Now lx2 which use MT35XU512A supports warm boot, fix the macro
define caused by the commit:
feat(driver/nxp/xspi): add MT35XU02G flash info
Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Change-Id: I83eb8cb9a30ac7c7efd5a010acbd03eddebed52b
An STM32 image with the awaited header major version shouldn't be forbid
to boot. If the minor differs, then it means only non-mandatory options
have been added in the reserved fields, and the header remains backward
compatible.
Change-Id: Iff16b67f95c728e2f1d128bd1760a4be497c5ca3
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Add enable bit mask description because power switches
are not all enabled by bit 0.
Signed-off-by: Pascal Paillet <p.paillet@st.com>
Change-Id: If7c9ae7d800adee8e25416ca35db1be20452741f
Use errno values, or the return of called functions, instead of -1.
Correct some MISRA issues, like braces.
Change-Id: If7b53de5cbfb4d2c9979bce0e594dd92bf07a77a
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Use BIT and GENMASK macros to ease stpmic1.h reading.
Change-Id: I808a62818d4188bb2f3686ab37518d369b6c41cb
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
On battery powered systems the RTC keeps the date/time across
system reboot.
The RTC clock should not be disabled otherwise the date/time
counter gets stopped.
Tag RTC clock as always on.
Signed-off-by: HE Shushan <shushan.he@st.com>
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
Change-Id: I6455c3c740d2e5add28255eb84f8ebaf2870d9d8
dt_match_instance_by_compatible() gives the DT node offset in DT
that matches both compatible and the peripheral instance address.
Change-Id: Ia85f4f4aa8fe8efd4df310d765e7586e67aa34c2
Signed-off-by: Yann Gautier <yann.gautier@st.com>
MPUDIV dividers are stored in a constant array, under bit shifts form.
They must be used in this way by the clock driver.
Change-Id: If758f7a4048eff956067a10a42ab0983a20a000d
Signed-off-by: Gabriel Fernandez <gabriel.fernandez@st.com>
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
Correct MCU clock parent selector: MCU subsystem clock is derived
from clock PLL3_P, not PLL3.
Correct AXI clock parent selector: AXI subsystem clock is derived
from clock PLL2_P, not PLL2.
This change also renames MCU clock and AXI clock resources to
prevent confusion.
Change-Id: If55618d180e7dce8e4f0977b0e586a6fa8ef28d1
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
To avoid parsing device tree file too often, keep the RCC node
offset value in a variable in fdt_get_rcc_node().
Change-Id: Ibb23ff92247d57c65a23517b8f3473f639794d2a
Signed-off-by: Yann Gautier <yann.gautier@st.com>
AXI, MPU and MCU clocks are always on, put them in the list
in the function clock_is_always_on().
Change-Id: I969a442274d2da6c59636f3293de1c31b4c8e3b1
Signed-off-by: Yann Gautier <yann.gautier@st.com>
This patch updates and refactors the GPT library and fixes bugs.
- Support all combinations of PGS, PPS, and L0GPTSZ parameters.
- PPS and PGS are set at runtime, L0GPTSZ is read from GPCCR_EL3.
- Use compiler definitions to simplify code.
- Renaming functions to better suit intended uses.
- MMU enabled before GPT APIs called.
- Add comments to make function usage more clear in GPT library.
- Added _rme suffix to file names to differentiate better from the
GPT file system code.
- Renamed gpt_defs.h to gpt_rme_private.h to better separate private
and public code.
- Renamed gpt_core.c to gpt_rme.c to better conform to TF-A precedent.
Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I4cbb23b0f81e697baa9fb23ba458aa3f7d1ed919
In the typical TF-A boot flow, the Trusted Watchdog is started
at the beginning of BL1 and then stopped in BL1 after returning
from BL2. However, in the RME boot flow there is no return path
from BL2 to BL1. Therefore, disable the Watchdog if ENABLE_RME is set.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Id88fbfab8e8440642414bed48c50e3fcb23f3621
This patch adds instructions on how to build and run TF-A
with FEAT_RME enabled. The patch also adds code owners for
FEAT_RME.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Id16dc52cb76b1ea56ac5c3fc38cb0794a62ac2a1
VERBOSE print logs need a larger stack size and the currently configured
BL2 stack size was insufficient for FVP. This patch increases the same.
