Commit Graph

289 Commits

Author SHA1 Message Date
Louis Mayencourt 330ead8065 PIE: Fix reloc at the beginning of bl31 entrypoint
The relocation fixup code must be called at the beginning of bl31
entrypoint to ensure that CPU specific reset handlers are fixed up for
relocations.

Change-Id: Icb04eacb2d4c26c26b08b768d871d2c82777babb
Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-03-25 10:54:59 +00:00
Alexei Fedorov 317d68e9de Restore PAuth context in case of unknown SMC call
Change-Id: I8fb346743b7afddbb8bf5908db4f27ee5a26f99b
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
2019-03-18 16:02:16 +00:00
Alexei Fedorov 7dcbb4f315 BL31: Enable pointer authentication support in warm boot path
In the current Pointer Authentication support added in
commit b86048c40c
PAuth gets enabled in BL31 cold boot entrypoint only,
(see bl31_entrypoint() in bl31\aarch64\bl31_entrypoint.S)
but not in bl31_warm_entrypoint().
This results in EnIA bit [31] in SCTLR_EL3 not being set
and pointer authentication disabled after CPU wake-up event.

Fixes ARM-software/tf-issues#684

Change-Id: I27a67804764dfba2a6d72ca119ca2bcff4f536d6
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
2019-03-07 10:50:10 +00:00
Antonio Nino Diaz 73308618fe Minor changes to documentation and comments
Fix some typos and clarify some sentences.

Change-Id: Id276d1ced9a991b4eddc5c47ad9a825e6b29ef74
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2019-02-28 13:35:21 +00:00
Antonio Nino Diaz 88cfd9a604 BL31: Enable pointer authentication support
The size increase after enabling options related to ARMv8.3-PAuth is:

+----------------------------+-------+-------+-------+--------+
|                            |  text |  bss  |  data | rodata |
+----------------------------+-------+-------+-------+--------+
| CTX_INCLUDE_PAUTH_REGS = 1 |  +192 | +1536 |   +0  |   +0   |
|                            |  0.3% |  3.1% |       |        |
+----------------------------+-------+-------+-------+--------+
| ENABLE_PAUTH = 1           | +1848 | +1536 |  +16  |   +0   |
|                            |  3.3% |  3.1% |  3.1% |        |
+----------------------------+-------+-------+-------+--------+

Results calculated with the following build configuration:

    make PLAT=fvp SPD=tspd DEBUG=1 \
    SDEI_SUPPORT=1                 \
    EL3_EXCEPTION_HANDLING=1       \
    TSP_NS_INTR_ASYNC_PREEMPT=1    \
    CTX_INCLUDE_PAUTH_REGS=1       \
    ENABLE_PAUTH=1

Change-Id: I43db7e509a4f39da6599ec2faa690d197573ec1b
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2019-02-27 11:58:10 +00:00
Antonio Nino Diaz b86048c40c Add support for pointer authentication
The previous commit added the infrastructure to load and save
ARMv8.3-PAuth registers during Non-secure <-> Secure world switches, but
didn't actually enable pointer authentication in the firmware.

This patch adds the functionality needed for platforms to provide
authentication keys for the firmware, and a new option (ENABLE_PAUTH) to
enable pointer authentication in the firmware itself. This option is
disabled by default, and it requires CTX_INCLUDE_PAUTH_REGS to be
enabled.

Change-Id: I35127ec271e1198d43209044de39fa712ef202a5
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2019-02-27 11:58:09 +00:00
Antonio Nino Diaz 5283962eba Add ARMv8.3-PAuth registers to CPU context
ARMv8.3-PAuth adds functionality that supports address authentication of
the contents of a register before that register is used as the target of
an indirect branch, or as a load.

This feature is supported only in AArch64 state.

This feature is mandatory in ARMv8.3 implementations.

This feature adds several registers to EL1. A new option called
CTX_INCLUDE_PAUTH_REGS has been added to select if the TF needs to save
them during Non-secure <-> Secure world switches. This option must be
enabled if the hardware has the registers or the values will be leaked
during world switches.

To prevent leaks, this patch also disables pointer authentication in the
Secure world if CTX_INCLUDE_PAUTH_REGS is 0. Any attempt to use it will
be trapped in EL3.

