Currently, BLs are mapping the GIC memory region as read-write
for all cores on boot-up.
This opens up the security hole where the active core can write
the GICR frame of fused/inactive core. To avoid this issue, disable
the GICR frame of all inactive cores as below:
1. After primary CPU boots up, map GICR region of all cores as
read-only.
2. After primary CPU boots up, map its GICR region as read-write
and initialize its redistributor interface.
3. After secondary CPU boots up, map its GICR region as read-write
and initialize its redistributor interface.
4. All unused/fused core's redistributor regions remain read-only and
write attempt to such protected regions results in an exception.
As mentioned above, this patch offers only the GICR memory-mapped
region protection considering there is no facility at the GIC IP
level to avoid writing the redistributor area.
These changes are currently done in BL31 of Arm FVP and guarded under
the flag 'FVP_GICR_REGION_PROTECTION'.
As of now, this patch is tested manually as below:
1. Disable the FVP cores (core 1, 2, 3) with core 0 as an active core.
2. Verify data abort triggered by manually updating the ‘GICR_CTLR’
register of core 1’s(fused) redistributor from core 0(active).
Change-Id: I86c99c7b41bae137b2011cf2ac17fad0a26e776d
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
GIC memory region is not getting used in BL1 and BL2.
Hence avoid its mapping in BL1 and BL2 that freed some
page table entries to map other memory regions in the
future.
Retains mapping of CCN interconnect region in BL1 and BL2
overlapped with the GIC memory region.
Change-Id: I880dd0690f94b140e59e4ff0c0d436961b9cb0a7
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
This patch removes the Neoverse N1 CPU errata workaround for
bug 1542419 as the bug is not present in Rainier R0P0 core.
Change-Id: Icaca299b13ef830b2ee5129576aae655a6288e69
Signed-off-by: Manoj Kumar <manoj.kumar3@arm.com>
Increase the core count and add respective entries in DTS.
Add Klein assembly file to cpu sources for core initialization.
Add SCMI entries for cores.
Signed-off-by: Avinash Mehta <avinash.mehta@arm.com>
Change-Id: I14dc1d87df6dcc8d560ade833ce1f92507054747
When building TF-A with USE_ROMLIB=1 and -j make options, the build fails with the following error:
make[1]: *** No rule to make target '/build/juno/debug/romlib/romlib.bin', needed by 'bl1_romlib.bin'.
This patch fixes that issue.
Signed-off-by: Zelalem <zelalem.aweke@arm.com>
Change-Id: I0cca416f3f50f400759164e0735c2d6b520ebf84
AMU counters are used for monitoring the CPU performance. RD-N2 platform
has architected AMU available for each core. Enable the use of AMU by
non-secure OS for supporting the use of counters for processor
performance control (ACPI CPPC).
Change-Id: I5cc749cf63c18fc5c7563dd754c2f42990a97e23
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>
AMU counters are used for monitoring the CPU performance. RD-V1 platform
has architected AMU available for each core. Enable the use of AMU by
non-secure OS for supporting the use of counters for processor
performance control (ACPI CPPC).
Change-Id: I4003d21407953f65b3ce99eaa8f496d6052546e0
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>
Some of the PSCI platform callbacks were restricted on RD-V1 platform
because the idle was not functional. Now that it is functional, remove
all the restrictions on the use PSCI platform callbacks.
Change-Id: I4cb97cb54de7ee166c30f28df8fea653b6b425c7
Signed-off-by: Pranav Madhu <pranav.madhu@arm.com>
The issue is that, when interrupt is triggered and RAS handler
is entered, after interrupt handler finishes, TF-A will re-enter
bl32 and then crash.
sdei_dispatch_event() may return failing result in some cases,
for example kernel may not have registered a handler or RAS event
may happen early during boot. We restore the NS context when
sdei_dispatch_event() returns failing result.
error log :
Received delegated event
X0 : 0xC4000061
X1 : 0x0
X2 : 0x0
X3 : 0x0
Received event - 0xC4000061 on cpu 0
UnRecognized Event - 0xC4000061
Failed delegated event 0xC4000061, Status Invalid Parameter
Unhandled Exception in EL3.
x30 = 0x000000000401f700
x0 = 0xfffffffffffffffe
x1 = 0xfffffffffffffffe
x2 = 0x00000000600003c0
Signed-off-by: Ming Huang <huangming@linux.alibaba.com>
Change-Id: I9802e9a32eee0ac3b5a8bcc0362d0b0e3b71dc9f
Turn ON/OFF GIC redistributor in sync with GIC CPU interface ON/OFF.
Issue :
The Linux prompt hangs when all the cores in a cluster are turned OFF
and we try to turn ON a core in that cluster. Previously when TF-A turns
ON a core, TF-A first turns ON the redistributor followed by the core.
This did not match the flow when turning OFF a core, as TF-A did not
turn OFF redistributor when the corresponding core[s] are disabled.
This hang is resolved by disabling redistributor as cores are disabled,
keeping them in sync.
