trusty: Allow getting trusty memsize from BL32_MEM_SIZE instead of TSP_SEC_MEM_SIZE

Some platforms define BL32_MEM_SIZE instead of TSP_SEC_MEM_SIZE, but
the meaning is the same.

Change-Id: I93d96dc

trusty: Allow getting trusty memsize from BL32_MEM_SIZE instead of TSP_SEC_MEM_SIZE

Some platforms define BL32_MEM_SIZE instead of TSP_SEC_MEM_SIZE, but
the meaning is the same.

Change-Id: I93d96dca442e653435cae6a165b1955efe2d2b75
Signed-off-by: Arve Hjønnevåg <arve@android.com>

show more ...

SPMD: hook SPMD into standard services framework

This patch adds support to initialise the SPM dispatcher as a standard
secure service. It also registers a handler for SPCI SMCs exported by
the SPM

SPMD: hook SPMD into standard services framework

This patch adds support to initialise the SPM dispatcher as a standard
secure service. It also registers a handler for SPCI SMCs exported by
the SPM dispatcher.

Signed-off-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>
Change-Id: I2183adf826d08ff3fee9aee75f021021162b6477

show more ...

SPMD: add SPM dispatcher based upon SPCI Beta 0 spec

This patch adds a rudimentary SPM dispatcher component in EL3.
It does the following:

- Consumes the TOS_FW_CONFIG to determine properties of th

SPMD: add SPM dispatcher based upon SPCI Beta 0 spec

This patch adds a rudimentary SPM dispatcher component in EL3.
It does the following:

- Consumes the TOS_FW_CONFIG to determine properties of the SPM core
component
- Initialises the SPM core component which resides in the BL32 image
- Implements a handler for SPCI calls from either security state. Some
basic validation is done for each call but in most cases it is simply
forwarded as-is to the "other" security state.

Signed-off-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>
Change-Id: I7d116814557f7255f4f4ebb797d1619d4fbab590

show more ...

Prevent speculative execution past ERET

Even though ERET always causes a jump to another address, aarch64 CPUs
speculatively execute following instructions as if the ERET
instruction was not a jump

Prevent speculative execution past ERET

Even though ERET always causes a jump to another address, aarch64 CPUs
speculatively execute following instructions as if the ERET
instruction was not a jump instruction.
The speculative execution does not cross privilege-levels (to the jump
target as one would expect), but it continues on the kernel privilege
level as if the ERET instruction did not change the control flow -
thus execution anything that is accidentally linked after the ERET
instruction. Later, the results of this speculative execution are
always architecturally discarded, however they can leak data using
microarchitectural side channels. This speculative execution is very
reliable (seems to be unconditional) and it manages to complete even
relatively performance-heavy operations (e.g. multiple dependent
fetches from uncached memory).

This was fixed in Linux, FreeBSD, OpenBSD and Optee OS:
https://github.com/torvalds/linux/commit/679db70801da9fda91d26caf13bf5b5ccc74e8e8
https://github.com/freebsd/freebsd/commit/29fb48ace4186a41c409fde52bcf4216e9e50b61
https://github.com/openbsd/src/commit/3a08873ece1cb28ace89fd65e8f3c1375cc98de2
https://github.com/OP-TEE/optee_os/commit/abfd092aa19f9c0251e3d5551e2d68a9ebcfec8a

It is demonstrated in a SafeSide example:
https://github.com/google/safeside/blob/master/demos/eret_hvc_smc_wrapper.cc
https://github.com/google/safeside/blob/master/kernel_modules/kmod_eret_hvc_smc/eret_hvc_smc_module.c

Signed-off-by: Anthony Steinhauser <asteinhauser@google.com>
Change-Id: Iead39b0b9fb4b8d8b5609daaa8be81497ba63a0f

show more ...

spm-mm: Rename aarch64 assembly files

Change-Id: I2bab67f319758dd033aa689d985227cad796cdea
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

spm-mm: Rename source files

Change-Id: I851be04fc5de8a95ea11270996f8ca33f0fccadb
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

spm-mm: Rename spm_shim_private.h

Change-Id: I575188885ebed8c5f0682ac6e0e7dd159155727f
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

spm-mm: Rename spm_private.h

Change-Id: Ie47009158032c2e8f35febd7bf5458156f334ead
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

spm-mm: Rename component makefile

Change-Id: Idcd2a35cd2b30d77a7ca031f7e0172814bdb8cab
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

spm-mm: Remove mm_svc.h header

The contents of this header have been merged into the spm_mm_svc.h
header file.

Change-Id: I01530b2e4ec1b4c091ce339758025e2216e740a4
Signed-off-by: Paul Beesley <paul

spm-mm: Remove mm_svc.h header

The contents of this header have been merged into the spm_mm_svc.h
header file.

