fix(gic600): workaround for Part 1 of GIC600 erratum 2384374

GIC600 erratum 2384374 is a Category B erratum. Part 1 is fixed
in this patch, and the Part 1 failure mode is described as
'If the packet

fix(gic600): workaround for Part 1 of GIC600 erratum 2384374

GIC600 erratum 2384374 is a Category B erratum. Part 1 is fixed
in this patch, and the Part 1 failure mode is described as
'If the packet to be sent is a SET packet, then a higher priority SET
may not be sent when it should be until an unblocking event occurs.'

This is handled by calling gicv3_apply_errata_wa_2384374() in the
ehf_deactivate_priority() path, so that when EHF restores the priority
to the original priority, the interrupt packet buffered
in the GIC can be sent.

gicv3_apply_errata_wa_2384374() is the workaround for
the Part 2 of erratum 2384374 which flush packets from the GIC buffer
and is being used in this patch.

SDEN can be found here:
https://developer.arm.com/documentation/sden892601/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I4bb6dcf86c94125cbc574e0dc5119abe43e84731

show more ...

refactor(sds): modify log level for region validity

Modify the log level from WARNING to VERBOSE for the SDS region
validity check. An invalid region causes the initialization step
to fail, but norm

refactor(sds): modify log level for region validity

Modify the log level from WARNING to VERBOSE for the SDS region
validity check. An invalid region causes the initialization step
to fail, but normally it's only a temporary condition as the
actual initialization of the region (such as adding a valid region
descriptor structure) can happen asynchronously in another system
component. The goal of this tiny modification is to avoid flooding
the log with this message when we're waiting in a loop for the
region initialization to happen.

Change-Id: I180e35e25df3f31bbc816e6421ded17ba6ae1d85
Signed-off-by: David Vincze <david.vincze@arm.com>

show more ...

feat(smmu): separate out smmuv3_security_init from smmuv3_init

Split the smmuv3_init() to separate smmuv3_security_init() from it in
order to allow skipping the default deny policy on reset for cert

feat(smmu): separate out smmuv3_security_init from smmuv3_init

Split the smmuv3_init() to separate smmuv3_security_init() from it in
order to allow skipping the default deny policy on reset for certain
SMMUv3 implementations.
Additionally, fix a couple of MISRA warnings.

Signed-off-by: Vijayenthiran Subramaniam <vijayenthiran.subramaniam@arm.com>
Signed-off-by: Vivek Gautam <vivek.gautam@arm.com>
Change-Id: I2127943e709dd1ded34145bd022c930e351bbb4a

show more ...

feat(smmu): fix to perform INV_ALL before enabling GPC

The SMMU_S_INIT register definition in the Arm SMMUv3 specification
says that if SMMUv3 has REALM_IMPL == 1 then it is root firmware’s
responsi

feat(smmu): fix to perform INV_ALL before enabling GPC

The SMMU_S_INIT register definition in the Arm SMMUv3 specification
says that if SMMUv3 has REALM_IMPL == 1 then it is root firmware’s
responsibility to write to INV_ALL before enabling granule protection
checks. So fix this flow during smmuv3 init.

Signed-off-by: Vivek Gautam <vivek.gautam@arm.com>
Change-Id: Ied9325e1658950c04f06c62485eeab3f28ca1285

show more ...

Merge changes from topic "mb/tc-model-update" into integration

* changes:
docs: update FVP TC2 model version and build (11.23/17)
fix(tc): increase BL2 maximum size limit
refactor(tc): update

Merge changes from topic "mb/tc-model-update" into integration

* changes:
docs: update FVP TC2 model version and build (11.23/17)
fix(tc): increase BL2 maximum size limit
refactor(tc): update platform tests
feat(rss): add defines for 'type' range and use them in psa_call()
feat(rss): adjust parameter packing to match TF-M changes
refactor(tc): remap console logs

show more ...

feat(rss): add defines for 'type' range and use them in psa_call()

Update the 'type' parameter checking according to changes
on RSS's (TF-M) side: 40b09ba1 [1]

[1]: https://git.trustedfirmware.org/

feat(rss): add defines for 'type' range and use them in psa_call()

Update the 'type' parameter checking according to changes
on RSS's (TF-M) side: 40b09ba1 [1]

[1]: https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/commit/?id=40b09ba1e4a7a4f726f98700eab7e4e4d8e95dcf

Change-Id: I8487e8ab24aa2dd080b5bb8f2f5c7e8fc15cf211
Signed-off-by: David Vincze <david.vincze@arm.com>

show more ...

feat(rss): adjust parameter packing to match TF-M changes

Adjust the parameter packing scheme in RSS communication
to align with changes made in TF-M: 3be6c395 [1]

[1]: https://git.trustedfirmware.

feat(rss): adjust parameter packing to match TF-M changes

Adjust the parameter packing scheme in RSS communication
to align with changes made in TF-M: 3be6c395 [1]

[1]: https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/commit/?id=3be6c3954b94f000cdcf7575bd4c18f57b3492f8

