Soby Mathew [Fri, 10 Nov 2017 12:08:46 +0000 (12:08 +0000)]
Allow API deprecation for uniphier platform
The `override ERROR_DEPRECATION = 1` setting in uniphier platform
makes deprecation of API difficult. Hence removing the same. This
flag should be specified on the command line if needed.
Julius Werner [Tue, 13 Jun 2017 22:53:45 +0000 (15:53 -0700)]
coreboot: Add support for CBMEM console
coreboot supports an in-memory console to store firmware logs even when
no serial console is available. It is widely supported by
coreboot-compatible bootloaders (including SeaBIOS and GRUB) and can be
read by the Linux kernel.
This patch allows BL31 to add its own log messages to this console. The
driver will be registered automatically if coreboot support is compiled
in and detects the presence of a console buffer in the coreboot tables.
Change-Id: I31254dfa0c2fdeb7454634134b5707b4b4154907 Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Wed, 2 Aug 2017 23:31:04 +0000 (16:31 -0700)]
rockchip: Move to MULTI_CONSOLE_API
This patch changes all Rockchip platforms to use the new
MULTI_CONSOLE_API. The platform-specific plat_crash_console
implementations are removed so that the platform can use the ones from
the common platform code instead.
Also change the registers used in plat_crash_print_regs. The existing
use of x16 and x17 has always been illegal, since those registers are
reserved for use by the linker as a temporary scratch registers in
intra-procedure-call veneers and can never be expected to maintain their
values across a function call.
Change-Id: I8249424150be8d5543ed4af93b56756795a5288f Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Fri, 9 Jun 2017 22:22:44 +0000 (15:22 -0700)]
rockchip: Use coreboot-supplied serial console on coreboot systems
This patch changes all Rockchip platforms to initialize the serial
console with information supplied by coreboot rather than hardcoded
base address and divisor values if BL31 is run on top of coreboot.
Moving the BL2-to-BL31 parameter parsing as early as possible to ensure
that the console is available for all following code.
Also update the Rockchip platform to use MULTI_CONSOLE_API.
Change-Id: I670d350fa2f8b8133539f91ac14977ab47db60d9 Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Fri, 9 Jun 2017 22:17:15 +0000 (15:17 -0700)]
Add platform-independent coreboot support library
This patch adds the foundation for a platform-independent coreboot
support library that can be shared by all platforms that boot BL31 from
coreboot (acting as BL2). It adds code to parse the "coreboot table", a
data structure that coreboot uses to communicate different kinds of
information to later-stage firmware and certain OS drivers.
As a first small use case for this information, allow platforms to
access the serial console configuration used by coreboot, removing the
need to hardcode base address and divisors and allowing Trusted Firmware
to benefit from coreboot's user configuration (e.g. which UART to pick
and which baud rate to use).
Change-Id: I2bfb39cd2609ce6640b844ab68df6c9ae3f28e9e Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Tue, 19 Sep 2017 00:01:06 +0000 (17:01 -0700)]
drivers: cadence: cdns: Update CDNS driver to support MULTI_CONSOLE_API
This patch updates the Cadence CDNS console driver to support the new
console API. The driver will continue to support the old API as well by
checking the MULTI_CONSOLE_API compile-time flag.
Change-Id: I2ef8fb0d6ab72696997db1e0243a533499569d6b Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Mon, 18 Sep 2017 23:59:43 +0000 (16:59 -0700)]
drivers: arm: pl011: Update PL011 driver to support MULTI_CONSOLE_API
This patch updates the ARM PL011 console driver to support the new
console API. The driver will continue to support the old API as well by
checking the MULTI_CONSOLE_API compile-time flag.
Change-Id: Ic34e4158addbb0c5fae500c9cff899c05a4f4206 Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Mon, 18 Sep 2017 23:57:51 +0000 (16:57 -0700)]
drivers: ti: uart: Update 16550 UART driver to support MULTI_CONSOLE_API
This patch updates the TI 16550 console driver to support the new
console API. The driver will continue to support the old API as well by
checking the MULTI_CONSOLE_API compile-time flag.
Change-Id: I60a44b7ba3c35c74561824c04b8dbe3e3039324c Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Mon, 18 Sep 2017 23:49:48 +0000 (16:49 -0700)]
Add default crash console code to hook up to new console API
This patch expands the weak stubs for the plat_crash_console_xxx
functions in common platform code to use the new console API for crash
output. This should make crash console output "just work" for most cases
without the need for the platform to explicitly set up a crash console.
