GitLab

When the MMU is enabled and the translation tables are mapped, data
read/writes to the translation tables are made using the attributes
specified in the translation tables themselves. However, the MMU
performs table walks with the attributes specified in TCR_ELx. They are
completely independent, so special care has to be taken to make sure
that they are the same.

This has to be done manually because it is not practical to have a test
in the code. Such a test would need to know the virtual memory region
that contains the translation tables and check that for all of the
tables the attributes match the ones in TCR_ELx. As the tables may not
even be mapped at all, this isn't a test that can be made generic.

The flags used by enable_mmu_xxx() have been moved to the same header
where the functions are.

Also, some comments in the linker scripts related to the translation
tables have been fixed.

Change-Id: I1754768bffdae75f53561b1c4a5baf043b45a304
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Change-Id: I93e491fde2a991fc39584c2762f33cbea40541e3
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

Change-Id: Iadb21bb56f2e61d7e6aec9b3b3efd30059521def
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

After executing a TLBI a DSB is needed to ensure completion of the
TLBI.

rk3328: The MMU is allowed to load TLB entries for as long as it is
enabled. Because of this, the correct place to execute a TLBI is right
after disabling the MMU.

Change-Id: I8280f248d10b49a8c354a4ccbdc8f8345ac4c170
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Commit fdb1964c

 ("xlat: Introduce
MAP_REGION2() macro") added a granularity field to mmap_region_t.

Tegra platforms were using the v2 xlat_tables implementation in
common/tegra_common.mk, but v1 xlat_tables.h headers in soc/*/plat_setup.c
where arrays are being defined. This caused the next physical address to
be read as granularity, causing EINVAL error and triggering an assert.

Consistently use xlat_tables_v2.h header to avoid this.

Fixes ARM-software/tf-issues#548.
Signed-off-by: Andreas Färber <afaerber@suse.de>

Avoid hardcode on uart port. The uart port could be auto detected
on HiKey960 platform.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

The console core flush API expects the base address in the first
register, but ARM helpers currently sets the second register with the
base address. This causes an assert failure.

This patch fixes that.

Change-Id: Ic54c423cd60f2756902ab3cfc77b3de2ac45481e
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Function plat_ic_get_pending_interrupt_type() should return interrupt
type, not id. The function is used in aarch64 exception handling and
currently the irq/fiq forwarding fails if a secure interrupt happens while
running normal world.

The qemu-specific gic file does not contain any extra functionality so it
can be removed and common file can be used instead.

fixes arm-software/tf-issues#546
Signed-off-by: Santeri Salko <santeri.salko@gmail.com>

Signed-off-by: Victor Chong <victor.chong@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Tested-by: Shawn Guo <shawn.guo@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Tested-by: Shawn Guo <shawn.guo@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Tested-by: Shawn Guo <shawn.guo@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Tested-by: Shawn Guo <shawn.guo@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Tested-by: Shawn Guo <shawn.guo@linaro.org>

Define Qemu AArch32 implementation for some platform functions
(core position, secondary boot cores, crash console). These are
derived from the AArch64 implementation.

BL31 on Qemu is needed only for ARMv8 and later. On ARMv7, BL32 is
the first executable image after BL2.

Support SP_MIN and OP-TEE as BL32: create a sp_min make script target
in Qemu, define mapping for IMAGE_BL32

Minor fix Qemu return value type for plat_get_ns_image_entrypoint().

Qemu model for the Cortex-A15 does not support the virtualization
extension although the core expects it. To overcome the issue, Qemu
ARMv7 configuration set ARCH_SUPPORTS_VIRTUALIZATION to 0.

Add missing AArch32 assembly macro arm_print_gic_regs from ARM platform
used by the Qemu platform.

Qemu Cortex-A15 model integrates a single cluster with up to 4 cores.

Change-Id: I65b44399071d6f5aa40d5183be11422b9ee9ca15
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

Looks like this is requirement in the pre-merge static analysis.

misra_violation: [Required] MISRA C-2012 Rule 7.2 violation:
Unsigned constants must be declared with U or u suffix.

