We currently use ARM_PRELOADED_DTB_BASE build
variable to pass the kernel DTB base address to
the kernel when using the ARM_LINUX_KERNEL_AS_BL33
option. However this variable doesn't actually
change the DTB load address.
The DTB load address is actually specified in the
FW_CONFIG DTS (fvp_fw_config.dts) as 'hw_config'.
This patch passes the hw_config value instead of
ARM_PRELOADED_DTB_BASE allowing us to change
the kernel DTB load address through
fvp_fw_config.dts.
With this change we don't need the ARM_PRELOADED_DTB_BASE
build variable if RESET_TO_BL31 is not set.
Note that the hw_config value needs to be within the
ARM_DTB_DRAM_NS region specified by FVP_DTB_DRAM_MAP_START
and FVP_DTB_DRAM_MAP_SIZE.
This patch also expands the ARM_DTB_DRAM_NS region to 32MB.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Idd74cdf5d2c649bb320644392ba5d69e175a53a9
The macros PLAT_HW_CONFIG_DTB_BASE and PLAT_HW_CONFIG_DTB_SIZE
describe the range of memory where the HW_CONFIG_DTB can be loaded
rather than the actual load address and size of the DTB. This patch
changes the names to something more descriptive.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I98b81f3ce0c80fd76614f959667c25b07941e190
When RME is enabled, during configuration of the TrustZone controller,
Root regions are initially configured as Secure regions, and Realm
regions as Non-secure regions. Then later these regions are configured
as Root and Realm regions respectively in the GPT. According to the RME
architecture reference manual, Root firmware must ensure that Granule
Protection Check is enabled before enabling any stage of translation.
Therefore initializations are done as follows when RME is enabled :
Initialize/enable the TrustZone controller (plat_arm_security_setup) -->
Initialize/enable GPC (arm_bl2_plat_gpt_setup) -->
enable MMU (enable_mmu_el3)
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I91094e8259079437bee02de1f65edb9ad51e43cf
When FEAT_RME is enabled, memory is divided into four Physical
Address Spaces (PAS): Root, Realm, Secure and Non-secure.
This patch introduces new carveouts for the Trusted SRAM and DRAM
for the FVP platform accordingly.
The following new regions are introduced with this change:
ARM_MAP_L0_GPT_REGION: Trusted SRAM region used to store Level 0
Granule Protection Table (GPT). This region resides in the Root PAS.
ARM_MAP_GPT_L1_DRAM: DRAM region used to store Level 1 GPT. It
resides in the Root PAS.
ARM_MAP_RMM_DRAM: DRAM region used to store RMM image. It
resides in the Realm PAS.
The L0 GPT is stored on Trusted SRAM next to firmware configuration
memory. The DRAM carveout when RME is enable is modified as follow:
--------------------
| |
| AP TZC (~28MB) |
--------------------
| |
| REALM (32MB) |
--------------------
| |
| EL3 TZC (3MB) |
--------------------
| L1 GPT + SCP TZC |
| (~1MB) |
0xFFFF_FFFF --------------------
During initialization of the TrustZone controller, Root regions
are configured as Secure regions. Then they are later reconfigured
to Root upon GPT initialization.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: If2e257141d51f51f715b70d4a06f18af53607254
If FEAT_RME is enabled, EL3 runs in the Root world as opposed to
Secure world. This patch changes EL3 memory region attributes for
Arm platforms accordingly.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Ie176f8b440ff34330e4e44bd3bf8d9703b3892ff
This patch adds the necessary changes needed to build
and load RMM image for the FVP platform. RMM image is
loaded by BL2 after BL32 (if BL32 exists) and before BL33.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I1ac9eade84c2e35c7479a322ca1d090b4e626819
TRP is a small test payload that implements Realm Monitor
Management (RMM) functionalities. RMM runs in the Realm world
(R-EL2) and manages the execution of Realm VMs and their
interaction with the hypervisor in Normal world.
TRP is used to test the interface between RMM and Normal world
software, known as Realm Management Interface (RMI). Current
functions includes returning RMM version and transitioning
granules from Non-secure to Realm world and vice versa.
More information about RMM can be found at:
https://developer.arm.com/documentation/den0125/latest
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Ic7b9a1e1f3142ef6458d40150d0b4ba6bd723ea2
The latest FVP model fix which correctly checks if IRQs
are enabled in current exception level, is causing TFTF
tests to hang.
This patch adds setting SCR_EL3.I and SCR_EL3.F bits in
'fvp_cpu_standby()' function to allow CPU to exit from WFI.
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
Change-Id: Iceec1e9dbd805803d370ecdb10e04ad135d6b3aa
For convenience we let the build system generate an ELF file (named
bl31.axf), containing all the trampolines, BL31 code and the DTB in one
file. This can be fed directly into the FPGA payload tool, and it will
load the bits at the right addresses.
Since this ELF file is more used as a "container with load addresses",
there is no need for normal ELF features like alignment or a symbol
table.
Remove unnecessary sections from that output file, by doing a static
"link", dropping the NOBITS stacks section, and by adding "-n" to the
linker command line (to avoid page alignment). This trims the generated
.axf file, and makes it smaller.
