refactor(psci): extract cm_prepare_el3_exit_ns() to a common location

PSCI on and suspend wakeup both end with a cm_prepare_el3_exit_ns() call.
Since they are equivalent to the caller, move the call

refactor(psci): extract cm_prepare_el3_exit_ns() to a common location

PSCI on and suspend wakeup both end with a cm_prepare_el3_exit_ns() call.
Since they are equivalent to the caller, move the call to just after the
*_finish calls to deduplicate it.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I05c16dc6613aba357d20cc39cc43aab803d675e0

show more ...

Merge changes from topic "bk/context_refactor" into integration

* changes:
refactor(pmu): convert FEAT_MTPMU to C and move to persistent register init
feat(pmu): introduce pmuv3 lib/extensions f

Merge changes from topic "bk/context_refactor" into integration

* changes:
refactor(pmu): convert FEAT_MTPMU to C and move to persistent register init
feat(pmu): introduce pmuv3 lib/extensions folder
fix(pmu): make MDCR_EL3.MTPME=1 out of reset
refactor(cm): introduce a real manage_extensions_nonsecure()

show more ...

refactor(cm): introduce a real manage_extensions_nonsecure()

manage_extensions_nonsecure() is problematic because it updates both
context and in-place registers (unlike its secure/realm counterparts

refactor(cm): introduce a real manage_extensions_nonsecure()

manage_extensions_nonsecure() is problematic because it updates both
context and in-place registers (unlike its secure/realm counterparts).
The in-place register updates make it particularly tricky, as those
never change for the lifetime of TF-A. However, they are only set when
exiting to NS world. As such, all of TF-A's execution before that
operates under a different context. This is inconsistent and could cause
problems.

This patch Introduce a real manage_extensions_nonsecure() which only
operates on the context structure. It also introduces a
cm_manage_extensions_el3() which only operates on register in-place that
are not context switched. It is called in BL31's entrypoints so that all
of TF-A executes with the same environment once all features have been
converted.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: Ic579f86c41026d2054863ef44893e0ba4c591da9

show more ...

Merge changes from topic "psci-osi" into integration

* changes:
fix(psci): add optional pwr_domain_validate_suspend to plat_psci_ops_t
fix(sc7280): update pwr_domain_suspend
fix(fvp): update p

Merge changes from topic "psci-osi" into integration

* changes:
fix(psci): add optional pwr_domain_validate_suspend to plat_psci_ops_t
fix(sc7280): update pwr_domain_suspend
fix(fvp): update pwr_domain_suspend

show more ...

fix(psci): add optional pwr_domain_validate_suspend to plat_psci_ops_t

This patch adds a new optional member `pwr_domain_validate_suspend` to
the `plat_psci_ops_t` structure that allows a platform t

fix(psci): add optional pwr_domain_validate_suspend to plat_psci_ops_t

This patch adds a new optional member `pwr_domain_validate_suspend` to
the `plat_psci_ops_t` structure that allows a platform to optionally
perform platform specific validations in OS-initiated mode. This is
conditionally compiled into the build depending on the value of the
`PSCI_OS_INIT_MODE` build option.

In https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/17682,
the return type of the `pwr_domain_suspend` handler was updated from
`void` to `int` to allow a platform to optionally perform platform
specific validations in OS-initiated mode. However, when an error code
other than `PSCI_E_SUCCESS` is returned, the current exit path does not
undo the operations in `psci_suspend_to_pwrdown_start`, and as a result,
the system ends up in an unexpected state.

The fix in this patch prevents the need to undo the operations in
`psci_suspend_to_pwrdown_start`, by allowing the platform to first
perform any necessary platform specific validations before the PSCI
generic code proceeds to the point of no return where the CPU_SUSPEND
request is expected to complete successfully.

Change-Id: I05d92c7ea3f5364da09af630d44d78252185db20
Signed-off-by: Wing Li <wingers@google.com>

show more ...