Change-Id: I27beba9907b9a86c6df1d0c5bf6180c972830855
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2019-02-27 11:08:59 +00:00
Antonio Niño Díaz 873e394b3b
Merge pull request #1810 from antonio-nino-diaz-arm/an/setjmp
Make setjmp/longjmp compliant with the C standard and move them to libc
2019-02-11 09:58:53 +00:00
Antonio Nino Diaz 70b0f2789e libc: Move setjmp to libc folder
Now that setjmp() and longjmp() are compliant with the standard they can
be moved with the other libc files.

Change-Id: Iea3b91c34eb353ace5e171e72f331602d57774d5
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2019-02-08 13:42:38 +00:00
Varun Wadekar 596929b971 locks: linker variables to calculate per-cpu bakery lock size
This patch introduces explicit linker variables to mark the start and
end of the per-cpu bakery lock section to help bakery_lock_normal.c
calculate the size of the section. This patch removes the previously
used '__PERCPU_BAKERY_LOCK_SIZE__' linker variable to make the code
uniform across GNU linker and ARM linker.

Change-Id: Ie0c51702cbc0fe8a2076005344a1fcebb48e7cca
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
2019-02-07 09:00:52 -08:00
Antonio Nino Diaz 0709055ed6 Remove support for the SMC Calling Convention 2.0
This reverts commit 2f37046524 ("Add support for the SMC Calling
Convention 2.0").

SMCCC v2.0 is no longer required for SPM, and won't be needed in the
future. Removing it makes the SMC handling code less complicated.

The SPM implementation based on SPCI and SPRT was using it, but it has
been adapted to SMCCC v1.0.

Change-Id: I36795b91857b2b9c00437cfbfed04b3c1627f578
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2019-01-30 16:01:49 +00:00
Antonio Nino Diaz c26bd4270e SPM: Rename folder of SPM based on MM
This implementation is no longer deprecated.

Change-Id: I68552d0fd5ba9f08fad4345e4657e8e3c5362a36
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2019-01-22 09:21:07 +00:00
Antonio Nino Diaz 8855e52ec5 SPM: Rename SPM_DEPRECATED flag to SPM_MM
The SPM implementation based on MM is going to be kept for the
foreseeable future.

Change-Id: I11e96778a4f52a1aa803e7e048d9a7cb24a53954
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
2019-01-22 09:20:59 +00:00
Soby Mathew cd1f39b48a
Merge pull request #1738 from ardbiesheuvel/synquacer-spm
synquacer: add SPM support
2019-01-16 16:01:42 +00:00
Ard Biesheuvel 32e8353748 spm: permit platform to override the VMA placement of the vector table
On some systems, it may be preferred to place the secure EL1/0 vector
table outside of the static placement of the BL31 image itself, for
instance when the latter is located in non-shareable SRAM which does
not tolerate inner shareable WBWA mappings (as is the case on SynQuacer)

So permit the platform to #define SPM_SHIM_EXCEPTIONS_VMA in its
supplementary linker script, in which case it will be used as the
VMA region for the vector table. Note that the LMA does not change,
and it is up to the platform to copy the contents to the right place
at init time.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
2019-01-15 17:51:23 +01:00
Paul Beesley 8aabea3358 Correct typographical errors
Corrects typos in core code, documentation files, drivers, Arm
platforms and services.

None of the corrections affect code; changes are limited to comments
and other documentation.

Change-Id: I5c1027b06ef149864f315ccc0ea473e2a16bfd1d
Signed-off-by: Paul Beesley <paul.beesley@arm.com>
2019-01-15 15:16:02 +00:00
Antonio Nino Diaz 09d40e0e08 Sanitise includes across codebase
Enforce full include path for includes. Deprecate old paths.

The following folders inside include/lib have been left unchanged:

- include/lib/cpus/${ARCH}
- include/lib/el3_runtime/${ARCH}

The reason for this change is that having a global namespace for
includes isn't a good idea. It defeats one of the advantages of having
folders and it introduces problems that are sometimes subtle (because
you may not know the header you are actually including if there are two
of them).

For example, this patch had to be created because two headers were
called the same way: e0ea0928d5 ("Fix gpio includes of mt8173 platform
to avoid collision."). More recently, this patch has had similar
problems: 46f9b2c3a2 ("drivers: add tzc380 support").

This problem was introduced in commit 4ecca33988 ("Move include and
source files to logical locations"). At that time, there weren't too
many headers so it wasn't a real issue. However, time has shown that
this creates problems.

