This patch moves the code to disable DCO operations out from common
CPU files. This allows the platform code to call thsi API as and
when required. There are certain CPU power down states which require
the DCO to be kept ON and platforms can decide selectively now.
Change-Id: Icb946fe2545a7d8c5903c420d1ee169c4921a2d1
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch enables the PSCI_EXTENDED_STATE_ID macro. Tegra platforms
have moved on to using the extended state ID for CPU_SUSPEND, where
the NS world passes the state ID and wakeup time as part of the
state ID field.
Change-Id: Ie8b0fec285d8b2330bc26ff239a4f628425c9fcf
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
The platform power states, PLAT_MAX_RET_STATE and PLAT_MAX_OFF_STATE,
can change on Tegra SoCs and so should be defined per-soc.
This patch moves these macro definitions to individual SoC's tegra_def.h
files.
Change-Id: Ib9b2752bc4d79cef6f79bee49882d340f71977a2
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch introduces a function to secure the on-chip TZRAM memory. The
Tegra132 and Tegra210 chips do not have a compelling use case to lock the
TZRAM. The trusted OS owns the TZRAM aperture on these chips and so it
can take care of locking the aperture. This might not be true for future
chips and this patch makes the TZRAM programming flexible.
Change-Id: I3ac9f1de1b792ccd23d4ded274784bbab2ea224a
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch enables the runtime console for all Tegra platforms
before exiting BL31. This would enable debug/error prints to be
always displayed on the UART console.
Change-Id: Ic48d61d05b0ab07973d6fc2dc6b68733a42a3f63
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch introduces a power down handler which can be overriden
by SoCs to customise the power down process. The current SoCs do
not have a way of powering down the entire system as external PMIC
chips are involved in the process.
But future SoCs will have a way to power off the entire system
without talking to an external PMIC.
Change-Id: Ie7750714141a29cb0a1a616fafc531c4f11d0985
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch implements a handler for common SiP calls. A weak
implementation for the SoC-specific handler has been provided
which can be overridden by SoCs to implement any custom SiP
calls.
Change-Id: I45122892a84ea35d7b44be0f35dc15f6bb95193e
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
The BL2 fills in the UART controller ID to be used as the normal as
well as the crash console on Tegra platforms. The controller ID to
UART controller base address mapping is handled by each Tegra SoC
the base addresses might change across Tegra chips.
This patch adds the handler to parse the platform params to get the
UART ID for the per-soc handlers.
Change-Id: I4d167b20a59aaf52a31e2a8edf94d8d6f89598fa
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch adds another member, tzdram_base, to the plat_params_from_bl2 struct
in order to store the TZDRAM carveout base address used to load the Trusted OS.
The monitor programs the memory controller with the TZDRAM base and size in order
to deny any accesses from the NS world.
Change-Id: If39b8674d548175d7ccb6525c18d196ae8a8506c
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch renames the current Memory Controller driver files to
"_v1". This is done to add a driver for the new Memory Controller
hardware (v2).
Change-Id: I668dbba42f6ee0db2f59a7103f0ae7e1d4684ecf
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch checks that the pointers to BL3-3 and BL3-2 ep_info
structs are valid before accessing them. Add some INFO prints
in the BL3-1 setup path for early debugging purposes.
Change-Id: I62b23fa870f1b2fb783c8de69aab819f1749d15a
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch modifies platform_get_core_pos() to use the Cluster ID
field as well to calculate the final index value. This helps the
system to store CPU data for multi-cluster configurations.
Change-Id: I76e35f723f741e995c6c9156e9d61b0b2cdd2709
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch enables the processor retention and L2/CPUECTLR read/write
access from the NS world only for Cortex-A57 CPUs on the Tegra SoCs.
Change-Id: I9941a67686ea149cb95d80716fa1d03645325445
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch moves these address translation helper macros to individual
Tegra SoC makefiles to provide more control.
Change-Id: Ieab53c457c73747bd0deb250459befb5b7b9363f
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
This patch converts the common SiP handler to SoC specific SiP
handler. T210 and T132 have different SiP SMCs and so it makes
sense to move the SiP handler to soc/t132 and soc/t210 folders.
Change-Id: Idfe48384d63641137d74a095432df4724986b241
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
The Flow Controller hardware block is not present across all Tegra
SoCs, hence include the driver files from SoC specific makefiles.
T132/T210 are the SoCs which include this hardware block while future
SoCs have removed it.
Change-Id: Iaca25766a4fa51567293d10cf14dae968b0fae80
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
On Juno, the secure privileged invasive debug authentication signal
(SPIDEN) is controlled by board SCC registers, which by default enable
SPIDEN. Disable secure privileged external debug in release builds by
programming the appropriate Juno SoC registers.
