summaryrefslogtreecommitdiff
path: root/include/common
Commit message (Collapse)AuthorAgeFilesLines
* SPM: Introduce Secure Partition ManagerAntonio Nino Diaz2017-11-082-10/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A Secure Partition is a software execution environment instantiated in S-EL0 that can be used to implement simple management and security services. Since S-EL0 is an unprivileged exception level, a Secure Partition relies on privileged firmware e.g. ARM Trusted Firmware to be granted access to system and processor resources. Essentially, it is a software sandbox that runs under the control of privileged software in the Secure World and accesses the following system resources: - Memory and device regions in the system address map. - PE system registers. - A range of asynchronous exceptions e.g. interrupts. - A range of synchronous exceptions e.g. SMC function identifiers. A Secure Partition enables privileged firmware to implement only the absolutely essential secure services in EL3 and instantiate the rest in a partition. Since the partition executes in S-EL0, its implementation cannot be overly complex. The component in ARM Trusted Firmware responsible for managing a Secure Partition is called the Secure Partition Manager (SPM). The SPM is responsible for the following: - Validating and allocating resources requested by a Secure Partition. - Implementing a well defined interface that is used for initialising a Secure Partition. - Implementing a well defined interface that is used by the normal world and other secure services for accessing the services exported by a Secure Partition. - Implementing a well defined interface that is used by a Secure Partition to fulfil service requests. - Instantiating the software execution environment required by a Secure Partition to fulfil a service request. Change-Id: I6f7862d6bba8732db5b73f54e789d717a35e802f Co-authored-by: Douglas Raillard <douglas.raillard@arm.com> Co-authored-by: Sandrine Bailleux <sandrine.bailleux@arm.com> Co-authored-by: Achin Gupta <achin.gupta@arm.com> Co-authored-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com> Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* GIC: Allow specifying interrupt propertiesJeenu Viswambharan2017-10-161-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The GIC driver initialization currently allows an array of interrupts to be configured as secure. Future use cases would require more interrupt configuration other than just security, such as priority. This patch introduces a new interrupt property array as part of both GICv2 and GICv3 driver data. The platform can populate the array with interrupt numbers and respective properties. The corresponding driver initialization iterates through the array, and applies interrupt configuration as required. This capability, and the current way of supplying array (or arrays, in case of GICv3) of secure interrupts, are however mutually exclusive. Henceforth, the platform should supply either: - A list of interrupts to be mapped as secure (the current way). Platforms that do this will continue working as they were. With this patch, this scheme is deprecated. - A list of interrupt properties (properties include interrupt group). Individual interrupt properties are specified via. descriptors of type 'interrupt_prop_desc_t', which can be populated with the macro INTR_PROP_DESC(). A run time assert checks that the platform doesn't specify both. Henceforth the old scheme of providing list of secure interrupts is deprecated. When built with ERROR_DEPRECATED=1, GIC drivers will require that the interrupt properties are supplied instead of an array of secure interrupts. Add a section to firmware design about configuring secure interrupts. Fixes ARM-software/tf-issues#262 Change-Id: I8eec29e72eb69dbb6bce77879febf32c95376942 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* Implement log frameworkSoby Mathew2017-09-111-6/+18
| | | | | | | | | | | | | | | | | | | | This patch gives users control over logging messages printed from the C code using the LOG macros defined in debug.h Users now have the ability to reduce the log_level at run time using the tf_log_set_max_level() function. The default prefix string can be defined by platform by overriding the `plat_log_get_prefix()` platform API which is also introduced in this patch. The new log framework results in saving of some RO data. For example, when BL1 is built for FVP with LOG_LEVEL=LOG_LEVEL_VERBOSE, resulted in saving 384 bytes of RO data and increase of 8 bytes of RW data. The framework also adds about 108 bytes of code to the release build of FVP. Fixes ARM-software/tf-issues#462 Change-Id: I476013d9c3deedfdd4c8b0b0f125665ba6250554 Co-authored-by: Eleanor Bonnici <Eleanor.bonnici@arm.com> Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* Introduce tf_vprintf() and tf_string_print()Soby Mathew2017-09-111-0/+3
