summaryrefslogtreecommitdiff
path: root/services
AgeCommit message (Collapse)Author
2018-06-21Merge pull request #1397 from dp-arm/dp/cortex-a76Dimitris Papastamos
Add support for Cortex-A76 and Cortex-Ares
2018-06-21Merge pull request #1392 from dp-arm/dp/cve_2018_3639Dimitris Papastamos
Implement workaround for CVE-2018-3639 on Cortex A57/A72/A73 and A75 Conflicts: services/arm_arch_svc/arm_arch_svc_setup.c
2018-03-14Fixup `SMCCC_ARCH_FEATURES` semanticsDimitris Papastamos
When querying `SMCCC_ARCH_WORKAROUND_1` through `SMCCC_ARCH_FEATURES`, return either: * -1 to indicate the PE on which `SMCCC_ARCH_FEATURES` is called requires firmware mitigation for CVE-2017-5715 but the mitigation is not compiled in. * 0 to indicate that firmware mitigation is required, or * 1 to indicate that no firmware mitigation is required. This patch complies with v1.2 of the firmware interfaces specification (ARM DEN 0070A). Change-Id: Ibc32d6620efdac6c340758ec502d95554a55f02a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-03-07Merge pull request #1239 from arve-android/trusty-fixesdavidcunado-arm
Trusty fixes
2018-03-02trusty: Fix another reported misra violationArve Hjønnevåg
Change-Id: I822ccf5852dce4c01f98382cc393331f29e1e256
2018-03-01trusty: Fix reported misra violationArve Hjønnevåg
memset does not return a useful result here, so explitcitly ignore it Change-Id: I33cd2228cadc280ee8e5ce3a4f8682dde9a7c16c
2018-02-28trusty: Fix reported static check errorsArve Hjønnevåg
Change-Id: I9f9a8a159b41be1c865a20801d03a1b2934c3cac
2018-02-28trusty: Change type of aarch32 flag t boolArve Hjønnevåg
Change-Id: Ie4f937808d24c9b45066c6582c4eee61699ef6df
2018-02-28Merge pull request #1282 from robertovargas-arm/misra-changesdavidcunado-arm
Misra changes
2018-02-28Fix MISRA rule 8.4 in common codeRoberto Vargas
Rule 8.4: A compatible declaration shall be visible when an object or function with external linkage is defined. Change-Id: I26e042cb251a6f9590afa1340fdac73e42f23979 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-02-28Merge pull request #1284 from jeenu-arm/tspd-ehfdavidcunado-arm
TSPD and EHF
2018-02-27TSPD: Register preempted SMC error code with EHFJeenu Viswambharan
An earlier patch extended ehf_allow_ns_preemption() API to also register an error code to offer to Non-secure when a Yielding SMC is preempted by SDEI interrupt. In TSPD's case, register the error code TSP_PREEMPTED. Change-Id: I31992b6651f80694e83bc5092b044ef7a3eda690 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-02-27SDEI: Pop dispatch context only after error checkingJeenu Viswambharan
Currently, when the client attempts to do SDEI_EVENT_COMPLETE or SDEI_EVENT_COMPLETE_AND_RESUME, the dispatcher pops off the outstanding dispatch context for sanity check. There are however other checks following this, which could potentially return failure. If that happens, by popping the context, the dispatcher has inadvertently discarded a valid context. This patch fixes this bug by inspecting (not actually popping) the outstanding context. The context is popped only after all error checks are completed. Change-Id: Ie199f6442f871a8177a8247a0c646543bad76d21 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-02-21tegra/trusty: Setup tegra specific trusty args in platform codeArve Hjønnevåg
Fixes tegra build with SPD=trusty. Not tested. Change-Id: I851a2b00b8b1cc65112b6088980a811d8eda1a99
2018-02-21Ensure the correct execution of TLBI instructionsAntonio Nino Diaz
After executing a TLBI a DSB is needed to ensure completion of the TLBI. rk3328: The MMU is allowed to load TLB entries for as long as it is enabled. Because of this, the correct place to execute a TLBI is right after disabling the MMU. Change-Id: I8280f248d10b49a8c354a4ccbdc8f8345ac4c170 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-02-14Remove URLs from commentsAntonio Nino Diaz
