Created a function to abort all pending NS DMA transactions to
engage complete DMA protection. This call will be used by the
subsequent DRTM implementation changes.
Signed-off-by: Manish V Badarkhe <manish.badarkhe@arm.com>
Signed-off-by: Lucian Paul-Trifu <lucian.paultrifu@gmail.com>
Change-Id: I94992b54c570327d6746295073822a9c0ebdc85d
This commit adds a driver to conduct the AP's communication
with the Runtime Security Subsystem (RSS).
RSS is Arm's reference implementation for the CCA HES [1].
It can be considered as a secure enclave to which, for example,
certain services can be offloaded such as initial attestation.
RSS comms driver:
- Relies on MHU v2.x communication IP, using a generic MHU API,
- Exposes the psa_call(..) API to the upper layers.
[1] https://developer.arm.com/documentation/DEN0096/latest
Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Signed-off-by: David Vincze <david.vincze@arm.com>
Change-Id: Ib174ac7d1858834006bbaf8aad0eb31e3a3ad107
The Arm Message Handling Unit (MHU) is a mailbox controller used to
communicate with other processing element(s). Adding a driver to
enable the communication:
- Adding generic MHU driver interface,
- Adding MHU_v2_x driver.
Driver supports:
- Discovering available MHU channels,
- Sending / receiving words over MHU channels,
- Signaling happens over a dedicated channel.
Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Signed-off-by: David Vincze <david.vincze@arm.com>
Change-Id: I41a5b968f6b8319cdbdf7907d70bd8837839862e
This change performs a basic configuration of the SMMU root registers
interface on an RME enabled system. This permits enabling GPC checks
for transactions originated from a non-secure or secure device upstream
to an SMMU. It re-uses the boot time GPT base address and configuration
programmed on the PE.
The root register file offset is platform dependent and has to be
supplied on a model command line.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I4f889be6b7afc2afb4d1d147c5c1c3ea68f32e07
The following SMIDs are disabled by default.
* GICD: MBIST REQ error and GICD FMU ClkGate override
* PPI: MBIST REQ error and PPI FMU ClkGate override
* ITS: MBIST REQ error and ITS FMU ClkGate override
This patch explicitly enables them during the FMU init sequence.
Change-Id: I573e64786e3318d4cbcd07d0a1caf25f8e6e9200
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch updates the gic600_fmu_init function to disable all safety
mechanisms for a block ID that is not present on the platform. All
safety mechanisms for GIC-600AE are enabled by default and should be
disabled for blocks that are not present on the platform to avoid
false positive RAS errors.
Change-Id: I52dc3bee9a8b49fd2e51d7ed851fdc803a48e6e3
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
The GIC-600AE uses a range of RAS features for all RAMs, which include
SECDED, ECC, and Scrub, software and bus error reporting. The GIC makes
all necessary information available to software through Armv8.2 RAS
architecture compliant register space.
This patch introduces support to probe the FMU_ERRGSR register to find
the right error record. Once the correct record is identified, the
"handler" function queries the FMU_ERR<m>STATUS register to further
identify the block ID, safety mechanism and the architecturally defined
primary error code. The description of the error is displayed on the
console to simplify debug.
Change-Id: I7e543664b74457afee2da250549f4c3d9beb1a03
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
As filter is unsigned, we have to use %u and not %d.
This avoids warning when -Wformat-signedness is enabled.
Change-Id: I9fc9f15774dc974edfa3db65f5aecd1e70bc146b
Signed-off-by: Yann Gautier <yann.gautier@st.com>
When tf-a is built with the llvm toolchain, the compiler optimizes the
variable in some way which results in SCMI_MSG_GET_TOKEN assert failure
in multiple places. This patch makes the msg_header variable in
mailbox_mem struct volatile, which seems to fix the issue.
Signed-off-by: sahil <sahil@arm.com>
Change-Id: I1d28b30a6472fc23ed85adff9cf73dfb536e39cc
As mpidr is unsigned long long, U should be ULL. We use macro to
fix this issue.
