GitLab

Add two timestamps to measure PSCI cache flush overhead

Fixes and improvements to translation tables library

Update Foundation Model version

Fix incorrect copyright notices

Foundation Model release 10.2 has been made available and Trusted
Firmware has been tested against that it as part of its CI system.

This patch updates the user guide documentation to reflect the version
of Foundation Model that Trusted Firmware has been tested against.

Change-Id: I8571e1027b24892b41d04b93b24245a371ca2cae
Signed-off-by: David Cunado <david.cunado@arm.com>

Fix integer comparison in memcpy16

Some files have incorrect copyright notices, this patch fixes all
files with deviations from the standard notice.

Change-Id: I66b73e78a50a235acb55f1e2ec2052a42c0570d2
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Unsigned conditions should be used instead of signed ones when comparing
addresses or sizes in assembly.
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
Change-Id: Id3bd9ccaf58c37037761af35ac600907c4bb0580

Testing showed that the time spent in a cluster power down
operation is dominated by cache flushes.  Add two more timestamps
in runtime instrumentation to keep track of the time spent
flushing the L1/L2 caches.

Change-Id: I4c5a04e7663543225a85d3c6b271d7b706deffc4
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

Docs: Fix monospace formatting in user guide

stdlib: Fix signedness issue in memcmp()

AArch32: Fix the stack alignment issue

In AArch64, depending on the granularity of the translation tables,
level 0 and/or level 1 of the translation tables may not support block
descriptors, only table descriptors.

This patch introduces a check to make sure that, even if theoretically
it could be possible to create a block descriptor to map a big memory
region, a new subtable will be created to describe its mapping.

Change-Id: Ieb9c302206bfa33fbaf0cdc6a5a82516d32ae2a7
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

The now deprecated ADDR_SPACE_SIZE has been replaced by the two
defines PLAT_PHY_ADDR_SPACE_SIZE and PLAT_VIRT_ADDR_SPACE_SIZE.

Change-Id: I027a2f02f47ab2f679b8979a6dbfb0f08270a1a4
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Added the definitions `PLAT_PHY_ADDR_SPACE_SIZE` and
`PLAT_VIRT_ADDR_SPACE_SIZE` which specify respectively the physical
and virtual address space size a platform can use.

`ADDR_SPACE_SIZE` is now deprecated. To maintain compatibility, if any
of the previous defines aren't present, the value of `ADDR_SPACE_SIZE`
will be used instead.

For AArch64, register ID_AA64MMFR0_EL1 is checked to calculate the
max PA supported by the hardware and to verify that the previously
mentioned definition is valid. For AArch32, a 40 bit physical
address space is considered.

Added asserts to check for overflows.

Porting guide updated.

Change-Id: Ie8ce1da5967993f0c94dbd4eb9841fc03d5ef8d6
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Each translation table level entry can only map a given virtual
address onto physical addresses of the same granularity. For example,
with the current configuration, a level 2 entry maps blocks of 2 MB,
so the physical address must be aligned to 2 MB. If the address is not
aligned, the MMU will just ignore the lower bits.

This patch adds an assertion to make sure that physical addresses are
always aligned to the correct boundary.

Change-Id: I0ab43df71829d45cdbe323301b3053e08ca99c2c
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Change-Id: I28b2790ff2f87b9fe3cf1020e59e1e0a00be6f97
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

There is no guarantee on the signedness of char.  It can be either
signed or unsigned.  On ARM it is unsigned and hence this memcmp()
implementation works as intended.

On other machines, char can be signed (x86 for example).  In that case
(and assuming a 2's complement implementation), interpreting a
bit-pattern of 0xFF as signed char can yield -1.  If *s1 is 0 and *s2
is 255 then the difference *s1 - *s2 should be negative.  The C
integer promotion rules guarantee that the unsigned chars will be
converted to int before the operation takes place.  The current
implementation will return a positive value (0 - (-1)) instead, which
is wrong.

Fix it by changing the signedness to unsigned to avoid surprises for
anyone using this code on non-ARM systems.

Change-Id: Ie222fcaa7c0c4272d7a521a6f2f51995fd5130cc
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

The AArch32 Procedure call Standard mandates that the stack must be aligned
to 8 byte boundary at external interfaces. This patch does the required
changes.

This problem was detected when a crash was encountered in
`psci_print_power_domain_map()` while printing 64 bit values. Aligning
the stack to 8 byte boundary resolved the problem.

Fixes ARM-Software/tf-issues#437

Change-Id: I517bd8203601bb88e9311bd36d477fb7b3efb292
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

Define and use no_ret macro where no return is expected

Various fiptool enhancements and bug fixes

Reset EL2 and EL3 configurable controls

AArch32: Miscellaneous fixes in the AArch32 code

Optimize cache flush when authenticating images

Introduce SCP power management abstraction

The capabilities exposed by the PSCI generic layer depends on the hooks
populated by the platform in `plat_arm_psci_pm_ops`. Currently ARM
Standard platforms statically define this structure. However, some
platforms may want to modify the hooks at runtime before registering
them with the generic layer.