Change-Id: I01530b2e4ec1b4c091ce339758025e2216e740a4
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

show more ...

spm-mm: Refactor spm_svc.h and its contents

Change-Id: I91c192924433226b54d33e57d56d146c1c6df81b
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

spm-mm: Refactor secure_partition.h and its contents

Before adding any new SPM-related components we should first do
some cleanup around the existing SPM-MM implementation. The aim
is to make sure t

spm-mm: Refactor secure_partition.h and its contents

Before adding any new SPM-related components we should first do
some cleanup around the existing SPM-MM implementation. The aim
is to make sure that any SPM-MM components have names that clearly
indicate that they are MM-related. Otherwise, when adding new SPM
code, it could quickly become confusing as it would be unclear to
which component the code belongs.

The secure_partition.h header is a clear example of this, as the
name is generic so it could easily apply to any SPM-related code,
when it is in fact SPM-MM specific.

This patch renames the file and the two structures defined within
it, and then modifies any references in files that use the header.

Change-Id: I44bd95fab774c358178b3e81262a16da500fda26
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

show more ...

spm: Remove SPM Alpha 1 prototype and support files

The Secure Partition Manager (SPM) prototype implementation is
being removed. This is preparatory work for putting in place a
dispatcher component

spm: Remove SPM Alpha 1 prototype and support files

The Secure Partition Manager (SPM) prototype implementation is
being removed. This is preparatory work for putting in place a
dispatcher component that, in turn, enables partition managers
at S-EL2 / S-EL1.

This patch removes:

- The core service files (std_svc/spm)
- The Resource Descriptor headers (include/services)
- SPRT protocol support and service definitions
- SPCI protocol support and service definitions

Change-Id: Iaade6f6422eaf9a71187b1e2a4dffd7fb8766426
Signed-off-by: Paul Beesley <paul.beesley@arm.com>
Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>

show more ...

Remove dependency between SPM_MM and ENABLE_SPM build flags

There are two different implementations of Secure Partition
management in TF-A. One is based on the "Management Mode" (MM)
design, the oth

Remove dependency between SPM_MM and ENABLE_SPM build flags

There are two different implementations of Secure Partition
management in TF-A. One is based on the "Management Mode" (MM)
design, the other is based on the Secure Partition Client Interface
(SPCI) specification. Currently there is a dependency between their
build flags that shouldn't exist, making further development
harder than it should be. This patch removes that
dependency, making the two flags function independently.

Before: ENABLE_SPM=1 is required for using either implementation.
By default, the SPCI-based implementation is enabled and
this is overridden if SPM_MM=1.

After: ENABLE_SPM=1 enables the SPCI-based implementation.
SPM_MM=1 enables the MM-based implementation.
The two build flags are mutually exclusive.

Note that the name of the ENABLE_SPM flag remains a bit
ambiguous - this will be improved in a subsequent patch. For this
patch the intention was to leave the name as-is so that it is
easier to track the changes that were made.

Change-Id: I8e64ee545d811c7000f27e8dc8ebb977d670608a
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

show more ...

Enable -Wshadow always

Variable shadowing is, according to the C standard, permitted and valid
behaviour. However, allowing a local variable to take the same name as a
global one can cause confusion

Enable -Wshadow always

Variable shadowing is, according to the C standard, permitted and valid
behaviour. However, allowing a local variable to take the same name as a
global one can cause confusion and can make refactoring and bug hunting
more difficult.

This patch moves -Wshadow from WARNING2 into the general warning group
so it is always used. It also fixes all warnings that this introduces
by simply renaming the local variable to a new name

Change-Id: I6b71bdce6580c6e58b5e0b41e4704ab0aa38576e
Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>

show more ...

Merge changes from topic "jc/coverity-fixes" into integration

* changes:
Fix Coverity #261967, Infinite loop
Fix Coverity #343017, Missing unlock
Fix Coverity #343008, Side affect in assertion

Merge changes from topic "jc/coverity-fixes" into integration

* changes:
Fix Coverity #261967, Infinite loop
Fix Coverity #343017, Missing unlock
Fix Coverity #343008, Side affect in assertion
Fix Coverity #342970, Uninitialized scalar variable

show more ...

Fix Coverity #343017, Missing unlock

All other returns from this function unlock the responses_lock, so we
also should release the lock in this case.

Change-Id: Ie2cfa8755723fed79e809f9480190d11f37

Fix Coverity #343017, Missing unlock

All other returns from this function unlock the responses_lock, so we
also should release the lock in this case.

Change-Id: Ie2cfa8755723fed79e809f9480190d11f373a217
Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>

show more ...

spd: opteed: enable NS_TIMER_SWITCH

Enable dispatcher to save/restore unbanked timer registers. So that
both secure (OP-TEE) and non-secure (Linux) worlds can have independent
access control over ti

spd: opteed: enable NS_TIMER_SWITCH

Enable dispatcher to save/restore unbanked timer registers. So that
both secure (OP-TEE) and non-secure (Linux) worlds can have independent
access control over timer registers.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I4d58d5ff8298587ed478c8433fcbc3aef538d668

show more ...

Switch AARCH32/AARCH64 to __aarch64__

NOTE: AARCH32/AARCH64 macros are now deprecated in favor of __aarch64__.

