diff options
31 files changed, 929 insertions, 813 deletions
diff --git a/docs/design/cpu-specific-build-macros.rst b/docs/design/cpu-specific-build-macros.rst index bc277a72f..0a0d2f0fc 100644 --- a/docs/design/cpu-specific-build-macros.rst +++ b/docs/design/cpu-specific-build-macros.rst @@ -281,6 +281,12 @@ For Cortex-A78, the following errata build flags are defined : - ``ERRATA_A78_1821534``: This applies errata 1821534 workaround to Cortex-A78 CPU. This needs to be enabled for revisions r0p0 and r1p0. +For Cortex-A78 AE, the following errata build flags are defined : + +- ``ERRATA_A78_AE_1951502`` : This applies errata 1951502 workaround to Cortex-A78 + AE CPU. This needs to be enabled for revisions r0p0 and r0p1. This erratum is + still open. + For Neoverse N1, the following errata build flags are defined : - ``ERRATA_N1_1073348``: This applies errata 1073348 workaround to Neoverse-N1 diff --git a/docs/plat/nvidia-tegra.rst b/docs/plat/nvidia-tegra.rst index 02ff38bef..391c7c815 100644 --- a/docs/plat/nvidia-tegra.rst +++ b/docs/plat/nvidia-tegra.rst @@ -19,7 +19,7 @@ The NVIDIA® Parker (T186) series system-on-chip (SoC) delivers a heterogeneous multi-processing (HMP) solution designed to optimize performance and efficiency. -T186 has Dual NVIDIA Denver 2 ARM® CPU cores, plus Quad ARM Cortex®-A57 cores, +T186 has Dual NVIDIA Denver2 ARM® CPU cores, plus Quad ARM Cortex®-A57 cores, in a coherent multiprocessor configuration. The Denver 2 and Cortex-A57 cores support ARMv8, executing both 64-bit Aarch64 code, and 32-bit Aarch32 code including legacy ARMv7 applications. The Denver 2 processors each have 128 KB @@ -29,20 +29,6 @@ Data Level 1 caches; and also have a 2 MB shared Level 2 unified cache. A high speed coherency fabric connects these two processor complexes and allows heterogeneous multi-processing with all six cores if required. -- .. rubric:: T210 - :name: t210 - -T210 has Quad Arm® Cortex®-A57 cores in a switched configuration with a -companion set of quad Arm Cortex-A53 cores. The Cortex-A57 and A53 cores -support Armv8-A, executing both 64-bit Aarch64 code, and 32-bit Aarch32 code -including legacy Armv7-A applications. The Cortex-A57 processors each have -48 KB Instruction and 32 KB Data Level 1 caches; and have a 2 MB shared -Level 2 unified cache. The Cortex-A53 processors each have 32 KB Instruction -and 32 KB Data Level 1 caches; and have a 512 KB shared Level 2 unified cache. - -- .. rubric:: T132 - :name: t132 - Denver is NVIDIA's own custom-designed, 64-bit, dual-core CPU which is fully Armv8-A architecture compatible. Each of the two Denver cores implements a 7-way superscalar microarchitecture (up to 7 concurrent @@ -68,6 +54,17 @@ Denver also features new low latency power-state transitions, in addition to extensive power-gating and dynamic voltage and clock scaling based on workloads. +- .. rubric:: T210 + :name: t210 + +T210 has Quad Arm® Cortex®-A57 cores in a switched configuration with a +companion set of quad Arm Cortex-A53 cores. The Cortex-A57 and A53 cores +support Armv8-A, executing both 64-bit Aarch64 code, and 32-bit Aarch32 code +including legacy Armv7-A applications. The Cortex-A57 processors each have +48 KB Instruction and 32 KB Data Level 1 caches; and have a 2 MB shared +Level 2 unified cache. The Cortex-A53 processors each have 32 KB Instruction +and 32 KB Data Level 1 caches; and have a 512 KB shared Level 2 unified cache. + Directory structure ------------------- @@ -89,7 +86,6 @@ their dispatchers in the image without changing any makefiles. These are the supported Trusted OS' by Tegra platforms. -- Tegra132: TLK - Tegra210: TLK and Trusty - Tegra186: Trusty - Tegra194: Trusty @@ -110,7 +106,7 @@ Preparing the BL31 image to run on Tegra SoCs .. code:: shell CROSS_COMPILE=<path-to-aarch64-gcc>/bin/aarch64-none-elf- make PLAT=tegra \ - TARGET_SOC=<target-soc e.g. t194|t186|t210|t132> SPD=<dispatcher e.g. trusty|tlkd> + TARGET_SOC=<target-soc e.g. t194|t186|t210> SPD=<dispatcher e.g. trusty|tlkd> bl31 Platforms wanting to use different TZDRAM\_BASE, can add ``TZDRAM_BASE=<value>`` diff --git a/docs/resources/diagrams/plantuml/spm_dfd.puml b/docs/resources/diagrams/plantuml/spm_dfd.puml new file mode 100644 index 000000000..ad4996ec6 --- /dev/null +++ b/docs/resources/diagrams/plantuml/spm_dfd.puml @@ -0,0 +1,82 @@ +/' + ' Copyright (c) 2021, Arm Limited. All rights reserved. + ' + ' SPDX-License-Identifier: BSD-3-Clause + '/ + +/' +TF-A SPMC Data Flow Diagram +'/ + +@startuml +digraph tfa_dfd { + + # Allow arrows to end on cluster boundaries + compound=true + + # Default settings for edges and nodes + edge [minlen=2 color="#8c1b07"] + node [fillcolor="#ffb866" style=filled shape=box fixedsize=true width=1.6 height=0.7] + + # Nodes outside of the trust boundary + nsec [label="NS Client"] + ddr [label="External memory (DDR)"] + + # Trust boundary cluster + subgraph cluster_trusted { + graph [style=dashed color="#f22430"] + + # HW IPs cluster + subgraph cluster_ip { + label ="Hardware IPs"; + graph [style=filled color="#000000" fillcolor="#ffd29e"] + + rank="same" + gic [label="GIC" width=1.2 height=0.5] + smmu [label="SMMU" width=1.2 height=0.5] + uart [label="UART" width=1.2 height=0.5] + pe [label="PE" width=1.2 height=0.5] + } + + # TF-A cluster + subgraph cluster_tfa { + label ="EL3 monitor"; + graph [style=filled color="#000000" fillcolor="#faf9cd"] + + bl31 [label="BL31" fillcolor="#ddffb3"]; + spmd [label="SPMD" fillcolor="#ddffb3" height=1] + } + + # SPMC cluster + subgraph cluster_spmc { + label ="SPMC"; + graph [style=filled color="#000000" fillcolor="#faf9cd"] + + spmc [label="SPMC" fillcolor="#ddffb3" height=1] + } + bl2 [label="BL2" width=1.2 height=0.5] + } + + # Secure Partitions cluster + subgraph cluster_sp { + label ="Secure Partitions"; + graph [style=filled color="#000000" fillcolor="#faf9cd"] + + sp1 [label="SP1" fillcolor="#ddffb3" height=1] + sp2 [label="SP2" fillcolor="#ddffb3" height=1] + spn [label="SP..." fillcolor="#ddffb3" height=1] + } + + # Interactions between nodes + sp1 -> spmc [dir="both" label="DF1"] + spmc -> spmd [dir="both" label="DF2"] + spmd -> nsec [dir="both" label="DF3"] + sp1 -> sp2 [dir="both" label="DF4"] + spmc -> smmu [lhead=cluster_spmc label="DF5"] + bl2 -> spmc [lhead=cluster_spmc label="DF6"] + bl2 -> spn [lhead=cluster_spmc label="DF6"] + sp1 -> ddr [dir="both" label="DF7"] + spmc -> ddr [dir="both" label="DF7"] +} + +@enduml diff --git a/docs/resources/diagrams/spm-threat-model-trust-boundaries.png b/docs/resources/diagrams/spm-threat-model-trust-boundaries.png Binary files differnew file mode 100644 index 000000000..58898c531 --- /dev/null +++ b/docs/resources/diagrams/spm-threat-model-trust-boundaries.png diff --git a/docs/threat_model/index.rst b/docs/threat_model/index.rst index e8f09b928..b5ede6900 100644 --- a/docs/threat_model/index.rst +++ b/docs/threat_model/index.rst @@ -1,5 +1,12 @@ Threat Model -============= +============ + +Threat modeling is an important part of Secure Development Lifecycle (SDL) +that helps us identify potential threats and mitigations affecting a system. + +In the next sections, we first give a description of the target of evaluation +using a data flow diagram. Then we provide a list of threats we have identified +based on the data flow diagram and potential threat mitigations. .. toctree:: :maxdepth: 1 @@ -7,6 +14,7 @@ Threat Model :numbered: threat_model + threat_model_spm -------------- diff --git a/docs/threat_model/threat_model.rst b/docs/threat_model/threat_model.rst index 9cee10415..9f26487e9 100644 --- a/docs/threat_model/threat_model.rst +++ b/docs/threat_model/threat_model.rst @@ -1,13 +1,10 @@ -***************** -Introduction -***************** -Threat modeling is an important part of Secure Development Lifecycle (SDL) -that helps us identify potential threats and mitigations affecting a system. +Generic threat model +******************** -This document provides a generic threat model for TF-A firmware. In the -next sections, we first give a description of the target of evaluation -using a data flow diagram. Then we provide a list of threats we have -identified based on the data flow diagram and potential threat mitigations. +************************ +Introduction +************************ +This document provides a generic threat model for TF-A firmware. ************************ Target of Evaluation @@ -781,4 +778,4 @@ each diagram element of the data flow diagram. .. _Trusted Board Boot (TBB): https://trustedfirmware-a.readthedocs.io/en/latest/design/trusted-board-boot.html .. _TF-A error handling policy: https://trustedfirmware-a.readthedocs.io/en/latest/process/coding-guidelines.html#error-handling-and-robustness .. _Secure Development Guidelines: https://trustedfirmware-a.readthedocs.io/en/latest/process/security-hardening.html#secure-development-guidelines -.. _Trusted Firmware-A Tests: https://git.trustedfirmware.org/TF-A/tf-a-tests.git/about/