This patch introduces a new ARM platform layer API
`plat_arm_psci_override_pm_ops` which allows the platform to probe
the power controller and modify `plat_arm_psci_pm_ops` if required.
Consequently, 'plat_arm_psci_pm_ops' is no longer qualified as
`const` on ARM Standard platforms.

Change-Id: I7dbb44b7bd36c20ec14ded5ee45a96816ca2ab9d
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

This patch introduces an additional layer of abstraction between
CSS power management hooks and the SCPI driver. A new set of APIs
are introduced in order to abstract out power management operations
from underlying communication mechanism with the SCP.

The SCPI and the associated MHU drivers are moved into a `drivers`
folder in CSS. The new SCP communication abstraction layer is added
in the `drivers/scp` folder. The existing CSS power management
uses the new APIs to reflect this abstraction.

Change-Id: I7d775129fc0558e9703c2724523fb8f0a916838c
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

There are many instances in ARM Trusted Firmware where control is
transferred to functions from which return isn't expected. Such jumps
are made using 'bl' instruction to provide the callee with the location
from which it was jumped to. Additionally, debuggers infer the caller by
examining where 'lr' register points to. If a 'bl' of the nature
described above falls at the end of an assembly function, 'lr' will be
left pointing to a location outside of the function range. This misleads
the debugger back trace.

This patch defines a 'no_ret' macro to be used when jumping to functions
from which return isn't expected. The macro ensures to use 'bl'
instruction for the jump, and also, for debug builds, places a 'nop'
instruction immediately thereafter (unless instructed otherwise) so as
to leave 'lr' pointing within the function range.

Change-Id: Ib34c69fc09197cfd57bc06e147cc8252910e01b0
Co-authored-by: Douglas Raillard <douglas.raillard@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Change-Id: Ie3e43e9f7d31df40a5997047b9bddec0a06fd47f
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

Change-Id: I18a4327e41fc090dcea9a647f7673182ca0ed1d9
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

Change-Id: I62c1a636eb0d9f73fa3a6356e32b5a44f268d421
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

Additionally, remove the -o option for the create command
as it is not supported.

Change-Id: I27993a6fc5e3b0b9710e2ec5322e4296bc87d0df
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

This patch resets EL2 and EL3 registers that have architecturally
UNKNOWN values on reset and that also provide EL2/EL3 configuration
and trap controls.

Specifically, the EL2 physical timer is disabled to prevent timer
interrups into EL2 - CNTHP_CTL_EL2 and CNTHP_CTL for AArch64 and AArch32,
respectively.

Additionally, for AArch64, HSTR_EL2 is reset to avoid unexpected traps of
non-secure access to certain system registers at EL1 or lower.

For AArch32, the patch also reverts the reset to SDCR which was
incorrectly added in a previous change.

Change-Id: If00eaa23afa7dd36a922265194ccd6223187414f
Signed-off-by: David Cunado <david.cunado@arm.com>

For C99 compliance, changed the unsigned char/short bitfield to unsigned int bitfields

C99 restricts bitfields type is signed and unsigned integer or _Bool.
See section 6.7.2.1 Structure and union specifiers.
"A bit-field shall have a type that is a qualified or unqualified version
 of _Bool, signed int, unsigned int, or some other implementation-defined type."

Since the compiler packs bitfields anyways, actual data layout in the structure is unaffected.
Signed-off-by: Alex Nemirovsky <alex.nemirovsky@cortina-access.com>

This patch makes following miscellaneous fixes:
* pl011_console.S: Fixed the bit mask used to check if the
  transmit FIFO is full or empty.
* smcc_macros.S: Added `_fsxc` suffix while updating the SPSR.
  By default the assembler assumes `_fc` suffix which does not
  update all the fields in SPSR. By adding `_fsxc` suffix all
  the fields gets updated.
* platform_helpers.S: Removed the weak definition for
  `plat_my_core_pos()` as this is a mandatory function which
  needs to be defined by all platforms.

Change-Id: I8302292533c943686fff8d7c749a07132c052a3b
Signed-off-by: Yatharth Kochar <yatharth.kochar@arm.com>

Check Trusty is present during the SPD's initialization

Fix normal memory bakery lock implementation

Add a debug assertion in the initialization function of Trusty's SPD
to check for the presence of Trusty. If Trusty is absent then the SPD's
setup function already detects it and returns an error code so the init
function will never been called. Therefore, a debug assertion is enough
to catch this improbable error case.

Change-Id: Id20013e9291cdeef7827b919de2a22455f6cd9f9
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

When loading and authenticating an image, all parent images must also
be authenticated. The parent images are just certificates that don't
need to be used by any other CPU except the one loading the image, and
so there is no need to flush the cache of memory regions where they
are loaded.

Change-Id: Ice8d6979d1c02eabf1a543281ae1a07d098e4a99
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>