Adding ULL as requested.  I used ULL() macros for BL*_{BASE,LIMIT}
because they are referenced from linker scripts.
Requested-by: David Cunado <david.cunado@arm.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Currently, the xlat region of the on-chip SRAM is always allocated
for all BL images.

The access to the on-chip SRAM is necessary for loading images from
a USB memory device (i.e. when updating firmware), so unneeded for
the usual boot procedure.

To avoid this waste, allocate the xlat region dynamically only for
BL2, and only when it is necessary.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Commit 247fc043

 ("uniphier: switch to BL2-AT-EL3 and remove BL1
support") accidentally changed the location of BL31 and BL32.  The
new memory map overlaps with the audio DSP images, also gives impact
to OP-TEE.  They are both out of control of ARM Trusted Firmware, so
not easy to change.  This commit restores the image layout that was
originally used prior to the BL2-AT-EL3 migration.
Reported-by: Katsuhiro Suzuki <suzuki.katsuhiro@socionext.com>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Allow to handle GZIP-compressed images by giving FIP_GZIP=1 from the
command line.

- Images are GZIP-compressed, then packed into FIP.  If Trusted Board
  Boot is enabled, certificates are generated based on the compressed
  images.

- GZIP decompressor is linked into BL2 to decompress images at
  run-time.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

In the next commit, I will have more usecases to get struct image_info
from image ID.  It is better to make a helper function at a different
layer.  I do not need the current uniphier_image_descs_fixup() since
the code is small enough to be squashed into the caller side.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Just like bl2_, add pre/post image load handlers for BL1.  No argument
is needed since BL2 is the only image loaded by BL1.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

There are cases where we need to manipulate image information before
the load.  For example, for decompressing data, we cannot load the
compressed images to their final destination.  Instead, we need to
load them to the temporary buffer for the decompressor.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

When we add a new callback, we need to duplicate fallbacks among
plat/common/{aarch32,aarch64}/platform_helpers.S  This is tedious.

I created a new C file, then moved 3 functions:
  plat_error_handler
  bl2_plat_preload_setup
  plat_try_next_boot_source

They are called from C, so I do not see a good reason to implement
them in assembly.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

In the next commit, I need the image name in lowercase because
output files are generally named in lowercase.

Unfortunately, TOOL_ADD_IMG takes the first argument in uppercase
since we generally use uppercase Make variables.

make_helpers/build_macros.mk provides 'uppercase' macro to convert
a string into uppercase, but 'lowercase' does not exist.  We can
implement it if we like, but it would be more straightforward to
change the argument of TOOL_ADD_IMG.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Now FIP_ADD_IMG takes care of both fiptool and cert_create
symmetrically.  Rename it so that it matches the behavior.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

The build system supports generating two FIP images, fip and fwu_fip.
Accordingly, we have similar build macros.

   FIP_ADD_PAYLOAD   <-->  FWU_FIP_ADD_PAYLOAD
   CERT_ADD_CMD_OPT  <-->  FWU_CERT_ADD_CMD_OPT
   FIP_ADD_IMG       <-->  FWU_FIP_ADD_IMG

The duplicated code increases the maintenance burden.  Also, the build
rule of BL2U looks clumsy - we want to call MAKE_BL to compile it from
source files, but we want to put it in fwu_fip.  We can not do it in a
single macro call since the current MAKE_BL does not support fwu_fip.

To refactor those in a clean way is to support one more argument to
specify the FIP prefix.  If it is empty, the images are targeted to
fip, whereas if the argument is "FWU_", targeted to fwu_fip.

The build macros prefixed with FWU_ go away.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Coverity scan done for the coreboot project found the issue:
Coverity (*** CID 1385418: Memory - illegal accesses (OVERRUN))
Coverity (*** CID 1385419: Memory - corruptions  (OVERRUN))

Fix the Converity error issue with store_cru[] loop needs to be one
element bigger.