Change-Id: Ief38f96ab991d1125b37adfced5ffafc39e754a0
Signed-off-by: David Vincze <david.vincze@arm.com>

show more ...

refactor(css): support multiple SDS regions

Extend the SDS driver to be able to handle multiple
SDS regions:
- AP-SCP
- AP-RSS

Change-Id: Id303840b248c383b3f960227cbf6333d1cc75e65
Signed-off-by:

refactor(css): support multiple SDS regions

Extend the SDS driver to be able to handle multiple
SDS regions:
- AP-SCP
- AP-RSS

Change-Id: Id303840b248c383b3f960227cbf6333d1cc75e65
Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Signed-off-by: David Vincze <david.vincze@arm.com>

show more ...

Merge "refactor(gicv3): introducing is_valid_interrupt, a new helper utility" into integration

Merge changes from topic "ADD_DELAY_IN_POLLING_SCMI" into integration

* changes:
fix(scmi): induce a delay in monitoring SCMI channel status
feat(css): initialise generic timer early in the boot

refactor(gicv3): introducing is_valid_interrupt, a new helper utility

In gicv3_main.c the function is_sgi_ppi() returns true when its
sgi/ppi or false when the interrupt number matches an spi interr

refactor(gicv3): introducing is_valid_interrupt, a new helper utility

In gicv3_main.c the function is_sgi_ppi() returns true when its
sgi/ppi or false when the interrupt number matches an spi interrupt.
Introducing a new API is_valid_interrupt() which validates if
an interrupt number matches SGI/PPI or SPI as a valid interrupt,
any other interrupt number is considered invalid and panics.

Change-Id: Idce8f5432a94c8d300b9408cf5b2502c60e13318
Signed-off-by: Sona Mathew <sonarebecca.mathew@arm.com>

show more ...

fix(rss): fix bound check during protocol selection

Fix the wrong placement of the closing parenthesis in the second
condition check that resulted in the incorrect calculation of the MHU
message siz

fix(rss): fix bound check during protocol selection

Fix the wrong placement of the closing parenthesis in the second
condition check that resulted in the incorrect calculation of the MHU
message size. Also, format the code for readability.

Signed-off-by: Vijayenthiran Subramaniam <vijayenthiran.subramaniam@arm.com>
Change-Id: I0e012f3ff00bae2dfc12cdb1c2c636fc6c0a0b55

show more ...

fix(mhuv2): provide only the usable size of memory

The function mhu_get_max_message_size() for MHUv2 should return only the
available memory for use after considering all the overheads for its own
u

fix(mhuv2): provide only the usable size of memory

The function mhu_get_max_message_size() for MHUv2 should return only the
available memory for use after considering all the overheads for its own
use.

Signed-off-by: Sathyam Panda <sathyam.panda@arm.com>
Signed-off-by: Vijayenthiran Subramaniam <vijayenthiran.subramaniam@arm.com>
Change-Id: I14ad16e8f4b781e396bca6173077513db74157d5

show more ...

fix(scmi): induce a delay in monitoring SCMI channel status

Reading the SCMI mailbox status in polling mode causes a burst of bus
accesses. On certain platforms, this would not be ideal as the share

fix(scmi): induce a delay in monitoring SCMI channel status

Reading the SCMI mailbox status in polling mode causes a burst of bus
accesses. On certain platforms, this would not be ideal as the shared
bus on the CPU subsystem might cause contentions across all the CPUs.
So allow platforms to specify a delay to be introduced while polling.

Change-Id: Ib90ad7b5954854071cfd543f4a27a178dde3d5c6
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>

show more ...

Merge changes from topic "dcc-console" into integration

* changes:
fix(dcc): enable DCC also for crash console
build(changelog): add new scope for DCC

refactor(console): disable getc() by default

The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A

refactor(console): disable getc() by default

The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A. It is dangerous to keep that feature enabled if not
strictly necessary, especially in production firmware builds.

Thus, we need a way to disable this feature. Moreover, when it is
disabled, all related code should be eliminated from the firmware
binaries, such that no remnant/dead getc() code remains in memory,
which could otherwise be used as a gadget as part of a bigger security
attack.

This patch disables getc() feature by default. For legitimate getc()
use cases [1], it can be explicitly enabled by building TF-A with
ENABLE_CONSOLE_GETC=1.

The following changes are introduced when getc() is disabled:

- The multi-console framework no longer provides the console_getc()
function.

- If the console driver selected by the platform attempts to register
a getc() callback into the multi-console framework then TF-A will
now fail to build.

If registered through the assembly function finish_console_register():
- On AArch64, you'll get:
Error: undefined symbol CONSOLE_T_GETC used as an immediate value.
- On AArch32, you'll get:
Error: internal_relocation (type: OFFSET_IMM) not fixed up

If registered through the C function console_register(), this requires
populating a struct console with a getc field, which will trigger:
error: 'console_t' {aka 'struct console'} has no member named 'getc'

- All console drivers which previously registered a getc() callback
have been modified to do so only when ENABLE_CONSOLE_GETC=1.

