Adds comments with a list of unsupported FF-A interfaces and limitations
in the implemented FF-A interfaces.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Henry Wang <Henry.Wang@arm.com>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
The single lock in struct ffa_ctx is complemented with rx_lock and tx_lock.
The old lock is used for small critical sections, like increasing
shm_count or adding another shm to shm_list.
rx_lock and tx_lock are only acquired using spin_trylock() which for
well-behaving guests should always succeed. Guests using the RX and TX
buffers are expected to serialize accesses before doing the FF-A
request.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Adds support to reclaim memory previously shared with FFA_MEM_SHARE.
A memory region that doesn't need to be shared any longer can be
reclaimed with FFA_MEM_RECLAIM once the SP doesn't use it any longer.
This is checked by the SPMC and not in control of the mediator.
Adds a check that the SP supports the needed FF-A feature
FFA_MEM_RECLAIM.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Adds support for a guest to share memory with an SP using FFA_MEM_SHARE.
Only memory regions small enough to be shared with a single call to
FFA_MEM_SHARE are supported.
With this commit we have a FF-A version 1.1 [1] mediator able to
communicate with a Secure Partition in secure world using shared memory.
The secure world must use FF-A version 1.1, but the guest is free to use
version 1.0 or version 1.1.
Adds a check that the SP supports the needed FF-A features
FFA_MEM_SHARE_64 or FFA_MEM_SHARE_32.
[1] https://developer.arm.com/documentation/den0077/latest
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Adds the ABI structs used by function FFA_MEM_SHARE and friends for
sharing memory.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
According to DEN0077A version 1.1 REL0
- Section 10.9.2 Memory region handle, page 167
- Table 10.18 at page 175
- Table 10.15 at page 168
- Section 10.11.4 Flags usage, page 184-187
add defines needed for sharing using the function FFA_MEM_SHARE and
friends.
Also add limits for how many shared buffers that a guest can have at
once and how large a shared buffer can be at most.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Henry Wang <Henry.Wang@arm.com>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Moves the two helper functions regpair_to_uint64() and
uint64_to_regpair() from xen/arch/arm/tee/optee.c to the common arm
specific regs.h. This enables reuse of these functions in the FF-A
mediator in a subsequent patch.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Reviewed-by: Henry Wang <Henry.Wang@arm.com>
Adds support in the mediator to handle FFA_PARTITION_INFO_GET requests
from a guest. The requests are forwarded to the SPMC and the response is
translated according to the FF-A version in use by the guest.
Using FFA_PARTITION_INFO_GET changes the owner of the RX buffer to the
caller (the guest in this case), so once it is done with the buffer it
must be released using FFA_RX_RELEASE before another call can be made.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Adds support in the mediator to map and unmap the RX and TX buffers
provided by the guest using the two FF-A functions FFA_RXTX_MAP and
FFA_RXTX_UNMAP.
These buffer are later used to transmit data that cannot be passed in
registers only.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
The FF-A specification defines framework messages sent as direct
requests when certain events occurs. For instance when a VM (guest) is
created or destroyed. Only SPs which have subscribed to these events
will receive them. An SP can subscribe to these messages in its
partition properties.
Adds a check that the SP supports the needed FF-A features
FFA_PARTITION_INFO_GET and FFA_RX_RELEASE.
The partition properties of each SP is retrieved with
FFA_PARTITION_INFO_GET which returns the information in our RX buffer.
Using FFA_PARTITION_INFO_GET changes the owner of the RX buffer to the
caller (us), so once we're done with the buffer it must be released
using FFA_RX_RELEASE before another call can be made.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
When initializing the FF-A mediator map the RX and TX buffers shared with
the SPMC.
These buffer are later used to to transmit data that cannot be passed in
registers only.
Adds a check that the SP supports the needed FF-A features
FFA_RXTX_MAP_64 and FFA_RXTX_UNMAP.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Adds support for sending a FF-A direct request. Checks that the SP also
supports handling a 32-bit direct request. 64-bit direct requests are
not used by the mediator itself so there is not need to check for that.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Henry Wang <Henry.Wang@arm.com>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Old gcc (up to at least 4.3.4) won't cope with initializers involving
unnamed struct/union fields.
Fixes: 3e033172b0 ("x86/iommu: pass full IO-APIC RTE for remapping table update")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
tboot_shutdown() calls into tboot to perform the actual system shutdown.
tboot isn't built with endbr annotations, and Xen has CET-IBT enabled on
newer hardware. shutdown_entry isn't annotated with endbr and Xen
faults:
Panic on CPU 0:
CONTROL-FLOW PROTECTION FAULT: #CP[0003] endbranch
And Xen hangs at this point.