Change-Id: I5768543101d667fb4a3b70e60b08cfe970d2a2b6
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
The arm64 Linux kernel needed to be loaded at a certain offset within any
2MB aligned region; this value was configured at compile time and stored
in the Linux kernel image header. The default value was always 512KiB,
so this is the value we use in the TF-A build system for the kernel
load address.
However the whole scheme around the TEXT_OFFSET changed in Linux v5.8:
Linux kernels became fully relocatable, so this value is largely ignored
now, and its default value changed to 0. The only remainder is a warning
message at boot time in case there is a mismatch:
[Firmware Bug]: Kernel image misaligned at boot, please fix your bootloader!
To avoid this warning, and to make TF-A Linux kernel boot protocol
compliant, we should load newer kernels to offset 0 of a 2 MB
region. This can be done by the user at FPGA boot time, but BL31 needs
to know about this address. As we can't change the build default to 0
without breaking older kernels, we should try to make a build dealing
with both versions:
This patch introduces a small trampoline code, which gets loaded at
512KB of DRAM, and branches up to 2MB. If users load their newer
kernels at 2MB, this trampoline will cover them. In case an older kernel
is loaded at 512KB, it will overwrite this trampoline code, so it would
still work.
Change-Id: If49ca86f5dca380036caf2555349748722901277
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Add support for Arm Ethos-N NPU multi-device.
The device tree parsing currently only supports one NPU device with
multiple cores. To be able to support multi-device NPU configurations
this patch adds support for having multiple NPU devices in the device
tree.
To be able to support multiple NPU devices in the SMC API, it has been
changed in an incompatible way so the API version has been bumped.
Signed-off-by: Laurent Carlier <laurent.carlier@arm.com>
Change-Id: Ide279ce949bd06e8939268b9601c267e45f3edc3
This patch adds the basic CPU library code to support the Hayes CPU
in TF-A. This CPU is based on the Klein core so that library code
has been adapted for use here.
Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: If0e0070cfa77fee8f6eebfee13d3c4f209ad84fc
Adding load, authentication, and transfer functionality from FVP R BL1 to
BL33, which will be the partner runtime code.
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I293cad09739dacac0d20dd57c1d98178dbe84d40
For v8-R64, especially R82, creating code to run BL1 at EL2, using MPU.
Signed-off-by: Gary Morrison <gary.morrison@arm.com>
Change-Id: I439ac3915b982ad1e61d24365bdd1584b3070425
Creating a platform port for FVP_R based on the FVP platform.
Differences including only-BL1, aarch64, Secure only, and EL2 being the
ELmax (No EL3).
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I1283e033fbd4e03c397d0a2c10c4139548b4eee4
The 'CORE_PWRDN_EN' bit of 'CPUPWRCTLR_EL1' register requires an
explicit write to clear it for hotplug and idle to function correctly.
So add Neoverse N2 CPU specific handler in platform reset handler to
clear the CORE_PWRDN_EN bit.
Signed-off-by: shriram.k <shriram.k@arm.com>
Change-Id: If3859447410c4b8e704588993941178fa9411f52
The 'CORE_PWRDN_EN' bit of 'CPUPWRCTLR_EL1' register requires an
explicit write to clear it for hotplug and idle to function correctly.
So add Neoverse V1 CPU specific handler in platform reset handler to
clear the CORE_PWRDN_EN bit.
Signed-off-by: shriram.k <shriram.k@arm.com>
Change-Id: I56084c42a56c401503a751cb518238c83cfca8ac
Currently the SP package loading mechanism is only enabled when S-EL2
SPMC is selected. Remove this limitation.
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
Change-Id: I5bf5a32248e85a26d0345cacff7d539eed824cfc
Update UUID to little endian:
The SPMC expects a little endian representation of the UUID as an array
of four integers in the SP manifest.
Add managed exit field and cosmetic comments updates.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Icad93ca70bc27bc9d83b8cf888fe5f8839cb1288
* changes:
feat(plat/fvp): enable trace extension features by default
feat(trf): enable trace filter control register access from lower NS EL
feat(trf): initialize trap settings of trace filter control registers access
feat(sys_reg_trace): enable trace system registers access from lower NS ELs
feat(sys_reg_trace): initialize trap settings of trace system registers access
feat(trbe): enable access to trace buffer control registers from lower NS EL
feat(trbe): initialize trap settings of trace buffer control registers access
Trusted Services had removed secure storage and added two new
trusted services - Protected Storage and Internal Trusted Storage.
Hence we are removing secure storage and adding support for the
internal trusted storage.
And enable external SP images in BL2 config for TC, so that
we do not have to modify this file whenever the list of SPs
changes. It is already implemented for fvp in the below commit.
commit 33993a3737
Author: Balint Dobszay <balint.dobszay@arm.com>
Date: Fri Mar 26 15:19:11 2021 +0100
feat(fvp): enable external SP images in BL2 config
Change-Id: I3e0a0973df3644413ca5c3a32f36d44c8efd49c7
Signed-off-by: Davidson K <davidson.kumaresan@arm.com>
BL2 passes FW_CONFIG to BL31 which contains information
about different DTBs present. BL31 then uses FW_CONFIG
to get the base address of HW_CONFIG and populate fconf.
