- 22 Jan, 2020 1 commit
-
-
Anthony Steinhauser authored
Even though ERET always causes a jump to another address, aarch64 CPUs speculatively execute following instructions as if the ERET instruction was not a jump instruction. The speculative execution does not cross privilege-levels (to the jump target as one would expect), but it continues on the kernel privilege level as if the ERET instruction did not change the control flow - thus execution anything that is accidentally linked after the ERET instruction. Later, the results of this speculative execution are always architecturally discarded, however they can leak data using microarchitectural side channels. This speculative execution is very reliable (seems to be unconditional) and it manages to complete even relatively performance-heavy operations (e.g. multiple dependent fetches from uncached memory). This was fixed in Linux, FreeBSD, OpenBSD and Optee OS: https://github.com/torvalds/linux/commit/679db70801da9fda91d26caf13bf5b5ccc74e8e8 https://github.com/freebsd/freebsd/commit/29fb48ace4186a41c409fde52bcf4216e9e50b61 https://github.com/openbsd/src/commit/3a08873ece1cb28ace89fd65e8f3c1375cc98de2 https://github.com/OP-TEE/optee_os/commit/abfd092aa19f9c0251e3d5551e2d68a9ebcfec8a It is demonstrated in a SafeSide example: https://github.com/google/safeside/blob/master/demos/eret_hvc_smc_wrapper.cc https://github.com/google/safeside/blob/master/kernel_modules/kmod_eret_hvc_smc/eret_hvc_smc_module.c Signed-off-by: Anthony Steinhauser <asteinhauser@google.com> Change-Id: Iead39b0b9fb4b8d8b5609daaa8be81497ba63a0f
-
- 20 Jan, 2020 8 commits
-
-
Lionel Debieve authored
Add QSPI support (limited to read interface). Implements the memory map and indirect modes. Low level driver based on SPI-MEM operations. Change-Id: Ied698e6de3c17d977f8b497c81f2e4a0a27c0961 Signed-off-by: Lionel Debieve <lionel.debieve@st.com> Signed-off-by: Christophe Kerello <christophe.kerello@st.com>
-
Lionel Debieve authored
Add fmc2_nand driver support. The driver implements only read interface for NAND devices. Change-Id: I3cd037e8ff645ce0d217092b96f33ef41cb7a522 Signed-off-by: Lionel Debieve <lionel.debieve@st.com> Signed-off-by: Christophe Kerello <christophe.kerello@st.com>
-
Lionel Debieve authored
Device size could be more than 4GB, we must define size as unsigned long long. Change-Id: I52055cf5c1c15ff18ab9e157aa9b73c8b4fb7b63 Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
-
Lionel Debieve authored
Add the standard CLAMP macro. It ensures that x is between the limits set by low and high. If low is greater than high the result is undefined. Signed-off-by: Lionel Debieve <lionel.debieve@st.com> Change-Id: Ia173bb9ca51bc8d9a8ec573bbc15636a94f881f4
-
Lionel Debieve authored
SPI-NOR framework is based on SPI-MEM framework using spi_mem_op execution interface. It implements read functions and allows NOR configuration up to quad mode. Default management is 1 data line but it can be overridden by platform. It also includes specific quad mode configuration for Spansion, Micron and Macronix memories. Change-Id: If49502b899b4a75f6ebc3190f6bde1013651197f Signed-off-by: Lionel Debieve <lionel.debieve@st.com> Signed-off-by: Christophe Kerello <christophe.kerello@st.com>
-
Lionel Debieve authored
This framework supports SPI-NAND and is based on the SPI-MEM framework for SPI operations. It uses a common high level access using the io_mtd. It is limited to the read functionalities. Default behavior is the basic one data line operation but it could be overridden by platform. Change-Id: Icb4e0887c4003a826f47c876479dd004a323a32b Signed-off-by: Lionel Debieve <lionel.debieve@st.com> Signed-off-by: Christophe Kerello <christophe.kerello@st.com>
-
Lionel Debieve authored
This framework supports SPI operations using a common spi_mem_op structure: - command - addr - dummy - data The framework manages SPI bus configuration: - speed - bus width (Up to quad mode) - chip select Change-Id: Idc2736c59bfc5ac6e55429eba5d385275ea3fbde Signed-off-by: Lionel Debieve <lionel.debieve@st.com> Signed-off-by: Christophe Kerello <christophe.kerello@st.com>
-
Lionel Debieve authored