\ No newline at end of file +.. _Trusted Firmware-A Tests: https://git.trustedfirmware.org/TF-A/tf-a-tests.git/about/ diff --git a/docs/threat_model/threat_model_spm.rst b/docs/threat_model/threat_model_spm.rst new file mode 100644 index 000000000..96d33a2f3 --- /dev/null +++ b/docs/threat_model/threat_model_spm.rst @@ -0,0 +1,617 @@ +SPMC threat model +***************** + +************************ +Introduction +************************ +This document provides a threat model for the TF-A `Secure Partition Manager`_ +(SPM) implementation or more generally the S-EL2 reference firmware running on +systems implementing the FEAT_SEL2 (formerly Armv8.4 Secure EL2) architecture +extension. The SPM implementation is based on the `Arm Firmware Framework for +Armv8-A`_ specification. + +In brief, the broad FF-A specification and S-EL2 firmware implementation +provide: + +- Isolation of mutually mistrusting SW components, or endpoints in the FF-A + terminology. +- Distinct sandboxes in the secure world called secure partitions. This permits + isolation of services from multiple vendors. +- A standard protocol for communication and memory sharing between FF-A + endpoints. +- Mutual isolation of the normal world and the secure world (e.g. a Trusted OS + is prevented to map an arbitrary NS physical memory region such as the kernel + or the Hypervisor). + +************************ +Target of Evaluation +************************ +In this threat model, the target of evaluation is the S-EL2 firmware or the +``Secure Partition Manager Core`` component (SPMC). +The monitor and SPMD at EL3 are covered by the `Generic TF-A threat model`_. + +The scope for this threat model is: + +- The TF-A implementation for the S-EL2 SPMC based on the Hafnium hypervisor + running in the secure world of TrustZone (at S-EL2 exception level). + The threat model is not related to the normal world Hypervisor or VMs. + The S-EL1 SPMC solution is not covered. +- The implementation complies with the FF-A v1.0 specification. +- Secure partitions are statically provisioned at boot time. +- Focus on the run-time part of the life-cycle (no specific emphasis on boot + time, factory firmware provisioning, firmware udpate etc.) +- Not covering advanced or invasive physical attacks such as decapsulation, + FIB etc. +- Assumes secure boot or in particular TF-A trusted boot (TBBR or dual CoT) is + enabled. An attacker cannot boot arbitrary images that are not approved by the + SiP or platform providers. + +Data Flow Diagram +====================== +Figure 1 shows a high-level data flow diagram for the SPM split into an SPMD +component at EL3 and an SPMC component at S-EL2. The SPMD mostly acts as a +relayer/pass-through between the normal world and the secure world. It is +assumed to expose small attack surface. + +A description of each diagram element is given in Table 1. In the diagram, the +red broken lines indicate trust boundaries. + +Components outside of the broken lines are considered untrusted. + +.. uml:: ../resources/diagrams/plantuml/spm_dfd.puml + :caption: Figure 1: SPMC Data Flow Diagram + +.. table:: Table 1: SPMC Data Flow Diagram Description + + +---------------------+--------------------------------------------------------+ + | Diagram Element | Description | + +=====================+========================================================+ + | ``DF1`` | SP to SPMC communication. FF-A function invocation or | + | | implementation-defined Hypervisor call. | + +---------------------+--------------------------------------------------------+ + | ``DF2`` | SPMC to SPMD FF-A call. | + +---------------------+--------------------------------------------------------+ + | ``DF3`` | SPMD to NS forwarding. | + +---------------------+--------------------------------------------------------+ + | ``DF4`` | SP to SP FF-A direct message request/response. | + | | Note as a matter of simplifying the diagram | + | | the SP to SP communication happens through the SPMC | + | | (SP1 performs a direct message request to the | + | | SPMC targeting SP2 as destination. And similarly for | + | | the direct message response from SP2 to SP1). | + +---------------------+--------------------------------------------------------+ + | ``DF5`` | HW control. | + +---------------------+--------------------------------------------------------+ + | ``DF6`` | Bootloader image loading. | + +---------------------+--------------------------------------------------------+ + | ``DF7`` | External memory access. | + +---------------------+--------------------------------------------------------+ + +********************* +Threat Analysis +********************* + +This threat model follows a similar methodology to the `Generic TF-A threat model`_. +The following sections define: + +- Trust boundaries +- Assets +- Theat agents +- Threat types + +Trust boundaries +============================ + +- Normal world is untrusted. +- Secure world and normal world are separate trust boundaries. +- EL3 monitor, SPMD and SPMC are trusted. +- Bootloaders (in particular BL1/BL2 if using TF-A) and run-time BL31 are + implicitely trusted by the usage of secure boot. +- EL3 monitor, SPMD, SPMC do not trust SPs. + +.. figure:: ../resources/diagrams/spm-threat-model-trust-boundaries.png + + Figure 2: Trust boundaries + +Assets +============================ + +The following assets are identified: + +- SPMC state. +- SP state. +- Information exchange between endpoints (partition messages). +- SPMC secrets (e.g. pointer authentication key when enabled) +- SP secrets (e.g. application keys). +- Scheduling cycles. +- Shared memory. + +Threat Agents +============================ + +The following threat agents are identified: + +- NS-Endpoint identifies a non-secure endpoint: normal world client at NS-EL2 + (Hypervisor) or NS-EL1 (VM or OS kernel). +- S-Endpoint identifies a secure endpoint typically a secure partition. +- Hardware attacks (non-invasive) requiring a physical access to the device, + such as bus probing or DRAM stress. + +Threat types +============================ + +The following threat categories as exposed in the `Generic TF-A threat model`_ +are re-used: + +- Spoofing +- Tampering +- Repudiation +- Information disclosure +- Denial of service +- Elevation of privileges + +Similarly this threat model re-uses the same threat risk ratings. The risk +analysis is evaluated based on the environment being ``Server`` or ``Mobile``. + +Threat Assessment +============================ + +The following threats are identified by applying STRIDE analysis on each diagram +element of the data flow diagram. + ++------------------------+----------------------------------------------------+ +| ID | 01 | ++========================+====================================================+ +| ``Threat`` | **An endpoint impersonates the sender or receiver | +| | FF-A ID in a direct request/response invocation.** | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMD, SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SP state | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Spoofing | ++------------------------+------------------+-----------------+---------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------++----------------+---------------+ +| ``Impact`` | Critical(5) | Critical(5) | | ++------------------------+------------------++----------------+---------------+ +| ``Likelihood`` | Critical(5) | Critical(5) | | ++------------------------+------------------++----------------+---------------+ +| ``Total Risk Rating`` | Critical(25) | Critical(25) | | ++------------------------+------------------+-----------------+---------------+ +| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | +| | The guidance below is left for a system integrator | +| | to implemented as necessary. | +| | The SPMC must enforce checks in the direct message | +| | request/response interfaces such an endpoint cannot| +| | spoof the origin and destination worlds (e.g. a NWd| +| | originated message directed to the SWd cannot use a| +| | SWd ID as the sender ID). | +| | Additionally a software component residing in the | +| | SPMC can be added for the purpose of direct | +| | request/response filtering. | +| | It can be configured with the list of known IDs | +| | and about which interaction can occur between one | +| | and another endpoint (e.g. which NWd endpoint ID | +| | sends a direct request to which SWd endpoint ID). | +| | This component checks the sender/receiver fields | +| | for a legitimate communication between endpoints. | +| | A similar component can exist in the OS kernel | +| | driver, or Hypervisor although it remains untrusted| +| | by the SPMD/SPMC. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 02 | ++========================+====================================================+ +| ``Threat`` | **Tampering with memory shared between an endpoint | +| | and the SPMC.** | +| | A malicious endpoint may attempt tampering with its| +| | RX/TX buffer contents while the SPMC is processing | +| | it (TOCTOU). | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF1, DF3, DF4, DF7 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | Shared memory, Information exchange | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Tampering | ++------------------------+------------------+-----------------+---------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+-----------------+---------------+ +| ``Impact`` | High (4) | High (4) | | ++------------------------+------------------+-----------------+---------------+ +| ``Likelihood`` | High (4) | High (4) | | ++------------------------+------------------+-----------------+---------------+ +| ``Total Risk Rating`` | High (16) | High (16) | | ++------------------------+------------------+-----------------+---------------+ +| ``Mitigations`` | In context of FF-A v1.0 this is the case of sharing| +| | the RX/TX buffer pair and usage in the | +| | PARTITION_INFO_GET or mem sharing primitives. | +| | The SPMC must copy the contents of the TX buffer | +| | to an internal temporary buffer before processing | +| | its contents. The SPMC must implement hardened | +| | input validation on data transmitted through the TX| +| | buffer by an untrusted endpoint. | +| | The TF-A SPMC mitigates this threat by enforcing | +| | checks on data transmitted through RX/TX buffers. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 03 | ++========================+====================================================+ +| ``Threat`` | **An endpoint may tamper with its own state or the | +| | state of another endpoint.** | +| | A malicious endpoint may attempt violating: | +| | - its own or another SP state by using an unusual | +| | combination (or out-of-order) FF-A function | +| | invocations. | +| | This can also be an endpoint emitting | +| | FF-A function invocations to another endpoint while| +| | the latter in not in a state to receive it (e.g. a | +| | SP sends a direct request to the normal world early| +| | while the normal world is not booted yet). | +| | - the SPMC state itself by employing unexpected | +| | transitions in FF-A memory sharing, direct requests| +| | and responses, or handling of interrupts. | +| | This can be led by random stimuli injection or | +| | fuzzing. | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMD, SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SP state, SPMC state | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Tampering | ++------------------------+------------------+-----------------+---------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+-----------------+---------------+ +| ``Impact`` | High (4) | High (4) | | ++------------------------+------------------+-----------------+---------------+ +| ``Likelihood`` | Medium (3) | Medium (3) | | ++------------------------+------------------+-----------------+---------------+ +| ``Total Risk Rating`` | High (12) | High (12) | | ++------------------------+------------------+-----------------+---------------+ +| ``Mitigations`` | The SPMC may be vulnerable to invalid state | +| | transitions for itself or while handling an SP | +| | state. The FF-A v1.1 specification provides a | +| | guidance on those state transitions (run-time | +| | model). The TF-A SPMC will be hardened in future | +| | releases to follow this guidance. | +| | Additionally The TF-A SPMC mitigates the threat by | +| | runs of the Arm `FF-A ACS`_ compliance test suite. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 04 | ++========================+====================================================+ +| ``Threat`` | *An attacker may attempt injecting errors by the | +| | use of external DRAM stress techniques.** | +| | A malicious agent may attempt toggling an SP | +| | Stage-2 MMU descriptor bit within the page tables | +| | that the SPMC manages. This can happen in Rowhammer| +| | types of attack. | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF7 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SP or SPMC state | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | Hardware attack | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Tampering | ++------------------------+------------------+---------------+-----------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+---------------+-----------------+ +| ``Impact`` | High (4) | High (4) | | ++------------------------+------------------+---------------+-----------------+ +| ``Likelihood`` | Low (2) | Medium (3) | | ++------------------------+------------------+---------------+-----------------+ +| ``Total Risk Rating`` | Medium (8) | High (12) | | ++------------------------+------------------+---------------+-----------------+ +| ``Mitigations`` | The TF-A SPMC does not provide mitigations to this | +| | type of attack. It can be addressed by the use of | +| | dedicated HW circuity or hardening at the chipset | +| | or platform level left to the integrator. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 05 | ++========================+====================================================+ +| ``Threat`` | **Protection of the SPMC from a DMA capable device | +| | upstream to an SMMU.** | +| | A device may attempt to tamper with the internal | +| | SPMC code/data sections. | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF5 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SPMC or SP state | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Tampering, Elevation of privileges | ++------------------------+------------------+---------------+-----------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+---------------+-----------------+ +| ``Impact`` | High (4) | High (4) | | ++------------------------+------------------+---------------+-----------------+ +| ``Likelihood`` | Medium (3) | Medium (3) | | ++------------------------+------------------+---------------+-----------------+ +| ``Total Risk Rating`` | High (12) | High (12) | | ++------------------------+------------------+---------------+-----------------+ +| ``Mitigations`` | A platform may prefer assigning boot time, | +| | statically alocated memory regions through the SMMU| +| | configuration and page tables. The FF-A v1.1 | +| | specification provisions this capability through | +| | static DMA isolation. | +| | The TF-A SPMC does not mitigate this threat. | +| | It will adopt the static DMA isolation approach in | +| | a future release. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 06 | ++========================+====================================================+ +| ``Threat`` | **Replay fragments of past communication between | +| | endpoints.** | +| | A malicious endpoint may replay a message exchange | +| | that occured between two legitimate endpoint as | +| | a matter of triggering a malfunction or extracting | +| | secrets from the receiving endpoint. In particular | +| | the memory sharing operation with fragmented | +| | messages between an endpoint and the SPMC may be | +| | replayed by a malicious agent as a matter of | +| | getting access or gaining permissions to a memory | +| | region which does not belong to this agent. | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF2, DF3 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | Information exchange | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Repdudiation | ++------------------------+------------------+---------------+-----------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+---------------+-----------------+ +| ``Impact`` | Medium (3) | Medium (3) | | ++------------------------+------------------+---------------+-----------------+ +| ``Likelihood`` | High (4) | High (4) | | ++------------------------+------------------+---------------+-----------------+ +| ``Total Risk Rating`` | High (12) | High (12) | | ++------------------------+------------------+---------------+-----------------+ +| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 07 | ++========================+====================================================+ +| ``Threat`` | **A malicious endpoint may attempt to extract data | +| | or state information by the use of invalid or | +| | incorrect input arguments.** | +| | Lack of input parameter validation or side effects | +| | of maliciously forged input parameters might affect| +| | the SPMC. | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMD, SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SP secrets, SPMC secrets, SP state, SPMC state | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Information discolure | ++------------------------+------------------+---------------+-----------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+---------------+-----------------+ +| ``Impact`` | High (4) | High (4) | | ++------------------------+------------------+---------------+-----------------+ +| ``Likelihood`` | Medium (3) | Medium (3) | | ++------------------------+------------------+---------------+-----------------+ +| ``Total Risk Rating`` | High (12) | High (12) | | ++------------------------+------------------+---------------+-----------------+ +| ``Mitigations`` | Secure Partitions must follow security standards | +| | and best practises as a way to mitigate the risk | +| | of common vulnerabilities to be exploited. | +| | The use of software (canaries) or hardware | +| | hardening techniques (XN, WXN, BTI, pointer | +| | authentication, MTE) helps detecting and stopping | +| | an exploitation early. | +| | The TF-A SPMC mitigates this threat by implementing| +| | stack protector, pointer authentication, BTI, XN, | +| | WXN, security hardening techniques. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 08 | ++========================+====================================================+ +| ``Threat`` | **A malicious endpoint may forge a direct message | +| | request such that it reveals the internal state of | +| | another endpoint through the direct message | +| | response.** | +| | The secure partition or SPMC replies to a partition| +| | message by a direct message response with | +| | information which may reveal its internal state | +| | (.e.g. partition message response outside of | +| | allowed bounds). | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SPMC or SP state | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Information discolure | ++------------------------+------------------+---------------+-----------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+---------------+-----------------+ +| ``Impact`` | Medium (3) | Medium (3) | | ++------------------------+------------------+---------------+-----------------+ +| ``Likelihood`` | Low (2) | Low (2) | | ++------------------------+------------------+---------------+-----------------+ +| ``Total Risk Rating`` | Medium (6) | Medium (6) | | ++------------------------+------------------+---------------+-----------------+ +| ``Mitigations`` | For the specific case of direct requests targetting| +| | the SPMC, the latter is hardened to prevent | +| | its internal state or the state of an SP to be | +| | revealed through a direct message response. | +| | Further FF-A v1.1 guidance about run time models | +| | and partition states will be implemented in future | +| | TF-A SPMC releases. