame size) we need 16384 cores to overflow
32-bit, so it's not a practical issue.

But it's also easy to fix, so let's just do that: cast gicr_frame_size
to an unsigned 64-bit integer, so that the multiplication is done in the
64-bit realm.

Change-Id: Iad10e19b9e58d5fbf9d13205fbcef0aac5ae48af
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge changes from topic "stm32_exceptions" into integration

* changes:
stm32mp1: correct crash console GPIO alternate configuration
stm32mp1: add plat_panic_handler function
stm32mp1: update

Merge changes from topic "stm32_exceptions" into integration

* changes:
stm32mp1: correct crash console GPIO alternate configuration
stm32mp1: add plat_panic_handler function
stm32mp1: update plat_report_exception
Align AARCH32 version of debug.S with AARCH64

show more ...

fdt: Add function to adjust GICv3 redistributor size

We now have code to detect the CPU topology at runtime, and can also
populate the CPU nodes in a devicetree accordingly. This is used by the
ARM

fdt: Add function to adjust GICv3 redistributor size

We now have code to detect the CPU topology at runtime, and can also
populate the CPU nodes in a devicetree accordingly. This is used by the
ARM FPGA port, for instance.
But also a GICv3 compatible interrupt controller provides MMIO frames
per core, so the size of this region needs to be adjusted in the DT,
to match the number of cores as well.

Provide a generic function to find the GICv3 interrupt controller in
the DT, then adjust the "reg" entry to match the number of detected
cores. Since the size of the GICR frame per cores differs between
GICv4 and GICv3, this size is supplied as a parameter to the function.
The caller should determine the applicable value by either hardcoding
it or by observing GICR_TYPER.VLPIS.

Change-Id: Ic2a6445c2c5381a36bf24263f52fcbefad378c05
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Align AARCH32 version of debug.S with AARCH64

Re-order code (put panic and report_exception at the end of the file).
Export asm_print_* functions.
Add asm_print_line_dec macro, and asm_print_newline

Align AARCH32 version of debug.S with AARCH64

Re-order code (put panic and report_exception at the end of the file).
Export asm_print_* functions.
Add asm_print_line_dec macro, and asm_print_newline func.
Align comments in both AARCH32 and AARCH64 files.
Add blank lines in AARCH64 files to align with AARCH32.

Change-Id: I8e299a27c1390f71f04e260cd4a0e59b2384eb19
Signed-off-by: Yann Gautier <yann.gautier@st.com>

show more ...

Add support to export a /cpus node to the device tree.

This patch creates and populates the /cpus node in a device tree
based on the existing topology. It uses the minimum required nodes
and propert

Add support to export a /cpus node to the device tree.

This patch creates and populates the /cpus node in a device tree
based on the existing topology. It uses the minimum required nodes
and properties to satisfy the binding as specified in
https://www.kernel.org/doc/Documentation/devicetree/bindings/arm/cpus.txt

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I03bf4e9a6427da0a3b8ed013f93d7bc43b5c4df0

show more ...

Add wrapper for AT instruction

In case of AT speculative workaround applied, page table walk
is disabled for lower ELs (EL1 and EL0) in EL3.
Hence added a wrapper function which temporarily enables

Add wrapper for AT instruction

In case of AT speculative workaround applied, page table walk
is disabled for lower ELs (EL1 and EL0) in EL3.
Hence added a wrapper function which temporarily enables page
table walk to execute AT instruction for lower ELs and then
disables page table walk.

Execute AT instructions directly for lower ELs (EL1 and EL0)
assuming page table walk is enabled always when AT speculative
workaround is not applied.

Change-Id: I4ad4c0bcbb761448af257e9f72ae979473c0dde8
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

plat/fvp: Support for extracting UART serial node info from DT

This patch introduces the populate function which leverages
a new driver to extract base address and clk frequency properties
of the ua

plat/fvp: Support for extracting UART serial node info from DT

This patch introduces the populate function which leverages
a new driver to extract base address and clk frequency properties
of the uart serial node from HW_CONFIG device tree.

This patch also introduces fdt helper API fdtw_translate_address()
which helps in performing address translation.

Change-Id: I053628065ebddbde0c9cb3aa93d838619f502ee3
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

SPMD: extract SPMC DTB header size from SPMD

Currently BL2 passes TOS_FW_CONFIG address and size through registers to
BL31. This corresponds to SPMC manifest load address and size. The SPMC
manifest

SPMD: extract SPMC DTB header size from SPMD

Currently BL2 passes TOS_FW_CONFIG address and size through registers to
BL31. This corresponds to SPMC manifest load address and size. The SPMC
manifest is mapped in BL31 by dynamic mapping. This patch removes BL2
changes from generic code (which were enclosed by SPD=spmd) and retrieves
SPMC manifest size directly from within SPMD. The SPMC manifest load
address is still passed through a register by generic code.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I35c5abd95c616ae25677302f0b1d0c45c51c042f

show more ...

fdt/wrappers: Introduce code to find UART DT node

The stdout-path property in the /chosen node of a DTB points to a device
node, which is used for boot console output.
On most (if not all) ARM based

fdt/wrappers: Introduce code to find UART DT node

The stdout-path property in the /chosen node of a DTB points to a device
node, which is used for boot console output.
On most (if not all) ARM based platforms this is the debug UART.
The ST platform code contains a function to parse this property and
chase down eventual aliases to learn the node offset of this UART node.