This fixes all defects according to MISRA Rule 3.1: "The character sequences /* and // shall not be used within a comment". This affects all URLs in comments, so they have been removed: - The link in `sdei_state.c` can also be found in the documentation file `docs/sdei.rst`. - The bug that the file `io_fip.c` talks about doesn't affect the currently supported version of GCC, so it doesn't make sense to keep the comment. Note that the version of GCC officially supported is the one that comes with Linaro Release 17.10, which is GCC 6.2. - The link in `tzc400.c` was broken, and it didn't correctly direct to the Technical Reference Manual it should. The link has been replaced by the title of the document, which is more convenient when looking for the document. Change-Id: I89f60c25f635fd4c008a5d3a14028f814c147bbe Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-02-06TSPD: Require NS preemption along with EL3 exception handlingJeenu Viswambharan
At present, the build option TSP_NS_INTR_ASYNC_PREEMPT controls how Non-secure interrupt affects TSPs execution. When TSP is executing: 1. When TSP_NS_INTR_ASYNC_PREEMPT=0, Non-secure interrupts are received at the TSP's exception vector, and TSP voluntarily preempts itself. 2. When TSP_NS_INTR_ASYNC_PREEMPT=1, Non-secure interrupts causes a trap to EL3, which preempts TSP execution. When EL3 exception handling is in place (i.e., EL3_EXCEPTION_HANDLING=1), FIQs are always trapped to EL3. On a system with GICv3, pending NS interrupts while TSP is executing will be signalled as FIQ (which traps to EL3). This situation necessitates the same treatment applied to case (2) above. Therefore, when EL3 exception handling is in place, additionally require that TSP_NS_INTR_ASYNC_PREEMPT is set to one 1. Strictly speaking, this is not required on a system with GICv2, but the same model is uniformly followed regardless, for simplicity. Relevant documentation updated. Change-Id: I928a8ed081fb0ac96e8b1dfe9375c98384da1ccd Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-02-06TSPD: Explicitly allow NS preemption for Yielding SMCsJeenu Viswambharan
When EL3 exception handling is in effect (i.e., EL3_EXCEPTION_HANDLING=1), Non-secure interrupts can't preempt Secure execution. However, for yielding SMCs, preemption by Non-secure interupts is intended. This patch therefore adds a call to ehf_allow_ns_preemption() before dispatching a Yielding SMC to TSP. Change-Id: Ia3a1ae252f3adc0f14e6d7e0502f251bdb349bdf Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-02-01trusty: generic-arm64-smcall: Use SPDX license identifiersArve Hjønnevåg
Signed-off-by: Arve Hjønnevåg <arve@android.com>
2018-01-29Implement support for SMCCC v1.1Dimitris Papastamos
SMCCC v1.1 comes with a relaxed calling convention for AArch64 callers. The caller only needs to save x0-x3 before doing an SMC call. This patch adds support for SMCCC_VERSION and SMCCC_ARCH_FEATURES. Refer to "Firmware Interfaces for mitigating CVE_2017_5715 System Software on Arm Systems"[0] for more information. [0] https://developer.arm.com/-/media/developer/pdf/ARM%20DEN%200070A%20Firmware%20interfaces%20for%20mitigating%20CVE-2017-5715_V1.0.pdf Change-Id: If5b1c55c17d6c5c7cb9c2c3ed355d3a91cdad0a9 Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-01-24trusty: Pass cpu suspend/resume reason to trustyArve Hjønnevåg
Add off/on argument to SMC_FC_CPU_SUSPEND SMC_FC_CPU_RESUME and pass 1 when called from the cpu on/off hooks. Change-Id: Ie233c446fd38b3ff8546e445a8d86a15d2816093 Signed-off-by: Arve Hjønnevåg <arve@android.com>
2018-01-24trusty: Run bl33 in EL1 instead of EL2 is trusty image is 32-bitArve Hjønnevåg
The secure physical timer is inacessible from 32-bit S-EL1 (when EL3 is 64-bit) so trusty will use the non-secure physical timer in this case. Linux will use the virtual timer instead of the physical timer when started in EL1. Change-Id: Ie49348d9a27e5287676dd4a77f678ecbd6c2309f Signed-off-by: Arve Hjønnevåg <arve@android.com>