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 09 | ++========================+====================================================+ +| ``Threat`` | **Probing the FF-A communication between | +| | endpoints.** | +| | SPMC and SPs are typically loaded to external | +| | memory (protected by a TrustZone memory | +| | controller). A malicious agent may use non invasive| +| | methods to probe the external memory bus and | +| | extract the traffic between an SP and the SPMC or | +| | among SPs when shared buffers are held in external | +| | memory. | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF7 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SP/SPMC state, SP/SPMC secrets | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | Hardware attack | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Information disclosure | ++------------------------+------------------+-----------------+---------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+-----------------+---------------+ +| ``Impact`` | Medium (3) | Medium (3) | | ++------------------------+------------------+-----------------+---------------+ +| ``Likelihood`` | Low (2) | Medium (3) | | ++------------------------+------------------+-----------------+---------------+ +| ``Total Risk Rating`` | Medium (6) | Medium (9) | | ++------------------------+------------------+-----------------+---------------+ +| ``Mitigations`` | It is expected the platform or chipset provides | +| | guarantees in protecting the DRAM contents. | +| | The TF-A SPMC does not mitigate this class of | +| | attack and this is left to the integrator. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 10 | ++========================+====================================================+ +| ``Threat`` | **A malicious agent may attempt revealing the SPMC | +| | state or secrets by the use of software-based cache| +| | side-channel attack techniques.** | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF7 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SP or SPMC state | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Information disclosure | ++------------------------+------------------+-----------------+---------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+-----------------+---------------+ +| ``Impact`` | Medium (3) | Medium (3) | | ++------------------------+------------------+-----------------+---------------+ +| ``Likelihood`` | Low (2) | Low (2) | | ++------------------------+------------------+-----------------+---------------+ +| ``Total Risk Rating`` | Medium (6) | Medium (6) | | ++------------------------+------------------+-----------------+---------------+ +| ``Mitigations`` | From an integration perspective it is assumed | +| | platforms consuming the SPMC component at S-EL2 | +| | (hence implementing the Armv8.4 FEAT_SEL2 | +| | architecture extension) implement mitigations to | +| | Spectre, Meltdown or other cache timing | +| | side-channel type of attacks. | +| | The TF-A SPMC implements one mitigation (barrier | +| | preventing speculation past exeception returns). | +| | The SPMC may be hardened further with SW | +| | mitigations (e.g. speculation barriers) for the | +| | cases not covered in HW. Usage of hardened | +| | compilers and appropriate options, code inspection | +| | are recommended ways to mitigate Spectre types of | +| | attacks. For non-hardened cores, the usage of | +| | techniques such a kernel page table isolation can | +| | help mitigating Meltdown type of attacks. | ++------------------------+----------------------------------------------------+ + ++------------------------+----------------------------------------------------+ +| ID | 11 | ++========================+====================================================+ +| ``Threat`` | **A malicious endpoint may attempt flooding the | +| | SPMC with requests targetting a service within an | +| | endpoint such that it denies another endpoint to | +| | access this service.** | +| | Similarly, the malicious endpoint may target a | +| | a service within an endpoint such that the latter | +| | is unable to request services from another | +| | endpoint. | ++------------------------+----------------------------------------------------+ +| ``Diagram Elements`` | DF1, DF2, DF3, DF4 | ++------------------------+----------------------------------------------------+ +| ``Affected TF-A | SPMC | +| Components`` | | ++------------------------+----------------------------------------------------+ +| ``Assets`` | SPMC state | ++------------------------+----------------------------------------------------+ +| ``Threat Agent`` | NS-Endpoint, S-Endpoint | ++------------------------+----------------------------------------------------+ +| ``Threat Type`` | Denial of service | ++------------------------+------------------+-----------------+---------------+ +| ``Application`` | ``Server`` | ``Mobile`` | | ++------------------------+------------------+-----------------+---------------+ +| ``Impact`` | Medium (3) | Medium (3) | | ++------------------------+------------------+-----------------+---------------+ +| ``Likelihood`` | Medium (3) | Medium (3) | | ++------------------------+------------------+-----------------+---------------+ +| ``Total Risk Rating`` | Medium (9) | Medium (9) | | ++------------------------+------------------+-----------------+---------------+ +| ``Mitigations`` | The TF-A SPMC does not mitigate this threat. | +| | Bounding the time for operations to complete can | +| | be achieved by the usage of a trusted watchdog. | +| | Other quality of service monitoring can be achieved| +| | in the SPMC such as counting a number of operations| +| | in a limited timeframe. | ++------------------------+----------------------------------------------------+ + +-------------- + +*Copyright (c) 2021, Arm Limited. All rights reserved.* + +.. _Arm Firmware Framework for Armv8-A: https://developer.arm.com/docs/den0077/latest +.. _Secure Partition Manager: ../components/secure-partition-manager.html +.. _Generic TF-A threat model: ./threat_model.html#threat-analysis +.. _FF-A ACS: https://github.com/ARM-software/ff-a-acs/releases diff --git a/include/lib/el3_runtime/cpu_data.h b/include/lib/el3_runtime/cpu_data.h index 54261358e..3d57a5c59 100644 --- a/include/lib/el3_runtime/cpu_data.h +++ b/include/lib/el3_runtime/cpu_data.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014-2019, ARM Limited and Contributors. All rights reserved. + * Copyright (c) 2014-2021, ARM Limited and Contributors. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -125,7 +125,7 @@ extern cpu_data_t percpu_data[PLATFORM_CORE_COUNT]; #if ENABLE_PAUTH CASSERT(CPU_DATA_APIAKEY_OFFSET == __builtin_offsetof (cpu_data_t, apiakey), - assert_cpu_data_crash_stack_offset_mismatch); + assert_cpu_data_pauth_stack_offset_mismatch); #endif #if CRASH_REPORTING diff --git a/include/plat/common/platform.h b/include/plat/common/platform.h index 2d5c521db..434835ee7 100644 --- a/include/plat/common/platform.h +++ b/include/plat/common/platform.h @@ -141,6 +141,8 @@ int plat_sdei_validate_entry_point(uintptr_t ep, unsigned int client_mode); void plat_sdei_handle_masked_trigger(uint64_t mpidr, unsigned int intr); #endif +void plat_default_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *cookie, + void *handle, uint64_t flags); void plat_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *cookie, void *handle, uint64_t flags); diff --git a/lib/cpus/aarch64/cortex_a78_ae.S b/lib/cpus/aarch64/cortex_a78_ae.S index 9aff9ac85..c8cccf278 100644 --- a/lib/cpus/aarch64/cortex_a78_ae.S +++ b/lib/cpus/aarch64/cortex_a78_ae.S @@ -1,5 +1,6 @@ /* * Copyright (c) 2019-2020, ARM Limited. All rights reserved. + * Copyright (c) 2021, NVIDIA Corporation. