GitLab

ARM Trusted Firmware supports 2 different interconnect peripheral
drivers: CCI and CCN. ARM platforms are implemented using either of the
interconnect peripherals.

This patch adds a layer of abstraction to help ARM platform ports to
choose the right interconnect driver and corresponding platform support.
This is as described below:

1. A set of ARM common functions have been implemented to initialise an
interconnect and for entering/exiting a cluster from coherency. These
functions are prefixed as "plat_arm_interconnect_". Weak definitions of
these functions have been provided for each type of driver.

2.`plat_print_interconnect_regs` macro used for printing CCI registers is
moved from a common arm_macros.S to cci_macros.S.

3. The `ARM_CONFIG_HAS_CCI` flag used in `arm_config_flags` structure
is renamed to `ARM_CONFIG_HAS_INTERCONNECT`.

Change-Id: I02f31184fbf79b784175892d5ce1161b65a0066c

Perform security setup separately for each ARM platform

Vk/scp flexibility

Vk/misc plat reorg

Current code mandates loading of SCP_BL2/SCP_BL2U images for all
CSS platforms. On future ARM CSS platforms, the Application
Processor (AP) might not need to load these images. So, these
items can be removed from the FIP on those platforms.

BL2 tries to load  SCP_BL2/SCP_BL2U images if their base
addresses are defined causing boot error if the images are not
found in FIP.

This change adds a make flag `CSS_LOAD_SCP_IMAGES` which if set
to `1` does:
1. Adds SCP_BL2, SCP_BL2U images to FIP.
2. Defines the base addresses of these images so that AP loads
   them.

And vice-versa if it is set to `0`. The default value is set to
`1`.

Change-Id: I5abfe22d5dc1e9d80d7809acefc87b42a462204a

Prior to this patch, it was assumed that on all ARM platforms the bare
minimal security setup required is to program TrustZone protection. This
would always be done by programming the TZC-400 which was assumed to be
present in all ARM platforms. The weak definition of
platform_arm_security_setup() in plat/arm/common/arm_security.c
reflected these assumptions.

In reality, each ARM platform either decides at runtime whether
TrustZone protection needs to be programmed (e.g. FVPs) or performs
some security setup in addition to programming TrustZone protection
(e.g. NIC setup on Juno). As a result, the weak definition of
plat_arm_security_setup() is always overridden.

When a platform needs to program TrustZone protection and implements the
TZC-400 peripheral, it uses the arm_tzc_setup() function to do so. It is
also possible to program TrustZone protection through other peripherals
that include a TrustZone controller e.g. DMC-500. The programmer's
interface is slightly different across these various peripherals.

In order to satisfy the above requirements, this patch makes the
following changes to the way security setup is done on ARM platforms.

1. arm_security.c retains the definition of arm_tzc_setup() and has been
   renamed to arm_tzc400.c. This is to reflect the reliance on the
   TZC-400 peripheral to perform TrustZone programming. The new file is
   not automatically included in all platform ports through
   arm_common.mk. Each platform must include it explicitly in a platform
   specific makefile if needed.

   This approach enables introduction of similar library code to program
   TrustZone protection using a different peripheral. This code would be
   used by the subset of ARM platforms that implement this peripheral.

2. Due to #1 above, existing platforms which implements the TZC-400 have been
   updated to include the necessary files for both BL2, BL2U and BL31
   images.

Change-Id: I513c58f7a19fff2e9e9c3b95721592095bcb2735

Current code assumes `SCP_COM_SHARED_MEM_BASE` as the base address
for BOM/SCPI protocol between AP<->SCP on all CSS platforms. To
cater for future ARM platforms this is made platform specific.
Similarly, the bit shifts of `SCP_BOOT_CONFIG_ADDR` are also made
platform specific.

Change-Id: Ie8866c167abf0229a37b3c72576917f085c142e8

Functions to configure the MMU in S-EL1 and EL3 on ARM platforms
expect each platform to export its memory map in the `plat_arm_mmap`
data structure. This approach does not scale well in case the memory
map cannot be determined until runtime. To cater for this possibility,
this patch introduces the plat_arm_get_mmap() API. It returns a
reference to the `plat_arm_mmap` by default but can be overridden
by a platform if required.

