Commit Graph

368 Commits

Author SHA1 Message Date
Samuel Holland 9d6d800d13 gicv2: Fix support for systems without secure interrupts
Accessing the interrupt_props array only happens inside a loop over
interrupt_props_num, so the GICv2 driver can cope with no secure
interrupts. As in fact we have already some asserts in place that
respect that, lets change the final place where we insist on a non-NULL
pointer to relax that.
This enables GICv2 platforms which have no need for a secure interrupt.

This only covers the non-deprecated code paths.

Also we remove a now redundant assert().

Change-Id: Id100ea978643d8558335ad28649d55743fe9bd4c
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
2018-04-03 16:45:10 +01:00
Dimitris Papastamos 6ab136c258
Merge pull request #1313 from jonathanwright-ARM/jw/MISRA-switch-statements
Fix switch statements to comply with MISRA rules
2018-03-29 13:20:05 +01:00
Dimitris Papastamos 875a85aae6
Merge pull request #1333 from jeenu-arm/icfg-fix
GIC: Fix interrupt setting interrupt configuration
2018-03-29 13:19:04 +01:00
Dimitris Papastamos 469744e6c2
Merge pull request #1329 from antonio-nino-diaz-arm/an/rpi3-multi-console
rpi3: Migrate to the multi console API
2018-03-29 10:04:06 +01:00
Joel Hutton 9f85f9e379 Clean usage of void pointers to access symbols
Void pointers have been used to access linker symbols, by declaring an
extern pointer, then taking the address of it. This limits symbols
values to aligned pointer values. To remove this restriction an
IMPORT_SYM macro has been introduced, which declares it as a char
pointer and casts it to the required type.

Change-Id: I89877fc3b13ed311817bb8ba79d4872b89bfd3b0
Signed-off-by: Joel Hutton <Joel.Hutton@Arm.com>
2018-03-27 13:20:27 +01:00
Jonathan Wright 5aa7498abd drivers: fix switch statements to comply with MISRA rules
Ensure (where possible) that switch statements in drivers comply with
MISRA rules 16.1 - 16.7.

Change-Id: I7a91e04b02af80fbc4673a52293386c0f81a0f7a
Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>
2018-03-26 12:43:05 +01:00
Jeenu Viswambharan 17e84eedb2 GIC: Fix setting interrupt configuration
- Interrupt configuration is a 2-bit field, so the field shift has to
    be double that of the bit number.

  - Interrupt configuration (level- or edge-trigger) is specified in the
    MSB of the field, not LSB.

Fixes applied to both GICv2 and GICv3 drivers.

Fixes ARM-software/tf-issues#570

Change-Id: Ia6ae6ed9ba9fb0e3eb0f921a833af48e365ba359
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-03-26 09:45:48 +01:00
Antonio Nino Diaz 4f8053dd28 drivers: ti: 16550: Implement console flush
Replace placeholder by actual implementation.

Change-Id: I0861b1ac5304b0d2d7c32d7d9a48bd985e258e92
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-03-22 20:13:44 +00:00
Michalis Pappas 3d2690d6e2 [PATCH 1/2] qemu: Support MULTI_CONSOLE_API
Include missing plat_helpers.S into pl011_console.S, to build successfully
when MULTI_CONSOLE_API is enabled.

Signed-off-by: Michalis Pappas <mpappas@fastmail.fm>
2018-03-05 20:14:39 +08:00
Dan Handley dcf01a0a8d Emit warnings when using deprecated GIC init
Emit runtime warnings when intializing the GIC drivers using the
deprecated method of defining integer interrupt arrays in the GIC driver
data structures; interrupt_prop_t arrays should be used instead. This
helps platforms detect that they have migration work to do. Previously,
no warning was emitted in this case. This affects both the GICv2 and GICv3
drivers.

Also use the __deprecated attribute to emit a build time warning if these
deprecated fields are used. These warnings are suppressed in the GIC
driver compatibility functions but will be visible if platforms use them.

Change-Id: I6b6b8f6c3b4920c448b6dcb82fc18442cfdf6c7a
Signed-off-by: Dan Handley <dan.handley@arm.com>
2018-03-01 16:14:29 +00:00
Dan Handley bc1a03c7a6 Improve MULTI_CONSOLE_API deprecation warnings
For platforms that have not migrated to MULTI_CONSOLE_API == 1, there
are a lot of confusing deprecated declaration warnings relating to
use of console_init() and console_uninit(). Some of these relate to use
by the generic code, not the platform code. These functions are not really
deprecated but *removed* when MULTI_CONSOLE_API == 1.

This patch consolidates these warnings into a single preprocessor warning.
The __deprecated attribute is removed from the console_init() and
console_uninit() declarations.

For preprocessor warnings like this to not cause fatal build errors,
this patch adds -Wno-error=cpp to the build flags when
ERROR_DEPRECATED == 0.
This option (and -Wno-error=deprecated-declarations) is now added to
CPPFLAGS instead of TF_CFLAGS to ensure the build flags are used in the
assembler as well as the compiler.

This patch also disentangles the MULTI_CONSOLE_API and ERROR_DEPRECATED
build flags by defaulting MULTI_CONSOLE_API to 0 instead of
ERROR_DEPRECATED. This allows platforms that have not migrated to
MULTI_CONSOLE_API to use ERROR_DEPRECATED == 1 to emit a more meaningful
build error.

Finally, this patch bans use of MULTI_CONSOLE_API == 1 and AARCH32, since
the AArch32 console implementation does not support
MULTI_CONSOLE_API == 1.

Change-Id: If762165ddcb90c28aa7a4951aba70cb15c2b709c
Signed-off-by: Dan Handley <dan.handley@arm.com>
2018-03-01 16:14:29 +00:00
Roberto Vargas 1af540ef2a Fix MISRA rule 8.4 Part 1
Rule 8.4: A compatible declaration shall be visible when
          an object or function with external linkage is defined

Fixed for:
	make DEBUG=1 PLAT=fvp LOG_LEVEL=50 all

Change-Id: I7c2ad3f5c015411c202605851240d5347e4cc8c7
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-02-28 17:19:55 +00:00
Roberto Vargas 7fabe1a899 Fix MISRA rule 8.4 in common code
Rule 8.4: A compatible declaration shall be visible when
          an object or function with external linkage is defined.

Change-Id: I26e042cb251a6f9590afa1340fdac73e42f23979
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-02-28 17:18:46 +00:00
Roberto Vargas 9fb8af33c4 Fix MISRA rule 8.3 in common code
Rule 8.3: All declarations of an object or function shall
          use the same names and type qualifiers.

Change-Id: Iff384187c74a598a4e73f350a1893b60e9d16cec
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-02-28 17:18:21 +00:00
Soby Mathew 6d31020e90 Dynamic cfg: Add HW and TB_FW configs to CoT
This patch adds image IDs to `hw_config` and `tb_fw_config` and
includes them in the default Chain Of Trust (CoT).

Change-Id: If7bb3e9be8a5e48be76614b35bf43d58fc7fed12
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2018-02-26 16:31:10 +00:00
davidcunado-arm a7265c9cb2
Merge pull request #1264 from fengbaopeng/integration
drivers:ufs: fix hynix ufs bug with quirk on hi36xx SoC
2018-02-24 20:18:14 +00:00
fengbaopeng 5ac25de695 drivers:ufs: fix hynix ufs bug with quirk on hi36xx SoC
Hynix ufs has deviations on hi36xx platform which will result
in ufs bursts transfer failures at a very low probability.

To fix the problem, the Hynix device must set the register
VS_DebugSaveConfigTime to 0x10, which will set time reference
for SaveConfigTime is 250 ns. The time reference for SaveConfigTime
is 40 ns by default.

Signed-off-by: fengbaopeng <fengbaopeng@hisilicon.com>
2018-02-24 09:30:41 +08:00
Soby Mathew 806d9ad171 Resolve TZC400 build issue when DEBUG=1 and ENABLE_ASSERTIONS=0
Previously the definition of `_tzc_read_peripheral_id()` was wrapped
in ENABLE_ASSERTIONS build flag. This causes build issue for TZC400 driver
when DEBUG=1 and ENABLE_ASSERTIONS=0. This patch fixes the same by
moving the definitions outside the ENABLE_ASSERTIONS build flag.

