- 05 Feb, 2021 1 commit
-
-
Jimmy Brisson authored
This adds the TRNG Firmware Interface Service to the standard service dispatcher. This includes a method for dispatching entropy requests to platforms and includes an entropy pool implementation to avoid dropping any entropy requested from the platform. Change-Id: I71cadb3cb377a507652eca9e0d68714c973026e9 Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com> Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-
- 30 Nov, 2020 1 commit
-
-
Alexei Fedorov authored
This patch provides the changes listed below: - Adds new bit fields definitions for SCTLR_EL1/2 registers - Corrects the name of SCTLR_EL1/2.[20] bit field from SCTLR_UWXN_BIT to SCTLR_TSCXT_BIT - Adds FEAT_PANx bit field definitions and their possible values for ID_AA64MMFR1_EL1 register. - Adds setting of SCTLR_EL1.SPAN bit to preserve PSTATE.PAN on taking an exception to EL1 in spm_sp_setup() function (services\std_svc\spm_mm\spm_mm_setup.c) Change-Id: If51f20e7995c649126a7728a4d0867041fdade19 Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
-
- 02 Oct, 2020 1 commit
-
-
Andre Przywara authored
With -Wsign-compare, compilers issue a warning in the SPMD code: ==================== services/std_svc/spmd/spmd_pm.c:35:22: error: comparison of integer expressions of different signedness: 'int' and 'unsigned int' [-Werror=sign-compare] 35 | if ((id < 0) || (id >= PLATFORM_CORE_COUNT)) { | ^~ cc1: all warnings being treated as errors ==================== Since we just established that "id" is positive, we can safely cast it to an unsigned type to make the comparison have matching types. Change-Id: I6ef24804c88136d7e3f15de008e4fea854f10ffe Signed-off-by: Andre Przywara <andre.przywara@arm.com>
-
- 07 Sep, 2020 1 commit
-
-
Max Shvetsov authored
spmd_get_context_by_mpidr was using potentially negative value as an array index. plat_core_pos_by_mpidr could return -1 on failure which is utilized by some platforms. Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com> Change-Id: I7f8827e77f18da389c9cafdc1fc841aba9f03120
-
- 01 Sep, 2020 1 commit
-
-
Varun Wadekar authored
This patch removes the assert that expects the SPMC PC value to be same as BL32_BASE. This assumption is not true for all platforms e.g. Tegra, and so will be removed from the SPMD. Platforms can always add this check to the platform files, if required. Change-Id: Ic40620b43d160feb4f72f4af18e6d01861d4bf37 Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
-
- 21 Aug, 2020 1 commit
-
-
Ruari Phipps authored
Signed-off-by: Ruari Phipps <ruari.phipps@arm.com> Change-Id: I4e9fbfcfda4ed4b87d5ece1c609c57c73d617d4c
-
- 20 Aug, 2020 8 commits
-
-
Olivier Deprez authored
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com> Change-Id: Icdb15b8664fb3467ffd55b44d1f0660457192586
-
Olivier Deprez authored
Define SPMD PM hooks for warm boot and off events. svc_on_finish handler enters the SPMC at the entry point defined by the secondary EP register service. The svc_off handler notifies the SPMC that a physical core is being turned off through a notification message. Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Change-Id: I2609a75a0c6ffb9f6313fc09553be2b29a41de59
-
Olivier Deprez authored
Upon booting, the SPMC running on the primary core shall register the secondary core entry points to which a given secondary core being woken up shall jump to into the SPMC . The current implementation assumes the SPMC calls a registering service implemented in the SPMD for each core identified by its MPIDR. This can typically happen in a simple loop implemented in the early SPMC initialization routines by passing each core identifier associated with an entry point address and context information. This service is implemented on top of a more generic SPMC<=>SPMD interface using direct request/response message passing as defined by the FF-A specification. Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com> Change-Id: I1f70163b6b5cee0880bd2004e1fec41e3780ba35
-
Olivier Deprez authored
FF-A interface to handle SPMC to SPMD direct messages requests. Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com> Change-Id: Ia707a308c55561a31dcfa86e554ea1c9e23f862a
-
Olivier Deprez authored