Change-Id: I61045f09a47dc647bbe95e1b7a60e768f5499f49
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
This patch introduces the following three platform interfaces:
* void plat_psci_stat_accounting_start(const psci_power_state_t *state_info)
This is an optional hook that platforms can implement in order
to perform accounting before entering a low power state. This
typically involves capturing a timestamp.
* void plat_psci_stat_accounting_stop(const psci_power_state_t *state_info)
This is an optional hook that platforms can implement in order
to perform accounting after exiting from a low power state. This
typically involves capturing a timestamp.
* u_register_t plat_psci_stat_get_residency(unsigned int lvl,
const psci_power_state_t *state_info,
unsigned int last_cpu_index)
This is an optional hook that platforms can implement in order
to calculate the PSCI stat residency.
If any of these interfaces are overridden by the platform, it is
recommended that all of them are.
By default `ENABLE_PSCI_STAT` is disabled. If `ENABLE_PSCI_STAT`
is set but `ENABLE_PMF` is not set then an alternative PSCI stat
collection backend must be provided. If both are set, then default
weak definitions of these functions are provided, using PMF to
calculate the residency.
NOTE: Previously, platforms did not have to explicitly set
`ENABLE_PMF` since this was automatically done by the top-level
Makefile.
Change-Id: I17b47804dea68c77bc284df15ee1ccd66bc4b79b
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
Replace all use of memset by zeromem when zeroing moderately-sized
structure by applying the following transformation:
memset(x, 0, sizeof(x)) => zeromem(x, sizeof(x))
As the Trusted Firmware is compiled with -ffreestanding, it forbids the
compiler from using __builtin_memset and forces it to generate calls to
the slow memset implementation. Zeromem is a near drop in replacement
for this use case, with a more efficient implementation on both AArch32
and AArch64.
Change-Id: Ia7f3a90e888b96d056881be09f0b4d65b41aa79e
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
Introduce zeromem_dczva function on AArch64 that can handle unaligned
addresses and make use of DC ZVA instruction to zero a whole block at a
time. This zeroing takes place directly in the cache to speed it up
without doing external memory access.
Remove the zeromem16 function on AArch64 and replace it with an alias to
zeromem. This zeromem16 function is now deprecated.
Remove the 16-bytes alignment constraint on __BSS_START__ in
firmware-design.md as it is now not mandatory anymore (it used to comply
with zeromem16 requirements).
Change the 16-bytes alignment constraints in SP min's linker script to a
8-bytes alignment constraint as the AArch32 zeromem implementation is now
more efficient on 8-bytes aligned addresses.
Introduce zero_normalmem and zeromem helpers in platform agnostic header
that are implemented this way:
* AArch32:
* zero_normalmem: zero using usual data access
* zeromem: alias for zero_normalmem
* AArch64:
* zero_normalmem: zero normal memory using DC ZVA instruction
(needs MMU enabled)
* zeromem: zero using usual data access
Usage guidelines: in most cases, zero_normalmem should be preferred.
There are 2 scenarios where zeromem (or memset) must be used instead:
* Code that must run with MMU disabled (which means all memory is
considered device memory for data accesses).
* Code that fills device memory with null bytes.
Optionally, the following rule can be applied if performance is
important:
* Code zeroing small areas (few bytes) that are not secrets should use
memset to take advantage of compiler optimizations.
Note: Code zeroing security-related critical information should use
zero_normalmem/zeromem instead of memset to avoid removal by
compilers' optimizations in some cases or misbehaving versions of GCC.
FixesARM-software/tf-issues#408
Change-Id: Iafd9663fc1070413c3e1904e54091cf60effaa82
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
With GCC 6.2 compiler, more C undefined behaviour is being flagged as
warnings, which result in build errors in ARM TF build.
The specific issue that this patch resolves is the use of (1 << 31),
which is predominantly used in case statements, where 1 is represented
as a signed int. When shifted to msb the behaviour is undefined.
The resolution is to specify 1 as an unsigned int using a convenience
macro ULL(). A duplicate macro MAKE_ULL() is replaced.
FixesARM-software/tf-issues#438
Change-Id: I08e3053bbcf4c022ee2be33a75bd0056da4073e1
Signed-off-by: David Cunado <david.cunado@arm.com>
One nasty part of ATF is some of boolean macros are always defined
as 1 or 0, and the rest of them are only defined under certain
conditions.
For the former group, "#if FOO" or "#if !FOO" must be used because
"#ifdef FOO" is always true. (Options passed by $(call add_define,)
are the cases.)
For the latter, "#ifdef FOO" or "#ifndef FOO" should be used because
checking the value of an undefined macro is strange.
For AARCH32/AARCH64, these macros are defined in the top-level
Makefile as follows:
ifeq (${ARCH},aarch32)
$(eval $(call add_define,AARCH32))
else
$(eval $(call add_define,AARCH64))
endif
This means only one of the two is defined. So, AARCH32/AARCH64
belongs to the latter group where we should use #ifdef or #ifndef.