The raw NAND framework supports SLC NAND devices. It introduces a new high level interface (io_mtd) that defines operations a driver can register to the NAND framework. This interface will fill in the io_mtd device specification: - device_size - erase_size that could be used by the io_storage interface. NAND core source file integrates the standard read loop that performs NAND device read operations using a skip bad block strategy. A platform buffer must be defined in case of unaligned data. This buffer must fit to the maximum device page size defined by PLATFORM_MTD_MAX_PAGE_SIZE. The raw_nand.c source file embeds the specific NAND operations to read data. The read command is a raw page read without any ECC correction. This can be overridden by a low level driver. No generic support for write or erase command or software ECC correction. NAND ONFI detection is available and can be enabled using NAND_ONFI_DETECT=1. For non-ONFI NAND management, platform can define required information. Change-Id: Id80e9864456cf47f02b74938cf25d99261da8e82 Signed-off-by: Lionel Debieve <lionel.debieve@st.com> Signed-off-by: Christophe Kerello <christophe.kerello@st.com>
-
- 15 Jan, 2020 1 commit
-
-
Luka Kovacic authored
Implements a way to add platform specific power off code to a Marvell Armada 8K platform. Marvell Armada 8K boards can now add a board/system_power.c file that contains a system_power_off() function. This function can now send a command to a power management MCU or other board periferals before shutting the board down. Signed-off-by: Luka Kovacic <luka.kovacic@sartura.hr> Cc: Luka Perkov <luka.perkov@sartura.hr> Change-Id: Iaba20bc2f603195679c54ad12c0c18962dd8e3db --- I am working on a device that will be ported later, which has a custom power management MCU that handles LEDs, board power and fans and requires this separation.
-
- 10 Jan, 2020 2 commits
-
-
Yann Gautier authored
IO seek offset can be set to values above UINT32_MAX, this change changes the seek offset argument from 'ssize_t' to 'signed long long'. Fixing platform seek functions to match the new interface update. Change-Id: I25de83b3b7abe5f52a7b0fee36f71e60cac9cfcb Signed-off-by: Yann Gautier <yann.gautier@st.com> Signed-off-by: Etienne Carriere <etienne.carriere@st.com> Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
-
Deepika Bhavnani authored
NOTE for platform integrators: API `plat_psci_stat_get_residency()` third argument `last_cpu_idx` is changed from "signed int" to the "unsigned int" type. Issue / Trouble points 1. cpu_idx is used as mix of `unsigned int` and `signed int` in code with typecasting at some places leading to coverity issues. 2. Underlying platform API's return cpu_idx as `unsigned int` and comparison is performed with platform specific defines `PLAFORM_xxx` which is not consistent Misra Rule 10.4: The value of a complex expression of integer type may only be cast to a type that is narrower and of the same signedness as the underlying type of the expression. Based on above points, cpu_idx is kept as `unsigned int` to match the API's and low-level functions and platform defines are updated where ever required Signed-off-by: Deepika Bhavnani <deepika.bhavnani@arm.com> Change-Id: Ib26fd16e420c35527204b126b9b91e8babcc3a5c
-
- 09 Jan, 2020 2 commits
-
-
Olivier Deprez authored
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Change-Id: I2953f0a6f35bc678402bc185640d1f328b065af5
-
Madhukar Pappireddy authored
In further patches, we aim to enable -Wredundant-decls by default. This rearragement of helper macros is necessary to make Coverity tool happy as well as making sure there are no redundant function declarations for PMF related declarations. Also, PMF related macros were added to provide appropriate function declarations for helper APIs which capture PSCI statistics. Change-Id: I36273032dde8fa079ef71235ed3a4629c5bfd981 Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
-
- 03 Jan, 2020 1 commit
-
-
Vishnu Banavath authored
