aboutsummaryrefslogtreecommitdiffstats
path: root/services
Commit message (Collapse)AuthorAgeFilesLines
* types: use int-ll64 for both aarch32 and aarch64Masahiro Yamada2018-04-271-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit 031dbb122472 ("AArch32: Add essential Arch helpers"), it is difficult to use consistent format strings for printf() family between aarch32 and aarch64. For example, uint64_t is defined as 'unsigned long long' for aarch32 and as 'unsigned long' for aarch64. Likewise, uintptr_t is defined as 'unsigned int' for aarch32, and as 'unsigned long' for aarch64. A problem typically arises when you use printf() in common code. One solution could be, to cast the arguments to a type long enough for both architectures. For example, if 'val' is uint64_t type, like this: printf("val = %llx\n", (unsigned long long)val); Or, somebody may suggest to use a macro provided by <inttypes.h>, like this: printf("val = %" PRIx64 "\n", val); But, both would make the code ugly. The solution adopted in Linux kernel is to use the same typedefs for all architectures. The fixed integer types in the kernel-space have been unified into int-ll64, like follows: typedef signed char int8_t; typedef unsigned char uint8_t; typedef signed short int16_t; typedef unsigned short uint16_t; typedef signed int int32_t; typedef unsigned int uint32_t; typedef signed long long int64_t; typedef unsigned long long uint64_t; [ Linux commit: 0c79a8e29b5fcbcbfd611daf9d500cfad8370fcf ] This gets along with the codebase shared between 32 bit and 64 bit, with the data model called ILP32, LP64, respectively. The width for primitive types is defined as follows: ILP32 LP64 int 32 32 long 32 64 long long 64 64 pointer 32 64 'long long' is 64 bit for both, so it is used for defining uint64_t. 'long' has the same width as pointer, so for uintptr_t. We still need an ifdef conditional for (s)size_t. All 64 bit architectures use "unsigned long" size_t, and most 32 bit architectures use "unsigned int" size_t. H8/300, S/390 are known as exceptions; they use "unsigned long" size_t despite their architecture is 32 bit. One idea for simplification might be to define size_t as 'unsigned long' across architectures, then forbid the use of "%z" string format. However, this would cause a distortion between size_t and sizeof() operator. We have unknowledge about the native type of sizeof(), so we need a guess of it anyway. I want the following formula to always return 1: __builtin_types_compatible_p(size_t, typeof(sizeof(int))) Fortunately, ARM is probably a majority case. As far as I know, all 32 bit ARM compilers use "unsigned int" size_t. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
* Fix pointer type mismatch of handlersMasahiro Yamada2018-04-277-43/+43
| | | | | | | | Commit 4c0d03907652 ("Rework type usage in Trusted Firmware") changed the type usage in struct declarations, but did not touch the definition side. Fix the type mismatch. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
* spd: add static qualifier to locally used functions and dataMasahiro Yamada2018-04-215-19/+9
| | | | | | These are used locally in a file. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
* Merge pull request #1357 from antonio-nino-diaz-arm/an/fix-misraDimitris Papastamos2018-04-181-27/+28
|\ | | | | Fix some MISRA defects in SPM code
| * Fix some MISRA defects in SPM codeAntonio Nino Diaz2018-04-171-27/+28
| | | | | | | | | | Change-Id: I989c1f4aef8e3cb20d5d19e6347575e6449bb60b Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | Merge pull request #1356 from robertovargas-arm/misra-changesDimitris Papastamos2018-04-161-4/+16
|\ \ | |/ |/| Misra changes
| * Fix MISRA rule 8.4 Part 3Roberto Vargas2018-04-131-0/+12
| | | | | | | | | | | | | | | | | | | | | | Rule 8.4: A compatible declaration shall be visible when an object or function with external linkage is defined Fixed for: make DEBUG=1 PLAT=fvp SPD=tspd all Change-Id: I0a16cf68fef29cf00ec0a52e47786f61d02ca4ae Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
| * Fix MISRA rule 8.3 Part 3Roberto Vargas2018-04-131-4/+4