Change-Id: Ic1cad69f02ce65ac34aefd39eaa96d5781043152
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2018-02-21 16:51:12 +00:00
Antonio Nino Diaz fb1198b1bf Remove URLs from comments
This fixes all defects according to MISRA Rule 3.1: "The character
sequences /* and // shall not be used within a comment". This affects
all URLs in comments, so they have been removed:

- The link in `sdei_state.c` can also be found in the documentation file
  `docs/sdei.rst`.

- The bug that the file `io_fip.c` talks about doesn't affect the
  currently supported version of GCC, so it doesn't make sense to keep
  the comment. Note that the version of GCC officially supported is the
  one that comes with Linaro Release 17.10, which is GCC 6.2.

- The link in `tzc400.c` was broken, and it didn't correctly direct to
  the Technical Reference Manual it should. The link has been replaced
  by the title of the document, which is more convenient when looking
  for the document.

Change-Id: I89f60c25f635fd4c008a5d3a14028f814c147bbe
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-02-14 11:41:26 +00:00
davidcunado-arm 334e1ceb48
Merge pull request #1236 from dbasehore/gic-save-restore
RK3399 GIC save/restore
2018-02-01 08:58:23 +00:00
davidcunado-arm eefd04b69c
Merge pull request #1235 from jwerner-chromium/JW_udelay
Fix udelay issues that can make duration slightly too short
2018-01-30 08:59:35 +00:00
Julius Werner e2aec918d0 delay_timer: Guarantee that delay time can never be undershot
Delay functions like udelay() are often used to ensure that the
necessary time passed to allow some asynchronous event to finish, such
as the stabilization delay for a power rail. For these use cases it is
not very problematic if the delay is slightly longer than requested,
but it is critical that the delay must never be shorter.

The current udelay() implementation contains two hazards that may cause
the delay to be slightly shorter than intended: Firstly, the amount of
ticks to wait is calculated with an integer division, which may cut off
the last fraction of ticks needed. Secondly, the delay may be short by a
fraction of a tick because we do not know whether the initial ("start")
sample of the timer was near the start or near the end of the current
tick. Thus, if the code intends to wait for one tick, it might read the
timer value close to the end of the current tick and then read it again
right after the start of the next tick, concluding that the duration of
a full tick has passed when it in fact was just a fraction of it.

This patch rounds up the division and always adds one extra tick to
counteract both problems and ensure that delays will always be larger
but never smaller than requested.

Change-Id: Ic5fe5f858b5cdf3c0dbf3e488d4d5702d9569433
Signed-off-by: Julius Werner <jwerner@chromium.org>
2018-01-25 11:03:07 -08:00
davidcunado-arm 040f1e6987
Merge pull request #1193 from jwerner-chromium/JW_coreboot
New console API and coreboot support [v4]
2018-01-24 14:31:53 +00:00
Derek Basehore 3580a497b5 GICv3: Fix Dist restore for when the GIC is reset
If the GIC loses power during suspend, which the restore code was
written for, exit early in the post restore power sequence. This
prevents an assert from tripping, and the power sequence isn't needed
in this case anyways.

Signed-off-by: Derek Basehore <dbasehore@chromium.org>
2018-01-23 17:42:49 -08:00
davidcunado-arm b6df93dd70
Merge pull request #1227 from geesun/qx/emmc_macros
emmc: add macros CMD21, BUS_WIDTH_DDR_4 and BUS_WIDTH_DDR_8
2018-01-19 23:56:58 +00:00
Julius Werner 1c5f5031f3 coreboot: Add support for CBMEM console
coreboot supports an in-memory console to store firmware logs even when
no serial console is available. It is widely supported by
coreboot-compatible bootloaders (including SeaBIOS and GRUB) and can be
read by the Linux kernel.

This patch allows BL31 to add its own log messages to this console. The
driver will be registered automatically if coreboot support is compiled
in and detects the presence of a console buffer in the coreboot tables.

Change-Id: I31254dfa0c2fdeb7454634134b5707b4b4154907
Signed-off-by: Julius Werner <jwerner@chromium.org>
2018-01-19 15:21:12 -08:00
Julius Werner 38ba8e9327 drivers: cadence: cdns: Update CDNS driver to support MULTI_CONSOLE_API
This patch updates the Cadence CDNS console driver to support the new
console API. The driver will continue to support the old API as well by
checking the MULTI_CONSOLE_API compile-time flag.

Change-Id: I2ef8fb0d6ab72696997db1e0243a533499569d6b
Signed-off-by: Julius Werner <jwerner@chromium.org>
2018-01-19 15:21:12 -08:00
Julius Werner 4a0c45716d drivers: arm: pl011: Update PL011 driver to support MULTI_CONSOLE_API
This patch updates the ARM PL011 console driver to support the new
console API. The driver will continue to support the old API as well by
checking the MULTI_CONSOLE_API compile-time flag.

Change-Id: Ic34e4158addbb0c5fae500c9cff899c05a4f4206
Signed-off-by: Julius Werner <jwerner@chromium.org>
2018-01-19 15:21:12 -08:00
Julius Werner 36c42ca111 drivers: ti: uart: Update 16550 UART driver to support MULTI_CONSOLE_API
This patch updates the TI 16550 console driver to support the new
console API. The driver will continue to support the old API as well by
checking the MULTI_CONSOLE_API compile-time flag.

Change-Id: I60a44b7ba3c35c74561824c04b8dbe3e3039324c
Signed-off-by: Julius Werner <jwerner@chromium.org>
2018-01-19 15:21:12 -08:00
davidcunado-arm 0d3a27e7f6
Merge pull request #1200 from robertovargas-arm/bl2-el3
Add BL2_AT_EL3 build option
2018-01-19 13:40:12 +00:00
Roberto Vargas 76d2673346 bl2-el3: Don't compile BL1 when BL2_AT_EL3 is defined in FVP
This patch modifies the makefiles to avoid the definition
of BL1_SOURCES and BL2_SOURCES in the tbbr makefiles, and
it lets to the platform makefiles to define them if they
actually need these images. In the case of BL2_AT_EL3
BL1 will not be needed usually because the Boot ROM will
jump directly to BL2.

Change-Id: Ib6845a260633a22a646088629bcd7387fe35dcf9
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-01-18 16:25:18 +00:00
Qixiang Xu bc9a7c9cf9 emmc: add macros CMD21, BUS_WIDTH_DDR_4 and BUS_WIDTH_DDR_8
Add some macros according to JEDEC Standard Embedded Multi-Media
Card (eMMC) Electrical Standard (5.1)": Table 145 - Bus Mode
Selection.

Change-Id: Iaa45e0582653ef4290efd60d039f0bdc420eeb47
Signed-off-by: Qixiang Xu <qixiang.xu@arm.com>
2018-01-17 14:14:29 +08:00
Haojian Zhuang e52f529167 emmc/dw_mmc: fix the assert on HLE bit
When check HLE bit in interrupt register, it should check whether
HLE bit is set, not clear.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
2018-01-11 13:49:56 +08:00
davidcunado-arm dced20e17b
Merge pull request #1194 from robertovargas-arm/io-fix
io: block: fix block_read/write may read/write overlap buffer
2017-12-19 17:39:20 +00:00
Roberto Vargas e19e40af97 io: block: fix block_read/write may read/write overlap buffer
The block operations were trying to optimize the number of memory
copies, and it tried to use directly the buffer supplied by the user
to them. This was a mistake because it created too many corner cases:

	1- It was possible to generate unaligned
	   operations to unaligned buffers. Drivers that were using
	   DMA transfer failed in that case.

	2- It was possible to generate read operations
	   with sizes that weren't a multiple of the block size. Some
	   low level drivers assumed that condition and they calculated
	   the number of blocks dividing the number of bytes by the
	   size of the block, without considering the remaining bytes.

	3- The block_* operations didn't control the
	   number of bytes actually copied to memory, because the
	   low level drivers were writing directly to the user buffer.

This patch rewrite block_read and block_write to use always the device
buffer, which the platform ensures that has the correct aligment and
the correct size.

Change-Id: I5e479bb7bc137e6ec205a8573eb250acd5f40420
Signed-off-by: Qixiang Xu <qixiang.xu@arm.com>
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2017-12-13 09:13:37 +00:00
Julius Werner 9536bae6df Add new function-pointer-based console API
This patch overhauls the console API to allow for multiple console
instances of different drivers that are active at the same time. Instead
of binding to well-known function names (like console_core_init),
consoles now provide a register function (e.g. console_16550_register())
that will hook them into the list of active consoles. All console
operations will be dispatched to all consoles currently in the list.

