GitLab

Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
This resolves the following required rule:

    bl1/aarch64/bl1_context_mgmt.c:81:[MISRA C-2012 Rule 10.7 (required)]<None>
    The width of the composite expression "0U | ((mode & 3U) << 2U) | 1U |
    0x3c0U" (32 bits) is less that the right hand operand
    "18446744073709547519ULL" (64 bits).

This also resolves MISRA defects such as:

    bl2/aarch64/bl2arch_setup.c:18:[MISRA C-2012 Rule 12.2 (required)]
    In the expression "3U << 20", shifting more than 7 bits, the number
    of bits in the essential type of the left expression, "3U", is
    not allowed.

Further, MISRA requires that all shifts don't overflow. The definition of
PAGE_SIZE was (1U << 12), and 1U is 8 bits. This caused about 50 issues.
This fixes the violation by changing the definition to 1UL << 12. Since
this uses 32bits, it should not create any issues for aarch32.

This patch also contains a fix for a build failure in the sun50i_a64
platform. Specifically, these misra fixes removed a single and
instruction,

    92407e73        and     x19, x19, #0xffffffff

from the cm_setup_context function caused a relocation in
psci_cpus_on_start to require a linker-generated stub. This increased the
size of the .text section and caused an alignment later on to go over a
page boundary and round up to the end of RAM before placing the .data
section. This sectionn is of non-zero size and therefore causes a link
error.

The fix included in this reorders the functions during link time
without changing their ording with respect to alignment.

Change-Id: I76b4b662c3d262296728a8b9aab7a33b02087f16
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

Only define arm_get_rotpk_info_regs if ROTPK is in registers,
i.e. (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_REGS_ID). This will
allow platform build without definition of TZ_PUB_KEY_HASH_BASE
if dedicated registers for ROTPK are not available on the platform.

Change-Id: I74ee2d5007f5d876a031a1efca20ebee2dede0c7
Signed-off-by: Usama Arif <usama.arif@arm.com>

Change-Id: Ieb411e2f8092fa82062e619305b680673a8f184f
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

Change-Id: Ic0ca51a855660509264ff0d084c068e1421ad09a
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

This patch makes changes required to get the morello
platform working with the tip of TF-A.

Change-Id: I095006615c9959bba49fcc75b52e1de7d7486309
Signed-off-by: Chandni Cherukuri <chandni.cherukuri@arm.com>

For the Arm Ltd. FPGAs to run, we need to load several payloads into the
FPGA's memory:
- Some trampoline code at address 0x0, to jump to BL31's entry point.
- The actual BL31 binary at the beginning of DRAM.
- The (generic) DTB image to describe the hardware.
- The actual non-secure payloads (kernel, ramdisks, ...)

The latter is application specific, but the first three blobs are rather
generic.
Since the uploader tool supports ELF binaries, it seems helpful to
combine these three images into one .axf file, as this also simplifies
the command line.

Add a post-build linker script, that combines those three bits into one
ELF file, together with their specific load addresses.
Include a call to "ld" with this linker script in the platform Makefile,
so it will be build automatically. The result will be called "bl31.axf".

Change-Id: I4a90da16fa1e0e83b51d19e5b1daf61f5a0bbfca
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The application cores of the FPGAs used in Arm Ltd. start execution at
address 0x0. This is the location of some (emulated) ROM area (which can
be written to by the uploading tool).
Since the arm_fpga port is configured to run from DRAM, we load BL31 to
the beginning of DRAM (mapped at 2GB). This requires some small
trampoline code in the "ROM" to jump to the BL31 entry point.

To avoid some extra magic binary, add a tiny assembly file with that
trivial jump instruction to the tree, so this binary can be created
alongside BL31.

Change-Id: I9e4439fc0f093fa24dd49a8377c9edb030fbb477
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The FPGA images used in Arm Ltd. focus on CPU cores, so they share a
common platform, with a minimal set of peripherals (interconnect, GIC,
UART).
This allows to support most platforms with a single devicetree file.
The topology and number of CPU cores differ, but those will added at
runtime, in BL31. Other adjustments (GICR size, SPE node, command line)
are also done at this point.

Add the common devicetree file to TF-A's build system, so it can be
build together with BL31. At runtime, the resulting .dtb file should be
uploaded to the address given with FPGA_PRELOADED_DTB_BASE at build time.

Change-Id: I3206d6131059502ec96896e95329865452c9d83e
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The Statistical Profiling Extension (SPE) is an architectural feature we
can safely detect at runtime. However it still relies on one piece of
platform-specific information: the interrupt line it is connected
to. This requires SPE to be described in a devicetree node.

