summaryrefslogtreecommitdiff
path: root/services
AgeCommit message (Collapse)Author
2018-12-11SPM: Introduce SPRT C host libraryAntonio Nino Diaz
Change-Id: If57ec9cc0791f49d9ade83dff9d24ef9047963a8 Co-authored-by: Jean-Paul Etienne <jean-paul.etienne@arm.com> Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11SPM: Implement SPCI open/close handle SMCsAntonio Nino Diaz
Introduce SMCs that open and close handles according to the SPCI specification. Change-Id: I65f365f15612e01aa445e783e96e48ae275c39fd Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11SPM: Introduce SMC handlers for SPCI and SPRTAntonio Nino Diaz
Change-Id: I2ae9b3bb686c41b2e138132a7bed107925ac861e Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11SPM: Support multiple xlat tables contextsAntonio Nino Diaz
Change-Id: Ib7c2529b85bb5930d44907edfc8ead13d3b1ef4d Co-authored-by: Sandrine Bailleux <sandrine.bailleux@arm.com> Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11SPM: Support multiple partitionsAntonio Nino Diaz
Change-Id: I6673a5f8c2f6afa7780483e0ce8d4dad4c8dc8ea Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11SPM: Remove old SMC interfacesAntonio Nino Diaz
Remove interfaces based on MM_COMMUNICATE. Change-Id: I628c884b91d9f4758269ea2c4dedc37a66bb93cf Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11SPM: Map memory regions from RDAntonio Nino Diaz
SPM needs to map a number of regions on behalf of the secure partition. Previously, it used to get a list of them from platform code using the plat_get_secure_partition_mmap() API. Now it gets them from the resource description structure. The SPM<->SP shared buffer is mapped dynamically at EL3. This buffer is used to pass information between SPM and SP, so it must be mapped at EL3 as well in order to be used by SPM. Dynamic translation tables have been enabled when the Trusted Firmware is compiled with SPM support. Change-Id: I64ad335e931661812a0a60558e60372e1e5e6b72 Co-authored-by: Sandrine Bailleux <sandrine.bailleux@arm.com> Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11SPM: Read entrypoint from resource descriptorAntonio Nino Diaz
Read entrypoint of the Secure Partition from the resource description struct. Change-Id: Ie693c7b4d4fecafd85b6934d9d8c4232efb1dc55 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11SPM: Load image and RD from SP packageAntonio Nino Diaz
Load SP and RD from package instead of relying on RD being already loaded in memory and the SP being loaded as a BL32 image. Change-Id: I18d4fbf4597656c6a7e878e1d7c01a8a324f3f8a Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-10SPM: Remove SP memory mappings definitionsAntonio Nino Diaz
This information is retrieved from the resource description now. Change-Id: Iaae23945eb2c45305cdc6442853e42f4e04fe094 Co-authored-by: Sandrine Bailleux <sandrine.bailleux@arm.com> Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-10SPM: Deprecate boot info structAntonio Nino Diaz
This information is defined by the Secure Partition in the resource description. Change-Id: Ia7db90c5de8360a596106880d3f6a632a88d3ea8 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-10SPM: Deprecate the current implementationAntonio Nino Diaz
The current SPM is a prototype that only supports one secure partition in EL0. The objective of SPM is to have multiple partitions. The current MM interface isn't adequate for this, so it is needed to modify heavily the code to add proper support for it. However, there are platforms which are already using this (like SGI) and removing the code would break it. For this reason, the current SPM code has been duplicated in order to temporarily preserve compatibility. All new improvements/changes to SPM will be done in the non-deprecated copy, that may change without notice. The new build option SPM_DEPRECATED has been introduced to select the SPM implementation. It defaults to 1, that selects the deprecated SPM. Change-Id: Ic9f80b53b450e97b4d3f47e4ef4a138ee8d87443 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-10AArch64: Use SSBS for CVE_2018_3639 mitigationJeenu Viswambharan