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -16,12 +17,73 @@ #error "cortex_a78_ae must be compiled with HW_ASSISTED_COHERENCY enabled" #endif +/* -------------------------------------------------- + * Errata Workaround for A78 AE Erratum 1951502. + * This applies to revisions r0p0 and r0p1 of A78 AE. + * Inputs: + * x0: variant[4:7] and revision[0:3] of current cpu. + * Shall clobber: x0-x17 + * -------------------------------------------------- + */ +func errata_a78_ae_1951502_wa + /* Compare x0 against revisions r0p0 - r0p1 */ + mov x17, x30 + bl check_errata_1951502 + cbz x0, 1f + + msr S3_6_c15_c8_0, xzr + ldr x0, =0x10E3900002 + msr S3_6_c15_c8_2, x0 + ldr x0, =0x10FFF00083 + msr S3_6_c15_c8_3, x0 + ldr x0, =0x2001003FF + msr S3_6_c15_c8_1, x0 + + mov x0, #1 + msr S3_6_c15_c8_0, x0 + ldr x0, =0x10E3800082 + msr S3_6_c15_c8_2, x0 + ldr x0, =0x10FFF00083 + msr S3_6_c15_c8_3, x0 + ldr x0, =0x2001003FF + msr S3_6_c15_c8_1, x0 + + mov x0, #2 + msr S3_6_c15_c8_0, x0 + ldr x0, =0x10E3800200 + msr S3_6_c15_c8_2, x0 + ldr x0, =0x10FFF003E0 + msr S3_6_c15_c8_3, x0 + ldr x0, =0x2001003FF + msr S3_6_c15_c8_1, x0 + + isb +1: + ret x17 +endfunc errata_a78_ae_1951502_wa + +func check_errata_1951502 + /* Applies to revisions r0p0 and r0p1. */ + mov x1, #CPU_REV(0, 0) + mov x2, #CPU_REV(0, 1) + b cpu_rev_var_range +endfunc check_errata_1951502 + /* ------------------------------------------------- * The CPU Ops reset function for Cortex-A78-AE * ------------------------------------------------- */ -#if ENABLE_AMU func cortex_a78_ae_reset_func + mov x19, x30 + bl cpu_get_rev_var + mov x18, x0 + +#if ERRATA_A78_AE_1951502 + mov x0, x18 + bl errata_a78_ae_1951502_wa +#endif + +#if ENABLE_AMU /* Make sure accesses from EL0/EL1 and EL2 are not trapped to EL3 */ mrs x0, actlr_el3 bic x0, x0, #CORTEX_A78_ACTLR_TAM_BIT @@ -39,11 +101,12 @@ func cortex_a78_ae_reset_func /* Enable group1 counters */ mov x0, #CORTEX_A78_AMU_GROUP1_MASK msr CPUAMCNTENSET1_EL0, x0 +#endif + isb - ret + ret x19 endfunc cortex_a78_ae_reset_func -#endif /* ------------------------------------------------------- * HW will do the cache maintenance while powering down @@ -66,6 +129,18 @@ endfunc cortex_a78_ae_core_pwr_dwn */ #if REPORT_ERRATA func cortex_a78_ae_errata_report + stp x8, x30, [sp, #-16]! + + bl cpu_get_rev_var + mov x8, x0 + + /* + * Report all errata. The revision-variant information is passed to + * checking functions of each errata. + */ + report_errata ERRATA_A78_AE_1951502, cortex_a78_ae, 1951502 + + ldp x8, x30, [sp], #16 ret endfunc cortex_a78_ae_errata_report #endif @@ -89,12 +164,6 @@ func cortex_a78_ae_cpu_reg_dump ret endfunc cortex_a78_ae_cpu_reg_dump -#if ENABLE_AMU -#define A78_AE_RESET_FUNC cortex_a78_ae_reset_func -#else -#define A78_AE_RESET_FUNC CPU_NO_RESET_FUNC -#endif - declare_cpu_ops cortex_a78_ae, CORTEX_A78_AE_MIDR, \ - A78_AE_RESET_FUNC, \ + cortex_a78_ae_reset_func, \ cortex_a78_ae_core_pwr_dwn diff --git a/lib/cpus/cpu-ops.mk b/lib/cpus/cpu-ops.mk index 050a56e4f..b36616760 100644 --- a/lib/cpus/cpu-ops.mk +++ b/lib/cpus/cpu-ops.mk @@ -1,6 +1,6 @@ # # Copyright (c) 2014-2021, ARM Limited and Contributors. All rights reserved. -# Copyright (c) 2020, NVIDIA Corporation. All rights reserved. +# Copyright (c) 2020-2021, NVIDIA Corporation. All rights reserved. # # SPDX-License-Identifier: BSD-3-Clause # @@ -311,6 +311,10 @@ ERRATA_A78_1941498 ?=0 # well but there is no workaround for that revision. ERRATA_A78_1951500 ?=0 +# Flag to apply erratum 1951502 workaround during reset. This erratum applies +# to revisions r0p0 and r0p1 of the A78 AE cpu. It is still open. +ERRATA_A78_AE_1951502 ?=0 + # Flag to apply erratum 1821534 workaround during reset. This erratum applies # to revisions r0p0 and r1p0 of the A78 cpu. ERRATA_A78_1821534 ?=0 @@ -646,6 +650,10 @@ $(eval $(call add_define,ERRATA_A78_1941498)) $(eval $(call assert_boolean,ERRATA_A78_1951500)) $(eval $(call add_define,ERRATA_A78_1951500)) +# Process ERRATA_A78_AE_1951502 flag +$(eval $(call assert_boolean,ERRATA_A78_AE_1951502)) +$(eval $(call add_define,ERRATA_A78_AE_1951502)) + # Process ERRATA_A78_1821534 flag $(eval $(call assert_boolean,ERRATA_A78_1821534)) $(eval $(call add_define,ERRATA_A78_1821534)) diff --git a/plat/arm/board/arm_fpga/platform.mk b/plat/arm/board/arm_fpga/platform.mk index f1fd7773a..f80ea2fef 100644 --- a/plat/arm/board/arm_fpga/platform.mk +++ b/plat/arm/board/arm_fpga/platform.mk @@ -32,6 +32,8 @@ $(eval $(call add_define,FPGA_PRELOADED_DTB_BASE)) FPGA_PRELOADED_CMD_LINE := 0x1000 $(eval $(call add_define,FPGA_PRELOADED_CMD_LINE)) +ENABLE_AMU := 1 + # Treating this as a memory-constrained port for now USE_COHERENT_MEM := 0 diff --git a/plat/arm/board/diphda/platform.mk b/plat/arm/board/diphda/platform.mk index 5ff08620c..8b89cee7e 100644 --- a/plat/arm/board/diphda/platform.mk +++ b/plat/arm/board/diphda/platform.mk @@ -59,6 +59,13 @@ BL31_SOURCES += drivers/cfi/v2m/v2m_flash.c \ ${DIPHDA_CPU_LIBS} \ ${DIPHDA_GIC_SOURCES} +ifneq (${ENABLE_STACK_PROTECTOR},0) + ifneq (${ENABLE_STACK_PROTECTOR},none) + DIPHDA_SECURITY_SOURCES := plat/arm/board/diphda/common/diphda_stack_protector.c + BL2_SOURCES += ${DIPHDA_SECURITY_SOURCES} + BL31_SOURCES += ${DIPHDA_SECURITY_SOURCES} + endif +endif FDT_SOURCES += plat/arm/board/diphda/common/fdts/diphda_spmc_manifest.dts DIPHDA_TOS_FW_CONFIG := ${BUILD_PLAT}/fdts/diphda_spmc_manifest.dtb diff --git a/plat/common/aarch64/plat_common.c b/plat/common/aarch64/plat_common.c index 5b3262c7d..345fec36a 100644 --- a/plat/common/aarch64/plat_common.c +++ b/plat/common/aarch64/plat_common.c @@ -28,7 +28,7 @@ #pragma weak plat_sdei_validate_entry_point #endif -#pragma weak plat_ea_handler +#pragma weak plat_ea_handler = plat_default_ea_handler void bl31_plat_runtime_setup(void) { @@ -79,7 +79,7 @@ static const char *get_el_str(unsigned int el) #endif /* !ENABLE_BACKTRACE */ /* RAS functions common to AArch64 ARM platforms */ -void plat_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *cookie, +void plat_default_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *cookie, void *handle, uint64_t flags) { #if RAS_EXTENSION diff --git a/plat/marvell/armada/a3k/common/a3700_ea.c b/plat/marvell/armada/a3k/common/a3700_ea.c index dd46beb55..3a4f7203b 100644 --- a/plat/marvell/armada/a3k/common/a3700_ea.c +++ b/plat/marvell/armada/a3k/common/a3700_ea.c @@ -7,17 +7,15 @@ #include <common/bl_common.h> #include <common/debug.h> #include <arch_helpers.h> +#include <plat/common/platform.h> #define ADVK_SERROR_SYNDROME 0xbf000002 void plat_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *cookie, void *handle, uint64_t flags) { - if (syndrome != ADVK_SERROR_SYNDROME) { - ERROR("Unhandled External Abort received on 0x%lx at EL3!\n", - read_mpidr_el1()); - ERROR(" exception reason=%u syndrome=0x%llx\n", ea_reason, - syndrome); - panic(); - } + if (syndrome == ADVK_SERROR_SYNDROME) + return; + + plat_default_ea_handler(ea_reason, syndrome, cookie, handle, flags); } diff --git a/plat/nvidia/tegra/common/tegra_platform.c b/plat/nvidia/tegra/common/tegra_platform.c index 3894b7476..f3aa3eafd 100644 --- a/plat/nvidia/tegra/common/tegra_platform.c +++ b/plat/nvidia/tegra/common/tegra_platform.c @@ -1,6 +1,6 @@ /* * Copyright (c) 2016-2021, ARM Limited and Contributors. All rights reserved. - * Copyright (c) 2020, NVIDIA Corporation. All rights reserved. + * Copyright (c) 2020-2021, NVIDIA Corporation. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -82,13 +82,6 @@ static uint32_t tegra_get_chipid_pre_si_platform(void) return (tegra_get_chipid() >> PRE_SI_PLATFORM_SHIFT) & PRE_SI_PLATFORM_MASK; } -bool tegra_chipid_is_t132(void) -{ - uint32_t chip_id = ((tegra_get_chipid() >> CHIP_ID_SHIFT) & CHIP_ID_MASK); - - return (chip_id == TEGRA_CHIPID_TEGRA13); -} - bool tegra_chipid_is_t186(void) { uint32_t chip_id = (tegra_get_chipid() >> CHIP_ID_SHIFT) & CHIP_ID_MASK; diff --git a/plat/nvidia/tegra/include/t132/tegra_def.h b/plat/nvidia/tegra/include/t132/tegra_def.h deleted file mode 100644 index 6b87655e3..000000000 --- a/plat/nvidia/tegra/include/t132/tegra_def.h +++ /dev/null @@ -1,127 +0,0 @@ -/* - * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved. - * Copyright (c) 2020, NVIDIA Corporation. All rights reserved. - * - * SPDX-License-Identifier: BSD-3-Clause - */ - -#ifndef TEGRA_DEF_H -#define TEGRA_DEF_H - -#include <lib/utils_def.h> - -/******************************************************************************* - * Platform BL31 specific defines. - ******************************************************************************/ -#define BL31_SIZE U(0x40000) - -/******************************************************************************* - * This value is used by the PSCI implementation during the `SYSTEM_SUSPEND` - * call as the `state-id` field in the 'power state' parameter. - ******************************************************************************/ -#define PSTATE_ID_SOC_POWERDN U(0xD) - -/******************************************************************************* - * Platform power states (used by PSCI framework) - * - * - PLAT_MAX_RET_STATE should be less than lowest PSTATE_ID - * - PLAT_MAX_OFF_STATE should be greater than the highest PSTATE_ID - ******************************************************************************/ -#define PLAT_MAX_RET_STATE U(1) -#define PLAT_MAX_OFF_STATE (PSTATE_ID_SOC_POWERDN + U(1)) - -/******************************************************************************* - * Chip specific page table and MMU setup constants - ******************************************************************************/ -#define PLAT_PHY_ADDR_SPACE_SIZE (ULL(1) << 35) -#define PLAT_VIRT_ADDR_SPACE_SIZE (ULL(1) << 35) - -/******************************************************************************* - * GIC memory map - ******************************************************************************/ -#define TEGRA_GICD_BASE U(0x50041000) -#define TEGRA_GICC_BASE U(0x50042000) - -/******************************************************************************* - * Tegra micro-seconds timer constants - ******************************************************************************/ -#define TEGRA_TMRUS_BASE U(0x60005010) -#define TEGRA_TMRUS_SIZE U(0x1000) - -/******************************************************************************* - * Tegra Clock and Reset Controller constants - ******************************************************************************/ -#define TEGRA_CAR_RESET_BASE U(0x60006000) -#define TEGRA_GPU_RESET_REG_OFFSET U(0x28C) -#define TEGRA_GPU_RESET_GPU_SET_OFFSET U(0x290) -#define GPU_RESET_BIT (U(1) << 24) -#define GPU_SET_BIT (U(1) << 24) - -/******************************************************************************* - * Tegra Flow Controller constants - ******************************************************************************/ -#define TEGRA_FLOWCTRL_BASE