plat/arm/arm_image_load: refine plat_add_sp_images_load_info

Refine the function plat_add_sp_images_load_info() by saving the
previous node and only setting its next link when the current node is
va

plat/arm/arm_image_load: refine plat_add_sp_images_load_info

Refine the function plat_add_sp_images_load_info() by saving the
previous node and only setting its next link when the current node is
valid. This can reduce the check for the next node and simply the
total logic.

Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I4061428bf49ef0c3816ac22aaeb2e50315531f88

show more ...

plat/arm/arm_image_load: fix bug of overriding the last node

The traverse flow in function plat_add_sp_images_load_info() will find
the last node in the main load info list, with its
next_load_info=

plat/arm/arm_image_load: fix bug of overriding the last node

The traverse flow in function plat_add_sp_images_load_info() will find
the last node in the main load info list, with its
next_load_info==NULL. However this node is still useful and should not
be overridden with SP node info.

The bug will cause below error on RDN2 for spmd enabled:

ERROR: Invalid NT_FW_CONFIG DTB passed

Fix the bug by only setting the next_load_info of the last node in the
original main node list.

Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: Icaee5da1f2d53b29fdd6085a8cc507446186fd57

show more ...

plat/arm: Remove ARM_LINUX_KERNEL_AS_BL33 relying on RESET_TO_BL31

So far the ARM platform Makefile would require that RESET_TO_BL31 is set
when we ask for the ARM_LINUX_KERNEL_AS_BL33 feature.
Ther

plat/arm: Remove ARM_LINUX_KERNEL_AS_BL33 relying on RESET_TO_BL31

So far the ARM platform Makefile would require that RESET_TO_BL31 is set
when we ask for the ARM_LINUX_KERNEL_AS_BL33 feature.
There is no real technical reason for that, and the one place in the
code where this was needed has been fixed.

Remove the requirement of those two options to be always enabled
together.
This enables the direct kernel boot feature for the Foundation FVP
(as described in the documentation), which requires a BL1/FIP
combination to boot, so cannot use RESET_TO_BL31.

Change-Id: I6814797b6431b6614d684bab3c5830bfd9481851
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

plat/arm: Always allow ARM_LINUX_KERNEL_AS_BL33

At the moment we have the somewhat artifical limitation of
ARM_LINUX_KERNEL_AS_BL33 only being used together with RESET_TO_BL31.

However there does n

plat/arm: Always allow ARM_LINUX_KERNEL_AS_BL33

At the moment we have the somewhat artifical limitation of
ARM_LINUX_KERNEL_AS_BL33 only being used together with RESET_TO_BL31.

However there does not seem to be a good technical reason for that,
it was probably just to differentate between two different boot flows.

Move the initial register setup for ARM_LINUX_KERNEL_AS_BL33 out of the
RESET_TO_BL31 #ifdef, so that we initialise the registers in any case.

This allows to use a preloaded kernel image when using BL1 and FIP.

Change-Id: I832df272d3829f077661f4ee6d3dd9a276a0118f
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge "Use constant stack size with RECLAIM_INIT_CODE" into integration

Use constant stack size with RECLAIM_INIT_CODE

Currently, when RECLAIM_INIT_CODE is set, the
stacks are scaled to ensure that the entirety
of the init section can be reclaimed as stack.

This causes

Use constant stack size with RECLAIM_INIT_CODE

Currently, when RECLAIM_INIT_CODE is set, the
stacks are scaled to ensure that the entirety
of the init section can be reclaimed as stack.

This causes an issue in lib/psci/aarch64/psci_helpers.S,
where the stack size is used for cache operations in
psci_do_pwrdown_cache_maintenance(). If the stacks
are scaled, then the PSCI code may fail to invalidate
some of the stack memory before power down.

Resizing stacks is also not good for stability in general,
since code that works with a small number of cores may
overflow the stack when the number of cores is increased.

Change to make every stack be PLATFORM_STACK_SIZE big,
and allow the total stack to be smaller than the
init section.

Any pages of the init section not reclaimed as
stack will be set to read-only and execute-never,
for security.