The SCU connects one to four Cortex-A5/Cortex-A9 processors to the memory system through the AXI interfaces. The SCU functions are to: - maintain data cache coherency between the Cortex-A5/Cortex-A9 processors - initiate L2 AXI memory accesses - arbitrate between Cortex-A5/Cortex-A9 processors requesting L2 accesses - manage ACP accesses. Snoop Control Unit will enable to snoop on other CPUs caches. This is very important when it comes to synchronizing data between CPUs. As an example, there is a high chance that data might be cache'd and other CPUs can't see the change. In such cases, if snoop control unit is enabled, data is synchoronized immediately between CPUs and the changes are visible to other CPUs. This driver provides functionality to enable SCU as well as enabling user to know the following - number of CPUs present - is a particular CPU operating in SMP mode or AMP mode - data cache size of a particular CPU - does SCU has ACP port - is L2CPRESENT Change-Id: I0d977970154fa60df57caf449200d471f02312a0 Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
-
- 30 Dec, 2019 1 commit
-
-
Andre Przywara authored
On some platforms the UART might have already been initialised, for instance by firmware running before TF-A or by a separate management processor. In this case it would not be need to initialise it again (doing so could create spurious characters). But more importantly this saves us from knowing the right baudrate and the right base clock rate for the UART. This can lead to more robust and versatile firmware builds. Allow to skip the 16550 UART initialisation and baud rate divisor programming, by interpreting an input clock rate of "0" to signify this case. This will just skip the call to console_16550_core_init, but still will register the console properly. Users should just pass 0 as the second parameter, the baudrate (third parameter) will then be ignored as well. Fix copy & paste typos in comments for the console_16550_register() function on the way. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Change-Id: I9f8fca5b358f878fac0f31dc411358fd160786ee
-
- 29 Dec, 2019 1 commit
-
-
Samuel Holland authored
Some platforms are extremely memory constrained and must split BL31 between multiple non-contiguous areas in SRAM. Allow the NOBITS sections (.bss, stacks, page tables, and coherent memory) to be placed in a separate region of RAM from the loaded firmware image. Because the NOBITS region may be at a lower address than the rest of BL31, __RW_{START,END}__ and __BL31_{START,END}__ cannot include this region, or el3_entrypoint_common would attempt to invalidate the dcache for the entire address space. New symbols __NOBITS_{START,END}__ are added when SEPARATE_NOBITS_REGION is enabled, and the dcached for the NOBITS region is invalidated separately. Signed-off-by: Samuel Holland <samuel@sholland.org> Change-Id: Idedfec5e4dbee77e94f2fdd356e6ae6f4dc79d37
-
- 23 Dec, 2019 2 commits
-
-
Madhukar Pappireddy authored
Erratum 1688305 is a Cat B erratum present in r0p0, r0p1 versions of Hercules core. The erratum can be avoided by setting bit 1 of the implementation defined register CPUACTLR2_EL1 to 1 to prevent store- release from being dispatched before it is the oldest. Change-Id: I2ac04f5d9423868b6cdd4ceb3d0ffa46e570efed Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
-
Sheetal Tigadoli authored
Add additional field definitions for Cortex_A72 L2 Control registers Change-Id: I5ef3a6db41cd7c5d9904172720682716276b7889 Signed-off-by: Sheetal Tigadoli <sheetal.tigadoli@broadcom.com>
-
- 20 Dec, 2019 5 commits
-
-
Paul Beesley authored
The contents of this header have been merged into the spm_mm_svc.h header file. Change-Id: I01530b2e4ec1b4c091ce339758025e2216e740a4 Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
Change-Id: I91c192924433226b54d33e57d56d146c1c6df81b Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
Before adding any new SPM-related components we should first do some cleanup around the existing SPM-MM implementation. The aim is to make sure that any SPM-MM components have names that clearly indicate that they are MM-related. Otherwise, when adding new SPM code, it could quickly become confusing as it would be unclear to which component the code belongs. The secure_partition.h header is a clear example of this, as the name is generic so it could easily apply to any SPM-related code, when it is in fact SPM-MM specific. This patch renames the file and the two structures defined within it, and then modifies any references in files that use the header. Change-Id: I44bd95fab774c358178b3e81262a16da500fda26 Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
