Introduce locking primitives using CAS instruction

The ARMv8v.1 architecture extension has introduced support for far
atomics, which includes compare-and-swap. Compare and Swap instruction
is only a

Introduce locking primitives using CAS instruction

The ARMv8v.1 architecture extension has introduced support for far
atomics, which includes compare-and-swap. Compare and Swap instruction
is only available for AArch64.

Introduce build options to choose the architecture versions to target
ARM Trusted Firmware:

- ARM_ARCH_MAJOR: selects the major version of target ARM
Architecture. Default value is 8.

- ARM_ARCH_MINOR: selects the minor version of target ARM
Architecture. Default value is 0.

When:

(ARM_ARCH_MAJOR > 8) || ((ARM_ARCH_MAJOR == 8) && (ARM_ARCH_MINOR >= 1)),

for AArch64, Compare and Swap instruction is used to implement spin
locks. Otherwise, the implementation falls back to using
load-/store-exclusive instructions.

Update user guide, and introduce a section in Firmware Design guide to
summarize support for features introduced in ARMv8 Architecture
Extensions.

Change-Id: I73096a0039502f7aef9ec6ab3ae36680da033f16
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

show more ...

Merge pull request #833 from masahir0y/cert_create

Bug fix and cleanup of cert_create tool

Merge pull request #828 from masahir0y/fiptool

Fiptool cleanup

Migrate to Linaro Release 16.12

This Linaro release updates both the binaries and the toolchain:
Linaro binaries upgraded 16.06 --> 16.12
AArch64 compiler upgraded 15.05 (gcc 4.9) --> 5.3-2015.05 (g

Migrate to Linaro Release 16.12

This Linaro release updates both the binaries and the toolchain:
Linaro binaries upgraded 16.06 --> 16.12
AArch64 compiler upgraded 15.05 (gcc 4.9) --> 5.3-2015.05 (gcc 5.3)
AArch32 compiler upgraded 15.05 (gcc 4.9) --> 5.3-2015.05 (gcc 5.3)

The ARM TF codebase has been tested against these new binaries. This patch
updates the User Guide to reflect that the 16.12 release is now a supported
Linaro Release.

Change-Id: I6247e820f591df7d05df4f622ee45a3abf2c2d72
Signed-off-by: David Cunado <david.cunado@arm.com>

show more ...

Merge pull request #826 from dp-arm/dp/psci-stat-abstraction

Decouple PSCI stat residency calculation from PMF

PSCI: Do stat accounting for retention/standby states

Perform stat accounting for retention/standby states also when
requested at multiple power levels.

Change-Id: I2c495ea7cdff8619bde323fb641cd844

PSCI: Do stat accounting for retention/standby states

Perform stat accounting for retention/standby states also when
requested at multiple power levels.

Change-Id: I2c495ea7cdff8619bde323fb641cd84408eb5762
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

show more ...

PSCI: Decouple PSCI stat residency calculation from PMF

This patch introduces the following three platform interfaces:

* void plat_psci_stat_accounting_start(const psci_power_state_t *state_info)

PSCI: Decouple PSCI stat residency calculation from PMF

This patch introduces the following three platform interfaces:

* void plat_psci_stat_accounting_start(const psci_power_state_t *state_info)

This is an optional hook that platforms can implement in order
to perform accounting before entering a low power state. This
typically involves capturing a timestamp.

* void plat_psci_stat_accounting_stop(const psci_power_state_t *state_info)

This is an optional hook that platforms can implement in order
to perform accounting after exiting from a low power state. This
typically involves capturing a timestamp.

* u_register_t plat_psci_stat_get_residency(unsigned int lvl,
const psci_power_state_t *state_info,
unsigned int last_cpu_index)

This is an optional hook that platforms can implement in order
to calculate the PSCI stat residency.

If any of these interfaces are overridden by the platform, it is
recommended that all of them are.

By default `ENABLE_PSCI_STAT` is disabled. If `ENABLE_PSCI_STAT`
is set but `ENABLE_PMF` is not set then an alternative PSCI stat
collection backend must be provided. If both are set, then default
weak definitions of these functions are provided, using PMF to
calculate the residency.

NOTE: Previously, platforms did not have to explicitly set
`ENABLE_PMF` since this was automatically done by the top-level
Makefile.

Change-Id: I17b47804dea68c77bc284df15ee1ccd66bc4b79b
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

show more ...