Merge "fix(psci): do not panic on illegal MPIDR" into integration

fix(psci): do not panic on illegal MPIDR

Commit 66327414fb1e ("fix(psci): potential array overflow with cpu on")
changed an assert in the PSCI library's psci_cpu_on_start() function to
a runtime err

fix(psci): do not panic on illegal MPIDR

Commit 66327414fb1e ("fix(psci): potential array overflow with cpu on")
changed an assert in the PSCI library's psci_cpu_on_start() function to
a runtime error message, followed by a panic. This does not seem right
for two reasons:
- We must not panic() triggered by conditions influenced by lower EL
callers. If non-secure world provides illegal arguments to a PSCI
call, we can easily detect this and return -PSCI_E_INVALID_PARAMS, as
the PSCI spec demands. In fact this is done already, which brings us
to the next reason:
- psci_cpu_on_start() is effectively a function private to the PSCI
library: its prototype is in psci_private.h. It's just not static
because it lives in a different code file from the main PSCI code.
We check for illegal MPID values already in psci_cpu_on(), and return
an error value to the caller, as we should. This function is the ONLY
caller of psci_cpu_on_start(), so there is no way we get an illegal
target_cpu argument into this function. An assert() is thus the proper
way to check for this.

Mostly revert the patch mentioned above, just extending the assert so
that it does also check for not exceeding the array boundaries.
To harden the code, add a check against PLATFORM_MAX_CORE_COUNT in
psci_validate_mpidr(), and return with the proper PSCI error code if
this number is exceeded.

This also fixes the sun50i_a64 build with DEBUG=1, which exceeded an
SRAM limit due to the error message.

Change-Id: I48fc58d96b0173da5b934750f4cadf7884ef5e42
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge changes from topic "psci-osi" into integration

* changes:
feat(sc7280): add support for PSCI_OS_INIT_MODE
feat(fvp): enable support for PSCI OS-initiated mode
feat(psci): update PSCI_FEA

Merge changes from topic "psci-osi" into integration

* changes:
feat(sc7280): add support for PSCI_OS_INIT_MODE
feat(fvp): enable support for PSCI OS-initiated mode
feat(psci): update PSCI_FEATURES
feat(psci): add support for OS-initiated mode
feat(psci): add support for PSCI_SET_SUSPEND_MODE
build(psci): add build option for OS-initiated mode
docs(psci): add design proposal for OS-initiated mode

show more ...

feat(psci): add support for OS-initiated mode

This patch adds a `psci_validate_state_coordination` function that is
called by `psci_cpu_suspend_start` in OS-initiated mode.

This function validates

feat(psci): add support for OS-initiated mode

This patch adds a `psci_validate_state_coordination` function that is
called by `psci_cpu_suspend_start` in OS-initiated mode.

This function validates the request per sections 4.2.3.2, 5.4.5, and 6.3
of the PSCI spec (DEN0022D.b):
- The requested power states are consistent with the system's state
- The calling core is the last running core at the requested power level

This function differs from `psci_do_state_coordination` in that:
- The `psci_req_local_pwr_states` map is not modified if the request
were to be denied
- The `state_info` argument is never modified since it contains the
power states requested by the calling OS

This is conditionally compiled into the build depending on the value of
the `PSCI_OS_INIT_MODE` build option.

Change-Id: I667041c842d2856e9d128c98db4d5ae4e4552df3
Signed-off-by: Wing Li <wingers@google.com>

show more ...

feat(psci): add support for PSCI_SET_SUSPEND_MODE

This patch adds a PSCI_SET_SUSPEND_MODE handler that validates the
request per section 5.20.2 of the PSCI spec (DEN0022D.b), and updates
the suspend

feat(psci): add support for PSCI_SET_SUSPEND_MODE

This patch adds a PSCI_SET_SUSPEND_MODE handler that validates the
request per section 5.20.2 of the PSCI spec (DEN0022D.b), and updates
the suspend mode to the requested mode.