Signed-off-by: Ming Huang <huangming@linux.alibaba.com>
Change-Id: I7dfd51a63f27f471794bcbf72ffff0c1a0598b46
The previous codes were using the cntpct_el0 to check the time
elapsed. But this physical timer does not seem to count for
the expected time resulting in gic fmu communication failures
on Tegra platforms.
This patch uses the delay_timer instead to use a platform
defined timer for calculating timeouts.
Change-Id: Ic8646ad1662c9928ac64c4152deb27e8c86fe344
Signed-off-by: Anthony Zhou <anzhou@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
The GIC specification describes ID registers in each GIC register frame
(PIDRx), which can be used to identify a GIC component. The Arm Ltd. GIC
implementations use certain ID values to identify the distributor, the
redistributors and other parts like ITSes.
Introduce a function that reads those part number IDs, which are spread
over two registers. The actual numbers are only meaningful in connection
with a certain GIC model, which would need to be checked beforehand, by
the caller.
Change-Id: Ia6ff326a1e8b12664e4637bc8e2683d2b5c7721c
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
there are features which are marked as experimental even though they
are stable and used for quite some time.
Following features are no longer marked as experimental
- SPMD
- MEASURED_BOOT
- FCONF and associated build flags
- DECRYPTION_SUPPORT and associated build flags
- ENABLE_PAUTH
- ENABLE_BTI
- USE_SPINLOCK_CAS
- GICv3 Multichip support
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I4bb653d9c413c66095ec31f0b8aefeb13ea04ee9
Currently the SCMI driver reports:
INFO: Initializing driver on Channel 0
on the console, which is not very specific (which driver?).
Add "SCMI" to the message so the user knows what the firmware is trying
to initialise.
Change-Id: Id8202655d07b8e12fe07670d462c6202e6eae2f0
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Add support for Arm Ethos-N NPU multi-device.
The device tree parsing currently only supports one NPU device with
multiple cores. To be able to support multi-device NPU configurations
this patch adds support for having multiple NPU devices in the device
tree.
To be able to support multiple NPU devices in the SMC API, it has been
changed in an incompatible way so the API version has been bumped.
Signed-off-by: Laurent Carlier <laurent.carlier@arm.com>
Change-Id: Ide279ce949bd06e8939268b9601c267e45f3edc3
Disabling filter 0 causes inability to access DRAM.
An attempt leads to an abort.
ARM manual disallows to disable filter 0, but if we do
that from SRAM, nothing bad happens.
This patch prevents disabling of a filter 0, allowing to
reconfigure other filters from DRAM.
Note: this patch doesn't change the logic after reset.
It is only needed in case someone wants to reconfigure the
previously configured TZASC.
Change-Id: I196a0cb110a89afbde97f64a94df3101f28708a4
Signed-off-by: stsp@users.sourceforge.net
Add a new function that allows to enable or disabled filters on
configured regions dynamically. This will avoid the need to
reconfigure the entire attribute and just manage to
enable/disable filters.
Change-Id: If0937ca755bec6c45d3649718147108459682fff
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
The FMU is part of the GIC Distributor (GICD) component. It implements
the following functionality in GIC-600AE:
* Provides software the means to enable or disable a Safety Mechanism
within a GIC block.
* Receives error signaling from all Safety Mechanisms within other GIC
blocks.
* Maintains error records for each GIC block, for software inspection
and provides information on the source of the error.
* Retains error records across functional reset.
* Enables software error recovery testing by providing error injection
capabilities in a Safety Mechanism.
This patch introduces support to enable error detection for all safety
mechanisms provided by the FMU. Platforms are expected to invoke the
initialization function during cold boot.
The support for the FMU is guarded by the GICV3_SUPPORT_GIC600AE_FMU
makefile variable. The default value of this variable is '0'.
Change-Id: I421c3d059624ddefd174cb1140a2d2a2296be0c6
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
At the moment we have a GIC_ENABLE_V4_EXTN build time variable to
determine whether the GIC interrupt controller is compliant to version
4.0 of the spec or not. This just changes the number of 64K MMIO pages
we expect per redistributor.