Signed-off-by: Usama Arif <usama.arif@arm.com>
Change-Id: I0b4fc83e6e0a0b9401f692516654eb9a3b037616
Embarrassingly we never told the non-secure world that secure firmware
lives in the first few hundred KBs of DRAM, so any non-secure payload
could happily overwrite TF-A, and we couldn't even blame it.
Advertise the BL31 region in the reserved-memory DT node, so non-secure
world stays out of it.
This fixes Linux booting on FPGAs with less memory than usual.
Change-Id: I7fbe7d42c0b251c0ccc43d7c50ca902013d152ec
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
At the moment we specified the BL31 memory limits to 1MB; since we
typically have gigabytes of DRAM, we can be quite generous.
However the default parameters expect the devicetree binary at
0x80070000, so we should actually make sure we have no code or data
beyond that point.
Limit the ARM FPGA BL31 memory footprint to this available 7*64K region.
We stay within the limit at the moment, with more than half of it
reserved for stacks, so this could be downsized later should we run
into problems.
The PIE addresses stay as they are, since the default addresses do not
apply there anywhere, and the build is broken anyway.
Change-Id: I7768af1a93ff67096f4359fc5f5feb66464bafaa
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Currently the list of SP UUIDs loaded by BL2 is hardcoded in the DT.
This is a problem when building a system with other SPs (e.g. from
Trusted Services). This commit implements a workaround to enable adding
SP UUIDs to the list at build time.
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
Change-Id: Iff85d3778596d23d777dec458f131bd7a8647031
Up until now we relied on the GICs used in our FPGA images to be GICv3
compliant, without the "direct virtual injection" feature (aka GICv4)
enabled.
To support newer images which have GICv4 compliant GICs, enable the
newly introduced GICv4 detection code, and use that also when we adjust
the redistributor region size in the devicetree.
This allows the same BL31 image to be used with GICv3 or GICv4 FPGA
images.
Change-Id: I9f6435a6d5150983625efe3650a8b7d1ef11b1d1
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
At the moment we have a GIC_ENABLE_V4_EXTN build time variable to
determine whether the GIC interrupt controller is compliant to version
4.0 of the spec or not. This just changes the number of 64K MMIO pages
we expect per redistributor.
To support firmware builds which run on variable systems (emulators,
fast model or FPGAs), let's make this decision at runtime.
The GIC specification provides several architected flags to learn the
size of the MMIO frame per redistributor, we use GICR_TYPER[VLPI] here.
Provide a (static inline) function to return the size of each
redistributor.
We keep the GIC_ENABLE_V4_EXTN build time variable around, but change
its meaning to enable this autodetection code. Systems not defining this
rely on a "pure" GICv3 (as before), but platforms setting it to "1" can
now deal with both configurations.
Change-Id: I9ede4acf058846157a0a9e2ef6103bf07c7655d9
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Add TZC master source id for DMA in the SoC space and for the DMAs
behind the I/O Virtualization block to allow the non-secure transactions
from these DMAs targeting DRAM.
Signed-off-by: Vijayenthiran Subramaniam <vijayenthiran.subramaniam@arm.com>
Change-Id: I77a2947b01b4b49a7c1940f09cf62b7b5257657c
The GIC IP formerly known as "GIC Clayton" has been released under the
name of "GIC-700".
Rename occurences of Clayton in comments and macro names to reflect the
official name.
Change-Id: Ie8c55f7da7753127d58c8382b0033c1b486f7909
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
This patch adds the basic CPU library code to support the Demeter
CPU. This CPU is based on the Makalu-ELP core so that CPU lib code
was adapted to create this patch.
Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: Ib5740b748008a72788c557f0654d8d5e9ec0bb7f
As done recently for plat/tc0 in b5863cab9, enable AMU explicitly.
This is necessary as the recent changes that enable SVE for the secure
world disable AMU by default in the CPTR_EL3 reset value.
Change-Id: Ie3abf1dee8a4e1c8c39f934da8e32d67891f5f09
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
This commit activates the stack protector feature for the diphda
platform.
Change-Id: Ib16b74871c62b67e593a76ecc12cd3634d212614
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
This renames tc0 platform folder and files to tc, and introduces
TARGET_PLATFORM variable to account for the differences between
TC0 and TC1.
Signed-off-by: Usama Arif <usama.arif@arm.com>
Change-Id: I5b4a83f3453afd12542267091b3edab4c139c5cd
Fixed the build error by removing the local definition of 'efi_guid'
structure in 'sgi_ras.c' file as this structure definition is already
populated in 'sgi_ras.c' file via 'uuid.h' header.
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I57687336863f2a0761c09b6c1aa00b4aa82a6a12
Bump the required FF-A version in framework and manifests to v1.1 as
upstream feature development goes.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I89b2bd3828a13fc4344ccd53bc3ac9c0c22ab29f
Renamed hw_crc32 to tf_crc32 to make the file and function
name more generic so that the same name can be used in upcoming
software CRC32 implementation.
