aboutsummaryrefslogtreecommitdiffstats
path: root/bl32
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #1473 from robertovargas-arm/misraDimitris Papastamos2018-07-111-0/+1
|\ | | | | Misra
| * Fix MISRA rule 8.4Roberto Vargas2018-07-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | Rule 8.4: A compatible declaration shall be visible when an object or function with external linkage is defined Fixed for: make DEBUG=1 PLAT=juno ARCH=aarch32 AARCH32_SP=sp_min RESET_TO_SP_MIN=1 JUNO_AARCH32_EL3_RUNTIME=1 bl32 Change-Id: I3ac25096b55774689112ae37bdf1222f9a9ecffb Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* | Add end_vector_entry assembler macroRoberto Vargas2018-07-111-16/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* | Add .extab and .exidx sectionsRoberto Vargas2018-07-111-0/+9
| | | | | | | | | | | | | | | | | | | | These sections are required by clang when the code is compiled for aarch32. These sections are related to the unwind of the stack in exceptions, but in the way that clang defines and uses them, the garbage collector cannot get rid of them. Change-Id: I085efc0cf77eae961d522472f72c4b5bad2237ab Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* | Use ALIGN instead of NEXT in linker scriptsRoberto Vargas2018-07-112-8/+8
|/ | | | | | | | | Clang linker doesn't support NEXT. As we are not using the MEMORY command to define discontinuous memory for the output file in any of the linker scripts, ALIGN and NEXT are equivalent. Change-Id: I867ffb9c9a76d4e81c9ca7998280b2edf10efea0 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* TSP: Enable cache along with MMUJeenu Viswambharan2018-06-271-31/+3
| | | | | | | | | Previously, data caches were disabled while enabling MMU only because of active stack. Now that we can enable MMU without using stack, we can enable both MMU and data caches at the same time. Change-Id: I73f3b8bae5178610e17e9ad06f81f8f6f97734a6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* DynamIQ: Enable MMU without using stackJeenu Viswambharan2018-06-271-7/+4
| | | | | | | | | | | | | | | | | | | Having an active stack while enabling MMU has shown coherency problems. This patch builds on top of translation library changes that introduces MMU-enabling without using stacks. Previously, with HW_ASSISTED_COHERENCY, data caches were disabled while enabling MMU only because of active stack. Now that we can enable MMU without using stack, we can enable both MMU and data caches at the same time. NOTE: Since this feature depends on using translation table library v2, disallow using translation table library v1 with HW_ASSISTED_COHERENCY. Fixes ARM-software/tf-issues#566 Change-Id: Ie55aba0c23ee9c5109eb3454cb8fa45d74f8bbb2 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* Rename symbols and files relating to CVE-2017-5715Dimitris Papastamos2018-05-233-6/+6
| | | | | | | | This patch renames symbols and files relating to CVE-2017-5715 to make it easier to introduce new symbols and files for new CVE mitigations. Change-Id: I24c23822862ca73648c772885f1690bed043dbc7 Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
* types: use int-ll64 for both aarch32 and aarch64Masahiro Yamada2018-04-272-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since commit 031dbb122472 ("AArch32: Add essential Arch helpers"), it is difficult to use consistent format strings for printf() family between aarch32 and aarch64. For example, uint64_t is defined as 'unsigned long long' for aarch32 and as 'unsigned long' for aarch64. Likewise, uintptr_t is defined as 'unsigned int' for aarch32, and as 'unsigned long' for aarch64. A problem typically arises when you use printf() in common code. One solution could be, to cast the arguments to a type long enough for both architectures. For example, if 'val' is uint64_t type, like this: printf("val = %llx\n", (unsigned long long)val); Or, somebody may suggest to use a macro provided by <inttypes.h>, like this: printf("val = %" PRIx64 "\n", val); But, both would make the code ugly. The solution adopted in Linux kernel is to use the same typedefs for all architectures. The fixed integer types in the kernel-space have been unified into int-ll64, like follows: typedef signed char int8_t; typedef unsigned char uint8_t; typedef signed short int16_t; typedef unsigned short uint16_t; typedef signed int int32_t; typedef unsigned int uint32_t; typedef signed long long int64_t; typedef unsigned long long uint64_t; [ Linux commit: 0c79a8e29b5fcbcbfd611daf9d500cfad8370fcf ] This gets along with the codebase shared between 32 bit and 64 bit, with the data model called ILP32, LP64, respectively. The width for primitive types is defined as follows: ILP32 LP64 int 32 32 long 32 64 long long 64 64 pointer 32 64 'long long' is 64 bit for both, so it is used for defining uint64_t. 