Change-Id: If88d64c0e3d60accd2638a55f9f3299ec700a8c8 Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
-
Olivier Deprez authored
This patch defines and registers the SPMD PM handler hooks. This is intended to relay boot and PM events to the SPMC. Change-Id: If5a758d22b8d2152cbbb83a0cad563b5e1c6bd49 Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
-
Olivier Deprez authored
This patch adds SPMC states used by the SPMD to track SPMC boot phases specifically on secondary cores. Change-Id: If97af7352dda7f04a8e46a56892a2aeddcfab91b Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
-
Olivier Deprez authored
This patch provides a helper to get the entry_point_info structure used by the boot CPU as it is used to initialise the SPMC context on secondary CPUs. Change-Id: I99087dc7a86a7258e545d24a2ff06aa25170f00c Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
-
- 23 Jun, 2020 1 commit
-
-
J-Alves authored
Change handler of FFA version interface: - Return SPMD's version if the origin of the call is secure; - Return SPMC's version if origin is non-secure. Signed-off-by: J-Alves <joao.alves@arm.com> Change-Id: I0d1554da79b72b1e02da6cc363a2288119c32f44
-
- 02 Jun, 2020 1 commit
-
-
Masahisa Kojima authored
Core spm_mm code expects the translation tables are located in the inner & outer WBWA & shareable memory. REGISTER_XLAT_CONTEXT2 macro is used to specify the translation table section in spm_mm. In the commit 363830df (xlat_tables_v2: merge REGISTER_XLAT_CONTEXT_{FULL_SPEC,RO_BASE_TABLE}), REGISTER_XLAT_CONTEXT2 macro explicitly specifies the base xlat table goes into .bss by default. This change affects the existing SynQuacer spm_mm implementation. plat/socionext/synquacer/include/plat.ld.S linker script intends to locate ".bss.sp_base_xlat_table" into "sp_xlat_table" section, but this implementation is no longer available. This patch adds the base table section name parameter for REGISTER_XLAT_CONTEXT2 so that platform can specify the inner & outer WBWA & shareable memory for spm_mm base xlat table. If PLAT_SP_IMAGE_BASE_XLAT_SECTION_NAME is not defined, base xlat table goes into .bss by default, the result is same as before. Change-Id: Ie0e1a235e5bd4288dc376f582d6c44c5df6d31b2 Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
-
- 25 May, 2020 1 commit
-
-
J-Alves authored
SPCI is renamed as PSA FF-A which stands for Platform Security Architecture Firmware Framework for A class processors. This patch replaces the occurrence of SPCI with PSA FF-A(in documents) or simply FFA(in code). Change-Id: I4ab10adb9ffeef1ff784641dfafd99f515133760 Signed-off-by: J-Alves <joao.alves@arm.com>
-
- 15 May, 2020 1 commit
-
-
Balint Dobszay authored
This patch introduces dynamic configuration for SDEI setup and is supported when the new build flag SDEI_IN_FCONF is enabled. Instead of using C arrays and processing the configuration at compile time, the config is moved to dts files. It will be retrieved at runtime during SDEI init, using the fconf layer. Change-Id: If5c35a7517ba00a9f258d7f3e7c8c20cee169a31 Signed-off-by: Balint Dobszay <balint.dobszay@arm.com> Co-authored-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
-
- 13 May, 2020 2 commits
-
-
Olivier Deprez authored
Currently BL2 passes TOS_FW_CONFIG address and size through registers to BL31. This corresponds to SPMC manifest load address and size. The SPMC manifest is mapped in BL31 by dynamic mapping. This patch removes BL2 changes from generic code (which were enclosed by SPD=spmd) and retrieves SPMC manifest size directly from within SPMD. The SPMC manifest load address is still passed through a register by generic code. Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Change-Id: I35c5abd95c616ae25677302f0b1d0c45c51c042f
-
Olivier Deprez authored
As a follow-up to bdd2596d , and related to SPM Dispatcher EL3 component and SPM Core S-EL2/S-EL1 component: update with cosmetic and coding rules changes. In addition: -Add Armv8.4-SecEL2 arch detection helper. -Add an SPMC context (on current core) get helper. -Return more meaningful error return codes. -Remove complexity in few spmd_smc_handler switch-cases. -Remove unused defines and structures from spmd_private.h Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Change-Id: I99e642450b0dafb19d3218a2f0e2d3107e8ca3fe
