fix(cm): deprecate use of NS_TIMER_SWITCHOn AArch64, secure world has it's own EL3 physical timer registersaccessible to secure EL1 in absence of S-EL2. With S-EL2 there isvirtualized view availa
fix(cm): deprecate use of NS_TIMER_SWITCHOn AArch64, secure world has it's own EL3 physical timer registersaccessible to secure EL1 in absence of S-EL2. With S-EL2 there isvirtualized view available for EL1 timer registers. So it isunreasonable for secure world to use non-secure EL1 physical timerregisters. Moreover, the non-secure operating system (Linux in our case)relies heavily on these EL1 physical timer registers for schedulingdecisions. If NS_TIMER_SWITCH is enabled, it simply breaks the preemptionmodel of the non-secure world by disabling non-secure timer interruptsleading to RCU stalls being observed on long running secure world tasks.The only arch timer register which will benefit from context managementis cntkctl_el1: Counter-timer Kernel Control Register. This enables thesecure and non-secure worlds to independently control accesses to EL0for counter-timer registers. This is something that OP-TEE uses toenable ftrace feature for Trusted Applications and SPM_MM uses for EL0access as well.Lets enable context management of cntkctl_el1 by default and deprecateconditional context management of non-secure EL1 physical timerregisters for whom there isn't any upstream user. With that deprecatethis NS_TIMER_SWITCH build option which just adds confusion for theplatform maintainers. It will be eventually dropped followingdeprecation policy of TF-A.Reported-by: Stauffer Thomas MTANA <thomas.stauffer@mt.com>Reported-by: Andrew Davis <afd@ti.com>Change-Id: Ifb3a919dc0bf8c05c38895352de5fe94b4f4387eSigned-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
show more ...
fix(optee): allow opteed_handle_smc_load to handle 64-bit data_paChange the datatype of data_pa to uint64_t to allowopteed_handle_smc_load to handle 64-bit data_pa from non secure.Change-Id: I90
fix(optee): allow opteed_handle_smc_load to handle 64-bit data_paChange the datatype of data_pa to uint64_t to allowopteed_handle_smc_load to handle 64-bit data_pa from non secure.Change-Id: I90d0630d23dbd97143a975f00a0f6b74b7cc0223Signed-off-by: Yidi Lin <yidilin@google.com>
feat(psci): make pabandon support genericSupport for aborted powerdowns does not require much dedicated code.Rather, it is largely a matter of orchestrating things to happen in theright order.T
feat(psci): make pabandon support genericSupport for aborted powerdowns does not require much dedicated code.Rather, it is largely a matter of orchestrating things to happen in theright order.The only exception to this are older secure world dispatchers, whichassume that a CPU_SUSPEND call will be terminal and therefore canclobber context. This was patched over in common code and hidden behinda flag. This patch moves this to the dispatchers themselves.Dispatchers that don't register svc_suspend{_finish} are unaffected.Those that do must save the NS context before clobbering it andrestoring in only in case of a pabandon. Due to this operation beingnon-trivial, this patch makes the assumption that these dispatchers willonly be present on hardware that does not support pabandon and thereforedoes not add any contexting for them. In case this assumption everchanges, asserts are added that should alert us of this change.Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0eSigned-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
build(handoff)!: switch to LibTL submoduleRemoves in-tree Transfer List implementation and updates all referencesto use the external LibTL submodule. Updates include paths, Makefilemacros, and pl
build(handoff)!: switch to LibTL submoduleRemoves in-tree Transfer List implementation and updates all referencesto use the external LibTL submodule. Updates include paths, Makefilemacros, and platform integration logic to link with LibTL as a staticlibrary.If you cloned TF-A without the `--recurse-submodules` flag, you canensure that this submodule is present by running: git submodule update --init --recursiveBREAKING-CHANGE: LibTL is now included in TF-A as a submodule. Please run `git submodule update --init --recursive` if you encounter issues after migrating to the latest version of TF-A.Change-Id: I1fa31f7b730066c27985d968698e553b00b07c38Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>
refactor(optee): guard handoff logic w/ build flagPrepare OP-TEE for environments where the Firmware Handoff (LibTL)submodule may not be available. Wrap all Transfer List dependent logicin `#if