'long' has the same width as pointer, so for uintptr_t. We still need an ifdef conditional for (s)size_t. All 64 bit architectures use "unsigned long" size_t, and most 32 bit architectures use "unsigned int" size_t. H8/300, S/390 are known as exceptions; they use "unsigned long" size_t despite their architecture is 32 bit. One idea for simplification might be to define size_t as 'unsigned long' across architectures, then forbid the use of "%z" string format. However, this would cause a distortion between size_t and sizeof() operator. We have unknowledge about the native type of sizeof(), so we need a guess of it anyway. I want the following formula to always return 1: __builtin_types_compatible_p(size_t, typeof(sizeof(int))) Fortunately, ARM is probably a majority case. As far as I know, all 32 bit ARM compilers use "unsigned int" size_t. Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
* Fix MISRA rule 8.4 Part 3Roberto Vargas2018-04-131-0/+40
| | | | | | | | | | | Rule 8.4: A compatible declaration shall be visible when an object or function with external linkage is defined Fixed for: make DEBUG=1 PLAT=fvp SPD=tspd all Change-Id: I0a16cf68fef29cf00ec0a52e47786f61d02ca4ae Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* Fix MISRA rule 8.3 Part 3Roberto Vargas2018-04-131-2/+2
| | | | | | | | | | | Rule 8.3: All declarations of an object or function shall use the same names and type qualifiers Fixed for: make DEBUG=1 PLAT=fvp SPD=tspd all Change-Id: I4e31c93d502d433806dfc521479d5d428468b37c Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* Rename 'smcc' to 'smccc'Antonio Nino Diaz2018-03-212-7/+7
| | | | | | | | | | | | | When the source code says 'SMCC' it is talking about the SMC Calling Convention. The correct acronym is SMCCC. This affects a few definitions and file names. Some files have been renamed (smcc.h, smcc_helpers.h and smcc_macros.S) but the old files have been kept for compatibility, they include the new ones with an ERROR_DEPRECATED guard. Change-Id: I78f94052a502436fdd97ca32c0fe86bd58173f2f Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* Remove sp_min functions from plat_common.cSoby Mathew2018-03-021-0/+1
| | | | | | | | | | | | | | | | | | This patch removes default platform implementations of sp_min platform APIs from plat/common/aarch32/plat_common.c. The APIs are now implemented in `plat_sp_min_common.c` file within the same folder. The ARM platform layer had a weak definition of sp_min_platform_setup2() which conflicted with the weak definition in the common file. Hence this patch fixes that by introducing a `plat_arm_` version of the API thus allowing individual boards within ARM platforms to override it if they wish to. Fixes ARM-software/tf-issues#559 Change-Id: I11a74ecae8191878ccc7ea03f12bdd5ae88faba5 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* Merge pull request #1286 from antonio-nino-diaz-arm/an/mmu-mismatchdavidcunado-arm2018-02-282-4/+6
|\ | | | | Clarify comments in xlat tables lib and fixes related to the TLB
| * Add comments about mismatched TCR_ELx and xlat tablesAntonio Nino Diaz2018-02-272-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the MMU is enabled and the translation tables are mapped, data read/writes to the translation tables are made using the attributes specified in the translation tables themselves. However, the MMU performs table walks with the attributes specified in TCR_ELx. They are completely independent, so special care has to be taken to make sure that they are the same. This has to be done manually because it is not practical to have a test in the code. Such a test would need to know the virtual memory region that contains the translation tables and check that for all of the tables the attributes match the ones in TCR_ELx. As the tables may not even be mapped at all, this isn't a test that can be made generic. The flags used by enable_mmu_xxx() have been moved to the same header where the functions are. Also, some comments in the linker scripts related to the translation tables have been fixed. Change-Id: I1754768bffdae75f53561b1c4a5baf043b45a304 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | Introduce the new BL handover interfaceSoby Mathew2018-02-261-7/+14