U(0x60007000) - -/******************************************************************************* - * Tegra Secure Boot Controller constants - ******************************************************************************/ -#define TEGRA_SB_BASE U(0x6000C200) - -/******************************************************************************* - * Tegra Exception Vectors constants - ******************************************************************************/ -#define TEGRA_EVP_BASE U(0x6000F000) - -/******************************************************************************* - * Tegra Miscellaneous register constants - ******************************************************************************/ -#define TEGRA_MISC_BASE U(0x70000000) -#define HARDWARE_REVISION_OFFSET U(0x804) - -/******************************************************************************* - * Tegra UART controller base addresses - ******************************************************************************/ -#define TEGRA_UARTA_BASE U(0x70006000) -#define TEGRA_UARTB_BASE U(0x70006040) -#define TEGRA_UARTC_BASE U(0x70006200) -#define TEGRA_UARTD_BASE U(0x70006300) -#define TEGRA_UARTE_BASE U(0x70006400) - -/******************************************************************************* - * Tegra Power Mgmt Controller constants - ******************************************************************************/ -#define TEGRA_PMC_BASE U(0x7000E400) - -/******************************************************************************* - * Tegra Memory Controller constants - ******************************************************************************/ -#define TEGRA_MC_BASE U(0x70019000) - -/* Memory Controller Interrupt Status */ -#define MC_INTSTATUS 0x00U - -/* TZDRAM carveout configuration registers */ -#define MC_SECURITY_CFG0_0 U(0x70) -#define MC_SECURITY_CFG1_0 U(0x74) -#define MC_SECURITY_CFG3_0 U(0x9BC) - -/* Video Memory carveout configuration registers */ -#define MC_VIDEO_PROTECT_BASE_HI U(0x978) -#define MC_VIDEO_PROTECT_BASE_LO U(0x648) -#define MC_VIDEO_PROTECT_SIZE_MB U(0x64c) -#define MC_VIDEO_PROTECT_REG_CTRL U(0x650) -#define MC_VIDEO_PROTECT_WRITE_ACCESS_ENABLED U(3) - -/******************************************************************************* - * Tegra TZRAM constants - ******************************************************************************/ -#define TEGRA_TZRAM_BASE U(0x7C010000) -#define TEGRA_TZRAM_SIZE U(0x10000) - -/******************************************************************************* - * Tegra DRAM memory base address - ******************************************************************************/ -#define TEGRA_DRAM_BASE ULL(0x80000000) -#define TEGRA_DRAM_END ULL(0x27FFFFFFF) - -#endif /* TEGRA_DEF_H */ diff --git a/plat/nvidia/tegra/include/tegra_platform.h b/plat/nvidia/tegra/include/tegra_platform.h index b8297fd93..ab51dfee4 100644 --- a/plat/nvidia/tegra/include/tegra_platform.h +++ b/plat/nvidia/tegra/include/tegra_platform.h @@ -1,6 +1,6 @@ /* * Copyright (c) 2017-2018, ARM Limited and Contributors. All rights reserved. - * Copyright (c) 2020, NVIDIA Corporation. All rights reserved. + * Copyright (c) 2020-2021, NVIDIA Corporation. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -49,7 +49,6 @@ uint32_t tegra_get_chipid_minor(void); /* * Tegra chip ID identifiers */ -bool tegra_chipid_is_t132(void); bool tegra_chipid_is_t186(void); bool tegra_chipid_is_t210(void); bool tegra_chipid_is_t210_b01(void); diff --git a/plat/nvidia/tegra/soc/t132/plat_psci_handlers.c b/plat/nvidia/tegra/soc/t132/plat_psci_handlers.c deleted file mode 100644 index 0e2edf096..000000000 --- a/plat/nvidia/tegra/soc/t132/plat_psci_handlers.c +++ /dev/null @@ -1,208 +0,0 @@ -/* - * Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved. - * Copyright (c) 2020, NVIDIA Corporation. All rights reserved. - * - * SPDX-License-Identifier: BSD-3-Clause - */ - -#include <assert.h> - -#include <platform_def.h> - -#include <arch.h> -#include <arch_helpers.h> -#include <common/debug.h> -#include <drivers/delay_timer.h> -#include <denver.h> -#include <lib/mmio.h> -#include <lib/psci/psci.h> - -#include <flowctrl.h> -#include <pmc.h> -#include <tegra_def.h> -#include <tegra_private.h> - -/* - * Register used to clear CPU reset signals. Each CPU has two reset - * signals: CPU reset (3:0) and Core reset (19:16) - */ -#define CPU_CMPLX_RESET_CLR 0x344 -#define CPU_CORE_RESET_MASK 0x10001 - -/* Clock and Reset controller registers for system clock's settings */ -#define SCLK_RATE 0x30 -#define SCLK_BURST_POLICY 0x28 -#define SCLK_BURST_POLICY_DEFAULT 0x10000000 - -static int cpu_powergate_mask[PLATFORM_MAX_CPUS_PER_CLUSTER]; - -plat_local_state_t tegra_soc_get_target_pwr_state(uint32_t lvl, - const plat_local_state_t *states, - uint32_t ncpu) -{ - plat_local_state_t target = PLAT_MAX_OFF_STATE, temp; - uint32_t num_cpu = ncpu; - const plat_local_state_t *local_state = states; - - (void)lvl; - - assert(ncpu != 0U); - - do { - temp = *local_state; - if ((temp < target)) { - target = temp; - } - --num_cpu; - local_state++; - } while (num_cpu != 0U); - - return target; -} - -int32_t tegra_soc_validate_power_state(unsigned int power_state, - psci_power_state_t *req_state) -{ - int state_id = psci_get_pstate_id(power_state); - int cpu = read_mpidr() & MPIDR_CPU_MASK; - - /* - * Sanity check the requested state id, power level and CPU number. - * Currently T132 only supports SYSTEM_SUSPEND on last standing CPU - * i.e. CPU 0 - */ - if ((state_id != PSTATE_ID_SOC_POWERDN) || (cpu != 0)) { - ERROR("unsupported state id @ power level\n"); - return PSCI_E_INVALID_PARAMS; - } - - /* Set lower power states to PLAT_MAX_OFF_STATE */ - for (uint32_t i = MPIDR_AFFLVL0; i < PLAT_MAX_PWR_LVL; i++) - req_state->pwr_domain_state[i] = PLAT_MAX_OFF_STATE; - - /* Set the SYSTEM_SUSPEND state-id */ - req_state->pwr_domain_state[PLAT_MAX_PWR_LVL] = - PSTATE_ID_SOC_POWERDN; - - return PSCI_E_SUCCESS; -} - -int tegra_soc_pwr_domain_on(u_register_t mpidr) -{ - int cpu = mpidr & MPIDR_CPU_MASK; - uint32_t mask = CPU_CORE_RESET_MASK << cpu; - - if (cpu_powergate_mask[cpu] == 0) { - - /* Deassert CPU reset signals */ - mmio_write_32(TEGRA_CAR_RESET_BASE + CPU_CMPLX_RESET_CLR, mask); - - /* Power on CPU using PMC */ - tegra_pmc_cpu_on(cpu); - - /* Fill in the CPU powergate mask */ - cpu_powergate_mask[cpu] = 1; - - } else { - /* Power on CPU using Flow Controller */ - tegra_fc_cpu_on(cpu); - } - - return PSCI_E_SUCCESS; -} - -int tegra_soc_pwr_domain_on_finish(const psci_power_state_t *target_state) -{ - /* - * Lock scratch registers which hold the CPU vectors - */ - tegra_pmc_lock_cpu_vectors(); - - return PSCI_E_SUCCESS; -} - -int tegra_soc_pwr_domain_off(const psci_power_state_t *target_state) -{ - uint64_t val; - - tegra_fc_cpu_off(read_mpidr() & MPIDR_CPU_MASK); - - /* Disable DCO operations */ - denver_disable_dco(); - - /* Power down the CPU */ - val = read_actlr_el1() & ~ACTLR_EL1_PMSTATE_MASK; - write_actlr_el1(val | DENVER_CPU_STATE_POWER_DOWN); - - return PSCI_E_SUCCESS; -} - -int32_t tegra_soc_cpu_standby(plat_local_state_t cpu_state) -{ - (void)cpu_state; - return PSCI_E_SUCCESS; -} - -int tegra_soc_pwr_domain_suspend(const psci_power_state_t *target_state) -{ - uint64_t val; - -#if ENABLE_ASSERTIONS - int cpu = read_mpidr() & MPIDR_CPU_MASK; - - /* SYSTEM_SUSPEND only on CPU0 */ - assert(cpu == 0); -#endif - - /* Allow restarting CPU #1 using PMC on suspend exit */ - cpu_powergate_mask[1] = 0; - - /* Program FC to enter suspend state */ - tegra_fc_cpu_powerdn(read_mpidr()); - - /* Disable DCO operations */ - denver_disable_dco(); - - /* Program the suspend state ID */ - val = read_actlr_el1() & ~ACTLR_EL1_PMSTATE_MASK; - write_actlr_el1(val | target_state->pwr_domain_state[PLAT_MAX_PWR_LVL]); - - return PSCI_E_SUCCESS; -} - -int32_t tegra_soc_pwr_domain_suspend_pwrdown_early(const psci_power_state_t *target_state) -{ - return PSCI_E_NOT_SUPPORTED; -} - -int tegra_soc_pwr_domain_power_down_wfi(const psci_power_state_t *target_state) -{ - return PSCI_E_SUCCESS; -} - -int tegra_soc_prepare_system_reset(void) -{ - /* - * Set System Clock (SCLK) to POR default so that the clock source - * for the PMC APB clock would not be changed due to system reset. - */ - mmio_write_32((uintptr_t)TEGRA_CAR_RESET_BASE + SCLK_BURST_POLICY, - SCLK_BURST_POLICY_DEFAULT); - mmio_write_32((uintptr_t)TEGRA_CAR_RESET_BASE + SCLK_RATE, 0); - - /* Wait 1 ms to make sure clock source/device logic is stabilized. */ - mdelay(1); - - /* - * Program the PMC in order to restart the system. - */ - tegra_pmc_system_reset(); - - return PSCI_E_SUCCESS; -} - -__dead2 void tegra_soc_prepare_system_off(void) -{ - ERROR("Tegra System Off: operation not handled.