Platforms that want to preserve the way they include headers may add the
removed paths to PLAT_INCLUDES, but this is discouraged.

Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8f
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2019-01-04 10:43:17 +00:00
Soby Mathew 5bfac4fc2f BL31: correct GOT section omission
When the patch SHA 931f7c6 introduced PIE support for BL31,
adding the GOT section when the SEPARATE_CODE_AND_RODATA=0
to the linker script was erroneously omitted. This patch corrects
the same.

Also the patch reduces the alignment requirement for GOT and RELA
sections from 16 bytes to 8. Comments are added explain the
intent for alignment.

Change-Id: I8035cbf75f346f99bd56b13f32e0b3b70dd2fe6c
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2018-12-17 15:25:49 +00:00
Antonio Nino Diaz e8ce60aeb1 SPM: Introduce SMC handlers for SPCI and SPRT
Change-Id: I2ae9b3bb686c41b2e138132a7bed107925ac861e
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-11 13:45:41 +00:00
Antonio Nino Diaz 2d7b9e5e7f SPM: Deprecate the current implementation
The current SPM is a prototype that only supports one secure partition
in EL0. The objective of SPM is to have multiple partitions. The current
MM interface isn't adequate for this, so it is needed to modify heavily
the code to add proper support for it.

However, there are platforms which are already using this (like SGI) and
removing the code would break it.  For this reason, the current SPM code
has been duplicated in order to temporarily preserve compatibility. All
new improvements/changes to SPM will be done in the non-deprecated copy,
that may change without notice.

The new build option SPM_DEPRECATED has been introduced to select the SPM
implementation. It defaults to 1, that selects the deprecated SPM.

Change-Id: Ic9f80b53b450e97b4d3f47e4ef4a138ee8d87443
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-10 16:37:46 +00:00
Soby Mathew 01fc1c24b9 BL31: Use helper function to save registers in SMC handler
Use the helper function `save_gp_registers` to save the register
state to cpu_context on entry to EL3 in SMC handler. This has the
effect of saving x0 - x3 as well into the cpu_context which was
not done previously but it unifies the register save sequence
in BL31.

Change-Id: I5753c942263a5f9178deda3dba896e3220f3dd83
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2018-12-05 10:40:08 +00:00
Sughosh Ganu 8a3588a7c8 SPM: EHF: Build EHF module along with Secure Partition Manager
Add a dependency for building EL3 exception handling framework(EHF)
module with the secure partition manager(SPM).

The EHF module is needed for raising the core's running priority
before the core enters the secure partition, and lowering it
subsequently on exit from the secure partition.

Change-Id: Icbe2d0a63f00b46dc593ff3d86b676c9333506c3
Signed-off-by: Sughosh Ganu <sughosh.ganu@arm.com>
2018-11-14 11:18:22 +05:30
Antonio Nino Diaz a0fee7474f context_mgmt: Fix MISRA defects
The macro EL_IMPLEMENTED() has been deprecated in favour of the new
function el_implemented().

Change-Id: Ic9b1b81480b5e019b50a050e8c1a199991bf0ca9
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-11-01 14:15:39 +00:00
Soby Mathew 931f7c6156 PIE: Position Independant Executable support for BL31
This patch introduces Position Independant Executable(PIE) support
in TF-A. As a initial prototype, only BL31 can support PIE. A trivial
dynamic linker is implemented which supports fixing up Global Offset
Table(GOT) and Dynamic relocations(.rela.dyn). The fixup_gdt_reloc()
helper function implements this linker and this needs to be called
early in the boot sequence prior to invoking C functions. The GOT is
placed in the RO section of BL31 binary for improved security and the
BL31 linker script is modified to export the appropriate symbols
required for the dynamic linker.

The C compiler always generates PC relative addresses to linker symbols
and hence referencing symbols exporting constants are a problem when
relocating the binary. Hence the reference to the
`__PERCPU_TIMESTAMP_SIZE__` symbol in PMF is removed and is now calculated
at runtime based on start and end addresses.

Change-Id: I1228583ff92cf432963b7cef052e95d995cca93d
Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2018-10-29 09:54:32 +00:00
Roberto Vargas 32aee8415d scmi: Optimize bakery locks when HW_ASSISTED_COHERENCY is enabled
When HW_ASSISTED_COHERENCY is enabled we can use spinlocks
instead of using the more complex and slower bakery algorithm.