|/ | | | | | | | | | | | | | | This patch introduces a new BL handover interface. It essentially allows passing 4 arguments between the different BL stages. Effort has been made so as to be compatible with the previous handover interface. The previous blx_early_platform_setup() platform API is now deprecated and the new blx_early_platform_setup2() variant is introduced. The weak compatiblity implementation for the new API is done in the `plat_bl_common.c` file. Some of the new arguments in the new API will be reserved for generic code use when dynamic configuration support is implemented. Otherwise the other registers are available for platform use. Change-Id: Ifddfe2ea8e32497fe1beb565cac155ad9d50d404 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* Merge pull request #1173 from etienne-lms/armv7-qemudavidcunado-arm2018-02-071-0/+15
|\ | | | | support to boot OP-TEE on AArch32/Armv7+example with Cortex-A15/Qemu
| * aarch32: optee: define the OP-TEE secure payloadEtienne Carriere2018-02-051-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AArch32 only platforms can boot the OP-TEE secure firmware as a BL32 secure payload. Such configuration can be defined through AARCH32_SP=optee. The source files can rely on AARCH32_SP_OPTEE to condition OP-TEE boot specific instruction sequences. OP-TEE does not expect ARM Trusted Firmware formatted structure as boot argument. Load sequence is expected to have already loaded to OP-TEE boot arguments into the bl32 entrypoint info structure. Last, AArch32 platform can only boot AArch32 OP-TEE images. Change-Id: Ic28eec5004315fc9111051add6bb1a1d607fc815 Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
* | AMU: Add assembler helper functions for aarch32Joel Hutton2018-01-311-1/+2
|/ | | | | Change-Id: Id6dfe885a63561b1d2649521bd020367b96ae1af Signed-off-by: Joel Hutton <joel.hutton@arm.com>
* sp_min: Implement workaround for CVE-2017-5715Dimitris Papastamos2018-01-184-8/+164
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces two workarounds for ARMv7 systems. The workarounds need to be applied prior to any `branch` instruction in secure world. This is achieved using a custom vector table where each entry is an `add sp, sp, #1` instruction. On entry to monitor mode, once the sequence of `ADD` instructions is executed, the branch target buffer (BTB) is invalidated. The bottom bits of `SP` are then used to decode the exception entry type. A side effect of this change is that the exception vectors are installed before the CPU specific reset function. This is now consistent with how it is done on AArch64. Note, on AArch32 systems, the exception vectors are typically tightly integrated with the secure payload (e.g. the Trusted OS). This workaround will need porting to each secure payload that requires it. The patch to modify the AArch32 per-cpu vbar to the corresponding workaround vector table according to the CPU type will be done in a later patch. Change-Id: I5786872497d359e496ebe0757e8017fa98f753fa Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
* Merge pull request #1174 from antonio-nino-diaz-arm/an/page-sizedavidcunado-arm2017-12-082-12/+14
|\ | | | | Replace magic numbers in linkerscripts by PAGE_SIZE
| * Replace magic numbers in linkerscripts by PAGE_SIZEAntonio Nino Diaz2017-11-292-12/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | When defining different sections in linker scripts it is needed to align them to multiples of the page size. In most linker scripts this is done by aligning to the hardcoded value 4096 instead of PAGE_SIZE. This may be confusing when taking a look at all the codebase, as 4096 is used in some parts that aren't meant to be a multiple of the page size. Change-Id: I36c6f461c7782437a58d13d37ec8b822a1663ec1 Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* | ARM platforms: Fixup AArch32 buildsSoby Mathew2017-11-291-0/+4