2018-01-24trusty: Add fpu/simd supportArve Hjønnevåg
The original patch has been partly merged. This adds the missing pieces. Change-Id: I77fd434feab396ff05d9b8e0c1761e4dd588a701 Signed-off-by: Arve Hjønnevåg <arve@android.com>
2018-01-24trusty: Add generic-arm64 supportArve Hjønnevåg
Add smc calls to return gic base address and print to the debug console. Allows running a generic trusty binary. Change-Id: I4b6540f140f11432cdff43c3f5a2097df09dc9d1 Signed-off-by: Arve Hjønnevåg <arve@android.com>
2018-01-24trusty: Restore working trusty setup code and include trusty image in buildArve Hjønnevåg
Change-Id: I081901e7df22f78dd9c4fc4c6bfad2aceb870a2d Signed-off-by: Arve Hjønnevåg <arve@android.com>
2018-01-16Merge pull request #1219 from antonio-nino-diaz-arm/an/mm-versiondavidcunado-arm
SPM: Fix version header definitions
2018-01-10SPM: Fix version header definitionsAntonio Nino Diaz
Rename SP_VERSION macros to MM_VERSION, which is the name used in the MM specification [1]. Also, a few more helper macros have been added. MM-specific definitions have been moved to their own header file. [1] http://infocenter.arm.com/help/topic/com.arm.doc.den0060a/DEN0060A_ARM_MM_Interface_Specification.pdf Change-Id: Ia10e48c7e81a7a1f5eeca29a5270cae740a4a88a Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-01-08spd: tlkd: support for "NS memory ranges" function IDVarun Wadekar
This patch adds support to receive function ID with NS world's memory ranges to provide the memory snapshot to TLK. Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
2018-01-08SPM: Allow secondary CPUs to use the Secure PartitionAntonio Nino Diaz
The Secure Partition should be able to be used from any CPU, not just the lead one. This patch point the secure contexts of all secondary CPUs to the same one used by the lead CPU for the Secure Partition. This way, they can also use it. In order to prevent more than one CPU from using the Secure Partition at the same time, a lock has been added. Change-Id: Ica76373127c3626498b06c558a4874ce72201ff7 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-01-08SPM: Move initialization flag to context structAntonio Nino Diaz
Whether a Secure Partition is being initialized or not is something related to that specific partition, so it should be saved with the rest of the information related to it. Change-Id: Ie8a780f70df83fb03ef9c01ba37960208d9b5319 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-12-12SPM: Fix MM_COMMUNICATE_AARCH32/64 parametersSandrine Bailleux
This partially reverts commit d6b532b50f8, keeping only the fixes to the assertions. The changes related to the order of arguments passed to the secure partition were not correct and violated the specification of the SP_EVENT_COMPLETE SMC. This patch also improves the MM_COMMUNICATE argument validation. The cookie argument, as it comes from normal world, can't be trusted and thus needs to always be validated at run time rather than using an assertion. Also validate the communication buffer address and return INVALID_PARAMETER if it is zero, as per the MM specification. Fix a few typos in comments and use the "secure partition" terminology rather than "secure payload". Change-Id: Ice6b7b5494b729dd44611f9a93d362c55ab244f7 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
2017-12-10Merge pull request #1187 from antonio-nino-diaz-arm/an/spm-xlat-dramdavidcunado-arm
SPM: Move S-EL1/S-EL0 xlat tables to TZC DRAM
2017-12-09Merge pull request #1184 from antonio-nino-diaz-arm/an/bl31-in-dramdavidcunado-arm
fvp: Disable SYSTEM_SUSPEND when ARM_BL31_IN_DRAM
2017-12-09Merge pull request #1183 from jeenu-arm/sdei-reset-fixdavidcunado-arm
SDEI: Fix return value of reset calls
2017-12-06SPM: Move S-EL1/S-EL0 xlat tables to TZC DRAMAntonio Nino Diaz
