GitLab

This patch maps the TZDRAM carveout used by the BL31. In the near
future BL31 would be running from the TZRAM for security and
performance reasons. The only downside to this solution is that
the TZRAM loses its state in System Suspend. So, we map the TZDRAM
carveout that the BL31 would use to save its state before entering
System Suspend.

Change-Id: Id5bda7e9864afd270cf86418c703fa61c2cb095f
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch increases the BL31 image size for all Tegra platforms to
256KB, so that we can relocate BL31 to TZSRAM on supported chips.

Change-Id: I467063c68632b53b5d4ef8ff1f76f5988096bd9c
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch uses the Memory controller driver's handler to restore
its settings and moves the other chip specific code to their own
'pwr_domain_on_finish' handlers.

Change-Id: I3c9d23bdab9e2e3c05034ff6812cf941ccd7a75e
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch moves the code to disable DCO operations out from common
CPU files. This allows the platform code to call thsi API as and
when required. There are certain CPU power down states which require
the DCO to be kept ON and platforms can decide selectively now.

Change-Id: Icb946fe2545a7d8c5903c420d1ee169c4921a2d1
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch enables the PSCI_EXTENDED_STATE_ID macro. Tegra platforms
have moved on to using the extended state ID for CPU_SUSPEND, where
the NS world passes the state ID and wakeup time as part of the
state ID field.

Change-Id: Ie8b0fec285d8b2330bc26ff239a4f628425c9fcf
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

The platform power states, PLAT_MAX_RET_STATE and PLAT_MAX_OFF_STATE,
can change on Tegra SoCs and so should be defined per-soc.

This patch moves these macro definitions to individual SoC's tegra_def.h
files.

Change-Id: Ib9b2752bc4d79cef6f79bee49882d340f71977a2
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch introduces a function to secure the on-chip TZRAM memory. The
Tegra132 and Tegra210 chips do not have a compelling use case to lock the
TZRAM. The trusted OS owns the TZRAM aperture on these chips and so it
can take care of locking the aperture. This might not be true for future
chips and this patch makes the TZRAM programming flexible.

Change-Id: I3ac9f1de1b792ccd23d4ded274784bbab2ea224a
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch enables the runtime console for all Tegra platforms
before exiting BL31. This would enable debug/error prints to be
always displayed on the UART console.

Change-Id: Ic48d61d05b0ab07973d6fc2dc6b68733a42a3f63
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch introduces a power down handler which can be overriden
by SoCs to customise the power down process. The current SoCs do
not have a way of powering down the entire system as external PMIC
chips are involved in the process.

But future SoCs will have a way to power off the entire system
without talking to an external PMIC.

Change-Id: Ie7750714141a29cb0a1a616fafc531c4f11d0985
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch implements a handler for common SiP calls. A weak
implementation for the SoC-specific handler has been provided
which can be overridden by SoCs to implement any custom SiP
calls.

Change-Id: I45122892a84ea35d7b44be0f35dc15f6bb95193e
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch uses the OEN_TAP_START aperture for all the standard
calls being passed to Trusty.

Change-Id: Id78d01c7f48e4f54855600d7c789ffbfb898c541
Signed-off-by: Amith <aramachan@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

Tegra changes from downstream v1

The BL2 fills in the UART controller ID to be used as the normal as
well as the crash console on Tegra platforms. The controller ID to
UART controller base address mapping is handled by each Tegra SoC
the base addresses might change across Tegra chips.

This patch adds the handler to parse the platform params to get the
UART ID for the per-soc handlers.

Change-Id: I4d167b20a59aaf52a31e2a8edf94d8d6f89598fa
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch adds another member, tzdram_base, to the plat_params_from_bl2 struct
in order to store the TZDRAM carveout base address used to load the Trusted OS.
The monitor programs the memory controller with the TZDRAM base and size in order
to deny any accesses from the NS world.

Change-Id: If39b8674d548175d7ccb6525c18d196ae8a8506c
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch renames the current Memory Controller driver files to
"_v1". This is done to add a driver for the new Memory Controller
hardware (v2).

Change-Id: I668dbba42f6ee0db2f59a7103f0ae7e1d4684ecf
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch checks that the pointers to BL3-3 and BL3-2 ep_info
structs are valid before accessing them. Add some INFO prints
in the BL3-1 setup path for early debugging purposes.

Change-Id: I62b23fa870f1b2fb783c8de69aab819f1749d15a
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch adds support for all variants of the Denver CPUs. The
variants export their cpu_ops to allow all Denver platforms to run
the Trusted Firmware stack.

Change-Id: I1488813ddfd506ffe363d8a32cda1b575e437035
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch modifies platform_get_core_pos() to use the Cluster ID
field as well to calculate the final index value. This helps the
system to store CPU data for multi-cluster configurations.

Change-Id: I76e35f723f741e995c6c9156e9d61b0b2cdd2709
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch enables the processor retention and L2/CPUECTLR read/write
access from the NS world only for Cortex-A57 CPUs on the Tegra SoCs.