Change-Id: I10b3884981006431f2fcbec3864c81d4a8c246e8
Signed-off-by: David Horstmann <david.horstmann@arm.com>

show more ...

Merge "Increase type widths to satisfy width requirements" into integration

Increase type widths to satisfy width requirements

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
T

Increase type widths to satisfy width requirements

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
This resolves the following required rule:

bl1/aarch64/bl1_context_mgmt.c:81:[MISRA C-2012 Rule 10.7 (required)]<None>
The width of the composite expression "0U | ((mode & 3U) << 2U) | 1U |
0x3c0U" (32 bits) is less that the right hand operand
"18446744073709547519ULL" (64 bits).

This also resolves MISRA defects such as:

bl2/aarch64/bl2arch_setup.c:18:[MISRA C-2012 Rule 12.2 (required)]
In the expression "3U << 20", shifting more than 7 bits, the number
of bits in the essential type of the left expression, "3U", is
not allowed.

Further, MISRA requires that all shifts don't overflow. The definition of
PAGE_SIZE was (1U << 12), and 1U is 8 bits. This caused about 50 issues.
This fixes the violation by changing the definition to 1UL << 12. Since
this uses 32bits, it should not create any issues for aarch32.

This patch also contains a fix for a build failure in the sun50i_a64
platform. Specifically, these misra fixes removed a single and
instruction,

92407e73 and x19, x19, #0xffffffff

from the cm_setup_context function caused a relocation in
psci_cpus_on_start to require a linker-generated stub. This increased the
size of the .text section and caused an alignment later on to go over a
page boundary and round up to the end of RAM before placing the .data
section. This sectionn is of non-zero size and therefore causes a link
error.

The fix included in this reorders the functions during link time
without changing their ording with respect to alignment.

Change-Id: I76b4b662c3d262296728a8b9aab7a33b02087f16
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

Don't return error information from console_flush

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return typ

Don't return error information from console_flush

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return type to void does not
work around the MISRA violation that this causes. Instead, we collect
the error information from the driver (to avoid changing that API), and
don't return it to the caller.

Change-Id: I1e35afe01764d5c8f0efd04f8949d333ffb688c1
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...

Merge "plat/arm: Introduce and use libc_asm.mk makefile" into integration

Merge changes from topic "ehf_common" into integration

* changes:
plat: tegra: Use generic ehf defines
ehf: use common priority level enumuration

lib: fconf: Implement a parser to populate CoT

Implemented a parser which populates the properties of
the CoT descriptors as per the binding document [1].
'COT_DESC_IN_DTB' build option is disabled

lib: fconf: Implement a parser to populate CoT

Implemented a parser which populates the properties of
the CoT descriptors as per the binding document [1].
'COT_DESC_IN_DTB' build option is disabled by default and can
be enabled in future for all Arm platforms by making necessary
changes in the memory map.
Currently, this parser is tested only for FVP platform.

[1]:
https://trustedfirmware-a.readthedocs.io/en/latest/components/cot-binding.html

Change-Id: I2f911206087a1a2942aa728de151d2ac269d27cc
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge "SPM: Get rid of uint32_t array representation of UUID" into integration

SPM: Get rid of uint32_t array representation of UUID

UUID's in the device tree files were stored in little endian. So
to keep all entries in these files RFC 4122 compliant, store them in
big endian

SPM: Get rid of uint32_t array representation of UUID

UUID's in the device tree files were stored in little endian. So
to keep all entries in these files RFC 4122 compliant, store them in
big endian then convert it to little endian when they are read so they
can be used in the UUID data structure.

