fix(psci): get the cpu_ops before exiting coherency

It is possible for the cpu_data structure to be cached somewhere in the
cache hierarchy. When HW_ASSISTED_COHERENCY == 0 we flush the core's
priva

fix(psci): get the cpu_ops before exiting coherency

It is possible for the cpu_data structure to be cached somewhere in the
cache hierarchy. When HW_ASSISTED_COHERENCY == 0 we flush the core's
private caches (usually the L1). However, the destination might be
shared caches (eg DSU L2 cache) so when we subsequently dereference the
cpu_data pointer we could get a stale value.

So dereference it prior to disabling the caches to avoid this scenario
and do all accesses from a coherent view of memory.

Change-Id: If118ca8c0436dd04d6ad0d57073d69305a7f41cb
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes from topic "gr/cov_fixes" into integration

* changes:
fix(libc): fix coverity overflowed constant
fix(libc): fix coverity overflowed constant
fix(psci): fix coverity issue with o

Merge changes from topic "gr/cov_fixes" into integration

* changes:
fix(libc): fix coverity overflowed constant
fix(libc): fix coverity overflowed constant
fix(psci): fix coverity issue with out-of-bounds read
fix(fvp): fix coverity issue unsigned_compare

show more ...

feat(cpufeat): add support for FEAT_IDTE3

This patch adds support for FEAT_IDTE3, which introduces support
for handling the trapping of Group 3 and Group 5 (only GMID_EL1)
registers to EL3 (unless t

feat(cpufeat): add support for FEAT_IDTE3

This patch adds support for FEAT_IDTE3, which introduces support
for handling the trapping of Group 3 and Group 5 (only GMID_EL1)
registers to EL3 (unless trapped to EL2). IDTE3 allows EL3 to
modify the view of ID registers for lower ELs, and this capability
is used to disable fields of ID registers tied to disabled features.

The ID registers are initially read as-is and stored in context.
Then, based on the feature enablement status for each world, if a
particular feature is disabled, its corresponding field in the
cached ID register is set to Res0. When lower ELs attempt to read
an ID register, the cached ID register value is returned. This
allows EL3 to prevent lower ELs from accessing feature-specific
system registers that are disabled in EL3, even though the hardware
implements them.

The emulated ID register values are stored primarily in per-world
context, except for certain debug-related ID registers such as
ID_AA64DFR0_EL1 and ID_AA64DFR1_EL1, which are stored in the
cpu_data and are unique to each PE. This is done to support feature
asymmetry that is commonly seen in debug features.

FEAT_IDTE3 traps all Group 3 ID registers in the range
op0 == 3, op1 == 0, CRn == 0, CRm == {2–7}, op2 == {0–7} and the
Group 5 GMID_EL1 register. However, only a handful of ID registers
contain fields used to detect features enabled in EL3. Hence, we
only cache those ID registers, while the rest are transparently
returned as is to the lower EL.

This patch updates the CREATE_FEATURE_FUNCS macro to generate
update_feat_xyz_idreg_field() functions that disable ID register
fields on a per-feature basis. The enabled_worlds scope is used to
disable ID register fields for security states where the feature is
not enabled.

This EXPERIMENTAL feature is controlled by the ENABLE_FEAT_IDTE3
build flag and is currently disabled by default.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I5f998eeab81bb48c7595addc5595313a9ebb96d5

show more ...

feat(per-cpu): migrate psci_ns_context to per-cpu framework

migrate psci_ns_context object to the NUMA-aware per-cpu
framework to optimize memory access and to efficiently
utilize memory.

Signed-of

feat(per-cpu): migrate psci_ns_context to per-cpu framework

migrate psci_ns_context object to the NUMA-aware per-cpu
framework to optimize memory access and to efficiently
utilize memory.

Signed-off-by: Sammit Joshi <sammit.joshi@arm.com>
Change-Id: Ie8b9f4eea8c61d4de9996d9370634cbd08ff1d8d

show more ...

feat(per-cpu): migrate psci_cpu_pd_nodes to per-cpu framework

migrate psci_cpu_pd_nodes object to the NUMA-aware per-cpu
framework to optimize memory access and to efficiently
utilize memory.

Signe

feat(per-cpu): migrate psci_cpu_pd_nodes to per-cpu framework

migrate psci_cpu_pd_nodes object to the NUMA-aware per-cpu
framework to optimize memory access and to efficiently
utilize memory.