Change-Id: Idae6ad8fdf40cdddcd8b992abc188455fa047c74

Each ARM Compute Subsystem based platform implements a System Security
Control (SSC) Registers Unit. The SSC_VERSION register inside it carries
information to identify the platform. This enables ARM Trusted Firmware
to compile in support for multiple ARM platforms and choose one at
runtime. This patch adds macros to enable access to this register.
Each platform is expected to export its PART_NUMBER separately.

Additionally, it also adds juno part number.

Change-Id: I2b1d5f5b65a9c7b76c6f64480cc7cf0aef019422

This patch moves the definition of some macros used only on
ARM platforms from common headers to platform specific headers.
It also forces all ARM standard platforms to have distinct
definitions (even if they are usually the same).
 1. `PLAT_ARM_TZC_BASE` and `PLAT_ARM_NSTIMER_FRAME_ID` have been
     moved from `css_def.h` to `platform_def.h`.
 2. `MHU_BASE` used in CSS platforms is moved from common css_def.h
    to platform specific header `platform_def.h` on Juno and
    renamed as `PLAT_ARM_MHU_BASE`.
 3. To cater for different sizes of BL images, new macros like
    `PLAT_ARM_MAX_BL31_SIZE` have been created for each BL image. All
    ARM platforms need to define them for each image.

Change-Id: I9255448bddfad734b387922aa9e68d2117338c3f

Fix IPRIORITY and ITARGET accessors in GIC drivers

build system: allow overriding the build's timestamp

This patch moves the private GIC common accessors from `gic_common.h` to
a new private header file `gic_common_private.h`. This patch also adds
additional comments to GIC register accessors to highlight the fact
that some of them access register values that correspond to multiple
interrupt IDs. The convention used is that the `set`, `get` and `clr`
accessors access and modify the values corresponding to a single interrupt
ID whereas the `read` and `write` GIC register accessors access the raw
GIC registers and it could correspond to multiple interrupt IDs depending
on the register accessed.

Change-Id: I2643ecb2533f01e3d3219fcedfb5f80c120622f9

The code to set the interrupt priority for secure interrupts in the
new GICv2 and GICv3 drivers is incorrect. The setup code to configure
interrupt priorities of secure interrupts, one interrupt at a time, used
gicd_write_ipriorityr()/gicr_write_ipriority() function affecting
4 interrupts at a time. This bug did not manifest itself because all the
secure interrupts were configured to the highest secure priority(0) during
cold boot and the adjacent non secure interrupt priority would be configured
later by the normal world. This patch introduces new accessors,
gicd_set_ipriorityr() and gicr_set_ipriorityr(), for configuring priority
one interrupt at a time and fixes the the setup code to use the new
accessors.

Fixes ARM-software/tf-issues#344

Change-Id: I470fd74d2b7fce7058b55d83f604be05a27e1341

GICD_IPRIORITYR and GICD_ITARGETSR specifically support byte addressing
so that individual interrupt priorities can be atomically updated by
issuing a single byte write. The previous implementation of
gicd_set_ipriority() and gicd_set_itargetsr() used 32-bit register
accesses, modifying values for 4 interrupts at a time, using a
read-modify-write approach. This potentially may cause concurrent changes
by other CPUs to the adjacent interrupts to be corrupted. This patch fixes
the issue by modifying these accessors to use byte addressing.

Fixes ARM-software/tf-issues#343

Change-Id: Iec28b5f5074045b00dfb8d5f5339b685f9425915

Bug fix: Rectify logic to enter or exit from DVM domain

PSCI: Resolve GCC static analysis false positive

Disable non-temporal hint on Cortex-A53/57

Currently, `ccn_snoop_dvm_domain_common()` is responsible for providing
a bitmap of HN-F and HN-I nodes in the interconnect. There is a request
node (RN) corresponding to the master interface (e.g. cluster) that needs
to be added or removed from the snoop/DVM domain. This request node is
removed from or added to each HN-F or HN-I node present in the bitmap
depending upon the type of domain.