Signed-off-by: Ruari Phipps <ruari.phipps@arm.com>
Change-Id: I5674159b82b245104381df10a4e3291160d9b3b5

show more ...

plat/arm: Introduce and use libc_asm.mk makefile

Trace analysis of FVP_Base_AEMv8A 0.0/6063 model
running in Aarch32 mode with the build options
listed below:
TRUSTED_BOARD_BOOT=1 GENERATE_COT=1
ARM

plat/arm: Introduce and use libc_asm.mk makefile

Trace analysis of FVP_Base_AEMv8A 0.0/6063 model
running in Aarch32 mode with the build options
listed below:
TRUSTED_BOARD_BOOT=1 GENERATE_COT=1
ARM_ROTPK_LOCATION=devel_ecdsa KEY_ALG=ecdsa
ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_ecdsa.pem
shows that when auth_signature() gets called
71.99% of CPU execution time is spent in memset() function
written in C using single byte write operations,
see lib\libc\memset.c.
This patch introduces new libc_asm.mk makefile which
replaces C memset() implementation with assembler
version giving the following results:
- for Aarch32 in auth_signature() call memset() CPU time
reduced to 20.56%.
The number of CPU instructions (Inst) executed during
TF-A boot stage before start of BL33 in RELEASE builds
for different versions is presented in the tables below,
where:
- C TF-A: existing TF-A C code;
- C musl: "lightweight code" C "implementation of the
standard library for Linux-based systems"
https://git.musl-libc.org/cgit/musl/tree/src/string/memset.c
- Asm Opt: assemler version from "Arm Optimized Routines"
project
https://github.com/ARM-software/optimized-routines/blob/
master/string/arm/memset.S
- Asm Linux: assembler version from Linux kernel
https://github.com/torvalds/linux/blob/master/arch/arm/lib/memset.S
- Asm TF-A: assembler version from this patch

Aarch32:
+-----------+------+------+--------------+----------+
| Variant | Set | Size | Inst | Ratio |
+-----------+------+------+--------------+----------+
| C TF-A | T32 | 16 | 2122110003 | 1.000000 |
| C musl | T32 | 156 | 1643917668 | 0.774662 |
| Asm Opt | T32 | 84 | 1604810003 | 0.756233 |
| Asm Linux | A32 | 168 | 1566255018 | 0.738065 |
| Asm TF-A | A32 | 160 | 1525865101 | 0.719032 |
+-----------+------+------+--------------+----------+

AArch64:
+-----------+------+------------+----------+
| Variant | Size | Inst | Ratio |
+-----------+------+------------+----------+
| C TF-A | 28 | 2732497518 | 1.000000 |
| C musl | 212 | 1802999999 | 0.659836 |
| Asm TF-A | 140 | 1680260003 | 0.614917 |
+-----------+------+------------+----------+

This patch modifies 'plat\arm\common\arm_common.mk'
by overriding libc.mk makefile with libc_asm.mk and
does not effect other platforms.

Change-Id: Ie89dd0b74ba1079420733a0d76b7366ad0157c2e
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

show more ...

Merge "plat/arm: Get the base address of nv-counters from device tree" into integration

sp_min: Avoid platform security reconfiguration

In the case of Juno AArch32, platform security configuration
gets done from both BL2 and SP_MIN(BL32) components when
JUNO_AARCH32_EL3_RUNTIME and RES

sp_min: Avoid platform security reconfiguration

In the case of Juno AArch32, platform security configuration
gets done from both BL2 and SP_MIN(BL32) components when
JUNO_AARCH32_EL3_RUNTIME and RESET_TO_SP_MIN build options
are set.
Fix is provided to avoid Platform security configuration from
SP_MIN when it is already done in BL2.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I702e91dacb4cdd2d10e339ddeaea91289bef3229

show more ...

plat/arm: Get the base address of nv-counters from device tree

Using the Fconf, register base address of the various nv-counters
(currently, trusted, non-trusted nv-counters) are moved to the
device

plat/arm: Get the base address of nv-counters from device tree

Using the Fconf, register base address of the various nv-counters
(currently, trusted, non-trusted nv-counters) are moved to the
device tree and retrieved during run-time. This feature is
enabled using the build option COT_DESC_IN_DTB.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I236f532e63cea63b179f60892cb406fc05cd5830

show more ...

ehf: use common priority level enumuration

'EHF' is used by RAS, SDEI, SPM_MM common frameworks.
If platform needs to plug-in specific handlers then
'PLAT_EHF_DESC' can be used to populate platform

ehf: use common priority level enumuration

'EHF' is used by RAS, SDEI, SPM_MM common frameworks.
If platform needs to plug-in specific handlers then
'PLAT_EHF_DESC' can be used to populate platform specific
priority levels.