Signed-off-by: Sammit Joshi <sammit.joshi@arm.com>
Signed-off-by: Rohit Mathew <rohit.mathew@arm.com>
Change-Id: Idec3e3b74ecf03b420b339a183be2b9e00f8a78f

show more ...

fix(psci): fix coverity issue with out-of-bounds read

Avoid OVERRUN on parent indices if accidental return negative value
from `get_pwr_lvl_state_idx`, so convert everything to use unsigned
int to a

fix(psci): fix coverity issue with out-of-bounds read

Avoid OVERRUN on parent indices if accidental return negative value
from `get_pwr_lvl_state_idx`, so convert everything to use unsigned
int to avoid Out-of-bounds read (OVERRUN)

Change-Id: Ie6d6fd34db9903e99b29e004fb46908aea8acd46
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

refactor(aarch64): move BL31 specific setup out of the PSCI entrypoint

We've charged the PSCI entrypoint with doing BL31 specific things like
setting up the EL3 context and doing feature detection.

refactor(aarch64): move BL31 specific setup out of the PSCI entrypoint

We've charged the PSCI entrypoint with doing BL31 specific things like
setting up the EL3 context and doing feature detection. Well, this is
irrelevant for sp_min and not really appropriate for PSCI. So move it to
the bl31_warmboot() function to reflect this correctly and bring the
feature detection a bit earlier, hopefully spotting more errors.

This allows for a pair of minor cleanups - we can pass the core_pos to
psci_warmboot_entrypoint() without having to refetch it, and we can put
the pauth enablement in cm_manage_extensions_el3() along with all
others. The call of that function is kept after the MMU is turned on so
that we have nicer (coherent) access to cpu_data.

Change-Id: Id031cfa0e1d8fe98919a14f9db73eb5bc9e00f67
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "fix(smccc): resolve caller world confusion" into integration

Merge changes Id38d6f1b,I5fcfe8dd,I7f3b50e5 into integration

* changes:
fix(cpus): inform the compiler that struct cpu_ops is aligned
refactor(el3-runtime): move the initialisation of the cpu_op

Merge changes Id38d6f1b,I5fcfe8dd,I7f3b50e5 into integration

* changes:
fix(cpus): inform the compiler that struct cpu_ops is aligned
refactor(el3-runtime): move the initialisation of the cpu_ops_ptr to C
fix(aarch32): make get_cpu_ops_ptr() PCS compliant

show more ...

refactor(el3-runtime): move the initialisation of the cpu_ops_ptr to C

The difference between AArch32 and AArch64 is insignificant and the
usage is identical. The only thing that required the use of

refactor(el3-runtime): move the initialisation of the cpu_ops_ptr to C

The difference between AArch32 and AArch64 is insignificant and the
usage is identical. The only thing that required the use of assembly was
that the get_cpu_ops_ptr() function was not PCS compliant and needed a
wrapper to do that instead. That has now been fixed so move this to C so
it's more readable and more optimise-able by the compiler.

Change-Id: I5fcfe8ddb122dd35d58adc6d44a7484c5c595815
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "fix(psci): add missing curly braces" into integration

Merge "fix(psci): initialise variable to default zero" into integration

fix(smccc): resolve caller world confusion

TF-A checks the SMC caller world using is_caller_secure,
is_caller_non_secure and is_caller_realm macros. Until
realm world was introduced it was fine to u

fix(smccc): resolve caller world confusion

TF-A checks the SMC caller world using is_caller_secure,
is_caller_non_secure and is_caller_realm macros. Until
realm world was introduced it was fine to use a pattern like

if (is_caller_non_secure(flags))
return DENY;

// Handle secure call
secure_operation();

is_caller_non_secure would be false for a realm caller, so this pattern
treats this like a secure world caller. This patch fixes
improper use of is_caller_non_secure and is_caller_secure
to handle realm world caller properly.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I60b125853183ac2ac15277f06d2efb7f3a9d3977

show more ...

fix(psci): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement.
Enclosed statement body w

fix(psci): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement.
Enclosed statement body within the curly braces.

Change-Id: Ida2460b7fe6f27b23382a1259a5ac93fe36bd48d
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>
Signed-off-by: Suraj Kakade <suraj.hanumantkakade@amd.com>

show more ...

fix(psci): initialize the variables

This corrects the MISRA violation C2012-9.1:
All variables are explicitly initialized with zero or default values
during declaration. This helps, even if a functi

fix(psci): initialize the variables

This corrects the MISRA violation C2012-9.1:
All variables are explicitly initialized with zero or default values
during declaration. This helps, even if a function fails, the
variables contain predictable values, preventing undefined behavior

Change-Id: I910467fd03e434e32da01e421fe77ec1402bc15a
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...

fix(psci): initialise variable to default zero

This corrects the MISRA violation C2012-9.1:
The value of an object with automatic storage duration shall not
be read before it has been set.
Initializ

fix(psci): initialise variable to default zero

This corrects the MISRA violation C2012-9.1:
The value of an object with automatic storage duration shall not
be read before it has been set.
Initialized the variable to default value zero.

Change-Id: I225ae4487b05fc47728222765029d6e1fe292ac1
Signed-off-by: Nithin G <nithing@amd.com>
Signed-off-by: Maheedhar Bollapalli <maheedharsai.bollapalli@amd.com>

show more ...

fix(lib): declare unused parameters as void

This corrects the MISRA violation C2012-2.7:
There should be no unused parameters in functions.
Declared unused function parameters as void.

Change-Id: I

fix(lib): declare unused parameters as void

This corrects the MISRA violation C2012-2.7:
There should be no unused parameters in functions.
Declared unused function parameters as void.

