GitLab

qemu: Add OP-TEE extra image parsing support

psci_common: Resolve GCC static analysis false positive

OP-TEE may have extra images to be loaded. Load them one by one and do
the parsing. In this patch, ARM TF need to load up to 3 images for
OP-TEE: header, pager and pages images. Header image is the info about
optee os and images. Pager image include pager code and data.  Paged
image include the paging parts using virtual memory.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Pass device tree pointer to OP-TEE in x2. bl2 is expected to fill in the
device tree pointer in args.arg3. Passing 0 means that device tree is
unavailable.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Change to compile with new plat/common/plat_psci_common.c instead of the old
deprecated plat/common/aarch64/plat_psci_common.c
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Replaces the deprecated ADDR_SPACE_SIZE with PLAT_PHY_ADDR_SPACE_SIZE
and PLAT_VIRT_ADDR_SPACE_SIZE.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Previously commit 555ebb34db8f3424c1b394df2f10ecf9c1f70901 attmpted to fix this
GCC issue:

services/std_svc/psci/psci_common.c: In function 'psci_do_state_coordination':
services/std_svc/psci/psci_common.c:220:27: error: array subscript is above
array bounds [-Werror=array-bounds]
  psci_req_local_pwr_states[pwrlvl - 1][cpu_idx] = req_pwr_state;

This fix doesn't work as asserts aren't built in non-debug build flows.

Let's use GCCs #pragma option (documented here:
https://gcc.gnu.org/onlinedocs/gcc/Diagnostic-Pragmas.html

) to avoid
this false positive instead.
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>

Minor docs

Change-Id: I08c9789d3fd2b034b08de663d151023ca005f77f
Reported-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

Change-Id: I00fae047dea0eaf7e60037598af020817c66f659
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

Fix x30 reporting for unhandled exceptions

Add new alignment parameter to func assembler macro

Some error paths that lead to a crash dump will overwrite the value in
the x30 register by calling functions with the no_ret macro, which
resolves to a BL instruction. This is not very useful and not what the
reader would expect, since a crash dump should usually show all
registers in the state they were in when the exception happened. This
patch replaces the offending function calls with a B instruction to
preserve the value in x30.

Change-Id: I2a3636f2943f79bab0cd911f89d070012e697c2a
Signed-off-by: Julius Werner <jwerner@chromium.org>

Hikey960: fix PSCI suspend stuck issue

bl32: add secure interrupt handling in AArch32 sp_min

Clear the cpuidle flag when resuming from idle. This flag is set
when entering idle, and if it remains set when resuming, it can
prevent the cluster from powering off during the next system
suspend operation. During system suspend, all CPUs are plugged
out except the last CPU, which is suspended. If any of the
cpuidle flags are set at this point, the last CPU will be stuck
in a WFI loop and will not be powered off.
This problem only occurs during system suspend.
Signed-off-by: Tao Wang <kevin.wangtao@linaro.org>

qemu: Add LOAD_IMAGE_V2 support

The generic LOAD_IMAGE_V2 framework has been merged and enable for almost
all the arm platform. Because qemu platform doesn't share those common
files with arm, QEMU haven't got this support yet.

This patch add all the necessary code the files for adding LOAD_IMAGE_V2
support on QEMU and enable it as default.

Fixes ARM-software/tf-issues#507
Signed-off-by: Fu Wei <fu.wei@linaro.org>

Assembler programmers are used to being able to define functions with a
specific aligment with a pattern like this:

    .align X
  myfunction:

However, this pattern is subtly broken when instead of a direct label
like 'myfunction:', you use the 'func myfunction' macro that's standard
in Trusted Firmware. Since the func macro declares a new section for the
function, the .align directive written above it actually applies to the
*previous* section in the assembly file, and the function it was
supposed to apply to is linked with default alignment.

An extreme case can be seen in Rockchip's plat_helpers.S which contains
this code:

  [...]
  endfunc plat_crash_console_putc

  .align 16
  func platform_cpu_warmboot
  [...]

