Merge "feat(el3-spmc): allow physical partitions to have multiple UUIDs" into integration

feat(el3-spmc): allow physical partitions to have multiple UUIDs

Physical partitions can now be assigned multiple UUIDs. This updates
- FFA_PARTITION_INFO_GET handling to return all the required

feat(el3-spmc): allow physical partitions to have multiple UUIDs

Physical partitions can now be assigned multiple UUIDs. This updates
- FFA_PARTITION_INFO_GET handling to return all the required
parttion descriptors
- device tree parsing to read multiple UUIDs

Change-Id: Ib9a961130aace75ba31b6610873138f35d355f09
Signed-off-by: Jay Monkman <jmonkman@google.com>
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

Merge "feat(el3-spmc): update FF-A version checks" into integration

feat(el3-spmc): update FF-A version checks

Fixed several version checks that failed with FF-A 1.2.

Change-Id: Idb37795e25eaa6f38ac4f065f68f8c8183cd26ea
Signed-off-by: Jay Monkman <jmonkman@google.c

feat(el3-spmc): update FF-A version checks

Fixed several version checks that failed with FF-A 1.2.

Change-Id: Idb37795e25eaa6f38ac4f065f68f8c8183cd26ea
Signed-off-by: Jay Monkman <jmonkman@google.com>
Signed-off-by: Andrei Homescu <ahomescu@google.com>

show more ...

feat(el3-spmc): enable FFA_MEM_RETRIEVE_MEM_REQ from the hypervisor

pKVM calls this FF-A function to retrieve the descriptors
for regions donated/lent/shared by a VM with an SP.

Change-Id: I55f1d67

feat(el3-spmc): enable FFA_MEM_RETRIEVE_MEM_REQ from the hypervisor

pKVM calls this FF-A function to retrieve the descriptors
for regions donated/lent/shared by a VM with an SP.

Change-Id: I55f1d675db741bc8ddaaacae0d4d60245000fb34
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

fix(el3-spmc): validate fragment offset

Per Table 4.3 of DEN 0140 1.3ALP0, the fragment offset passed to
FFA_MEM_FRAG_RX has the following requirement:

Offset must be equal to one of the followin

fix(el3-spmc): validate fragment offset

Per Table 4.3 of DEN 0140 1.3ALP0, the fragment offset passed to
FFA_MEM_FRAG_RX has the following requirement:

Offset must be equal to one of the following:
– The number of bytes of the transaction descriptor
transmitted prior to the invocation of this
interface.
– The offset used in the previous invocation of this
interface. This allows the Sender to re-transmit
the previous fragment if the Receiver could not
receive it due to an IMPLEMENTATION DEFINED
reason.

Keep track of the last and next fragment offsets between calls
to FFA_MEM_RETRIEVE_REQ and FFA_MEM_FRAG_RX and validate the
fragment offset, returning INVALID_PARAMETERS if it doesn't match
one of the two expected values.

BREAKING CHANGE: no longer accepts invalid fragment offsets

Change-Id: If549bb62a1960e9367d14bae842cb4e289429669
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

fix(el3-spmc): do not check NS bit for fragments

We set the internal NS bit for memory transaction descriptors
after the first fragment. Skip the validation check on that NS
bit on every fragment af

fix(el3-spmc): do not check NS bit for fragments

We set the internal NS bit for memory transaction descriptors
after the first fragment. Skip the validation check on that NS
bit on every fragment after the first one, because by then
the bit will always be 1.

Change-Id: I2a9bff12ed5c3979b9d626ab33aac0115d81e2d1
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

fix(el3-spmc): set NS bit by default and clear it as needed

EL3-SPMC currently only supports sharing and lending memory
from NS to the secure world (DONATE is not supported).
That means that the NS

fix(el3-spmc): set NS bit by default and clear it as needed

EL3-SPMC currently only supports sharing and lending memory
from NS to the secure world (DONATE is not supported).
That means that the NS bit should always be set,
except for a few cases:
* The operation is a LEND (NS->S), or
* The NS bit is not supported, i.e., v1.0 where the bit
was not explicitly negotiated.

Change-Id: I00966a552906ebbe2675b4352afe5e85387e5775
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

Merge "fix(cm): deprecate use of NS_TIMER_SWITCH" into integration

Merge changes from topic "ja/ffa_v1_3" into integration

* changes:
feat(tc): bump SPMC version to FF-A v1.3 TC platform
feat(fvp): bump the SPMC version
feat(ff-a): bump SPMD FF-A version

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view availa

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view available for EL1 timer registers. So it is
unreasonable for secure world to use non-secure EL1 physical timer
registers. Moreover, the non-secure operating system (Linux in our case)
relies heavily on these EL1 physical timer registers for scheduling
decisions. If NS_TIMER_SWITCH is enabled, it simply breaks the preemption
model of the non-secure world by disabling non-secure timer interrupts
leading to RCU stalls being observed on long running secure world tasks.