The new API will be selected by the build-time option MULTI_CONSOLE_API,
which defaults to ${ERROR_DEPRECATED} for now. The old console API code
will be retained to stay backwards-compatible to older platforms, but
should no longer be used for any newly added platforms and can hopefully
be removed at some point in the future.

The new console API is intended to be used for both normal (bootup) and
crash use cases, freeing platforms of the need to set up the crash
console separately. Consoles can be individually configured to be active
active at boot (until first handoff to EL2), at runtime (after first
handoff to EL2), and/or after a crash. Console drivers should set a sane
default upon registration that can be overridden with the
console_set_scope() call. Code to hook up the crash reporting mechanism
to this framework will be added with a later patch.

This patch only affects AArch64, but the new API could easily be ported
to AArch32 as well if desired.

Change-Id: I35c5aa2cb3f719cfddd15565eb13c7cde4162549
Signed-off-by: Julius Werner <jwerner@chromium.org>
2017-12-12 15:00:34 -08:00
davidcunado-arm 71f8a6a9b0
Merge pull request #1145 from etienne-lms/rfc-armv7-2
Support ARMv7 architectures
2017-11-23 23:41:24 +00:00
Qixiang Xu 9a3088a5f5 tbbr: Add build flag HASH_ALG to let the user to select the SHA
The flag support the following values:
    - sha256 (default)
    - sha384
    - sha512

Change-Id: I7a49d858c361e993949cf6ada0a86575c3291066
Signed-off-by: Qixiang Xu <qixiang.xu@arm.com>
2017-11-21 14:16:18 +08:00
Jeenu Viswambharan 385f1dbb29 GIC: Fix Group 0 enabling
At present, the GIC drivers enable Group 0 interrupts only if there are
Secure SPIs listed in the interrupt properties/list. This means that,
even if there are Group 0 SGIs/PPIs configured, the group remained
disabled in the absence of a Group 0 SPI.

Modify both GICv2 and GICv3 SGI/PPI configuration to enable Group 0 when
corresponding SGIs/PPIs are present.

Change-Id: Id123e8aaee0c22b476eebe3800340906d83bbc6d
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-11-13 07:49:30 +00:00
Jeenu Viswambharan 058efeef98 GICv2: Fix populating PE target data
This patch brings in the following fixes:

  - The per-PE target data initialized during power up needs to be
    flushed so as to be visible to other PEs.

  - Setup per-PE target data for the primary PE as well. At present,
    this was only setup for secondary PEs when they were powered on.

Change-Id: Ibe3a57c14864e37b2326dd7ab321a5c7bf80e8af
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-11-13 07:49:30 +00:00
Etienne Carriere 64deed19e4 ARMv7: GICv2 driver can manage GICv1 with security extension
Some SoCs integrate a GIC in version 1 that is currently not supported
by the trusted firmware. This change hijacks GICv2 driver to handle the
GICv1 as GICv1 is compatible enough with GICv2 as far as the platform
does not attempt to play with virtualization support or some GICv2
specific power features.

Note that current trusted firmware does not use these GICv2 features
that are not available in GICv1 Security Extension.

Change-Id: Ic2cb3055f1319a83455571d6d918661da583f179
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
2017-11-08 14:42:06 +01:00
Jeenu Viswambharan c639e8ebee GIC: Allow specifying interrupt properties
The GIC driver initialization currently allows an array of interrupts to
be configured as secure. Future use cases would require more interrupt
configuration other than just security, such as priority.

This patch introduces a new interrupt property array as part of both
GICv2 and GICv3 driver data. The platform can populate the array with
interrupt numbers and respective properties. The corresponding driver
initialization iterates through the array, and applies interrupt
configuration as required.

This capability, and the current way of supplying array (or arrays, in
case of GICv3) of secure interrupts, are however mutually exclusive.
Henceforth, the platform should supply either:

  - A list of interrupts to be mapped as secure (the current way).
    Platforms that do this will continue working as they were. With this
    patch, this scheme is deprecated.

  - A list of interrupt properties (properties include interrupt group).
    Individual interrupt properties are specified via. descriptors of
    type 'interrupt_prop_desc_t', which can be populated with the macro
    INTR_PROP_DESC().

A run time assert checks that the platform doesn't specify both.

Henceforth the old scheme of providing list of secure interrupts is
deprecated. When built with ERROR_DEPRECATED=1, GIC drivers will require
that the interrupt properties are supplied instead of an array of secure
interrupts.

Add a section to firmware design about configuring secure interrupts.

Fixes ARM-software/tf-issues#262

Change-Id: I8eec29e72eb69dbb6bce77879febf32c95376942
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:02 +01:00
Jeenu Viswambharan 2296610696 GIC: Add helpers to set interrupt configuration
The helpers perform read-modify-write on GIC*_ICFGR registers, but don't
serialise callers. Any serialisation must be taken care of by the
callers.

Change-Id: I71995f82ff2c7f70d37af0ede30d6ee18682fd3f
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:02 +01:00
Jeenu Viswambharan d55a445069 GIC: Add API to set priority mask
API documentation updated.

Change-Id: I40feec1fe67a960d035061b54dd55610bc34ce1d
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:02 +01:00
Jeenu Viswambharan a2816a1644 GIC: Add API to set/clear interrupt pending
API documentation updated.

Change-Id: I14e33cfc7dfa93257c82d76fae186b17a1b6d266
Co-authored-by: Yousuf A <yousuf.sait@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:02 +01:00
Jeenu Viswambharan fc529fee72 GIC: Add API to set interrupt routing
SPIs can be routed to either a specific PE, or to any one of all
available PEs.

API documentation updated.

Change-Id: I28675f634568aaf4ea1aa8aa7ebf25b419a963ed
Co-authored-by: Yousuf A <yousuf.sait@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:02 +01:00
Jeenu Viswambharan 8db978b5a8 GIC: Add API to raise secure SGI
API documentation updated.

Change-Id: I129725059299af6cc612bafa8d74817f779d7c4f
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:02 +01:00
Jeenu Viswambharan 74dce7fa6e GIC: Add APIs to set interrupt type and query support
The back end GIC driver converts and assigns the interrupt type to
suitable group.

For GICv2, a build option GICV2_G0_FOR_EL3 is introduced, which
determines to which type Group 0 interrupts maps to.

 - When the build option is set 0 (the default), Group 0 interrupts are
   meant for Secure EL1. This is presently the case.

 - Otherwise, Group 0 interrupts are meant for EL3. This means the SPD
   will have to synchronously hand over the interrupt to Secure EL1.

The query API allows the platform to query whether the platform supports
interrupts of a given type.

API documentation updated.

Change-Id: I60fdb4053ffe0bd006b3b20914914ebd311fc858
Co-authored-by: Yousuf A <yousuf.sait@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:01 +01:00
Jeenu Viswambharan f3a866004e GIC: Add API to set interrupt priority
API documentation updated.

Change-Id: Ib700eb1b8ca65503aeed0ac4ce0e7b934df67ff9
Co-authored-by: Yousuf A <yousuf.sait@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:01 +01:00
Jeenu Viswambharan 979225f4ee GIC: Add APIs to enable and disable interrupt
API documentation updated.

Change-Id: Ice7511f8df5356851001d2f7dc2a46cfe318f9ba
Co-authored-by: Yousuf A <yousuf.sait@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:01 +01:00
Jeenu Viswambharan cbd3f3706d GIC: Add API to get interrupt active status
API documentation updated.

Change-Id: I6d61785af0d5330930c709de971a904dc7c3516c
Co-authored-by: Yousuf A <yousuf.sait@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:01 +01:00
Jeenu Viswambharan fa9db4230a GICv2: Add driver API to set PE target mask
The PE target mask is used to translate linear PE index (returned by
platform core position) to a bit mask used when targeting interrupts to
a PE, viz. when raising SGIs and routing SPIs.

The platform shall:

  - Populate the driver data with a pointer to array that's to contain
    per-PE target masks.

  - Invoke the new driver API 'gicv2_set_pe_target_mask()' during
    per-CPU initialization so that the driver populates the target mask
    for that CPU.

Platforms that don't intend to target interrupts or raise SGIs need not
populate this.

Change-Id: Ic0db54da86915e9dccd82fff51479bc3c1fdc968
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:01 +01:00
Jeenu Viswambharan eb68ea9b10 GIC: Add API to get running priority
Document the API in separate platform interrupt controller API document.