To support firmware builds which run on variable systems (emulators,
fast model or FPGAs), let's make this decision at runtime.
The GIC specification provides several architected flags to learn the
size of the MMIO frame per redistributor, we use GICR_TYPER[VLPI] here.
Provide a (static inline) function to return the size of each
redistributor.
We keep the GIC_ENABLE_V4_EXTN build time variable around, but change
its meaning to enable this autodetection code. Systems not defining this
rely on a "pure" GICv3 (as before), but platforms setting it to "1" can
now deal with both configurations.
Change-Id: I9ede4acf058846157a0a9e2ef6103bf07c7655d9
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
At the moment we have a GIC_ENABLE_V4_EXTN build time variable to
determine whether the GIC interrupt controller is compliant to version
4.0 of the GIC spec or not.
In case of the GIC-600 multichip support we were somewhat abusing that
flag to differentiate between a GIC-700 and GIC-600 implementation
being used in the system.
To avoid a build time dependency on this flag, look at the GICD_IIDR
register and check if the hardware is a GIC-600 or not, to make this
decision at runtime. We then use the values for either GIC-700 or the
GIC-600, respectively.
Change-Id: I8c09ec1cd6fd60d28da879ed55ffef5506f9869d
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
For the GIC power management we need to identify certain GIC
implementations, so we have the IIDR values for some Arm Ltd. GIC models
defined.
We will need those number elsewhere very soon, so export them to a
shared header file, to avoid defining them again.
Change-Id: I1b8e2d93d6cea0d066866143c89eef736231134f
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
The GIC IP formerly known as "GIC Clayton" has been released under the
name of "GIC-700".
Rename occurences of Clayton in comments and macro names to reflect the
official name.
Change-Id: Ie8c55f7da7753127d58c8382b0033c1b486f7909
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
A RAS error may be triggered while offline core in OS. Error:
Uncorrected software error in the Distributor, with IERR=9,SERR=f.
Core put to sleep before its Group enables were cleared.
gicv3_cpuif_disable() will be called in offline core flow.
According to GIC architecture version 3 and version 4:
Architectural execution of a DSB instruction guarantees that
the last value written to ICC_IGRPEN0_EL1, ICC_IGRPEN1_EL1,
ICC_IGRPEN1_EL3 or GICC_CTLR.{EnableGrp0, EnableGrp1}is observed
by the associated Redistributor.
An ISB or other context synchronization operation must precede
the DSB to ensure visibility of System register writes.
Signed-off-by: Ming Huang <huangming@linux.alibaba.com>
Change-Id: Iff1475657f401374c761b5e8f2f5b3a4b2040e9d
Use helper functions to get SPI and ESPI INTID limit, to remove
several pieces of similar code in gicv3 driver.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: Iaf441fe5e333c4260e7f6d98df6fdd931591976d
Add helper function gicv3_get_espi_limit() to get the value of
(maximum extended SPI INTID + 1), so that some duplicated code can be
removed later.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I0355ca2647f872e8189add259f6c47d415494cce
Add newline(\n) to make the message clearer when the warnings are
really triggered.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I5e2574a52c9065db32ecb4d453b9b02445f69a82
Add helper function gicv3_get_spi_limit() to get the value of (maximum
SPI INTID + 1), so that some duplicated code can be removed later.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I160c8a88fbb71d22790b8999a84afbfba766f5e7
By default the Arm Ethos-N NPU will boot up in secure mode. In this mode
the non-secure world cannot access the registers needed to use the NPU.
To still allow the non-secure world to use the NPU, a SiP service has
been added that can delegate non-secure access to the registers needed
to use it.
Only the HW_CONFIG for the Arm Juno platform has been updated to include
the device tree for the NPU and the platform currently only loads the
HW_CONFIG in AArch64 builds.