The above logic is incorrect when participation of a master interface in
the DVM domain has to be managed. The request node should be removed
from or added to the single Miscellaneous Node (MN) in the system
instead of each HN-I node.

This patch fixes this by removing the intermediate
`ccn_snoop_dvm_domain_common()` and instead reads the MN registers to
get the needed node Id bitmap for snoop(HN-F bitmap) and DVM(MN bitmap)
domains.

Additionally, it renames `MN_DDC_SET_OFF` to `MN_DDC_SET_OFFSET` to
be inline with other macros.

Change-Id: Id896046dd0ccc5092419e74f8ac85e31b104f7a4

When BL31 is compiled at `-O3` optimization level using Linaro GCC 4.9
AArch64 toolchain, it reports the following error:

```
services/std_svc/psci/psci_common.c: In function 'psci_do_state_coordination':
services/std_svc/psci/psci_common.c:220:27: error: array subscript is above
array bounds [-Werror=array-bounds]
  psci_req_local_pwr_states[pwrlvl - 1][cpu_idx] = req_pwr_state;
                           ^
```

This error is a false positive and this patch resolves the error by asserting
the array bounds in `psci_do_state_coordination()`.

Fixes ARM-software/tf-issues#347

Change-Id: I3584ed7b2e28faf455b082cb3281d6e1d11d6495

In the Cortex-A35/A53/A57 CPUs library code, some of the CPU specific
reset operations are skipped if they have already been applied in a
previous invocation of the reset handler. This precaution is not
required, as all these operations can be reapplied safely.

This patch removes the unneeded test-before-set instructions in
the reset handler for these CPUs.

Change-Id: Ib175952c814dc51f1b5125f76ed6c06a22b95167

The LDNP/STNP instructions as implemented on Cortex-A53 and
Cortex-A57 do not behave in a way most programmers expect, and will
most probably result in a significant speed degradation to any code
that employs them. The ARMv8-A architecture (see Document ARM DDI
0487A.h, section D3.4.3) allows cores to ignore the non-temporal hint
and treat LDNP/STNP as LDP/STP instead.

This patch introduces 2 new build flags:
A53_DISABLE_NON_TEMPORAL_HINT and A57_DISABLE_NON_TEMPORAL_HINT
to enforce this behaviour on Cortex-A53 and Cortex-A57. They are
enabled by default.

The string printed in debug builds when a specific CPU errata
workaround is compiled in but skipped at runtime has been
generalised, so that it can be reused for the non-temporal hint use
case as well.

Change-Id: I3e354f4797fd5d3959872a678e160322b13867a1

This allows reproducible builds (same source and same compiler produce
bit-identical results) and also allows coordinating the timestamp across
multiple projects, eg. with another firmware.
Signed-off-by: Patrick Georgi <pgeorgi@google.com>

Fix PSCI CPU ON race when setting state to ON_PENDING

Use tf_printf() for debug logs from xlat_tables.c

Porting Guide: Clarify identity-mapping requirement

Clarify EL3 payload documentation

Disable PL011 UART before configuring it

When a CPU is powered down using PSCI CPU OFF API, it disables its caches
and updates its `aff_info_state` to OFF. The corresponding cache line is
invalidated by the CPU so that the update will be observed by other CPUs
running with caches enabled. There is a possibility that another CPU
which has been trying to turn ON this CPU via PSCI CPU ON API,
has already seen the update to `aff_info_state` and proceeds to update
the state to ON_PENDING prior to the cache invalidation. This may result
in the update of the state to ON_PENDING being discarded.

This patch fixes this issue by making sure that the update of `aff_info_state`
to ON_PENDING sticks by reading back the value after the cache flush and
retrying it if not updated. The patch also adds a dsbish() to
`psci_do_cpu_off()` to ensure ordering of the update to `aff_info_state`
prior to cache line invalidation.

