GitLab

There are two communication scheme that have been enabled to communicate
with Secure Proxy in TI.
a) A full fledged prioritized communication scheme, which involves upto
   5 threads from the perspective of the host software
b) A much simpler "lite" version which is just a two thread scheme
   involving just a transmit and receive thread scheme.

The (a) system is specifically useful when the SoC is massive
involving multiple processor systems and where the potential for
priority inversion is clearly a system usecase killer. However, this
comes with the baggage of significant die area for larger number of
instances of secure proxy, ring accelerator and backing memories
for queued messages. Example SoCs using this scheme would be:
AM654[1], J721E[2], J7200[3]  etc.

The (b) scheme(aka the lite scheme) is introduced on smaller SoCs
where memory and area concerns are paramount. The tradeoff of
priority loss is acceptable given the reduced number of processors
communicating with the central system controller. This brings about
a very significant area and memory usage savings while the loss of
communication priority has no demonstrable impact. Example SoC using
this scheme would be: AM642[4]

While we can detect using JTAG ID and conceptually handle things
dynamically, adding such a scheme involves a lot of unused data (cost
of ATF memory footprint), pointer lookups (performance cost) and still
due to follow on patches, does'nt negate the need for a different
build configuration. However, (a) and (b) family of SoCs share the
same scheme and addresses etc, this helps minimize our churn quite a
bit

Instead of introducing a complex data structure lookup scheme, lets
keep things simple by first introducing the pieces necessary for an
alternate communication scheme, then introduce a second platform
representing the "lite" family of K3 processors.

NOTE: This is only possible since ATF uses just two (secure) threads
for actual communication with the central system controller. This is
sufficient for the function that ATF uses.

The (a) scheme and the (b) scheme also varies w.r.t the base addresses
used, even though the memory window assigned for them have remained
consistent. We introduce the delta as part of this change as well.
This is expected to remain consistent as a standard in TI SoCs.

References:
[1] See AM65x Technical Reference Manual (SPRUID7, April 2018)
for further details: https://www.ti.com/lit/pdf/spruid7

[2] See J721E Technical Reference Manual (SPRUIL1, May 2019)
for further details: https://www.ti.com/lit/pdf/spruil1

[3] See J7200 Technical Reference Manual (SPRUIU1, June 2020)
for further details: https://www.ti.com/lit/pdf/spruiu1

[4] See AM64X Technical Reference Manual (SPRUIM2, Nov 2020)
for further details: https://www.ti.com/lit/pdf/spruim2

Signed-off-by: Nishanth Menon <nm@ti.com>
Change-Id: I697711ee0e6601965015ddf950fdfdec8e759bfc

commit 65f7b817

 ("ti: k3: common: Use coherent memory for shared data")
introduced WARMBOOT_ENABLE_DCACHE_EARLY and USE_COHERENT_MEM to handle
multiple clusters across L3 cache systems. This is represented by
"generic" board in k3 platform.

On "lite" platforms, however, system level coherency is lacking since
we don't have a global monitor or an L3 cache controller. Though, at
a cluster level, ARM CPU level coherency is very much possible since
the max number of clusters permitted in lite platform configuration is
"1".

However, we need to be able to disable USE_COHERENT_MEM for the lite
configuration due to the lack of system level coherency.

See docs/getting_started/build-options.rst for further information.
Signed-off-by: Nishanth Menon <nm@ti.com>
Change-Id: I4a0ec150b3f9ea12369254aef834a6cbe82d6be6

The ti_sci_msg_req_reboot message payload has been extended to include
a domain field, and this should be zero to reset the entire SoC with
System Firmwares newer than v2020.04. Add the domain field to the
ti_sci_msg_req_reboot message structure for completeness. Set it up
to zero to fix the reboot issues with newer firmwares.

This takes care of the specific ABI that changed and has an impact on
ATF function.
Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Change-Id: I4f8064b9d6555687822dc2b2b8ec97609286fa0b

Sec proxy data buffer is 60 bytes with the last of the registers
indicating transmission completion. This however poses a bit
of a challenge.