Change-Id: Idff8f70c50ca700a4328a27b49d5e1f14d2095eb
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Added firmware update support in Arm platforms by using
FWU platform hooks and compiling FWU driver in BL2
component.
Change-Id: I71af06c09d95c2c58e3fd766c4a61c5652637151
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
These files are needed during boot, but they were missing
for semihosting.
With this patch, the list of files is complete enough to
boot on ATF platform via semihosting.
Change-Id: I2f0ca25983a6e18096f040780776f19f8040ea79
Signed-off-by: stsp@users.sourceforge.net
Recent changes to enable SVE for the secure world have disabled AMU
extension by default in the reset value of CPTR_EL3 register. So the
platform has to enable this extension explicitly.
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I7d930d96ec22d7c3db961411370564bece0ce272
At this stage of development Non Volatile counters are not implemented
in the Diphda platform.
This commit disables their use during the Trusted Board Boot by
overriding the NV counters get/set functions.
Change-Id: I8dcbebe0281cc4d0837c283ff637e20b850988ef
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
This commit enables trusted-firmware-a with Trusted Board Boot support
for the Diphda 64-bit platform.
Diphda uses a FIP image located in the flash. The FIP contains the
following components:
- BL2
- BL31
- BL32
- BL32 SPMC manifest
- BL33
- The TBB certificates
The board boot relies on CoT (chain of trust). The trusted-firmware-a
BL2 is extracted from the FIP and verified by the Secure Enclave
processor. BL2 verification relies on the signature area at the
beginning of the BL2 image. This area is needed by the SecureEnclave
bootloader.
Then, the application processor is released from reset and starts by
executing BL2.
BL2 performs the actions described in the trusted-firmware-a TBB design
document.
Signed-off-by: Rui Miguel Silva <rui.silva@arm.com>
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Change-Id: Iddb1cb9c2a0324a9635e23821c210ac81dfc305d
Align documentation with changes of messaging method for partition
manifest:
- Bit[0]: support for receiving direct message requests
- Bit[1]: support for sending direct messages
- Bit[2]: support for indirect messaging
- Bit[3]: support for managed exit
Change the optee_sp_manifest to align with the new messaging method
description.
Signed-off-by: Maksims Svecovs <maksims.svecovs@arm.com>
Change-Id: I333e82c546c03698c95f0c77293018f8dca5ba9c
Used mmio* functions to read/write NVFLAGS registers to avoid
possibile reordering of instructions by compiler.
Change-Id: Iae50ac30e5413259cf8554f0fff47512ad83b0fd
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
In the FVP platform, BL1 uses flash only for read purpose
hence marked this flash region as read-only.
Change-Id: I3b57130fd4f3b4df522ac075f66e9799f237ebb7
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Erasing the FIP TOC header present in a flash is replaced by updating NV
flags with an error code on image load/authentication failure.
BL1 component uses these NV flags to detect whether a firmware update is
needed or not.
These NV flags get cleared once the firmware update gets completed.
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I6232a0db07c89b2373b7b9d28acd37df6203d914
The partition layout description JSON file generated by TF-A tests
declares a fourth test partition called Ivy demonstrating the
implementation of a S-EL0 partition supported by a S-EL1 shim.
Change-Id: If8562acfc045d6496dfdb3df0524b3a069357f8e
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
We don't ever expect to load a binary with an STM32 header on the Arm
FVP platform so remove this type of image from the list of
measurements.
Also remove the GPT image type from the list, as it does not get
measured. GPT is a container, just like FIP is. We don't measure the FIP
but rather the images inside it. It would seem logical to treat GPT the
same way.
Besides, only images that get loaded through load_auth_image() get
measured right now. GPT processing happens before that and is handled in
a different way (see partition_init()).
Change-Id: Iac4de75380ed625b228e69ee4564cf9e67e19336
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
For Arm platforms PIE is enabled when RESET_TO_BL31=1 in aarch64 mode on
the similar lines enable PIE when RESET_TO_SP_MIN=1 in aarch32 mode.
The underlying changes for enabling PIE in aarch32 is submitted in
commit 4324a14bf
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ib8bb860198b3f97cdc91005503a3184d63e15469
Third instance of cactus is a UP SP. Set its vcpu count to 1.
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I34b7feb2915e6d335e690e89dea466e75944ed1b
* changes:
refactor(plat/nvidia): use SOC_ID defines
refactor(plat/mediatek): use SOC_ID defines
refactor(plat/arm): use SOC_ID defines
feat(plat/st): implement platform functions for SMCCC_ARCH_SOC_ID
refactor(plat/st): export functions to get SoC information
feat(smccc): add bit definition for SMCCC_ARCH_SOC_ID
Fix a remainder from early prototyping. OP-TEE as a secure partition
does not need specific SMC function id pass through to EL3.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I2843d1b9a5eb4c966f82790e1655fb569c2de7d4
The UUID strings used in FW_CONFIG DT are not aligned with UUIDs defined
in include/tools_share/firmware_image_package.h for BL32_EXTRA1 and
TRUSTED_KEY_CERT.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I517f8f9311585931f2cb931e0588414da449b694
Morello exhibits the behavior similar to Juno wherein CNTBaseN.CNTFRQ
can be written but does not reflect the value of the CNTFRQ register
in CNTCTLBase frame. This doesn't follow ARM ARM in that the value
updated in CNTCTLBase.CNTFRQ is not reflected in CNTBaseN.CNTFRQ.
