feat(ff-a): feature retrieval through FFA_FEATURES call

Updated FFA_FEATURES according to FF-A v1.1 in SPMC can also be used
to retrieve feature information, and should now accept other arguments
th

feat(ff-a): feature retrieval through FFA_FEATURES call

Updated FFA_FEATURES according to FF-A v1.1 in SPMC can also be used
to retrieve feature information, and should now accept other arguments
than just FF-A call IDs.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I02cc24a31ab3092ec1ce6fed1a9649ffe7136782

show more ...

fix(sdei): fix assert while kdump issue

Assert condition:
1 Register secure timer(ppi=29) for sdei nmi watchdog;
2 kernel panic and then kdump;
While kdump, kernel mask all cores sdei, secure timer

fix(sdei): fix assert while kdump issue

Assert condition:
1 Register secure timer(ppi=29) for sdei nmi watchdog;
2 kernel panic and then kdump;
While kdump, kernel mask all cores sdei, secure timer trigger
and go to handle_masked_trigger() and assert here:
assert(se->affinity == my_mpidr);

As kernel register with flag=0, mpidr=0 and TF-A set flag to
SDEI_REGF_RM_PE but leave mpidr=0. So set mpidr to fix his
assert issue.

Signed-off-by: Ming Huang <huangming@linux.alibaba.com>
Change-Id: Ia9182f40bde94fb004b46e2a72b186eb0ef05166

show more ...

feat(SPMD): route secure interrupts to SPMC

Define a handler in the SPMD to route secure interrupts occurring while
the normal world runs. On a Group1 Secure interrupt (with a GICv3 or a
Group0 inte

feat(SPMD): route secure interrupts to SPMC

Define a handler in the SPMD to route secure interrupts occurring while
the normal world runs. On a Group1 Secure interrupt (with a GICv3 or a
Group0 interrupt on GICv2), the normal world is pre-empted to EL3 and
redirected to the SPMD/SPMC for further handling.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
Change-Id: I1350d74048c5549a2af8da0ba004c08512cc006a

show more ...

fix(sdei): print event number in hex format

SDEI specified event numbers in hexadecimal format.
Change event number format to hexadecimal to make
it easier for the reader to recognize the proper eve

fix(sdei): print event number in hex format

SDEI specified event numbers in hexadecimal format.
Change event number format to hexadecimal to make
it easier for the reader to recognize the proper event.

Change-Id: Iac7a91d0910316e0ad54a8f09bc17209e8c6adf6
Signed-off-by: Vasyl Gomonovych <vgomonovych@marvell.com>

show more ...

refactor(gpt): productize and refactor GPT library

This patch updates and refactors the GPT library and fixes bugs.

- Support all combinations of PGS, PPS, and L0GPTSZ parameters.
- PPS and PGS are

refactor(gpt): productize and refactor GPT library

This patch updates and refactors the GPT library and fixes bugs.

- Support all combinations of PGS, PPS, and L0GPTSZ parameters.
- PPS and PGS are set at runtime, L0GPTSZ is read from GPCCR_EL3.
- Use compiler definitions to simplify code.
- Renaming functions to better suit intended uses.
- MMU enabled before GPT APIs called.
- Add comments to make function usage more clear in GPT library.
- Added _rme suffix to file names to differentiate better from the
GPT file system code.
- Renamed gpt_defs.h to gpt_rme_private.h to better separate private
and public code.
- Renamed gpt_core.c to gpt_rme.c to better conform to TF-A precedent.

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I4cbb23b0f81e697baa9fb23ba458aa3f7d1ed919

show more ...

feat(rme): add ENABLE_RME build option and support for RMM image

The changes include:

- A new build option (ENABLE_RME) to enable FEAT_RME

- New image called RMM. RMM is R-EL2 firmware that manage

feat(rme): add ENABLE_RME build option and support for RMM image

The changes include:

- A new build option (ENABLE_RME) to enable FEAT_RME

- New image called RMM. RMM is R-EL2 firmware that manages Realms.
When building TF-A, a path to RMM image can be specified using
the "RMM" build flag. If RMM image is not provided, TRP is built
by default and used as RMM image.

- Support for RMM image in fiptool

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I017c23ef02e465a5198baafd665a60858ecd1b25

show more ...

feat(rme): add Test Realm Payload (TRP)

TRP is a small test payload that implements Realm Monitor
Management (RMM) functionalities. RMM runs in the Realm world
(R-EL2) and manages the execution of R

feat(rme): add Test Realm Payload (TRP)

TRP is a small test payload that implements Realm Monitor
Management (RMM) functionalities. RMM runs in the Realm world
(R-EL2) and manages the execution of Realm VMs and their
interaction with the hypervisor in Normal world.