This assembles into the following plat_helpers.o:

  Sections:
  Idx Name                             Size  [...]  Algn
   9 .text.plat_crash_console_putc 00010000  [...]  2**16
  10 .text.platform_cpu_warmboot   00000080  [...]  2**3

As can be seen, the *previous* function actually got the alignment
constraint, and it is also 64KB big even though it contains only two
instructions, because the .align directive at the end of its section
forces the assembler to insert a giant sled of NOPs. The function we
actually wanted to align has the default constraint. This code only
works at all because the linker just happens to put the two functions
right behind each other when linking the final image, and since the end
of plat_crash_console_putc is aligned the start of platform_cpu_warmboot
will also be. But it still wastes almost 64KB of image space
unnecessarily, and it will break under certain circumstances (e.g. if
the plat_crash_console_putc function becomes unused and its section gets
garbage-collected out).

There's no real way to fix this with the existing func macro. Code like

 func myfunc
 .align X

happens to do the right thing, but is still not really correct code
(because the function label is inserted before the .align directive, so
the assembler is technically allowed to insert padding at the beginning
of the function which would then get executed as instructions if the
function was called). Therefore, this patch adds a new parameter with a
default value to the func macro that allows overriding its alignment.

Also fix up all existing instances of this dangerous antipattern.

Change-Id: I5696a07e2fde896f21e0e83644c95b7b6ac79a10
Signed-off-by: Julius Werner <jwerner@chromium.org>

Support opteed header

Add documentation of the xlat tables library V2

Fix BL2U entrypoint possible parameter corruption

Support for RevC FVP model

qemu: use translation tables library v2 as default.

Add support for a minimal secure interrupt service in sp_min for
the AArch32 implementation. Hard code that only FIQs are handled.

Introduce bolean build directive SP_MIN_WITH_SECURE_FIQ to enable
FIQ handling from SP_MIN.

Configure SCR[FIQ] and SCR[FW] from generic code for both cold and
warm boots to handle FIQ in secure state from monitor.

Since SP_MIN architecture, FIQ are always trapped when system executes
in non secure state. Hence discard relay of the secure/non-secure
state in the FIQ handler.

Change-Id: I1f7d1dc7b21f6f90011b7f3fcd921e455592f5e7
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

ARM TF need transfer information about pageable image load address
and memory limit to OPTEE. OPTEE will relocate the pageable image
to where it's needed.
The legacy OP-TEE images that do not include header information
are not affected.

Change-Id: Id057efbbc894de7c36b2209b391febea4729c455
Signed-off-by: Edison Ai <edison.ai@arm.com>

Trusted OS may have extra images to be loaded. Load them one by one
and do the parsing. In this patch, ARM TF need to load up to 3 images
for optee os: header, pager and paged images. Header image is the info
about optee os and images. Pager image include pager code and data.
Paged image include the paging parts using virtual memory.

Change-Id: Ia3bcfa6d8a3ed7850deb5729654daca7b00be394
Signed-off-by: Summer Qin <summer.qin@arm.com>

Since Trusted OS firmware may have extra images, need to
assign new uuid and image id for them.
The TBBR chain of trust has been extended to add support
for the new images within the existing Trusted OS firmware
content certificate.

Change-Id: I678dac7ba1137e85c5779b05e0c4331134c10e06
Signed-off-by: Summer Qin <summer.qin@arm.com>

The documentation describes the design of the translation tables
library version 2 used by the ARM Trusted Firmware.

The diagram file has been created with Dia version 0.97.2. This tool
can be obtained from: https://wiki.gnome.org/Apps/Dia/Download



Inkscape has been used to generate the *.png file from the *.dia file
to work around a bug in the generation of *.png files in some versions
of Dia.

Change-Id: Ie67d9998d4ae881b2c060200a318ad3ac2fa5e91
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

Fix to change.log

With the migration to .rst from .md, the Issues Resolved and
Known Issues sections for v1.4 were using Header 1 format.

This patch changes to using Header 2 for these sections.