The backing memory for sec_proxy is regular memory, and all sec proxy
does is to trigger a burst of all 60 bytes of data over to the target
thread backing ring accelerator. It doesn't do a memory scrub when
it moves data out in the burst. When we transmit multiple messages,
remnants of previous message is also transmitted which results in
some random data being set in TISCI fields of messages that have been
expanded forward.

The entire concept of backward compatibility hinges on the fact that
the unused message fields remain 0x0 allowing for 0x0 value to be
specially considered when backward compatibility of message extension
is done.

So, instead of just writing the completion register, we continue
to fill the message buffer up with 0x0 (note: for partial message
involving completion, we already do this).

This allows us to scale and introduce ABI changes back into TF-A only
as needed.
Signed-off-by: Nishanth Menon <nm@ti.com>
Change-Id: Ie22cb2a319f4aa80aef23ffc7e059207e5d4c640

ARM's generic timer[1] picks up it's graycode from GTC. However, the
frequency of the GTC is supposed to be programmed in CNTFID0[2]
register.

In K3, architecture, GTC provides a central time to many parts of the
SoC including graycode to the generic timer in the ARMv8 subsystem.
However, due to the central nature and the need to enable the counter
early in the boot process, the R5 based bootloader enables GTC and
programs it's frequency based on central needs of the system. This
may not be a constant 200MHz based on the system. The bootloader is
supposed to program the FID0 register with the correct frequency it
has sourced for GTC from the central system controller, and TF-A is
supposed to use that as the frequency for it's local timer.

A mismatch in programmed frequency and what we program for generic
timer will, as we can imagine, all kind of weird mayhem.

So, check the CNTFID0 register, if it is 0, warn and use the default
frequency to continue the boot process.

While at it, we can also check CNTCR register to provide some basic
diagnostics to make sure that we don't have OS folks scratch their
heads. Even though this is used during cpu online operations, the cost
of this additional check is minimal enough for us not to use #ifdeffery
with DEBUG flags.

[1] https://developer.arm.com/documentation/100095/0002/generic-timer/generic-timer-register-summary/aarch64-generic-timer-register-summary
[2] https://developer.arm.com/docs/ddi0595/h/external-system-registers/cntfid0
[3] https://developer.arm.com/docs/ddi0595/h/external-system-registers/cntcr

Signed-off-by: Nishanth Menon <nm@ti.com>
Change-Id: Ib03e06788580f3540dcb1a11677d0d6d398b2c9f

The CatB erratum ARM_ERRATA_A72_1319367 applies to all TI A72
platforms as well.

See the following for further information:
https://developer.arm.com/documentation/epm012079/11/

Signed-off-by: Nishanth Menon <nm@ti.com>
Change-Id: I80c6262b9cdadcb12f6dfd5a21272989ba257719

The CatB erratum ARM_ERRATA_A53_1530924 applies to all TI A53
platforms as well.

See the following for further information:
https://developer.arm.com/documentation/epm048406/2100

Signed-off-by: Nishanth Menon <nm@ti.com>
Change-Id: Ic095424ce510139e060b38cfb84509d2cc573cad

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return type to void does not
work around the MISRA violation that this causes. Instead, we collect
the error information from the driver (to avoid changing that API), and
don't return it to the caller.

Change-Id: I1e35afe01764d5c8f0efd04f8949d333ffb688c1
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

If the user tries to change BUILD_BASE to put the build products outside
the build tree the compile will fail due to hard coded assumptions that
$BUILD_BASE is a relative path. Fix by using $(abspath $(BUILD_BASE))
to rationalize to an absolute path every time and remove the relative
path assumptions.