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
Change-Id: I316ba2ea467571161b5f4807e6e5fa0bf89d44c6
We currently use ARM_PRELOADED_DTB_BASE build
variable to pass the kernel DTB base address to
the kernel when using the ARM_LINUX_KERNEL_AS_BL33
option. However this variable doesn't actually
change the DTB load address.
The DTB load address is actually specified in the
FW_CONFIG DTS (fvp_fw_config.dts) as 'hw_config'.
This patch passes the hw_config value instead of
ARM_PRELOADED_DTB_BASE allowing us to change
the kernel DTB load address through
fvp_fw_config.dts.
With this change we don't need the ARM_PRELOADED_DTB_BASE
build variable if RESET_TO_BL31 is not set.
Note that the hw_config value needs to be within the
ARM_DTB_DRAM_NS region specified by FVP_DTB_DRAM_MAP_START
and FVP_DTB_DRAM_MAP_SIZE.
This patch also expands the ARM_DTB_DRAM_NS region to 32MB.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Idd74cdf5d2c649bb320644392ba5d69e175a53a9
The macros PLAT_HW_CONFIG_DTB_BASE and PLAT_HW_CONFIG_DTB_SIZE
describe the range of memory where the HW_CONFIG_DTB can be loaded
rather than the actual load address and size of the DTB. This patch
changes the names to something more descriptive.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I98b81f3ce0c80fd76614f959667c25b07941e190
This patch make minor modifications to FVP DTS including modifying
the Non-secure memory range when RME is enabled.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I6b3650a2abfff10462a8a2d42755e6d764f7b035
When RME is enabled, during configuration of the TrustZone controller,
Root regions are initially configured as Secure regions, and Realm
regions as Non-secure regions. Then later these regions are configured
as Root and Realm regions respectively in the GPT. According to the RME
architecture reference manual, Root firmware must ensure that Granule
Protection Check is enabled before enabling any stage of translation.
Therefore initializations are done as follows when RME is enabled :
Initialize/enable the TrustZone controller (plat_arm_security_setup) -->
Initialize/enable GPC (arm_bl2_plat_gpt_setup) -->
enable MMU (enable_mmu_el3)
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I91094e8259079437bee02de1f65edb9ad51e43cf
When FEAT_RME is enabled, memory is divided into four Physical
Address Spaces (PAS): Root, Realm, Secure and Non-secure.
This patch introduces new carveouts for the Trusted SRAM and DRAM
for the FVP platform accordingly.
The following new regions are introduced with this change:
ARM_MAP_L0_GPT_REGION: Trusted SRAM region used to store Level 0
Granule Protection Table (GPT). This region resides in the Root PAS.
ARM_MAP_GPT_L1_DRAM: DRAM region used to store Level 1 GPT. It
resides in the Root PAS.
ARM_MAP_RMM_DRAM: DRAM region used to store RMM image. It
resides in the Realm PAS.
The L0 GPT is stored on Trusted SRAM next to firmware configuration
memory. The DRAM carveout when RME is enable is modified as follow:
--------------------
| |
| AP TZC (~28MB) |
--------------------
| |
| REALM (32MB) |
--------------------
| |
| EL3 TZC (3MB) |
--------------------
| L1 GPT + SCP TZC |
| (~1MB) |
0xFFFF_FFFF --------------------
During initialization of the TrustZone controller, Root regions
are configured as Secure regions. Then they are later reconfigured
to Root upon GPT initialization.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: If2e257141d51f51f715b70d4a06f18af53607254
If FEAT_RME is enabled, EL3 runs in the Root world as opposed to
Secure world. This patch changes EL3 memory region attributes for
Arm platforms accordingly.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Ie176f8b440ff34330e4e44bd3bf8d9703b3892ff
This patch adds the necessary changes needed to build
and load RMM image for the FVP platform. RMM image is
loaded by BL2 after BL32 (if BL32 exists) and before BL33.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I1ac9eade84c2e35c7479a322ca1d090b4e626819
This patch introduces the Granule Protection Table (GPT)
library code. This implementation will be updated later to
be more flexible, as the current implementation is very rigid.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I3af824a28c6e9a5d36459c0c51d2d9bebfba1505
The changes include:
- A new build option (ENABLE_RME) to enable FEAT_RME
- New image called RMM. RMM is R-EL2 firmware that manages Realms.
When building TF-A, a path to RMM image can be specified using
the "RMM" build flag. If RMM image is not provided, TRP is built
by default and used as RMM image.