The Armv8.5 extensions introduces PSTATE.SSBS (Speculation Store Bypass Safe) bit to mitigate against Variant 4 vulnerabilities. Although an Armv8.5 feature, this can be implemented by CPUs implementing earlier version of the architecture. With this patch, when both PSTATE.SSBS is implemented and DYNAMIC_WORKAROUND_CVE_2018_3639 is active, querying for SMCCC_ARCH_WORKAROUND_2 via. SMCCC_ARCH_FEATURES call would return 1 to indicate that mitigation on the PE is either permanently enabled or not required. When SSBS is implemented, SCTLR_EL3.DSSBS is initialized to 0 at reset of every BL stage. This means that EL3 always executes with mitigation applied. For Cortex A76, if the PE implements SSBS, the existing mitigation (by using a different vector table, and tweaking CPU ACTLR2) is not used. Change-Id: Ib0386c5714184144d4747951751c2fc6ba4242b6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-11-26SDEI: Unconditionally resume Secure if it was interruptedJeenu Viswambharan
Secure world execution nearly always expect a controlled exit to Non-secure world. SDEI interrupts, although targets EL3, occur on behalf of Non-secure world, and may have higher priority than Secure world interrupts. Therefore they might preempt Secure execution, and yield execution to Non-secure SDEI handler. Upon completion of SDEI event handling (regardless of whether it's COPLETE or COMPLETE_AND_RESUME), we must resume Secure execution if it was preempted. Change-Id: I6edd991032588588427ba2fe6c3d7668f7080e3d Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-11-14SPM: Raise running priority of the core while in Secure PartitionSughosh Ganu
The current secure partition design mandates that a) at a point, only a single core can be executing in the secure partition, and b) a core cannot be preempted by an interrupt while executing in secure partition. Ensure this by activating the SPM priority prior to entering the parition. Deactivate the priority on return from the partition. Change-Id: Icb3473496d16b733564592eef06304a1028e4f5c Signed-off-by: Sughosh Ganu <sughosh.ganu@arm.com>
2018-11-08Standardise header guards across codebaseAntonio Nino Diaz
All identifiers, regardless of use, that start with two underscores are reserved. This means they can't be used in header guards. The style that this project is now to use the full name of the file in capital letters followed by 'H'. For example, for a file called "uart_example.h", the header guard is UART_EXAMPLE_H. The exceptions are files that are imported from other projects: - CryptoCell driver - dt-bindings folders - zlib headers Change-Id: I50561bf6c88b491ec440d0c8385c74650f3c106e Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-10-30sdei: include "context.h" to fix compilation errorsVarun Wadekar
This patch includes context.h from sdei_private.h to fix the following compilation errors: <snip> In file included from services/std_svc/sdei/sdei_event.c:9:0: services/std_svc/sdei/sdei_private.h: In function 'sdei_client_el': services/std_svc/sdei/sdei_private.h:164:2: error: unknown type name 'cpu_context_t' cpu_context_t *ns_ctx = cm_get_context(NON_SECURE); ^ services/std_svc/sdei/sdei_private.h:165:2: error: unknown type name 'el3_state_t' el3_state_t *el3_ctx = get_el3state_ctx(ns_ctx); ^ services/std_svc/sdei/sdei_private.h:165:2: error: implicit declaration of function 'get_el3state_ctx' [-Werror=implicit-function-declaration] services/std_svc/sdei/sdei_private.h:165:25: error: initialization makes pointer from integer without a cast [-Werror] el3_state_t *el3_ctx = get_el3state_ctx(ns_ctx); ^ services/std_svc/sdei/sdei_private.h:167:2: error: implicit declaration of function 'read_ctx_reg' [-Werror=implicit-function-declaration] return ((read_ctx_reg(el3_ctx, CTX_SCR_EL3) & SCR_HCE_BIT) != 0U) ? ^ services/std_svc/sdei/sdei_private.h:167:33: error: 'CTX_SCR_EL3' undeclared (first use in this function) return ((read_ctx_reg(el3_ctx, CTX_SCR_EL3) & SCR_HCE_BIT) != 0U) ? ^ services/std_svc/sdei/sdei_private.h:167:33: note: each undeclared identifier is reported only once for each function it appears in cc1: all warnings being treated as errors <snip> Change-Id: Id0cad56accf81b19cb0d301784f3f086dd052722 Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
