GitLab

Move almost all system include files to a logical sub-directory
under ./include. The only remaining system include directories
not under ./include are specific to the platform. Move the
corresponding source files to match the include directory
structure.

Also remove pm.h as it is no longer used.

Change-Id: Ie5ea6368ec5fad459f3e8a802ad129135527f0b3

- Use the TrustZone controller on Base FVP to program DRAM access
  permissions. By default no access to DRAM is allowed if
  'secure memory' is enabled on the Base FVP.
- The Foundation FVP does not have a TrustZone controller but instead
  has fixed access permissions.
- Update FDTs for Linux to use timers at the correct security level.
- Starting the FVPs with 'secure memory' disabled is also supported.

Limitations:
Virtio currently uses a reserved NSAID. This will be corrected in
future FVP releases.

Change-Id: I0b6c003a7b5982267815f62bcf6eb82aa4c50a31

Remove redundant code in plat_secondary_cold_boot_setup() in
plat/fvp/aarch64/bl1_plat_helpers.S.

Fixes ARM-software/tf-issues#136

Change-Id: I98c0a46d95cfea33125e34e609c83dc2c97cd86e

The BL images share common stack management code which provides
one coherent and one cacheable stack for every CPU. BL1 and BL2
just execute on the primary CPU during boot and do not require
the additional CPU stacks. This patch provides separate stack
support code for UP and MP images, substantially reducing the
RAM usage for BL1 and BL2 for the FVP platform.

This patch also provides macros for declaring stacks and
calculating stack base addresses to improve consistency where
this has to be done in the firmware.

The stack allocation source files are now included via
platform.mk rather than the common BLx makefiles. This allows
each platform to select the appropriate MP/UP stack support
for each BL image.

Each platform makefile must be updated when including this
commit.

Fixes ARM-software/tf-issues#76

Change-Id: Ia251f61b8148ffa73eae3f3711f57b1ffebfa632

Rename the array "mmap" in plat/fvp/aarch64/plat_common.c to
"fvp_mmap", to avoid confusion with the array of the same name
in lib/arch/aarch64/xlat_tables.c

Fixes ARM-software/tf-issues#114

Change-Id: I61478c0070aa52d5dcf5d85af2f353f56c060cfb

Rename drivers/console/console.c to
drivers/arm/peripherals/pl011/pl011_console.c. This makes it clear
that this is a pl011 specific console implementation.

Fixes ARM-software/tf-issues#129

Change-Id: Ie2f8109602134c5b86993e32452c70734c45a3ed

BL3-1 architecture setup code programs the system counter frequency
into the CNTFRQ_EL0 register. This frequency is defined by the
platform, though. This patch introduces a new platform hook that
the architecture setup code can call to retrieve this information.
In the ARM FVP port, this returns the first entry of the frequency
modes table from the memory mapped generic timer.

All system counter setup code has been removed from BL1 as some
platforms may not have initialized the system counters at this stage.
The platform specific settings done exclusively in BL1 have been moved
to BL3-1. In the ARM FVP port, this consists in enabling and
initializing the System level generic timer. Also, the frequency change
request in the counter control register has been set to 0 to make it
explicit it's using the base frequency. The CNTCR_FCREQ() macro has been
fixed in this context to give an entry number rather than a bitmask.

In future, when support for firmware update is implemented, there
is a case where BL1 platform specific code will need to program
the counter frequency. This should be implemented at that time.

This patch also updates the relevant documentation.

It properly fixes ARM-software/tf-issues#24

Change-Id: If95639b279f75d66ac0576c48a6614b5ccb0e84b

This reverts commit 1c297bf0
because it introduced a bug: the CNTFRQ_EL0 register was no
longer programmed by all CPUs.  bl31_platform_setup() function
is invoked only in the cold boot path and consequently only
on the primary cpu.

A subsequent commit will correctly implement the necessary changes
to the counter frequency setup code.

Fixes ARM-software/tf-issues#125

Conflicts:

	docs/firmware-design.md
	plat/fvp/bl31_plat_setup.c

Change-Id: Ib584ad7ed069707ac04cf86717f836136ad3ab54

This extends the --gc-sections behaviour to the many assembler
support functions in the firmware images by placing each function
into its own code section. This is achieved by creating a 'func'
macro used to declare each function label.

Fixes ARM-software/tf-issues#80

Change-Id: I301937b630add292d2dec6d2561a7fcfa6fec690

This patch reworks the console driver to ensure that each bootloader stage
initializes it independently. As a result, both BL3-1 and BL2 platform code
now calls console_init() instead of relying on BL1 to perform console setup

Fixes ARM-software/tf-issues#120

Change-Id: Ic4d66e0375e40a2fc7434afcabc8bbb4715c14ab

This commit isolates the accessor functions in pl011.c and builds
a wrapper layer for console functions.