| | | | | | | | | This patch introduces tf_vprintf() and tf_string_print() APIs which is needed by the logging framework introduced in a later patch. Change-Id: Ie4240443d0e04e070502b51e371e546dd469fd33 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* Merge pull request #1078 from douglas-raillard-arm/dr/add_cfi_vector_entrydavidcunado-arm2017-09-071-0/+6
|\ | | | | Add CFI debug info to vector entries
| * Add CFI debug info to vector entriesDouglas Raillard2017-08-311-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add Call Frame Information assembler directives to vector entries so that debuggers display the backtrace of functions that triggered a synchronous exception. For example, a function triggering a data abort will be easier to debug if the backtrace can be displayed from a breakpoint at the beginning of the synchronous exception vector. DS-5 needs CFI otherwise it will not attempt to display the backtrace. Other debuggers might have other needs. These debug information are stored in the ELF file but not in the final binary. Change-Id: I32dc4e4b7af02546c93c1a45c71a1f6d710d36b1 Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
* | Merge pull request #1019 from etienne-lms/log-sizedavidcunado-arm2017-09-071-0/+13
|\ \ | | | | | | CPU_DATA_LOG2SIZE depends on cache line size
| * | cpu log buffer size depends on cache line sizeEtienne Carriere2017-09-011-0/+13
| |/ | | | | | | | | | | | | | | | | | | | | | | Platform may use specific cache line sizes. Since CACHE_WRITEBACK_GRANULE defines the platform specific cache line size, it is used to define the size of the cpu data structure CPU_DATA_SIZE aligned on cache line size. Introduce assembly macro 'mov_imm' for AArch32 to simplify implementation of function '_cpu_data_by_index'. Change-Id: Ic2d49ffe0c3e51649425fd9c8c99559c582ac5a1 Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
* | asm_macros: set the default assembly code alignment to 4 byteMasahiro Yamada2017-08-311-7/+6
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Assembly routines are usually defined by using "func" and "endfunc": func foo ... endfunc foo Currently, the "func" macro does not specify ".align" directive by default. It causes unaligned instruction under some circumstances. As far as I tested, this problem happens for GCC 5 or older. It did not happen for GCC 6 or newer. Taking into account that GCC 4.x / 5.x is still used, make sure that assembly code is at least 4 byte aligned. [ How to reproduce the problem ] For example, use GCC 5.3 downloaded from Linaro: http://releases.linaro.org/components/toolchain/binaries/5.3-2016.05/ aarch64-linux-gnu/gcc-linaro-5.3.1-2016.05-x86_64_aarch64-linux-gnu.tar.xz Expand mbedtls-2.4.2 to the current directory. Try the following: $ git log --oneline -1 77544ef Merge pull request #1071 from jeenu-arm/syntax-fix $ aarch64-linux-gnu-gcc --version | head -1 aarch64-linux-gnu-gcc (Linaro GCC 5.3-2016.05) 5.3.1 20160412 $ make CROSS_COMPILE=aarch64-linux-gnu- PLAT=uniphier \ TRUSTED_BOARD_BOOT=1 MBEDTLS_DIR=mbedtls-2.4.2 ( snip build log ) $ aarch64-linux-gnu-nm build/uniphier/release/bl1/bl1.elf | grep handler 00000000800088f4 T bl1_fwu_smc_handler 00000000800084c8 T bl1_smc_handler 000000008000a6e0 t _panic_handler 000000008000a8e0 W plat_error_handler 000000008000a8e8 W plat_panic_handler 000000008000a8d8 W plat_reset_handler 000000008000a39f T reset_handler 000000008000a367 t smc_handler 000000008000a2ef t smc_handler64 You will notice "smc_handler64", "reset_handler", etc. are not properly aligned. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
* Add new alignment parameter to func assembler macroJulius Werner2017-08-151-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Assembler programmers are used to being able to define functions with a specific aligment with a pattern like this: .align X myfunction: However, this pattern is subtly broken when instead of a direct label like 'myfunction:', you use the 'func myfunction' macro that's standard in Trusted Firmware. Since the func macro declares a new section for the function, the .align directive written above it actually applies to the *previous* section in the assembly file, and the function it was supposed to apply to is linked with default alignment. An extreme case can be seen in Rockchip's plat_helpers.S which contains this code: [...] endfunc plat_crash_console_putc .align 16 func platform_cpu_warmboot [...] This assembles into the following plat_helpers.o: Sections: Idx Name Size [...] Algn 9 .text.plat_crash_console_putc 00010000 [...] 