2018-10-03Merge pull request #1584 from danielboulby-arm/db/SwitchesSoby Mathew
Ensure the flow through switch statements is clear
2018-09-28Remove all other deprecated interfaces and filesAntonio Nino Diaz
Change-Id: Icd1cdd42afdc78895a9be6c46b414b0a155cfa63 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-09-21Ensure the flow through switch statements is clearDaniel Boulby
Ensure case clauses: * Terminate with an unconditional break, return or goto statement. * Use conditional break, return or goto statements as long as the end of the case clause is unreachable; such case clauses must terminate with assert(0) /* Unreachable */ or an unconditional __dead2 function call * Only fallthough when doing otherwise would result in less readable/maintainable code; such case clauses must terminate with a /* Fallthrough */ comment to make it clear this is the case and indicate that a fallthrough is intended. This reduces the chance of bugs appearing due to unintended flow through a switch statement Change-Id: I70fc2d1f4fd679042397dec12fd1982976646168 Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
2018-09-18trusty: Fix return value of trusty_init()Antonio Nino Diaz
The value used to signal failure is 0. It is needed to return a different value on success. Change-Id: I2186aa7dfbfc825bfe7b3d5ae3c4de7af10ee44f Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-09-07SDEI: Mask events after CPU wakeupJeenu Viswambharan
The specification requires that, after wakeup from a CPU suspend, the dispatcher must mask all events on the CPU. This patch adds the feature to the SDEI dispatcher by subscribing to the PSCI suspend to power down event, and masking all events on the PE. Change-Id: I9fe1d1bc2a58379ba7bba953a8d8b275fc18902c Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-08-31opteed: pass power level on suspendJorge Ramirez-Ortiz
Some platforms might chose to take different actions depending on this value; this is precisely the case for rcar-gen3. Signed-off-by: Jorge Ramirez-Ortiz <jramirez@baylibre.com>
2018-08-22libc: Use printf and snprintf across codebaseAntonio Nino Diaz
tf_printf and tf_snprintf are now called printf and snprintf, so the code needs to be updated. Change-Id: Iffeee97afcd6328c4c2d30830d4923b964682d71 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-08-22libc: Fix all includes in codebaseAntonio Nino Diaz
The codebase was using non-standard headers. It is needed to replace them by the correct ones so that we can use the new libc headers. Change-Id: I530f71d9510cb036e69fe79823c8230afe890b9d Acked-by: Sumit Garg <sumit.garg@linaro.org> Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-08-20SDEI: Fix locking issuesJeenu Viswambharan
The event lock for a shared event was being unlocked twice, and the locking sequence for event complete was misplaced. This patch fixes both issues. Change-Id: Ie2fb15c6ec240af132d7d438946ca160bd5c63dc Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-08-20SDEI: MISRA fixesJeenu Viswambharan
These changes address most of the required MISRA rules. In the process, some from generic code is also fixed. No functional changes. Change-Id: I6235a355e006f0b1c7c1c4d811b3964a64d0434f Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-08-15Merge pull request #1516 from antonio-nino-diaz-arm/an/printfDimitris Papastamos
Replace stdio.h functions by TF functions
2018-08-10Replace stdio.h functions by TF functionsAntonio Nino Diaz
Functions provided by stdio.h such as printf and sprintf are available in the codebase, but they add a lot of code to the final image if they are used: - AArch64: ~4KB - AArch32: ~2KB in T32, ~3KB in A32 tf_printf and tf_snprintf are a lot more simple, but it is preferable to use them when possible because they are also used in common code. Change-Id: Id09fd2b486198fe3d79276e2c27931595b7ba60e Acked-by: Haojian Zhuang <haojian.zhuang@linaro.org> Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-08-06xlat v2: Cleanup get/change mem attr helpersAntonio Nino Diaz