- Support for RMM image in fiptool
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I017c23ef02e465a5198baafd665a60858ecd1b25
The current Makefile assumes all TF-A binaries
have BL prefixes (BL1, BL2, etc). Now that we
have other binary names with FEAT_RME feature, remove
this assumption. With this change, we need to pass
the full name of a binary when using build macros.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I44e094b2366aa526f807d92dffa709390d14d145
This patch adds a new context for realm world and realm world
awareness in context management.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Signed-off-by: Subhasish Ghosh <subhasish.ghosh@arm.com>
Change-Id: Ic17469393603e789d7adc025880346bc3d6233d7
TRP is a small test payload that implements Realm Monitor
Management (RMM) functionalities. RMM runs in the Realm world
(R-EL2) and manages the execution of Realm VMs and their
interaction with the hypervisor in Normal world.
TRP is used to test the interface between RMM and Normal world
software, known as Realm Management Interface (RMI). Current
functions includes returning RMM version and transitioning
granules from Non-secure to Realm world and vice versa.
More information about RMM can be found at:
https://developer.arm.com/documentation/den0125/latest
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Ic7b9a1e1f3142ef6458d40150d0b4ba6bd723ea2
This patch introduces the RMM dispatcher into BL31. This
will be the mechanism that will enable communication to
take place between the Realm and non-secure world. Currently
gives the capability for granules to be
transitioned from non-secure type to realm and vice versa.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Signed-off-by: Subhasish Ghosh <subhasish.ghosh@arm.com>
Change-Id: I1fdc99a4bdd42bc14911aa0c6954b131de309511
* changes:
feat(plat/rcar3): keep RWDT enabled
feat(drivers/rcar3): add extra offset if booting B-side
feat(plat/rcar3): modify LifeC register setting for R-Car D3
feat(plat/rcar3): modify SWDT counter setting for R-Car D3
feat(plat/rcar3): update DDR setting for R-Car D3
feat(plat/rcar3): remove access to RMSTPCRn registers in R-Car D3
feat(plat/rcar3): add process of SSCG setting for R-Car D3
feat(plat/rcar3): add process to back up X6 and X7 register's value
feat(plat/rcar3): modify operation register from SYSCISR to SYSCISCR
feat(plat/rcar3): add SYSCEXTMASK bit set/clear in scu_power_up
feat(plat/rcar3): change the memory map for OP-TEE
feat(plat/rcar3): use PRR cut to determine DRAM size on M3
feat(plat/rcar3): apply ERRATA_A53_1530924 and ERRATA_A57_1319537
fix(plat/rcar3): fix disabling MFIS write protection for R-Car D3
fix(plat/rcar3): fix eMMC boot support for R-Car D3
fix(plat/rcar3): fix version judgment for R-Car D3
fix(plat/rcar3): fix source file to make about GICv2
fix(drivers/rcar3): console: fix a return value of console_rcar_init
The latest FVP model fix which correctly checks if IRQs
are enabled in current exception level, is causing TFTF
tests to hang.
This patch adds setting SCR_EL3.I and SCR_EL3.F bits in
'fvp_cpu_standby()' function to allow CPU to exit from WFI.
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
Change-Id: Iceec1e9dbd805803d370ecdb10e04ad135d6b3aa
This patch enables BL2 to run in root world (EL3) which is
needed as per the security model of RME-enabled systems.
Using the existing BL2_AT_EL3 TF-A build option is not convenient
because that option assumes TF-A BL1 doesn't exist, which is not
the case for RME-enabled systems. For the purposes of RME, we use
a normal BL1 image but we also want to run BL2 in EL3 as normally as
possible, therefore rather than use the special bl2_entrypoint
function in bl2_el3_entrypoint.S, we use a new bl2_entrypoint
function (in bl2_rme_entrypoint.S) which doesn't need reset or
mailbox initialization code seen in the el3_entrypoint_common macro.
