spm-mm: Refactor secure_partition.h and its contents

Before adding any new SPM-related components we should first do
some cleanup around the existing SPM-MM implementation. The aim
is to make sure t

spm-mm: Refactor secure_partition.h and its contents

Before adding any new SPM-related components we should first do
some cleanup around the existing SPM-MM implementation. The aim
is to make sure that any SPM-MM components have names that clearly
indicate that they are MM-related. Otherwise, when adding new SPM
code, it could quickly become confusing as it would be unclear to
which component the code belongs.

The secure_partition.h header is a clear example of this, as the
name is generic so it could easily apply to any SPM-related code,
when it is in fact SPM-MM specific.

This patch renames the file and the two structures defined within
it, and then modifies any references in files that use the header.

Change-Id: I44bd95fab774c358178b3e81262a16da500fda26
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

show more ...

spm: Remove SPM Alpha 1 prototype and support files

The Secure Partition Manager (SPM) prototype implementation is
being removed. This is preparatory work for putting in place a
dispatcher component

spm: Remove SPM Alpha 1 prototype and support files

The Secure Partition Manager (SPM) prototype implementation is
being removed. This is preparatory work for putting in place a
dispatcher component that, in turn, enables partition managers
at S-EL2 / S-EL1.

This patch removes:

- The core service files (std_svc/spm)
- The Resource Descriptor headers (include/services)
- SPRT protocol support and service definitions
- SPCI protocol support and service definitions

Change-Id: Iaade6f6422eaf9a71187b1e2a4dffd7fb8766426
Signed-off-by: Paul Beesley <paul.beesley@arm.com>
Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>

show more ...

Remove dependency between SPM_MM and ENABLE_SPM build flags

There are two different implementations of Secure Partition
management in TF-A. One is based on the "Management Mode" (MM)
design, the oth

Remove dependency between SPM_MM and ENABLE_SPM build flags

There are two different implementations of Secure Partition
management in TF-A. One is based on the "Management Mode" (MM)
design, the other is based on the Secure Partition Client Interface
(SPCI) specification. Currently there is a dependency between their
build flags that shouldn't exist, making further development
harder than it should be. This patch removes that
dependency, making the two flags function independently.

Before: ENABLE_SPM=1 is required for using either implementation.
By default, the SPCI-based implementation is enabled and
this is overridden if SPM_MM=1.

After: ENABLE_SPM=1 enables the SPCI-based implementation.
SPM_MM=1 enables the MM-based implementation.
The two build flags are mutually exclusive.

Note that the name of the ENABLE_SPM flag remains a bit
ambiguous - this will be improved in a subsequent patch. For this
patch the intention was to leave the name as-is so that it is
easier to track the changes that were made.

Change-Id: I8e64ee545d811c7000f27e8dc8ebb977d670608a
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

show more ...

debugfs: add SMC channel

Provide an SMC interface to the 9p filesystem. This permits
accessing firmware drivers through a common interface, using
standardized read/write/control operations.

Signed-

debugfs: add SMC channel

Provide an SMC interface to the 9p filesystem. This permits
accessing firmware drivers through a common interface, using
standardized read/write/control operations.

Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I9314662314bb060f6bc02714476574da158b2a7d

show more ...

arm: Fix current RECLAIM_INIT_CODE behavior

Previously the .init section was created even when the reclaim flag was
manually set to 0.

Change-Id: Ia9e7c7997261f54a4eca725d7ea605192f60bcf8
Signed-of

arm: Fix current RECLAIM_INIT_CODE behavior

Previously the .init section was created even when the reclaim flag was
manually set to 0.

Change-Id: Ia9e7c7997261f54a4eca725d7ea605192f60bcf8
Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
Zelalem Aweke <zelalem.aweke@arm.com>

show more ...

Merge "Fix multithreaded FVP power domain tree" into integration

GIC-600: Fix include ordering according to the coding style

Change-Id: Ia120bcaacea3a462ab78db13f84ed23493033601
Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>

Merge changes from topic "lm/improve_memory_layout" into integration

* changes:
DOC: Update ROMLIB page with memory impact info
ROMLIB: Optimize memory layout when ROMLIB is used

ROMLIB: Optimize memory layout when ROMLIB is used

ROMLIB extract functions code from BL images to put them inside ROM.
This has for effect to reduce the size of the BL images.

This patch take this

ROMLIB: Optimize memory layout when ROMLIB is used

ROMLIB extract functions code from BL images to put them inside ROM.
This has for effect to reduce the size of the BL images.

This patch take this size reduction into consideration to optimize the
memory layout of BL2.
A new "PLAT_ARM_BL2_ROMLIB_OPTIMIZATION" macro is defined and used to
reduce "PLAT_ARM_MAX_BL2_SIZE". This allows to remove the gap between
BL1 and BL2 when ROMLIB is used and provides more room for BL31.