Since SPE support varies with the CPU cores found on an FPGA image, we
should detect the presence of SPE at runtime, and remove a potentially
existing SPE PMU node from the DT.

This allows to always have the SPE node in a generic devicetree file,
without risking exposing it on a CPU without this feature.

Change-Id: I73d83ea8509b03fe7bba20b9cce8d1335035fa31
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

The size of a GICv3 redistributor region depends on the number of
cores in the system. For the ARM FPGA port, we detect the topology at
runtime, and adjust the CPU DT nodes accordingly.
Now the size of the GICR region must also be adjusted, or Linux will
fail to initialise the GICv3.

Use the newly introduced function to overwrite the GICR size entry in
the GICv3 reg property. We count the number of existing cores by
iterating over the GICR frames until we find the LAST bit set in TYPER.

Change-Id: Ib69565600859de9b1b15ceb8495172cd26d16fce
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

This patch adds support for Morello platform.
It is an initial port which includes only BL31 support
as the System Control Processor (SCP) is expected to take
the role of primary bootloader.

Change-Id: I1ecbe5a14a2d487b2ecea3c1ca227f08473ed2dd
Co-authored-by: Chandni Cherukuri <chandni.cherukuri@arm.com>
Signed-off-by: Chandni Cherukuri <chandni.cherukuri@arm.com>
Signed-off-by: Anurag Koul <anurag.koul@arm.com>

This patch allows the system to fallback to a default CPU library
in case the MPID does not match with any of the supported ones.

This feature can be enabled by setting SUPPORT_UNKNOWN_MPID build
option to 1 (enabled by default only on arm_fpga platform).

This feature can be very dangerous on a production image and
therefore it MUST be disabled for Release images.
Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I0df7ef2b012d7d60a4fd5de44dea1fbbb46881ba

The SGI platform defines the macro PLAT_ARM_MEM_PROT_ADDR which
indicates that the platform has mitigation for cold reboot attacks.

However, the flash memory used for the mem_protect region was not
mapped. This results in a crash when an OS calls PSCI MEM_PROTECT.

To fix this map the flash region used for mem_protect.

Change-Id: Ia494f924ecfe2ce835c045689ba8f942bf0941f4
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>

Change-Id: Ic2bb8482f0b602f6b7850d4fa553448bc4931edc
Signed-off-by: Usama Arif <usama.arif@arm.com>

According to [1] and in context of FF-A v1.0 a secure partition must
have either one EC (migratable UP) or a number of ECs equal to the
number of PEs (pinned MP). Adjust the SPMC manifest such that the
number of ECs is equal to the number of PEs.

[1] https://trustedfirmware-a.readthedocs.io/en/latest/components/


secure-partition-manager.html#platform-topology
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Ie8c7d96ae7107cb27f5b97882d8f476c18e026d4

Increased BL2 maximum size when CoT descriptors are placed
in device tree.
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I6466d2841e189e7f15eb4f1a8db070542893cb5b

Implemented a parser which populates the properties of
the CoT descriptors as per the binding document [1].
'COT_DESC_IN_DTB' build option is disabled by default and can
be enabled in future for all Arm platforms by making necessary
changes in the memory map.
Currently, this parser is tested only for FVP platform.

[1]:
https://trustedfirmware-a.readthedocs.io/en/latest/components/cot-binding.html



Change-Id: I2f911206087a1a2942aa728de151d2ac269d27cc
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

The size of debug binaries of SCP has increased beyond the current
limit of 80kB set in platform. Hence, increase it to 128kB.

Change-Id: I5dbcf87f8fb35672b39abdb942c0691fb339444a
Signed-off-by: Usama Arif <usama.arif@arm.com>

This fixes build errors for rdn1edge

Change-Id: I63f7ebff68679e1e859f8786d4def4960c0f2ddf
Signed-off-by: Anders Dellien <anders.dellien@arm.com>

UUID's in the device tree files were stored in little endian. So
to keep all entries in these files RFC 4122 compliant, store them in
big endian then convert it to little endian when they are read so they
can be used in the UUID data structure.
Signed-off-by: Ruari Phipps <ruari.phipps@arm.com>
Change-Id: I5674159b82b245104381df10a4e3291160d9b3b5