TRP is used to test the interface between RMM and Normal world
software, known as Realm Management Interface (RMI). Current
functions includes returning RMM version and transitioning
granules from Non-secure to Realm world and vice versa.

More information about RMM can be found at:
https://developer.arm.com/documentation/den0125/latest

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Ic7b9a1e1f3142ef6458d40150d0b4ba6bd723ea2

show more ...

feat(rme): add RMM dispatcher (RMMD)

This patch introduces the RMM dispatcher into BL31. This
will be the mechanism that will enable communication to
take place between the Realm and non-secure worl

feat(rme): add RMM dispatcher (RMMD)

This patch introduces the RMM dispatcher into BL31. This
will be the mechanism that will enable communication to
take place between the Realm and non-secure world. Currently
gives the capability for granules to be
transitioned from non-secure type to realm and vice versa.

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Signed-off-by: Subhasish Ghosh <subhasish.ghosh@arm.com>
Change-Id: I1fdc99a4bdd42bc14911aa0c6954b131de309511

show more ...

Merge "feat(ff-a): adding notifications SMC IDs" into integration

feat(ff-a): adding notifications SMC IDs

Defining SMC IDs for FF-A v1.1 notifications functionality, and adding
them to SPMD SMC handler, to ensure calls are forwarded to the SPMC.

Signed-off-by: J

feat(ff-a): adding notifications SMC IDs

Defining SMC IDs for FF-A v1.1 notifications functionality, and adding
them to SPMD SMC handler, to ensure calls are forwarded to the SPMC.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: Icc88aded0fd33507f7795e996bd4ff1c2fe679c8

show more ...

refactor(spmd): boot interface and pass core id

This change refactors the SPMD to setup SPMC CPU contexts once and early
from spmd_spmc_init (single call to cm_setup_context rather than on each
and

refactor(spmd): boot interface and pass core id

This change refactors the SPMD to setup SPMC CPU contexts once and early
from spmd_spmc_init (single call to cm_setup_context rather than on each
and every warm boot).
Pass the core linear ID through a GP register as an implementation
defined behavior helping FF-A adoption to legacy TOSes (essentially
when secure virtualization is not used).

A first version of this change was originally submitted by Lukas [1].
Pasting below the original justification:

Our TEE, Kinibi, is used to receive the core linear ID in the x3
register of booting secondary cores.
This patch is necessary to bring up secondary cores with Kinibi as an
SPMC in SEL1.

In Kinibi, the TEE is mostly platform-independent and all platform-
specifics like topology is concentrated in TF-A of our customers.
That is why we don't have the MPIDR - linear ID mapping in Kinibi.
We need the correct linear ID to program the GICv2 target register,
for example in power management case.
It is not needed on GICv3/v4, because of using a fixed mapping from
MPIDR to ICDIPTR/GICD_ITARGETSRn register.

For debug and power management purpose, we also want a unified view to
linear id between Linux and the TEE.
E.g. to disable a core, to see what cores are printing a trace /
an event.

In the past, Kinibi had several other designs, but the complexity was
getting out of control:
* Platform-specific assembler macros in the kernel.
* A per-core SMC from Linux to tell the linear ID after the boot.
* With DynamiQ, it seems SIPs were playing with MPIDR register values,
reusing them between cores and changing them during boot.

[1] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/10235

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Signed-off-by: Lukas Hanel <lukas.hanel@trustonic.com>
Change-Id: Ifa8fa208e9b8eb1642c80b5f7b54152dadafa75e

show more ...

services: Fix pmr_el1 rewrote issue in sdei_disaptch_event()

Consider a RAS scenario:
Enter EL3 by sync exception, then call spm_mm_sp_call() enter
EL0s to handle this error, then call sdei_dispatch

services: Fix pmr_el1 rewrote issue in sdei_disaptch_event()

Consider a RAS scenario:
Enter EL3 by sync exception, then call spm_mm_sp_call() enter
EL0s to handle this error, then call sdei_dispatch_event() to
inform OS. Finally, return back to OS from sync exception flow.
Similar flow is sgi_ras_intr_handler() in sgi_ras.c.

The icc_pmr_el1 register will be change in above flow:
1 cm_el1_sysregs_context_save(NON_SECURE);
-> ehf_exited_normal_world();
##icc_pmr_el1: 0xf8 => 0x80
2 spm_mm_sp_call();
3 sdei_dispatch_event();
4 ehf_activate_priority(sdei_event_priority(map));
##icc_pmr_el1: 0x80 => 0x60
5 restore_and_resume_ns_context();
-> ehf_exited_normal_world();
##return due to has_valid_pri_activations(pe_data) == 1
6 ehf_deactivate_priority(sdei_event_priority(map));
##icc_pmr_el1: 0x60 => 0x80
The icc_pmr_el1 was rewrote from 0xf8 to 0x80. This issue will
result in OS hang when eret to OS from RAS flow.