Disabling CET-IBT let Xen and tboot power off, but reboot was
perfoming a poweroff instead of a warm reboot. Disabling all of CET,
i.e. shadow stacks as well, lets tboot reboot properly.
Fixes: cdbe2b0a1a ("x86: Enable CET Indirect Branch Tracking")
Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Daniel P. Smith <dpsmith@apertussolutions.com>
The "cpuid_empty" label is also (in principle; maybe only for rubbish
input) reachable in the "cpuid_only" case. Hence the label needs to live
ahead of the check of the variable.
Fixes: 5b80cecb74 ("libxl: introduce MSR data in libxl_cpuid_policy")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
Address some occurrences of shadowing between the global
variable 'e820' in 'xen/arch/x86/e820.c' and the function
parameter name of 'e820_add_range'.
Since the function is only ever called with the global variable
as the actual parameter, so there is no need to have it as a parameter
because both are defined in the same file (mentioned above).
This in turn causes several other functions to lose their parameter
'e820' because they are involved in the call chain that leads to
'e820_add_range'.
Similarly, 'kexec_reserve_area' is only ever called with the static
variable 'boot_e820' as a parameter, which is defined in the same file
as the function, thus it does not need that parameter, which is a cause
of shadowing, as explained above.
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
The function has no uses in the codebase, and can be removed.
This also avoids the violation of MISRA C:2012 Rule 8.4 and Rule 2.1
because it has no declaration and the function's code is unreachable.
Suggested-by: Julien Grall <julien@xen.org>
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Debian unstable used in the Xen containers is actually bookworm.
Switching to bookworm which is now stable means we are not basing our
containers on a moving target anymore.
Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Reviewed-by: Michal Orzel <michal.orzel@amd.com>
The patch introdcuces printk related stuff which should be deleted
after Xen common code will be available.
Signed-off-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
The missing header included by this patch provides a declaration for
'set_px_pminfo' that is visible prior to the definition in this file.
This also resolves a violation of MISRA C:2012 Rule 8.4.
Fixes: 452119c094 ("x86 and ia64: move cpufreq notify code to commone place")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
The missing headers declare variables 'xen_cpuidle' and 'use_invpcid'
that are then defined inside the file.
This is undesirable and also violates MISRA C:2012 Rule 8.4.
Adding suitable "#include"s resolves the issue.
The type of the variable 'xen_cpuidle' also changes according to
s/s8/int8_t/.
Fixes: 3eab82196b ("x86: PIT broadcast to fix local APIC timer stop issue for Deep C state")
Fixes: 63dc135aea ("x86: invpcid support")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
The variable is only ever used inside the file where it's
defined, therefore it can have static storage. This also
resolves a violation of MISRA C:2012 Rule 8.4 due to the absence
of a declaration prior to the definition.
Fixes: 3ba523ff95 ("CPUIDLE: enable MSI capable HPET for timer broadcast")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
The check was missing an escape for the inner $, thus breaking things
in the unlikely event that the underlying assembler doesn't support this
option.
Fixes: 62d22296a9 ("build: silence GNU ld warning about executable stacks")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
Interestingly only Clang warns about the now bogus less-than-zero
comparison. Convert it to something that's more explicitly doing what
the comment says.
Fixes: 4086857cc1 ("x86: implement cpuid() in terms of cpuid_count()")
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
The local variables 'irq_desc' shadow the homonymous global variable,
declared in 'xen/arch/x86/include/asm/irq.h', therefore they are renamed
'irqd'.
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Configuration for dom0less domUs is stored under /chosen/<domu> nodes
present in the host device tree provided to Xen. All the properties and
sub nodes there are meant only for Xen. However, at the moment we still
copy them (except for modules that we skip) into hardware domain /chosen
node. Fix it by adding "xen,domain" compatible into the list of nodes to
skip in handle_node().
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
When booting a dom0less domU without initial ramdisk, it was observed
that Xen still creates empty linux,initrd-{start,end} properties under
/chosen node. This is because in make_chosen_node(), generation of initrd
placeholders (later on filled with the real values) is protected with
a check for presence of kernel bootmodule (always present) instead of
initrd bootmodule. Fix it along with renaming the variable from "mod" to
"initrd" to prevent similar mistakes in the future.
Fixes: 48f4bf6bde ("arm/acpi: Create min DT stub for Dom0")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
the function 'fdt_add_uefi_nodes' can be defined static, as its
only callers are within the same file. This in turn avoids
violating Rule 8.4 because no declaration is present.
No functional change.
Fixes: 6d70ea10d4 ("Add ARM EFI boot support”)
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Include an additional header to make the declarations for
functions 'watchdog_*' visible prior to their definition in the
file, thereby resolving the violations of MISRA C:2012 Rule 8.4.