refactor(optee): guard handoff logic w/ build flagPrepare OP-TEE for environments where the Firmware Handoff (LibTL)submodule may not be available. Wrap all Transfer List dependent logicin `#if TRANSFER_LIST` guards, ensuring OP-TEE can build and run withoutthe submodule.This is useful for platforms or builds not integrating the firmwarehandoff mechanism.Change-Id: I701e357a8ee29d37b370c98c907d3e2795a921ddSigned-off-by: Harrison Mutai <harrison.mutai@arm.com>
fix(handoff): fix register convention in opteedThe commit with Change-Id:Ie417e054a7a4c192024a2679419e99efeded1705updated the register convention r1/x1 values but missing necessarychanges in BL31
fix(handoff): fix register convention in opteedThe commit with Change-Id:Ie417e054a7a4c192024a2679419e99efeded1705updated the register convention r1/x1 values but missing necessarychanges in BL31.As a result, a system panic observed during setup for BL32 whenTRANSFER_LIST is enabled due to unexpected arguments.This patch is to fix this issue for optee.Change-Id: I13e116e7cb5a7d89fafc11d20295cffbf24793abSigned-off-by: Raymond Mao <raymond.mao@linaro.org>
feat(handoff): fix register convention r1/x1 value on transfer listAccording to recently firmware handsoff spec [1]'s "Register usage at handoffboundary", Transfer List's signature value was chang
feat(handoff): fix register convention r1/x1 value on transfer listAccording to recently firmware handsoff spec [1]'s "Register usage at handoffboundary", Transfer List's signature value was changed from 0x40_b10b(3 bytes) to 4a0f_b10b (4 bytes).As updating of TL's signature, register value of x1/r1 should be:In aarch32's r1 value should be R1[23:0]: set to the TL signature (4a0f_b10b -> masked range value: 0f_b10b) R1[31:24]: version of the register convention == 1andIn aarch64's x1 value should be X1[31:0]: set to the TL signature (4a0f_b10b) X1[39:32]: version of the register convention == 1 X1[63:40]: MBZ(See the [2] and [3]).Therefore, it requires to separate mask and shift value for registerconvention version field when sets each r1/x1.This patch fix two problems: 1. breaking X1 value with updated specification in aarch64 - change of length of signature field. 2. previous error value set in R1 in arm32. - length of signature should be 24, but it uses 32bit signature.This change is breaking change. It requires some patch for othersoftwares (u-boot[4], optee[5]).Link: https://github.com/FirmwareHandoff/firmware_handoff [1]Link: https://github.com/FirmwareHandoff/firmware_handoff/issues/32 [2]Link: https://github.com/FirmwareHandoff/firmware_handoff/commit/5aa7aa1d3a1db75213e458d392b751f0707de027 [3]Link: https://lists.denx.de/pipermail/u-boot/2024-July/558628.html [4]Link: https://github.com/OP-TEE/optee_os/pull/6933 [5]Signed-off-by: Levi Yun <yeoreum.yun@arm.com>Change-Id: Ie417e054a7a4c192024a2679419e99efeded1705
fix(optee): set interrupt handler before kernel bootWhen loading OPTEE via an SMC after we start Linux, we end up changingthe interrupt settings which is a violation of the Linux kernel'spolicies
fix(optee): set interrupt handler before kernel bootWhen loading OPTEE via an SMC after we start Linux, we end up changingthe interrupt settings which is a violation of the Linux kernel'spolicies. This change sets the interrupt handler before we proceed tostarting the kernel and ignores any incoming interrupts that occurbefore OPTEE is loaded.Signed-off-by: Jeffrey Kardatzke<jkardatzke@google.com>Change-Id: I7da5334498e14f4a703e8cc3eeff386e3ecc0882
feat(cros_widevine): add ChromeOS widevine SMC handlerThe ChromeOS will use the SMC to pass some secrets from firmware tooptee.Change-Id: Iaf3357d40a7ed22415926acd9d7979df24dd81f1Signed-off-by:
feat(cros_widevine): add ChromeOS widevine SMC handlerThe ChromeOS will use the SMC to pass some secrets from firmware tooptee.Change-Id: Iaf3357d40a7ed22415926acd9d7979df24dd81f1Signed-off-by: Yi Chou <yich@google.com>
feat(optee): enable transfer list in opteedEnable handoff to OP-TEE using transfer list.Create transfer list when loading OP-TEE image via non-secure SMC call.Fallback to default handoff args whe
feat(optee): enable transfer list in opteedEnable handoff to OP-TEE using transfer list.Create transfer list when loading OP-TEE image via non-secure SMC call.Fallback to default handoff args when transfer list is disabled ortransfer list signature does not exist.Change-Id: I94bb5b7fdfbb8829016a9d5d9ef5aff993d7cc99Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
feat(optee): add device tree for coreboot tableThis adds creation of a device tree that will be passed to OP-TEE.Currently that device tree only contains the coreboot table per theLinux coreboot