Introduce a slightly more generalised version of this ST platform function
in the generic fdt_wrappers code. This will be useful for other platforms
as well.

Change-Id: Ie6da47ace7833861b5e35fe8cba49835db3659a5
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

plat/stm32: Use generic fdt_get_reg_props_by_name()

The STM32 platform port parse DT nodes to find base address to
peripherals. It does this by using its own implementation, even though
this functio

plat/stm32: Use generic fdt_get_reg_props_by_name()

The STM32 platform port parse DT nodes to find base address to
peripherals. It does this by using its own implementation, even though
this functionality is generic and actually widely useful outside of the
STM32 code.

Re-implement fdt_get_reg_props_by_name() on top of the newly introduced
fdt_get_reg_props_by_index() function, and move it to fdt_wrapper.c.
This is removes the assumption that #address-cells and #size-cells are
always one.

Change-Id: I6d584930262c732b6e0356d98aea50b2654f789d
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

arm: fconf: Fix GICv3 dynamic configuration

At the moment the fconf_populate_gicv3_config() implementation is
somewhat incomplete: First it actually fails to store the retrieved
information (the loc

arm: fconf: Fix GICv3 dynamic configuration

At the moment the fconf_populate_gicv3_config() implementation is
somewhat incomplete: First it actually fails to store the retrieved
information (the local addr[] array is going nowhere), but also it makes
quite some assumptions about the device tree passed to it: it needs to
use two address-cells and two size-cells, and also requires all five
register regions to be specified, where actually only the first two
are mandatory according to the binding (and needed by our code).

Fix this by introducing a proper generic function to retrieve "reg"
property information from a DT node:
We retrieve the #address-cells and #size-cells properties from the
parent node, then use those to extract the right values from the "reg"
property. The function takes an index to select one region of a reg
property.

This is loosely based on the STM32 implementation using "reg-names",
which we will subsume in a follow-up patch.

Change-Id: Ia59bfdf80aea4e36876c7b6ed4d153e303f482e8
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

plat/stm32: Implement fdt_read_uint32_default() as a wrapper

The STM32 platform code uses its own set of FDT helper functions,
although some of them are fairly generic.

Remove the implementation of

plat/stm32: Implement fdt_read_uint32_default() as a wrapper

The STM32 platform code uses its own set of FDT helper functions,
although some of them are fairly generic.

Remove the implementation of fdt_read_uint32_default() and implement it
on top of the newly introduced fdt_read_uint32() function, then convert
all users over.

This also fixes two callers, which were slightly abusing the "default"
semantic.

Change-Id: I570533362b4846e58dd797a92347de3e0e5abb75
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fdt/wrappers: Replace fdtw_read_cells() implementation

Our fdtw_read_cells() implementation goes to great lengths to
sanity-check every parameter and result, but leaves a big hole open:
The size of

fdt/wrappers: Replace fdtw_read_cells() implementation

Our fdtw_read_cells() implementation goes to great lengths to
sanity-check every parameter and result, but leaves a big hole open:
The size of the storage the value pointer points at needs to match the
number of cells given. This can't be easily checked at compile time,
since we lose the size information by using a void pointer.
Regardless the current usage of this function is somewhat wrong anyways,
since we use it on single-element, fixed-length properties only, for
which the DT binding specifies the size.
Typically we use those functions dealing with a number of cells in DT
context to deal with *dynamically* sized properties, which depend on
other properties (#size-cells, #clock-cells, ...), to specify the number
of cells needed.

Another problem with the current implementation is the use of
ambiguously sized types (uintptr_t, size_t) together with a certain
expectation about their size. In general there is no relation between
the length of a DT property and the bitness of the code that parses the
DTB: AArch64 code could encounter 32-bit addresses (where the physical
address space is limited to 4GB [1]), while AArch32 code could read
64-bit sized properties (/memory nodes on LPAE systems, [2]).

To make this more clear, fix the potential issues and also align more
with other DT users (Linux and U-Boot), introduce functions to explicitly
read uint32 and uint64 properties. As the other DT consumers, we do this
based on the generic "read array" function.
Convert all users to use either of those two new functions, and make
sure we never use a pointer to anything other than uint32_t or uint64_t
variables directly.

This reveals (and fixes) a bug in plat_spmd_manifest.c, where we write
4 bytes into a uint16_t variable (passed via a void pointer).

Also we change the implementation of the function to better align with
other libfdt users, by using the right types (fdt32_t) and common
variable names (*prop, prop_names).