Hence enable the workaround (applied to Juno) for Morello that updates
the CNTFRQ register in the Non Secure CNTBaseN frame.
Change-Id: Iabe53bf3c25152052107e08321323e4bde5fbef4
Signed-off-by: Manoj Kumar <manoj.kumar3@arm.com>
This patch renames the Matterhorn, Matterhorn ELP, and Klein CPUs to
Cortex A710, Cortex X2, and Cortex A510 respectively.
Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I056d3114210db71c2840a24562b51caf2546e195
Use the macros that are now defined in include/lib/smccc.h.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I688a76277b729672835d51fafb68d1d6205b6ae4
The SGI/RD platforms have been using PSCI state ID format as defined in
PSCI version prior to 1.0. This is being changed and the PSCI extended
state ID format as defined in PSCI version 1.1 is being adapted. In
addition to this, the use of Arm recommended PSCI state ID encoding is
enabled as well.
Change-Id: I2be8a9820987a96b23f4281563b6fa22db48fa5f
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>
Added support for HW computed CRC using Arm ACLE intrinsics.
These are built-in intrinsics available for ARMv8.1-A, and
onwards.
These intrinsics are enabled via '-march=armv8-a+crc' compile
switch for ARMv8-A (supports CRC instructions optionally).
HW CRC support is enabled unconditionally in BL2 for all Arm
platforms.
HW CRC calculation is verified offline to ensure a similar
result as its respective ZLib utility function.
HW CRC calculation support will be used in the upcoming
firmware update patches.
Change-Id: Ia2ae801f62d2003e89a9c3e6d77469b5312614b3
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Disable non-invasive debug of secure state for Juno
in release builds. This makes sure that PMU counts
only Non-secure events.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I0d1c3f96f3b4e48360a7211ae55851d65d291025
This patch adds support for the crypto and secure storage secure
partitions for the Total Compute platform. These secure partitions
have to be managed by Hafnium executing at S-EL2
Change-Id: I2df690e3a99bf6bf50e2710994a905914a07026e
Signed-off-by: Davidson K <davidson.kumaresan@arm.com>
AMU counters are used for monitoring the CPU performance. RD-V1-MC
platform has architected AMU available for each core. Enable the use of
AMU by non-secure OS for supporting the use of counters for processor
performance control (ACPI CPPC).
Change-Id: I33be594cee669e7f4031e5e5a371eec7c7451030
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>
Added GPT parser support in BL2 for Arm platforms to get the entry
address and length of the FIP in the GPT image.
Also, increased BL2 maximum size for FVP platform to successfully
compile ROM-enabled build with this change.
Verified this change using a patch:
https://review.trustedfirmware.org/c/ci/tf-a-ci-scripts/+/9654
Change-Id: Ie8026db054966653b739a82d9ba106d283f534d0
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
NOTE: Breaking change to the way UUIDs are stored in the DT
Currently, UUIDs are stored in the device tree as
sequences of 4 integers. There is a mismatch in endianness
between the way UUIDs are represented in memory and the way
they are parsed from the device tree. As a result, we must either
store the UUIDs in little-endian format in the DT (which means
that they do not match up with their string representations)
or perform endianness conversion after parsing them.
Currently, TF-A chooses the second option, with unwieldy
endianness-conversion taking place after reading a UUID.
To fix this problem, and to make it convenient to copy and
paste UUIDs from other tools, change to store UUIDs in string
format, using a new wrapper function to parse them from the
device tree.
Change-Id: I38bd63c907be14e412f03ef0aab9dcabfba0eaa0
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Replaced PLAT_ARM_FIP_BASE and PLAT_ARM_FIP_MAX_SIZE macro with a
generic name PLAT_ARM_FLASH_IMAGE_BASE and PLAT_ARM_FLASH_IMAGE_MAX_SIZE
so that these macros can be reused in the subsequent GPT based support
changes.
Change-Id: I88fdbd53e1966578af4f1e8e9d5fef42c27b1173
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Add board support for RD-N2 Cfg1 variant of RD-N2 platform. It is a
variant of RD-N2 platform with a reduced interconnect mesh size (3x3)
and core count (8-cores). Its platform variant id is 1.
Change-Id: I34ad35c5a5c1e9b69a658fb92ed00e5bc5fe72f3
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
A Neoverse reference design platform can have two or more variants that
differ in core count, cluster count or other peripherals. To allow reuse
of platform code across all the variants of a platform, introduce build
option CSS_SGI_PLATFORM_VARIANT for Arm Neoverse reference design
platforms. The range of allowed values for the build option is platform
specific. The recommended range is an interval of non negative integers.
An example usage of the build option is
make PLAT=rdn2 CSS_SGI_PLATFORM_VARIANT=1
Change-Id: Iaae79c0b4d0dc700521bf6e9b4979339eafe0359
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
This will help in keeping source file generic and conditional
compilation can be contained in platform provided dt files.