2**16 10 .text.platform_cpu_warmboot 00000080 [...] 2**3 As can be seen, the *previous* function actually got the alignment constraint, and it is also 64KB big even though it contains only two instructions, because the .align directive at the end of its section forces the assembler to insert a giant sled of NOPs. The function we actually wanted to align has the default constraint. This code only works at all because the linker just happens to put the two functions right behind each other when linking the final image, and since the end of plat_crash_console_putc is aligned the start of platform_cpu_warmboot will also be. But it still wastes almost 64KB of image space unnecessarily, and it will break under certain circumstances (e.g. if the plat_crash_console_putc function becomes unused and its section gets garbage-collected out). There's no real way to fix this with the existing func macro. Code like func myfunc .align X happens to do the right thing, but is still not really correct code (because the function label is inserted before the .align directive, so the assembler is technically allowed to insert padding at the beginning of the function which would then get executed as instructions if the function was called). Therefore, this patch adds a new parameter with a default value to the func macro that allows overriding its alignment. Also fix up all existing instances of this dangerous antipattern. Change-Id: I5696a07e2fde896f21e0e83644c95b7b6ac79a10 Signed-off-by: Julius Werner <jwerner@chromium.org>
* Support Trusted OS firmware extra images in TF toolsSummer Qin2017-08-091-1/+7
| | | | | | | | | | | Since Trusted OS firmware may have extra images, need to assign new uuid and image id for them. The TBBR chain of trust has been extended to add support for the new images within the existing Trusted OS firmware content certificate. Change-Id: I678dac7ba1137e85c5779b05e0c4331134c10e06 Signed-off-by: Summer Qin <summer.qin@arm.com>
* aarch64: Enable Statistical Profiling Extensions for lower ELsdp-arm2017-06-221-0/+17
| | | | | | | | | | | | SPE is only supported in non-secure state. Accesses to SPE specific registers from SEL1 will trap to EL3. During a world switch, before `TTBR` is modified the SPE profiling buffers are drained. This is to avoid a potential invalid memory access in SEL1. SPE is architecturally specified only for AArch64. Change-Id: I04a96427d9f9d586c331913d815fdc726855f6b0 Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
* Fully initialise essential control registersDavid Cunado2017-06-213-66/+173
| | | | | | | | | | | | | | | | | | | | | This patch updates the el3_arch_init_common macro so that it fully initialises essential control registers rather then relying on hardware to set the reset values. The context management functions are also updated to fully initialise the appropriate control registers when initialising the non-secure and secure context structures and when preparing to leave EL3 for a lower EL. This gives better alignement with the ARM ARM which states that software must initialise RES0 and RES1 fields with 0 / 1. This patch also corrects the following typos: "NASCR definitions" -> "NSACR definitions" Change-Id: Ia8940b8351dc27bc09e2138b011e249655041cfc Signed-off-by: David Cunado <david.cunado@arm.com>
* include: add U()/ULL() macros for constantsVarun Wadekar2017-06-141-17/+18
| | | | | | | This patch uses the U() and ULL() macros for constants, to fix some of the signed-ness defects flagged by the MISRA scanner. Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
* Merge pull request #949 from antonio-nino-diaz-arm/an/printf-memorydavidcunado-arm2017-05-301-0/+1
|\ | | | | Reduce code size when building with Trusted Board Boot enabled
| * Introduce `tf_snprintf`Antonio Nino Diaz2017-05-241-0/+1
| | | | | | | | | | | | | | | | | | | | This is a reduced version of `snprintf` that only supports formats '%d', '%i' and '%u'. It can be used when the full `snprintf` is not needed in order to save memory. If it finds an unknown format specifier, it prints an error message and panics. Change-Id: I2cb06fcdf74cda2c43caf73ae0762a91499fc04e Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | fip: move headers shared between TF and fiptool to include/tools_shareMasahiro Yamada2017-05-231-76/+0
|/ | | | | | | | | | | | | | | | | | Some header files need to be shared between TF and host programs. For fiptool, two headers are copied to the tools/fiptool directory, but it looks clumsy. This commit introduces a new directory, include/tools_share, which collects headers that should be shared between TF and host programs. This will clarify the interface exposed to host tools. We should add new headers to this directory only when we really need to do so. For clarification, I inserted a blank line between headers from the include/ directory (#include <...>) and ones from a local directory (#include "..." ). Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