Change-Id: If18f208e10a8a243f5c59d226fcf48e985941949
Co-authored-by: Yousuf A <yousuf.sait@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-10-16 16:50:01 +01:00
Soby Mathew c1bbeb5fab Fix assertion in GIC ITS helper
This patch fixes an assertion check in the GICv3 ITS helper function.

Change-Id: I75f50d7bf6d87c12c6e24a07c9a9889e5facf4a5
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2017-10-06 18:12:37 +01:00
Soby Mathew b258278eec GICv3: ITS architectural save and restore helpers
This patch adds functions to save and restore GICv3 ITS registers during
system suspend. Please note that the power management of GIC ITS is
implementation defined. These functions only implements the
architectural part of the ITS power management and they do not restore
memory structures or register content required to support ITS. Even if
the ITS implementation stores structures in memory, an implementation
defined power down sequence is likely to be required to flush some
internal ITS caches to memory. If such implementation defined sequence
is not followed, the platform must ensure that the ITS is not power
gated during system suspend.

Change-Id: I5f31e5541975aa7dcaab69b0b7f67583c0e27678
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
2017-10-05 16:47:53 +01:00
Soby Mathew ebf1ca10e4 GICv3: add functions for save and restore
During system suspend, the GICv3 Distributor and Redistributor context
can be lost due to power gating of the system power domain. This means
that the GICv3 context needs to be saved prior to system suspend and
restored on wakeup. Currently the consensus is that the Firmware should
be in charge of this. See tf-issues#464 for more details.

This patch introduces helper APIs in the GICv3 driver to save and
restore the Distributor and Redistributor contexts. The GICv3 ITS
context is not considered in this patch because the specification says
that the details of ITS power management is implementation-defined.
These APIs are expected to be appropriately invoked by the platform
layer during system suspend.

Fixes ARM-software/tf-issues#464

Change-Id: Iebb9c6770ab8c4d522546f161fa402d2fe02ec00
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
2017-10-05 16:47:53 +01:00
Douglas Raillard a64b4e626e GICv3: turn some macros into inline functions
Tidy up the code a bit by turning some macros into inline functions
which allows to remove the do/while(0) idiom and backslashes at the end
of the line.

Change-Id: Ie41a4ea4a4da507f7b925247b53e85019101d717
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
2017-10-05 16:47:53 +01:00
Douglas Raillard b50bdceadf GICv3: Fix gic600.c indentation
Reindent the file using tabs as the mix of spaces and tabs confuses some
editors and leads them to use spaces instead of tabs for new code
although the coding style mandates tabs.

Change-Id: I87fa4a5d368a048340054b9b3622325f3f7befba
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
2017-10-05 16:47:53 +01:00
davidcunado-arm b8fa2ed562 Merge pull request #1107 from geesun/qx/add_ecdsa_support
Add support for TBBR using ECDSA keys in ARM platforms
2017-10-02 15:03:16 +01:00
Qixiang Xu dcbf3932fd Dynamic selection of ECDSA or RSA
Add new option rsa+ecdsa for TF_MBEDTLS_KEY_ALG, which selects
rsa or ecdsa depending on the certificate used.

Change-Id: I08d9e99bdbba361ed2ec5624248dc382c750ad47
Signed-off-by: Qixiang Xu <qixiang.xu@arm.com>
2017-09-22 17:42:40 +08:00
Qixiang Xu 9db9c65a11 Add support for TBBR using ECDSA keys in ARM platforms
- fixed compile error when KEY_ALG=ecdsa
    - add new option ecdsa for TF_MBEDTLS_KEY_ALG
    - add new option devel_ecdsa for ARM_ROTPK_LOCATION
    - add ecdsa key at plat/arm/board/common/rotpk/
    - reduce the mbedtls heap memory size to 13k

Change-Id: I3f7a6170af93fdbaaa7bf2fffb4680a9f6113c13
Signed-off-by: Qixiang Xu <qixiang.xu@arm.com>
2017-09-22 09:48:36 +08:00
Antonio Nino Diaz e47ac1fd63 Fix type of `unsigned long` constants
The type `unsigned long` is 32 bit wide in AArch32, but 64 bit wide in
AArch64. This is inconsistent and that's why we avoid using it as per
the Coding Guidelines. This patch changes all `UL` occurrences to `U`
or `ULL` depending on the context so that the size of the constant is
clear.

This problem affected the macro `BIT(nr)`. As long as this macro is used
to fill fields of registers, that's not a problem, since all registers
are 32 bit wide in AArch32 and 64 bit wide in AArch64. However, if the
macro is used to fill the fields of a 64-bit integer, it won't be able
to set the upper 32 bits in AArch32.

By changing the type of this macro to `unsigned long long` the behaviour
is always the same regardless of the architecture, as this type is
64-bit wide in both cases.

Some Tegra platform files have been modified by this patch.

Change-Id: I918264c03e7d691a931f0d1018df25a2796cc221
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-09-21 12:03:53 +01:00
Soby Mathew a8eb286ada cert_tool: Support for legacy RSA PKCS#1 v1.5
This patch enables choice of RSA version at run time to be used for
generating signatures by the cert_tool. The RSA PSS as defined in
PKCS#1 v2.1 becomes the default version and this patch enables to specify
the RSA PKCS#1 v1.5 algorithm to `cert_create` through the command line
-a option. Also, the build option `KEY_ALG` can be used to pass this
option from the build system. Please note that RSA PSS is mandated
by Trusted Board Boot requirements (TBBR) and legacy RSA support is
being added for compatibility reasons.

Fixes ARM-Software/tf-issues#499
Change-Id: Ifaa3f2f7c9b43f3d7b3effe2cde76bf6745a5d73
Co-Authored-By: Eleanor Bonnici <Eleanor.bonnici@arm.com>
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2017-08-31 16:42:11 +01:00
Soby Mathew 2091755c5e Export KEY_ALG as a user build option
The `KEY_ALG` variable is used to select the algorithm for key
generation by `cert_create` tool for signing the certificates. This
variable was previously undocumented and did not have a global default
value. This patch corrects this and also adds changes to derive the
value of `TF_MBEDTLS_KEY_ALG` based on `KEY_ALG` if it not set by the
platform. The corresponding assignment of these variables are also now
removed from the `arm_common.mk` makefile.

Signed-off-by: Soby Mathew <soby.mathew@arm.com>
Change-Id: I78e2d6f4fc04ed5ad35ce2266118afb63127a5a4
2017-08-31 16:42:11 +01:00
danh-arm 1a52aca5f6 Merge pull request #1040 from sliai/support-opteed-header
Support opteed header
2017-08-14 16:35:12 +01:00
Summer Qin 71fb396440 Support Trusted OS firmware extra images in TF tools
Since Trusted OS firmware may have extra images, need to
assign new uuid and image id for them.
The TBBR chain of trust has been extended to add support
for the new images within the existing Trusted OS firmware
content certificate.

Change-Id: I678dac7ba1137e85c5779b05e0c4331134c10e06
Signed-off-by: Summer Qin <summer.qin@arm.com>
2017-08-09 18:06:05 +08:00
Jeenu Viswambharan 1154586b71 Add SMMUv3 driver
The driver has only one API: to initialize an SMMUv3 device. This
operates on a device that implements secure state, by invalidating
secure caches and TLBs.

Change-Id: Ief32800419ddf0f1fe38c8f0da8f5ba75c72c826
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-08-01 14:33:47 +01:00
Jeenu Viswambharan e33fd44548 CCI: Adapt for specific product at run time
The current build system and driver requires the CCI product to be
specified at build time. The device constraints can be determined at run
time from its ID registers, obviating the need for specifying them
ahead.

This patch adds changes to identify and validate CCI at run time. Some
global variables are renamed to be in line with the rest of the code
base.

The build option ARM_CCI_PRODUCT_ID is now removed, and user guide is
updated.

Change-Id: Ibb765e349d3bc95ff3eb9a64bde1207ab710a93d
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-08-01 14:33:47 +01:00
Isla Mitchell 2a4b4b71ba Fix order of #includes
This fix modifies the order of system includes to meet the ARM TF coding
standard. There are some exceptions in order to retain header groupings,
minimise changes to imported headers, and where there are headers within
the #if and #ifndef statements.