This patch also adds documentation that BUILD_BASE can be specified by
the user.
Signed-off-by: Grant Likely <grant.likely@arm.com>
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ib1af874de658484aaffc672f30029b852d2489c8

This allows to build for k3-based boards that use a different UART as
console, such as the IOT2050 which requires K3_USART=1.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Change-Id: I7171f86c3cabae2c575b8fbeecef839b48bd109b

PSCI demands that SYSTEM_OFF must not return. While it seems like a
generic ATF bug that this is possible when a platform does not Implement
a corresponding handler, let's do that here until it's addressed
differently.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Change-Id: I4c08948b18bbfdc3a24214f2ae0fbad9e017ada1

This patch moves all GICv3 driver files into new added
'gicv3.mk' makefile for the benefit of the generic driver
which can evolve in the future without affecting platforms.
The patch adds GICv3 driver configuration flags
'GICV3_IMPL', 'GICV3_IMPL_GIC600_MULTICHIP' and
'GICV3_OVERRIDE_DISTIF_PWR_OPS' described in
'GICv3 driver options' section of 'build-option.rst'
document.

NOTE: Platforms with GICv3 driver need to be modified to
include 'drivers/arm/gic/v3/gicv3.mk' in their makefiles.

Change-Id: If055f6770ff20f5dee5a3c99ae7ced7cdcac5c44
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

This patch provides separation of GICD, GICR accessor
functions and adds new macros for GICv3 registers access
as a preparation for GICv3.1 and GICv4 support.
NOTE: Platforms need to modify to include both
'gicdv3_helpers.c' and 'gicrv3_helpers.c' instead of the
single helper file previously.

Change-Id: I1641bd6d217d6eb7d1228be3c4177b2d556da60a
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

Since now the generic console_t structure holds the UART base address as
well, let's use that generic location and drop the UART driver specific
data structure at all.

Change-Id: I5c2fe3b6a667acf80c808cfec4a64059a2c9c25f
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The Secure Configuration Register is 64-bits in AArch64 and 32-bits in
AArch32. Use u_register_t instead of unsigned int to reflect this.

Change-Id: I51b69467baba36bf0cfaec2595dc8837b1566934
Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>

The current message sequence number is accessed both with caches on and
off so put this memory in the un-cached coherent section so accesses
are consistent and coherency is maintained.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: Ieeefefeaffc691e4e4c4de7c74490d50ff9de807

The 'info' structure contained what is only static data for this
implementation of TI-SCI. Remove this indirection and remove the
struct.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I2328fddf388bf7d56a56bd673c080e78c86fe072

When all cores in a cluster are powered down the parent cluster can
be also powered down. When the last core has requested powering down
follow by sending the cluster power down sequence to the system
power controller firmware.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I0ffeb339852c66ef62743aecd3e17ca20bad6216

The core number is called 'core_id' but the processor and device IDs are
called 'proc' and 'device'. Rename these to make them less confusing.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I3d7c6dddd7aa37b5dee1aa9689ce31730e9c3b59

PLATFORM_CORE_COUNT - Unsigned int
PLATFORM_CLUSTER_COUNT - Unsigned int
PLATFORM_MAX_CPUS_PER_CLUSTER - Unsigned int
PLATFORM_CORE_COUNT_PER_CLUSTER - Unsigned int
Signed-off-by: Deepika Bhavnani <deepika.bhavnani@arm.com>
Change-Id: Ia7072d82116b03904c1b3982f37d96347203e621

Running TF-A from non-standard location such as DRAM is useful for some
SRAM heavy use-cases. Allow the TF-A binary to be executed from an
arbitrary memory location.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: Icd97926e4d97f37d7cde4a92758a52f57d569111

These errors are asynchronous and cannot be directly correlated with the
exact current running software, so handling them in the same EL is not
critical. Handling them in TF-A allows for more platform specific
decoding of the implementation defined exception registers
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: Iee7a38c9fc9c698fa0ad42dafa598bcbed6a4fda

The new API becomes the default one.

Change-Id: Ic1d602da3dff4f4ebbcc158b885295c902a24fec
Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>

We previously left our caches on during power-down to prevent any
non-caching accesses to memory that is cached by other cores. Now with
the last accessed areas all being marked as non-cached by
USE_COHERENT_MEM we can rely on that to workaround our interconnect
issues. Remove the old workaround.