Change-Id: Ic3127d84eb169a65039fd4cc8284c6429302732d
Signed-off-by: David Cunado <david.cunado@arm.com>

Fix order of #includes

Replace the use of r12 by r10 to save the value of a parameter of
bl2u_entrypoint to pass it to bl2u_early_platform_setup at the end of
the function. r10 is a callee saved register so it will not become
corrupted by C code, whereas r12 is the The Intra-Procedure-call scratch
register potentially used by veneers. See the ARM AAPCS document (ARM
IHI 0042F).

Change-Id: I4f37e54a6b550719edb40bb24cd8f498827e2749
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>

Revision C of the Base FVP has the same memory map as earlier revisions,
but has the following differences:

  - Implements CCI550 instead of CCI400,
  - Has a single instantiation of SMMUv3,
  - CPU MPIDs are shifted left by one level, and has MT bit set in them.

The correct interconnect to program is chosen at run time based on the
FVP revision. Therefore, this patch implements FVP functions for
interconnect programming, rather than depending on ARM generic ones. The
macros used have been renamed to reflect this change.

Additionally, this patch initializes SMMUv3 as part of FVP early
platform setup.

New ARM config flags are introduced for feature queries at run time.

Change-Id: Ic7b7f080953a51fceaf62ce7daa6de0573801f09
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

The driver has only one API: to initialize an SMMUv3 device. This
operates on a device that implements secure state, by invalidating
secure caches and TLBs.

Change-Id: Ief32800419ddf0f1fe38c8f0da8f5ba75c72c826
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

The current build system and driver requires the CCI product to be
specified at build time. The device constraints can be determined at run
time from its ID registers, obviating the need for specifying them
ahead.

This patch adds changes to identify and validate CCI at run time. Some
global variables are renamed to be in line with the rest of the code
base.

The build option ARM_CCI_PRODUCT_ID is now removed, and user guide is
updated.

Change-Id: Ibb765e349d3bc95ff3eb9a64bde1207ab710a93d
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

The CCI crash dump macros assumes CCI base at build time. Since this
can't be the case for CCI on FVP, choose not to register dump CCI
registers for FVP.

Change-Id: I7374a037e7fd0a85b138e84b3cf0aa044262da97
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

In contrast with the non-multi-threading DTS, this enumerates MPIDR
values shifted by one affinity level to the left. The newly added DTS
reflects CPUs with a single thread in them.

Since both DTS files are the same apart from MPIDR contents, the common
bits have been moved to a separate file that's then included from the
top-level DTS files. The multi-threading version only updates the MPIDR
contents.

Change-Id: Id225cd93574f764171df8962ac76f42fcb6bba4b
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

ARM CPUs with multi-threading implementation has more than one
Processing Element in a single physical CPU. Such an implementation will
reflect the following changes in the MPIDR register:

  - The MT bit set;

  - Affinity levels pertaining to cluster and CPUs occupy one level
    higher than in a single-threaded implementation, and the lowest
    affinity level pertains to hardware threads. MPIDR affinity level
    fields essentially appear shifted to left than otherwise.

The FVP port henceforth assumes that both properties above to be
concomitant on a given FVP platform.

To accommodate for varied MPIDR formats at run time, this patch
re-implements the FVP platform-specific functions that translates MPIDR
values to a linear indices, along with required validation. The same
treatment is applied for GICv3 MPIDR hashing function as well.

An FVP-specific build option FVP_MAX_PE_PER_CPU is introduced which
specifies the maximum number of threads implemented per CPU. For
backwards compatibility, its value defaults to 1.

Change-Id: I729b00d3e121d16ce9a03de4f9db36dfac580e3f
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

plat_get_my_stack is called from C, so it can't expect argument
registers to be preserved. Stash registers temporarily onto the stack
instead.

plat_set_my_stack is called during early init, when there exists no
stack. Use any register other than argument registers to stash temporary
values.

Change-Id: I98052e20671d0933201d45ec7a5affccd71ce08c
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>