Skip to content

GitLab

Switch branch/tag
  1. 29 Oct, 2018 4 commits
    • Antonio Nino Diaz's avatar
      Fix MISRA defects in extension libs · 40daecc1
      Antonio Nino Diaz authored 
      

No functional changes.

Change-Id: I2f28f20944f552447ac4e9e755493cd7c0ea1192
Signed-off-by: default avatarAntonio Nino Diaz <antonio.ninodiaz@arm.com>
      40daecc1
    • Soby Mathew's avatar
      PIE: Position Independant Executable support for BL31 · 931f7c61
      Soby Mathew authored 
      

This patch introduces Position Independant Executable(PIE) support
in TF-A. As a initial prototype, only BL31 can support PIE. A trivial
dynamic linker is implemented which supports fixing up Global Offset
Table(GOT) and Dynamic relocations(.rela.dyn). The fixup_gdt_reloc()
helper function implements this linker and this needs to be called
early in the boot sequence prior to invoking C functions. The GOT is
placed in the RO section of BL31 binary for improved security and the
BL31 linker script is modified to export the appropriate symbols
required for the dynamic linker.

The C compiler always generates PC relative addresses to linker symbols
and hence referencing symbols exporting constants are a problem when
relocating the binary. Hence the reference to the
`__PERCPU_TIMESTAMP_SIZE__` symbol in PMF is removed and is now calculated
at runtime based on start and end addresses.

Change-Id: I1228583ff92cf432963b7cef052e95d995cca93d
Signed-off-by: default avatarSoby Mathew <soby.mathew@arm.com>
      931f7c61
    • Soby Mathew's avatar
      Make errata reporting mandatory for CPU files · 12af5ed4
      Soby Mathew authored 
      

Previously the errata reporting was optional for CPU operation
files and this was achieved by making use of weak reference to
resolve to 0 if the symbol is not defined. This is error prone
when adding new CPU operation files and weak references are
problematic when fixing up dynamic relocations. Hence this patch
removes the weak reference and makes it mandatory for the CPU
operation files to define the errata reporting function.

Change-Id: I8af192e19b85b7cd8c7579e52f8f05a4294e5396
Signed-off-by: default avatarSoby Mathew <soby.mathew@arm.com>
      12af5ed4
    • Soby Mathew's avatar
      PIE: Use PC relative adrp/adr for symbol reference · f1722b69
      Soby Mathew authored 
      

This patch fixes up the AArch64 assembly code to use
adrp/adr instructions instead of ldr instruction for
reference to symbols. This allows these assembly
sequences to be Position Independant. Note that the
the reference to sizes have been replaced with
calculation of size at runtime. This is because size
is a constant value and does not depend on execution
address and using PC relative instructions for loading
them makes them relative to execution address. Also
we cannot use `ldr` instruction to load size as it
generates a dynamic relocation entry which must *not*
be fixed up and it is difficult for a dynamic loader
to differentiate which entries need to be skipped.

Change-Id: I8bf4ed5c58a9703629e5498a27624500ef40a836
Signed-off-by: default avatarSoby Mathew <soby.mathew@arm.com>
      f1722b69
  3. 26 Oct, 2018 1 commit
    • Antonio Nino Diaz's avatar
      xlat: Fix compatibility between v1 and v2 · 03987d01
      Antonio Nino Diaz authored 
      

There are several platforms using arm_setup_page_tables(), which is
supposed to be Arm platform only. This creates several dependency
problems between platforms.

This patch adds the definition XLAT_TABLES_LIB_V2 to the xlat tables lib
v2 makefile. This way it is possible to detect from C code which version
is being used and include the correct header.

The file arm_xlat_tables.h has been renamed to xlat_tables_compat.h and
moved to a common folder. This way, when in doubt, this header can be
used to guarantee compatibility, as it includes the correct header based
on XLAT_TABLES_LIB_V2.

This patch also removes the usage of ARM_XLAT_TABLES_V1 from QEMU (so
that is now locked in xlat lib v2) and ZynqMP (where it was added as a
workaround).

Change-Id: Ie1e22a23b44c549603d1402a237a70d0120d3e04
Signed-off-by: default avatarAntonio Nino Diaz <antonio.ninodiaz@arm.com>
      03987d01
  5. 23 Oct, 2018 4 commits
  7. 16 Oct, 2018 2 commits
    • Andrew F. Davis's avatar
      ti: k3: common: Do not disable cache on TI K3 core powerdown · 6a655a85
      Andrew F. Davis authored 
      

Leave the caches on and explicitly flush any data that
may be stale when the core is powered down. This prevents
non-coherent interconnect access which has negative side-
effects on AM65x.
Signed-off-by: default avatarAndrew F. Davis <afd@ti.com>
      6a655a85
    • Jeenu Viswambharan's avatar
      AArch64: Enable lower ELs to use pointer authentication · 3ff4aaac
      Jeenu Viswambharan authored 
      

Pointer authentication is an Armv8.3 feature that introduces
instructions that can be used to authenticate and verify pointers.