No functional change.
Fixes: c8177e691f ("watchdog: Move watchdog from being x86 specific to common code")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Add a declaration for the variable 'init_ttbr' to resolve the violation
of MISRA C:2012 Rule 8.4 present the relative source file 'mm.c'.
No functional changes.
Fixes: 4557c22928 ("xen: arm: rewrite start of day page table and cpu bring up")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
The functions and variables touched by this commit can be static,
as they are only used within the same unit. This in turn addresses
the absence of declarations that violates MISRA C:2012 Rule 8.4.
Fixes: 741367e77d ("mce: Clean-up mcheck_init handler")
Fixes: 45f57813f6 ("x86/MCE: implement recoverscan for AMD")
Fixes: 155587481e ("x86/microcode: Scan the initramfs payload for microcode blob")
Fixes: af50dd63cf ("Pull nmi/traps changes from Linux 2.6.14.")
Fixes: fef244b179 ("x86/spec-ctrl: Knobs for STIBP and PSFD, and follow hardware STIBP hint")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
'xen/hypercall.h' is included in 'xen/arch/arm/setup.c' to allow
the declaration of 'arch_get_xen_caps' to be visible when
defining the function.
The header 'xen/delay.h' is included in 'xen/arch/arm/time.c'
to allow the declaration of 'udelay' to be visible.
Fixes: 7cfc339cbc ("arm: Implement arch_get_xen_caps")
Fixes: 335ba242c5 ("arm: implement udelay()")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
A declaration for 'get_sec' is added in 'xen/include/xen/time.h' to
be available for every call site (in particular 'cper.h').
This also resolves a violation of MISRA C:2012 Rule 8.4.
Fixes: c8cb30cfc8 ("mce: Provide ERST interface")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
The variable 'saved_cmdline' can be defined static,
as its only uses are within the same file. This in turn avoids
violating MISRA C:2012 Rule 8.4 because no declaration is present.
Fixes: e6ee01ad24 ("xen/version: Drop compat/kernel.c")
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
The function 'ioreq_server_max_frames' can be defined static,
as its only uses are within the same file. This in turn avoids
violating MISRA C:2012 Rule 8.4 because no declaration is present.
No functional change.
Fixes: 9244528955 ("xen/memory: Fix acquire_resource size semantics”)
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Luca Fancellu <luca.fancellu@arm.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
Since as a bug workaround (likely inapplicable to any 64-bit CPUs, but
it probably doesn't hurt to keep this) we clear %ecx on input anyway,
we can as well fall back to cpuid_count(). This allows getting rid of
four risky casts and makes things type-safe. The latter aspect requires
two type adjustments elsewhere. While adjusting init_intel_cacheinfo(),
convert three other local variables there as well. For the struct
cpuinfo_x86 change it is relevant to note that no 64-bit CPU comes
without CPUID support, and hence cpuid_level is never set to -1; the
comment there was simply stale.
No functional change intended, yet of course generated code isn't
identical.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
Much like we have PAGE_OFFSET() there already, there's also no reason
for each arch to define identical PAGE_ALIGN().
While there re-pad PAGE_OFFSET() to match the other macros.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
The xen build for ARM64 now has new configuration options which
require to be defined: this patch defines them.
In both configuration files some no longer true comments have been removed.
Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
This patch adds some deviations for the following guidelines:
Rule 2.1, Rule 5.3 and Rule 8.2.
Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
This patch splits the former list in two separate selectors
clean_guidelines_common and additional_clean_guidelines.
clean_guidelines_common contains the guidelines that are clean
in both the analyzed builds, instead additional_clean_guidelines
is popolated depending on the current one.
The following clean guidelines have been added:
- MC3R1.R1.1;
- MC3R1.R1.3;
- MC3R1.R3.1;
- MC3R1.R4.1;
- MC3R1.R17.4;
- MC3R1.R22.6;
- MC3R1.D4.3 (just x86_64);
- MC3R1.R5.3 (just arm64);
- MC3R1.R7.2 (just arm64);
- MC3R1.R8.6 (just arm64);
- MC3R1.R9.3 (just arm64).
Signed-off-by: Simone Ballarin <simone.ballarin@bugseng.com>
Acked-by: Stefano Stabellini <sstabellini@kernel.org>
The variable 'msec' declared in the macro shadows the local
variable in 'ehci_dbgp_bios_handoff', but to prevent any
future clashes with other functions the macro is converted to
a static inline function.
No functional change.
Signed-off-by: Nicola Vetrini <nicola.vetrini@bugseng.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>
Jens Wiklander