All common C compilers pre-define the same macros to signal which
architecture the cod

Switch AARCH32/AARCH64 to __aarch64__

NOTE: AARCH32/AARCH64 macros are now deprecated in favor of __aarch64__.

All common C compilers pre-define the same macros to signal which
architecture the code is being compiled for: __arm__ for AArch32 (or
earlier versions) and __aarch64__ for AArch64. There's no need for TF-A
to define its own custom macros for this. In order to unify code with
the export headers (which use __aarch64__ to avoid another dependency),
let's deprecate the AARCH32 and AARCH64 macros and switch the code base
over to the pre-defined standard macro. (Since it is somewhat
unintuitive that __arm__ only means AArch32, let's standardize on only
using __aarch64__.)

Change-Id: Ic77de4b052297d77f38fc95f95f65a8ee70cf200
Signed-off-by: Julius Werner <jwerner@chromium.org>

show more ...

Replace __ASSEMBLY__ with compiler-builtin __ASSEMBLER__

NOTE: __ASSEMBLY__ macro is now deprecated in favor of __ASSEMBLER__.

All common C compilers predefine a macro called __ASSEMBLER__ when
pre

Replace __ASSEMBLY__ with compiler-builtin __ASSEMBLER__

NOTE: __ASSEMBLY__ macro is now deprecated in favor of __ASSEMBLER__.

All common C compilers predefine a macro called __ASSEMBLER__ when
preprocessing a .S file. There is no reason for TF-A to define it's own
__ASSEMBLY__ macro for this purpose instead. To unify code with the
export headers (which use __ASSEMBLER__ to avoid one extra dependency),
let's deprecate __ASSEMBLY__ and switch the code base over to the
predefined standard.

Change-Id: Id7d0ec8cf330195da80499c68562b65cb5ab7417
Signed-off-by: Julius Werner <jwerner@chromium.org>

show more ...

Remove references to old project name from common files

The project has been renamed from "Arm Trusted Firmware (ATF)" to
"Trusted Firmware-A (TF-A)" long ago. A few references to the old
project na

Remove references to old project name from common files

The project has been renamed from "Arm Trusted Firmware (ATF)" to
"Trusted Firmware-A (TF-A)" long ago. A few references to the old
project name that still remained in various places have now been
removed.

This change doesn't affect any platform files. Any "ATF" references
inside platform files, still remain.

Change-Id: Id97895faa5b1845e851d4d50f5750de7a55bf99e
Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>

show more ...

services/spm: Fix service UUID lookup

The spm_sp_get_by_uuid() function is used to look up the secure
partition that provides a given service.

Within this function, memcmp() is used to compare the

services/spm: Fix service UUID lookup

The spm_sp_get_by_uuid() function is used to look up the secure
partition that provides a given service.

Within this function, memcmp() is used to compare the service
UUIDs but it uses the size of the rdsvc->uuid pointer instead of
the size of its content (missing dereference). This means that only
a partial comparison is performed as UUIDs are 128 bits in length and
rdsvc->uuid is a uint32_t typed pointer.

Instead, use the size of the array pointed to by the svc_uuid parameter,
which will be the full 128 bits, for the comparison.

Change-Id: I258fb0cca3bf19f97b8f2a4c133981647cd050e4
Signed-off-by: Paul Beesley <paul.beesley@arm.com>

show more ...

Makefile: remove extra include paths in INCLUDES

Now it is needed to use the full path of the common header files.

Commit 09d40e0e0828 ("Sanitise includes across codebase") provides more
informatio

Makefile: remove extra include paths in INCLUDES

Now it is needed to use the full path of the common header files.

Commit 09d40e0e0828 ("Sanitise includes across codebase") provides more
information.

Change-Id: Ifedc79d9f664d208ba565f5736612a3edd94c647
Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>

show more ...

SPM: Adjust size of virtual address space per partition

Rather than using a fixed virtual address space size, read all regions
in the resource description of each partition and restrict the virtual

SPM: Adjust size of virtual address space per partition

Rather than using a fixed virtual address space size, read all regions
in the resource description of each partition and restrict the virtual
address space size to the one the partition actually needs.

This also allows SPM to take advantage of the extension ARMv8.4-TTST if
the virtual address space size is small enough.

Change-Id: I8646aa95e659136b58b44b040364cdee631f7e82
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

show more ...

SPM: Refactor xlat context creation

Right now the virtual address space is fixed to
PLAT_VIRT_ADDR_SPACE_SIZE, so all base translation tables are the same
size and need the same alignment. The curre

SPM: Refactor xlat context creation

Right now the virtual address space is fixed to
PLAT_VIRT_ADDR_SPACE_SIZE, so all base translation tables are the same
size and need the same alignment. The current code allocates the exact
space needed by this initial table.

However, a following patch is going to allow each partition to choose
the size of its address space based on the memory regions defined in
their resource description, so it isn't possible to determine this at
build time. As this optimization no longer applies, it has to be
removed.

Change-Id: Ia8d19f4981e1017e4ffe0ba136de73d701044cb0
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

show more ...