Merge pull request #836 from davidcunado-arm/dc/update_userguide

Update AEM and Cortex Models versions

fiptool: remove unneeded declarations

These functions are defined above any calls.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

fiptool: stretch out printf strings for readability and grep'ability

We should follow the Linux coding style, which is clearly stated in
the docs/user-guide.mk:

When making changes to the source

fiptool: stretch out printf strings for readability and grep'ability

We should follow the Linux coding style, which is clearly stated in
the docs/user-guide.mk:

When making changes to the source for submission to the project,
the source must be in compliance with the Linux style guide

and Documentation/process/coding-style.rst of Linux Kernel says:

The limit on the length of lines is 80 columns and this is a
strongly preferred limit.
[ snip ]
However, never break user-visible strings such as printk messages,
because that breaks the ability to grep for them.

The strings for printf() are user-visible, and can exceed the 80
column limit.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

fiptool: print new lines of usage to stdout instead of stderr

The strings in usage functions are sent to stdout by printf(),
but some new lines are sent to stderr by fputc(..., stderr).

This incons

fiptool: print new lines of usage to stdout instead of stderr

The strings in usage functions are sent to stdout by printf(),
but some new lines are sent to stderr by fputc(..., stderr).

This inconsistency will break the usage format when users re-direct
stdout or stderr. Just use printf() for consistency.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

cert_create: remove unneeded initializers

These variables store return values of functions. Remove all of
meaningless initializers.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

cert_create: merge successive i2d_ASN1_INTEGER() calls

The ext_new_nvcounter() function calls i2d_ASN1_INTEGER() twice;
the first call to get the return value "sz", and the second one
for writing da

cert_create: merge successive i2d_ASN1_INTEGER() calls

The ext_new_nvcounter() function calls i2d_ASN1_INTEGER() twice;
the first call to get the return value "sz", and the second one
for writing data into the buffer. This is actually redundant.
We can do both by one function call.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

cert_create: fix memory leak bug caused by key container overwrite

In the current code, both key_load() and key_create() call key_new()
to allocate a key container (and they do not free it even if t

cert_create: fix memory leak bug caused by key container overwrite

In the current code, both key_load() and key_create() call key_new()
to allocate a key container (and they do not free it even if they
fail). If a specific key is not given by the command option,
key_load() fails, then key_create() is called. At this point, the
key container that has been allocated in key_load() is still alive,
and it is overwritten by a new key container created by key_create().

Move the key_new() call to the main() function to make sure it is
called just once for each descriptor.

While we are here, let's fix one more bug; the error handling code
ERROR("Malloc error while loading '%s'\n", keys[i].fn);
is wrong because keys[i].fn is NULL pointer unless a specific key is
given by the command option. This code could be run in either case.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

Update AEM and Cortex Models versions

AEMv8-A Model release v8.2 has been made available and Trusted Firmware
has been tested against these versions as part of its CI system. This
patch updates the

Update AEM and Cortex Models versions

AEMv8-A Model release v8.2 has been made available and Trusted Firmware
has been tested against these versions as part of its CI system. This
patch updates the user guide documentation to reflect the version of AEM
and Cortex Models that Trusted Firmware has been tested against.

Also, the Linaro Release Notes link was broken and this patch updates the
link.

Change-Id: I88729cef909a69fff629036f480fd6168ad7dc9a
Signed-off-by: David Cunado <david.cunado@arm.com>

show more ...

Merge pull request #831 from masahir0y/zynqmp

zynqmp: remove RESET_TO_BL31=1 from build instruction

Replace some memset call by zeromem

Replace all use of memset by zeromem when zeroing moderately-sized
structure by applying the following transformation:
memset(x, 0, sizeof(x)) => zeromem(x, sizeo

Replace some memset call by zeromem

Replace all use of memset by zeromem when zeroing moderately-sized
structure by applying the following transformation:
memset(x, 0, sizeof(x)) => zeromem(x, sizeof(x))

As the Trusted Firmware is compiled with -ffreestanding, it forbids the
compiler from using __builtin_memset and forces it to generate calls to
the slow memset implementation. Zeromem is a near drop in replacement
for this use case, with a more efficient implementation on both AArch32
and AArch64.

Change-Id: Ia7f3a90e888b96d056881be09f0b4d65b41aa79e
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>

show more ...

Introduce unified API to zero memory

Introduce zeromem_dczva function on AArch64 that can handle unaligned
addresses and make use of DC ZVA instruction to zero a whole block at a
time. This zeroing

Introduce unified API to zero memory

Introduce zeromem_dczva function on AArch64 that can handle unaligned
addresses and make use of DC ZVA instruction to zero a whole block at a
time. This zeroing takes place directly in the cache to speed it up
without doing external memory access.

Remove the zeromem16 function on AArch64 and replace it with an alias to
zeromem. This zeromem16 function is now deprecated.

Remove the 16-bytes alignment constraint on __BSS_START__ in
firmware-design.md as it is now not mandatory anymore (it used to comply
with zeromem16 requirements).

Change the 16-bytes alignment constraints in SP min's linker script to a
8-bytes alignment constraint as the AArch32 zeromem implementation is now
more efficient on 8-bytes aligned addresses.