This also modifies the console driver to use the pl011 FIFO.

Fixes ARM-software/tf-issues#63

Change-Id: I3b402171cd14a927831bf5e5d4bb310b6da0e9a8

This patch adds support in the generic PSCI implementation to call a
platform specific function to enter a standby state using an example
implementation in ARM FVP port

Fixes ARM-software/tf-issues#94
Change-Id: Ic1263fcf25f28e09162ad29dca954125f9aa8cc9

Trusted firmware binaries loaded via semihosting used to be
opened using 'r' mode (i.e. read mode).  This is fine on POSIX
conforming systems (including Linux) but for Windows it also means
that the file should be opened in text mode. 'rb' mode must be
specified instead for binary mode.  On POSIX conforming systems,
'rb' mode is equivalent to 'r' mode so it does no harm.

Fixes ARM-software/tf-issues#69

Change-Id: Ifa53f2ecfd765f572dea5dd73191f9fe2b2c2011

Each ARM Trusted Firmware image should know in which EL it is running
and it should use the corresponding register directly instead of reading
currentEL and knowing which asm register to read/write

Change-Id: Ief35630190b6f07c8fbb7ba6cb20db308f002945

Remove the hard coding of all the MMU related registers with 0 and disable MMU
by clearing the M and C bit in SCTLR_ELx

Change-Id: I4a0b1bb14a604734b74c32eb31315d8504a7b8d8

At present, bl1_arch_setup() and bl31_arch_setup() program the counter
frequency using a value from the memory mapped generic timer. The
generic timer however is not necessarily present on all ARM systems
(although it is architected to be present on all server systems).

This patch moves the timer setup to platform-specific code and updates
the relevant documentation. Also, CNTR.FCREQ is set as the specification
requires the bit corresponding to the counter's frequency to be set when
enabling. Since we intend to use the base frequency, set bit 8.

Fixes ARM-software/tf-issues#24

Change-Id: I32c52cf882253e01f49056f47c58c23e6f422652

This patch removes the 'CPU present' flag that's being set but not
referred or used anywhere else.

Change-Id: Iaf82bdb354134e0b33af16c7ba88eb2259b2682a

Fixes ARM-software/tf-issues#41

The policy functions for each file to be loaded were implemented by
copy/pasting one method and then varying the data checked.

This patch creates a generic function to check the policy based on the
data stored in a table.

This removes the amount of duplicated code but also makes the code
simpler and more efficient.

Change-Id: I1c52eacf6f18a1442dabbb33edd03d4bb8bbeae0
Signed-off-by: Ryan Harkin <ryan.harkin@linaro.org>

Change-Id: I559c5a4d86cad55ce3f6ad71285b538d3cfd76dc
Signed-off-by: Jon Medhurst <tixy@linaro.org>

This change requires all platforms to now specify a list of source files
rather than object files.

New source files should preferably be specified by using the path as
well and we should add this in the future for all files so we can remove
use of vpath. This is desirable because vpath hides issues like the fact
that BL2 currently pulls in a BL1 file bl1/aarch64/early_exceptions.S
and if in the future we added bl2/aarch64/early_exceptions.S then it's
likely only one of the two version would be used for both bootloaders.

This change also removes the 'dump' build target and simply gets
bootloaders to always generate a dump file. At the same time the -x
option is added so the section headers and symbols table are listed.

Fixes ARM-software/tf-issues#11

Change-Id: Ie38f7be76fed95756c8576cf3f3ea3b7015a18dc
Signed-off-by: Jon Medhurst <tixy@linaro.org>

Make gicd_set_ipriorityr() actually write to the priority register.

Also correct callers of this function which want the highest priority
to use the value zero as this is the highest priority value according
to the ARM Generic Interrupt Controller Architecture Specification.

To make this easier to get right, we introduce defines for the lowest
and highest priorities for secure and non-secure interrupts.

Fixes ARM-software/tf-issues#21
Signed-off-by: Jon Medhurst <tixy@linaro.org>

The UART used to be initialised in bl1_platform_setup(). This is too
late because there are some calls to the assert() macro, which needs
to print some messages on the console, before that.

This patch moves the UART initialisation code to
bl1_early_platform_setup().

Fixes ARM-software/tf-issues#49

Change-Id: I98c83a803866372806d2a9c2e1ed80f2ef5b3bcc

At present many recoverable failures are reported as errors. This patch
modifies all such failures to be reported as warnings instead.

Change-Id: I5141653c82498defcada9b90fdf7498ba496b2f2

This patch adds the TSPD service which is responsible for managing
communication between the non-secure state and the Test Secure Payload
(TSP) executing in S-EL1.