The current memory gain is 0x6000 for fvp and 0x8000 for juno.

Change-Id: I71c2c2c63b57bce5b22a125efaefc486ff3e87be
Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>

show more ...

Fix multithreaded FVP power domain tree

The number of levels in the topology has not changed but the count of
processing elements on the lowest layer is now multiplied by the value
of FVP_MAX_PE_PER

Fix multithreaded FVP power domain tree

The number of levels in the topology has not changed but the count of
processing elements on the lowest layer is now multiplied by the value
of FVP_MAX_PE_PER_CPU.

Signed-off-by: Imre Kis <imre.kis@arm.com>
Change-Id: Ia1568a40ea33dbbbcdfab6c8ab6d19f4db0b8eb4

show more ...

Merge "plat/arm: Re-enable PIE when RESET_TO_BL31=1" into integration

n1sdp: setup multichip gic routing table

N1SDP supports multichip configuration wherein n1sdp boards are
connected over high speed coherent CCIX link, for now only dual-chip
is supported.

Whether o

n1sdp: setup multichip gic routing table

N1SDP supports multichip configuration wherein n1sdp boards are
connected over high speed coherent CCIX link, for now only dual-chip
is supported.

Whether or not multiple chips are present is dynamically probed by
SCP firmware and passed on to TF-A, routing table will be set up
only if multiple chips are present.

Initialize GIC-600 multichip operation by overriding the default GICR
frames with array of GICR frames and setting the chip 0 as routing
table owner.

Change-Id: Ida35672be4bbf4c517469a5b330548d75e593ff2
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>

show more ...

plat/arm: Re-enable PIE when RESET_TO_BL31=1

Earlier PIE support was enabled for all arm platforms when
RESET_TO_BL31=1, but later on it was restricted only to FVP with patch
SHA d4580d17 because of

plat/arm: Re-enable PIE when RESET_TO_BL31=1

Earlier PIE support was enabled for all arm platforms when
RESET_TO_BL31=1, but later on it was restricted only to FVP with patch
SHA d4580d17 because of n1sdp platform.

Now it has been verified that PIE does work for n1sdp platform also, so
enabling it again for all arm platforms.

Change-Id: I05ad4f1775ef72e7cb578ec9245cde3fbce971a5
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>

show more ...

n1sdp: update platform macros for dual-chip setup

N1SDP supports multichip configuration wherein n1sdp boards are
connected over high speed coherent CCIX link for now only dual-chip is
supported.

n1sdp: update platform macros for dual-chip setup

N1SDP supports multichip configuration wherein n1sdp boards are
connected over high speed coherent CCIX link for now only dual-chip is
supported.

A single instance of TF-A runs on master chip which should be aware of
slave chip's CPU and memory topology.

This patch updates platform macros to include remote chip's information
and also ensures that a single version of firmware works for both single
and dual-chip setup.

Change-Id: I75799fd46dc10527aa99585226099d836c21da70
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>

show more ...

n1sdp: introduce platform information SDS region

Platform information structure holds information about platform's DDR
size(local/remote) which will be used to zero out the memory before
enabling th

n1sdp: introduce platform information SDS region

Platform information structure holds information about platform's DDR
size(local/remote) which will be used to zero out the memory before
enabling the ECC capability as well as information about multichip
setup. Multichip and remote DDR information can only be probed in SCP,
SDS region will be used by TF-A to get this information at boot up.

This patch introduces a new SDS to store platform information, which is
populated dynamically by SCP Firmware.previously used mem_info SDS is
also made part of this structure itself.

The platform information is also passed to BL33 by copying it to Non-
Secure SRAM.

Change-Id: I4781dc6a7232c3c0a3219b164d943ce9e3e469ee
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>

show more ...

Introducing support for Cortex-A65AE

Change-Id: I1ea2bf088f1e001cdbd377cbfb7c6a2866af0422
Signed-off-by: Imre Kis <imre.kis@arm.com>

Merge "a5ds: Add handler for when user tries to switch off secondary cores" into integration

a5ds: Add handler for when user tries to switch off secondary cores

a5ds only has always-on power domain and there is no power control
present. However, without the pwr_domain_off handler, the kerne

a5ds: Add handler for when user tries to switch off secondary cores

a5ds only has always-on power domain and there is no power control
present. However, without the pwr_domain_off handler, the kernel
panics when the user will try to switch off secondary cores. The
a5ds_pwr_domain_off handler will prevent kernel from crashing,
i.e. the kernel will attempt but fail to shut down the secondary CPUs
if the user tries to switch them offline.

Change-Id: I3c2239a1b6f035113ddbdda063c8495000cbe30c
Signed-off-by: Usama Arif <usama.arif@arm.com>

show more ...