Fixes: ARM-software/tf-issues#544

Change-Id: I420f0a660b24baaa5fc5e78fca242cf750c9bbc7
Signed-off-by: Caesar Wang <wxt@rock-chips.com>

Change-Id: Ib67b841ab621ca1ace3280e44cf3e1d83052cb73
Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>

This patch maps the devices in the first GB of the system address map
on the FVP into the S-EL1&0 translation regime when SPM support is
enabled. This grants the Secure Partition access to the devices in
this region, for example the memory-mapped Generic Timer device.

Change-Id: I3aeea65f859ecbe83efde2acee20c55500c451bc
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

`assert(e)` was used in place of `if (e) ERROR()` when sec_protect()
was ported from hikey fork so the logic should have been reversed.

Fixes: 3d5d9f5a ("hikey: configure the top 16MB of DRAM as secure")
Fixes: 52988b38

 ("hikey: configure 4 MB of secure DRAM for OP-TEE
Secure Data Path")
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Tested-by: Victor Chong <victor.chong@linaro.org>

This disables the redistributor before either of the pwr_dm_suspend
functions are called. This is because the rdist save code in the
rk3399 rockchip_soc_sys_pwr_dm_suspend function requires that each
redistributor be disabled before saving state.
Signed-off-by: Derek Basehore <dbasehore@chromium.org>

UniPhier platform implements non-TF boot ROM.  Prior to the BL2-AT-EL3
support, BL1 (worked as a pseudo ROM) was needed just for ensuring BL2
is entered at EL1-S.  Now, this platform is able to avoid this waste.

Enable the BL2_AT_EL3 option, and remove BL1.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

The warm boot mailbox code is compiled if PROGRAMMABLE_RESET_ADDRESS
is disabled.

The warm boot mailbox is useless for UniPhier SoC family because BL1
is not the first image.  The UniPhier platform implements non-TF ROM,
then BL1 works as a pseudo ROM, so it is never executed in the warm
boot.

The reset vector address is not actually programmable for UniPhier
platform, but it should not hurt to enable PROGRAMMABLE_RESET_ADDRESS
to disable the mailbox and remove pointless plat_get_my_entrypoint.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Update the memory firewall configuration to reserve 4 MB of secure RAM
for use by the kernel and OP-TEE as the Secure Data Path pool.
Note that this address range (0x3E800000 - 0x3EC00000) falls in the
range already set aside by UEFI (which reserves the upper 32 MB of the
1GB DRAM for OP-TEE [1]) and was previously unused.

[1] https://github.com/96boards-hikey/edk2/blob/hikey/HisiPkg/HiKeyPkg/Library/HiKeyLib/HiKeyMem.c#L44

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Acked-by: Victor Chong <victor.chong@linaro.org>

DRAM region 0x3f000000 - 0x3fffffff is reserved for OP-TEE and should
therefore be accessible only from secure world.
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Acked-by: Victor Chong <victor.chong@linaro.org>

This adds calls to the GICv3 save/restore functions for the GIC
distributor and redistributor.
Signed-off-by: Derek Basehore <dbasehore@chromium.org>

We were looping for MAX_WAIT_COUNT in several places without any
delays, so this adds the delays to make those loops more predictable.
Signed-off-by: Derek Basehore <dbasehore@chromium.org>

The code was accidentally restoring the QOS on suspend and saving the
QOS on resume. This is the opposite of what we want.
Signed-off-by: Derek Basehore <dbasehore@chromium.org>

This brings ATF into line with the kernel on the timeout for power
domains turning on. We could actually timeout (when we shouldn't) on
resume when turning power domains on. The guaranteed maximum delay is
now 10ms.
Signed-off-by: Derek Basehore <dbasehore@chromium.org>

The `override ERROR_DEPRECATION = 1` setting in uniphier platform
makes deprecation of API difficult. Hence removing the same. This
flag should be specified on the command line if needed.

Change-Id: I8c82d8d13944e450a8cd636de3326137c04d7560
Signed-off-by: Soby Mathew <soby.mathew@arm.com>