Signed-off-by: Mikael Olsson <mikael.olsson@arm.com>
Change-Id: I65dfd864042ed43faae0a259dcf319cbadb5f3d2
The legacy console is gone. Re-add DCC console support based
on the multi-console framework.
Signed-off-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@xilinx.com>
Acked-by: Michal Simek <michal.simek@xilinx.com>
Change-Id: Ia8388721093bc1be3af40974530d7c9a9ae5f43e
A new function tzc400_it_handler() is created to manage TZC400
interrupts. The required helpers to read and clear interrupts are added
as well.
In case DEBUG is enabled, more information about the faulty access
(address, NSAID, type of access) is displayed.
Change-Id: Ie9ab1c199a8f12b2c9472d7120efbdf35711284a
Signed-off-by: Yann Gautier <yann.gautier@st.com>
* changes:
drivers/gicv3: also shift eSPI register offset in GICD_OFFSET_64()
drivers/gicv3: add debug log for maximum INTID of SPI and eSPI
drivers/gicv3: limit SPI ID to avoid misjudgement in GICD_OFFSET()
drivers/gicv3: fix logical issue for num_eints
drivers/gicv3: fix potential GICD context override with ESPI enabled
drivers/gicv3: use mpidr to probe GICR for current CPU
TZC_400_REGION_ATTR_FILTER_BIT_ALL is a simple constant definition, so
it can't get the real filter number to construct the bit flag for all
existing filters. If the platform doesn't have 4 filters, passing
FILTER_BIT_ALL to tzc400_configure_region() will cause assertion or
misconfiguration. So adjust the bit flag against the real filter
number.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: Ie5c48303485f3b5015772961ee7c34746121ee84
ESPI register offset should also be shifted right by REG##R_SHIFT to
keep consistent.
It is not a functional issue, for GICD_OFFSET_64() is only used for
GICD_IROUTER<E>, and IROUTER_SHIFT is 0.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I76eee5c50e4300890e78e80bddde135ce88daa2d
Add debug log for the maximum supported INTID of SPI and eSPI on the
current GIC implementation.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: Ie45ab1d85b39658c4ca4bc54ee433ac44e41d03f
The GICv3 architecture allows GICD_TYPER.ITLinesNumber to be 31, so
the maximum possible value for num_ints is 1024. The value must be
limited to (MAX_SPI_ID + 1), or GICD_OFFSET() will consider it as ESPI
INTID and return wrong register address.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: Iddcb83d3e5d241b39f4176c19c2bceaa2c3dd653
In function gicv3_spis_config_defaults(), the variable num_ints is set
to (maximum SPI INTID + 1), while num_eints is set to (maximum ESPI
INTID). It introduces not only inconsistency to the code, but also
logical bug in the "for" loops, for the INTID of num_eints is also
valid and the check should be inclusive.
Fix this by setting num_eints to (maximum ESPI INTID + 1) as well.
Fix similar issues in gicv3_distif_save() and
gicv3_distif_init_restore().
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I4425777d17e84e85f38853603340bd348640154f
RESTORE/SAVE_GICD_EREGS uses (int_id - (MIN_ESPI_ID - MIN_SPI_ID)) to
get the context array index for ESPI, which will override the space of
standard SPI starting from (MIN_SPI_ID + MIN_SPI_ID).
However, using TOTAL_SPI_INTR_NUM to replace the above MIN_SPI_ID
cannot totally fix the issue, for TOTAL_SPI_INTR_NUM is not well
aligned and the array index will be rounded down by the shifting
operation if being shifted more than 2 bits. It will cause buffer
override again when the existing maximum SPI reaches 1019.
So round up TOTAL_SPI_INTR_NUM with (1 << REG##R_SHIFT) for GICD
context arrays.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I5be2837c42f381a62f8d46a4ecd778009b1fe059
In function gicv3_rdistif_probe(), line #1322 implies
gicv3_driver_data->mpidr_to_core_pos() may be null, but the original
code uses this interface to get current CPU index unconditionally.