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a couple of issues for AArch32 builds on ARM reference platforms : 1. The arm_def.h previously defined the same BL32_BASE value for AArch64 and AArch32 build. Since BL31 is not present in AArch32 mode, this meant that the BL31 memory is empty when built for AArch32. Hence this patch allocates BL32 to the memory region occupied by BL31 for AArch32 builds. As a side-effect of this change, the ARM_TSP_RAM_LOCATION macro cannot be used to control the load address of BL32 in AArch32 mode which was never the intention of the macro anyway. 2. A static assert is added to sp_min linker script to check that the progbits are within the bounds expected when overlaid with other images. 3. Fix specifying `SPD` when building Juno for AArch32 mode. Due to the quirks involved when building Juno for AArch32 mode, the build option SPD needed to specifed. This patch corrects this and also updates the documentation in the user-guide. 4. Exclude BL31 from the build and FIP when building Juno for AArch32 mode. As a result the previous assumption that BL31 must be always present is removed and the certificates for BL31 is only generated if `NEED_BL31` is defined. Change-Id: I1c39bbc0abd2be8fbe9f2dea2e9cb4e3e3e436a8 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* AMU: Implement support for aarch32Dimitris Papastamos2017-11-291-1/+5
| | | | | | | | | The `ENABLE_AMU` build option can be used to enable the architecturally defined AMU counters. At present, there is no support for the auxiliary counter group. Change-Id: Ifc7532ef836f83e629f2a146739ab61e75c4abc8 Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
* ARMv7 requires the clear exclusive access at monitor entryEtienne Carriere2017-11-081-5/+13
| | | | | | Clear exclusive monitor on SMC and FIQ entry for ARMv7 cores. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
* BL31: Introduce Publish and Subscribe frameworkJeenu Viswambharan2017-10-231-0/+8
| | | | | | | | | | | | This light-weight framework enables some EL3 components to publish events which other EL3 components can subscribe to. Publisher can optionally pass opaque data for subscribers. The order in which subscribers are called is not defined. Firmware design updated. Change-Id: I24a3a70b2b1dedcb1f73cf48313818aebf75ebb6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* Init and save / restore of PMCR_EL0 / PMCRDavid Cunado2017-10-131-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | Currently TF does not initialise the PMCR_EL0 register in the secure context or save/restore the register. In particular, the DP field may not be set to one to prohibit cycle counting in the secure state, even though event counting generally is prohibited via the default setting of MDCR_EL3.SMPE to 0. This patch initialises PMCR_EL0.DP to one in the secure state to prohibit cycle counting and also initialises other fields that have an architectually UNKNOWN reset value. Additionally, PMCR_EL0 is added to the list of registers that are saved and restored during a world switch. Similar changes are made for PMCR for the AArch32 execution state. NOTE: secure world code at lower ELs that assume other values in PMCR_EL0 will be impacted. Change-Id: Iae40e8c0a196d74053accf97063ebc257b4d2f3a Signed-off-by: David Cunado <david.cunado@arm.com>
* Set NS version SCTLR during warmboot pathDavid Cunado2017-09-051-0/+12
| | | | | | | | | | | | | When ARM TF executes in AArch32 state, the NS version of SCTLR is not being set during warmboot flow. This results in secondary CPUs entering the Non-secure world with the default reset value in SCTLR. This patch explicitly sets the value of the NS version of SCTLR during the warmboot flow rather than relying on the h/w. Change-Id: I86bf52b6294baae0a5bd8af0cd0358cc4f55c416 Signed-off-by: David Cunado <david.cunado@arm.com>
* Merge pull request #1054 from jwerner-chromium/JW_crash_x30davidcunado-arm2017-08-221-14/+14
|\ | | | | Fix x30 reporting for unhandled exceptions
| * Fix x30 reporting for unhandled exceptionsJulius Werner2017-08-211-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | Some error paths that lead to a crash dump will overwrite the value in the x30 register by calling functions with the no_ret macro, which resolves to a BL instruction. This is not very useful and not what the reader would expect, since a crash dump should usually show all registers in the state they were in when the exception happened. This patch replaces the offending function calls with a B instruction to preserve the value in x30. Change-Id: I2a3636f2943f79bab0cd911f89d070012e697c2a Signed-off-by: Julius Werner <jwerner@chromium.org>
* | Merge pull request #1053 from jwerner-chromium/JW_func_aligndavidcunado-arm2017-08-221-4/+1
|\ \ | |/ |/| Add new alignment parameter to func assembler macro