Pointer authentication instructions are allowed to be accessed from all
ELs but only when EL3 explicitly allows for it; otherwise, their usage
will trap to EL3. Since EL3 doesn't have trap handling in place, this
patch unconditionally disables all related traps to EL3 to avoid
potential misconfiguration leading to an unhandled EL3 exception.

Fixes ARM-software/tf-issues#629

Change-Id: I9bd2efe0dc714196f503713b721ffbf05672c14d
Signed-off-by: default avatarJeenu Viswambharan <jeenu.viswambharan@arm.com>
      3ff4aaac
  9. 11 Oct, 2018 1 commit
    • ldts's avatar
      psci: platform control of SYSTEM_SUSPEND entry · a4065abd
      ldts authored 
      Some platforms can only resume from system suspend from the boot
CPU, hence they should only enter that state from that same core.

The following commit presents an interface that allows the platform to
reject system suspend entry near its very last stage (last CPU).
      a4065abd
  11. 10 Oct, 2018 2 commits
  13. 08 Oct, 2018 1 commit
    • Antonio Nino Diaz's avatar
      xlat: Fix checks in mmap_add() and mmap_add_ctx() · a5fa5658
      Antonio Nino Diaz authored 
      Commit 79621f00

 broke sgi575.

It is possible to have a region with 0 as value for the attributes. It
means device memory, read only, secure, executable. This is legitimate
if the code is in flash and the code is executed from there.

This is the case for SGI_MAP_FLASH0_RO, defined in the file
plat/arm/css/sgi/sgi_plat.c.

This problem is solved by checking both size and attributes in xlat v1.
In xlat v2, it is enough to check the granularity, as it can never be 0.

Change-Id: I7be11f1b0e51c4c2ffd560b4a6cdfbf15de2c276
Signed-off-by: default avatarAntonio Nino Diaz <antonio.ninodiaz@arm.com>
      a5fa5658
  15. 03 Oct, 2018 3 commits
    • Daniel Boulby's avatar
      Mark xlat tables initialization code · aff2863f
      Daniel Boulby authored 
      

Mark the xlat tables code only used in BL31 initialization as
__init to be reclaimed once no longer needed

Change-Id: I3106bfd994706a57c578624573bcfa525fbbd3c4
Signed-off-by: default avatarDaniel Boulby <daniel.boulby@arm.com>
      aff2863f
    • Daniel Boulby's avatar
      Mark BL31 initialization functions · 87c85134
      Daniel Boulby authored 
      

Mark the initialization functions in BL31, such as context management,
EHF, RAS and PSCI as __init so that they can be reclaimed by the
platform when no longer needed

Change-Id: I7446aeee3dde8950b0f410cb766b7a2312c20130
Signed-off-by: default avatarDaniel Boulby <daniel.boulby@arm.com>
      87c85134
    • Daniel Boulby's avatar
      xlat: Change check in mmap_add and mmap_add_ctx() · 79621f00
      Daniel Boulby authored 
      

Depending on the build flags it is possible that some of the memory
regions mapped in page table setup could have a size of 0. In this
case we simply want to do nothing but still wish to map the other
regions in the array. Therefore we cannot only use size == 0 as
the termination logic for the loop.

Since an attributes field with value 0 means that the region is
device memory, read only, secure and executable. Device memory
can't be executable, so this combination should never be used
and it is safe to use as a terminator value.

Therefore by changing the termination logic to use attributes
instead of size we prevent terminating the loop when we don't
intend to.

Change-Id: I92fc7f689ab08543497be6be4896dace2ed7b66a
Signed-off-by: default avatarDaniel Boulby <daniel.boulby@arm.com>
      79621f00
  17. 28 Sep, 2018 4 commits
  19. 21 Sep, 2018 1 commit
    • Daniel Boulby's avatar
      Ensure the flow through switch statements is clear · a08a2014
      Daniel Boulby authored 
      

Ensure case clauses:
*   Terminate with an unconditional break, return or goto statement.
*   Use conditional break, return or goto statements as long as the end
    of the case clause is unreachable; such case clauses must terminate
    with assert(0) /* Unreachable */ or an unconditional  __dead2 function
    call
*   Only fallthough when doing otherwise would result in less
    readable/maintainable code; such case clauses must terminate with a
    /* Fallthrough */ comment to make it clear this is the case and
    indicate that a fallthrough is intended.