* Use SPDX license identifiersdp-arm2017-05-0316-400/+16
| | | | | | | | | | | | To make software license auditing simpler, use SPDX[0] license identifiers instead of duplicating the license text in every file. NOTE: Files that have been imported by FreeBSD have not been modified. [0]: https://spdx.org/ Change-Id: I80a00e1f641b8cc075ca5a95b10607ed9ed8761a Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
* Merge branch 'integration' into tf_issue_461Scott Branden2017-04-292-1/+34
|\
| * Merge pull request #910 from dp-arm/dp/AArch32-juno-portdavidcunado-arm2017-04-211-0/+33
| |\ | | | | | | Add AArch32 support for Juno
| | * AArch32: Add support for ARM Cortex-A53/57/72 MPCore ProcessorYatharth Kochar2017-04-201-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds AArch32 state support for ARM Cortex-A53, Cortex-A57 and Cortex-A72 MPCore Processor in the CPU specific operations framework. NOTE: CPU errata handling code is not present in this patch. Change-Id: I01eb3e028e40dde37565707ebc99e06e7a0c113d Signed-off-by: Yatharth Kochar <yatharth.kochar@arm.com> Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
| * | Remove build option `ASM_ASSERTION`Antonio Nino Diaz2017-04-201-1/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | | | The build option `ENABLE_ASSERTIONS` should be used instead. That way both C and ASM assertions can be enabled or disabled together. All occurrences of `ASM_ASSERTION` in common code and ARM platforms have been replaced by `ENABLE_ASSERTIONS`. ASM_ASSERTION has been removed from the user guide. Change-Id: I51f1991f11b9b7ff83e787c9a3270c274748ec6f Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | Move defines in utils.h to utils_def.h to fix shared header compile issuesScott Branden2017-04-291-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | utils.h is included in various header files for the defines in it. Some of the other header files only contain defines. This allows the header files to be shared between host and target builds for shared defines. Recently types.h has been included in utils.h as well as some function prototypes. Because of the inclusion of types.h conflicts exist building host tools abd these header files now. To solve this problem, move the defines to utils_def.h and have this included by utils.h and change header files to only include utils_def.h and not pick up the new types.h being introduced. Fixes ARM-software/tf-issues#461 Signed-off-by: Scott Branden <scott.branden@broadcom.com> Remove utils_def.h from utils.h This patch removes utils_def.h from utils.h as it is not required. And also makes a minor change to ensure Juno platform compiles. Change-Id: I10cf1fb51e44a8fa6dcec02980354eb9ecc9fa29
* Merge pull request #886 from dp-arm/dp/stack-protectordavidcunado-arm2017-04-063-2/+17
|\ | | | | Add support for GCC stack protection
| * Add support for GCC stack protectionDouglas Raillard2017-03-313-2/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce new build option ENABLE_STACK_PROTECTOR. It enables compilation of all BL images with one of the GCC -fstack-protector-* options. A new platform function plat_get_stack_protector_canary() is introduced. It returns a value that is used to initialize the canary for stack corruption detection. Returning a random value will prevent an attacker from predicting the value and greatly increase the effectiveness of the protection. A message is printed at the ERROR level when a stack corruption is detected. To be effective, the global data must be stored at an address lower than the base of the stacks. Failure to do so would allow an attacker to overwrite the canary as part of an attack which would void the protection. FVP implementation of plat_get_stack_protector_canary is weak as there is no real source of entropy on the FVP. It therefore relies on a timer's value, which could be predictable. Change-Id: Icaaee96392733b721fa7c86a81d03660d3c1bc06 Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
* | Re-factor header files for easier PSCI library integrationSoby Mathew2017-03-273-141/+227
|/ | | | | | | | | | | | | | | | | | This patch re-factors the following headers to make it easier to integrate the PSCI library with an AArch32 Secure Payload : * bl_common.h : The entry point information and the param header data structures are factored out into separate headers ep_info.h and param_headers.h * psci.h : The PSCI library interfaces are factored out into the new header psci_lib.h * context_mgmt.h : The header file is modified to not include arch.h when compiled for AArch32 mode. No functional changes are introduced by this patch. Change-Id: I5e21a843c0af2ba8e47dee4e577cf95929be8cd4 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* Merge pull request #841 from dp-arm/dp/debug-regsdanh-arm2017-02-202-2/+8