Move ehf_activate_priority(sdei_event_priority(map)) after
restore_and_resume_ns_context() can fix this issue.

Signed-off-by: Ming Huang <huangming@linux.alibaba.com>
Change-Id: If01ec55cf0aabf1594dece1ad50d3ec3406cdabc

show more ...

fix(sdei): set SPSR for SDEI based on TakeException

The SDEI specification now says that during an SDEI
event handler dispatch the SPSR should be set according
to the TakeException() pseudocode func

fix(sdei): set SPSR for SDEI based on TakeException

The SDEI specification now says that during an SDEI
event handler dispatch the SPSR should be set according
to the TakeException() pseudocode function defined in
the Arm Architecture Reference Manual. This patch sets
the SPSR according to the function given in
ARM DDI 0487F.c page J1-7635

Change-Id: Id2f8f2464fd69c701d81626162827e5c4449b658
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

show more ...

Merge "feat(spmd): add support for FFA_SPM_ID_GET" into integration

perf(spmd): omit sel1 context save if sel2 present

The SPMC at S-EL2 manages S-EL1 execution contexts for SPs. The
currently running SP vCPU state is always saved when the SPMC exits to
SPMD. A fres

perf(spmd): omit sel1 context save if sel2 present

The SPMC at S-EL2 manages S-EL1 execution contexts for SPs. The
currently running SP vCPU state is always saved when the SPMC exits to
SPMD. A fresh vCPU context is always restored when the SPMC is entered
from the SPMD and a SP resumed. For performance optimization reasons
this permits omitting the saving/restoring of the S-EL1 context from
within the EL3 SPMD on entering/exiting the SPMC. The S-EL2 SPMC and
NS-EL1 context save/restore remain done in the SPMD.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I66413ed5983913791ff5c9fc03c590ee65c6ccd7

show more ...

Merge changes from topic "Arm_PCI_Config_Space_Interface" into integration

* changes:
TF-A: Document SMC_PCI_SUPPORT option
SMCCC/PCI: Handle std svc boilerplate
SMCCC/PCI: Add initial PCI con

Merge changes from topic "Arm_PCI_Config_Space_Interface" into integration

* changes:
TF-A: Document SMC_PCI_SUPPORT option
SMCCC/PCI: Handle std svc boilerplate
SMCCC/PCI: Add initial PCI conduit definitions
SMCCC: Hoist SMC_32 sanitization

show more ...

SMCCC/PCI: Handle std svc boilerplate

Add SMC wrappers for handshaking the existence
and basic parameter validation for the SMCCC/PCI
API. The actual read/write/segment validation is
implemented by

SMCCC/PCI: Handle std svc boilerplate

Add SMC wrappers for handshaking the existence
and basic parameter validation for the SMCCC/PCI
API. The actual read/write/segment validation is
implemented by a given platform which will enable
the API by defining SMC_PCI_SUPPORT.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Change-Id: I4485ad0fe6003cec6f5eedef688914d100513c21

show more ...

SMCCC: Hoist SMC_32 sanitization

The SMCCC, part 3 indicates that only the bottom
32-bits of a 32-bit SMC call are valid. The upper
bits must be zero. Lets enforce that so standard
service code can

SMCCC: Hoist SMC_32 sanitization

The SMCCC, part 3 indicates that only the bottom
32-bits of a 32-bit SMC call are valid. The upper
bits must be zero. Lets enforce that so standard
service code can assume its been called that way.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Change-Id: I1bac50fbdc3b6ddca5fe2d1d1f96166a65ac4eb4

show more ...

feat(spmd): add support for FFA_SPM_ID_GET

Handle calls to the FFA_SPM_ID_GET interface. If FFA_SPM_ID_GET is
invoked from the non-secure physical FF-A instance, return the SPMC id
(defined in the S

feat(spmd): add support for FFA_SPM_ID_GET

Handle calls to the FFA_SPM_ID_GET interface. If FFA_SPM_ID_GET is
invoked from the non-secure physical FF-A instance, return the SPMC id
(defined in the SPMC manifest). If FFA_SPM_ID_GET is invoked from
the secure physical FF-A instance (e.g. the SPMC), return the SPMD id.