| * Add new alignment parameter to func assembler macroJulius Werner2017-08-151-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Assembler programmers are used to being able to define functions with a specific aligment with a pattern like this: .align X myfunction: However, this pattern is subtly broken when instead of a direct label like 'myfunction:', you use the 'func myfunction' macro that's standard in Trusted Firmware. Since the func macro declares a new section for the function, the .align directive written above it actually applies to the *previous* section in the assembly file, and the function it was supposed to apply to is linked with default alignment. An extreme case can be seen in Rockchip's plat_helpers.S which contains this code: [...] endfunc plat_crash_console_putc .align 16 func platform_cpu_warmboot [...] This assembles into the following plat_helpers.o: Sections: Idx Name Size [...] Algn 9 .text.plat_crash_console_putc 00010000 [...] 2**16 10 .text.platform_cpu_warmboot 00000080 [...] 2**3 As can be seen, the *previous* function actually got the alignment constraint, and it is also 64KB big even though it contains only two instructions, because the .align directive at the end of its section forces the assembler to insert a giant sled of NOPs. The function we actually wanted to align has the default constraint. This code only works at all because the linker just happens to put the two functions right behind each other when linking the final image, and since the end of plat_crash_console_putc is aligned the start of platform_cpu_warmboot will also be. But it still wastes almost 64KB of image space unnecessarily, and it will break under certain circumstances (e.g. if the plat_crash_console_putc function becomes unused and its section gets garbage-collected out). There's no real way to fix this with the existing func macro. Code like func myfunc .align X happens to do the right thing, but is still not really correct code (because the function label is inserted before the .align directive, so the assembler is technically allowed to insert padding at the beginning of the function which would then get executed as instructions if the function was called). Therefore, this patch adds a new parameter with a default value to the func macro that allows overriding its alignment. Also fix up all existing instances of this dangerous antipattern. Change-Id: I5696a07e2fde896f21e0e83644c95b7b6ac79a10 Signed-off-by: Julius Werner <jwerner@chromium.org>
* | bl32: add secure interrupt handling in AArch32 sp_minEtienne Carriere2017-08-094-1/+81
|/ | | | | | | | | | | | | | | | | | Add support for a minimal secure interrupt service in sp_min for the AArch32 implementation. Hard code that only FIQs are handled. Introduce bolean build directive SP_MIN_WITH_SECURE_FIQ to enable FIQ handling from SP_MIN. Configure SCR[FIQ] and SCR[FW] from generic code for both cold and warm boots to handle FIQ in secure state from monitor. Since SP_MIN architecture, FIQ are always trapped when system executes in non secure state. Hence discard relay of the secure/non-secure state in the FIQ handler. Change-Id: I1f7d1dc7b21f6f90011b7f3fcd921e455592f5e7 Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
* Merge pull request #978 from etienne-lms/minor-builddanh-arm2017-06-281-2/+2
|\ | | | | Minor build fixes
| * bl: security_state should be of type unsigned intEtienne Carriere2017-06-231-2/+2
| | | | | | | | | | | | | | | | security_state is either 0 or 1. Prevent sign conversion potential error (setting -Werror=sign-conversion results in a build error). Signed-off-by: Yann Gautier <yann.gautier@st.com> Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
* | Merge pull request #995 from davidcunado-arm/dc/init_regdavidcunado-arm2017-06-231-6/+6
|\ \ | | | | | | Fully initialise essential control registers
| * | Fully initialise essential control registersDavid Cunado2017-06-211-6/+6
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch updates the el3_arch_init_common macro so that it fully initialises essential control registers rather then relying on hardware to set the reset values. The context management functions are also updated to fully initialise the appropriate control registers when initialising the non-secure and secure context structures and when preparing to leave EL3 for a lower EL. This gives better alignement with the ARM ARM which states that software must initialise RES0 and RES1 fields with 0 / 1. This patch also corrects the following typos: "NASCR definitions" -> "NSACR definitions" Change-Id: Ia8940b8351dc27bc09e2138b011e249655041cfc Signed-off-by: David Cunado <david.cunado@arm.com>