|\ | | | | Disable secure self-hosted debug
| * Disable secure self-hosted debug via MDCR_EL3/SDCRdp-arm2017-02-152-2/+8
| | | | | | | | | | | | | | | | | | | | | | Trusted Firmware currently has no support for secure self-hosted debug. To avoid unexpected exceptions, disable software debug exceptions, other than software breakpoint instruction exceptions, from all exception levels in secure state. This applies to both AArch32 and AArch64 EL3 initialization. Change-Id: Id097e54a6bbcd0ca6a2be930df5d860d8d09e777 Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
* | Introduce unified API to zero memoryDouglas Raillard2017-02-061-3/+3
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce zeromem_dczva function on AArch64 that can handle unaligned addresses and make use of DC ZVA instruction to zero a whole block at a time. This zeroing takes place directly in the cache to speed it up without doing external memory access. Remove the zeromem16 function on AArch64 and replace it with an alias to zeromem. This zeromem16 function is now deprecated. Remove the 16-bytes alignment constraint on __BSS_START__ in firmware-design.md as it is now not mandatory anymore (it used to comply with zeromem16 requirements). Change the 16-bytes alignment constraints in SP min's linker script to a 8-bytes alignment constraint as the AArch32 zeromem implementation is now more efficient on 8-bytes aligned addresses. Introduce zero_normalmem and zeromem helpers in platform agnostic header that are implemented this way: * AArch32: * zero_normalmem: zero using usual data access * zeromem: alias for zero_normalmem * AArch64: * zero_normalmem: zero normal memory using DC ZVA instruction (needs MMU enabled) * zeromem: zero using usual data access Usage guidelines: in most cases, zero_normalmem should be preferred. There are 2 scenarios where zeromem (or memset) must be used instead: * Code that must run with MMU disabled (which means all memory is considered device memory for data accesses). * Code that fills device memory with null bytes. Optionally, the following rule can be applied if performance is important: * Code zeroing small areas (few bytes) that are not secrets should use memset to take advantage of compiler optimizations. Note: Code zeroing security-related critical information should use zero_normalmem/zeromem instead of memset to avoid removal by compilers' optimizations in some cases or misbehaving versions of GCC. Fixes ARM-software/tf-issues#408 Change-Id: Iafd9663fc1070413c3e1904e54091cf60effaa82 Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
* Allow spin locks to be defined from assemblyJeenu Viswambharan2017-01-302-2/+22
| | | | | | | | At present, spin locks can only defined from C files. Add some macros such that they can be defined from assembly files too. Change-Id: I64f0c214062f5c15b3c8b412c7f25c908e87d970 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* Use #ifdef for IMAGE_BL* instead of #ifMasahiro Yamada2017-01-243-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | One nasty part of ATF is some of boolean macros are always defined as 1 or 0, and the rest of them are only defined under certain conditions. For the former group, "#if FOO" or "#if !FOO" must be used because "#ifdef FOO" is always true. (Options passed by $(call add_define,) are the cases.) For the latter, "#ifdef FOO" or "#ifndef FOO" should be used because checking the value of an undefined macro is strange. Here, IMAGE_BL* is handled by make_helpers/build_macro.mk like follows: $(eval IMAGE := IMAGE_BL$(call uppercase,$(3))) $(OBJ): $(2) @echo " CC $$<" $$(Q)$$(CC) $$(TF_CFLAGS) $$(CFLAGS) -D$(IMAGE) -c $$< -o $$@ This means, IMAGE_BL* is defined when building the corresponding image, but *undefined* for the other images. So, IMAGE_BL* belongs to the latter group where we should use #ifdef or #ifndef. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
* Merge pull request #791 from jeenu-arm/asm-assert-32danh-arm2016-12-201-2/+2
|\ | | | | AArch32: Print ASM_ASSERT and panic messages
| * AArch32: Print ASM_ASSERT and panic messagesJeenu Viswambharan2016-12-191-2/+2
| | | | | | | | | | | | | | | | | | ASM_ASSERT failure and panic messages are suppressed at present. This patch enables printing the PC location for panic messages, and file name and line number upon assembly assert failure. Change-Id: I80cb715988e7ce766f64da1e1d7065a74a096a0c Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* | Export is_mem_free() functionSandrine Bailleux2016-12-201-0/+3