For cases where the normal console framework doesn't work (e.g. very
early crashes, before the platform can register any consoles), platforms
are still able to override the functions just like before.
This feature requires the MULTI_CONSOLE_API compile-time flag to work.
For builds which don't have it set, this patch has no practical effect.
Change-Id: I80dd161cb43f9db59a0bad2dae33c6560cfac584 Signed-off-by: Julius Werner <jwerner@chromium.org>
Manoj Kumar [Fri, 19 Jan 2018 12:21:31 +0000 (17:51 +0530)]
lib/cpus: fix branching in reset function for cortex-a72 AARCH32 mode
In AARCH32 mode, cortex_a72_reset_func branches to address in lr
register instead of r5 register. This leads to linux boot failure
of Cortex-A72 cores in AARCH32 mode on Juno-R2 board.
This patch fixes the branching of cortex_a72_reset_func to r5
register as in cortex_a57_reset_func implementation.
Roberto Vargas [Tue, 16 Jan 2018 10:35:23 +0000 (10:35 +0000)]
bl2-el3: Don't compile BL1 when BL2_AT_EL3 is defined in FVP
This patch modifies the makefiles to avoid the definition
of BL1_SOURCES and BL2_SOURCES in the tbbr makefiles, and
it lets to the platform makefiles to define them if they
actually need these images. In the case of BL2_AT_EL3
BL1 will not be needed usually because the Boot ROM will
jump directly to BL2.
Roberto Vargas [Tue, 2 Jan 2018 11:23:41 +0000 (11:23 +0000)]
bl2-el3: Don't include BL2 in fip for BL2 at EL3
It is better to not include BL2 in FIP when using `BL2 at EL3` as
platforms using this config would not have the capability to parse the
FIP format in Boot ROM and BL2 needs to be loaded independently. This
patch does the required changes for the same.
Roberto Vargas [Mon, 20 Nov 2017 13:36:10 +0000 (13:36 +0000)]
bl2-el3: Add documentation for BL2 at EL3
Update firmware-design.rst, porting-guide.rst and user-guide.rst
with the information about BL2 at EL3. Firmware-design.rst is
also update to explain how to test this feauture with FVP.
Roberto Vargas [Fri, 17 Nov 2017 10:51:54 +0000 (10:51 +0000)]
bl2-el3: Mark all the assembly functions in bl2 at el3
When BL2_AT_EL3 option is enabled some platforms are going to
need a resident part in BL2 because the boot rom may jump to it
after a reset. This patch introduces __TEXT_RESIDENT_START__ and
__TEXT_RESIDENT_END__ linker symbols that mark the resident region.
Roberto Vargas [Thu, 2 Nov 2017 16:36:51 +0000 (16:36 +0000)]
Mark functions defined in assembly files
This patch change the name of the section containing the functions
defined in assembly files from text.* to text.asm.*. This change
makes possible to select in the linker script the functions
defined in those files.
Roberto Vargas [Fri, 17 Nov 2017 13:22:18 +0000 (13:22 +0000)]
bl2-el3: Add BL2 at EL3 support in FVP
This patch add supports for the new API added for BL2 at EL3 for
FVP. We don't have a non-TF Boot ROM for FVP, but this option can be
tested setting specific parameters in the model.
The bl2 image is loaded directly in memory instead of being loaded
by a non-TF Boot ROM and the reset address is changed:
These parameters mean that in the cold boot path the processor will
jump to BL2 again. For this reason, BL2 is loaded in dram in this
case, to avoid other images reclaiming BL2 memory.
Roberto Vargas [Mon, 30 Oct 2017 14:43:43 +0000 (14:43 +0000)]
bl2-el3: Add BL2_EL3 image
This patch enables BL2 to execute at the highest exception level
without any dependancy on TF BL1. This enables platforms which already
have a non-TF Boot ROM to directly load and execute BL2 and subsequent BL
stages without need for BL1. This is not currently possible because
BL2 executes at S-EL1 and cannot jump straight to EL3.