Introducing support for Cortex-A65

Change-Id: I645442d52a295706948e2cac88c36c1a3cb0bc47
Signed-off-by: Imre Kis <imre.kis@arm.com>

Cortex_hercules: Add support for Hercules-AE

Not tested on FVP Model.

Change-Id: Iedebc5c1fbc7ea577e94142b7feafa5546f1f4f9
Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>

Merge changes from topic "a5ds-multicore" into integration

* changes:
a5ds: add multicore support
a5ds: Hold the secondary cpus in pen rather than panic

Merge changes from topic "mp/giv3-discovery" into integration

* changes:
Migrate ARM platforms to use the new GICv3 API
Adding new optional PSCI hook pwr_domain_on_finish_late
GICv3: Enable mu

Merge changes from topic "mp/giv3-discovery" into integration

* changes:
Migrate ARM platforms to use the new GICv3 API
Adding new optional PSCI hook pwr_domain_on_finish_late
GICv3: Enable multi socket GIC redistributor frame discovery

show more ...

Migrate ARM platforms to use the new GICv3 API

This patch invokes the new function gicv3_rdistif_probe() in the
ARM platform specific gicv3 driver. Since this API modifies the
shared GIC related dat

Migrate ARM platforms to use the new GICv3 API

This patch invokes the new function gicv3_rdistif_probe() in the
ARM platform specific gicv3 driver. Since this API modifies the
shared GIC related data structure, it must be invoked coherently
by using the platform specific pwr_domain_on_finish_late hook.

Change-Id: I6efb17d5da61545a1c5a6641b8f58472b31e62a8
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

FVP: Fix plat_set_nv_ctr() function

The Fast Models provide a non-volatile counter component, which is used
in the Trusted Board Boot implementation to protect against rollback
attacks.

This compon

FVP: Fix plat_set_nv_ctr() function

The Fast Models provide a non-volatile counter component, which is used
in the Trusted Board Boot implementation to protect against rollback
attacks.

This component comes in 2 versions (see [1]).

- Version 0 is the default and models a locked non-volatile counter,
whose value is fixed.

- Version 1 of the counter may be incremented in a monotonic fashion.

plat_set_nv_ctr() must cope with both versions. This is achieved by:
1) Attempting to write the new value in the counter.
2) Reading the value back.
3) If there is a mismatch, we know the counter upgrade failed.

When using version 0 of the counter, no upgrade is possible so the
function is expected to fail all the time. However, the code is
missing a compiler barrier between the write operation and the next
read. Thus, the compiler may optimize and remove the read operation on
the basis that the counter value has not changed. With the default
optimization level used in TF-A (-Os), this is what's happening.

The fix introduced in this patch marks the write and subsequent read
accesses to the counter as volatile, such that the compiler makes no
assumption about the value of the counter.

Note that the comment above plat_set_nv_ctr() was clearly stating
that when using the read-only version of the non-volatile counter,
"we expect the values in the certificates to always match the RO
values so that this function is never called". However, the fact that
the counter value was read back seems to contradict this comment, as
it is implementing a counter-measure against misuse of the
function. The comment has been reworded to avoid any confusion.

Without this patch, this bug may be demonstrated on the Base AEM FVP:
- Using version 0 of the non-volatile counter (default version).
- With certificates embedding a revision number value of 32
(compiling TF-A with TFW_NVCTR_VAL=32).

In this configuration, the non-volatile counter is tied to value 31 by
default. When BL1 loads the Trusted Boot Firmware certificate, it
notices that the two values do not match and tries to upgrade the
non-volatile counter. This write operation is expected to fail
(because the counter is locked) and the function is expected to return
an error but it succeeds instead.

As a result, the trusted boot does not abort as soon as it should and
incorrectly boots BL2. The boot is finally aborted when BL2 verifies
the BL31 image and figures out that the version of the SoC Firmware
Key Certificate does not match. On Arm platforms, only certificates
signed with the Root-of-Trust Key may trigger an upgrade of the
non-volatile Trusted counter.

[1] https://developer.arm.com/docs/100964/1160/fast-models-components/peripheral-components/nonvolatilecounter

Change-Id: I9979f29c23b47b338b9b484013d1fb86c59db92f
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

show more ...

a5ds: add multicore support

Enable cores 1-3 using psci. On receiving the smc call from kernel,
core 0 will bring the secondary cores out pen and signal an event for
the cores. Currently on switchin

a5ds: add multicore support

Enable cores 1-3 using psci. On receiving the smc call from kernel,
core 0 will bring the secondary cores out pen and signal an event for
the cores. Currently on switching the cores is enabled i.e. it is not
possible to suspend, switch cores off, etc.

Change-Id: I6087e1d2ec650e1d587fd543efc1b08cbb50ae5f
Signed-off-by: Usama Arif <usama.arif@arm.com>

show more ...