|/ | | | | | | | The is_mem_free() function used to be local to bl_common.c. This patch exports it so that it can be used outside of bl_common.c. Change-Id: I01dcb4229f3a36f56a4724b567c5e6c416dc5e98 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* Merge pull request #774 from jeenu-arm/no-return-macrodanh-arm2016-12-123-1/+45
|\ | | | | Define and use no_ret macro where no return is expected
| * Define and use no_ret macro where no return is expectedJeenu Viswambharan2016-12-053-1/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are many instances in ARM Trusted Firmware where control is transferred to functions from which return isn't expected. Such jumps are made using 'bl' instruction to provide the callee with the location from which it was jumped to. Additionally, debuggers infer the caller by examining where 'lr' register points to. If a 'bl' of the nature described above falls at the end of an assembly function, 'lr' will be left pointing to a location outside of the function range. This misleads the debugger back trace. This patch defines a 'no_ret' macro to be used when jumping to functions from which return isn't expected. The macro ensures to use 'bl' instruction for the jump, and also, for debug builds, places a 'nop' instruction immediately thereafter (unless instructed otherwise) so as to leave 'lr' pointing within the function range. Change-Id: Ib34c69fc09197cfd57bc06e147cc8252910e01b0 Co-authored-by: Douglas Raillard <douglas.raillard@arm.com> Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* | Reset EL2 and EL3 configurable controlsDavid Cunado2016-12-011-8/+0
|/ | | | | | | | | | | | | | | | | | | This patch resets EL2 and EL3 registers that have architecturally UNKNOWN values on reset and that also provide EL2/EL3 configuration and trap controls. Specifically, the EL2 physical timer is disabled to prevent timer interrups into EL2 - CNTHP_CTL_EL2 and CNTHP_CTL for AArch64 and AArch32, respectively. Additionally, for AArch64, HSTR_EL2 is reset to avoid unexpected traps of non-secure access to certain system registers at EL1 or lower. For AArch32, the patch also reverts the reset to SDCR which was incorrectly added in a previous change. Change-Id: If00eaa23afa7dd36a922265194ccd6223187414f Signed-off-by: David Cunado <david.cunado@arm.com>
* Add CFI debug frame information for ASM functionsDouglas Raillard2016-11-211-1/+20
| | | | | | | | | | | | | | | | This allows the debugger to print the callstack when there is an assembly function in the callstack. It will work as long as the CFA pointer (frame pointer) location is not modified (i.e. x29 is not touched in AArch64 state). It is the case in almost all assembly functions, so this patch improves the average debugging experience. Call stacks from the debugger should still be interpreted with care. In more complex functions, one could use .cfi* directives to inform the debugger about the new location of the CFA pointer. Change-Id: I9dabfbc033b45e8528e67f4823c17de7bf02fa24 Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
* Reset debug registers MDCR-EL3/SDCR and MDCR_EL2/HDCRDavid Cunado2016-11-092-0/+15
| | | | | | | | | | | | | | | | | | | In order to avoid unexpected traps into EL3/MON mode, this patch resets the debug registers, MDCR_EL3 and MDCR_EL2 for AArch64, and SDCR and HDCR for AArch32. MDCR_EL3/SDCR is zero'ed when EL3/MON mode is entered, at the start of BL1 and BL31/SMP_MIN. For MDCR_EL2/HDCR, this patch zero's the bits that are architecturally UNKNOWN values on reset. This is done when exiting from EL3/MON mode but only on platforms that support EL2/HYP mode but choose to exit to EL1/SVC mode. Fixes ARM-software/tf-issues#430 Change-Id: Idb992232163c072faa08892251b5626ae4c3a5b6 Signed-off-by: David Cunado <david.cunado@arm.com>
* AArch32: Add `memcpy4` function in assemblyYatharth Kochar2016-09-281-1/+1
| | | | | | | | | | | | | | | | | At present the `el3_entrypoint_common` macro uses `memcpy` function defined in lib/stdlib/mem.c file, to copy data from ROM to RAM for BL1. Depending on the compiler being used the stack could potentially be used, in `memcpy`, for storing the local variables. Since the stack is initialized much later in `el3_entrypoint_common` it may result in unknown behaviour. This patch adds `memcpy4` function definition in assembly so that it can be used before the stack is initialized and it also replaces `memcpy` by `memcpy4` in `el3_entrypoint_common` macro, to copy data from ROM to RAM for BL1. Change-Id: I3357a0e8095f05f71bbbf0b185585d9499bfd5e0
* PSCI: Introduce PSCI Library argument structureSoby Mathew2016-09-221-0/+1