feat(optee): add device tree for coreboot tableThis adds creation of a device tree that will be passed to OP-TEE.Currently that device tree only contains the coreboot table per theLinux coreboot device tree specification. This device tree is thenpassed to OP-TEE so it can extract the CBMEM console information fromthe coreboot table for logging purposes.Signed-off-by: Jeffrey Kardatzke <jkardatzke@google.com>Change-Id: I6a26d335e16f7226018c56ad571cca77b81b0f6a
Merge "fix(optee): return UUID for image loading service" into integration
fix(optee): return UUID for image loading serviceThis adds return of a UUID when TF-A is in the state where it needs toreceive the SMC call to load the OP-TEE image. It also changes the OENused f
fix(optee): return UUID for image loading serviceThis adds return of a UUID when TF-A is in the state where it needs toreceive the SMC call to load the OP-TEE image. It also changes the OENused for the image loading call to match the OEN used for the UUID call.Signed-off-by: Jeffrey Kardatzke <jkardatzke@google.com>Change-Id: I713cb602d8e53b3f20d179b5fb5162da6a2ed057
style: remove useless trailing semicolon and line continuationsfound using checkpatch.pl[1][1]: https://review.coreboot.org/plugins/gitiles/coreboot/+/refs/heads/master/util/lint/checkpatch.plS
style: remove useless trailing semicolon and line continuationsfound using checkpatch.pl[1][1]: https://review.coreboot.org/plugins/gitiles/coreboot/+/refs/heads/master/util/lint/checkpatch.plSigned-off-by: Elyes Haouas <ehaouas@noos.fr>Change-Id: I7957c9694300fefb85d11f7819c43af95271f14c
fix(optee): address late comments and fix bad rcThere were some late comments to the prior change (18635) which areaddress in this commit. There was also an invalid return value checkwhich was ch
fix(optee): address late comments and fix bad rcThere were some late comments to the prior change (18635) which areaddress in this commit. There was also an invalid return value checkwhich was changed and the wrong result was being returned via the SMCcall for loading OP-TEE which is now fixed.Signed-off-by: Jeffrey Kardatzke <jkardatzke@google.com>Change-Id: I883ddf966662549a3ef9c801a2d4f47709422332
feat(optee): add loading OP-TEE image via an SMCThis adds the ability to load the OP-TEE image via an SMC called fromnon-secure userspace rather than loading it during boot. This shouldonly be ut
feat(optee): add loading OP-TEE image via an SMCThis adds the ability to load the OP-TEE image via an SMC called fromnon-secure userspace rather than loading it during boot. This shouldonly be utilized on platforms that can ensure security is maintained upuntil the point the SMC is invoked as it breaks the normal barrierbetween the secure and non-secure world.Signed-off-by: Jeffrey Kardatzke <jkardatzke@google.com>Change-Id: I21cfa9699617c493fa4190f01d1cbb714e7449cc
spd: opteed: enable NS_TIMER_SWITCHEnable dispatcher to save/restore unbanked timer registers. So thatboth secure (OP-TEE) and non-secure (Linux) worlds can have independentaccess control over ti
spd: opteed: enable NS_TIMER_SWITCHEnable dispatcher to save/restore unbanked timer registers. So thatboth secure (OP-TEE) and non-secure (Linux) worlds can have independentaccess control over timer registers.Signed-off-by: Sumit Garg <sumit.garg@linaro.org>Change-Id: I4d58d5ff8298587ed478c8433fcbc3aef538d668
Replace __ASSEMBLY__ with compiler-builtin __ASSEMBLER__NOTE: __ASSEMBLY__ macro is now deprecated in favor of __ASSEMBLER__.All common C compilers predefine a macro called __ASSEMBLER__ whenpre
Replace __ASSEMBLY__ with compiler-builtin __ASSEMBLER__NOTE: __ASSEMBLY__ macro is now deprecated in favor of __ASSEMBLER__.All common C compilers predefine a macro called __ASSEMBLER__ whenpreprocessing a .S file. There is no reason for TF-A to define it's own__ASSEMBLY__ macro for this purpose instead. To unify code with theexport headers (which use __ASSEMBLER__ to avoid one extra dependency),let's deprecate __ASSEMBLY__ and switch the code base over to thepredefined standard.Change-Id: Id7d0ec8cf330195da80499c68562b65cb5ab7417Signed-off-by: Julius Werner <jwerner@chromium.org>
Remove references to old project name from common filesThe project has been renamed from "Arm Trusted Firmware (ATF)" to"Trusted Firmware-A (TF-A)" long ago. A few references to the oldproject na