Change-Id: Id6d4e96b1da2510386d344e09c4553dba01227ec
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

show more ...

fix(services): drop warning on unimplemented calls

Standard Secure Services, complying to the SMCCC specification, are
discoverable: Any user can do the SMC call, and derive from the return
value (-

fix(services): drop warning on unimplemented calls

Standard Secure Services, complying to the SMCCC specification, are
discoverable: Any user can do the SMC call, and derive from the return
value (-1) if the service is implemented. Consequently we should not
*warn* if BL31 does not implement a service, as some services (TRNG, for
instance) might never be implemented for devices, as they are lacking
hardware.

Short of dropping the existing warning message altogether, change the
level to VERBOSE, which should prevent it actually being printed in
normal situations.

This removes the pointless TF-A messages on the console when booting
Linux, as modern kernels now call the SOCID and the TRNG service
unconditionally.

Change-Id: I08b0b02e0f46322ebe0b40b3991c3c9b5bed4f97
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge changes from topic "od/ns-interrupts" into integration

* changes:
spmd: add FFA_INTERRUPT forwarding
doc: spm: update messaging method field

spmd: add FFA_INTERRUPT forwarding

In the case of a SP pre-empted by a non-secure interrupt, the SPMC
returns to the SPMD through the FFA_INTERRUPT ABI. It is then forwarded
to the normal world driv

spmd: add FFA_INTERRUPT forwarding

In the case of a SP pre-empted by a non-secure interrupt, the SPMC
returns to the SPMD through the FFA_INTERRUPT ABI. It is then forwarded
to the normal world driver hinting the SP has to be resumed after the
non-secure interrupt has been serviced.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I51a694dddcb8ea30fa84e1f11d018bc2abec0a56

show more ...

services: spm_mm: Use sp_boot_info to set SP context

The current SPM_MM implementations expects the SP image addresses
as static macros. This means platforms wanting to use dynamically
allocated mem

services: spm_mm: Use sp_boot_info to set SP context

The current SPM_MM implementations expects the SP image addresses
as static macros. This means platforms wanting to use dynamically
allocated memory addresses are left out. This patch gets sp_boot_info
at the beginning of spm_sp_setup function and uses member variables
of sp_boot_info to setup the context. So member variables of
struct sp_boot_info and consequently the context can be initialized
by static macros or dynamiclly allocated memory address..

Change-Id: I1cb75190ab8026b845ae20a9c6cc416945b5d7b9
Signed-off-by: Mayur Gudmeti <mgudmeti@nvidia.com>

show more ...

SPM: Fix error codes size in SPMD handler

FF-A specification states that error codes should be typed int32_t.
SPMD's uses uint64_t for return values, which if assigned with a signed
type would have

SPM: Fix error codes size in SPMD handler

FF-A specification states that error codes should be typed int32_t.
SPMD's uses uint64_t for return values, which if assigned with a signed
type would have sign extension, and change the size of the return from
32-bit to 64-bit.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I288ab2ffec8330a2fe1f21df14e22c34bd83ced3

show more ...

Bug fix in tspd interrupt handling when TSP_NS_INTR_ASYNC_PREEMPT is enabled

Typically, interrupts for a specific security state get handled in the
same security execption level if the execution is

Bug fix in tspd interrupt handling when TSP_NS_INTR_ASYNC_PREEMPT is enabled

Typically, interrupts for a specific security state get handled in the
same security execption level if the execution is in the same security
state. For example, if a non-secure interrupt gets fired when CPU is
executing in NS-EL2 it gets handled in the non-secure world.

However, interrupts belonging to the opposite security state typically
demand a world(context) switch. This is inline with the security
principle which states a secure interrupt has to be handled in the
secure world. Hence, the TSPD in EL3 expects the context(handle) for a
secure interrupt to be non-secure and vice versa.

The function "tspd_sel1_interrupt_handler" is the handler registered
for S-EL1 interrupts by the TSPD. Based on the above assumption, it
provides an assertion to validate if the interrupt originated from
non-secure world and upon success arranges entry into the TSP at
'tsp_sel1_intr_entry' for handling the interrupt.

However, a race condition between non-secure and secure interrupts can
lead to a scenario where the above assumptions do not hold true and
further leading to following assert fail.

This patch fixes the bug which causes this assert fail:

ASSERT: services/spd/tspd/tspd_main.c:105
BACKTRACE: START: assert
0: EL3: 0x400c128
1: EL3: 0x400faf8
2: EL3: 0x40099a4
3: EL3: 0x4010d54
BACKTRACE: END: assert

Change-Id: I359d30fb5dbb1429a4a3c3fff37fdc64c07e9414
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...