Change-Id: I65085a142ba6a83792b26efb47df1329153f1624
Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
2017-07-12 14:45:31 +01:00
Soby Mathew fd2b42f4ae Do basic CryptoCell LCS check
This patch implements the basic lifecycle state check when CryptoCell
SBROM is initialized. Currently the check ensures that if the lifecycle
state is Security Disabled (SD), the boot process does not proceed
further.

Change-Id: I5101335453cd3ea413e97bcfb9138a96c05e1aea
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2017-06-28 15:58:06 +01:00
Soby Mathew 4eb20d99c5 Add CC crypto driver to the Auth module
This patch adds a crypto driver which utilizes the ARM® TrustZone®
CryptoCell-712 to verify signature and hash during Trusted Board Boot. Along
with this driver, the CryptoCell SBROM library is required to successfully
build the BL image. The path to this library is specified via
the `CCSBROM_LIB_PATH` variable. Please note that, mbedTLS is still required
to do the X509 certificate ASN.1 parsing and CryptoCell is only utilized for
signature and hash verification.

Change-Id: If82dfbae0d7772ba1c64839f0b27850c103fe253
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2017-06-28 15:58:06 +01:00
Etienne Carriere d60e6bae02 io_dummy: correct sparse warnings
Include io_dummy.h header file.
Use static for device_type_dummy function.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
2017-06-23 09:38:15 +02:00
Etienne Carriere 5a8e2aeec4 io_storage: use unsigned int for index
This change avoids warning about type conversion.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
2017-06-23 09:38:13 +02:00
Etienne Carriere 1496b4895e delay_timer: correct sparse issues and warnings
Use NULL instead of 0 where required.
Include headers to have the prototype of the functions.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
2017-06-23 09:38:08 +02:00
Haojian Zhuang 101afa02b7 ufs: fix the and operator
Should use AND (&), not &&.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
2017-06-13 14:33:49 +08:00
davidcunado-arm b91926fd50 Merge pull request #968 from antonio-nino-diaz-arm/an/snprintf-alt
mbedtls: Don't use tf_snprintf if option not defined
2017-06-09 12:03:35 +01:00
Antonio Nino Diaz c46c18c598 mbedtls: Don't use tf_snprintf if option not defined
If `MBEDTLS_PLATFORM_SNPRINTF_ALT` isn't used, the function
`mbedtls_platform_set_snprintf()` isn't defined.

In case a platform uses a different mbed TLS configuration file than
the one provided by the Trusted Firmware, and it doesn't define the
mentioned build option, this will result in a build error.

This patch modifies the initialization code so that
`mbedtls_platform_set_snprintf()` is only used if
`MBEDTLS_PLATFORM_SNPRINTF_ALT` is defined, allowing platforms to use
it or not depending on their needs.

Change-Id: I1d5c86d57e9b2871ba463030bf89210ebec5178e
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-06-06 10:54:42 +01:00
danh-arm 47fd7cb0ac Merge pull request #964 from soby-mathew/sm/rsapss_sup
Add support for RSASSAPSS algorithm
2017-06-05 14:45:10 +01:00
Soby Mathew 1001202d24 Add support for RSASSAPSS algorithm in mbedtls crypto driver
This patch adds support for RSASSA-PSS Signature Algorithm for
X509 certificates in mbedtls crypto driver. Now the driver supports
RSA PKCS2_1 standard as mandated by TBBR.

NOTE: With this patch, the PKCS1_5 standard compliant RSA signature
is deprecated.

Change-Id: I9cf6d073370b710cc36a7b374a55ec96c0496461
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2017-06-05 12:25:26 +01:00
Soby Mathew 38aacad3cb Increase heapsize for mbedtls library
The mbedTLS library requires larger heap memory for verification of RSASSA-PSS
signature in certificates during Trusted Board Boot. This patch increases the
heap memory for the same.

Change-Id: I3c3123d7142b7b7b01463516ec436734895da159
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2017-06-05 12:23:27 +01:00
Jeenu Viswambharan e1c59ab3f1 Introduce ARM GIC-600 driver
ARM GIC-600 IP complies with ARM GICv3 architecture, but among others,
implements a power control register in the Redistributor frame. This
register must be programmed to mark the frame as powered on, before
accessing other registers in the frame. Rest of initialization sequence
remains the same.

The driver provides APIs for Redistributor power management, and
overrides those in the generic GICv3 driver. The driver data is shared
between generic GICv3 driver and that of GIC-600.

For FVP platform, the GIC-600 driver is chosen when FVP_USE_GIC_DRIVER
is set to FVP_GIC600. Also update user guide.

Change-Id: I321b2360728d69f6d4b0a747b2cfcc3fe5a20d67
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-06-01 11:44:56 +01:00
danh-arm 2bd26faf62 Merge pull request #958 from antonio-nino-diaz-arm/an/mbedtls-heap-size
mbedtls: Define optimized mbed TLS heap size
2017-05-31 16:40:56 +01:00
Antonio Nino Diaz 05fd893ea4 mbedtls: Define optimized mbed TLS heap size
mbed TLS provides the debug API `mbedtls_memory_buffer_alloc_status()`
to analyse the RAM usage of the library.

When RSA is selected as algorithm, the maximum heap usage in FVP and
Juno has been determined empirically to be approximately 5.5 KiB.
However, The default heap size used when RSA is selected is 8 KiB.

This patch reduces the buffer from 8 KiB to 6 KiB so that the BSS
sections of both BL1 and BL2 are 2 KiB smaller when the firmware is
compiled with TBB support.

Change-Id: I43878a4e7af50c97be9c8d027c728c8483f24fbf
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-05-31 15:02:32 +01:00
danh-arm 9260f92949 Merge pull request #955 from hzhuang1/ufs
Add ufs stack and designware phy
2017-05-31 14:25:36 +01:00
Haojian Zhuang 7e08084213 drivers: add designware ufs driver
Initialized the designware UFS PHY.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
2017-05-31 11:00:57 +08:00
Haojian Zhuang eb5073f49e drivers: add ufs stack
If UFS device is initialized, we could just make it out of
hibernation by UFS_FLAGS_SKIPINIT. And vendor's dirver is always
focus on PHY setting. We could use UFS driver directly if it
exits from hibernation.

There're eight LUNs in UFS device. The UFS driver only provides
the read/write API with LUN. User could define his own read/write
since user may want to access different LUNs.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
2017-05-31 11:00:38 +08:00
davidcunado-arm 572e141327 Merge pull request #949 from antonio-nino-diaz-arm/an/printf-memory
Reduce code size when building with Trusted Board Boot enabled
2017-05-30 10:56:47 +01:00
Antonio Nino Diaz ab1794f576 mbedtls: Use `tf_snprintf` instead of `snprintf`
The Trusted Firmware uses a subset of the APIs provided by mbed TLS.
This subset internally uses `snprintf`, but the only format specifier
used is '%d', which is supported by `tf_snprintf`.

This patch makes mbed TLS use `tf_snprintf` instead of `snprintf`,
saving 3 KB in both debug and release builds when TBBR is enabled.

Change-Id: I7f992a21015930d7c0f4660e7a28ceefd60b9597
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-05-24 10:47:05 +01:00
Masahiro Yamada bb41eb7a9d cert: move platform_oid.h to include/tools_share for all platforms
Platforms aligned with TBBR are supposed to use their own OIDs, but
defining the same macros with different OIDs does not provide any
value (at least technically).

For easier use of TBBR, this commit allows platforms to reuse the OIDs
obtained by ARM Ltd.  This will be useful for non-ARM vendors that
do not need their own extension fields in their certificate files.

The OIDs of ARM Ltd. have been moved to include/tools_share/tbbr_oid.h

Platforms can include <tbbr_oid.h> instead of <platform_oid.h> by
defining USE_TBBR_DEFS as 1.  USE_TBBR_DEFS is 0 by default to keep the
backward compatibility.

For clarification, I inserted a blank line between headers from the
include/ directory (#include <...>) and ones from a local directory
(#include "..." ).

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2017-05-24 00:08:35 +09:00
David Cunado 0aff7ad2bc mbedtls: Complete namespace for TF specific macros
This patch renames MBEDTLS_KEY_ALG to TF_MBEDTLS_KEY_ALG. This
completes the migration of TF specific macros so that they do not
have the MBEDTLS_ suffix (see arm-trusted-firmware#874).