* | sp_min: Flush console at end of main()Dimitris Papastamos2017-06-201-0/+3
| | | | | | | | | | | | | | | | Flush the console so the errata report is printed correctly before exit to normal world. Change-Id: Idd6b5199b5fb8bda9d16a7b5c6426cdda7c73167 Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
* | sp_min: Implement `sp_min_plat_runtime_setup()`Dimitris Papastamos2017-06-201-0/+6
|/ | | | | | | | On ARM platforms before exiting from SP_MIN ensure that the default console is switched to the runtime serial port. Change-Id: I0ca0d42cc47e345d56179eac16aa3d6712767c9b Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
* AArch32: Rework SMC context save and restore mechanismSoby Mathew2017-05-122-49/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current SMC context data structure `smc_ctx_t` and related helpers are optimized for case when SMC call does not result in world switch. This was the case for SP_MIN and BL1 cold boot flow. But the firmware update usecase requires world switch as a result of SMC and the current SMC context helpers were not helping very much in this regard. Therefore this patch does the following changes to improve this: 1. Add monitor stack pointer, `spmon` to `smc_ctx_t` The C Runtime stack pointer in monitor mode, `sp_mon` is added to the SMC context, and the `smc_ctx_t` pointer is cached in `sp_mon` prior to exit from Monitor mode. This makes is easier to retrieve the context when the next SMC call happens. As a result of this change, the SMC context helpers no longer depend on the stack to save and restore the register. This aligns it with the context save and restore mechanism in AArch64. 2. Add SCR in `smc_ctx_t` Adding the SCR register to `smc_ctx_t` makes it easier to manage this register state when switching between non secure and secure world as a result of an SMC call. Change-Id: I5e12a7056107c1701b457b8f7363fdbf892230bf Signed-off-by: Soby Mathew <soby.mathew@arm.com> Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
* Merge pull request #925 from dp-arm/dp/spdxdavidcunado-arm2017-05-0414-350/+14
|\ | | | | Use SPDX license identifiers
| * Use SPDX license identifiersdp-arm2017-05-0314-350/+14
| | | | | | | | | | | | | | | | | | | | | | | | To make software license auditing simpler, use SPDX[0] license identifiers instead of duplicating the license text in every file. NOTE: Files that have been imported by FreeBSD have not been modified. [0]: https://spdx.org/ Change-Id: I80a00e1f641b8cc075ca5a95b10607ed9ed8761a Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
* | Update terminology: standard SMC to yielding SMCDavid Cunado2017-04-262-11/+11
|/ | | | | | | | | | | | | | | | Since Issue B (November 2016) of the SMC Calling Convention document standard SMC calls are renamed to yielding SMC calls to help avoid confusion with the standard service SMC range, which remains unchanged. http://infocenter.arm.com/help/topic/com.arm.doc.den0028b/ARM_DEN0028B_SMC_Calling_Convention.pdf This patch adds a new define for yielding SMC call type and deprecates the current standard SMC call type. The tsp is migrated to use this new terminology and, additionally, the documentation and code comments are updated to use this new terminology. Change-Id: I0d7cc0224667ee6c050af976745f18c55906a793 Signed-off-by: David Cunado <david.cunado@arm.com>
* PSCI: Build option to enable D-Caches early in warmbootSoby Mathew2017-04-191-13/+16
| | | | | | | | | | | | | This patch introduces a build option to enable D-cache early on the CPU after warm boot. This is applicable for platforms which do not require interconnect programming to enable cache coherency (eg: single cluster platforms). If this option is enabled, then warm boot path enables D-caches immediately after enabling MMU. Fixes ARM-Software/tf-issues#456 Change-Id: I44c8787d116d7217837ced3bcf0b1d3441c8d80e Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* Add support for GCC stack protectionDouglas Raillard2017-03-311-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce new build option ENABLE_STACK_PROTECTOR. It enables compilation of all BL images with one of the GCC -fstack-protector-* options. A new platform function plat_get_stack_protector_canary() is introduced. It returns a value that is used to initialize the canary for stack corruption detection. Returning a random value will prevent an