| | | | | | | | | | | | | | | | | | | | | | Rule 8.3: All declarations of an object or function shall use the same names and type qualifiers Fixed for: make DEBUG=1 PLAT=fvp SPD=tspd all Change-Id: I4e31c93d502d433806dfc521479d5d428468b37c Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* | Fixup SMCCC_FEATURES return value for SMCCC_ARCH_WORKAROUND_1Dimitris Papastamos2018-04-031-7/+4
|/ | | | | | | Only return -1 if the workaround for CVE-2017-5715 is not compiled in. Change-Id: I1bd07c57d22b4a13cf51b35be141a1f1ffb065ff Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
* Merge pull request #1313 from jonathanwright-ARM/jw/MISRA-switch-statementsDimitris Papastamos2018-03-295-20/+9
|\ | | | | Fix switch statements to comply with MISRA rules
| * services: fix switch statements to comply with MISRA rulesJonathan Wright2018-03-265-20/+9
| | | | | | | | | | | | | | | | Ensure (where possible) that switch statements in services comply with MISRA rules 16.1 - 16.7. Change-Id: I47bf6ed4a026201e6fe125ce51842482e99e8bb0 Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>
* | Merge pull request #1335 from JoelHutton/jh/cleanup_void_pointersDimitris Papastamos2018-03-291-9/+5
|\ \ | |/ |/| Clean usage of void pointers to access symbols
| * Clean usage of void pointers to access symbolsJoel Hutton2018-03-271-9/+5
| | | | | | | | | | | | | | | | | | | | | | Void pointers have been used to access linker symbols, by declaring an extern pointer, then taking the address of it. This limits symbols values to aligned pointer values. To remove this restriction an IMPORT_SYM macro has been introduced, which declares it as a char pointer and casts it to the required type. Change-Id: I89877fc3b13ed311817bb8ba79d4872b89bfd3b0 Signed-off-by: Joel Hutton <Joel.Hutton@Arm.com>
* | Merge pull request #1321 from sandrine-bailleux-arm/topics/sb/fix-trusty-setupdavidcunado-arm2018-03-221-1/+1
|\ \ | |/ |/| Trusty: Fix sanity check on NS entry point
| * Trusty: Fix sanity check on NS entry pointSandrine Bailleux2018-03-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the sanity check on the non-secure entrypoint value returned by bl31_plat_get_next_image_ep_info(). This issue has been reported by Coverity Scan Online: CID 264893 (#1 of 1): Dereference null return value (NULL_RETURNS) Dereferencing a null pointer ns_ep_info. Change-Id: Ia0f64d8c8b005f042608f1422ecbd42bc90b2fb4 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* | Rename 'smcc' to 'smccc'Antonio Nino Diaz2018-03-213-5/+5
|/ | | | | | | | | | | | | When the source code says 'SMCC' it is talking about the SMC Calling Convention. The correct acronym is SMCCC. This affects a few definitions and file names. Some files have been renamed (smcc.h, smcc_helpers.h and smcc_macros.S) but the old files have been kept for compatibility, they include the new ones with an ERROR_DEPRECATED guard. Change-Id: I78f94052a502436fdd97ca32c0fe86bd58173f2f Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* Fixup `SMCCC_ARCH_FEATURES` semanticsDimitris Papastamos2018-03-141-3/+10
| | | | | | | | | | | | | | | | When querying `SMCCC_ARCH_WORKAROUND_1` through `SMCCC_ARCH_FEATURES`, return either: * -1 to indicate the PE on which `SMCCC_ARCH_FEATURES` is called requires firmware mitigation for CVE-2017-5715 but the mitigation is not compiled in. * 0 to indicate that firmware mitigation is required, or * 1 to indicate that no firmware mitigation is required. This patch complies with v1.2 of the firmware interfaces specification (ARM DEN 0070A). Change-Id: Ibc32d6620efdac6c340758ec502d95554a55f02a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
* Merge pull request #1239 from arve-android/trusty-fixesdavidcunado-arm2018-03-074-25/+200
|\ | | | | Trusty fixes
| * trusty: Fix another reported misra violationArve Hjønnevåg2018-03-021-1/+1
| | | | | | | | Change-Id: I822ccf5852dce4c01f98382cc393331f29e1e256
| * trusty: Fix reported misra violationArve Hjønnevåg2018-03-011-1/+1
| | | | | | | | | | | | memset does not return a useful result here, so explitcitly ignore it Change-Id: I33cd2228cadc280ee8e5ce3a4f8682dde9a7c16c