Signed-off-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>
Change-Id: I37af7e0e48111f87b6982604bf5c15db3e05755d

show more ...

Merge changes from topic "at_errata_fix" into integration

* changes:
doc: Update description for AT speculative workaround
lib/cpus: Report AT speculative erratum workaround
Add wrapper for AT

Merge changes from topic "at_errata_fix" into integration

* changes:
doc: Update description for AT speculative workaround
lib/cpus: Report AT speculative erratum workaround
Add wrapper for AT instruction

show more ...

Add wrapper for AT instruction

In case of AT speculative workaround applied, page table walk
is disabled for lower ELs (EL1 and EL0) in EL3.
Hence added a wrapper function which temporarily enables

Add wrapper for AT instruction

In case of AT speculative workaround applied, page table walk
is disabled for lower ELs (EL1 and EL0) in EL3.
Hence added a wrapper function which temporarily enables page
table walk to execute AT instruction for lower ELs and then
disables page table walk.

Execute AT instructions directly for lower ELs (EL1 and EL0)
assuming page table walk is enabled always when AT speculative
workaround is not applied.

Change-Id: I4ad4c0bcbb761448af257e9f72ae979473c0dde8
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

plat/arm: remove common code for soc-id feature

Removed common code for soc-id feature which is applicable
for all arm platforms.

In subsequent patches, added a platform based functions
for FVP and

plat/arm: remove common code for soc-id feature

Removed common code for soc-id feature which is applicable
for all arm platforms.

In subsequent patches, added a platform based functions
for FVP and Juno to retrieve the soc-id information.

Change-Id: Idb632a935758a6caff2ca03a6eab8f663da8a93a
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "sp_dual_signing" into integration

* changes:
SPM: Add owner field to cactus secure partitions
SPM: Alter sp_gen.mk entry depending on owner of partition
plat/arm: ena

Merge changes from topic "sp_dual_signing" into integration

* changes:
SPM: Add owner field to cactus secure partitions
SPM: Alter sp_gen.mk entry depending on owner of partition
plat/arm: enable support for Plat owned SPs

show more ...

plat/arm: enable support for Plat owned SPs

For Arm platforms SPs are loaded by parsing tb_fw_config.dts and
adding them to SP structure sequentially, which in-turn is appended to
loadable image lis

plat/arm: enable support for Plat owned SPs

For Arm platforms SPs are loaded by parsing tb_fw_config.dts and
adding them to SP structure sequentially, which in-turn is appended to
loadable image list.

With recently introduced dualroot CoT for SPs where they are owned
either by SiP or by Platform. SiP owned SPs index starts at SP_PKG1_ID
and Plat owned SPs index starts at SP_PKG5_ID. As the start index of SP
depends on the owner, there should be a mechanism to parse owner of a SP
and put it at the correct index in SP structure.

This patch adds support for parsing a new optional field "owner" and
based on it put SP details(UUID & Load-address) at the correct index in
SP structure.

Change-Id: Ibd255b60d5c45023cc7fdb10971bef6626cb560b
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>

show more ...

Prevent colliding identifiers

There was a collision between the name of the typedef in the CASSERT and
something else, so we make the name of the typedef unique to the
invocation of DEFFINE_SVC_UUID

Prevent colliding identifiers

There was a collision between the name of the typedef in the CASSERT and
something else, so we make the name of the typedef unique to the
invocation of DEFFINE_SVC_UUID2 by appending the name that's passed into
the macro. This eliminates the following MISRA violation:

bl1/bl1_main.c:233:[MISRA C-2012 Rule 5.6 (required)] Identifier
"invalid_svc_uuid" is already used to represent a typedef.

This also resolves MISRA rule 5.9.

These renamings are as follows:
* tzram -> secram. This matches the function call name as it has
sec_mem in it's name
* fw_config_base -> config_base. This file does not mess with
hw_conig, so there's little chance of confusion

Change-Id: I8734ba0956140c8e29b89d0596d10d61a6ef351e
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...