The conditionals are mostly coded correctly, but I see some mistakes.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
One nasty part of ATF is some of boolean macros are always defined
as 1 or 0, and the rest of them are only defined under certain
conditions.
For the former group, "#if FOO" or "#if !FOO" must be used because
"#ifdef FOO" is always true. (Options passed by $(call add_define,)
are the cases.)
For the latter, "#ifdef FOO" or "#ifndef FOO" should be used because
checking the value of an undefined macro is strange.
Here, IMAGE_BL* is handled by make_helpers/build_macro.mk like
follows:
$(eval IMAGE := IMAGE_BL$(call uppercase,$(3)))
$(OBJ): $(2)
@echo " CC $$<"
$$(Q)$$(CC) $$(TF_CFLAGS) $$(CFLAGS) -D$(IMAGE) -c $$< -o $$@
This means, IMAGE_BL* is defined when building the corresponding
image, but *undefined* for the other images.
So, IMAGE_BL* belongs to the latter group where we should use #ifdef
or #ifndef.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
We have lots of duplicated defines (and comment blocks too).
Move them to include/plat/common/common_def.h.
While we are here, suffix the end address with _END instead of
_LIMIT. The _END is a better fit to indicate the linker-derived
real end address.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
The usage of _LIMIT seems odd here, so rename as follows:
BL_CODE_LIMIT --> BL_CODE_END
BL_RO_DATA_LIMIT --> BL_RO_DATA_END
BL1_CODE_LIMIT --> BL1_CODE_END
BL1_RO_DATA_LIMIT --> BL1_RO_DATA_END
Basically, we want to use _LIMIT and _END properly as follows:
*_SIZE + *_MAX_SIZE = *_LIMIT
*_SIZE + *_SIZE = *_END
The _LIMIT is generally defined by platform_def.h to indicate the
platform-dependent memory constraint. So, its typical usage is
ASSERT(. <= BL31_LIMIT, "BL31 image has exceeded its limit.")
in a linker script.
On the other hand, _END is used to indicate the end address of the
compiled image, i.e. we do not know it until the image is linked.
Here, all of these macros belong to the latter, so should be
suffixed with _END.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
We are duplicating this macro define, and it is useful enough
to be placed in the common place.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Commit 0029624fe2 ("Add
PLAT_xxx_ADDR_SPACE_SIZE definition") deprecates 'ADDR_SPACE_SIZE' in
favor of PLAT_(PHY|VIRT)_ADDRESS_SPACE_SIZE. Migrate the zynqmp platform
to use the new interface.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Depending on the compiler used, it might try to link in libc even though
it's not required. Stop it from doing that.
Signed-off-by: Patrick Georgi <pgeorgi@google.com>
The platform.mk sets build options required for ZynqMP, but users
can still change them from the command line, like:
make PLAT=zynqmp RESET_TO_BL31=0 CROSS_COMPILE=...
Then, the makefile shows an error message in that case:
Using BL31 as the reset vector is only one option supported on ZynqMP.
Please set RESET_TO_BL31 to 1.
If the option is not user-configurable, the makefile can specify
"override" to prevent users from changing it. We do not need the
error message for the case that never happens.
Likewise, ENABLE_PLAT_COMPAT := 0 and PROGRAMMABLE_RESET_ADDRESS := 1
are mandatory to avoid build error.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Acked-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Before adding a base address and a size to compute the end
address of an image to copy or authenticate, check this
won't result in an integer overflow. If it does then consider
the input arguments are invalid.
As a result, bl1_plat_mem_check() can now safely assume the
end address (computed as the sum of the base address and size
of the memory region) doesn't overflow, as the validation is
done upfront in bl1_fwu_image_copy/auth(). A debug assertion
has been added nonetheless in the ARM implementation in order
to help catching such problems, should bl1_plat_mem_check()
be called in a different context in the future.
Fixes TFV-1: Malformed Firmware Update SMC can result in copy
of unexpectedly large data into secure memory
Change-Id: I8b8f8dd4c8777705722c7bd0e8b57addcba07e25
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Signed-off-by: Dan Handley <dan.handley@arm.com>
ASM_ASSERT failure and panic messages are suppressed at present. This
patch enables printing the PC location for panic messages, and file name
and line number upon assembly assert failure.
Change-Id: I80cb715988e7ce766f64da1e1d7065a74a096a0c
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
Varun Wadekar
danh-arm
davidcunado-arm
dp-arm
Douglas Raillard
Koan-Sin Tan
Masahiro Yamada
Paul Kocialkowski
Soren Brinkmann
Patrick Georgi
Sandrine Bailleux
Jeenu Viswambharan