\n"); - panic(); -} diff --git a/plat/nvidia/tegra/soc/t132/plat_secondary.c b/plat/nvidia/tegra/soc/t132/plat_secondary.c deleted file mode 100644 index f46ad3bb6..000000000 --- a/plat/nvidia/tegra/soc/t132/plat_secondary.c +++ /dev/null @@ -1,75 +0,0 @@ -/* - * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved. - * - * SPDX-License-Identifier: BSD-3-Clause - */ - -#include <assert.h> - -#include <arch_helpers.h> -#include <common/debug.h> -#include <denver.h> -#include <lib/mmio.h> -#include <lib/psci/psci.h> -#include <plat/common/platform.h> - -#include <pmc.h> -#include <tegra_def.h> - -#define SB_CSR 0x0 -#define SB_CSR_NS_RST_VEC_WR_DIS (1 << 1) - -/* AARCH64 CPU reset vector */ -#define SB_AA64_RESET_LOW 0x30 /* width = 31:0 */ -#define SB_AA64_RESET_HI 0x34 /* width = 11:0 */ - -/* AARCH32 CPU reset vector */ -#define EVP_CPU_RESET_VECTOR 0x100 - -extern void tegra_secure_entrypoint(void); - -/* - * For T132, CPUs reset to AARCH32, so the reset vector is first - * armv8_trampoline which does a warm reset to AARCH64 and starts - * execution at the address in SB_AA64_RESET_LOW/SB_AA64_RESET_HI. - */ -__aligned(8) const uint32_t armv8_trampoline[] = { - 0xE3A00003, /* mov r0, #3 */ - 0xEE0C0F50, /* mcr p15, 0, r0, c12, c0, 2 */ - 0xEAFFFFFE, /* b . */ -}; - -/******************************************************************************* - * Setup secondary CPU vectors - ******************************************************************************/ -void plat_secondary_setup(void) -{ - uint32_t val; - uint64_t reset_addr = (uint64_t)tegra_secure_entrypoint; - - /* - * For T132, CPUs reset to AARCH32, so the reset vector is first - * armv8_trampoline, which does a warm reset to AARCH64 and starts - * execution at the address in SCRATCH34/SCRATCH35. - */ - INFO("Setting up T132 CPU boot\n"); - - /* initial AARCH32 reset address */ - tegra_pmc_write_32(PMC_SECURE_SCRATCH22, - (unsigned long)&armv8_trampoline); - - /* set AARCH32 exception vector (read to flush) */ - mmio_write_32(TEGRA_EVP_BASE + EVP_CPU_RESET_VECTOR, - (unsigned long)&armv8_trampoline); - val = mmio_read_32(TEGRA_EVP_BASE + EVP_CPU_RESET_VECTOR); - - /* setup secondary CPU vector */ - mmio_write_32(TEGRA_SB_BASE + SB_AA64_RESET_LOW, - (reset_addr & 0xFFFFFFFF) | 1); - val = reset_addr >> 32; - mmio_write_32(TEGRA_SB_BASE + SB_AA64_RESET_HI, val & 0x7FF); - - /* configure PMC */ - tegra_pmc_cpu_setup(reset_addr); - tegra_pmc_lock_cpu_vectors(); -} diff --git a/plat/nvidia/tegra/soc/t132/plat_setup.c b/plat/nvidia/tegra/soc/t132/plat_setup.c deleted file mode 100644 index 49e8b5d88..000000000 --- a/plat/nvidia/tegra/soc/t132/plat_setup.c +++ /dev/null @@ -1,201 +0,0 @@ -/* - * Copyright (c) 2015-2019, ARM Limited and Contributors. All rights reserved. - * Copyright (c) 2020, NVIDIA Corporation. All rights reserved. - * - * SPDX-License-Identifier: BSD-3-Clause - */ - -#include <arch_helpers.h> -#include <assert.h> -#include <common/bl_common.h> -#include <drivers/console.h> -#include <lib/xlat_tables/xlat_tables_v2.h> -#include <memctrl.h> -#include <plat/common/platform.h> -#include <tegra_def.h> -#include <tegra_platform.h> -#include <tegra_private.h> - -/* sets of MMIO ranges setup */ -#define MMIO_RANGE_0_ADDR 0x50000000 -#define MMIO_RANGE_1_ADDR 0x60000000 -#define MMIO_RANGE_2_ADDR 0x70000000 -#define MMIO_RANGE_SIZE 0x200000 - -/* - * Table of regions to map using the MMU. - */ -static const mmap_region_t tegra_mmap[] = { - MAP_REGION_FLAT(MMIO_RANGE_0_ADDR, MMIO_RANGE_SIZE, - MT_DEVICE | MT_RW | MT_SECURE), - MAP_REGION_FLAT(MMIO_RANGE_1_ADDR, MMIO_RANGE_SIZE, - MT_DEVICE | MT_RW | MT_SECURE), - MAP_REGION_FLAT(MMIO_RANGE_2_ADDR, MMIO_RANGE_SIZE, - MT_DEVICE | MT_RW | MT_SECURE), - {0} -}; - -/******************************************************************************* - * Set up the pagetables as per the platform memory map & initialize the MMU - ******************************************************************************/ -const mmap_region_t *plat_get_mmio_map(void) -{ - /* MMIO space */ - return tegra_mmap; -} - -/******************************************************************************* - * The Tegra power domain tree has a single system level power domain i.e. a - * single root node. The first entry in the power domain descriptor specifies - * the number of power domains at the highest power level. - ******************************************************************************* - */ -const unsigned char tegra_power_domain_tree_desc[] = { - /* No of root nodes */ - 1, - /* No of clusters */ - PLATFORM_CLUSTER_COUNT, - /* No of CPU cores */ - PLATFORM_CORE_COUNT, -}; - -/******************************************************************************* - * This function returns the Tegra default topology tree information. - ******************************************************************************/ -const unsigned char *plat_get_power_domain_tree_desc(void) -{ - return tegra_power_domain_tree_desc; -} - -unsigned int plat_get_syscnt_freq2(void) -{ - return 12000000; -} - -/******************************************************************************* - * Maximum supported UART controllers - ******************************************************************************/ -#define TEGRA132_MAX_UART_PORTS 5 - -/******************************************************************************* - * This variable holds the UART port base addresses - ******************************************************************************/ -static uint32_t tegra132_uart_addresses[TEGRA132_MAX_UART_PORTS + 1] = { - 0, /* undefined - treated as an error case */ - TEGRA_UARTA_BASE, - TEGRA_UARTB_BASE, - TEGRA_UARTC_BASE, - TEGRA_UARTD_BASE, - TEGRA_UARTE_BASE, -}; - -/******************************************************************************* - * Enable console corresponding to the console ID - ******************************************************************************/ -void plat_enable_console(int32_t id) -{ - static console_t uart_console; - uint32_t console_clock; - - if ((id > 0) && (id < TEGRA132_MAX_UART_PORTS)) { - /* - * Reference clock used by the FPGAs is a lot slower. - */ - if (tegra_platform_is_fpga()) { - console_clock = TEGRA_BOOT_UART_CLK_13_MHZ; - } else { - console_clock = TEGRA_BOOT_UART_CLK_408_MHZ; - } - - (void)console_16550_register(tegra132_uart_addresses[id], - console_clock, - TEGRA_CONSOLE_BAUDRATE, - &uart_console); - console_set_scope(&uart_console, CONSOLE_FLAG_BOOT | - CONSOLE_FLAG_RUNTIME | CONSOLE_FLAG_CRASH); - } -} - -/******************************************************************************* - * Initialize the GIC and SGIs - ******************************************************************************/ -void plat_gic_setup(void) -{ - tegra_gic_setup(NULL, 0); - tegra_gic_init(); -} - -/******************************************************************************* - * Return pointer to the BL31 params from previous bootloader - ******************************************************************************/ -struct tegra_bl31_params *plat_get_bl31_params(void) -{ - return NULL; -} - -/******************************************************************************* - * Return pointer to the BL31 platform params from previous bootloader - ******************************************************************************/ -plat_params_from_bl2_t *plat_get_bl31_plat_params(void) -{ - return NULL; -} - -/******************************************************************************* - * Handler for early platform setup - ******************************************************************************/ -void plat_early_platform_setup(void) -{ - plat_params_from_bl2_t *plat_params = bl31_get_plat_params(); - - /* Verify chip id is t132 */ - assert(tegra_chipid_is_t132()); - - /* - * Do initial security configuration to allow DRAM/device access. - */ - tegra_memctrl_tzdram_setup(plat_params->tzdram_base, - (uint32_t)plat_params->tzdram_size); -} - -/******************************************************************************* - * Handler for late platform setup - ******************************************************************************/ -void plat_late_platform_setup(void) -{ - ; /* do nothing */ -} - -/******************************************************************************* - * Handler to indicate support for System Suspend - ******************************************************************************/ -bool plat_supports_system_suspend(void) -{ - return true; -} - -/******************************************************************************* - * Platform specific runtime setup. - ******************************************************************************/ -void plat_runtime_setup(void) -{ - /* - * During cold boot, it is observed that the arbitration - * bit is set in the Memory controller leading to false - * error interrupts in the non-secure world. To avoid - * this, clean the interrupt status register before - * booting into the non-secure world - */ - tegra_memctrl_clear_pending_interrupts(); - - /* - * During boot, USB3 and flash media (SDMMC/SATA) devices need - * access to IRAM. Because these clients connect to the MC and - * do not have a direct path to the IRAM, the MC implements AHB - * redirection during boot to allow path to IRAM. In this mode - * accesses to a programmed memory address aperture are directed - * to the AHB bus, allowing access to the IRAM. This mode must be - * disabled before we jump to the non-secure world. - */ - tegra_memctrl_disable_ahb_redirection(); -} diff --git a/plat/nvidia/tegra/soc/t132/plat_sip_calls.c b/plat/nvidia/tegra/soc/t132/plat_sip_calls.c deleted file mode 100644 index 90c6bb2a1..000000000 --- a/plat/nvidia/tegra/soc/t132/plat_sip_calls.c +++ /dev/null @@ -1,75 +0,0 @@ -/* - * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved. - * - * SPDX-License-Identifier: BSD-3-Clause - */ - -#include <assert.h> -#include <errno.h> - -#include <arch.h> -#include <arch_helpers.h> -#include <common/bl_common.h> -#include <common/debug.h> -#include <lib/el3_runtime/context_mgmt.h> - -#include <tegra_private.h> - -#define NS_SWITCH_AARCH32 1 -#define SCR_RW_BITPOS __builtin_ctz(SCR_RW_BIT) - -/******************************************************************************* - * Tegra132 SiP SMCs - ******************************************************************************/ -#define TEGRA_SIP_AARCH_SWITCH 