| * trusty: Fix reported static check errorsArve Hjønnevåg2018-02-282-2/+2
| | | | | | | | Change-Id: I9f9a8a159b41be1c865a20801d03a1b2934c3cac
| * trusty: Change type of aarch32 flag t boolArve Hjønnevåg2018-02-281-2/+3
| | | | | | | | Change-Id: Ie4f937808d24c9b45066c6582c4eee61699ef6df
| * tegra/trusty: Setup tegra specific trusty args in platform codeArve Hjønnevåg2018-02-211-3/+0
| | | | | | | | | | | | Fixes tegra build with SPD=trusty. Not tested. Change-Id: I851a2b00b8b1cc65112b6088980a811d8eda1a99
| * trusty: generic-arm64-smcall: Use SPDX license identifiersArve Hjønnevåg2018-02-012-50/+2
| | | | | | | | Signed-off-by: Arve Hjønnevåg <arve@android.com>
| * trusty: Pass cpu suspend/resume reason to trustyArve Hjønnevåg2018-01-241-8/+8
| | | | | | | | | | | | | | | | Add off/on argument to SMC_FC_CPU_SUSPEND SMC_FC_CPU_RESUME and pass 1 when called from the cpu on/off hooks. Change-Id: Ie233c446fd38b3ff8546e445a8d86a15d2816093 Signed-off-by: Arve Hjønnevåg <arve@android.com>
| * trusty: Run bl33 in EL1 instead of EL2 is trusty image is 32-bitArve Hjønnevåg2018-01-241-0/+25
| | | | | | | | | | | | | | | | | | | | The secure physical timer is inacessible from 32-bit S-EL1 (when EL3 is 64-bit) so trusty will use the non-secure physical timer in this case. Linux will use the virtual timer instead of the physical timer when started in EL1. Change-Id: Ie49348d9a27e5287676dd4a77f678ecbd6c2309f Signed-off-by: Arve Hjønnevåg <arve@android.com>
| * trusty: Add fpu/simd supportArve Hjønnevåg2018-01-242-4/+5
| | | | | | | | | | | | | | | | The original patch has been partly merged. This adds the missing pieces. Change-Id: I77fd434feab396ff05d9b8e0c1761e4dd588a701 Signed-off-by: Arve Hjønnevåg <arve@android.com>
| * trusty: Add generic-arm64 supportArve Hjønnevåg2018-01-243-0/+173
| | | | | | | | | | | | | | | | Add smc calls to return gic base address and print to the debug console. Allows running a generic trusty binary. Change-Id: I4b6540f140f11432cdff43c3f5a2097df09dc9d1 Signed-off-by: Arve Hjønnevåg <arve@android.com>
| * trusty: Restore working trusty setup code and include trusty image in buildArve Hjønnevåg2018-01-242-10/+36
| | | | | | | | | | Change-Id: I081901e7df22f78dd9c4fc4c6bfad2aceb870a2d Signed-off-by: Arve Hjønnevåg <arve@android.com>
* | Merge pull request #1282 from robertovargas-arm/misra-changesdavidcunado-arm2018-02-282-3/+3
|\ \ | | | | | | Misra changes
| * | Fix MISRA rule 8.4 in common codeRoberto Vargas2018-02-282-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Rule 8.4: A compatible declaration shall be visible when an object or function with external linkage is defined. Change-Id: I26e042cb251a6f9590afa1340fdac73e42f23979 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* | | Merge pull request #1284 from jeenu-arm/tspd-ehfdavidcunado-arm2018-02-281-4/+6
|\ \ \ | | | | | | | | TSPD and EHF
| * | | TSPD: Register preempted SMC error code with EHFJeenu Viswambharan2018-02-271-4/+6
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | An earlier patch extended ehf_allow_ns_preemption() API to also register an error code to offer to Non-secure when a Yielding SMC is preempted by SDEI interrupt. In TSPD's case, register the error code TSP_PREEMPTED. Change-Id: I31992b6651f80694e83bc5092b044ef7a3eda690 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* / / SDEI: Pop dispatch context only after error checkingJeenu Viswambharan2018-02-271-9/+11
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, when the client attempts to do SDEI_EVENT_COMPLETE or SDEI_EVENT_COMPLETE_AND_RESUME, the dispatcher pops off the outstanding dispatch context for sanity check. There are however other checks following this, which could potentially return failure. If that happens, by popping the context, the dispatcher has inadvertently discarded a valid context. This patch fixes this bug by inspecting (not actually popping) the outstanding context. The context is popped only after all error checks are completed. Change-Id: Ie199f6442f871a8177a8247a0c646543bad76d21 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* | Ensure the correct execution of TLBI instructionsAntonio