Paul Beesley authored
The Secure Partition Manager (SPM) prototype implementation is being removed. This is preparatory work for putting in place a dispatcher component that, in turn, enables partition managers at S-EL2 / S-EL1. This patch removes: - The core service files (std_svc/spm) - The Resource Descriptor headers (include/services) - SPRT protocol support and service definitions - SPCI protocol support and service definitions Change-Id: Iaade6f6422eaf9a71187b1e2a4dffd7fb8766426 Signed-off-by: Paul Beesley <paul.beesley@arm.com> Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com>
-
Paul Beesley authored
There are two different implementations of Secure Partition management in TF-A. One is based on the "Management Mode" (MM) design, the other is based on the Secure Partition Client Interface (SPCI) specification. Currently there is a dependency between their build flags that shouldn't exist, making further development harder than it should be. This patch removes that dependency, making the two flags function independently. Before: ENABLE_SPM=1 is required for using either implementation. By default, the SPCI-based implementation is enabled and this is overridden if SPM_MM=1. After: ENABLE_SPM=1 enables the SPCI-based implementation. SPM_MM=1 enables the MM-based implementation. The two build flags are mutually exclusive. Note that the name of the ENABLE_SPM flag remains a bit ambiguous - this will be improved in a subsequent patch. For this patch the intention was to leave the name as-is so that it is easier to track the changes that were made. Change-Id: I8e64ee545d811c7000f27e8dc8ebb977d670608a Signed-off-by: Paul Beesley <paul.beesley@arm.com>
-
- 18 Dec, 2019 1 commit
-
-
Ambroise Vincent authored
Provide an SMC interface to the 9p filesystem. This permits accessing firmware drivers through a common interface, using standardized read/write/control operations. Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com> Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Change-Id: I9314662314bb060f6bc02714476574da158b2a7d
-
- 17 Dec, 2019 2 commits
-
-
Bence Szépkúti authored
Ported the pmf asm macros and the asm code in the bl31 entrypoint necessary for the instrumentation to AArch32. Since smc dispatch is handled by the bl32 payload on AArch32, we provide this service only if AARCH32_SP=sp_min is set. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com> Change-Id: Id33b7e9762ae86a4f4b40d7f1b37a90e5130c8ac
-
Olivier Deprez authored
The 9p interface provides abstraction layers allowing the software that uses devices to be independent from the hardware. This patch provides a file system abstraction to link drivers to their devices and propose a common interface to expose driver operations to higher layers. This file system can be used to access and configure a device by doing read/write operations. Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com> Signed-off-by: Olivier Deprez <olivier.deprez@arm.com> Change-Id: Ia9662393baf489855dc0c8f389fe4a0afbc9c255
-
- 16 Dec, 2019 1 commit
-
-
Bence Szépkúti authored
SIZE_MAX was mistakenly redefined from UINT32_MAX to UINT64_MAX on AArch32 when the arch-specific headers were merged. This value is not currently used by upstream TF-A source code, so no functionality should be affected. Change-Id: I2acf7f8736423697c7377e8ed4b08843ced26e66 Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
-
- 14 Dec, 2019 2 commits
-
-
Samuel Holland authored
Previously, the A64/H5 and H6 platforms' PMIC setup code was entirely independent. However, some H6 boards also need early regulator setup. Most of the register interface and all of the device tree traversal code can be reused between the AXP803 and AXP805. The main difference is the hardware bus interface, so that part is left to the platforms. The remainder is moved into a driver. I factored out the bits that were obviously specific to the AXP803; additional changes for compatibility with other PMICs can be made as needed. The only functional change is that rsb_init() now checks the PMIC's chip ID register against the expected value. This was already being done in the H6 version of the code. Signed-off-by: Samuel Holland <samuel@sholland.org> Change-Id: Icdcf9edd6565f78cccc503922405129ac27e08a2