Change-Id: I9d791a70050d599241169b9160a67e57d5506564
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-10-16 13:38:41 +01:00
Antonio Nino Diaz 81542c00d0 Remove some MISRA defects in common code
No functional changes.

Change-Id: I9638e02acb9b22eb794ebf45aad84348a710287e
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-10-04 15:43:52 +01:00
Daniel Boulby 87c8513498 Mark BL31 initialization functions
Mark the initialization functions in BL31, such as context management,
EHF, RAS and PSCI as __init so that they can be reclaimed by the
platform when no longer needed

Change-Id: I7446aeee3dde8950b0f410cb766b7a2312c20130
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
2018-10-03 11:47:30 +01:00
Antonio Nino Diaz 7dab0eac07 context_mgmt: Remove deprecated interfaces
Change-Id: I2d4a21a80a768bc422e9707e6d7e98d20a716275
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-09-28 15:31:53 +01:00
Antonio Nino Diaz 74ad948f43 BL31: Fix warning about BL32 init function
The expected value for failure is 0, so the warning only has to be shown
in that case. This is the way the TSPD has done it since it was
introduced, and the way SPM and OP-TEE do it.

Trusty wrongly returns 0 on success.

In the case of TLK, the return value of tlkd_init() is passed from the
secure world in register X1 when calling the SMC TLK_ENTRY_DONE.

Change-Id: I39106d67631ee57f109619f8830bf4b9d96155e6
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-09-18 13:14:30 +01:00
Antonio Nino Diaz 46b9aa764b Convert BL31 error message into warning
If BL32 isn't present or it fails to initialize the current code prints
an error message in both debug and release builds. This is too verbose
for release builds, so it has been converted into a warning.

Also, it was missing a newline at the end of the message.

Change-Id: I91e18d5d5864dbb19d47ecd54f174d2d8c06296c
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-09-06 17:09:57 +01:00
Antonio Nino Diaz c9512bca3b Fix MISRA defects in BL31 common code
Change-Id: I5993b425445ee794e6d2a792c244c0af53640655
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-08-30 09:22:33 +01:00
Dimitris Papastamos 11dfe0b49a
Merge pull request #1532 from jeenu-arm/misra-fixes
MISRA fixes
2018-08-22 10:25:41 +01:00
Dimitris Papastamos 61e7c0542e
Merge pull request #1533 from jeenu-arm/mpam
AArch64: Enable MPAM for lower ELs
2018-08-22 10:24:24 +01:00
Jeenu Viswambharan 03b645ed86 EHF: MISRA fixes
These changes address most of the required MISRA rules. In the process,
some from generic code are also fixed.

No functional changes.

Change-Id: I19786070af7bc5e1f6d15bdba93e22a4451d8fe9
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-08-20 09:05:39 +01:00
Jeenu Viswambharan 5f83591880 AArch64: Enable MPAM for lower ELs
Memory Partitioning And Monitoring is an Armv8.4 feature that enables
various memory system components and resources to define partitions.
Software running at various ELs can then assign themselves to the
desired partition to control their performance aspects.

With this patch, when ENABLE_MPAM_FOR_LOWER_ELS is set to 1, EL3 allows
lower ELs to access their own MPAM registers without trapping to EL3.
This patch however doesn't make use of partitioning in EL3; platform
initialisation code should configure and use partitions in EL3 if
required.

Change-Id: I5a55b6771ccaa0c1cffc05543d2116b60cbbcdcd
Co-authored-by: James Morse <james.morse@arm.com>
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-08-20 07:32:19 +01:00
John Tsichritzis 8a6771803f DSU erratum 936184 workaround
If the system is in near idle conditions, this erratum could cause a
deadlock or data corruption. This patch applies the workaround that
prevents this.

This DSU erratum affects only the DSUs that contain the ACP interface
and it was fixed in r2p0. The workaround is applied only to the DSUs
that are actually affected.

Link to respective Arm documentation:
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.epm138168/index.html

Change-Id: I033213b3077685130fc1e3f4f79c4d15d7483ec9
Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
2018-08-17 10:34:43 +01:00
Jeenu Viswambharan eaeaa4d048 RAS: Introduce handler for EL3 EAs
External Aborts while executing in EL3 is fatal in nature. This patch
allows for the platform to define a handler for External Aborts received
while executing in EL3. A default implementation is added which falls
back to platform unhandled exception.

