GitLab

Before adding a base address and a size to compute the end
address of an image to copy or authenticate, check this
won't result in an integer overflow. If it does then consider
the input arguments are invalid.

As a result, bl1_plat_mem_check() can now safely assume the
end address (computed as the sum of the base address and size
of the memory region) doesn't overflow, as the validation is
done upfront in bl1_fwu_image_copy/auth(). A debug assertion
has been added nonetheless in the ARM implementation in order
to help catching such problems, should bl1_plat_mem_check()
be called in a different context in the future.

Fixes TFV-1: Malformed Firmware Update SMC can result in copy
of unexpectedly large data into secure memory

Change-Id: I8b8f8dd4c8777705722c7bd0e8b57addcba07e25
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Signed-off-by: Dan Handley <dan.handley@arm.com>

The previous code required that a certificate be signed with the ROT
key before the platform's NV counter could be updated with the value
in the certificate.  This implies that the Non-Trusted NV counter was
not being updated for Non-Trusted content certificates, as they cannot
be signed with the ROT key in the TBBR CoT scheme.

The code is reworked to only allow updating the platform's Trusted NV
counter when a certificate protected by the Trusted NV counter is
signed with the ROT key.

Content certificates protected by the Non-Trusted NV counter are
allowed to update the platform's Non-Trusted NV counter, assuming
that the certificate value is higher than the platform's value.

A new optional platform API has been introduced, named
plat_set_nv_ctr2().  Platforms may choose to implement it and perform
additional checks based on the authentication image descriptor before
modifying the NV counters.  A default weak implementation is available
that just calls into plat_set_nv_ctr().

Fixes ARM-software/tf-issues#426

Change-Id: I4fc978fd28a3007bc0cef972ff1f69ad0413b79c
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

Earlier patches introduced GIC Redistributor power management for ARM
platforms. This patch modifies FVP power management to power down
Redistributor during CPU power on/off.

Change-Id: I2adb9c50a7dd750019fe3b4e576b5d5fc364bffb
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

As with other ARM platform GIC APIs, these directly invoke the GICv3
driver APIs for Redistributor power management.

For the sake of uniform GIC API, empty stubs are placed for those GIC
drivers that lack Redistributor component.

Change-Id: Iad0d760d4dbca790998f7768cda621ff3b15a864
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

This patch enables TRUSTED_BOARD_BOOT (Authentication and FWU)
support, for AArch64, when LOAD_IMAGE_V2 is enabled.

This patch also enables LOAD_IMAGE_V2 for ARM platforms.

Change-Id: I294a2eebce7a30b6784c80c9d4ac7752808ee3ad
Signed-off-by: Yatharth Kochar <yatharth.kochar@arm.com>

Some files have incorrect copyright notices, this patch fixes all
files with deviations from the standard notice.

Change-Id: I66b73e78a50a235acb55f1e2ec2052a42c0570d2
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

The capabilities exposed by the PSCI generic layer depends on the hooks
populated by the platform in `plat_arm_psci_pm_ops`. Currently ARM
Standard platforms statically define this structure. However, some
platforms may want to modify the hooks at runtime before registering
them with the generic layer.

This patch introduces a new ARM platform layer API
`plat_arm_psci_override_pm_ops` which allows the platform to probe
the power controller and modify `plat_arm_psci_pm_ops` if required.
Consequently, 'plat_arm_psci_pm_ops' is no longer qualified as
`const` on ARM Standard platforms.

Change-Id: I7dbb44b7bd36c20ec14ded5ee45a96816ca2ab9d
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

This patch introduces an additional layer of abstraction between
CSS power management hooks and the SCPI driver. A new set of APIs
are introduced in order to abstract out power management operations
from underlying communication mechanism with the SCP.

The SCPI and the associated MHU drivers are moved into a `drivers`
folder in CSS. The new SCP communication abstraction layer is added
in the `drivers/scp` folder. The existing CSS power management
uses the new APIs to reflect this abstraction.

Change-Id: I7d775129fc0558e9703c2724523fb8f0a916838c
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

There are many instances in ARM Trusted Firmware where control is
transferred to functions from which return isn't expected. Such jumps
are made using 'bl' instruction to provide the callee with the location
from which it was jumped to. Additionally, debuggers infer the caller by
examining where 'lr' register points to. If a 'bl' of the nature
described above falls at the end of an assembly function, 'lr' will be
left pointing to a location outside of the function range. This misleads
the debugger back trace.

This patch defines a 'no_ret' macro to be used when jumping to functions
from which return isn't expected. The macro ensures to use 'bl'
instruction for the jump, and also, for debug builds, places a 'nop'
instruction immediately thereafter (unless instructed otherwise) so as
to leave 'lr' pointing within the function range.