Remove references to old project name from common filesThe project has been renamed from "Arm Trusted Firmware (ATF)" to"Trusted Firmware-A (TF-A)" long ago. A few references to the oldproject name that still remained in various places have now beenremoved.This change doesn't affect any platform files. Any "ATF" referencesinside platform files, still remain.Change-Id: Id97895faa5b1845e851d4d50f5750de7a55bf99eSigned-off-by: John Tsichritzis <john.tsichritzis@arm.com>
Correct typographical errorsCorrects typos in core code, documentation files, drivers, Armplatforms and services.None of the corrections affect code; changes are limited to commentsand other do
Correct typographical errorsCorrects typos in core code, documentation files, drivers, Armplatforms and services.None of the corrections affect code; changes are limited to commentsand other documentation.Change-Id: I5c1027b06ef149864f315ccc0ea473e2a16bfd1dSigned-off-by: Paul Beesley <paul.beesley@arm.com>
Sanitise includes across codebaseEnforce full include path for includes. Deprecate old paths.The following folders inside include/lib have been left unchanged:- include/lib/cpus/${ARCH}- inclu
Sanitise includes across codebaseEnforce full include path for includes. Deprecate old paths.The following folders inside include/lib have been left unchanged:- include/lib/cpus/${ARCH}- include/lib/el3_runtime/${ARCH}The reason for this change is that having a global namespace forincludes isn't a good idea. It defeats one of the advantages of havingfolders and it introduces problems that are sometimes subtle (becauseyou may not know the header you are actually including if there are twoof them).For example, this patch had to be created because two headers werecalled the same way: e0ea0928d5b7 ("Fix gpio includes of mt8173 platformto avoid collision."). More recently, this patch has had similarproblems: 46f9b2c3a282 ("drivers: add tzc380 support").This problem was introduced in commit 4ecca33988b9 ("Move include andsource files to logical locations"). At that time, there weren't toomany headers so it wasn't a real issue. However, time has shown thatthis creates problems.Platforms that want to preserve the way they include headers may add theremoved paths to PLAT_INCLUDES, but this is discouraged.Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8fSigned-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Standardise header guards across codebaseAll identifiers, regardless of use, that start with two underscores arereserved. This means they can't be used in header guards.The style that this proje
Standardise header guards across codebaseAll identifiers, regardless of use, that start with two underscores arereserved. This means they can't be used in header guards.The style that this project is now to use the full name of the file incapital letters followed by 'H'. For example, for a file called"uart_example.h", the header guard is UART_EXAMPLE_H.The exceptions are files that are imported from other projects:- CryptoCell driver- dt-bindings folders- zlib headersChange-Id: I50561bf6c88b491ec440d0c8385c74650f3c106eSigned-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
opteed: pass power level on suspendSome platforms might chose to take different actions depending on thisvalue; this is precisely the case for rcar-gen3.Signed-off-by: Jorge Ramirez-Ortiz <jrami
opteed: pass power level on suspendSome platforms might chose to take different actions depending on thisvalue; this is precisely the case for rcar-gen3.Signed-off-by: Jorge Ramirez-Ortiz <jramirez@baylibre.com>
Fix some violations to MISRA rule 8.3Wherever we use 'struct foo' and 'foo_t' interchangeably in afunction's declaration and definition, use 'struct foo' consistentlyfor both, as per the TF-A cod
Fix some violations to MISRA rule 8.3Wherever we use 'struct foo' and 'foo_t' interchangeably in afunction's declaration and definition, use 'struct foo' consistentlyfor both, as per the TF-A coding guidelines [1].[1] https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Coding-Guidelines#avoid-anonymous-typedefs-of-structsenums-in-header-filesChange-Id: I7998eb24a26746e87e9b6425529926406745b721Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Fix MISRA Rule 5.7 Part 3Rule 5.7: A tag name shall be a unique identifierFollow convention of shorter names for smaller scope to fixviolations of MISRA rule 5.7Fixed For: make ARM_TSP_RAM
Fix MISRA Rule 5.7 Part 3Rule 5.7: A tag name shall be a unique identifierFollow convention of shorter names for smaller scope to fixviolations of MISRA rule 5.7Fixed For: make ARM_TSP_RAM_LOCATION=tdram LOG_LEVEL=50 PLAT=fvp SPD=opteedChange-Id: I5fbb5d6ebddf169550eddb07ed880f5c8076bb76Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
12