Introduce zero_normalmem and zeromem helpers in platform agnostic header
that are implemented this way:
* AArch32:
* zero_normalmem: zero using usual data access
* zeromem: alias for zero_normalmem
* AArch64:
* zero_normalmem: zero normal memory using DC ZVA instruction
(needs MMU enabled)
* zeromem: zero using usual data access

Usage guidelines: in most cases, zero_normalmem should be preferred.

There are 2 scenarios where zeromem (or memset) must be used instead:
* Code that must run with MMU disabled (which means all memory is
considered device memory for data accesses).
* Code that fills device memory with null bytes.

Optionally, the following rule can be applied if performance is
important:
* Code zeroing small areas (few bytes) that are not secrets should use
memset to take advantage of compiler optimizations.

Note: Code zeroing security-related critical information should use
zero_normalmem/zeromem instead of memset to avoid removal by
compilers' optimizations in some cases or misbehaving versions of GCC.

Fixes ARM-software/tf-issues#408

Change-Id: Iafd9663fc1070413c3e1904e54091cf60effaa82
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>

show more ...

Merge pull request #830 from masahir0y/misc

gitignore: ignore GNU GLOBAL tag files

Merge pull request #827 from dp-arm/dp/pmf-constants

PMF: Fixup PMF constants

zynqmp: remove RESET_TO_BL31=1 from build instruction

RESET_TO_BL31=1 is specified by plat/xilinx/zynqmp/platform.mk with
"override" directive. So, RESET_TO_BL31=1 is guaranteed without any
operati

zynqmp: remove RESET_TO_BL31=1 from build instruction

RESET_TO_BL31=1 is specified by plat/xilinx/zynqmp/platform.mk with
"override" directive. So, RESET_TO_BL31=1 is guaranteed without any
operation on users' side.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

gitignore: ignore GNU GLOBAL tag files

GNU GLOBAL (https://www.gnu.org/software/global/) is source code
tagging system. It creates 4 tag files (GTAGS, GRTAGS, GSYMS and
GPATH) for the symbol cross-

gitignore: ignore GNU GLOBAL tag files

GNU GLOBAL (https://www.gnu.org/software/global/) is source code
tagging system. It creates 4 tag files (GTAGS, GRTAGS, GSYMS and
GPATH) for the symbol cross-reference. Ignore them.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

Makefile: use git describe for BUILD_STRING

Currently, the BUILD_STRING is just 7-digits git hash. It is true
we can identify which version is running, but we can not get a quick
idea about how new

Makefile: use git describe for BUILD_STRING

Currently, the BUILD_STRING is just 7-digits git hash. It is true
we can identify which version is running, but we can not get a quick
idea about how new or old it is.

The command "git describe" provides us a bit more useful information
in the format of:
(tag-name)-(number of commits on top the tag)-g(7 digits hash)

I added some options:
--always
Make "git describe" work without any tag in case the upstream
ATF is cloned, but all the tags are locally dropped.

--tags
Use any tag instead of only annotated tags. In ATF, only some
tags are annotated, actually the last annotated tag is "v0.2",
whereas we are on "v1.3" tag now. This option is needed to get
something like v1.3-233-gbcc2bf0 instead of v0.2-1713-gbcc2bf0.

--dirty
The mark "-dirty" is appended if the source tree is locally
modified.

With this commit, the welcome string

NOTICE: BL1: v1.3(debug):bcc2bf0

will become like follows:

NOTICE: BL1: v1.3(debug):v1.3-233-gbcc2bf0-dirty

While we are here, let's add "2> /dev/null" as well to silently
ignore any error message from git. We should not assume that users
always work in a git repository; the ATF might be released in a
tarball form instead of a git repository. In such a case, the git
command will fail, then the ugly message "fatal: Not a git ..." will
be displayed during the build:

$ make CROSS_COMPILE=aarch64-linux-gnu-
fatal: Not a git repository (or any of the parent directories): .git
Building fvp
CC drivers/io/io_semihosting.c
CC lib/semihosting/semihosting.c
...

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

PMF: Fixup PMF constants

`PMF_ARM_TIF_IMPL_ID` should be set to 0x41. The code already left
shifts it by 24 bit positions so this was overflowing.

This fixes a build error with GCC 6.2 when
`ENABL

PMF: Fixup PMF constants

`PMF_ARM_TIF_IMPL_ID` should be set to 0x41. The code already left
shifts it by 24 bit positions so this was overflowing.

This fixes a build error with GCC 6.2 when
`ENABLE_RUNTIME_INSTRUMENTATION` is set.

Change-Id: I4c99d48ea7ce3d76e9edd1325b1979994db2c0fb
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

show more ...

Merge pull request #821 from jeenu-arm/errata-printing

Errata printing infrastructure