attacker from predicting the value and greatly increase the effectiveness of the protection. A message is printed at the ERROR level when a stack corruption is detected. To be effective, the global data must be stored at an address lower than the base of the stacks. Failure to do so would allow an attacker to overwrite the canary as part of an attack which would void the protection. FVP implementation of plat_get_stack_protector_canary is weak as there is no real source of entropy on the FVP. It therefore relies on a timer's value, which could be predictable. Change-Id: Icaaee96392733b721fa7c86a81d03660d3c1bc06 Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
* Merge pull request #860 from jeenu-arm/hw-asstd-cohdavidcunado-arm2017-03-171-16/+19
|\ | | | | Patches for platforms with hardware-assisted coherency
| * Enable data caches early with hardware-assisted coherencyJeenu Viswambharan2017-03-021-17/+20
| | | | | | | | | | | | | | | | | | | | | | | | At present, warm-booted CPUs keep their caches disabled when enabling MMU, and remains so until they enter coherency later. On systems with hardware-assisted coherency, for which HW_ASSISTED_COHERENCY build flag would be enabled, warm-booted CPUs can have both caches and MMU enabled at once. Change-Id: Icb0adb026e01aecf34beadf49c88faa9dd368327 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
* | Simplify translation tables headers dependenciesAntonio Nino Diaz2017-03-082-3/+3
|/ | | | | | | | | The files affected by this patch don't really depend on `xlat_tables.h`. By changing the included file it becomes easier to switch between the two versions of the translation tables library. Change-Id: Idae9171c490e0865cb55883b19eaf942457c4ccc Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* Replace some memset call by zeromemDouglas Raillard2017-02-061-2/+3
| | | | | | | | | | | | | | | Replace all use of memset by zeromem when zeroing moderately-sized structure by applying the following transformation: memset(x, 0, sizeof(x)) => zeromem(x, sizeof(x)) As the Trusted Firmware is compiled with -ffreestanding, it forbids the compiler from using __builtin_memset and forces it to generate calls to the slow memset implementation. Zeromem is a near drop in replacement for this use case, with a more efficient implementation on both AArch32 and AArch64. Change-Id: Ia7f3a90e888b96d056881be09f0b4d65b41aa79e Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
* Introduce unified API to zero memoryDouglas Raillard2017-02-063-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce zeromem_dczva function on AArch64 that can handle unaligned addresses and make use of DC ZVA instruction to zero a whole block at a time. This zeroing takes place directly in the cache to speed it up without doing external memory access. Remove the zeromem16 function on AArch64 and replace it with an alias to zeromem. This zeromem16 function is now deprecated. Remove the 16-bytes alignment constraint on __BSS_START__ in firmware-design.md as it is now not mandatory anymore (it used to comply with zeromem16 requirements). Change the 16-bytes alignment constraints in SP min's linker script to a 8-bytes alignment constraint as the AArch32 zeromem implementation is now more efficient on 8-bytes aligned addresses. Introduce zero_normalmem and zeromem helpers in platform agnostic header that are implemented this way: * AArch32: * zero_normalmem: zero using usual data access * zeromem: alias for zero_normalmem * AArch64: * zero_normalmem: zero normal memory using DC ZVA instruction (needs MMU enabled) * zeromem: zero using usual data access Usage guidelines: in most cases, zero_normalmem should be preferred. There are 2 scenarios where zeromem (or memset) must be used instead: * Code that must run with MMU disabled (which means all memory is considered device memory for data accesses). * Code that fills device memory with null bytes. Optionally, the following rule can be applied if performance is important: * Code zeroing small areas (few bytes) that are not secrets should use memset to take advantage of compiler optimizations. Note: Code zeroing security-related critical information should use zero_normalmem/zeromem instead of memset to avoid removal by compilers' optimizations in some cases or misbehaving versions of GCC. Fixes ARM-software/tf-issues#408 Change-Id: Iafd9663fc1070413c3e1904e54091cf60effaa82 Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-14 21:14:37 +0000