It is better to use MPIDR to probe GICR which does not depend on
gicv3_driver_data->mpidr_to_core_pos().
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I64add055385040fe0a56b977e2299608e2309a6e
Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
This resolves the following required rule:
bl1/aarch64/bl1_context_mgmt.c:81:[MISRA C-2012 Rule 10.7 (required)]<None>
The width of the composite expression "0U | ((mode & 3U) << 2U) | 1U |
0x3c0U" (32 bits) is less that the right hand operand
"18446744073709547519ULL" (64 bits).
This also resolves MISRA defects such as:
bl2/aarch64/bl2arch_setup.c:18:[MISRA C-2012 Rule 12.2 (required)]
In the expression "3U << 20", shifting more than 7 bits, the number
of bits in the essential type of the left expression, "3U", is
not allowed.
Further, MISRA requires that all shifts don't overflow. The definition of
PAGE_SIZE was (1U << 12), and 1U is 8 bits. This caused about 50 issues.
This fixes the violation by changing the definition to 1UL << 12. Since
this uses 32bits, it should not create any issues for aarch32.
This patch also contains a fix for a build failure in the sun50i_a64
platform. Specifically, these misra fixes removed a single and
instruction,
92407e73 and x19, x19, #0xffffffff
from the cm_setup_context function caused a relocation in
psci_cpus_on_start to require a linker-generated stub. This increased the
size of the .text section and caused an alignment later on to go over a
page boundary and round up to the end of RAM before placing the .data
section. This sectionn is of non-zero size and therefore causes a link
error.
The fix included in this reorders the functions during link time
without changing their ording with respect to alignment.
Change-Id: I76b4b662c3d262296728a8b9aab7a33b02087f16
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
In the function gicv2_set_spi_routing, the signed value proc_num is cast
to unsigned int before being compared to other unsigned values in two
assert calls. The value proc_num can be a negative value, and once the
negative value is cast to unsigned it becomes a very large number which
will trigger the assert. This patch changes the assert cast so that the
unsigned values are cast to signed instead, keeping the same functionality
but allowing proc_num to be negative.
This bug can be seen when running the SDEI RM_ANY routing mode test in
TFTF on the Juno platform.
This patch also makes the usage of the proc_num variable in other gicv2
functions more clear.
Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: If1b98eebb00bd9b73862e5e995e5e68c168170a6
And from crash_console_flush.
We ignore the error information return by console_flush in _every_
place where we call it, and casting the return type to void does not
work around the MISRA violation that this causes. Instead, we collect
the error information from the driver (to avoid changing that API), and
don't return it to the caller.
Change-Id: I1e35afe01764d5c8f0efd04f8949d333ffb688c1
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
A GICv3 interrupt controller will be instantiated for a certain number
of cores. This will result in the respective number of GICR frames. The
last frame will have the "Last" bit set in its GICR_TYPER register.
For platforms with a topology unknown at build time (the Arm FPGAs, for
instance), we need to learn the number of used cores at runtime, to size
the GICR region in the devicetree accordingly.
Add a generic function that iterates over all GICR frames until it
encounters one with the "Last" bit set. It returns the number of cores
the GICv3 has been configured for.
Change-Id: I79f033c50dfc1c275aba7122725868811abcc4f8
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
This patch fixes defects 10.3, 10.4, 10.7, 20.7
reported by MISRA-2012 scan and adds braces for
conditional statements according to the TF-A
coding style.
Change-Id: If84ed31cdd55bc8e7cdd2a5f48c0dacc25792112
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
Lucian Paul-Trifu
Tamas Ban
Olivier Deprez
Varun Wadekar
Yann Gautier
sah01
Ming Huang
anzhou
Andre Przywara
Sandrine Bailleux
Manish Pandey
Laurent Carlier
Stas Sergeev
Mark Dykes
Lionel Debieve
Heyi Guo
Mikael Olsson
Venkatesh Yadav Abbarapu
Joanna Farley
Mark Dykes
Jimmy Brisson
johpow01
Alexei Fedorov