Nino Diaz2018-02-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | After executing a TLBI a DSB is needed to ensure completion of the TLBI. rk3328: The MMU is allowed to load TLB entries for as long as it is enabled. Because of this, the correct place to execute a TLBI is right after disabling the MMU. Change-Id: I8280f248d10b49a8c354a4ccbdc8f8345ac4c170 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | Remove URLs from commentsAntonio Nino Diaz2018-02-141-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes all defects according to MISRA Rule 3.1: "The character sequences /* and // shall not be used within a comment". This affects all URLs in comments, so they have been removed: - The link in `sdei_state.c` can also be found in the documentation file `docs/sdei.rst`. - The bug that the file `io_fip.c` talks about doesn't affect the currently supported version of GCC, so it doesn't make sense to keep the comment. Note that the version of GCC officially supported is the one that comes with Linaro Release 17.10, which is GCC 6.2. - The link in `tzc400.c` was broken, and it didn't correctly direct to the Technical Reference Manual it should. The link has been replaced by the title of the document, which is more convenient when looking for the document. Change-Id: I89f60c25f635fd4c008a5d3a14028f814c147bbe Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | TSPD: Require NS preemption along with EL3 exception handlingJeenu Viswambharan2018-02-061-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At present, the build option TSP_NS_INTR_ASYNC_PREEMPT controls how Non-secure interrupt affects TSPs execution. When TSP is executing: 1. When TSP_NS_INTR_ASYNC_PREEMPT=0, Non-secure interrupts are received at the TSP's exception vector, and TSP voluntarily preempts itself. 2. When TSP_NS_INTR_ASYNC_PREEMPT=1, Non-secure interrupts causes a trap to EL3, which preempts TSP execution. When EL3 exception handling is in place (i.e., EL3_EXCEPTION_HANDLING=1), FIQs are always trapped to EL3. On a system with GICv3, pending NS interrupts while TSP is executing will be signalled as FIQ (which traps to EL3). This situation necessitates the same treatment applied to case (2) above. Therefore, when EL3 exception handling is in place, additionally require that TSP_NS_INTR_ASYNC_PREEMPT is set to one 1. Strictly speaking, this is not required on a system with GICv2, but the same model is uniformly followed regardless, for simplicity. Relevant documentation updated. Change-Id: I928a8ed081fb0ac96e8b1dfe9375c98384da1ccd Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* | TSPD: Explicitly allow NS preemption for Yielding SMCsJeenu Viswambharan2018-02-061-2/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | When EL3 exception handling is in effect (i.e., EL3_EXCEPTION_HANDLING=1), Non-secure interrupts can't preempt Secure execution. However, for yielding SMCs, preemption by Non-secure interupts is intended. This patch therefore adds a call to ehf_allow_ns_preemption() before dispatching a Yielding SMC to TSP. Change-Id: Ia3a1ae252f3adc0f14e6d7e0502f251bdb349bdf Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* | Implement support for SMCCC v1.1Dimitris Papastamos2018-01-291-0/+74
|/ | | | | | | | | | | | | | | | SMCCC v1.1 comes with a relaxed calling convention for AArch64 callers. The caller only needs to save x0-x3 before doing an SMC call. This patch adds support for SMCCC_VERSION and SMCCC_ARCH_FEATURES. Refer to "Firmware Interfaces for mitigating CVE_2017_5715 System Software on Arm Systems"[0] for more information. [0] https://developer.arm.com/-/media/developer/pdf/ARM%20DEN%200070A%20Firmware%20interfaces%20for%20mitigating%20CVE-2017-5715_V1.0.pdf Change-Id: If5b1c55c17d6c5c7cb9c2c3ed355d3a91cdad0a9 Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
* Merge pull request #1219 from antonio-nino-diaz-arm/an/mm-versiondavidcunado-arm2018-01-161-4/+4
|\ | | | | SPM: Fix version header definitions