This reduces the chance of bugs appearing due to unintended flow through a
switch statement

Change-Id: I70fc2d1f4fd679042397dec12fd1982976646168
Signed-off-by: default avatarDaniel Boulby <daniel.boulby@arm.com>
      a08a2014
  21. 10 Sep, 2018 1 commit
  23. 07 Sep, 2018 1 commit
  25. 05 Sep, 2018 4 commits
    • Jeenu Viswambharan's avatar
      Add missing barriers to Bakery Locks · 24dc9709
      Jeenu Viswambharan authored 
      

With the current implementation, it's possible for a contender to
observe accesses in the Critical Section before acquiring or releasing
the lock. Insert fencing in the locking and release codes to prevent any
reorder.

Fixes ARM-software/tf-issues#609

Change-Id: I773b82aa41dd544a2d3dbacb9a4b42c9eb767bbb
Signed-off-by: default avatarJeenu Viswambharan <jeenu.viswambharan@arm.com>
      24dc9709
    • Varun Wadekar's avatar
      cpus: denver: Implement static workaround for CVE-2018-3639 · 6cf8d65f
      Varun Wadekar authored 
      

For Denver CPUs, this approach enables the mitigation during EL3
initialization, following every PE reset. No mechanism is provided to
disable the mitigation at runtime.

This approach permanently mitigates the EL3 software stack only. Other
software components are responsible to enable it for their exception
levels.

TF-A implements this approach for the Denver CPUs with DENVER_MIDR_PN3
and earlier:

*   By setting bit 11 (Disable speculative store buffering) of
    `ACTLR_EL3`

*   By setting bit 9 (Disable speculative memory disambiguation) of
    `ACTLR_EL3`

TF-A implements this approach for the Denver CPUs with DENVER_MIDR_PN4
and later:

*   By setting bit 18 (Disable speculative store buffering) of
    `ACTLR_EL3`

*   By setting bit 17 (Disable speculative memory disambiguation) of
    `ACTLR_EL3`

Change-Id: If1de96605ce3f7b0aff5fab2c828e5aecb687555
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      6cf8d65f
    • Varun Wadekar's avatar
      cpus: denver: reset power state to 'C1' on boot · cf3ed0dc
      Varun Wadekar authored 
      

Denver CPUs expect the power state field to be reset to 'C1'
during boot. This patch updates the reset handler to reset the
ACTLR_.PMSTATE field to 'C1' state during CPU boot.

Change-Id: I7cb629627a4dd1a30ec5cbb3a5e90055244fe30c
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      cf3ed0dc
    • Varun Wadekar's avatar
      denver: use plat_my_core_pos() to get core position · 1593cae4
      Varun Wadekar authored 
      

The current functions to disable and enable Dynamic Code Optimizer
(DCO) assume that all denver cores are in the same cluster. They
ignore AFF1 field of the mpidr_el1 register, which leads to
incorect logical core id calculation.

This patch calls the platform handler, plat_my_core_pos(), to get
the logical core id to disable/enable DCO for the core.

Original change by: Krishna Sitaraman <ksitaraman@nvidia.com>

Change-Id: I45fbd1f1eb032cc1db677a4fdecc554548b4a830
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      1593cae4
  27. 30 Aug, 2018 3 commits
  29. 23 Aug, 2018 2 commits
    • nathan-menhorn's avatar
      Fixed ARM-software/tf-issues#603 · b554e768
      nathan-menhorn authored 
      

Updated optee_utils.c to fix ARM-software/tf-issues#603 related to the
tee-validate-header bug.

Minor updates to the header valid checking logic. It would never make
sense to have less than 1 image to load so this is now checked.

Changed OPTEE_MAX_IMAGE_NUM to OPTEE_MAX_NUM_IMAGES to clarify its
definition. OPTEE_MAX_IMAGE_NUM sounds like an ID assigned to the last
image to load. OPTEE_MAX_NUM_IMAGES sounds like the maximum number of
images to load.
Signed-off-by: default avatarNathan Menhorn <nathan.menhorn@xilinx.com>
      b554e768
    • John Tsichritzis's avatar
      DSU erratum 936184 workaround: bug fix · 7436d5d3
      John Tsichritzis authored 
      

The initial implementation was corrupting registers that it shouldn't.
Now this is fixed.

Change-Id: Iaa407c18e668b2d9381391bf10d6876fe936aded
Signed-off-by: default avatarJohn Tsichritzis <john.tsichritzis@arm.com>
      7436d5d3
  31. 22 Aug, 2018 6 commits