-
Samuel Holland authored
This adds the new regulator list, as well as changes to make the switch (equivalent to DC1SW on the AXP803) work on both PMICs. Signed-off-by: Samuel Holland <samuel@sholland.org> Change-Id: I9a1eac8ddfc54b27096c10a8eebdd51aaf9b8311
-
- 12 Dec, 2019 1 commit
-
-
Manish Pandey authored
When a Firmware is complied as Position Independent Executable it needs to request GDT fixup by passing size of the memory region to el3_entrypoint_common macro. The Global descriptor table fixup will be done early on during cold boot process of primary core. Currently only BL31 supports PIE, but in future when BL2_AT_EL3 will be compiled as PIE, it can simply pass fixup size to the common el3 entrypoint macro to fixup GDT. The reason for this patch was to overcome the bug introduced by SHA 330ead80 which called fixup routine for each core causing re-initializing of global pointers thus overwriting any changes done by the previous core. Change-Id: I55c792cc3ea9e7eef34c2e4653afd04572c4f055 Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
-
- 11 Dec, 2019 2 commits
-
-
Gilad Ben-Yossef authored
Add the support needed to enable using CryptoCell integration with with RSA 3K support. Signed-off-by: Gilad Ben-Yossef <gilad.benyossef@arm.com> Change-Id: I95527cb0c41ae012109e8968dd20a4ae9fe67f17
-
Ambroise Vincent authored
This function scans a string backwards from the end for the first instance of a character. Change-Id: I46b21573ed25a0ff222eac340e1e1fb93b040763 Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
-
- 10 Dec, 2019 1 commit
-
-
Ambroise Vincent authored
C99 standard: "What constitutes an access to an object that has volatile-qualified type is implementation-defined". GCC is not considering the cast to void of volatile structures as an access and so is not actually issuing reads. Clang does read those structures by copying them on the stack, which in this case creates an overflow because of their large size. This patch removes the cast to void and instead uses the USED attribute to tell the compiler to retain the static variables. Change-Id: I952b5056e3f6e91841e7ef9558434352710ab80d Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com> Zelalem Aweke <zelalem.aweke@arm.com>
-
- 09 Dec, 2019 1 commit
-
-
Ambroise Vincent authored
Previously the .init section was created even when the reclaim flag was manually set to 0. Change-Id: Ia9e7c7997261f54a4eca725d7ea605192f60bcf8 Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com> Zelalem Aweke <zelalem.aweke@arm.com>
-
- 06 Dec, 2019 5 commits
-
-
Artsem Artsemenka authored
Check that entry point information requesting S-EL2 has AArch64 as an execution state during context setup. Signed-off-by: Artsem Artsemenka <artsem.artsemenka@arm.com> Change-Id: I447263692fed6e55c1b076913e6eb73b1ea735b7
-
Achin Gupta authored
This patch adds support for enabling S-EL2 if this EL is specified in the entry point information being used to initialise a secure context. It is the caller's responsibility to check if S-EL2 is available on the system before requesting this EL through the entry point information. Signed-off-by: Achin Gupta <achin.gupta@arm.com> Change-Id: I2752964f078ab528b2e80de71c7d2f35e60569e1
-
Bence Szépkúti authored
Consolidate the definition of size_t to one header per AArch, and the definition of NULL to one header Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com> Change-Id: Iecfbad2cf360cfb705ce7aaa981700fd16219b82
-
Bence Szépkúti authored
As supporting architectures aside from AArch32 and AArch64 is not a concern, keeping identical definitions in two places for a large part of the libc seems counterproductive The int128 types were left un-unified as __int128 is not supported by gcc on AArch32 Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com> Change-Id: Idf08e6fab7e4680d9da62d3c57266ea2d80472cf
-
Bence Szépkúti authored
Conceptually, these are supposed to be the largest integers representable in C, but GCC and Clang define them as long long for compatibility. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com> Change-Id: I7c0117f3be167342814d260a371889120dcf6576
-