| * SPM: Fix version header definitionsAntonio Nino Diaz2018-01-101-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | Rename SP_VERSION macros to MM_VERSION, which is the name used in the MM specification [1]. Also, a few more helper macros have been added. MM-specific definitions have been moved to their own header file. [1] http://infocenter.arm.com/help/topic/com.arm.doc.den0060a/DEN0060A_ARM_MM_Interface_Specification.pdf Change-Id: Ia10e48c7e81a7a1f5eeca29a5270cae740a4a88a Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | spd: tlkd: support for "NS memory ranges" function IDVarun Wadekar2018-01-081-4/+6
|/ | | | | | | This patch adds support to receive function ID with NS world's memory ranges to provide the memory snapshot to TLK. Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
* SPM: Allow secondary CPUs to use the Secure PartitionAntonio Nino Diaz2018-01-082-0/+15
| | | | | | | | | | | | | The Secure Partition should be able to be used from any CPU, not just the lead one. This patch point the secure contexts of all secondary CPUs to the same one used by the lead CPU for the Secure Partition. This way, they can also use it. In order to prevent more than one CPU from using the Secure Partition at the same time, a lock has been added. Change-Id: Ica76373127c3626498b06c558a4874ce72201ff7 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* SPM: Move initialization flag to context structAntonio Nino Diaz2018-01-082-6/+6
| | | | | | | | | Whether a Secure Partition is being initialized or not is something related to that specific partition, so it should be saved with the rest of the information related to it. Change-Id: Ie8a780f70df83fb03ef9c01ba37960208d9b5319 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* SPM: Fix MM_COMMUNICATE_AARCH32/64 parametersSandrine Bailleux2017-12-121-18/+32
| | | | | | | | | | | | | | | | | | | | This partially reverts commit d6b532b50f8, keeping only the fixes to the assertions. The changes related to the order of arguments passed to the secure partition were not correct and violated the specification of the SP_EVENT_COMPLETE SMC. This patch also improves the MM_COMMUNICATE argument validation. The cookie argument, as it comes from normal world, can't be trusted and thus needs to always be validated at run time rather than using an assertion. Also validate the communication buffer address and return INVALID_PARAMETER if it is zero, as per the MM specification. Fix a few typos in comments and use the "secure partition" terminology rather than "secure payload". Change-Id: Ice6b7b5494b729dd44611f9a93d362c55ab244f7 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* Merge pull request #1187 from antonio-nino-diaz-arm/an/spm-xlat-dramdavidcunado-arm2017-12-101-1/+6
|\ | | | | SPM: Move S-EL1/S-EL0 xlat tables to TZC DRAM
| * SPM: Move S-EL1/S-EL0 xlat tables to TZC DRAMAntonio Nino Diaz2017-12-061-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A new platform define, `PLAT_SP_IMAGE_XLAT_SECTION_NAME`, has been introduced to select the section where the translation tables used by the S-EL1/S-EL0 are placed. This define has been used to move the translation tables to DRAM secured by TrustZone. Most of the extra needed space in BL31 when SPM is enabled is due to the large size of the translation tables. By moving them to this memory region we can save 44 KiB. A new argument has been added to REGISTER_XLAT_CONTEXT2() to specify the region where the translation tables have to be placed by the linker. Change-Id: Ia81709b4227cb8c92601f0caf258f624c0467719 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | Merge pull request #1184 from antonio-nino-diaz-arm/an/bl31-in-dramdavidcunado-arm2017-12-091-1/+0
|\ \ | | | | | | fvp: Disable SYSTEM_SUSPEND when ARM_BL31_IN_DRAM
| * | SPM: Remove ARM platforms header from SPM common codeAntonio Nino Diaz2017-12-061-1/+0
| |/ | | | | | | | | | | | | Common code mustn't include ARM platforms headers. Change-Id: Ib6e4f5a77c2d095e6e8c3ad89c89cb1959cd3043 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | Merge pull request #1183 from jeenu-arm/sdei-reset-fixdavidcunado-arm2017-12-091-2/+2
|\ \ | | | | | | SDEI: Fix return value of reset calls
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-14 21:15:54 +0000