This is conditionally compiled into the build depending on the value of
the `PSCI_OS_INIT_MODE` build option.

Change-Id: Iebf65f5f7846aef6b8643ad6082db99b4dcc4bef
Signed-off-by: Wing Li <wingers@google.com>

show more ...

Merge changes I51c13c52,I3358c51e into integration

* changes:
build: always prefix section names with `.`
build: communicate correct page size to linker

build: always prefix section names with `.`

Some of our specialized sections are not prefixed with the conventional
period. The compiler uses input section names to derive certain other
section name

build: always prefix section names with `.`

Some of our specialized sections are not prefixed with the conventional
period. The compiler uses input section names to derive certain other
section names (e.g. `.rela.text`, `.relacpu_ops`), and these can be
difficult to select in linker scripts when there is a lack of a
delimiter.

This change introduces the period prefix to all specialized section
names.

BREAKING-CHANGE: All input and output linker section names have been
prefixed with the period character, e.g. `cpu_ops` -> `.cpu_ops`.

Change-Id: I51c13c5266d5975fbd944ef4961328e72f82fc1c
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

Merge "refactor(psci): unify psci_is_last_on_cpu and psci_is_last_on_cpu_safe" into integration

refactor(psci): unify psci_is_last_on_cpu and psci_is_last_on_cpu_safe

"psci_is_last_on_cpu" and "psci_is_last_on_cpu_safe" modules perform
mostly similar functionalities, verifying whether the curr

refactor(psci): unify psci_is_last_on_cpu and psci_is_last_on_cpu_safe

"psci_is_last_on_cpu" and "psci_is_last_on_cpu_safe" modules perform
mostly similar functionalities, verifying whether the current CPU
is the only active core and other cores have been turned off.

However, psci_is_last_on_cpu_safe function differs from the other with:
1. Safe API locks the power domain

This patch removes the section duplicating the functionality
and ensures that "psci_is_last_on_cpu api",is reused in
"psci_is_last_on_cpu_safe" procedure.

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: Ie372519e423898d7afa5427cdd77a7f9d3369587

show more ...

Merge changes from topic "RDN2_WARM_REBOOT_WITH_SGI" into integration

* changes:
feat(sgi): enable css implementation of warm reset
feat(scmi): send powerdown request to online secondary cpus

Merge changes from topic "RDN2_WARM_REBOOT_WITH_SGI" into integration

* changes:
feat(sgi): enable css implementation of warm reset
feat(scmi): send powerdown request to online secondary cpus
feat(plat/arm/css): add interrupt handler for reboot request
refactor(psci): move psci_do_pwrdown_sequence() out of private header
feat(plat/arm/css): add per-cpu power down support for warm reset
feat(scmi): set warm reboot entry point
fix(gicv3): update the affinity mask to 8 bit

show more ...

refactor(psci): move psci_do_pwrdown_sequence() out of private header

Move the psci_do_pwrdown_sequence() function declaration from PSCI
private header to common header. The psci_do_pwrdown_sequence

refactor(psci): move psci_do_pwrdown_sequence() out of private header

Move the psci_do_pwrdown_sequence() function declaration from PSCI
private header to common header. The psci_do_pwrdown_sequence is
required to support warm reset, where each CPU need to execute the
powerdown sequence.

Change-Id: I298e7a120be814941fa91c0b001002a080e56263
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>

show more ...

Merge "fix(psci): fix MISRA failure - Memory - illegal accesses" into integration

fix(psci): fix MISRA failure - Memory - illegal accesses

Fixed below MISRA failure -
>>> CID 379362: Memory - illegal accesses (OVERRUN)
>>> Overrunning array "psci_non_cpu_pd_nodes" of 5

fix(psci): fix MISRA failure - Memory - illegal accesses

Fixed below MISRA failure -
>>> CID 379362: Memory - illegal accesses (OVERRUN)
>>> Overrunning array "psci_non_cpu_pd_nodes" of 5 16-byte
>>> elements at element index 5 (byte offset 95) using index
>>> "i" (which evaluates to 5).