A new platform define, `PLAT_SP_IMAGE_XLAT_SECTION_NAME`, has been introduced to select the section where the translation tables used by the S-EL1/S-EL0 are placed. This define has been used to move the translation tables to DRAM secured by TrustZone. Most of the extra needed space in BL31 when SPM is enabled is due to the large size of the translation tables. By moving them to this memory region we can save 44 KiB. A new argument has been added to REGISTER_XLAT_CONTEXT2() to specify the region where the translation tables have to be placed by the linker. Change-Id: Ia81709b4227cb8c92601f0caf258f624c0467719 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-12-06SPM: Remove ARM platforms header from SPM common codeAntonio Nino Diaz
Common code mustn't include ARM platforms headers. Change-Id: Ib6e4f5a77c2d095e6e8c3ad89c89cb1959cd3043 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-12-06SDEI: Fix return value of reset callsJeenu Viswambharan
At present, both SDEI_PRIVATE_RESET and SDEI_SHARED_RESET returns SDEI_PENDING if they fail to unregister an event. The SDEI specification however requires that the APIs return SDEI_EDENY in these cases. This patch fixes the return codes for the reset APIs. Change-Id: Ic14484c91fa8396910387196c256d1ff13d03afd Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-12-05SPM: Rename SP_COMMUNICATE macrosSandrine Bailleux
Rename SP_COMMUNICATE_AARCH32/AARCH64 into MM_COMMUNICATE_AARCH32/AARCH64 to align with the MM specification [1]. [1] http://infocenter.arm.com/help/topic/com.arm.doc.den0060a/DEN0060A_ARM_MM_Interface_Specification.pdf Change-Id: I478aa4024ace7507d14a5d366aa8e20681075b03 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
2017-12-05SPM: Rename SP_MEM_ATTR*** definesAntonio Nino Diaz
The defines have been renamed to match the names used in the documentation. Change-Id: I2f18b65112d2db040a89d5a8522e9790c3e21628 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-11-23Merge pull request #1169 from antonio-nino-diaz-arm/an/spm-fixesdavidcunado-arm
SPM fixes
2017-11-20SDEI: Assert that dynamic events have Normal priorityJeenu Viswambharan
The SDEI specification requires that binding a client interrupt dispatches SDEI Normal priority event. This means that dynamic events can't have Critical priority. Add asserts for this. Change-Id: I0bdd9e0e642fb2b61810cb9f4cbfbd35bba521d1 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-11-20SDEI: Fix security state check for explicit dispatchJeenu Viswambharan
Change-Id: Ic381ab5d03ec68c7f6e8d357ac2e2cbf0cc6b2e8 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-11-15SPM: Fix SP_COMMUNICATE_AARCH32/64 parametersAntonio Nino Diaz
The parameters passed to the Secure world from the Secure Partition Manager when invoking SP_COMMUNICATE_AARCH32/64 were incorrect, as well as the checks done on them. Change-Id: I26e8c80cad0b83437db7aaada3d0d9add1c53a78 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-11-15SPM: Fix calculation of max page granularityAntonio Nino Diaz
The code was incorrectly reading from ID_AA64PRF0_EL1 instead of ID_AA64MMFR0_EL1 causing the supported granularity sizes returned by the code to be wrong. This wasn't causing any problem because it's just used to check the alignment of the base of the buffer shared between Non-secure and Secure worlds, and it was aligned to more than 64 KiB, which is the maximum granularity supported by the architecture. Change-Id: Icc0d949d9521cc0ef13afb753825c475ea62d462 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-11-13SDEI: Fix build error with logging enabledJeenu Viswambharan
Change-Id: Iee617a3528225349b6eede2f8abb26da96640678 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-11-13SDEI: Add API for explicit dispatchJeenu Viswambharan