Changed the names for consistency with the rest of the library. Introduced new helpers that manipulate the active translation tables context. Change-Id: Icaca56b67fcf6a96e88aa3c7e47411162e8e6856 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-08-01Fix handler prototype in Trusty generic dispatcherSandrine Bailleux
Fix the types of the arguments of trusty_generic_platform_smc() to match the expected prototype of a runtime service handler (see rt_svc_handle_t type). Change-Id: Ie839d116ca924b4b018ea2abbef72a1073da2a32 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
2018-07-19Merge pull request #1481 from antonio-nino-diaz-arm/an/xlat-refactordanh-arm
xlat: More refactoring
2018-07-15SPM: Use generic MMU setup functionsAntonio Nino Diaz
Instead of having a different initialization routine than the rest of the codebase, use the common implementation. Change-Id: I27c03b9905f3cf0af8810aad9e43092005387a1a Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-07-13Fix verbose messages in SDEI codeSandrine Bailleux
Fix mismatches between the format specifier and the corresponding variable type. Change-Id: Ib9004bd9baa9ba24a50000bea4f2418e1bf7e743 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
2018-07-11Fix some violations to MISRA rule 8.3Sandrine Bailleux
Wherever we use 'struct foo' and 'foo_t' interchangeably in a function's declaration and definition, use 'struct foo' consistently for both, as per the TF-A coding guidelines [1]. [1] https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Coding-Guidelines#avoid-anonymous-typedefs-of-structsenums-in-header-files Change-Id: I7998eb24a26746e87e9b6425529926406745b721 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
2018-07-11Add end_vector_entry assembler macroRoberto Vargas
Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-06-22Merge pull request #1406 from robertovargas-arm/uuidDimitris Papastamos
Make TF UUID RFC 4122 compliant
2018-06-22SDEI: Fix name of internal functionJeenu Viswambharan
The function end_sdei_explicit_dispatch() was intended to be end_sdei_synchronous_dispatch() which does the opposite of begin_sdei_synchronous_dispatch(). This patch fixes that. No functional changes. Change-Id: I141bd91eb342ecf4ddfd05b49513eee4549e7a56 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-22SDEI: Fix determining client ELJeenu Viswambharan
commit 2ccfcb2ea555eb86122e7780010cc50fcee08f54 ("SDEI: Determine client EL from NS context's SCR_EL3") intended to read from SCR_EL3, but wrongly read from SPSR_EL3 instead. This patch fixes that. Change-Id: I8ffea39cc98ef59cb8e7a4c6ef4cb12011c58536 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-22SDEI: Fix dispatch bugJeenu Viswambharan
The Commit cdb6ac94ecb3c4caa784cd4d7580cf6252146196 introduced a bug because of which the SDEI dispatcher wrongly panic when an SDEI event dispatched earlier as a result of interrupt. This patch fixes the check for a bound interrupt. Change-Id: If55c8f0422ff781731248bbbc9c1b59fa0d3c4b0 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-22Merge pull request #1437 from jeenu-arm/ras-remainingDimitris Papastamos
SDEI dispatch changes to enable RAS use cases
2018-06-21SDEI: Make dispatches synchronousJeenu Viswambharan
SDEI event dispatches currently only sets up the Non-secure context before returning to the caller. The actual dispatch only happens upon exiting EL3 next time. However, for various error handling scenarios, it's beneficial to have the dispatch happen synchronously. I.e. when receiving SDEI interrupt, or for a successful sdei_dispatch_event() call, the event handler is executed; and upon the event completion, dispatcher execution resumes after the point of dispatch. The jump primitives introduced in the earlier patch facilitates this feature. With this patch: - SDEI interrupts and calls to sdei_dispatch_event prepares the NS context for event dispatch, then sets a jump point, and immediately exits EL3. This results in the client handler executing in Non-secure. - When the SDEI client completes the dispatched event, the SDEI dispatcher does a longjmp to the jump pointer created earlier. For the caller of the sdei_dispatch_event() in particular, this would appear as if call returned successfully. The dynamic workaround for CVE_2018_3639 is slightly shifted around as part of related minor refactoring. It doesn't affect the workaround functionality. Documentation updated. NOTE: This breaks the semantics of the explicit dispatch API, and any exiting usages should be carefully reviewed. Change-Id: Ib9c876d27ea2af7fb22de49832e55a0da83da3f9 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-21SDEI: Determine client EL from NS context's SCR_EL3Jeenu Viswambharan