Change-Id: Ib34c69fc09197cfd57bc06e147cc8252910e01b0
Co-authored-by: Douglas Raillard <douglas.raillard@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

This patch makes following miscellaneous fixes:
* pl011_console.S: Fixed the bit mask used to check if the
  transmit FIFO is full or empty.
* smcc_macros.S: Added `_fsxc` suffix while updating the SPSR.
  By default the assembler assumes `_fc` suffix which does not
  update all the fields in SPSR. By adding `_fsxc` suffix all
  the fields gets updated.
* platform_helpers.S: Removed the weak definition for
  `plat_my_core_pos()` as this is a mandatory function which
  needs to be defined by all platforms.

Change-Id: I8302292533c943686fff8d7c749a07132c052a3b
Signed-off-by: Yatharth Kochar <yatharth.kochar@arm.com>

Commit b91d935f
("Add CFI debug frame information for ASM functions") modifies the
assembly macros 'func' and 'endfunc' to include CFI debug frame
information.

The rockchip platform uses a custom version of the 'func' macro with the
common 'endfunc' macro. The custom macro wasn't updated in
b91d935f resulting in the following
build error:
  plat/rockchip/rk3399/drivers/pmu/plat_pmu_macros.S: Assembler messages:
  plat/rockchip/rk3399/drivers/pmu/plat_pmu_macros.S:155: Error: .cfi_endproc without corresponding .cfi_startproc
  Makefile:532: recipe for target 'build/rk3399/release/bl31/plat_helpers.o' failed
  make: *** [build/rk3399/release/bl31/plat_helpers.o] Error 1

Fixing this by updating the sram_func macro in the rk3399 port.

Fixes: b91d935f

 ("Add CFI debug frame information for ASM functions")
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>

Add dependency information in the user guide for ARM_RECOM_STATE_ID_ENC
that needs to be set when using PSCI_EXTENDED_STATE_ID on ARM
platforms. Also clarify the build error message.

Change-Id: Id125a0299b179f5f222bca4e2503204bf89a3c59
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>

The callback IRQ is delivered to the NS OS. Provide an interface to
allow the NS OS to obtain the callback data from the secure HW.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>

The IPI hardware is secure and managed by ATF, nevertheless we deliver
the IRQ to the rich OS. The IRQ is needed to receive PM callbacks.
Enable the IPI interrupt when the rich OS probes the API version.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>

Remove dead code pieces and stale comments.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>

Cc: Michal Simek <michal.simek@xilinx.com>
Reported-by: Jonas Karlsson <jonas.karlsson@atero.se>
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Acked-by: Michal Simek <michal.simek@xilinx.com>

Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>

Use the PMUFW get_chipid call to obtain IDCODE and version register.

Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Siva Durga Prasad Paladugu <sivadur@xilinx.com>
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>

Allow reading more than just a single value from the message buffer.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>

On ZynqMP the FSBL will configure the system counter. Hence, remove the
initialization of the system counter with hardcoded values from the ATF
and use the setup provided by the bootloader.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Acked-by: Michal Simek <michal.simek@xilinx.com>

The silicon ID does not change at runtime. Skip the IO access if the
ID has been read before.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Acked-by: Michal Simek <michal.simek@xilinx.com>

We have do something for clocks gate.

Fox example as the below:
susped:
clk_gate_con_save();
clk_gate_con_disable();

resume:
clk_gate_con_restore();
--

SO, add the plls_suspend_prepare() and plls_resume_finish() are not
necessary to S2R, that will save S2R time if remove them.

BRANCH=none
BUG=chrome-os-partner:58870,chrome-os-partner:55934
TEST=build kevin, two dogfooders with suspend_stress_test
passing 3000 cycles and still going on.

Change-Id: Icfbabc0b3ea8d2b5108d4f3de99a803b6d459669
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

The CA53 and CM0 WDT clock gating in rk3399 SGRF, and ATF is in charge of
it because the kernel can't touch SGRF.

Basically the WDT didn't stop at suspend time, it just switched from the
24M to the 32k clock. That meant that the WDT would fire if you slept for
long enough. In other word, the watchdog timer over count will increase to
750 (24*1000/32) times.
The RK3399 HW watchdog interval is 21 seconds. When machine enters the
suspend, the watchdog will reset the system after 35.7 (750/21) hours.

BUG=chrome-os-partner:59257
TEST=daisydog checked and set value, powerd_dbus_suspend to verify.

Change-Id: I88bb2a05b7d67d5ffd292f9d05d033ae9a6a3593
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

This patch adds dependency rule generation and inclusion to the M0
Makefile, so that M0 objects will get correctly remade with an
incremental build if a header file they included changed.

Change-Id: I2067bd9fd4d9dad3e77a09cbf09c7b4db3c1eda5
Signed-off-by: Julius Werner <jwerner@chromium.org>

The dependencies in the M0 Makefile are not correctly laid out, which
may lead to errors with make -j if the binary target gets evaluated
before the target that creates the directory. In addition, the M0
Makefile just calls mkdir without using the platform-independent macros
from the main ARM TF build system. This patch fixes those issues,
removes some unused (and broken) M0 build targets and merges the two M0
output directories into one (since there's no real point splitting it up
and it creates more hassle).