[1] Example of such use cases would be:
- Firmware recovery: retrieving a golden BL2 image over the console in
order to repair a broken firmware on a bricked board.
- Factory CLI tool: Drive some soak tests through the console.

Discussed on TF-A mailing list here:
https://lists.trustedfirmware.org/archives/list/tf-a@lists.trustedfirmware.org/thread/YS7F6RCNTWBTEOBLAXIRTXWIOYINVRW7/

Change-Id: Icb412304cd23dbdd7662df7cf8992267b7975cc5
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Acked-by: Baruch Siach <baruch@tkos.co.il>

show more ...

Merge changes from topic "xlnx_dcc_console" into integration

* changes:
chore(dcc): remove unnecessary code in dcc
fix(dcc): add dcc console unregister function

chore(dcc): remove unnecessary code in dcc

Remove the dcc_console_init() function. The initialization function
is not being used and serves no purpose.

Signed-off-by: Prasad Kummari <prasad.kummari

chore(dcc): remove unnecessary code in dcc

Remove the dcc_console_init() function. The initialization function
is not being used and serves no purpose.

Signed-off-by: Prasad Kummari <prasad.kummari@amd.com>
Change-Id: I056d09e153998d686d3b95ad39c563f797184c18

show more ...

fix(dcc): add dcc console unregister function

Add unregistration function for the JTAG DCC (Debug Communication
Channel) console.
The unregistration function flushes DCC buffer before unregistering

fix(dcc): add dcc console unregister function

Add unregistration function for the JTAG DCC (Debug Communication
Channel) console.
The unregistration function flushes DCC buffer before unregistering
the dcc console to make sure that no output char is pending.

Since console_flush() flushes chars for all registered consoles on
the platform, which is not required in this case, dcc_console_flush()
is being called instead.

Signed-off-by: Prasad Kummari <prasad.kummari@amd.com>
Change-Id: I6f15a07c6ee947dc0e7aa8fb069227618080e611

show more ...

fix(dcc): enable DCC also for crash console

The JTAG DCC (Debug Communication Channel) console is primary used
for debugging that's why make no sense not to setup it up as crash
console too.

Change

fix(dcc): enable DCC also for crash console

The JTAG DCC (Debug Communication Channel) console is primary used
for debugging that's why make no sense not to setup it up as crash
console too.

Change-Id: I16e5d83f8da721657b1a10609494f835b87e5578
Signed-off-by: Michal Simek <michal.simek@amd.com>

show more ...

fix(gicv3): map generic interrupt type to GICv3 group

The generic interrupt controller identifies an interrupt based on its
type whereas the GIC uses the notion of groups to identify an
interrupt.

fix(gicv3): map generic interrupt type to GICv3 group

The generic interrupt controller identifies an interrupt based on its
type whereas the GIC uses the notion of groups to identify an
interrupt.

Currently, they are used interchangeably in GICv3 driver. It did not
cause any functional issues since the matching type and group had the
same value for corresponding macros. This patch makes the necessary
fixes.

The generic interrupt controller APIs, such as
plat_ic_set_interrupt_type map interrupt type to interrupt group
supported by the GICv3 IP. Similarly, other generic interrupt
controller APIs map interrupt group to interrupt type as needed.

This patch also changes the name of the helper functions to use group
rather than type for handling interrupts.

Change-Id: Ie2d88a3260c71e4ab9c8baacde24cc21e551de3d
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

chore(gicv2): use interrupt group instead of type

The generic interrupt controller identifies an interrupt based on its
type whereas the GIC uses the notion of groups to identify an
interrupt.

This

chore(gicv2): use interrupt group instead of type

The generic interrupt controller identifies an interrupt based on its
type whereas the GIC uses the notion of groups to identify an
interrupt.

This patch changes the name of the helper functions to use group
rather than type for handling interrupts. No functional change in this
patch.

Change-Id: If13ec65cc6c87c2da73a3d54b033f02635ff924a
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

feat(ethos-n): update npu error handling

Changes have been made in NPU firmware version 13 around error handling
which require some different register values to be set in AUXCTLR and
SYSCTRL1.

SiP

feat(ethos-n): update npu error handling

Changes have been made in NPU firmware version 13 around error handling
which require some different register values to be set in AUXCTLR and
SYSCTRL1.

SiP service version number has been bumped up to 15 to reflect these
changes.

Change-Id: I6cda0048dc75df2150f7a0fe25f12ba6bf119ced
Signed-off-by: Rob Hughes <robert.hughes@arm.com>

show more ...

Merge "fix(fvp): extract core id from mpidr for pwrc operations" into integration

chore(ethos-n): use non blocking soft reset on npu

Signed-off-by: Zingo Andersen <zingo.andersen@arm.com>
Change-Id: I2c4e826f4bbbcd7c9170d5df2f8088f82ac2da7c