Change-Id: Iad7632477e220b0af987c4db3cf52229fb127d00
Signed-off-by: David Cunado <david.cunado@arm.com>
2017-05-12 14:44:36 +01:00
David Cunado b188351025 mbedtls: Namespace for TF specific macros
An earlier patch (arm-trusted-firmware#874) migrated MBEDTLS_ suffixed
macros to have a TBBR_ suffix to avoid any potential clash with future
mbedtls macros.

But on reflection the TBBR_ suffix could be confusing as the macros
are used to drive TF-specific configuration of mbedtls. As such
this patch migrates these macros from TBBR_suffix to TF_MBEDTLS_
suffix which more accurately conveys their use.

Change-Id: Ic87642b653ceeaa03d62f724976abd5e12e867d4
Signed-off-by: David Cunado <david.cunado@arm.com>
2017-05-12 14:44:35 +01:00
dp-arm 82cb2c1ad9 Use SPDX license identifiers
To make software license auditing simpler, use SPDX[0] license
identifiers instead of duplicating the license text in every file.

NOTE: Files that have been imported by FreeBSD have not been modified.

[0]: https://spdx.org/

Change-Id: I80a00e1f641b8cc075ca5a95b10607ed9ed8761a
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
2017-05-03 09:39:28 +01:00
Varun Wadekar 8178ea7cb1 drivers: ti: uart: remove UART_FCR writes
This patch removes the code that touched UART_FCR, from
console_core_putc(). The check for whether transmit FIFO is
full is sufficient before writing to UART TX FIFO. In fact
setting UARTFCR_TXCLR immediately after a byte is written to
FIFO might even result in loss of that byte, if UART hasn't
sent that byte out yet.

Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
2017-04-21 15:18:48 -07:00
davidcunado-arm 2edf64827f Merge pull request #906 from antonio-nino-diaz-arm/an/asserts-release
Add `ENABLE_ASSERTIONS` build option
2017-04-21 09:37:36 +01:00
Antonio Nino Diaz aa61368eb5 Control inclusion of helper code used for asserts
Many asserts depend on code that is conditionally compiled based on the
DEBUG define. This patch modifies the conditional inclusion of such code
so that it is based on the ENABLE_ASSERTIONS build option.

Change-Id: I6406674788aa7e1ad7c23d86ce94482ad3c382bd
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-04-20 09:59:12 +01:00
Antonio Nino Diaz 239b085caa TZC: rename included C file to a header
C files shouldn't be included into others. This file only contains some
macros and functions that can be made `static inline`, so it is ok to
convert it into a header file.

This is the only occurrence of a C file being included in another one in
the codebase instead of using a header, other occurrences are a way of
achieving backwards-compatibility.

Functions therein have been qualified as `inline`.

Change-Id: I88fe300f6d85a7f0740ef14c9cb8fa54849218e6
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-04-18 10:36:02 +01:00
davidcunado-arm f3c8ec672e Merge pull request #893 from antonio-nino-diaz-arm/an/tf-printf-error
Replace tf_printf occurrences with ERROR
2017-04-16 17:42:28 +01:00
davidcunado-arm f07d3985b8 Merge pull request #885 from antonio-nino-diaz-arm/an/console-flush
Implement console_flush()
2017-04-12 22:23:44 +01:00
Antonio Nino Diaz 38aecbb43e Replace tf_printf occurrences with ERROR
The amount of console output is controlled by the LOG_LEVEL build
option. Using tf_printf without any #ifdef depending on the LOG_LEVEL
doesn't give the user that flexibility.

This patch replaces all occurrences of tf_printf that prints error, but
aren't dependent on LOG_LEVEL, with the ERROR macro.

Change-Id: Ib5147f14fc1579398a11f19ddd0e840ff6692831
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-04-06 14:46:38 +01:00
Antonio Nino Diaz ad4c2ec688 Add console_core_flush() in upstream platforms
It is needed to add placeholders for this function because, as this is
not a `plat_xxx()` function, there aren't weak definitions of it in any
file.

If `console_flush()` is used and there isn't an implementation of
`console_core_flush()` in any file, the compilation will fail.

Change-Id: I50eb56d085c4c9fbc85d40c343e86af6412f3020
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-03-31 09:54:21 +01:00
Antonio Nino Diaz 73e052846a Add console_flush() to console API
This function ensures that console output is flushed, for example
before shutting down or use by another component

In line with other console APIs, console_flush() wraps
console_core_flush().

Also implement console_core_flush() for PL011.

Change-Id: I3db365065e4de04a454a5c2ce21be335a23a01e4
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-03-31 09:54:21 +01:00
dp-arm 66b4c1660a mbedtls: Namespace TF specific macros
These macros are not part of mbed TLS so they should not be prefixed
with `MBEDTLS_` to avoid potential collision in the future. Use the
`TBBR_` suffix to highlight that they only used in TF.

`MBEDTLS_KEY_ALG` was not modified because that is documented and used
by platforms to select the key algorithm.

Change-Id: Ief224681715c481691c80810501830ce16e210b0
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
2017-03-22 15:30:05 +00:00
davidcunado-arm 3944adca59 Merge pull request #861 from soby-mathew/sm/aarch32_fixes
Misc AArch32 fixes
2017-03-18 12:16:27 +00:00
davidcunado-arm effe0dcab1 Merge pull request #858 from soby-mathew/sm/gic_driver_data_fix
Flush the GIC driver data after init
2017-03-17 13:31:05 +00:00
Soby Mathew e40e075f4d AArch32: Fix conditional inclusion of bakery_locks
Due to incorrect conditional compilation checks, bakery locks were
excluded from the CCN driver and the power controller driver for FVP
when BL32 was built as the EL3 Runtime Software in AArch32 mode.
This patch corrects the same.

Change-Id: Ib1f163d9167a5c38e4d622232c4835cad9c235aa
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2017-03-02 15:43:17 +00:00
Soby Mathew 311b177364 Flush the GIC driver data after init
The GIC driver data is initialized by the primary CPU with caches
enabled. When the secondary CPU boots up, it initializes the
GICC/GICR interface with the caches disabled and there is a chance that
the driver data is not yet written back to the memory. This patch fixes
this problem by flushing the driver data after they have been
initialized.

Change-Id: Ie9477029683846209593ff005d2bac559bb8f5e6
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2017-03-01 14:38:28 +00:00
Jeenu Viswambharan b4d2c67bdd Remove redundant assert
Static checks flag an assert added in commit 1f786b0 that compares
unsigned value to 0, which will never fail.

Change-Id: I4b02031c2cfbd9a25255d12156919dda7d4805a0
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-02-22 11:09:58 +00:00
danh-arm 93f398205a Merge pull request #844 from antonio-nino-diaz-arm/an/no-timingsafe
Revert "tbbr: Use constant-time bcmp() to compare hashes"
2017-02-20 14:00:05 +00:00
danh-arm 1f786b0f77 Merge pull request #842 from jeenu-arm/io-memmap-asserts
Add bounds checking asserts to memmap IO driver
2017-02-20 13:59:12 +00:00
Antonio Nino Diaz fabd21ad36 Revert "tbbr: Use constant-time bcmp() to compare hashes"
This reverts commit b621fb503c.

Because of the Trusted Firmware design, timing-safe functions are not
needed. Using them may be misleading as it could be interpreted as being
a protection against private data leakage, which isn't the case here.

For each image, the SHA-256 hash is calculated. Some padding is appended
and the result is encrypted with a private key using RSA-2048. This is
the signature of the image. The public key is stored along with BL1 in
read-only memory and the encrypted hash is stored in the FIP.

When authenticating an image, the TF decrypts the hash stored in the FIP
and recalculates the hash of the image. If they don't match, the boot
sequence won't continue.

A constant-time comparison does not provide additional security as all
the data involved in this process is already known to any attacker.
There is no private data that can leaked through a timing attack when
authenticating an image.

`timingsafe_bcmp()` is kept in the codebase because it could be useful
in the future.

Change-Id: I44bdcd58faa586a050cc89447e38c142508c9888
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-02-16 15:15:23 +00:00
davidcunado-arm 108e4df7f1 Merge pull request #834 from douglas-raillard-arm/dr/use_dc_zva_zeroing
Use DC ZVA instruction to zero memory
2017-02-16 14:49:37 +00:00
dp-arm dae695abf6 Fix minor issues found by cppcheck
cppcheck highlighted variables that were initialized but then later
reassigned.