Leo Yan [Thu, 4 Jan 2018 01:32:50 +0000 (09:32 +0800)]
Hikey960: Change CPU standby state for WFI
At early time, the CPU CA73 retention state has been supported on
Hikey960. Later we found the system has the hang issue and for
resolving this issue Hisilicon released new MCU firmware, but
unfortunately the new MCU firmware has side effect and results in the
CA73 CPU cannot really enter retention state and roll back to WFI state.
After discussion we cannot see the possibility to enable CA73 retention
state anymore on Hikey960, based on this conclusion we should remove
this state supporting from ARM-TF and roll back to WFI state only. We
will commit one patch to remove CA73 CPU retention state in kernel DT
binding as well.
Cc: Daniel Lezcano <daniel.lezcano@linaro.org> Cc: Haojian Zhuang <haojian.zhuang@linaro.org> Cc: Kevin Wang <jean.wangtao@linaro.org> Cc: Vincent Guittot <vincent.guittot@linaro.org> Signed-off-by: Leo Yan <leo.yan@linaro.org>
The commit fdae60b6ba27c216fd86d13b7432a1ff4f57dd84 changed the
parameter encoding for the hikey960. However that implies a DT change
in the kernel side. After submitting the DT change for upstreaming,
the backward compatibility issue and the interface change raise some
concerns from the Linux community about the issues related to kernel <->
ATF alignment. There is no way to detect a mis-alignment of those
without a deep knowledge of the ATF and the kernel. Furthermore, the
failing calls to PSCI in the idle path (because of bad parameters), will
lead to busy looping, implying: thermal issues and extra energy
consumption.
In regard of the Linux community concerns, the potential issues when the
ATF and the kernel are not aligned, it is preferable to revert the
commit.
Cc: Vincent Guittot <vincent.guittot@linaro.org> Cc: Haojian Zhuang <haojian.zhuang@linaro.org> Cc: Kevin Wang <jean.wangtao@linaro.org> Co-authored-by: Daniel Lezcano <daniel.lezcano@linaro.org> Signed-off-by: Leo Yan <leo.yan@linaro.org>
If AMU is not supported by the hardware but it is enabled in Trusted
Firmware, the console will be spammed with warnings every time a CPU
is brought up with a CPU ON call.
Remove the warning message as this is more in line with how other
extensions like SPE and SVE are handled.
On some systems, the AMU counters might reset to 0 when a CPU
powerdown happens. This behaviour conflicts with the intended
use-case of AMU as lower ELs are only expected to see non-decreasing
counter values.
Add some AMU helper functions to allow configuring, reading and
writing of the Group 0 and Group 1 counters. Documentation for these
helpers will come in a separate patch.
AMU: Add plat interface to select which group 1 counters to enable
A new platform macro `PLAT_AMU_GROUP1_COUNTERS_MASK` controls which
group 1 counters should be enabled. The maximum number of group 1
counters supported by AMUv1 is 16 so the mask can be at most 0xffff.
If the platform does not define this mask, no group 1 counters are
enabled.
A related platform macro `PLAT_AMU_GROUP1_NR_COUNTERS` is used by
generic code to allocate an array to save and restore the counters on
CPU suspend.
Use PFR0 to identify need for mitigation of CVE-2017-5915
If the CSV2 field reads as 1 then branch targets trained in one
context cannot affect speculative execution in a different context.
In that case skip the workaround on Cortex A75.
Workaround for CVE-2017-5715 on Cortex A73 and A75
Invalidate the Branch Target Buffer (BTB) on entry to EL3 by
temporarily dropping into AArch32 Secure-EL1 and executing the
`BPIALL` instruction.
This is achieved by using 3 vector tables. There is the runtime
vector table which is used to handle exceptions and 2 additional
tables which are required to implement this workaround. The
additional tables are `vbar0` and `vbar1`.
The sequence of events for handling a single exception is
as follows:
1) Install vector table `vbar0` which saves the CPU context on entry
to EL3 and sets up the Secure-EL1 context to execute in AArch32 mode
with the MMU disabled and I$ enabled. This is the default vector table.
2) Before doing an ERET into Secure-EL1, switch vbar to point to
another vector table `vbar1`. This is required to restore EL3 state
when returning from the workaround, before proceeding with normal EL3
exception handling.
3) While in Secure-EL1, the `BPIALL` instruction is executed and an
SMC call back to EL3 is performed.