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I3c6e0a429073f0afb412b9ba521ce43f880b57fe
sgm775 is an old platform and is no longer maintained by Arm and its
fast model FVP_CSS_SGM-775 is no longer available for download.
This platform is now superseded by Total Compute(tc) platforms.
This platform is now deprecated but the source will be kept for cooling
off period of 2 release cycle before removing it completely.
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I8fe1fc3da0c508dba62ed4fc60cbc1642e0f7f2a
ELP processors can sometimes have different MIDR values or features so
we are adding the "_arm" suffix to differentiate the reference
implementation from other future versions.
Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: Ieea444288587c7c18a397d279ee4b22b7ad79e20
By default the Arm Ethos-N NPU will boot up in secure mode. In this mode
the non-secure world cannot access the registers needed to use the NPU.
To still allow the non-secure world to use the NPU, a SiP service has
been added that can delegate non-secure access to the registers needed
to use it.
Only the HW_CONFIG for the Arm Juno platform has been updated to include
the device tree for the NPU and the platform currently only loads the
HW_CONFIG in AArch64 builds.
Signed-off-by: Mikael Olsson <mikael.olsson@arm.com>
Change-Id: I65dfd864042ed43faae0a259dcf319cbadb5f3d2
To make it possible to use the hw_config device tree for dynamic
configuration in BL31 on the Arm Juno platform. A placeholder hw_config
has been added that is included in the FIP and a Juno specific BL31
setup has been added to populate fconf with the hw_config.
Juno's BL2 setup has been updated to align it with the new behavior
implemented in the Arm FVP platform, where fw_config is passed in arg1
to BL31 instead of soc_fw_config. The BL31 setup is expected to use the
fw_config passed in arg1 to find the hw_config.
Signed-off-by: Mikael Olsson <mikael.olsson@arm.com>
Change-Id: Ib3570faa6714f92ab8451e8f1e59779dcf19c0b6
Remove an incorrect tabulation in front of an $(error) function call
outside of a recipe, which caused the following text to be displayed:
plat/arm/board/common/board_common.mk:36: *** recipe commences before first target. Stop.
instead of:
plat/arm/board/common/board_common.mk:36: *** "Unsupported ARM_ROTPK_LOCATION value". Stop.
Change-Id: I8592948e7de8ab0c4abbc56eb65a53eb1875a83c
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
The number of ITS have changed from 4 to 1, resulting
in GICR base address change.
Signed-off-by: Usama Arif <usama.arif@arm.com>
Change-Id: I28101f0d1faf9f3c58591b642033c3fd49a275e7
NT_FW_CONFIG file is meant to be passed from BL31 to be consumed by
BL33, fvp platforms use this to pass measured boot configuration and
the x0 register is used to pass the base address of it.
In case of hafnium used as hypervisor in normal world, hypervisor
manifest is expected to be passed from BL31 and its base address is
passed in x0 register.
As only one of NT_FW_CONFIG or hypervisor manifest base address can be
passed in x0 register and also measured boot is not required for SPM so
disable passing NT_FW_CONFIG.
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ifad9d3658f55ba7d70f468a88997d5272339e53e
Refine the function plat_add_sp_images_load_info() by saving the
previous node and only setting its next link when the current node is
valid. This can reduce the check for the next node and simply the
total logic.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: I4061428bf49ef0c3816ac22aaeb2e50315531f88
The traverse flow in function plat_add_sp_images_load_info() will find
the last node in the main load info list, with its
next_load_info==NULL. However this node is still useful and should not
be overridden with SP node info.
The bug will cause below error on RDN2 for spmd enabled:
ERROR: Invalid NT_FW_CONFIG DTB passed
Fix the bug by only setting the next_load_info of the last node in the
original main node list.
Signed-off-by: Heyi Guo <guoheyi@linux.alibaba.com>
Change-Id: Icaee5da1f2d53b29fdd6085a8cc507446186fd57
Define a GUID that should be used in the header of MM communicate
message originating due to a dmc620 ECC error interrupt. So the use
of SMC ID in 'sgi_ras_ev_map' to represent the interrupt event is
removed.
In addition to this, update the dmc620 error record data structure to
use aux_data to indicate the dmc620 instance number on which the ECC
error interrupt occurred.
Signed-off-by: Omkar Anand Kulkarni <omkar.kulkarni@arm.com>
Change-Id: I18c8ef5ba6483bb1bce6464ee9be0c2aabec4baa
Add the secure partition mmap table and the secure partition boot
information to support secure partitions on RD-N2 platform. In addition
to this, add the required memory region mapping for accessing the
SoC peripherals from the secure partition.
Signed-off-by: Omkar Anand Kulkarni <omkar.kulkarni@arm.com>
Change-Id: I2c75760d6c8c3da3ff4885599be420e924aeaf3c
A TZC400 controller is placed inline on DRAM channels and regulates
the secure and non-secure accesses to both secure and non-secure
regions of the DRAM memory. Configure each of the TZC controllers
across the Chips.
For use by secure software, configure the first chip's trustzone
controller to protect the upper 16MB of the memory of the first DRAM
block for secure accesses only. The other regions are configured for
non-secure read write access. For all the remote chips, all the DRAM
regions are allowed for non-secure read and write access.