Currently, the dispatcher reads from SCR_EL3 register directly to determine the EL of SDEI client. This is with the assumption that SCR_EL3 is not modified throughout. However, with RAS work flows, it's possible that SCR_EL3 register contains values corresponding to Secure world, and therefore EL determination can go wrong. To mitigate this, always read the register from the saved Non-secure context. Change-Id: Ic85e4021deb18eb58757f676f9a001174998543a Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-21SDEI: Allow platforms to define explicit eventsJeenu Viswambharan
The current macros only allow to define dynamic and statically-bound SDEI events. However, there ought be a mechanism to define SDEI events that are explicitly dispatched; i.e., events that are dispatched as a result of a previous secure interrupt or other exception This patch introduces SDEI_EXPLICIT_EVENT() macro to define an explicit event. They must be placed under private mappings. Only the priority flags are allowed to be additionally specified. Documentation updated. Change-Id: I2e12f5571381195d6234c9dfbd5904608ad41db3 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-20SPM: Allow entering the SP without needing a SMCAntonio Nino Diaz
It may be needed to enter the Secure Partition through other means than an MM_COMMUNICATE SMC. This patch enables this behaviour by extracting the necessary code from mm_communicate() and allowing other parts of the code to use it. Change-Id: I59f6638d22d9c9d0baff0984f39d056298a8dc8e Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-06-15SPM: Refactor entry and exit of the SPAntonio Nino Diaz
Only use synchronous calls to enter the Secure Partition in order to simplify the SMC handling code. Change-Id: Ia501a045585ee0836b9151141ad3bd11d0971be2 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-06-14Make TF UUID RFC 4122 compliantRoberto Vargas
RFC4122 defines that fields are stored in network order (big endian), but TF-A stores them in machine order (little endian by default in TF-A). We cannot change the future UUIDs that are already generated, but we can store all the bytes using arrays and modify fiptool to generate the UUIDs with the correct byte order. Change-Id: I97be2d3168d91f4dee7ccfafc533ea55ff33e46f Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-06-14Merge pull request #1415 from antonio-nino-diaz-arm/an/spm-fixesDimitris Papastamos
Minor fixes to SPM
2018-06-13xlat v2: Introduce xlat granule size helpersAntonio Nino Diaz
The function xlat_arch_is_granule_size_supported() can be used to check if a specific granule size is supported. In Armv8, AArch32 only supports 4 KiB pages. AArch64 supports 4 KiB, 16 KiB or 64 KiB depending on the implementation, which is detected at runtime. The function xlat_arch_get_max_supported_granule_size() returns the max granule size supported by the implementation. Even though right now they are only used by SPM, they may be useful in other places in the future. This patch moves the code currently in SPM to the xlat tables lib so that it can be reused. Change-Id: If54624a5ecf20b9b9b7f38861b56383a03bbc8a4 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-06-13SPM: Initialize SP args as expected by cm libraryAntonio Nino Diaz
In the context management library, cm_setup_context() takes the information in ep_info to fill the registers x0-x7. This patch replaces the current code that sets them manually by the correct initialization code. Change-Id: Id1fdf4681b154026c2e3af1f9b05b19582b7d16d Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-05-23 10:49:04 +0000