Change-Id: Ia5002479cf9c57fea7aefa8ca88e373df3a51f61
Signed-off-by: Julius Werner <jwerner@chromium.org>

The RK3399 supports close the center logic enter power mode,
so we can close PD_CENTER to save more power during suspend.
Therefore, we need to support save/restore the DDR PHY and
controller registers during suspend/resume.

Also, need CL (http://crosreview.com/397399

) to check disabling
center logic.

Change-Id: I288defd8e9caa3846d9fa663a33e4d51df1aaa5d
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
Signed-off-by: Derek Basehore <dbasehore@chromium.org>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

This patch intend to support save the registers of the DDR controller
and PHY before suspend, and restore them after resume.

Change-Id: Ia10b476c0b837628ac0f365416a7118292753e96
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
Signed-off-by: Derek Basehore <dbasehore@chromium.org>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

This changes the style of dmc register accesses to be a read/write on
a base address plus a register offset instead of reinterpretting a
base address as a struct and accessing members within that struct.

Change-Id: Iead097cd6afdb830d8bc193608cd39d01ce5a6bc
Signed-off-by: Derek Basehore <dbasehore@chromium.org>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

This renames dram.c and dram.h to dfs.c and dfs.h respectively. This
is to make room for common functionality between frequency scaling and
suspend code for the DRAM in a pair of common files named dram.c and
dram.h. It also removes a duplicate enum definition from
dram_spec_timing.h

Change-Id: Ibfa1041f8781401f9d27901fe8c61862bcb05562
Signed-off-by: Derek Basehore <dbasehore@chromium.org>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

This moves the PMU register definitions into another file for use in
later patches.

Change-Id: I8b5f1e7938b63ada6a743cf9661c3e474e96e4e4
Signed-off-by: Derek Basehore <dbasehore@chromium.org>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

The default value of L2CTLR_DATA_RAM_LATENCY is 2, depends to
the test result on rk3399, the A72 will need lower voltage for
high frequency if it's set to be 5, and almost no effect on performance.

Change-Id: I99a6a43edcc0c58f7775c10f4b85669dc3eff66d
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

Due to the PMU design, the PMU may not clear the WAKEUP bit after
wakeup, therefore, the state machine at the power mode may enter
the infinite loop during WFI.

There is a solution that we can use the M0 to monitor the WAKEUP
bit and clear it during power mode, then the state machine will be
recovered immediately. Then, the DUT can exit the WFI normally.

Change-Id: I303628553b728c214bf2d436bd3122032b5e669c
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

This CL supports add M0 source code to built into the bl31.bin, the
goal is that we can load the M0 code binary into SRAM and execute it.

We need the M0 help us to clean the power_mode_en bit during the AP
PMU enter the state machine with interrupt, and avoid to the AP can
not exit the loop forever.

Change-Id: I844582c54a1f0d44ca41290d44618df58679f341
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
Signed-off-by: Patrick Georgi <pgeorgi@google.com>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

Add the common extra.ld.S and customized rk3399.ld.S to extend
to more features for different platforms.
For example, we can add SRAM section and specific address to
load there if we need it, and the common bl31.ld.S not need to
be modified.

Therefore, we can remove the unused codes which copying explicitly
from the function pmusram_prepare(). It looks like more clear.

Change-Id: Ibffa2da5e8e3d1d2fca80085ebb296ceb967fce8
Signed-off-by: Xing Zheng <zhengxing@rock-chips.com>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

As described in the Porting Guide, plat_reset_handler should
preserve x19 to x29.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

The CRU_CLKSEL_COUNT value is 108, not 0x108.
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Change-Id: Ib9db066b8b3ecafcee7f645dd5633b55a808e3d7

This patch adds ARM SiP service for use by ARM standard platforms.
This service is added to support the SMC interface for the Performance
measurement framework(PMF).

Change-Id: I26f5712f9ab54f5f721dd4781e35a16f40aacc44
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

As the new RK3399TRM v1.1, there are some wrong set for CRU_CLKSEL_CON
register.

As the CRU_CLKSEL_CON96～107 high 16-bit isn't write mask and the
CRU_CLKSEL_CON offset is 0x100,not 0x80.

Change-Id: Ie127e9de74b87100af9a0150aad43e89e4972529

This prevents a warning being emitted in the console during FVP
configuration setup when using the Foundation FVP 9.6 onwards.

Change-Id: I685b8bd0dbd0119af4b0cb3f7d708fcc08e99561

This patch adds ARM Cortex-A32 MPCore Processor support
in the CPU specific operations framework. It also includes
this support for the Base FVP port.

Change-Id: If3697b88678df737c29f79cf3fa1ea2cb6fa565d