| | | | | | | | | | | | | | | | | This patch introduces a `psci_lib_args_t` structure which must be passed into `psci_setup()` which is then used to initialize the PSCI library. The `psci_lib_args_t` is a versioned structure so as to enable compatibility checks during library initialization. Both BL31 and SP_MIN are modified to use the new structure. SP_MIN is also modified to add version string and build message as part of its cold boot log just like the other BLs in Trusted Firmware. NOTE: Please be aware that this patch modifies the prototype of `psci_setup()`, which breaks compatibility with EL3 Runtime Firmware (excluding BL31 and SP_MIN) integrated with the PSCI Library. Change-Id: Ic3761db0b790760a7ad664d8a437c72ea5edbcd6
* AArch32: Common changes needed for BL1/BL2Yatharth Kochar2016-09-212-0/+288
| | | | | | | | | | | | | | | | | | | | | | This patch adds common changes to support AArch32 state in BL1 and BL2. Following are the changes: * Added functions for disabling MMU from Secure state. * Added AArch32 specific SMC function. * Added semihosting support. * Added reporting of unhandled exceptions. * Added uniprocessor stack support. * Added `el3_entrypoint_common` macro that can be shared by BL1 and BL32 (SP_MIN) BL stages. The `el3_entrypoint_common` is similar to the AArch64 counterpart with the main difference in the assembly instructions and the registers that are relevant to AArch32 execution state. * Enabled `LOAD_IMAGE_V2` flag in Makefile for `ARCH=aarch32` and added check to make sure that platform has not overridden to disable it. Change-Id: I33c6d8dfefb2e5d142fdfd06a0f4a7332962e1a3
* Add new version of image loading.Yatharth Kochar2016-09-202-5/+128
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds capability to load BL images based on image descriptors instead of hard coded way of loading BL images. This framework is designed such that it can be readily adapted by any BL stage that needs to load images. In order to provide the above capability the following new platform functions are introduced: bl_load_info_t *plat_get_bl_image_load_info(void); This function returns pointer to the list of images that the platform has populated to load. bl_params_t *plat_get_next_bl_params(void); This function returns a pointer to the shared memory that the platform has kept aside to pass trusted firmware related information that next BL image needs. void plat_flush_next_bl_params(void); This function flushes to main memory all the params that are passed to next image. int bl2_plat_handle_post_image_load(unsigned int image_id) This function can be used by the platforms to update/use image information for given `image_id`. `desc_image_load.c` contains utility functions which can be used by the platforms to generate, load and executable, image list based on the registered image descriptors. This patch also adds new version of `load_image/load_auth_image` functions in-order to achieve the above capability. Following are the changes for the new version as compared to old: - Refactor the signature and only keep image_id and image_info_t arguments. Removed image_base argument as it is already passed through image_info_t. Given that the BL image base addresses and limit/size are already provided by the platforms, the meminfo_t and entry_point_info arguments are not needed to provide/reserve the extent of free memory for the given BL image. - Added check for the image size against the defined max size. This is needed because the image size could come from an unauthenticated source (e.g. the FIP header). To make this check, new member is added to the image_info_t struct for identifying the image maximum size. New flag `LOAD_IMAGE_V2` is added in the Makefile. Default value is 0. NOTE: `TRUSTED_BOARD_BOOT` is currently not supported when `LOAD_IMAGE_V2` is enabled. Change-Id: Ia7b643f4817a170d5a2fbf479b9bc12e63112e79
* AArch32: Add support in TF librariesSoby Mathew2016-08-101-0/+15
| | | | | | | | | | This patch adds AArch32 support to cpu ops, context management, per-cpu data and spinlock libraries. The `entrypoint_info` structure is modified to add support for AArch32 register arguments. The CPU operations for AEM generic cpu in AArch32 mode is also added. Change-Id: I1e52e79f498661d8f31f1e7b3a29e222bc7a4483
* AArch32: Add API to invoke runtime service handlerSoby Mathew2016-08-101-1/+20
| | | | | | | | | | | | | | This patch adds an API in runtime service framework to invoke the registered handler corresponding to the SMC function identifier. This is helpful for AArch32 because the number of arguments required by the handler is more than registers available as per AArch32 program calling conventions and requires the use of stack. Hence this new API will do the necessary argument setup and invoke the appropriate handler. Although this API is primarily intended for AArch32, it can be used for AArch64 as well. Change-Id: Iefa15947fe5a1df55b0859886e677446a0fd7241