The TSPD does the following:

1. Determines the location of the TSP (BL3-2) image and passes control
   to it for initialization. This is done by exporting the 'bl32_init()'
   function.

2. Receives a structure containing the various entry points into the TSP
   image as a response to being initialized. The TSPD uses this
   information to determine how the TSP should be entered depending on
   the type of operation.

3. Implements a synchronous mechanism for entering into and returning
   from the TSP image. This mechanism saves the current C runtime
   context on top of the current stack and jumps to the TSP through an
   ERET instruction. The TSP issues an SMC to indicate completion of the
   previous request. The TSPD restores the saved C runtime context and
   resumes TSP execution.

This patch also introduces a Make variable 'SPD' to choose the specific
SPD to include in the build. By default, no SPDs are included in the
build.

Change-Id: I124da5695cdc510999b859a1bf007f4d049e04f3
Co-authored-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

This patch adds a simple TSP as the BL3-2 image. The secure payload
executes in S-EL1. It paves the way for the addition of the TSP
dispatcher runtime service to BL3-1. The TSP and the dispatcher service
will serve as an example of the runtime firmware's ability to toggle
execution between the non-secure and secure states in response to SMC
request from the non-secure state.  The TSP will be replaced by a
Trusted OS in a real system.

The TSP also exports a set of handlers which should be called in
response to a PSCI power management event e.g a cpu being suspended or
turned off. For now it runs out of Secure DRAM on the ARM FVP port and
will be moved to Secure SRAM later. The default translation table setup
code assumes that the caller is executing out of secure SRAM. Hence the
TSP exports its own translation table setup function.

The TSP only services Fast SMCs, is non-reentrant and non-interruptible.
It does arithmetic operations on two sets of four operands, one set
supplied by the non-secure client, and the other supplied by the TSP
dispatcher in EL3. It returns the result according to the Secure Monitor
Calling convention standard.

This TSP has two functional entry points:

- An initial, one-time entry point through which the TSP is initialized
  and prepares for receiving further requests from secure
  monitor/dispatcher

- A fast SMC service entry point through which the TSP dispatcher
  requests secure services on behalf of the non-secure client

Change-Id: I24377df53399307e2560a025eb2c82ce98ab3931
Co-authored-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

This patch adds the ability to specify the base address of a UART
device for initialising the console. This allows a boot loader stage
to use a different UART device from UART0 (default) for the console.

Change-Id: Ie60b927389ae26085cfc90d22a564ff83ba62955

This patch factors out the ARM FVP specific code to create MMU
translation tables so that it is possible for a boot loader stage to
create a different set of tables instead of using the default ones.
The default translation tables are created with the assumption that
the calling boot loader stage executes out of secure SRAM. This might
not be true for the BL3_2 stage in the future.

A boot loader stage can define the `fill_xlation_tables()` function as
per its requirements. It returns a reference to the level 1
translation table which is used by the common platform code to setup
the TTBR_EL3.

This patch is a temporary solution before a larger rework of
translation table creation logic is introduced.

Change-Id: I09a075d5da16822ee32a411a9dbe284718fb4ff6

This patch adds the following support to the BL3-1 stage:

1. BL3-1 allows runtime services to specify and determine the security
   state of the next image after BL3-1. This has been done by adding
   the `bl31_set_next_image_type()` & `bl31_get_next_image_type()`
   apis. The default security state is non-secure. The platform api
   `bl31_get_next_image_info()` has been modified to let the platform
   decide which is the next image in the desired security state.

2. BL3-1 exports the `bl31_prepare_next_image_entry()` function to
   program entry into the target security state. It uses the apis
   introduced in 1. to do so.

3. BL3-1 reads the information populated by BL2 about the BL3-2 image
   into its internal data structures.

4. BL3-1 introduces a weakly defined reference `bl32_init()` to allow
   initialisation of a BL3-2 image. A runtime service like the Secure
   payload dispatcher will define this function if present.

Change-Id: Icc46dcdb9e475ce6575dd3f9a5dc7a48a83d21d1

This patch adds support for loading a BL3-2 image in BL2. In case a
BL3-2 image is found, it also passes information to BL3-1 about where it
is located and the extents of memory available to it. Information about
memory extents is populated by platform specific code.

The documentation has also been updated to reflect the above changes.

Change-Id: I526b2efb80babebab1318f2b02e319a86d6758b0
Co-authored-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

This patch reworks BL2 to BL3-1 hand over interface by introducing a
composite structure (bl31_args) that holds the superset of information
that needs to be passed from BL2 to BL3-1.

  - The extents of secure memory available to BL3-1
  - The extents of memory available to BL3-2 (not yet implemented) and
    BL3-3
  - Information to execute BL3-2 (not yet implemented) and BL3-3 images

This patch also introduces a new platform API (bl2_get_bl31_args_ptr)
that needs to be implemented by the platform code to export reference to
bl31_args structure which has been allocated in platform-defined memory.