Trace analysis of FVP_Base_AEMv8A 0.0/6063 model
running in Aarch32 mode with the build options
listed below:
TRUSTED_BOARD_BOOT=1 GENERATE_COT=1
ARM_ROTPK_LOCATION=devel_ecdsa KEY_ALG=ecdsa
ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_ecdsa.pem
shows that when auth_signature() gets called
71.99% of CPU execution time is spent in memset() function
written in C using single byte write operations,
see lib\libc\memset.c.
This patch introduces new libc_asm.mk makefile which
replaces C memset() implementation with assembler
version giving the following results:
- for Aarch32 in auth_signature() call memset() CPU time
reduced to 20.56%.
The number of CPU instructions (Inst) executed during
TF-A boot stage before start of BL33 in RELEASE builds
for different versions is presented in the tables below,
where:
- C TF-A: existing TF-A C code;
- C musl: "lightweight code" C "implementation of the
  standard library for Linux-based systems"
https://git.musl-libc.org/cgit/musl/tree/src/string/memset.c
- Asm Opt: assemler version from "Arm Optimized Routines"
  project
https://github.com/ARM-software/optimized-routines/blob/
master/string/arm/memset.S
- Asm Linux: assembler version from Linux kernel
https://github.com/torvalds/linux/blob/master/arch/arm/lib/memset.S


- Asm TF-A: assembler version from this patch

Aarch32:
+-----------+------+------+--------------+----------+
| Variant   | Set  | Size |    Inst 	 |  Ratio   |
+-----------+------+------+--------------+----------+
| C TF-A    | T32  | 16   | 2122110003   | 1.000000 |
| C musl    | T32  | 156  | 1643917668   | 0.774662 |
| Asm Opt   | T32  | 84   | 1604810003   | 0.756233 |
| Asm Linux | A32  | 168  | 1566255018   | 0.738065 |
| Asm TF-A  | A32  | 160  | 1525865101   | 0.719032 |
+-----------+------+------+--------------+----------+

AArch64:
+-----------+------+------------+----------+
| Variant   | Size |    Inst    |  Ratio   |
+-----------+------+------------+----------+
| C TF-A    | 28   | 2732497518 | 1.000000 |
| C musl    | 212  | 1802999999 | 0.659836 |
| Asm TF-A  | 140  | 1680260003 | 0.614917 |
+-----------+------+------------+----------+

This patch modifies 'plat\arm\common\arm_common.mk'
by overriding libc.mk makefile with libc_asm.mk and
does not effect other platforms.

Change-Id: Ie89dd0b74ba1079420733a0d76b7366ad0157c2e
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

At the moment BL31 dynamically discovers the CPU topology of an FPGA
system at runtime, but does not export it to the non-secure world.
Any BL33 user would typically looks at the devicetree to learn about
existing CPUs.

This patch exports a minimum /cpus node in a devicetree to satisfy
the binding. This means that no cpumaps or caches are described.
This could be added later if needed.

An existing /cpus node in the DT will make the code bail out with a
message.
Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I589a2b3412411a3660134bdcef3a65e8200e1d7e

This patch adds dependencies to the generated configuration
files that are included in the FIP. This fixes occasional
build errors that occur when the FIP happens to be built first.

Change-Id: I5a2bf724ba3aee13954403b141f2f19b4fd51d1b
Signed-off-by: Anders Dellien <anders.dellien@arm.com>

In the case of Juno AArch32, platform security configuration
gets done from both BL2 and SP_MIN(BL32) components when
JUNO_AARCH32_EL3_RUNTIME and RESET_TO_SP_MIN build options
are set.
Fix is provided to avoid Platform security configuration from
SP_MIN when it is already done in BL2.
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I702e91dacb4cdd2d10e339ddeaea91289bef3229

Using the Fconf, register base address of the various nv-counters
(currently, trusted, non-trusted nv-counters) are moved to the
device tree and retrieved during run-time. This feature is
enabled using the build option COT_DESC_IN_DTB.
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I236f532e63cea63b179f60892cb406fc05cd5830

'EHF' is used by RAS, SDEI, SPM_MM common frameworks.
If platform needs to plug-in specific handlers then
'PLAT_EHF_DESC' can be used to populate platform specific
priority levels.
Signed-off-by: Sandeep Tripathy <sandeep.tripathy@broadcom.com>
Change-Id: I37af7e0e48111f87b6982604bf5c15db3e05755d

Allocated 512-959 SPI numbers for remote n1sdp chip and same has been
referenced for GIC routing table.

Change-Id: Id79ea493fd665ed93fe9644a59e363ec10441098
Signed-off-by: Sayanta Pattanayak <sayanta.pattanayak@arm.com>

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
Change-Id: Icf90c2ccce75257908ba3d4703926041d64b1dd3

Add information about the third partition so it can be loaded into SPM
when running the tests
Signed-off-by: Ruari Phipps <ruari.phipps@arm.com>
Change-Id: I5544e88df391ef294ddf6b5750d468d3e74892b1

In case of AT speculative workaround applied, page table walk
is disabled for lower ELs (EL1 and EL0) in EL3.
Hence added a wrapper function which temporarily enables page
table walk to execute AT instruction for lower ELs and then
disables page table walk.