The only arch timer register which will benefit from context management
is cntkctl_el1: Counter-timer Kernel Control Register. This enables the
secure and non-secure worlds to independently control accesses to EL0
for counter-timer registers. This is something that OP-TEE uses to
enable ftrace feature for Trusted Applications and SPM_MM uses for EL0
access as well.

Lets enable context management of cntkctl_el1 by default and deprecate
conditional context management of non-secure EL1 physical timer
registers for whom there isn't any upstream user. With that deprecate
this NS_TIMER_SWITCH build option which just adds confusion for the
platform maintainers. It will be eventually dropped following
deprecation policy of TF-A.

Reported-by: Stauffer Thomas MTANA <thomas.stauffer@mt.com>
Reported-by: Andrew Davis <afd@ti.com>
Change-Id: Ifb3a919dc0bf8c05c38895352de5fe94b4f4387e
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

fix(el3-spmc): update event log related include

This header provides APIs for managing an event log in a transfer list.
It was made part of LibTL, and removed in (b67e984) when we moved to
using Lib

fix(el3-spmc): update event log related include

This header provides APIs for managing an event log in a transfer list.
It was made part of LibTL, and removed in (b67e984) when we moved to
using LibEventLog as a submodule. This was missed during that update.

Change-Id: I279e23b25db40c04e9f2aae23e10ebddfe99419c
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(ff-a): bump SPMD FF-A version

The Hafnium SPM version bumped to FF-A v1.3, alongside
the TF-A SPMD.
EL3 SPMC was kept under the v1.2 version with its own
set of FFA_VERSION_SPMC_MAJOR/MINOR mac

feat(ff-a): bump SPMD FF-A version

The Hafnium SPM version bumped to FF-A v1.3, alongside
the TF-A SPMD.
EL3 SPMC was kept under the v1.2 version with its own
set of FFA_VERSION_SPMC_MAJOR/MINOR macros.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I0494738b9978ad72b3316a24d7811096c53f952b

show more ...

feat(el3-spmc): parse and report VM availability messages

Parse vm-availability-messages from the SP manifest
and report them with FFA_PARTITION_INFO_GET.

Change-Id: I3494959527644795a1a729ff3cb505

feat(el3-spmc): parse and report VM availability messages

Parse vm-availability-messages from the SP manifest
and report them with FFA_PARTITION_INFO_GET.

Change-Id: I3494959527644795a1a729ff3cb505aab1ba9e8c
Signed-off-by: Andrei Homescu <ahomescu@google.com>

show more ...

feat(el3-spmc): deliver TPM event log via hob list

Add MM_TPM_EVENT_LOG hob type and deliver tpm meaured event logs
passed via secure transfer list to secure partition with hob list in
SPMC_AT_EL3.

feat(el3-spmc): deliver TPM event log via hob list

Add MM_TPM_EVENT_LOG hob type and deliver tpm meaured event logs
passed via secure transfer list to secure partition with hob list in
SPMC_AT_EL3.

So that secure partition could get the meausred event log by TF-A.

Change-Id: I14f7f8cb8f8f54e07a13f40748ca551bcd265a51
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

feat(el3-spmc): get sp_manifest via xferlist

Since commit a852fa1d594f
("feat(arm): support boot info handoff and event log"),
the arg0 doesn't includes TOS_FW_CONFIG fdt but HW_CONFIG fdt is passed

feat(el3-spmc): get sp_manifest via xferlist

Since commit a852fa1d594f
("feat(arm): support boot info handoff and event log"),
the arg0 doesn't includes TOS_FW_CONFIG fdt but HW_CONFIG fdt is passed
via arg0 when SPMC_AT_EL3 build with TRANSFER_LIST option.

To resolve this, get TOS_FW_CONFIG (sp manifest) properly saved in
passed transfer list which saved with DT_FFA_MANIFEST tag.

Since delivered transfer list memory area is mapped
when BL31 is initialized, omit the mapping the manifest code
while initialize secure partition by spmc.