Signed-off-by: Jagadeesh Ujja <jagadeesh.ujja@arm.com>
Change-Id: Ifd04fdcfd47b45e00f874f15b098471883d023f0
Reference Design platform RD-Daniel-ConfigXLR has been renamed to
RD-V1-MC. Correspondingly, remove all uses of 'rddanielxlr' and replace
it with 'rdv1mc' where appropriate.
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Change-Id: I5d91c69738397b19ced43949b4080c74678e604c
Reference Design platform RD-Daniel has been renamed to RD-V1.
Correspondingly, remove all uses of 'rddaniel' and replace it with
'rdv1' where appropriate.
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Change-Id: I1702bab39c501f8c0a09df131cb2394d54c83bcf
Only non-file targets should be set a .PHONY. Otherwise if file target is
set as .PHONY then targets which depends on those file .PHONY targets would
be always rebuilt even when their prerequisites are not changed.
File target which needs to be always rebuilt can be specified in Make
system via having a prerequisite on some .PHONY target, instead of marking
whole target as .PHONY. In Makefile projects it is common to create empty
.PHONY target named FORCE for this purpose.
This patch changes all file targets which are set as .PHONY to depends on
new .PHONY target FORCE, to ensure that these file targets are always
rebuilt (as before). Basically they are those targets which calls external
make subprocess.
After FORCE target is specified in main Makefile, remove it from other
Makefile files to prevent duplicate definitions.
Signed-off-by: Pali Rohár <pali@kernel.org>
Change-Id: Iee3b4e0de93879b95eb29a1745a041538412e69e
RD-N2 platform has been updated to use six GIC ITS blocks. This results
in change in base address of the GIC Redistributor to accomodate two
new GIC ITS blocks. Update the base address of GICR to reflect the same.
Signed-off-by: Vijayenthiran Subramaniam <vijayenthiran.subramaniam@arm.com>
Change-Id: I740a547328fb9a9f25d7a09c08e61bdbc8bf781c
This patch adds support to enable OP-TEE as S-EL1 SP with SPMC at S-EL2
- create SPMC manifest file with OP-TEE as SP
- add support for ARM_SPMC_MANIFEST_DTS build option
- add optee entry with ffa as method in tc0.dts
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Ia9b5c22c6f605d3886914bbac8ac45e8365671cb
* changes:
doc: Update list of supported FVP platforms
board/rdn2: add board support for rdn2 platform
plat/arm/sgi: adapt to changes in memory map
plat/arm/sgi: add platform id value for rdn2 platform
plat/arm/sgi: platform definitions for upcoming platforms
plat/arm/sgi: refactor header file inclusions
plat/arm/sgi: refactor the inclusion of memory mapping
Add the initial board support for RD-N2 platform.
Change-Id: I8325885bf248dd92191d6fc92a2da91c23118f8c
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Upcoming RD platforms will have an updated memory map for the various
pheripherals on the system. So, for the newer platforms, handle the
memory mapping and other platform specific functionality separately
from the existing platforms.
Change-Id: Iab1355a4c8ea1f6db4f79fcdd6eed907903b6a18
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
In preparation for adding the board support for RD-N2 platform, add
macros to define the platform id and the corresponding SCMI platform
info for the RD-N2 platform.
Change-Id: Ie764ae618732b39e316f7ed080421f5d79adab21
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Upcoming RD platforms have changes in the SOC address map from that
of the existing platforms. As a prepartory step to add support for the
upcoming platforms, create platform definitions for those platforms.
Change-Id: Ic5df9fed02c44e65ec260bbb5efc1b8dbd919a56
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Upcoming RD platforms have deviations in various definitions of
platform macros from that of the exisiting platforms. In preparation
for adding support for those upcoming RD platforms, refactor the
header file inclusion to allow newer platforms to use a different
set of platform macros.
Change-Id: Ic80283ddadafaa7f766f300652cb0d4e507efdb6
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
Upcoming RD platforms have a different memory map from those of the
existing platforms. So make the build of the existing mmap entries to be
usable only for existing platforms and let upcoming platforms define
a different set of mmap entries.
Change-Id: Id1ef0293efe8749c78a99237e78d32573c7233aa
Signed-off-by: Aditya Angadi <aditya.angadi@arm.com>
The primary VM concept is removed from the SPMC.
Update the SPMC manifests with number of Execution Contexts
and SP workspace size for the first Secure Partition (as it
is done for NWd secondary VMs and other SPs).
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I3b9c52666f7dfe74ab1f7d2148ad0070ee44b54e
The chosen node is no longer required as the SPMC implements
a specific boot flow which no longer requires this node.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Ib566b602a7f83003a1b2d0ba5f6ebf4d8b7a9156
The PVM concept is removed from the SPMC so the device-memory
node which is specifying the device memory range for the PVM
is no longer applicable.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: If0cb956e0197028b24ecb78952c66ec454904516
Enable basic support for Neoverse-N2 CPUs.
Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I498adc2d9fc61ac6e1af8ece131039410872e8ad
Currently, when RECLAIM_INIT_CODE is set, the
stacks are scaled to ensure that the entirety
of the init section can be reclaimed as stack.