The platform will initialize the extents of memory available to BL3-3
during early platform setup in bl31_args structure. This obviates the
need for bl2_get_ns_mem_layout platform API.

BL2 calls the bl2_get_bl31_args_ptr function to get a reference to
bl31_args structure. It uses the 'bl33_meminfo' field of this structure
to load the BL3-3 image. It sets the entry point information for the
BL3-3 image in the 'bl33_image_info' field of this structure. The
reference to this structure is passed to the BL3-1 image.

Also fixes issue ARM-software/tf-issues#25

Change-Id: Ic36426196dd5ebf89e60ff42643bed01b3500517

This patch moves the translation tables into their own section. This
saves space that would otherwise have been lost in padding due to page
table alignment constraints. The BL31 and BL32 bases have been
consequently adjusted.

Change-Id: Ibd65ae8a5ce4c4ea9a71a794c95bbff40dc63e65

The Firmware Image Package (FIP) driver allows for data to be loaded
from a FIP on platform storage. The FVP supports loading bootloader
images from a FIP located in NOR FLASH.

The implemented FVP policy states that bootloader images will be
loaded from a FIP in NOR FLASH if available and fall back to loading
individual images from semi-hosting.

NOTE:
- BL3-3(e.g. UEFI) is loaded into DRAM and needs to be configured
  to run from the BL33_BASE address. This is currently set to
  DRAM_BASE+128MB for the FVP.

Change-Id: I2e4821748e3376b5f9e467cf3ec09509e43579a0

The modified implementation uses the IO abstraction rather than
making direct semi-hosting calls.  The semi-hosting driver is now
registered for the FVP platform during initialisation of each boot
stage where it is used.  Additionally, the FVP platform includes a
straightforward implementation of 'plat_get_image_source' which
provides a generic means for the 'load_image' function to determine
how to access the image data.

Change-Id: Ia34457b471dbee990c7b3c79de7aee4ceea51aa6

This is intended primarily for use as a storage abstraction.
It allows operations such as image-loading to be implemented
in a platform-independent fashion.  Each platform registers
a set of IO drivers during initialisation.  The platform must
also provide a function that will return a device and a specifier
that can be used to access specified content.

Clients of the API will primarily use device and entity handles.
The term "entity" is deliberately vague, to allow for different
representations of content accessed using different types of
specifier, but will often be interpreted as a "file" where the
specifier will normally be its path.

This commit builds, but is intended to be paired with a sample
implementation of "load_image" using a semi-hosting driver on FVP.

Change-Id: Id3b52f1c0eb9ce76b44b99fc6b6460803668cc86

Also fix warnings generated in release builds when assert code
is absent.

Change-Id: I45b9173d3888f9e93e98eb5b4fdc06727ba5cbf4

The last CPU in a cluster is responsible for issuing the cluster power
down request to the FVP power controller. If another CPU in this
cluster wakes up before the last CPU enters WFI then the cluster power
down request remains pending. If this request is not cancelled and the
newly woken up CPU enters a simple WFI later, the power controller
powers the cluster down. This leads to unpredictable behaviour.

This patch fixes this issue by ensuring that the first CPU to wake up
in a cluster writes its MPIDR to the power controller's PPONR. This
cancels any pending cluster power down request.

Change-Id: I7e787adfd6c9a0bd7308390e3309d46f35c01086

The FVP platform has a few filenames that begin with fvp_.  These are
renamed to plat_ to make it easier to use the FVP port as a template.

Change-Id: I601e6256d5ef3bae81a2e1f5df6de56db5b27069
Signed-off-by: Ryan Harkin <ryan.harkin@linaro.org>

Tidy up the spacing of variable definitions within the makefiles to make
them more consistent, easier to read and amend.

Change-Id: Ic6d7c8489ca4330824abb5cd1ead8f1d449d1a85
Signed-off-by: Ryan Harkin <ryan.harkin@linaro.org>

Move all explicit platform or architecture specific references
into a new platform.mk file that is defined for each platform.

Change-Id: I9d6320d1ba957e0cc8d9b316b3578132331fa428
Signed-off-by: Ryan Harkin <ryan.harkin@linaro.org>

Ctags seem to have a problem with generating tags for assembler symbols
when a comment immediately follows an assembly label.

This patch inserts a single space character between the label
definition and the following comments to help ctags.

The patch is generated by the command:

  git ls-files -- \*.S | xargs sed -i 's/^\([^:]\+\):;/\1: ;/1'

Change-Id: If7a3c9d0f51207ea033cc8b8e1b34acaa0926475