Change-Id: I466f2c8113a33870f2c7d2d8f2bf20437d9fd354
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-07-19 10:13:18 +01:00
Jeenu Viswambharan d5a23af50f RAS: Introduce handler for Double Faults
Double fault is when the PE receives another error whilst one is being
handled. To detect double fault condition, a per-CPU flag is introduced
to track the status of error handling. The flag is checked/modified
while temporarily masking external aborts on the PE.

This patch routes double faults to a separate platform-defined handler.

Change-Id: I70e9b7ba4c817273c55a0af978d9755ff32cc702
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-07-19 10:13:18 +01:00
Jeenu Viswambharan b56dc2a98c RAS: Introduce handler for Uncontainable errors
Uncontainable errors are the most severe form of errors, which typically
mean that the system state can't be trusted any more. This further means
that normal error recovery process can't be followed, and an orderly
shutdown of the system is often desirable.

This patch allows for the platform to define a handler for Uncontainable
errors received. Due to the nature of Uncontainable error, the handler
is expected to initiate an orderly shutdown of the system, and therefore
is not expected to return. A default implementation is added which falls
back to platform unhandled exception.

Also fix ras_arch.h header guards.

Change-Id: I072e336a391a0b382e77e627eb9e40729d488b55
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-07-19 10:13:17 +01:00
Jeenu Viswambharan ee6ff1bb37 RAS: Validate stack pointer after error handling
RAS handling flows might involve using setjmp/longjump calls introduced
in earlier patches; therefore, it'd be good to make sure the stack has
been unwound completely after the handling.

This patch inserts ASM assertions on the RAS handling path to validate
stack.

Change-Id: I59d40d3122010c977cdeab3cce3160f3909e7e69
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-07-17 08:31:31 +01:00
Jeenu Viswambharan df8f3188d7 RAS: Move EA handling to a separate file
A new file ea_delegate.S is introduced, and all EA-related functions are
moved into it. This makes runtime_exceptions.S less crowded and reads
better.

No functional changes.

Change-Id: I64b653b3931984cffd420563f8e8d1ba263f329f
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-07-17 08:31:31 +01:00
Roberto Vargas a9203edae7 Add end_vector_entry assembler macro
Check_vector_size checks if the size of the vector fits
in the size reserved for it. This check creates problems in
the Clang assembler. A new macro, end_vector_entry, is added
and check_vector_size is deprecated.

This new macro fills the current exception vector until the next
exception vector. If the size of the current vector is bigger
than 32 instructions then it gives an error.

Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-07-11 09:23:00 +01:00
Roberto Vargas 5629b2b11c Use ALIGN instead of NEXT in linker scripts
Clang linker doesn't support NEXT. As we are not using the MEMORY command
to define discontinuous memory for the output file in any of the linker
scripts, ALIGN and NEXT are equivalent.

Change-Id: I867ffb9c9a76d4e81c9ca7998280b2edf10efea0
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-07-11 09:21:02 +01:00
Jeenu Viswambharan 64ee263e20 DynamIQ: Enable MMU without using stack
Having an active stack while enabling MMU has shown coherency problems.
This patch builds on top of translation library changes that introduces
MMU-enabling without using stacks.

Previously, with HW_ASSISTED_COHERENCY, data caches were disabled while
enabling MMU only because of active stack. Now that we can enable MMU
without using stack, we can enable both MMU and data caches at the same
time.

NOTE: Since this feature depends on using translation table library v2,
disallow using translation table library v1 with HW_ASSISTED_COHERENCY.

Fixes ARM-software/tf-issues#566

Change-Id: Ie55aba0c23ee9c5109eb3454cb8fa45d74f8bbb2
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-27 11:31:30 +01:00
Jeenu Viswambharan cdb6ac94ec SDEI: Make dispatches synchronous
SDEI event dispatches currently only sets up the Non-secure context
before returning to the caller. The actual dispatch only happens upon
exiting EL3 next time.

However, for various error handling scenarios, it's beneficial to have
the dispatch happen synchronously. I.e. when receiving SDEI interrupt,
or for a successful sdei_dispatch_event() call, the event handler is
executed; and upon the event completion, dispatcher execution resumes
after the point of dispatch. The jump primitives introduced in the
earlier patch facilitates this feature.

With this patch:

  - SDEI interrupts and calls to sdei_dispatch_event prepares the NS
    context for event dispatch, then sets a jump point, and immediately
    exits EL3. This results in the client handler executing in
    Non-secure.