Change-Id: I3e02ca749a2b1828b171826a3829170001078d71
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that CPUs handled a pabandon
feat(psci): make pabandon support generic
refactor(psci): unify coherency exit between AArch64 and AArch32
refactor(psci): absorb psci_power_down_wfi() into common code
refactor(platforms): remove usage of psci_power_down_wfi
fix(cm): disable SPE/TRBE correctly

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(spm): update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface

Update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface
correspondant to FF-A v1.3 memory management protocol's
FFA_MEM_PERM_GET interfac

feat(spm): update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface

Update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface
correspondant to FF-A v1.3 memory management protocol's
FFA_MEM_PERM_GET interface [0].

This adds one input/output parameter with page_count
to set search range and get the range having same permssion from
base_va.

This change is backward compatible.

Links: https://developer.arm.com/documentation/den0140/latest/
Change-Id: Ib1b19dd433ad018f0c39af3a9ac8dda41358fb02
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page_count
to set search range and get the range having the same
permission from base_va.

This change is backward compatible with former FF-A v1.2 interface.

Links: https://developer.arm.com/documentation/den0140/latest/
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Change-Id: I5c9679c9da1126b1df65f22a803776029ab52b12

show more ...

fix(el3-spmc): fixed x8-x17 register handling for FFA 1.2

Changed spmd_smc_switch_state to return all 18 registers for 64 bit
calls, and set x8-17 to zero if necessary.

BREAKING CHANGE: Zeroes or f

fix(el3-spmc): fixed x8-x17 register handling for FFA 1.2

Changed spmd_smc_switch_state to return all 18 registers for 64 bit
calls, and set x8-17 to zero if necessary.

BREAKING CHANGE: Zeroes or forwards a different set of registers,
depending on the FF-A version of the source and destination.
E.g. a call from a v1.1 caller to a v1.2 destination will zero
out the extended registers, which is different from the old behavior
of forwarding everything to EL2 SPMC, but only x0-x7 to the EL3 SPMC.

Change-Id: Ic31755af0fbb117b0ed74565fba9decebab353c4
Signed-off-by: Jay Monkman <jmonkman@google.com>
Signed-off-by: Andrei Homescu <ahomescu@google.com>

show more ...

feat(smccc): introduce TPM Start SMC

To support TPM start method compatible with pre-FFA configuration (to
support SPM_MM) introduce an SMC FID el3 vendor specific range. This
SMC is forwarded to SP

feat(smccc): introduce TPM Start SMC

To support TPM start method compatible with pre-FFA configuration (to
support SPM_MM) introduce an SMC FID el3 vendor specific range. This
SMC is forwarded to SPM_MM module which converts into a MM_COMMUNICATE
to interact with Secure partition.

TPM Start method is mentioned in TCG ACPI spec section 3.3.1
https://trustedcomputinggroup.org/wp-content/uploads/TCG-ACPI-Specification-Version-1.4-Revision-15_pub.pdf

As this patch introduces a new sub service, increment minor version
of Vendor EL3 service.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I61698018e6bc33c9b389ac905fe158810af21bfa

show more ...

build(handoff)!: switch to LibTL submodule

Removes in-tree Transfer List implementation and updates all references
to use the external LibTL submodule. Updates include paths, Makefile
macros, and pl

build(handoff)!: switch to LibTL submodule

Removes in-tree Transfer List implementation and updates all references
to use the external LibTL submodule. Updates include paths, Makefile
macros, and platform integration logic to link with LibTL as a static
library.

If you cloned TF-A without the `--recurse-submodules` flag, you can
ensure that this submodule is present by running:

git submodule update --init --recursive

BREAKING-CHANGE: LibTL is now included in TF-A as a submodule.
Please run `git submodule update --init --recursive` if you encounter
issues after migrating to the latest version of TF-A.

Change-Id: I1fa31f7b730066c27985d968698e553b00b07c38
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge "fix(el3-spmc): fix FF-A v1.2 version check" into integration

fix(spm-mm): prevent excessive racing

The current code does the following:

sp_state_wait_switch:
lock()
if (status == 0)
status = 1
unlock()

[critical section]

sp_state_set:
lock()
status

fix(spm-mm): prevent excessive racing

The current code does the following:

sp_state_wait_switch:
lock()
if (status == 0)
status = 1
unlock()

[critical section]

sp_state_set:
lock()
status = 0
unlock()

One core will obtain the status for itself and then all other cores will
get the lock, see the status is not available, release the lock, and try
again. However, when there are many cores this causes a lot of lock
contention and the original core is racing to obtain the lock to release
the status. This starves the holder of the lock, resulting in an
apparent deadlock, although given enough time it will pass.

Hold the lock throughout to prevent this.

Also make the functions static as they are never exported and drop
sp_state_try_switch() as its unused and would not work anymore.

Change-Id: I0861d04ed95437e4ca9f203d9e79a6296b1ead56
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...