4) On entry to EL3 from Secure-EL1, the saved context from step 1) is
restored. The vbar is switched to point to `vbar0` in preparation to
handle further exceptions. Finally a branch to the runtime vector
table entry is taken to complete the handling of the original
exception.
This workaround is enabled by default on the affected CPUs.
NOTE
====
There are 4 different stubs in Secure-EL1. Each stub corresponds to
an exception type such as Sync/IRQ/FIQ/SError. Each stub will move a
different value in `R0` before doing an SMC call back into EL3.
Without this piece of information it would not be possible to know
what the original exception type was as we cannot use `ESR_EL3` to
distinguish between IRQs and FIQs.
Workaround for CVE-2017-5715 on Cortex A57 and A72
Invalidate the Branch Target Buffer (BTB) on entry to EL3 by disabling
and enabling the MMU. To achieve this without performing any branch
instruction, a per-cpu vbar is installed which executes the workaround
and then branches off to the corresponding vector entry in the main
vector table. A side effect of this change is that the main vbar is
configured before any reset handling. This is to allow the per-cpu
reset function to override the vbar setting.
This workaround is enabled by default on the affected CPUs.
`mm_cursor` doesn't have the needed data because the `memmove()` that
is called right before it overwrites that information. In order to get
the information of the region that was being mapped, `mm` has to be used
instead (like it is done to fill the fields of `unmap_mm`).
If the incorrect information is read, this check isn't reliable and
`xlat_tables_unmap_region` may be requested to unmap memory that isn't
mapped at all, triggering assertions.
Change-Id: I602d4ac83095d4e5dac9deb34aa5d00d00e6c289 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Roberto Vargas [Tue, 12 Dec 2017 10:39:44 +0000 (10:39 +0000)]
Add documentation about plat_try_next_boot_source to bl1_platform_setup
If boot redundancy is required in BL1 then the initialization
of the boot sequence must be done in bl1_platform_setup. In BL2,
we had to add a new function, bl2_preload_setup, because
bl2_platform_setup is called after the images are loaded, making it
invalid for the boot sequence initialization.
Wendy Liang [Wed, 4 Oct 2017 06:21:11 +0000 (23:21 -0700)]
zynqmp: pm_service: use zynqmp_ipi APIs
Use zynqmp_ipi APIs to access IPI registers in pm_service.
As the zynqmp_ipi APIs doesn't cover IPI buffers, the pm_ipi
in pm_service will still directly access the IPI buffers.
Previously, ZynqMP IPI in ATF is only for ZynqMP PM,
This patch is to have a ZynqMP IPI implementation to handle
both ZynqMP PM IPI requirement and IPI mailbox service requirement
which will be introduced next.
We control IPI agents registers access but not IPI buffers access in
this implementation. Each IPI mailbox user will directly access the
IPI buffers.
SPM: Allow secondary CPUs to use the Secure Partition
The Secure Partition should be able to be used from any CPU, not just
the lead one. This patch point the secure contexts of all secondary
CPUs to the same one used by the lead CPU for the Secure Partition. This
way, they can also use it.
In order to prevent more than one CPU from using the Secure Partition at
the same time, a lock has been added.
Change-Id: Ica76373127c3626498b06c558a4874ce72201ff7 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Whether a Secure Partition is being initialized or not is something
related to that specific partition, so it should be saved with the
rest of the information related to it.
Change-Id: Ie8a780f70df83fb03ef9c01ba37960208d9b5319 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Masahiro Yamada [Thu, 4 Jan 2018 03:59:11 +0000 (12:59 +0900)]
uniphier: simplify GZIP compress rule
It is not necessary to read data from stdin. The input file name
is ripped off by -n option, anyway. I still use the redirect for
the output to specify the output file name.
Masahiro Yamada [Sat, 23 Dec 2017 14:56:18 +0000 (23:56 +0900)]
Build: update comment lines for macros
Commit 8f0617ef9e46 ("Apply TBBR naming convention to the fip_create
options") changed fiptool command options. We often forget to update
documentation.
Masahiro Yamada [Tue, 19 Dec 2017 13:30:24 +0000 (22:30 +0900)]
doc: uniphier: reformat reStructuredText manually
Commit 6f6257476754 ("Convert documentation to reStructuredText")
automatically converted all documents by a tool. I see some parts
were converted in an ugly way (or, at least, it is not my intention).
Also, the footnote is apparently broken.