This allows for other EL3 components to schedule an SDEI event dispatch to Normal world upon the next ERET. The API usage constrains are set out in the SDEI dispatcher documentation. Documentation to follow. Change-Id: Id534bae0fd85afc94523490098c81f85c4e8f019 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-11-13BL31: Add SDEI dispatcherJeenu Viswambharan
The implementation currently supports only interrupt-based SDEI events, and supports all interfaces as defined by SDEI specification version 1.0 [1]. Introduce the build option SDEI_SUPPORT to include SDEI dispatcher in BL31. Update user guide and porting guide. SDEI documentation to follow. [1] http://infocenter.arm.com/help/topic/com.arm.doc.den0054a/ARM_DEN0054A_Software_Delegated_Exception_Interface.pdf Change-Id: I758b733084e4ea3b27ac77d0259705565842241a Co-authored-by: Yousuf A <yousuf.sait@arm.com> Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2017-11-10SPM: Fix pointer to MP info in boot info structAntonio Nino Diaz
The MP info struct is placed right after the boot info struct. However, when calculating the address of the MP info, the size of the boot info struct was being multiplied by the size of the MP boot info. This left a big gap of empty space between the structs. This didn't break any code because the boot info struct has a pointer to the MP info struct. It was just wasting space. Change-Id: I1668e3540d9173261968f6740623549000bd48db Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-11-08SPM: Introduce Secure Partition ManagerAntonio Nino Diaz
A Secure Partition is a software execution environment instantiated in S-EL0 that can be used to implement simple management and security services. Since S-EL0 is an unprivileged exception level, a Secure Partition relies on privileged firmware e.g. ARM Trusted Firmware to be granted access to system and processor resources. Essentially, it is a software sandbox that runs under the control of privileged software in the Secure World and accesses the following system resources: - Memory and device regions in the system address map. - PE system registers. - A range of asynchronous exceptions e.g. interrupts. - A range of synchronous exceptions e.g. SMC function identifiers. A Secure Partition enables privileged firmware to implement only the absolutely essential secure services in EL3 and instantiate the rest in a partition. Since the partition executes in S-EL0, its implementation cannot be overly complex. The component in ARM Trusted Firmware responsible for managing a Secure Partition is called the Secure Partition Manager (SPM). The SPM is responsible for the following: - Validating and allocating resources requested by a Secure Partition. - Implementing a well defined interface that is used for initialising a Secure Partition. - Implementing a well defined interface that is used by the normal world and other secure services for accessing the services exported by a Secure Partition. - Implementing a well defined interface that is used by a Secure Partition to fulfil service requests. - Instantiating the software execution environment required by a Secure Partition to fulfil a service request. Change-Id: I6f7862d6bba8732db5b73f54e789d717a35e802f Co-authored-by: Douglas Raillard <douglas.raillard@arm.com> Co-authored-by: Sandrine Bailleux <sandrine.bailleux@arm.com> Co-authored-by: Achin Gupta <achin.gupta@arm.com> Co-authored-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com> Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2017-11-08spd: Use `ENABLE_ASSERTIONS` instead of `DEBUG`Antonio Nino Diaz
A line in the upstream SPDs is only compiled in in `DEBUG` builds. This line is used to help with assertions and so assertion failures can happen in release builds with assertions enabled. Use `ENABLE_ASSERTIONS` instead of `DEBUG`. This bug was introduced in commit aa61368eb5, which introduced the build option `ENABLE_ASSERTIONS`. Change-Id: I7977df9c89c68677b00099b2a1926fa3cb0937c6 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-12 22:58:19 +0000