Merge "feat(el3-spmc): allow physical partitions to have multiple UUIDs" into integration

feat(el3-spmc): allow physical partitions to have multiple UUIDs

Physical partitions can now be assigned multiple UUIDs. This updates
- FFA_PARTITION_INFO_GET handling to return all the required

feat(el3-spmc): allow physical partitions to have multiple UUIDs

Physical partitions can now be assigned multiple UUIDs. This updates
- FFA_PARTITION_INFO_GET handling to return all the required
parttion descriptors
- device tree parsing to read multiple UUIDs

Change-Id: Ib9a961130aace75ba31b6610873138f35d355f09
Signed-off-by: Jay Monkman <jmonkman@google.com>
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

Merge "feat(el3-spmc): update FF-A version checks" into integration

feat(el3-spmc): update FF-A version checks

Fixed several version checks that failed with FF-A 1.2.

Change-Id: Idb37795e25eaa6f38ac4f065f68f8c8183cd26ea
Signed-off-by: Jay Monkman <jmonkman@google.c

feat(el3-spmc): update FF-A version checks

Fixed several version checks that failed with FF-A 1.2.

Change-Id: Idb37795e25eaa6f38ac4f065f68f8c8183cd26ea
Signed-off-by: Jay Monkman <jmonkman@google.com>
Signed-off-by: Andrei Homescu <ahomescu@google.com>

show more ...

feat(el3-spmc): enable FFA_MEM_RETRIEVE_MEM_REQ from the hypervisor

pKVM calls this FF-A function to retrieve the descriptors
for regions donated/lent/shared by a VM with an SP.

Change-Id: I55f1d67

feat(el3-spmc): enable FFA_MEM_RETRIEVE_MEM_REQ from the hypervisor

pKVM calls this FF-A function to retrieve the descriptors
for regions donated/lent/shared by a VM with an SP.

Change-Id: I55f1d675db741bc8ddaaacae0d4d60245000fb34
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

fix(el3-spmc): validate fragment offset

Per Table 4.3 of DEN 0140 1.3ALP0, the fragment offset passed to
FFA_MEM_FRAG_RX has the following requirement:

Offset must be equal to one of the followin

fix(el3-spmc): validate fragment offset

Per Table 4.3 of DEN 0140 1.3ALP0, the fragment offset passed to
FFA_MEM_FRAG_RX has the following requirement:

Offset must be equal to one of the following:
– The number of bytes of the transaction descriptor
transmitted prior to the invocation of this
interface.
– The offset used in the previous invocation of this
interface. This allows the Sender to re-transmit
the previous fragment if the Receiver could not
receive it due to an IMPLEMENTATION DEFINED
reason.

Keep track of the last and next fragment offsets between calls
to FFA_MEM_RETRIEVE_REQ and FFA_MEM_FRAG_RX and validate the
fragment offset, returning INVALID_PARAMETERS if it doesn't match
one of the two expected values.

BREAKING CHANGE: no longer accepts invalid fragment offsets

Change-Id: If549bb62a1960e9367d14bae842cb4e289429669
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

fix(el3-spmc): do not check NS bit for fragments

We set the internal NS bit for memory transaction descriptors
after the first fragment. Skip the validation check on that NS
bit on every fragment af

fix(el3-spmc): do not check NS bit for fragments

We set the internal NS bit for memory transaction descriptors
after the first fragment. Skip the validation check on that NS
bit on every fragment after the first one, because by then
the bit will always be 1.

Change-Id: I2a9bff12ed5c3979b9d626ab33aac0115d81e2d1
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

fix(el3-spmc): set NS bit by default and clear it as needed

EL3-SPMC currently only supports sharing and lending memory
from NS to the secure world (DONATE is not supported).
That means that the NS

fix(el3-spmc): set NS bit by default and clear it as needed

EL3-SPMC currently only supports sharing and lending memory
from NS to the secure world (DONATE is not supported).
That means that the NS bit should always be set,
except for a few cases:
* The operation is a LEND (NS->S), or
* The NS bit is not supported, i.e., v1.0 where the bit
was not explicitly negotiated.