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi#n874
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm/boot/dts/ecx-2000.dts

Change-Id: I718de960515117ac7a3331a1b177d2ec224a3890
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fdt/wrappers: Generalise fdtw_read_array()

Currently our fdtw_read_array() implementation requires the length of
the property to exactly match the requested size, which makes it less
flexible for pa

fdt/wrappers: Generalise fdtw_read_array()

Currently our fdtw_read_array() implementation requires the length of
the property to exactly match the requested size, which makes it less
flexible for parsing generic device trees.
Also the name is slightly misleading, since we treat the cells of the
array as 32 bit unsigned integers, performing the endianess conversion.

To fix those issues and align the code more with other DT users (Linux
kernel or U-Boot), rename the function to "fdt_read_uint32_array", and
relax the length check to only check if the property covers at least the
number of cells we request.
This also changes the variable names to be more in-line with other DT
users, and switches to the proper data types.

This makes this function more useful in later patches.

Change-Id: Id86f4f588ffcb5106d4476763ecdfe35a735fa6c
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Add support to pass the nt_fw_config DTB to OP-TEE.

At the moment, OP-TEE has no support to receive a DTB in Secure Memory
so it cannot receive TOS_FW_CONFIG_ID as it is supposed to happen on
any BL

Add support to pass the nt_fw_config DTB to OP-TEE.

At the moment, OP-TEE has no support to receive a DTB in Secure Memory
so it cannot receive TOS_FW_CONFIG_ID as it is supposed to happen on
any BL32 image. Instead, when OP-TEE is enable as BL32 payload,
NT_FW_CONFIG_ID is passed.

This MUST be reverted as soon as OP-TEE has support for receiving
DTBs from Secure Memory.

Change-Id: I9a873f42e94f2f99a60b638333e7afba1505aec9
Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>

show more ...

Fix crash dump for lower EL

This patch provides a fix for incorrect crash dump data for
lower EL when TF-A is built with HANDLE_EA_EL3_FIRST=1 option
which enables routing of External Aborts and SEr

Fix crash dump for lower EL

This patch provides a fix for incorrect crash dump data for
lower EL when TF-A is built with HANDLE_EA_EL3_FIRST=1 option
which enables routing of External Aborts and SErrors to EL3.

Change-Id: I9d5e6775e6aad21db5b78362da6c3a3d897df977
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

show more ...

Merge changes from topic "lm/fconf" into integration

* changes:
arm-io: Panic in case of io setup failure
MISRA fix: Use boolean essential type
fconf: Add documentation
fconf: Move platform

Merge changes from topic "lm/fconf" into integration

* changes:
arm-io: Panic in case of io setup failure
MISRA fix: Use boolean essential type
fconf: Add documentation
fconf: Move platform io policies into fconf
fconf: Add mbedtls shared heap as property
fconf: Add TBBR disable_authentication property
fconf: Add dynamic config DTBs info as property
fconf: Populate properties from dtb during bl2 setup
fconf: Load config dtb from bl1
fconf: initial commit

show more ...

Merge changes from topic "spmd" into integration

* changes:
SPMD: enable SPM dispatcher support
SPMD: hook SPMD into standard services framework
SPMD: add SPM dispatcher based upon SPCI Beta 0

Merge changes from topic "spmd" into integration

* changes:
SPMD: enable SPM dispatcher support
SPMD: hook SPMD into standard services framework
SPMD: add SPM dispatcher based upon SPCI Beta 0 spec
SPMD: add support to run BL32 in TDRAM and BL31 in secure DRAM on Arm FVP
SPMD: add support for an example SPM core manifest
SPMD: add SPCI Beta 0 specification header file

show more ...

Merge "coverity: Fix MISRA null pointer violations" into integration

SPMD: add support for an example SPM core manifest

This patch repurposes the TOS FW configuration file as the manifest for
the SPM core component which will reside at the secure EL adjacent to
EL3.

SPMD: add support for an example SPM core manifest

This patch repurposes the TOS FW configuration file as the manifest for
the SPM core component which will reside at the secure EL adjacent to
EL3. The SPM dispatcher component will use the manifest to determine how
the core component must be initialised. Routines and data structure to
parse the manifest have also been added.

Signed-off-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>
Change-Id: Id94f8ece43b4e05609f0a1d364708a912f6203cb

show more ...

Make PAC demangling more generic

At the moment, address demangling is only used by the backtrace
functionality. However, at some point, other parts of the TF-A
codebase may want to use it.
The 'dema

Make PAC demangling more generic

At the moment, address demangling is only used by the backtrace
functionality. However, at some point, other parts of the TF-A
codebase may want to use it.
The 'demangle_address' function is replaced with a single XPACI
instruction which is also added in 'do_crash_reporting()'.

Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
Change-Id: I4424dcd54d5bf0a5f9b2a0a84c4e565eec7329ec

show more ...