Change-Id: I9941a67686ea149cb95d80716fa1d03645325445
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch moves these address translation helper macros to individual
Tegra SoC makefiles to provide more control.

Change-Id: Ieab53c457c73747bd0deb250459befb5b7b9363f
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

This patch converts the common SiP handler to SoC specific SiP
handler. T210 and T132 have different SiP SMCs and so it makes
sense to move the SiP handler to soc/t132 and soc/t210 folders.

Change-Id: Idfe48384d63641137d74a095432df4724986b241
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

The Flow Controller hardware block is not present across all Tegra
SoCs, hence include the driver files from SoC specific makefiles.

T132/T210 are the SoCs which include this hardware block while future
SoCs have removed it.

Change-Id: Iaca25766a4fa51567293d10cf14dae968b0fae80
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

Revert "tbbr: Use constant-time bcmp() to compare hashes"

Introduce locking primitives using CAS instruction

Add bounds checking asserts to memmap IO driver

Disable secure self-hosted debug

This reverts commit b621fb50

.

Because of the Trusted Firmware design, timing-safe functions are not
needed. Using them may be misleading as it could be interpreted as being
a protection against private data leakage, which isn't the case here.

For each image, the SHA-256 hash is calculated. Some padding is appended
and the result is encrypted with a private key using RSA-2048. This is
the signature of the image. The public key is stored along with BL1 in
read-only memory and the encrypted hash is stored in the FIP.

When authenticating an image, the TF decrypts the hash stored in the FIP
and recalculates the hash of the image. If they don't match, the boot
sequence won't continue.

A constant-time comparison does not provide additional security as all
the data involved in this process is already known to any attacker.
There is no private data that can leaked through a timing attack when
authenticating an image.

`timingsafe_bcmp()` is kept in the codebase because it could be useful
in the future.

Change-Id: I44bdcd58faa586a050cc89447e38c142508c9888
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Use DC ZVA instruction to zero memory

Fix minor issues found by cppcheck

Migrate to Linaro Release 16.12

Makefile: use git describe for BUILD_STRING

On Juno, the secure privileged invasive debug authentication signal
(SPIDEN) is controlled by board SCC registers, which by default enable
SPIDEN.  Disable secure privileged external debug in release builds by
programming the appropriate Juno SoC registers.

Change-Id: I61045f09a47dc647bbe95e1b7a60e768f5499f49
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

Trusted Firmware currently has no support for secure self-hosted
debug.  To avoid unexpected exceptions, disable software debug
exceptions, other than software breakpoint instruction exceptions,
from all exception levels in secure state.  This applies to both
AArch32 and AArch64 EL3 initialization.

Change-Id: Id097e54a6bbcd0ca6a2be930df5d860d8d09e777
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

cppcheck highlighted variables that were initialized but then later
reassigned.

Change-Id: Ie12742c01fd3bf48b2d6c05a3b448da91d57a2e4
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

The memmap IO driver doesn't perform bounds check when reading, writing,
or seeking. The onus to vet parameters is on the caller, and this patch
asserts that:

  - non-negative size is specified for for backing memory;

  - valid parameters are passed into the driver for read, write and seek
    operations.

Change-Id: I6518c4065817e640e9e7e39a8a4577655f2680f7
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

The ARMv8v.1 architecture extension has introduced support for far
atomics, which includes compare-and-swap. Compare and Swap instruction
is only available for AArch64.

Introduce build options to choose the architecture versions to target
ARM Trusted Firmware:

  - ARM_ARCH_MAJOR: selects the major version of target ARM
    Architecture. Default value is 8.

  - ARM_ARCH_MINOR: selects the minor version of target ARM
    Architecture. Default value is 0.

When:

  (ARM_ARCH_MAJOR > 8) || ((ARM_ARCH_MAJOR == 8) && (ARM_ARCH_MINOR >= 1)),

for AArch64, Compare and Swap instruction is used to implement spin
locks. Otherwise, the implementation falls back to using
load-/store-exclusive instructions.

Update user guide, and introduce a section in Firmware Design guide to
summarize support for features introduced in ARMv8 Architecture
Extensions.

Change-Id: I73096a0039502f7aef9ec6ab3ae36680da033f16
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Bug fix and cleanup of cert_create tool

Fiptool cleanup

This Linaro release updates both the binaries and the toolchain:
Linaro binaries upgraded 16.06 --> 16.12
AArch64 compiler upgraded 15.05 (gcc 4.9) --> 5.3-2015.05 (gcc 5.3)
AArch32 compiler upgraded 15.05 (gcc 4.9) --> 5.3-2015.05 (gcc 5.3)

The ARM TF codebase has been tested against these new binaries. This patch
updates the User Guide to reflect that the 16.12 release is now a supported
Linaro Release.

Change-Id: I6247e820f591df7d05df4f622ee45a3abf2c2d72
Signed-off-by: David Cunado <david.cunado@arm.com>

Decouple PSCI stat residency calculation from PMF