Change-Id: Idadb7696d1449499d1edff4f6f62ab3b99d1efb7
Signed-off-by: Andrew F. Davis <afd@ti.com>

HW_ASSISTED_COHERENCY implies something stronger than just hardware
coherent interconnect, specifically a DynamIQ capable ARM core.

For K3, lets use WARMBOOT_ENABLE_DCACHE_EARLY to enable caches early
and then let the caches get shut off on powerdown, to prevent data
corruption we also need to USE_COHERENT_MEM so that any accesses to
shared memory after this point is only to memory that is set as
non-cached for all cores.

Change-Id: Ib9337f012df0e0388237942607c501b6f3e2a949
Signed-off-by: Andrew F. Davis <afd@ti.com>

The Cortex-A72 based cores on K3 platforms can be clocked fast
enough that an extra latency cycle is needed to ensure correct
L2 access. Set the latency here for all A72 cores.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: Id534316dec1c1f326908efbfd964f219cda7386a

Enable Cortex-A72 support for J721E.

Change-Id: I5bea5fb6ec45d1a9f8f2192d42da2cc03ae0f7ec
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Andrew F. Davis <afd@ti.com>

The MSMC port defines were added to help in the case when some ports
are not connected and have no cores attached. We can get the same
functionality by defined the number of cores on that port to zero.
This simplifies several code paths, do this here.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I3247fe37af7b86c3227e647b4f617fab70c8ee8a

These sections of code are only needed for the coherency workaround
used for AM65x, if this workaround is not needed then this code
is not either. Mark it off to keep it separated from the rest of
the PSCI implementation.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I113ca6a2a1f7881814ab0a64e5bac57139bc03ef

To make the USE_COHERENT_MEM option work we need to add an entry for the
area to our memory map table. Also fixup the alignment here.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I1c05477a97646ac73846a711bc38d3746628d847

The size of the RO data area was calculated by subtracting the area end
address from itself and not the base address due to a typo. Fix this
here.

Note, this was noticed at a glance thanks to the new aligned formating
of this table.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I994022ac9fc95dc5e37a420714da76081c61cce7

This macro was used when many of these functions were stubbed out,
the macro is not used anymore, remove it.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: Ida33f92fe3810a89e6e51faf6e93c1d2ada1a2ee

When we get a sequence ID that does not match what we expect then the we
are looking at is not the one we are expecting and so we error out. We
can also assume this message is a stale message left in the queue, in
this case we can read in the next message and check again for our
message. Switch to doing that here. We only retry a set number of times
so we don't lock the system if our message is actually lost and will
never show up.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I6c8186ccc45e646d3ba9d431f7d4c451dcd70c5c

The sequence ID can be set with a message to identify it when it is
responded to in the response queue. We assign each message a number and
check for this same number to detect response mismatches.

Start this at 0 and increase it by one for each message sent, even ones
that do not request or wait for a response as one may still be delivered
in some cases and we want to detect this.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I72b4d1ef98bf1c1409d9db9db074af8dfbcd83ea

The direction of a thread should be explicitly compared to avoid
confusion. Also fixup message wording based on this direction.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: Ia3cf9413cd23af476bb5d2e6d70bee15234cbd11

The ID of a thread is not used outside for printing it out when
something goes wrong. The specifier used is also not consistent.
Instead of storing the thread ID, store its name and print that.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: Id137c2f8dfdd5c599e220193344ece903f80af7b

This is only a formatting change but makes it instantly clear how each
region is set. This is over 80 chars and the MT_RO are not strictly
needed but this section very important to get right so make readability
the priority here.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I2432deda05d4502b3478170296b5da43f26ad8e6

This should be more secure and looks a bit cleaner.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: Ie5eaf0234b211ba02631cf5eab5faa1402a34461

We don't use this for anything right now, remove it.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I11505d01834f7ff1fdba46fda0acbb3b56fc9b66

This makes definitions more consistent, plus helps alignment.
Signed-off-by: Andrew F. Davis <afd@ti.com>
Change-Id: I38fcdd76207586613d9934c9dc83d7a347e9e0fc