* AArch32: Add assembly helpersSoby Mathew2016-08-103-2/+145
| | | | | | | | | | | | | | | | | This patch adds various assembly helpers for AArch32 like : * cache management : Functions to flush, invalidate and clean cache by MVA. Also helpers to do cache operations by set-way are also added. * stack management: Macros to declare stack and get the current stack corresponding to current CPU. * Misc: Macros to access co processor registers in AArch32, macros to define functions in assembly, assert macros, generic `do_panic()` implementation and function to zero block of memory. Change-Id: I7b78ca3f922c0eda39beb9786b7150e9193425be
* Rearrange assembly helper macrosSoby Mathew2016-07-193-75/+112
| | | | | | | | This patch moves assembler macros which are not architecture specific to a new file `asm_macros_common.S` and moves the `el3_common_macros.S` into `aarch64` specific folder. Change-Id: I444a1ee3346597bf26a8b827480cd9640b38c826
* Introduce PSCI Library InterfaceSoby Mathew2016-07-191-165/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces the PSCI Library interface. The major changes introduced are as follows: * Earlier BL31 was responsible for Architectural initialization during cold boot via bl31_arch_setup() whereas PSCI was responsible for the same during warm boot. This functionality is now consolidated by the PSCI library and it does Architectural initialization via psci_arch_setup() during both cold and warm boots. * Earlier the warm boot entry point was always `psci_entrypoint()`. This was not flexible enough as a library interface. Now PSCI expects the runtime firmware to provide the entry point via `psci_setup()`. A new function `bl31_warm_entrypoint` is introduced in BL31 and the previous `psci_entrypoint()` is deprecated. * The `smc_helpers.h` is reorganized to separate the SMC Calling Convention defines from the Trusted Firmware SMC helpers. The former is now in a new header file `smcc.h` and the SMC helpers are moved to Architecture specific header. * The CPU context is used by PSCI for context initialization and restoration after power down (PSCI Context). It is also used by BL31 for SMC handling and context management during Normal-Secure world switch (SMC Context). The `psci_smc_handler()` interface is redefined to not use SMC helper macros thus enabling to decouple the PSCI context from EL3 runtime firmware SMC context. This enables PSCI to be integrated with other runtime firmware using a different SMC context. NOTE: With this patch the architectural setup done in `bl31_arch_setup()` is done as part of `psci_setup()` and hence `bl31_platform_setup()` will be invoked prior to architectural setup. It is highly unlikely that the platform setup will depend on architectural setup and cause any failure. Please be be aware of this change in sequence. Change-Id: I7f497a08d33be234bbb822c28146250cb20dab73
* Introduce `el3_runtime` and `PSCI` librariesSoby Mathew2016-07-185-455/+137
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch moves the PSCI services and BL31 frameworks like context management and per-cpu data into new library components `PSCI` and `el3_runtime` respectively. This enables PSCI to be built independently from BL31. A new `psci_lib.mk` makefile is introduced which adds the relevant PSCI library sources and gets included by `bl31.mk`. Other changes which are done as part of this patch are: * The runtime services framework is now moved to the `common/` folder to enable reuse. * The `asm_macros.S` and `assert_macros.S` helpers are moved to architecture specific folder. * The `plat_psci_common.c` is moved from the `plat/common/aarch64/` folder to `plat/common` folder. The original file location now has a stub which just includes the file from new location to maintain platform compatibility. Most of the changes wouldn't affect platform builds as they just involve changes to the generic bl1.mk and bl31.mk makefiles. NOTE: THE `plat_psci_common.c` FILE HAS MOVED LOCATION AND THE STUB FILE AT THE ORIGINAL LOCATION IS NOW DEPRECATED. PLATFORMS SHOULD MODIFY THEIR MAKEFILES TO INCLUDE THE FILE FROM THE NEW LOCATION. Change-Id: I6bd87d5b59424995c6a65ef8076d4fda91ad5e86
* Fix coding guideline warningsSoby Mathew2016-07-182-13/+13
| | | | | | | This patch fixes some coding guideline warnings reported by the checkpatch script. Only files related to upcoming feature development have been fixed. Change-Id: I26fbce75c02ed62f00493ed6c106fe7c863ddbc5
View Lorry Controller Status