Change-Id: I00966a552906ebbe2675b4352afe5e85387e5775
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

Merge "fix(cm): deprecate use of NS_TIMER_SWITCH" into integration

Merge changes from topic "ja/ffa_v1_3" into integration

* changes:
feat(tc): bump SPMC version to FF-A v1.3 TC platform
feat(fvp): bump the SPMC version
feat(ff-a): bump SPMD FF-A version

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view availa

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view available for EL1 timer registers. So it is
unreasonable for secure world to use non-secure EL1 physical timer
registers. Moreover, the non-secure operating system (Linux in our case)
relies heavily on these EL1 physical timer registers for scheduling
decisions. If NS_TIMER_SWITCH is enabled, it simply breaks the preemption
model of the non-secure world by disabling non-secure timer interrupts
leading to RCU stalls being observed on long running secure world tasks.

The only arch timer register which will benefit from context management
is cntkctl_el1: Counter-timer Kernel Control Register. This enables the
secure and non-secure worlds to independently control accesses to EL0
for counter-timer registers. This is something that OP-TEE uses to
enable ftrace feature for Trusted Applications and SPM_MM uses for EL0
access as well.

Lets enable context management of cntkctl_el1 by default and deprecate
conditional context management of non-secure EL1 physical timer
registers for whom there isn't any upstream user. With that deprecate
this NS_TIMER_SWITCH build option which just adds confusion for the
platform maintainers. It will be eventually dropped following
deprecation policy of TF-A.

Reported-by: Stauffer Thomas MTANA <thomas.stauffer@mt.com>
Reported-by: Andrew Davis <afd@ti.com>
Change-Id: Ifb3a919dc0bf8c05c38895352de5fe94b4f4387e
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

fix(el3-spmc): update event log related include

This header provides APIs for managing an event log in a transfer list.
It was made part of LibTL, and removed in (b67e984) when we moved to
using Lib

fix(el3-spmc): update event log related include

This header provides APIs for managing an event log in a transfer list.
It was made part of LibTL, and removed in (b67e984) when we moved to
using LibEventLog as a submodule. This was missed during that update.

Change-Id: I279e23b25db40c04e9f2aae23e10ebddfe99419c
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(ff-a): bump SPMD FF-A version

The Hafnium SPM version bumped to FF-A v1.3, alongside
the TF-A SPMD.
EL3 SPMC was kept under the v1.2 version with its own
set of FFA_VERSION_SPMC_MAJOR/MINOR mac

feat(ff-a): bump SPMD FF-A version

The Hafnium SPM version bumped to FF-A v1.3, alongside
the TF-A SPMD.
EL3 SPMC was kept under the v1.2 version with its own
set of FFA_VERSION_SPMC_MAJOR/MINOR macros.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I0494738b9978ad72b3316a24d7811096c53f952b

show more ...

feat(el3-spmc): parse and report VM availability messages

Parse vm-availability-messages from the SP manifest
and report them with FFA_PARTITION_INFO_GET.

Change-Id: I3494959527644795a1a729ff3cb505

feat(el3-spmc): parse and report VM availability messages

Parse vm-availability-messages from the SP manifest
and report them with FFA_PARTITION_INFO_GET.

Change-Id: I3494959527644795a1a729ff3cb505aab1ba9e8c
Signed-off-by: Andrei Homescu <ahomescu@google.com>

show more ...

feat(el3-spmc): deliver TPM event log via hob list

Add MM_TPM_EVENT_LOG hob type and deliver tpm meaured event logs
passed via secure transfer list to secure partition with hob list in
SPMC_AT_EL3.

feat(el3-spmc): deliver TPM event log via hob list

Add MM_TPM_EVENT_LOG hob type and deliver tpm meaured event logs
passed via secure transfer list to secure partition with hob list in
SPMC_AT_EL3.

So that secure partition could get the meausred event log by TF-A.