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Change-Id: I809f27eccadfc23ea0ef64e2fd87f95eb8f195c1
On a multi-chip platform, the boot CPU on the first chip programs the
TZC controllers on all the remote chips. Define a memory region map for
the TZC controllers for all the remote chips and include it in the BL2
memory map table.
In addition to this, for SPM_MM enabled multi-chip platforms, increase
the number of mmap entries and xlat table counts for EL3 execution
context as well because the shared RAM regions and GIC address space of
remote chips are accessed.
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Change-Id: I6f0b5fd22f9f28046451e382eef7f1f9258d88f7
For multi-chip platforms, add a macro to define the memory regions on
chip numbers >1 and its associated access permissions. These memory
regions are marked with non-secure access.
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Change-Id: If3d6180fd8ea61f45147c39d3140d694abf06617
Allow the access of system registers and nor2 flash memory region
from s-el0. This allows the secure parititions residing at s-el0
to access these memory regions.
Signed-off-by: Thomas Abraham <thomas.abraham@arm.com>
Change-Id: I3887a86770de806323fbde0d20fdc96eec6e0c3c
Define a default DMC-620 TZC memory region configuration and use it to
specify the TZC memory regions on sgi575, rdn1edge and rde1edge
platforms. The default DMC-620 TZC memory regions are defined
considering the support for secure paritition as well.
Signed-off-by: Thomas Abraham <thomas.abraham@arm.com>
Change-Id: Iedee3e57d0d3de5b65321444da51ec990d3702db
Remove the 'ARM_' prefix from the macros defining the CPER buffer memory
and replace it with 'CSS_SGI_' prefix. These macros are applicable only
for platforms supported within plat/sgi. In addition to this, ensure
that these macros are defined only if the RAS_EXTENSION build option is
enabled.
Signed-off-by: Thomas Abraham <thomas.abraham@arm.com>
Change-Id: I44df42cded18d9d3a4cb13e5c990e9ab3194daee
The macros defining the SMC function ids for DMC-620 error handling are
listed in the sgi_base_platform_def.h header file. But these macros are
not applicable for all platforms supported under plat/sgi. So move these
macro definitions to sgi_ras.c file in which these are consumed. While
at it, remove the AArch32 and error injection function ids as these are
unused.
Signed-off-by: Thomas Abraham <thomas.abraham@arm.com>
Change-Id: I249b54bf4c1b1694188a1e3b297345b942f16bc9
The macros specific to SDEI defined in the sgi_base_platform_def.h are
not applicable for all the platforms supported by plat/sgi. So refactor
the SDEI specific macros into a new header file and include this file on
only on platforms it is applicable on.
Signed-off-by: Thomas Abraham <thomas.abraham@arm.com>
Change-Id: I0cb7125334f02a21cae1837cdfd765c16ab50bf5
The FF-A v1.0 spec allows two configurations for the number of EC/vCPU
instantiated in a Secure Partition:
-A MultiProcessor (MP) SP instantiates as many ECs as the number of PEs.
An EC is pinned to a corresponding physical CPU.
-An UniProcessor (UP) SP instantiates a single EC. The EC is migrated to
the physical CPU from which the FF-A call is originating.
This change permits exercising the latter case within the TF-A-tests
framework.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I7fae0e7b873f349b34e57de5cea496210123aea0
Rename rd_n1e1_edge_scmi_plat_info array to plat_rd_scmi_info as the
same array is used to provide SCMI platform info across mulitple RD
platforms and is not resitricted to only RD-N1 and RD-E1 platforms.
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Change-Id: I42ba33e0afa3003c731ce513c6a5754b602ec01f
Now that we have a framework for the SMCCC TRNG interface, and the
existing Juno entropy code has been prepared, add the few remaining bits
to implement this interface for the Juno Trusted Entropy Source.
We retire the existing Juno specific RNG interface, and use the generic
one for the stack canary generation.
Change-Id: Ib6a6e5568cb8e0059d71740e2d18d6817b07127d
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
The Juno Trusted Entropy Source has a bias, which makes the generated
raw numbers fail a FIPS 140-2 statistic test.
To improve the quality of the numbers, we can use the CPU's CRC
instructions, which do a decent job on conditioning the bits.
This adds a *very* simple version of arm_acle.h, which is typically
provided by the compiler, and contains the CRC instrinsics definitions
we need. We need the original version by using -nostdinc.
Change-Id: I83d3e6902d6a1164aacd5060ac13a38f0057bd1a
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Currently we use the Juno's TRNG hardware entropy source to initialise
the stack canary. The current function allows to fill a buffer of any
size, but we will actually only ever request 16 bytes, as this is what
the hardware implements. Out of this, we only need at most 64 bits for
the canary.
In preparation for the introduction of the SMCCC TRNG interface, we
can simplify this Juno specific interface by making it compatible with
the generic one: We just deliver 64 bits of entropy on each call.
This reduces the complexity of the code. As the raw entropy register
readouts seem to be biased, it makes sense to do some conditioning
inside the juno_getentropy() function already.
Also initialise the TRNG hardware, if not already done.