-
- 12 Mar, 2020 1 commit
-
-
Max Shvetsov authored
This patch introduces the `SPCI_ID_GET` interface which will return the ID of the calling SPCI component. Returns 0 for requests from the non-secure world and the SPCI component ID as specified in the manifest for secure world requests. Change-Id: Icf81eb1d0e1d7d5c521571e04972b6e2d356e0d1 Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com> Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
-
- 03 Mar, 2020 4 commits
-
-
Max Shvetsov authored
Added SPMD_SPM_AT_SEL2 build command line parameter. Set to 1 to run SPM at S-EL2. Set to 0 to run SPM at S-EL1 (pre-v8.4 or S-EL2 is disabled). Removed runtime EL from SPM core manifest. Change-Id: Icb4f5ea4c800f266880db1d410d63fe27a1171c0 Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com> Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
-
Olivier Deprez authored
Change-Id: Icc8f73660453a2cbb2241583684b615d5d1af9d4 Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
-
Max Shvetsov authored
Change-Id: I8881d489994aea667e3dd59932ab4123f511d6ba Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com> Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
-
Max Shvetsov authored
This patch adds EL2 registers that are supported up to ARMv8.6. ARM_ARCH_MINOR has to specified to enable save/restore routine. Note: Following registers are still not covered in save/restore. * AMEVCNTVOFF0<n>_EL2 * AMEVCNTVOFF1<n>_EL2 * ICH_AP0R<n>_EL2 * ICH_AP1R<n>_EL2 * ICH_LR<n>_EL2 Change-Id: I4813f3243e56e21cb297b31ef549a4b38d4876e1 Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
-
- 02 Mar, 2020 1 commit
-
-
Max Shvetsov authored
NOTE: Not all EL-2 system registers are saved/restored. This subset includes registers recognized by ARMv8.0 Change-Id: I9993c7d78d8f5f8e72d1c6c8d6fd871283aa3ce0 Signed-off-by: Jose Marinho <jose.marinho@arm.com> Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com> Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
-
- 10 Feb, 2020 2 commits
-
-
Achin Gupta authored
This patch adds support to initialise the SPM dispatcher as a standard secure service. It also registers a handler for SPCI SMCs exported by the SPM dispatcher. Signed-off-by: Achin Gupta <achin.gupta@arm.com> Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com> Change-Id: I2183adf826d08ff3fee9aee75f021021162b6477
-
Achin Gupta authored
This patch adds a rudimentary SPM dispatcher component in EL3. It does the following: - Consumes the TOS_FW_CONFIG to determine properties of the SPM core component - Initialises the SPM core component which resides in the BL32 image - Implements a handler for SPCI calls from either security state. Some basic validation is done for each call but in most cases it is simply forwarded as-is to the "other" security state. Signed-off-by: Achin Gupta <achin.gupta@arm.com> Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com> Change-Id: I7d116814557f7255f4f4ebb797d1619d4fbab590
-
- 22 Jan, 2020 1 commit
-
-
Anthony Steinhauser authored
Even though ERET always causes a jump to another address, aarch64 CPUs speculatively execute following instructions as if the ERET instruction was not a jump instruction. The speculative execution does not cross privilege-levels (to the jump target as one would expect), but it continues on the kernel privilege level as if the ERET instruction did not change the control flow - thus execution anything that is accidentally linked after the ERET instruction. Later, the results of this speculative execution are always architecturally discarded, however they can leak data using microarchitectural side channels. This speculative execution is very reliable (seems to be unconditional) and it manages to complete even relatively performance-heavy operations (e.g. multiple dependent fetches from uncached memory). This was fixed in Linux, FreeBSD, OpenBSD and Optee OS: https://github.com/torvalds/linux/commit/679db70801da9fda91d26caf13bf5b5ccc74e8e8 https://github.com/freebsd/freebsd/commit/29fb48ace4186a41c409fde52bcf4216e9e50b61 https://github.com/openbsd/src/commit/3a08873ece1cb28ace89fd65e8f3c1375cc98de2 https://github.com/OP-TEE/optee_os/commit/abfd092aa19f9c0251e3d5551e2d68a9ebcfec8a It is demonstrated in a SafeSide example: https://github.com/google/safeside/blob/master/demos/eret_hvc_smc_wrapper.cc https://github.com/google/safeside/blob/master/kernel_modules/kmod_eret_hvc_smc/eret_hvc_smc_module.c Signed-off-by: Anthony Steinhauser <asteinhauser@google.com> Change-Id: Iead39b0b9fb4b8d8b5609daaa8be81497ba63a0f