Fixes ARM-software/tf-issues#349

Change-Id: I225de99957fe89871f8c57bcfc243956e805dcca

update SPM/DCM/MTCMOS related code for power control logic

The debug prints used to debug translation table setup in xlat_tables.c
used the `printf()` standard library function instead of the stack
optimized `tf_printf()` API. DEBUG_XLAT_TABLE option was used to enable
debug logs within xlat_tables.c and it configured a much larger stack
size for the platform in case it was enabled. This patch modifies these
debug prints within xlat_tables.c to use tf_printf() and modifies the format
specifiers to be compatible with tf_printf(). The debug prints are now enabled
if the VERBOSE prints are enabled in Trusted Firmware via LOG_LEVEL build
option.

The much larger stack size definition when DEBUG_XLAT_TABLE is defined
is no longer required and the platform ports are modified to remove this
stack size definition.

Change-Id: I2f7d77ea12a04b827fa15e2adc3125b1175e4c23

The memory translation library in Trusted Firmware supports
non-identity mappings for Physical to Virtual addresses since commit
f984ce84. However, the porting guide hasn't been updated
accordingly and still mandates the platform ports to use
identity-mapped page tables for all addresses.

This patch removes this out-dated information from the Porting Guide
and clarifies in which circumstances non-identity mapping may safely
be used.

Fixes ARM-software/tf-issues#258

Change-Id: I84dab9f3cabfc43794951b1828bfecb13049f706

This patch reworks the section about booting an EL3 payload in the
User Guide:

 - Centralize all EL3 payload related information in the same
   section.

 - Mention the possibility to program the EL3 payload in flash memory
   and execute it in place.

 - Provide model parameters for both the Base and Foundation FVPs.

 - Provide some guidance to boot an EL3 payload on Juno.

Change-Id: I975c8de6b9b54ff4de01a1154cba63271d709912

We found sometimes mtcmos operation is too long in spm (>1ms),
so update a new version to fix it.
I verified with 5 hours power_LoadTest, every mtcmos control
can finish in 500us (average is 100~200us).

Change-Id: I47b712bf9898870f4abcecbea47e01b9786231d4
Signed-off-by: Fan Chen <fan.chen@mediatek.com>

1. Set more wakeup source
2. Update PCM code for control logic

Change-Id: I2ad06bd85bd1c75a22c838eab4cf5566c443b89a
Signed-off-by: Weiyi Lu <weiyi.lu@mediatek.com>

1. Add SiP calls for subsystem power on/off and check support
2. Add subsystem power control related initialization in
   bl31_plat_setup.c
3. Add subsystem power on/off and power ack waiting functions
4. Update PCM code for subsystem physical power control logic

Change-Id: Ia0ebb1964c8f9758159bcf17c1813d76ef52cf64
Signed-off-by: yt.lee <yt.lee@mediatek.com>

1. add power control for both big and Little cluster in MCDI
2. fix incorrect PCM_HOTPLUG_VALID_MASK in spm_hotplug.c
3. check the power status of cpus in cluster before setting the cputop
   power control

Change-Id: Ifa85306a8bc218098667247904d281494c2f7bfe
Signed-off-by: Weiyi Lu <weiyi.lu@mediatek.com>

Move SPM related PLL settings to spm_boot_init in ARM TF SPM driver

Change-Id: I414b896caae072570c8de33a25e06db4ae011f57
Signed-off-by: yt.lee <yt.lee@mediatek.com>

This patch updates SPM driver settings and PCM code to fix USB remote
wake up problem.

Change-Id: I07a81cc64b1d226d111380580d09ae25879f4285
Signed-off-by: yt.lee <yt.lee@mediatek.com>

This patch enables dynamic clock management control to reduce power
consumption in various components.

Change-Id: I8f66d9b72c8b1d70169ffe46cc361b16a0dadb77
Signed-off-by: Jimmy Huang <jimmy.huang@mediatek.com>