Change-Id: Ie12742c01fd3bf48b2d6c05a3b448da91d57a2e4
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
2017-02-14 17:00:01 +00:00
Jeenu Viswambharan 69c043b25f Add bounds checking asserts to memmap IO driver
The memmap IO driver doesn't perform bounds check when reading, writing,
or seeking. The onus to vet parameters is on the caller, and this patch
asserts that:

  - non-negative size is specified for for backing memory;

  - valid parameters are passed into the driver for read, write and seek
    operations.

Change-Id: I6518c4065817e640e9e7e39a8a4577655f2680f7
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-02-14 14:23:58 +00:00
Douglas Raillard 32f0d3c6c3 Replace some memset call by zeromem
Replace all use of memset by zeromem when zeroing moderately-sized
structure by applying the following transformation:
memset(x, 0, sizeof(x)) => zeromem(x, sizeof(x))

As the Trusted Firmware is compiled with -ffreestanding, it forbids the
compiler from using __builtin_memset and forces it to generate calls to
the slow memset implementation. Zeromem is a near drop in replacement
for this use case, with a more efficient implementation on both AArch32
and AArch64.

Change-Id: Ia7f3a90e888b96d056881be09f0b4d65b41aa79e
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
2017-02-06 17:01:39 +00:00
Antonio Nino Diaz b621fb503c tbbr: Use constant-time bcmp() to compare hashes
To avoid timing side-channel attacks, it is needed to use a constant
time memory comparison function when comparing hashes. The affected
code only cheks for equality so it isn't needed to use any variant of
memcmp(), bcmp() is enough.

Also, timingsafe_bcmp() is as fast as memcmp() when the two compared
regions are equal, so this change incurrs no performance hit in said
case. In case they are unequal, the boot sequence wouldn't continue as
normal, so performance is not an issue.

Change-Id: I1c7c70ddfa4438e6031c8814411fef79fd3bb4df
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-01-24 14:42:13 +00:00
danh-arm 4abd2225c2 Merge pull request #800 from masahir0y/ifdef
Correct preprocessor conditionals
2017-01-23 16:49:43 +00:00
danh-arm e02be20722 Merge pull request #815 from hzhuang1/dwmmc_v3.9
drivers: add designware emmc driver
2017-01-23 16:47:55 +00:00
Masahiro Yamada 3d8256b2a1 Use #ifdef for IMAGE_BL* instead of #if
One nasty part of ATF is some of boolean macros are always defined
as 1 or 0, and the rest of them are only defined under certain
conditions.

For the former group, "#if FOO" or "#if !FOO" must be used because
"#ifdef FOO" is always true.  (Options passed by $(call add_define,)
are the cases.)

For the latter, "#ifdef FOO" or "#ifndef FOO" should be used because
checking the value of an undefined macro is strange.

Here, IMAGE_BL* is handled by make_helpers/build_macro.mk like
follows:

  $(eval IMAGE := IMAGE_BL$(call uppercase,$(3)))

  $(OBJ): $(2)
          @echo "  CC      $$<"
          $$(Q)$$(CC) $$(TF_CFLAGS) $$(CFLAGS) -D$(IMAGE) -c $$< -o $$@

This means, IMAGE_BL* is defined when building the corresponding
image, but *undefined* for the other images.

So, IMAGE_BL* belongs to the latter group where we should use #ifdef
or #ifndef.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2017-01-24 01:01:21 +09:00
Haojian Zhuang 5dbdb7da1c drivers: add designware emmc driver
Support Designware eMMC driver. It's based on both IO block
and eMMC driver.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
2017-01-23 22:08:45 +08:00
danh-arm 23beccc9f7 Merge pull request #812 from antonio-nino-diaz-arm/an/clear-static-vars
Clear static variables in X509 parser on error
2017-01-23 11:39:17 +00:00
Antonio Nino Diaz 51c5e1a29f Clear static variables in X509 parser on error
In mbedtls_x509_parser.c there are some static arrays that are filled
during the integrity check and then read whenever an authentication
parameter is requested. However, they aren't cleared in case of an
integrity check failure, which can be problematic from a security
point of view. This patch clears these arrays in the case of failure.

Change-Id: I9d48f5bc71fa13e5a75d6c45b5e34796ef13aaa2
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-01-19 09:30:32 +00:00
danh-arm fc17f61251 Merge pull request #790 from masahir0y/utils
add utility macros to utils.h
2017-01-18 10:54:49 +00:00
davidcunado-arm 44f1c0bded Merge pull request #807 from nmenon/upstream/fix-16650-rx
uart: 16550: Fix getc
2017-01-13 17:18:59 +00:00
Masahiro Yamada 152c8c11b7 utils: move BIT(n) macro to utils.h
We are duplicating this macro define, and it is useful enough
to be placed in the common place.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2017-01-13 04:34:24 +09:00
Nishanth Menon 861ac52a7e uart: 16550: Fix getc
tbz check for RDR status is to check for a bit being zero.
Unfortunately, we are using a mask rather than the bit position.

Further as per http://www.ti.com/lit/ds/symlink/pc16550d.pdf (page 17),
LSR register bit 0 is Data ready status (RDR), not bit position 2.

Update the same to match the specification.

Reported-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
2017-01-10 09:36:44 -06:00
Masahiro Yamada a56f87c8b9 TBB: fix comment about MBEDTLS_KEY_ALG default
This comment block says the default algorithm is ESDSA, while the
code obviously sets the default to RSA:

  ifeq (${MBEDTLS_KEY_ALG},)
      MBEDTLS_KEY_ALG            :=      rsa
  endif

The git log of commit 7d37aa1711 ("TBB: add mbedTLS authentication
related libraries") states available options are:

  * 'rsa' (for RSA-2048) (default option)
  * 'ecdsa' (for ECDSA-SECP256R1)

So, my best guess is the comment block is wrong.

The mismatch between the code and the comment is confusing. Fix it.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2017-01-06 16:58:34 +09:00
danh-arm 9acdafbccf Merge pull request #793 from jeenu-arm/gic-changes
GIC driver changes for extended power management
2016-12-20 12:26:23 +00:00
dp-arm d35dee23b6 tbbr: Fix updating of Non-Trusted NV counter
The previous code required that a certificate be signed with the ROT
key before the platform's NV counter could be updated with the value
in the certificate.  This implies that the Non-Trusted NV counter was
not being updated for Non-Trusted content certificates, as they cannot
be signed with the ROT key in the TBBR CoT scheme.

The code is reworked to only allow updating the platform's Trusted NV
counter when a certificate protected by the Trusted NV counter is
signed with the ROT key.

Content certificates protected by the Non-Trusted NV counter are
allowed to update the platform's Non-Trusted NV counter, assuming
that the certificate value is higher than the platform's value.

A new optional platform API has been introduced, named
plat_set_nv_ctr2().  Platforms may choose to implement it and perform
additional checks based on the authentication image descriptor before
modifying the NV counters.  A default weak implementation is available
that just calls into plat_set_nv_ctr().

Fixes ARM-software/tf-issues#426

Change-Id: I4fc978fd28a3007bc0cef972ff1f69ad0413b79c
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
2016-12-15 14:12:35 +00:00
Jeenu Viswambharan d780699b5e GICv3: Introduce power management APIs for Redistributor
Some GICv3 implementations have provision for power management
operations at Redistributor level. This patch introduces and provides
place-holders for Redistributor power management. The default
implementations are empty stubs, but are weakly bound so as to enable
implementation-specific drivers to override them.

Change-Id: I4fec1358693d3603ca5dce242a2f7f0e730516d8
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2016-12-15 14:08:26 +00:00
Yatharth Kochar 69d59e0ce9 AArch32: Miscellaneous fixes in the AArch32 code
This patch makes following miscellaneous fixes:
* pl011_console.S: Fixed the bit mask used to check if the
  transmit FIFO is full or empty.
* smcc_macros.S: Added `_fsxc` suffix while updating the SPSR.
  By default the assembler assumes `_fc` suffix which does not
  update all the fields in SPSR. By adding `_fsxc` suffix all
  the fields gets updated.
* platform_helpers.S: Removed the weak definition for
  `plat_my_core_pos()` as this is a mandatory function which
  needs to be defined by all platforms.