I checked this document by my eyes, and reformated it so that it looks
nicer both in plain text and reST form.
ARM platforms: Allow platforms to define SDEI events
With this patch, ARM platforms are expected to define the macros
PLAT_ARM_SDEI_PRIVATE_EVENTS and PLAT_ARM_SDEI_SHARED_EVENTS as a list
of private and shared events, respectively. This allows for individual
platforms to define their own events.
Roberto Vargas [Thu, 23 Nov 2017 12:03:46 +0000 (12:03 +0000)]
io: block: fix block_read/write may read/write overlap buffer
The block operations were trying to optimize the number of memory
copies, and it tried to use directly the buffer supplied by the user
to them. This was a mistake because it created too many corner cases:
1- It was possible to generate unaligned
operations to unaligned buffers. Drivers that were using
DMA transfer failed in that case.
2- It was possible to generate read operations
with sizes that weren't a multiple of the block size. Some
low level drivers assumed that condition and they calculated
the number of blocks dividing the number of bytes by the
size of the block, without considering the remaining bytes.
3- The block_* operations didn't control the
number of bytes actually copied to memory, because the
low level drivers were writing directly to the user buffer.
This patch rewrite block_read and block_write to use always the device
buffer, which the platform ensures that has the correct aligment and
the correct size.
Julius Werner [Tue, 1 Aug 2017 01:15:11 +0000 (18:15 -0700)]
Add new function-pointer-based console API
This patch overhauls the console API to allow for multiple console
instances of different drivers that are active at the same time. Instead
of binding to well-known function names (like console_core_init),
consoles now provide a register function (e.g. console_16550_register())
that will hook them into the list of active consoles. All console
operations will be dispatched to all consoles currently in the list.
The new API will be selected by the build-time option MULTI_CONSOLE_API,
which defaults to ${ERROR_DEPRECATED} for now. The old console API code
will be retained to stay backwards-compatible to older platforms, but
should no longer be used for any newly added platforms and can hopefully
be removed at some point in the future.
The new console API is intended to be used for both normal (bootup) and
crash use cases, freeing platforms of the need to set up the crash
console separately. Consoles can be individually configured to be active
active at boot (until first handoff to EL2), at runtime (after first
handoff to EL2), and/or after a crash. Console drivers should set a sane
default upon registration that can be overridden with the
console_set_scope() call. Code to hook up the crash reporting mechanism
to this framework will be added with a later patch.
This patch only affects AArch64, but the new API could easily be ported
to AArch32 as well if desired.
Change-Id: I35c5aa2cb3f719cfddd15565eb13c7cde4162549 Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Tue, 20 Jun 2017 00:05:30 +0000 (17:05 -0700)]
rockchip: Implement a panic handler that will reboot the system
The current Rockchip platform code retains the "common" default panic
handler which simply hangs the system (until the watchdog kicks in, if
enabled). This is usually not a great user experience.
This patch implements a Rockchip-specific panic handler that calls the
platform's reboot implementation to reset the system.
Change-Id: I4cbe09c48f1b3f86ebdfc0108c186565f9ffc119 Signed-off-by: Julius Werner <jwerner@chromium.org>
Julius Werner [Tue, 12 Dec 2017 22:23:26 +0000 (14:23 -0800)]
utils_def: Add REGSZ and make BIT() assembly-compatible
In assembly code it can be useful to have a constant for the width of a
register in the current architecture, so this patch adds one to
<utils_def.h> and replaces the existing custom one in crash_reporting.S
with that. It also fixes up the BIT() macro in the same file so that it
can be safely used in assembly code.
Change-Id: I10513a311f3379e767396e6ddfbae8d2d8201464 Signed-off-by: Julius Werner <jwerner@chromium.org>
This partially reverts commit d6b532b50f8, keeping only the fixes to
the assertions. The changes related to the order of arguments passed
to the secure partition were not correct and violated the
specification of the SP_EVENT_COMPLETE SMC.
This patch also improves the MM_COMMUNICATE argument validation. The
cookie argument, as it comes from normal world, can't be trusted and thus
needs to always be validated at run time rather than using an assertion.
Also validate the communication buffer address and return
INVALID_PARAMETER if it is zero, as per the MM specification.
Fix a few typos in comments and use the "secure partition" terminology
rather than "secure payload".
projects / arm-tf.git / log