  - When the SDEI client completes the dispatched event, the SDEI
    dispatcher does a longjmp to the jump pointer created earlier. For
    the caller of the sdei_dispatch_event() in particular, this would
    appear as if call returned successfully.

The dynamic workaround for CVE_2018_3639 is slightly shifted around as
part of related minor refactoring. It doesn't affect the workaround
functionality.

Documentation updated.

NOTE: This breaks the semantics of the explicit dispatch API, and any
exiting usages should be carefully reviewed.

Change-Id: Ib9c876d27ea2af7fb22de49832e55a0da83da3f9
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-21 16:15:23 +01:00
Jeenu Viswambharan e7b9473e15 BL31: Introduce jump primitives
This patch introduces setjmp() and ongjmp() primitives to enable
standard setjmp/longjmp style execution. Both APIs parameters take a
pointer to struct jmpbuf type, which hosts CPU registers saved/restored
during jump.

As per the standard usage:

  - setjmp() return 0 when a jump is setup; and a non-zero value when
    returning from jump.

  - The caller of setjmp() must not return, or otherwise update stack
    pointer since.

Change-Id: I4af1d32e490cfa547979631b762b4cba188d0551
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-06-21 16:15:23 +01:00
Sandrine Bailleux d801a1d035 SPM: Treat SP xlat tables the same as others
The translation tables allocated for the Secure Partition do not need
to be treated as a special case. They can be put amongst the other
tables mapping BL31's general purpose memory. They will be mapped with
the same attributes as them, which is fine.

The explicit alignment constraint in BL31's linker script to pad the
last page of memory allocated to the Secure Partition's translation
tables is useless too, as page tables are per se pages, thus their
end address is naturally aligned on a page-boundary.

In fact, this patch does not change the existing behaviour. Since
patch 22282bb68a ("SPM: Move all SP-related info to SP context
struct"), the secure_partition.c file has been renamed into sp_xlat.c
but the linker script has not been properly updated. As a result, the
SP translation tables are not specifically put at the start of the
xlat_table linker section, the __SP_IMAGE_XLAT_TABLES_START__/_END__
symbols have the same value, the size of the resulting mmap_region
covering these xlat tables is 0 and so it is ignored.

Change-Id: I4cf0a4cc090298811cca53fc9cee74df0f2b1512
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
2018-06-13 09:19:41 +01:00
Dimitris Papastamos 2c3a10780d Rename symbols and files relating to CVE-2017-5715
This patch renames symbols and files relating to CVE-2017-5715 to make
it easier to introduce new symbols and files for new CVE mitigations.

Change-Id: I24c23822862ca73648c772885f1690bed043dbc7
Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-23 12:45:48 +01:00
Jeenu Viswambharan 14c6016ad5 AArch64: Introduce RAS handling
RAS extensions are mandatory for ARMv8.2 CPUs, but are also optional
extensions to base ARMv8.0 architecture.

This patch adds build system support to enable RAS features in ARM
Trusted Firmware. A boolean build option RAS_EXTENSION is introduced for
this.

With RAS_EXTENSION, an Exception Synchronization Barrier (ESB) is
inserted at all EL3 vector entry and exit. ESBs will synchronize pending
external aborts before entering EL3, and therefore will contain and
attribute errors to lower EL execution. Any errors thus synchronized are
detected via. DISR_EL1 register.

When RAS_EXTENSION is set to 1, HANDLE_EL3_EA_FIRST must also be set to 1.

Change-Id: I38a19d84014d4d8af688bd81d61ba582c039383a
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-05-04 08:33:17 +01:00
Jeenu Viswambharan 76454abf4a AArch64: Introduce External Abort handling
At present, any External Abort routed to EL3 is reported as an unhandled
exception and cause a panic. This patch enables ARM Trusted Firmware to
handle External Aborts routed to EL3.

With this patch, when an External Abort is received at EL3, its handling
is delegated to plat_ea_handler() function. Platforms can provide their
own implementation of this function. This patch adds a weak definition
of the said function that prints out a message and just panics.

In order to support handling External Aborts at EL3, the build option
HANDLE_EA_EL3_FIRST must be set to 1.

Before this patch, HANDLE_EA_EL3_FIRST wasn't passed down to
compilation; this patch fixes that too.

Change-Id: I4d07b7e65eb191ff72d63b909ae9512478cd01a1
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-05-04 08:32:42 +01:00