The patch also cleans up bl2_el3_entrypoint.S, moving the
bl2_run_next_image function to its own file to avoid duplicating
code.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I99821b4cd550cadcb701f4c0c4dc36da81c7ef55
FEAT_RME adds a new bit (NSE) in the translation table descriptor
to determine the Physical Address Space (PAS) of an EL3 stage 1
translation according to the following mapping:
TTD.NSE TTD.NS | PAS
=================================
0 0 | Secure
0 1 | Non-secure
1 0 | Root
1 1 | Realm
This patch adds modifications to version 2 of the translation table
library accordingly. Bits 4 and 5 in mmap attribute are used to
determine the PAS.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I82790f6900b7a1ab9494c732eac7b9808a388103
For convenience we let the build system generate an ELF file (named
bl31.axf), containing all the trampolines, BL31 code and the DTB in one
file. This can be fed directly into the FPGA payload tool, and it will
load the bits at the right addresses.
Since this ELF file is more used as a "container with load addresses",
there is no need for normal ELF features like alignment or a symbol
table.
Remove unnecessary sections from that output file, by doing a static
"link", dropping the NOBITS stacks section, and by adding "-n" to the
linker command line (to avoid page alignment). This trims the generated
.axf file, and makes it smaller.
Change-Id: I5768543101d667fb4a3b70e60b08cfe970d2a2b6
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
The arm64 Linux kernel needed to be loaded at a certain offset within any
2MB aligned region; this value was configured at compile time and stored
in the Linux kernel image header. The default value was always 512KiB,
so this is the value we use in the TF-A build system for the kernel
load address.
However the whole scheme around the TEXT_OFFSET changed in Linux v5.8:
Linux kernels became fully relocatable, so this value is largely ignored
now, and its default value changed to 0. The only remainder is a warning
message at boot time in case there is a mismatch:
[Firmware Bug]: Kernel image misaligned at boot, please fix your bootloader!
To avoid this warning, and to make TF-A Linux kernel boot protocol
compliant, we should load newer kernels to offset 0 of a 2 MB
region. This can be done by the user at FPGA boot time, but BL31 needs
to know about this address. As we can't change the build default to 0
without breaking older kernels, we should try to make a build dealing
with both versions:
This patch introduces a small trampoline code, which gets loaded at
512KB of DRAM, and branches up to 2MB. If users load their newer
kernels at 2MB, this trampoline will cover them. In case an older kernel
is loaded at 512KB, it will overwrite this trampoline code, so it would
still work.
Change-Id: If49ca86f5dca380036caf2555349748722901277
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
* changes:
feat(plat/imx/imx8m/imx8mp): enable Trusted Boot
feat(plat/imx/imx8m/imx8mp): add in BL2 with FIP
refactor(plat/imx/imx8m): make image load logic for TBBR FIP booting common
feat(plat/imx/imx8m/imx8mp): add initial definition to facilitate FIP layout
refactor(plat/imx/imx): make imx io-storage logic for TBBR/FIP common
feat(plat/imx/imx8m/imx8mp): add imx8mp_private.h to the build
This issue was found with Clang compiler:
lib/xlat_tables_v2/aarch32/xlat_tables_arch.c:206:34:
error: result of comparison of constant 4294967296 with expression
of type 'uintptr_t' (aka 'unsigned long') is always true
[-Werror,-Wtautological-constant-out-of-range-compare]
assert(virtual_addr_space_size <=
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~
On AARCH32, MAX_VIRT_ADDR_SPACE_SIZE is defined as 1 << 32, and a 32 bit
uintptr_t is always lower.
Just remove the assert line.
Change-Id: Iec2c05290cede6e9fedbbf7b7dff2118bd1f9b16
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
* changes:
fix(drivers/marvell/comphy-cp110): fix error code in pcie power on
fix(drivers/marvell/comphy-3700): handle failures in power functions
fix(drivers/marvell/comphy-3700): fix address overflow
refactor(drivers/marvell/comphy-3700): simplify usage of comphy_sgmii_phy_init()
refactor(drivers/marvell/comphy-3700): simplify usage of indirect access on lane2
refactor(drivers/marvell/comphy-3700): simplify usage of sata power off
FEAT_RME introduces two additional security states,
Root and Realm security states. This patch adds Realm
security state awareness to SMCCC helpers and entry point info
structure.
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I9cdefcc1aa71259b2de46e5fb62b28d658fa59bd
Joanna Farley
Pankaj Gupta
Nicolas Le Bayon
Pascal Paillet
Yann Gautier
Yann Gautier
HE Shushan
Gabriel Fernandez
Etienne Carriere
Sandrine Bailleux
johpow01
Madhukar Pappireddy
Zelalem Aweke
Soby Mathew
Manish Pandey
Alexei Fedorov
André Przywara
Manish V Badarkhe