0x82000004 - -/******************************************************************************* - * SPSR settings for AARCH32/AARCH64 modes - ******************************************************************************/ -#define SPSR32 SPSR_MODE32(MODE32_svc, SPSR_T_ARM, SPSR_E_LITTLE, \ - DAIF_FIQ_BIT | DAIF_IRQ_BIT | DAIF_ABT_BIT) -#define SPSR64 SPSR_64(MODE_EL2, MODE_SP_ELX, DISABLE_ALL_EXCEPTIONS) - -/******************************************************************************* - * This function is responsible for handling all T132 SiP calls - ******************************************************************************/ -int plat_sip_handler(uint32_t smc_fid, - uint64_t x1, - uint64_t x2, - uint64_t x3, - uint64_t x4, - const void *cookie, - void *handle, - uint64_t flags) -{ - switch (smc_fid) { - - case TEGRA_SIP_AARCH_SWITCH: - - /* clean up the high bits */ - x1 = (uint32_t)x1; - x2 = (uint32_t)x2; - - if (!x1 || x2 > NS_SWITCH_AARCH32) { - ERROR("%s: invalid parameters\n", __func__); - return -EINVAL; - } - - /* x1 = ns entry point */ - cm_set_elr_spsr_el3(NON_SECURE, x1, - (x2 == NS_SWITCH_AARCH32) ? SPSR32 : SPSR64); - - /* switch NS world mode */ - cm_write_scr_el3_bit(NON_SECURE, SCR_RW_BITPOS, !x2); - - INFO("CPU switched to AARCH%s mode\n", - (x2 == NS_SWITCH_AARCH32) ? "32" : "64"); - return 0; - - default: - ERROR("%s: unhandled SMC (0x%x)\n", __func__, smc_fid); - break; - } - - return -ENOTSUP; -} diff --git a/plat/nvidia/tegra/soc/t132/platform_t132.mk b/plat/nvidia/tegra/soc/t132/platform_t132.mk deleted file mode 100644 index 9534c07b9..000000000 --- a/plat/nvidia/tegra/soc/t132/platform_t132.mk +++ /dev/null @@ -1,35 +0,0 @@ -# -# Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved. -# Copyright (c) 2020, NVIDIA Corporation. All rights reserved. -# -# SPDX-License-Identifier: BSD-3-Clause -# - -TZDRAM_BASE := 0xF5C00000 -$(eval $(call add_define,TZDRAM_BASE)) - -PLATFORM_CLUSTER_COUNT := 1 -$(eval $(call add_define,PLATFORM_CLUSTER_COUNT)) - -PLATFORM_MAX_CPUS_PER_CLUSTER := 2 -$(eval $(call add_define,PLATFORM_MAX_CPUS_PER_CLUSTER)) - -MAX_XLAT_TABLES := 3 -$(eval $(call add_define,MAX_XLAT_TABLES)) - -MAX_MMAP_REGIONS := 8 -$(eval $(call add_define,MAX_MMAP_REGIONS)) - -# platform files -PLAT_INCLUDES += -Iplat/nvidia/tegra/include/t132 - -BL31_SOURCES += ${TEGRA_GICv2_SOURCES} \ - drivers/ti/uart/aarch64/16550_console.S \ - lib/cpus/aarch64/denver.S \ - ${TEGRA_DRIVERS}/flowctrl/flowctrl.c \ - ${TEGRA_DRIVERS}/memctrl/memctrl_v1.c \ - ${TEGRA_DRIVERS}/pmc/pmc.c \ - ${SOC_DIR}/plat_psci_handlers.c \ - ${SOC_DIR}/plat_sip_calls.c \ - ${SOC_DIR}/plat_setup.c \ - ${SOC_DIR}/plat_secondary.c diff --git a/plat/nvidia/tegra/soc/t194/plat_ras.c b/plat/nvidia/tegra/soc/t194/plat_ras.c index 0c4c6fad6..a32240339 100644 --- a/plat/nvidia/tegra/soc/t194/plat_ras.c +++ b/plat/nvidia/tegra/soc/t194/plat_ras.c @@ -493,9 +493,6 @@ void plat_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *cookie, #if RAS_EXTENSION tegra194_ea_handler(ea_reason, syndrome, cookie, handle, flags); #else - ERROR("Unhandled External Abort received on 0x%llx at EL3!\n", - read_mpidr_el1()); - ERROR(" exception reason=%u syndrome=0x%lx\n", ea_reason, syndrome); - panic(); + plat_default_ea_handler(ea_reason, syndrome, cookie, handle, flags); #endif } diff --git a/plat/qemu/qemu/include/platform_def.h b/plat/qemu/qemu/include/platform_def.h index 0891d809d..c02eff9a8 100644 --- a/plat/qemu/qemu/include/platform_def.h +++ b/plat/qemu/qemu/include/platform_def.h @@ -80,8 +80,8 @@ #define SEC_ROM_BASE 0x00000000 #define SEC_ROM_SIZE 0x00020000 -#define NS_DRAM0_BASE 0x40000000 -#define NS_DRAM0_SIZE 0xc0000000 +#define NS_DRAM0_BASE ULL(0x40000000) +#define NS_DRAM0_SIZE ULL(0xc0000000) #define SEC_SRAM_BASE 0x0e000000 #define SEC_SRAM_SIZE 0x00060000 diff --git a/plat/renesas/common/rcar_common.c b/plat/renesas/common/rcar_common.c index 95e1f6158..df4c30c06 100644 --- a/plat/renesas/common/rcar_common.c +++ b/plat/renesas/common/rcar_common.c @@ -60,11 +60,7 @@ void plat_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *cookie, if (fixed) return; - ERROR("Unhandled External Abort received on 0x%lx at EL3!\n", - read_mpidr_el1()); - ERROR(" exception reason=%u syndrome=0x%llx\n", ea_reason, syndrome); - - panic(); + plat_default_ea_handler(ea_reason, syndrome, cookie, handle, flags); } #include <drivers/renesas/rcar/console/console.h> diff --git a/plat/st/stm32mp1/bl2_plat_setup.c b/plat/st/stm32mp1/bl2_plat_setup.c index 3e179fbbf..b4c42fc06 100644 --- a/plat/st/stm32mp1/bl2_plat_setup.c +++ b/plat/st/stm32mp1/bl2_plat_setup.c @@ -153,8 +153,6 @@ void bl2_platform_setup(void) #ifdef AARCH32_SP_OPTEE INFO("BL2 runs OP-TEE setup\n"); - /* Initialize tzc400 after DDR initialization */ - stm32mp1_security_setup(); #else INFO("BL2 runs SP_MIN setup\n"); #endif @@ -384,4 +382,9 @@ int bl2_plat_handle_post_image_load(unsigned int image_id) return err; } + +void bl2_el3_plat_prepare_exit(void) +{ + stm32mp1_security_setup(); +} #endif diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.c b/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.c index f165fb022..9c5af88bb 100644 --- a/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.c +++ b/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.c @@ -677,6 +677,10 @@ enum pm_ret_status pm_api_ioctl(enum pm_node_id nid, case IOCTL_AFI: ret = pm_ioctl_afi(arg1, arg2); break; + case IOCTL_SET_FEATURE_CONFIG: + case IOCTL_GET_FEATURE_CONFIG: + ret = pm_feature_config(ioctl_id, arg1, arg2, value); + break; default: ret = PM_RET_ERROR_NOTSUPPORTED; break; diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.h b/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.h index 337f7321b..f18dc00a2 100644 --- a/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.h +++ b/plat/xilinx/zynqmp/pm_service/pm_api_ioctl.h @@ -15,28 +15,43 @@ //ioctl id enum { - IOCTL_GET_RPU_OPER_MODE, - IOCTL_SET_RPU_OPER_MODE, - IOCTL_RPU_BOOT_ADDR_CONFIG, - IOCTL_TCM_COMB_CONFIG, - IOCTL_SET_TAPDELAY_BYPASS, - IOCTL_SET_SGMII_MODE, - IOCTL_SD_DLL_RESET, - IOCTL_SET_SD_TAPDELAY, + IOCTL_GET_RPU_OPER_MODE = 0, + IOCTL_SET_RPU_OPER_MODE = 1, + IOCTL_RPU_BOOT_ADDR_CONFIG = 2, + IOCTL_TCM_COMB_CONFIG = 3, + IOCTL_SET_TAPDELAY_BYPASS = 4, + IOCTL_SET_SGMII_MODE = 5, + IOCTL_SD_DLL_RESET = 6, + IOCTL_SET_SD_TAPDELAY = 7, /* Ioctl for clock driver */ - IOCTL_SET_PLL_FRAC_MODE, - IOCTL_GET_PLL_FRAC_MODE, - IOCTL_SET_PLL_FRAC_DATA, - IOCTL_GET_PLL_FRAC_DATA, - IOCTL_WRITE_GGS, - IOCTL_READ_GGS, - IOCTL_WRITE_PGGS, - IOCTL_READ_PGGS, + IOCTL_SET_PLL_FRAC_MODE = 8, + IOCTL_GET_PLL_FRAC_MODE = 9, + IOCTL_SET_PLL_FRAC_DATA = 10, + IOCTL_GET_PLL_FRAC_DATA = 11, + IOCTL_WRITE_GGS = 12, + IOCTL_READ_GGS = 13, + IOCTL_WRITE_PGGS = 14, + IOCTL_READ_PGGS = 15, /* IOCTL for ULPI reset */ - IOCTL_ULPI_RESET, + IOCTL_ULPI_RESET = 16, /* Set healthy bit value */ - IOCTL_SET_BOOT_HEALTH_STATUS, - IOCTL_AFI, + IOCTL_SET_BOOT_HEALTH_STATUS = 17, + IOCTL_AFI = 18, + /* Probe counter read/write */ + IOCTL_PROBE_COUNTER_READ = 19, + IOCTL_PROBE_COUNTER_WRITE = 20, + IOCTL_OSPI_MUX_SELECT = 21, + /* IOCTL for USB power request */ + IOCTL_USB_SET_STATE = 22, + /* IOCTL to get last reset reason */ + IOCTL_GET_LAST_RESET_REASON = 23, + /* AI engine NPI ISR clear */ + IOCTL_AIE_ISR_CLEAR = 24, + /* Register SGI to ATF */ + IOCTL_REGISTER_SGI = 25, + /* Runtime feature configuration */ + IOCTL_SET_FEATURE_CONFIG = 26, + IOCTL_GET_FEATURE_CONFIG = 27, }; //RPU operation mode diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_sys.c b/plat/xilinx/zynqmp/pm_service/pm_api_sys.c index 62260bc40..5d9408cd5 100644 --- a/plat/xilinx/zynqmp/pm_service/pm_api_sys.c +++ b/plat/xilinx/zynqmp/pm_service/pm_api_sys.c @@ -1648,3 +1648,36 @@ enum pm_ret_status em_send_errors(unsigned int *value) EM_PACK_PAYLOAD1(payload, EM_SEND_ERRORS); return pm_ipi_send_sync(primary_proc, payload, value, 1); } + +/** + * pm_feature_config() - feature configuration at runtime + * + * This function is used to send IPI request to PMUFW to configure feature + * at runtime. The feature can be enable or disable as well as the feature + * can be configure at runtime using an IOCTL call. + * + * @ioctl_id The ioctl id for the feature configuration + * @config_id The config id of the feature to be configured + * @value The value to be configured + * @response Return to reference pointer + * + * @return Returns 0 on success or error value on failure + */ +enum pm_ret_status pm_feature_config(unsigned int ioctl_id, + unsigned int config_id, + unsigned int value, + unsigned int *response) +{ + uint32_t payload[PAYLOAD_ARG_CNT]; + + /* Send request to the PMU */ + PM_PACK_PAYLOAD5(payload, PM_IOCTL, 0, ioctl_id, config_id, value); + + if (ioctl_id == IOCTL_GET_FEATURE_CONFIG) { + return pm_ipi_send_sync(primary_proc, payload, response, 1); + } else if (ioctl_id == IOCTL_SET_FEATURE_CONFIG) { + return pm_ipi_send_sync(primary_proc, payload, NULL, 0); + } else { + return PM_RET_ERROR_ARGS; + } +} diff --git a/plat/xilinx/zynqmp/pm_service/pm_api_sys.h b/plat/xilinx/zynqmp/pm_service/pm_api_sys.h index b0c26529d..ca07cef75 100644 --- a/plat/xilinx/zynqmp/pm_service/pm_api_sys.h +++ b/plat/xilinx/zynqmp/pm_service/pm_api_sys.h @@ -202,4 +202,9 @@ enum pm_ret_status em_set_action(unsigned int *value); enum pm_ret_status em_remove_action(unsigned int *value); enum pm_ret_status em_send_errors(unsigned int *value); +enum pm_ret_status pm_feature_config(unsigned int ioctl_id, + unsigned int config_id, + unsigned int value, + unsigned int *response); + #endif /* PM_API_SYS_H */ |