Change-Id: I979ba118fd209be5d4f0bff3978479c22428d79b
Signed-off-by: Nithin G <nithing@amd.com>
Signed-off-by: Maheedhar Bollapalli <maheedharsai.bollapalli@amd.com>

show more ...

feat(cpufeat): do feature detection on secondary cores too

Feature detection currently only happens on the boot core, however, it
is possible to have asymmetry between cores. TF-A supports limited s

feat(cpufeat): do feature detection on secondary cores too

Feature detection currently only happens on the boot core, however, it
is possible to have asymmetry between cores. TF-A supports limited such
configurations so it should check secondary cores too.

Change-Id: Iee4955714685be9ae6a017af4a6c284e835ff299
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): optimise clock init on a pabandon

When a powerdown abandon happens, all state will be preserved. As such,
there is no need to re-initialise the timer counter when unwinding.

Change-Id:

feat(psci): optimise clock init on a pabandon

When a powerdown abandon happens, all state will be preserved. As such,
there is no need to re-initialise the timer counter when unwinding.

Change-Id: I64185792a118fd04ca036abbb9be8f670d0d8328
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this i

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this is indeed the case. The chosen method is with a return value
that is highly unlikely on cores that are unaware of pabandon (x0 will
be primed with 1 and if used should be overwritten with the value of
CPUPWRCTLR_EL1 which should have its last bit set to power off and its
top bits RES0; the ACK value is chosen to be the exact opposite). An
alternative method would have been to add a field in cpu_ops, however
that would have required more major refactoring across many cpus and
would have taken up more memory on older platforms, so it was not
chosen.

Change-Id: I5826c0e4802e104d295c4ecbd80b5f676d2cd871
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): unify coherency exit between AArch64 and AArch32

The procedure is fairly simple: if we have hardware assisted coherency,
call into the cpu driver and let it do its thing. If we don't

refactor(psci): unify coherency exit between AArch64 and AArch32

The procedure is fairly simple: if we have hardware assisted coherency,
call into the cpu driver and let it do its thing. If we don't, then we
must turn data caches off, handle the confusion that causes with the
stack, and call into the cpu driver which will flush the caches that
need flushing.

On AArch32 the above happens in common code. On AArch64, however, the
turning off of the caches happens in the cpu driver. Since we're dealing
with the stack, we must exercise control over it and implement this in
assembly. But as the two implementations are nominally different (in the
ordering of operations), the part that is in assembly is quite large as
jumping back to C to handle the difference might involve the stack.

Presumably, the AArch difference was introduced in order to cater for a
possible implementation where turning off the caches requires an IMP DEF
sequence. Well, Arm no longer makes cores without hardware assisted
coherency, so this eventually is not possible.

So take this part out of the cpu driver and put it into common code,
just like in AArch32. With this, there is no longer a need call
prepare_cpu_pwr_dwn() in a different order either - we can delay it a
bit to happen after the stack management. So the two AArch-s flows
become identical. We can convert prepare_cpu_pwr_dwn() to C and leave
psci_do_pwrdown_cache_maintenance() only to exercise control over stack.

Change-Id: Ie4759ebe20bb74b60533c6a47dbc2b101875900f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called f

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called from
non-PSCI code as PSCI is smart enough to handle this after platform
hooks. So absorb the functions into common code.

This allows for a tiny bit of optimisation: there will be no branch
(that can be missed or non-cached) to a non-inlineable function. Then in
the terminal case we can call wfi() directly with the application of the
erratum before the loop. And finally in the wakeup case, we don't have
to explicitly clear the errata as that will happen automatically on the
second call of prepare_cpu_pwr_dwn().

The A510 erratum requires a tsb csync before the dsb+wfi combo to turn
the core off. We can do this a little bit earlier in the cpu hook and
relieve common code from the responsibility. EL3 is always a prohibited
region so the buffer will stay empty.

Change-Id: I5f950df3fb7b0736df4ce25a21f78b29896de215
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(psci): initialise variable to default zero

This corrects the MISRA violation C2012-9.1:

The value of an object with automatic storage duration shall
not be read before it has been set.Initializ

fix(psci): initialise variable to default zero

This corrects the MISRA violation C2012-9.1:

The value of an object with automatic storage duration shall
not be read before it has been set.Initialized the variable
to default value zero.

Change-Id: Ib3a2a853b82ce3c3ba1f518705d7ac2e01130e37
Signed-off-by: Prasad Kummari <prasad.kummari@amd.com>
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...

fix(psci): add missing curly braces

This corrects the MISRA violation C2012-15.6:

The body of an iteration-statement or a selection-statement
shall be a compound-statement.Enclosed statement body w

fix(psci): add missing curly braces

This corrects the MISRA violation C2012-15.6:

The body of an iteration-statement or a selection-statement
shall be a compound-statement.Enclosed statement body within
the curly braces.

Change-Id: Ibd402a52e44e59d1c37613d8925aac8e115aa31c
Signed-off-by: Prasad Kummari <prasad.kummari@amd.com>
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...