Change-Id: Ie88fc555e48b06563372bfe4e51f16b13c0a020b
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge "feat(psci): add a helper function to ensure that non-boot PEs are offline" into integration

feat(psci): add a helper function to ensure that non-boot PEs are offline

Introduce a helper function that ensures that non-boot PEs are offline.
This function will be used by DRTM implementation to

feat(psci): add a helper function to ensure that non-boot PEs are offline

Introduce a helper function that ensures that non-boot PEs are offline.
This function will be used by DRTM implementation to ensure that system
is running with only single PE.

Signed-off-by: Manish V Badarkhe <manish.badarkhe@arm.com>
Signed-off-by: Lucian Paul-Trifu <lucian.paultrifu@gmail.com>
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I521ebefa49297026b02554629b1710a232148e01

show more ...

Merge changes from topic "st-format-signedness" into integration

* changes:
feat(stm32mp1): enable format-signedness warning
fix(stm32mp1): correct types in messages
fix(st-pmic): correct verb

Merge changes from topic "st-format-signedness" into integration

* changes:
feat(stm32mp1): enable format-signedness warning
fix(stm32mp1): correct types in messages
fix(st-pmic): correct verbose message
fix(st-sdmmc2): correct cmd_idx type in messages
fix(st-fmc): fix type in message
fix(mtd): correct types in messages
fix(usb): correct type in message
fix(tzc400): correct message with filter
fix(psci): correct parent_node type in messages
fix(libc): correct some messages
fix(fconf): correct image_id type in messages
fix(bl2): correct messages with image_id

show more ...

fix(psci): correct parent_node type in messages

As parent_node is unsigned, we have to use %u and not %d.
This avoids warning when -Wformat-signedness is enabled.

Signed-off-by: Yann Gautier <yann.

fix(psci): correct parent_node type in messages

As parent_node is unsigned, we have to use %u and not %d.
This avoids warning when -Wformat-signedness is enabled.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I5ab7acb33227d720b2c8a4ec013435442b219a44

show more ...

Merge "Increase type widths to satisfy width requirements" into integration

Increase type widths to satisfy width requirements

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
T

Increase type widths to satisfy width requirements

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
This resolves the following required rule:

bl1/aarch64/bl1_context_mgmt.c:81:[MISRA C-2012 Rule 10.7 (required)]<None>
The width of the composite expression "0U | ((mode & 3U) << 2U) | 1U |
0x3c0U" (32 bits) is less that the right hand operand
"18446744073709547519ULL" (64 bits).

This also resolves MISRA defects such as:

bl2/aarch64/bl2arch_setup.c:18:[MISRA C-2012 Rule 12.2 (required)]
In the expression "3U << 20", shifting more than 7 bits, the number
of bits in the essential type of the left expression, "3U", is
not allowed.

Further, MISRA requires that all shifts don't overflow. The definition of
PAGE_SIZE was (1U << 12), and 1U is 8 bits. This caused about 50 issues.
This fixes the violation by changing the definition to 1UL << 12. Since
this uses 32bits, it should not create any issues for aarch32.

This patch also contains a fix for a build failure in the sun50i_a64
platform. Specifically, these misra fixes removed a single and
instruction,

92407e73 and x19, x19, #0xffffffff

from the cm_setup_context function caused a relocation in
psci_cpus_on_start to require a linker-generated stub. This increased the
size of the .text section and caused an alignment later on to go over a
page boundary and round up to the end of RAM before placing the .data
section. This sectionn is of non-zero size and therefore causes a link
error.

The fix included in this reorders the functions during link time
without changing their ording with respect to alignment.

Change-Id: I76b4b662c3d262296728a8b9aab7a33b02087f16
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

Merge "psci: utility api to invoke stop for other cores" into integration