This causes an issue in lib/psci/aarch64/psci_helpers.S,
where the stack size is used for cache operations in
psci_do_pwrdown_cache_maintenance(). If the stacks
are scaled, then the PSCI code may fail to invalidate
some of the stack memory before power down.
Resizing stacks is also not good for stability in general,
since code that works with a small number of cores may
overflow the stack when the number of cores is increased.
Change to make every stack be PLATFORM_STACK_SIZE big,
and allow the total stack to be smaller than the
init section.
Any pages of the init section not reclaimed as
stack will be set to read-only and execute-never,
for security.
Change-Id: I10b3884981006431f2fcbec3864c81d4a8c246e8
Signed-off-by: David Horstmann <david.horstmann@arm.com>
For the first partition, mark first 2GB as device memory excluding
the Trusted DRAM region reserved for the SPMC.
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I3ff110b3facf5b6d41ac2519ff6ca5e30a0a502b
This includes configuration for SPMC and trusted OS.
Change-Id: Ie24df200f446b3f5b23f5f764b115c7191e6ada3
Signed-off-by: Usama Arif <usama.arif@arm.com>
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
This patch enables SPMC execution at S-EL2 by adding below changes
- Map TC0_MAP_TZC_DRAM1 for loading SPMC
- Add details of cactus test secure partitions
- Adds tc0 spmc manifest file with details on secure partitions
- Inlcude TOS_FW_CONFIG when SPM is spmd
- Increases bl2 image size
SPMC at S-EL2 is only enabled when build with SPD=spmd.
Change-Id: I4c5f70911903c232ee8ecca57f1e288d6b1cd647
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
- Reserve 32MB below ARM_AP_TZC_DRAM1_BASE for TC0_TZC_DRAM1
- Add TC0_NS_DRAM1 base and mapping
- Reserve memory region in tc0.dts
Change-Id: If2431f7f68e4255e28c86a0e89637dab7c424a13
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
To support platforms without Trusted DRAM this patch defines
PLAT_ARM_SPMC_BASE and enables platform to use either Trusted DRAM or
DRAM region behind TZC.
Change-Id: Icaa5c7d33334258ff27e8e0bfd0812c304e68ae4
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Statistical Profiling Extension is not supported by Matterhorn core
Change-Id: Iec652f1c6d6b6a9bf118ba682276a7c70a6abc0d
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Usually, C has no problem up-converting types to larger bit sizes. MISRA
rule 10.7 requires that you not do this, or be very explicit about this.
This resolves the following required rule:
bl1/aarch64/bl1_context_mgmt.c:81:[MISRA C-2012 Rule 10.7 (required)]<None>
The width of the composite expression "0U | ((mode & 3U) << 2U) | 1U |
0x3c0U" (32 bits) is less that the right hand operand
"18446744073709547519ULL" (64 bits).
This also resolves MISRA defects such as:
bl2/aarch64/bl2arch_setup.c:18:[MISRA C-2012 Rule 12.2 (required)]
In the expression "3U << 20", shifting more than 7 bits, the number
of bits in the essential type of the left expression, "3U", is
not allowed.
Further, MISRA requires that all shifts don't overflow. The definition of
PAGE_SIZE was (1U << 12), and 1U is 8 bits. This caused about 50 issues.
This fixes the violation by changing the definition to 1UL << 12. Since
this uses 32bits, it should not create any issues for aarch32.
This patch also contains a fix for a build failure in the sun50i_a64
platform. Specifically, these misra fixes removed a single and
instruction,
92407e73 and x19, x19, #0xffffffff
from the cm_setup_context function caused a relocation in
psci_cpus_on_start to require a linker-generated stub. This increased the
size of the .text section and caused an alignment later on to go over a
page boundary and round up to the end of RAM before placing the .data
section. This sectionn is of non-zero size and therefore causes a link
error.
The fix included in this reorders the functions during link time
without changing their ording with respect to alignment.
Change-Id: I76b4b662c3d262296728a8b9aab7a33b02087f16
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
And from crash_console_flush.
We ignore the error information return by console_flush in _every_
place where we call it, and casting the return type to void does not
work around the MISRA violation that this causes. Instead, we collect
the error information from the driver (to avoid changing that API), and
don't return it to the caller.
Change-Id: I1e35afe01764d5c8f0efd04f8949d333ffb688c1
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
Only define arm_get_rotpk_info_regs if ROTPK is in registers,
i.e. (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_REGS_ID). This will
allow platform build without definition of TZ_PUB_KEY_HASH_BASE
if dedicated registers for ROTPK are not available on the platform.
Change-Id: I74ee2d5007f5d876a031a1efca20ebee2dede0c7
Signed-off-by: Usama Arif <usama.arif@arm.com>
Manish V Badarkhe
Manoj Kumar
Lauren Wehrmeister
Manish Pandey
Avinash Mehta
Zelalem
Pranav Madhu
Ming Huang
Jagadeesh Ujja
Aditya Angadi
Pali Rohár
Madhukar Pappireddy
Vijayenthiran Subramaniam
Arunachalam Ganapathy
Olivier Deprez
Javier Almansa Sobrino
Alexei Fedorov
David Horstmann
Usama Arif
Joanna Farley
Jimmy Brisson