Change-Id: I8302292533c943686fff8d7c749a07132c052a3b
Signed-off-by: Yatharth Kochar <yatharth.kochar@arm.com>
2016-12-01 11:02:51 +00:00
danh-arm 97fa6f57bf Merge pull request #677 from hzhuang1/gpt
partition: check GPT partition table
2016-10-18 16:32:57 +01:00
Haojian Zhuang 201b66b7e7 partition: check GPT partition table
Now only support GPT partition table. MBR partition table isn't
supported yet.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
2016-09-20 13:19:32 +08:00
Yatharth Kochar 6083c841d0 GICv3: Allow either G1S or G0 interrupts to be configured
Currently the GICv3 driver mandates that platform populate
both G1S and G0 interrupts. However, it is possible that a
given platform is not interested in both the groups and
just needs to specify either one of them.

This patch modifies the `gicv3_rdistif_init()` & `gicv3_distif_init()`
functions to allow either G1S or G0 interrupts to be configured.

Fixes ARM-software/tf-issues#400

Change-Id: I43572b0e08ae30bed5af9334f25d35bf439b0d2b
2016-09-12 16:19:08 +01:00
danh-arm 937108a04a Merge pull request #678 from soby-mathew/sm/PSCI_AArch32
Introduce AArch32 support for PSCI library
2016-08-18 11:38:19 +01:00
danh-arm 6700ae65fb Merge pull request #682 from sudeep-holla/gicv3_ns_intr
gicv3: disable Group1 NonSecure interrupts during core powerdown
2016-08-17 12:54:38 +01:00
danh-arm d3ca949f00 Merge pull request #680 from hzhuang1/emmc_cmd23_v2
emmc: support CMD23
2016-08-17 12:54:14 +01:00
Haojian Zhuang 445b1e704e emmc: support CMD23
Support CMD23. When CMD23 is used, CMD12 could be avoided.

Two scenarios:
1. CMD17 for single block, CMD18 + CMD12 for multiple blocks.
2. CMD23 + CMD18 for both single block and multiple blocks.

The emmc_init() should initialize whether CMD23 is supported
or not.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
2016-08-12 11:41:00 +08:00
Sudeep Holla 65d68ca64d gicv3: disable Group1 NonSecure interrupts during core powerdown
As per the GICv3 specification, to power down a processor using GICv3
and allow automatic power-on if an interrupt must be sent to a processor,
software must set Enable to zero for all interrupt groups(by writing to
GICC_CTLR or ICC_IGRPEN{0,1}_EL1/3 as appropriate.

Also, NonSecure EL1 software may not be aware of the CPU power state
details and fail to choose right states that require quiescing the CPU
interface. So it's preferred that the PSCI implementation handles it as
it is fully aware of the CPU power states.

This patch adds disabling of Group1 NonSecure interrupts during processor
power down along with Group0 and Group1 Secure interrupts so that all the
interrupt groups are handled at once as per specification.

Change-Id: Ib564d773c9c4c41f2ca9471451c030e3de75e641
2016-08-11 11:09:35 +01:00
Soby Mathew 66be868e9a AArch32: Add console driver
This patch adds console drivers including the pl011 driver
for the AArch32 mode.

Change-Id: Ifd22520d370fca3e73dbbf6f2d97d6aee65b67dd
2016-08-10 12:35:46 +01:00
Soby Mathew 367d0ffb14 AArch32: Enable GIC and TZC support
This patch modifies GICv3 and TZC drivers to add AArch32 support.
No modifications are required for the GICv2 driver for AArch32 support.
The TZC driver assumes that the secure world is running in Little-Endian
mode to do 64 bit manipulations. Assertions are present to validate the
assumption.

Note: The legacy GICv3 driver is not supported for AArch32.

Change-Id: Id1bc75a9f5dafb9715c9500ca77b4606eb1e2458
2016-08-10 12:35:46 +01:00
Soby Mathew 9c94d3b326 Move console drivers to AArch64 folder
This patch moves the various assembly console drivers
into `aarch64` architecture specific folder. Stub files,
which include files from new location, are retained at the
original location for platform compatibility reasons.

Change-Id: I0069b6c1c0489ca47f5204d4e26e3bc3def533a8
2016-08-09 17:33:57 +01:00
Haojian Zhuang 9d063aa2e8 io: block: fix unaligned buffer
If buffer address parameter isn't aligned, it may cause
DMA issue in block device driver, as eMMC. Now check the buffer
address. If it's not aligned, use temporary buffer in io block
driver instead.

Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
2016-08-04 09:53:29 +08:00
Soby Mathew 61e3027719 GICv3: Fix the GICD_IROUTER offset
This patch fixes the offset of GICD_IROUTER register defined in gicv3.h.
Although the GICv3 documention mentions that the offset for this register
is 0x6100-0x7FD8, the offset calculation for an interrupt id `n` is :

   0x6000 + 8n, where n >= 32

This requires the offset for GICD_IROUTER to be defined as 0x6000.

Fixes ARM-software/tf-issues#410

Change-Id: If9e91e30d946afe7f1f60fea4f065c7567093fa8
2016-07-27 10:46:09 +01:00
Soby Mathew 4c0d039076 Rework type usage in Trusted Firmware
This patch reworks type usage in generic code, drivers and ARM platform files
to make it more portable. The major changes done with respect to
type usage are as listed below:

* Use uintptr_t for storing address instead of uint64_t or unsigned long.
* Review usage of unsigned long as it can no longer be assumed to be 64 bit.
* Use u_register_t for register values whose width varies depending on
  whether AArch64 or AArch32.
* Use generic C types where-ever possible.

In addition to the above changes, this patch also modifies format specifiers
in print invocations so that they are AArch64/AArch32 agnostic. Only files
related to upcoming feature development have been reworked.

Change-Id: I9f8c78347c5a52ba7027ff389791f1dad63ee5f8
2016-07-18 17:52:15 +01:00
Soby Mathew 47c6876a49 GIC: Ensure SGIs and PPIs are Group0 before setup
The legacy GIC driver assumes that the SGIs and PPIs are Group0 during
initialization. This is true if the driver is the first one to initialize
the GIC hardware after reset. But in some cases, earlier BL stages could
have already initialized the GIC hardware which means that SGI and PPI
configuration are not the expected reset values causing assertion failure
in `gicd_set_ipriorityr()`. This patch explicitly resets the SGI and PPI
to Group0 prior to their initialization in the driver. The same patch is
not done in the GICv2-only driver because unlike in the legacy driver,
`gicd_set_ipriorityr()` of GICv2 driver doesn't enforce this policy and
the appropriate group is set irrespective of the initial value.

Fixes ARM-software/tf-issues#396

Change-Id: I521d35caa37470ce542c796c2ba99716e4763105
2016-07-07 11:59:33 +01:00
danh-arm f9455cea8c Merge pull request #629 from ljerry/tf_issue_398
Bring IO storage dummy driver
2016-06-13 13:50:58 +01:00
Soby Mathew 04943d33cf Allow dynamic overriding of ROTPK verification
A production ROM with TBB enabled must have the ability to boot test software
before a real ROTPK is deployed (e.g. manufacturing mode). Previously the
function plat_get_rotpk_info() must return a valid ROTPK for TBB to succeed.
This patch adds an additional bit `ROTPK_NOT_DEPLOYED` in the output `flags`
parameter from plat_get_rotpk_info(). If this bit is set, then the ROTPK
in certificate is used without verifying against the platform value.

Fixes ARM-software/tf-issues#381

Change-Id: Icbbffab6bff8ed76b72431ee21337f550d8fdbbb
2016-06-03 18:27:36 +01:00
danh-arm a7e530331d Merge pull request #632 from rockchip-linux/support-for-gpio-driver-v2
rockchip/rk3399: Support the gpio driver and configure
2016-05-27 14:10:42 +01:00
Caesar Wang 195889829e gpio: support gpio set/get pull status
On some platform gpio can set/get pull status when input, add these
function so we can set/get gpio pull status when need it. And they are
optional function.
2016-05-27 09:39:56 +08:00
Soby Mathew 6331a31a66 CCN: Add API to query the PART0 ID from CCN
This patch adds the API `ccn_get_part0_id` to query the PART0 ID from the
PERIPHERAL_ID 0 register in the CCN driver. This ID allows to distinguish
the variant of CCN present on the system and possibly enable dynamic
configuration of the IP based on the variant. Also added an assert in
`ccn_master_to_rn_id_map()` to ensure that the master map bitfield provided
by the platform is within the expected interface id.

Change-Id: I92d2db7bd93a9be8a7fbe72a522cbcba0aba2d0e
2016-05-25 10:24:23 +01:00