Change-Id: I11b977ddc5417d52ac38709a9a7b61499eee481f
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Update TZC base address to align with the recent changes in the platform
memory map.
Signed-off-by: Vijayenthiran Subramaniam <vijayenthiran.subramaniam@arm.com>
Change-Id: I0d0ad528a2e236607c744979e1ddc5c6d426687a
Currently, BLs are mapping the GIC memory region as read-write
for all cores on boot-up.
This opens up the security hole where the active core can write
the GICR frame of fused/inactive core. To avoid this issue, disable
the GICR frame of all inactive cores as below:
1. After primary CPU boots up, map GICR region of all cores as
read-only.
2. After primary CPU boots up, map its GICR region as read-write
and initialize its redistributor interface.
3. After secondary CPU boots up, map its GICR region as read-write
and initialize its redistributor interface.
4. All unused/fused core's redistributor regions remain read-only and
write attempt to such protected regions results in an exception.
As mentioned above, this patch offers only the GICR memory-mapped
region protection considering there is no facility at the GIC IP
level to avoid writing the redistributor area.
These changes are currently done in BL31 of Arm FVP and guarded under
the flag 'FVP_GICR_REGION_PROTECTION'.
As of now, this patch is tested manually as below:
1. Disable the FVP cores (core 1, 2, 3) with core 0 as an active core.
2. Verify data abort triggered by manually updating the ‘GICR_CTLR’
register of core 1’s(fused) redistributor from core 0(active).
Change-Id: I86c99c7b41bae137b2011cf2ac17fad0a26e776d
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
GIC memory region is not getting used in BL1 and BL2.
Hence avoid its mapping in BL1 and BL2 that freed some
page table entries to map other memory regions in the
future.
Retains mapping of CCN interconnect region in BL1 and BL2
overlapped with the GIC memory region.
Change-Id: I880dd0690f94b140e59e4ff0c0d436961b9cb0a7
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
So far the ARM platform Makefile would require that RESET_TO_BL31 is set
when we ask for the ARM_LINUX_KERNEL_AS_BL33 feature.
There is no real technical reason for that, and the one place in the
code where this was needed has been fixed.
Remove the requirement of those two options to be always enabled
together.
This enables the direct kernel boot feature for the Foundation FVP
(as described in the documentation), which requires a BL1/FIP
combination to boot, so cannot use RESET_TO_BL31.
Change-Id: I6814797b6431b6614d684bab3c5830bfd9481851
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
At the moment we have the somewhat artifical limitation of
ARM_LINUX_KERNEL_AS_BL33 only being used together with RESET_TO_BL31.
However there does not seem to be a good technical reason for that,
it was probably just to differentate between two different boot flows.
Move the initial register setup for ARM_LINUX_KERNEL_AS_BL33 out of the
RESET_TO_BL31 #ifdef, so that we initialise the registers in any case.
This allows to use a preloaded kernel image when using BL1 and FIP.
Change-Id: I832df272d3829f077661f4ee6d3dd9a276a0118f
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
The structure has been modified to specify the memory
size in bytes instead of Gigabytes.
Signed-off-by: Manoj Kumar <manoj.kumar3@arm.com>
Signed-off-by: Chandni Cherukuri <chandni.cherukuri@arm.com>
Change-Id: I3384677d79af4f3cf55d3c353b6c20bb827b5ae7
This patch removes the Neoverse N1 CPU errata workaround for
bug 1542419 as the bug is not present in Rainier R0P0 core.
Change-Id: Icaca299b13ef830b2ee5129576aae655a6288e69
Signed-off-by: Manoj Kumar <manoj.kumar3@arm.com>
Increase the core count and add respective entries in DTS.
Add Klein assembly file to cpu sources for core initialization.
Add SCMI entries for cores.
Signed-off-by: Avinash Mehta <avinash.mehta@arm.com>
Change-Id: I14dc1d87df6dcc8d560ade833ce1f92507054747
When building TF-A with USE_ROMLIB=1 and -j make options, the build fails with the following error:
make[1]: *** No rule to make target '/build/juno/debug/romlib/romlib.bin', needed by 'bl1_romlib.bin'.
This patch fixes that issue.
Signed-off-by: Zelalem <zelalem.aweke@arm.com>
Change-Id: I0cca416f3f50f400759164e0735c2d6b520ebf84
AMU counters are used for monitoring the CPU performance. RD-N2 platform
has architected AMU available for each core. Enable the use of AMU by
non-secure OS for supporting the use of counters for processor
performance control (ACPI CPPC).
Change-Id: I5cc749cf63c18fc5c7563dd754c2f42990a97e23
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>
AMU counters are used for monitoring the CPU performance. RD-V1 platform
has architected AMU available for each core. Enable the use of AMU by
non-secure OS for supporting the use of counters for processor
performance control (ACPI CPPC).
Change-Id: I4003d21407953f65b3ce99eaa8f496d6052546e0
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>
Some of the PSCI platform callbacks were restricted on RD-V1 platform
because the idle was not functional. Now that it is functional, remove
all the restrictions on the use PSCI platform callbacks.
Change-Id: I4cb97cb54de7ee166c30f28df8fea653b6b425c7
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>