Execute AT instructions directly for lower ELs (EL1 and EL0)
assuming page table walk is enabled always when AT speculative
workaround is not applied.

Change-Id: I4ad4c0bcbb761448af257e9f72ae979473c0dde8
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

Implemented platform functions to retrieve the soc-id information
for juno platform

Change-Id: Ie677120710b45e202a2d63a954459ece8a64b353
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

Implemented platform functions to retrieve the soc-id information
for FVP platform.

Change-Id: Id3df02ab290a210310e8d34ec9d706a59d817517
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

Removed common code for soc-id feature which is applicable
for all arm platforms.

In subsequent patches, added a platform based functions
for FVP and Juno to retrieve the soc-id information.

Change-Id: Idb632a935758a6caff2ca03a6eab8f663da8a93a
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

SP804 TIMER is not platform specific, and current code base adds
multiple defines to use this driver. Like FVP_USE_SP804_TIMER and
FVP_VE_USE_SP804_TIMER.

This patch removes platform specific build flag and adds generic
flag `USE_SP804_TIMER` to be set to 1 by platform if needed.

Change-Id: I5ab792c189885fd1b98ddd187f3a38ebdd0baba2
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

For supporting dualroot CoT for Secure Partitions a new optional field
"owner" is introduced which will be used to sign the SP with
corresponding signing domain. To demonstrate its usage, this patch adds
owners to cactus Secure Partitions.
Signed-off-by: Ruari Phipps <ruari.phipps@arm.com>
Change-Id: I7b760580355fc92edf5402cecc38c38125dc1cae

For Arm platforms SPs are loaded by parsing tb_fw_config.dts and
adding them to SP structure sequentially, which in-turn is appended to
loadable image list.

With recently introduced dualroot CoT for SPs where they are owned
either by SiP or by Platform. SiP owned SPs index starts at SP_PKG1_ID
and Plat owned SPs index starts at SP_PKG5_ID. As the start index of SP
depends on the owner, there should be a mechanism to parse owner of a SP
and put it at the correct index in SP structure.

This patch adds support for parsing a new optional field "owner" and
based on it put SP details(UUID & Load-address) at the correct index in
SP structure.

Change-Id: Ibd255b60d5c45023cc7fdb10971bef6626cb560b
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>

This resolves MISRA defects such as:

    plat/common/plat_bl1_common.c:63:[MISRA C-2012 Rule 14.4 (required)]
    The condition expression "1" does not have an essentially boolean type.

Change-Id: I679411980ad661191fbc834a44a5eca5494fd0e2
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

There was a collision between the name of the typedef in the CASSERT and
something else, so we make the name of the typedef unique to the
invocation of DEFFINE_SVC_UUID2 by appending the name that's passed into
the macro. This eliminates the following MISRA violation:

    bl1/bl1_main.c:233:[MISRA C-2012 Rule 5.6 (required)] Identifier
    "invalid_svc_uuid" is already used to represent a typedef.

This also resolves MISRA rule 5.9.

These renamings are as follows:
  * tzram -> secram. This matches the function call name as it has
  sec_mem in it's  name
  * fw_config_base -> config_base. This file does not mess with
  hw_conig, so there's little chance of confusion

Change-Id: I8734ba0956140c8e29b89d0596d10d61a6ef351e
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

BL31 binary size is aligned to 4KB because of the
code in include\plat\arm\common\arm_reclaim_init.ld.S:
    __INIT_CODE_UNALIGNED__ = .;
    . = ALIGN(PAGE_SIZE);
    __INIT_CODE_END__ = .;
with all the zero data after the last instruction of
BL31 code to the end of the page.
This causes increase in size of BL31 binary stored in FIP
and its loading time by BL2.
This patch reduces the size of BL31 image by moving
page alignment from __INIT_CODE_END__ to __STACKS_END__
which also increases the stack size for secondary CPUs.

Change-Id: Ie2ec503fc774c22c12ec506d74fd3ef2b0b183a9
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

Currently only single signing domain is supported for SP packages but
there is plan to support dual signing domains if CoT is dualroot.

SP_CONTENT_CERT_ID is the certificate file which is currently generated
and signed with trusted world key which in-turn is derived from Silicon
provider RoT key.
To allow dual signing domain for SP packages, other certificate file
will be derived from Platform owned RoT key.

This patch renames "SP_CONTENT_CERT_ID" to "SIP_SP_CONTENT_CERT_ID" and
does other related changes.
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I0bc445a3ab257e2dac03faa64f46e36a9fed5e93