Change-Id: I14f7f8cb8f8f54e07a13f40748ca551bcd265a51
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

feat(el3-spmc): get sp_manifest via xferlist

Since commit a852fa1d594f
("feat(arm): support boot info handoff and event log"),
the arg0 doesn't includes TOS_FW_CONFIG fdt but HW_CONFIG fdt is passed

feat(el3-spmc): get sp_manifest via xferlist

Since commit a852fa1d594f
("feat(arm): support boot info handoff and event log"),
the arg0 doesn't includes TOS_FW_CONFIG fdt but HW_CONFIG fdt is passed
via arg0 when SPMC_AT_EL3 build with TRANSFER_LIST option.

To resolve this, get TOS_FW_CONFIG (sp manifest) properly saved in
passed transfer list which saved with DT_FFA_MANIFEST tag.

Since delivered transfer list memory area is mapped
when BL31 is initialized, omit the mapping the manifest code
while initialize secure partition by spmc.

Change-Id: I3e02ca749a2b1828b171826a3829170001078d71
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that CPUs handled a pabandon
feat(psci): make pabandon support generic
refactor(psci): unify coherency exit between AArch64 and AArch32
refactor(psci): absorb psci_power_down_wfi() into common code
refactor(platforms): remove usage of psci_power_down_wfi
fix(cm): disable SPE/TRBE correctly

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page_count
to set search range and get the range having the same
permission from base_va.

This change is backward compatible with former FF-A v1.2 interface.

Links: https://developer.arm.com/documentation/den0140/latest/
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Change-Id: I5c9679c9da1126b1df65f22a803776029ab52b12

show more ...

fix(el3-spmc): fixed x8-x17 register handling for FFA 1.2

Changed spmd_smc_switch_state to return all 18 registers for 64 bit
calls, and set x8-17 to zero if necessary.

BREAKING CHANGE: Zeroes or f

fix(el3-spmc): fixed x8-x17 register handling for FFA 1.2

Changed spmd_smc_switch_state to return all 18 registers for 64 bit
calls, and set x8-17 to zero if necessary.

BREAKING CHANGE: Zeroes or forwards a different set of registers,
depending on the FF-A version of the source and destination.
E.g. a call from a v1.1 caller to a v1.2 destination will zero
out the extended registers, which is different from the old behavior
of forwarding everything to EL2 SPMC, but only x0-x7 to the EL3 SPMC.

Change-Id: Ic31755af0fbb117b0ed74565fba9decebab353c4
Signed-off-by: Jay Monkman <jmonkman@google.com>
Signed-off-by: Andrei Homescu <ahomescu@google.com>

show more ...

Merge "fix(el3-spmc): fix FF-A v1.2 version check" into integration

refactor: report features supported to secure world

Report `FFA_MEM_PERM_GET` and `FFA_MEM_PERM_SET` supported to secure
world instances.

Signed-off-by: Karl Meakin <karl.meakin@arm.com>
Change-Id:

refactor: report features supported to secure world

Report `FFA_MEM_PERM_GET` and `FFA_MEM_PERM_SET` supported to secure
world instances.

Signed-off-by: Karl Meakin <karl.meakin@arm.com>
Change-Id: I90e6b0ab601ae1142b419cacfa56109c183ab640

show more ...

fix(el3-spmc): fix FF-A v1.2 version check

The two functions spmc_validate_mtd_start() and spmc_ffa_mem_send()
check FF-A version used with an end-point to determine the expected
minimal size of the

fix(el3-spmc): fix FF-A v1.2 version check

The two functions spmc_validate_mtd_start() and spmc_ffa_mem_send()
check FF-A version used with an end-point to determine the expected
minimal size of the memory transaction descriptor. However, they haven't
been updated for FF-A 1.2. So fix the two functions to take version 1.2
and beyond into account and use the version 1.1 size for the memory
transaction.

Change-Id: I86b9092eff7c4df557ee43522c680e3bf92199ba
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Merge "fix(el3-spmc): move ERROR line inside conditional" into integration

Merge "feat(el3-spmc): use spmd_smc_switch_state after secure interrupt" into integration