-
- 20 Dec, 2019 10 commits
-
-
Paul Beesley authored
Change-Id: I2bab67f319758dd033aa689d985227cad796cdea Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
Change-Id: I851be04fc5de8a95ea11270996f8ca33f0fccadb Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
Change-Id: I575188885ebed8c5f0682ac6e0e7dd159155727f Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
Change-Id: Ie47009158032c2e8f35febd7bf5458156f334ead Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
Change-Id: Idcd2a35cd2b30d77a7ca031f7e0172814bdb8cab Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
The contents of this header have been merged into the spm_mm_svc.h header file. Change-Id: I01530b2e4ec1b4c091ce339758025e2216e740a4 Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
Change-Id: I91c192924433226b54d33e57d56d146c1c6df81b Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
Before adding any new SPM-related components we should first do some cleanup around the existing SPM-MM implementation. The aim is to make sure that any SPM-MM components have names that clearly indicate that they are MM-related. Otherwise, when adding new SPM code, it could quickly become confusing as it would be unclear to which component the code belongs. The secure_partition.h header is a clear example of this, as the name is generic so it could easily apply to any SPM-related code, when it is in fact SPM-MM specific. This patch renames the file and the two structures defined within it, and then modifies any references in files that use the header. Change-Id: I44bd95fab774c358178b3e81262a16da500fda26 Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
The Secure Partition Manager (SPM) prototype implementation is being removed. This is preparatory work for putting in place a dispatcher component that, in turn, enables partition managers at S-EL2 / S-EL1. This patch removes: - The core service files (std_svc/spm) - The Resource Descriptor headers (include/services) - SPRT protocol support and service definitions - SPCI protocol support and service definitions Change-Id: Iaade6f6422eaf9a71187b1e2a4dffd7fb8766426 Signed-off-by: Paul Beesley <paul.beesley@arm.com> Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>
-
Paul Beesley authored
There are two different implementations of Secure Partition management in TF-A. One is based on the "Management Mode" (MM) design, the other is based on the Secure Partition Client Interface (SPCI) specification. Currently there is a dependency between their build flags that shouldn't exist, making further development harder than it should be. This patch removes that dependency, making the two flags function independently. Before: ENABLE_SPM=1 is required for using either implementation. By default, the SPCI-based implementation is enabled and this is overridden if SPM_MM=1. After: ENABLE_SPM=1 enables the SPCI-based implementation. SPM_MM=1 enables the MM-based implementation. The two build flags are mutually exclusive. Note that the name of the ENABLE_SPM flag remains a bit ambiguous - this will be improved in a subsequent patch. For this patch the intention was to leave the name as-is so that it is easier to track the changes that were made. Change-Id: I8e64ee545d811c7000f27e8dc8ebb977d670608a Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
- 19 Nov, 2019 1 commit
-
-
Justin Chadwell authored
Variable shadowing is, according to the C standard, permitted and valid behaviour. However, allowing a local variable to take the same name as a global one can cause confusion and can make refactoring and bug hunting more difficult. This patch moves -Wshadow from WARNING2 into the general warning group so it is always used. It also fixes all warnings that this introduces by simply renaming the local variable to a new name Change-Id: I6b71bdce6580c6e58b5e0b41e4704ab0aa38576e Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>
-