feat(cpufeat): enable FEAT_BTI to FEAT_STATE_CHECKEDIntroduce the is_feat_bti_{supported, present}() helpers and replacechecks for ENABLE_BTI with it. Also factor out the setting ofSCTLR_EL3.BT o
feat(cpufeat): enable FEAT_BTI to FEAT_STATE_CHECKEDIntroduce the is_feat_bti_{supported, present}() helpers and replacechecks for ENABLE_BTI with it. Also factor out the setting ofSCTLR_EL3.BT out of the PAuth enablement and place it in the respectiveentrypoints where we initialise SCTLR_EL3. This makes PAuthself-contained and SCTLR_EL3 initialisation centralised.Change-Id: I0c0657ff1e78a9652cd2cf1603478283dc01f17bSigned-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
show more ...
Avoid the use of linker *_SIZE__ macrosThe use of end addresses is preferred over the size of sections.This was done for some AARCH64 files for PIE with commit [1],and some extra explanations can
Avoid the use of linker *_SIZE__ macrosThe use of end addresses is preferred over the size of sections.This was done for some AARCH64 files for PIE with commit [1],and some extra explanations can be found in its commit message.Align the missing AARCH64 files.For AARCH32 files, this is required to prepare PIE support introduction. [1] f1722b693d36 ("PIE: Use PC relative adrp/adr for symbol reference")Change-Id: I8f1c06580182b10c680310850f72904e58a54d7dSigned-off-by: Yann Gautier <yann.gautier@st.com>
TF-A: Add support for ARMv8.3-PAuth in BL1 SMC calls and BL2UThis patch adds support for ARMv8.3-PAuth in BL1 SMC calls andBL2U image for firmware updates by programming APIAKey_EL1 registersand
TF-A: Add support for ARMv8.3-PAuth in BL1 SMC calls and BL2UThis patch adds support for ARMv8.3-PAuth in BL1 SMC calls andBL2U image for firmware updates by programming APIAKey_EL1 registersand enabling Pointer Authentication in EL3 and EL1 respectively.Change-Id: I875d952aba8242caf74fb5f4f2d2af6f0c768c08Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>
Apply stricter speculative load restrictionThe SCTLR.DSSBS bit is zero by default thus disabling speculative loads.However, we also explicitly set it to zero for BL2 and TSP images wheneach image
Apply stricter speculative load restrictionThe SCTLR.DSSBS bit is zero by default thus disabling speculative loads.However, we also explicitly set it to zero for BL2 and TSP images wheneach image initialises its context. This is done to ensure that theimage environment is initialised in a safe state, regardless of thereset value of the bit.Change-Id: If25a8396641edb640f7f298b8d3309d5cba3cd79Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
Sanitise includes across codebaseEnforce full include path for includes. Deprecate old paths.The following folders inside include/lib have been left unchanged:- include/lib/cpus/${ARCH}- inclu
Sanitise includes across codebaseEnforce full include path for includes. Deprecate old paths.The following folders inside include/lib have been left unchanged:- include/lib/cpus/${ARCH}- include/lib/el3_runtime/${ARCH}The reason for this change is that having a global namespace forincludes isn't a good idea. It defeats one of the advantages of havingfolders and it introduces problems that are sometimes subtle (becauseyou may not know the header you are actually including if there are twoof them).For example, this patch had to be created because two headers werecalled the same way: e0ea0928d5b7 ("Fix gpio includes of mt8173 platformto avoid collision."). More recently, this patch has had similarproblems: 46f9b2c3a282 ("drivers: add tzc380 support").This problem was introduced in commit 4ecca33988b9 ("Move include andsource files to logical locations"). At that time, there weren't toomany headers so it wasn't a real issue. However, time has shown thatthis creates problems.Platforms that want to preserve the way they include headers may add theremoved paths to PLAT_INCLUDES, but this is discouraged.Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8fSigned-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Use SPDX license identifiersTo make software license auditing simpler, use SPDX[0] licenseidentifiers instead of duplicating the license text in every file.NOTE: Files that have been imported by
Use SPDX license identifiersTo make software license auditing simpler, use SPDX[0] licenseidentifiers instead of duplicating the license text in every file.NOTE: Files that have been imported by FreeBSD have not been modified.[0]: https://spdx.org/Change-Id: I80a00e1f641b8cc075ca5a95b10607ed9ed8761aSigned-off-by: dp-arm <dimitris.papastamos@arm.com>
Add support for GCC stack protectionIntroduce new build option ENABLE_STACK_PROTECTOR. It enablescompilation of all BL images with one of the GCC -fstack-protector-*options.A new platform funct
Add support for GCC stack protectionIntroduce new build option ENABLE_STACK_PROTECTOR. It enablescompilation of all BL images with one of the GCC -fstack-protector-*options.A new platform function plat_get_stack_protector_canary() is introduced.It returns a value that is used to initialize the canary for stackcorruption detection. Returning a random value will prevent an attackerfrom predicting the value and greatly increase the effectiveness of theprotection.A message is printed at the ERROR level when a stack corruption isdetected.To be effective, the global data must be stored at an addresslower than the base of the stacks. Failure to do so would allow anattacker to overwrite the canary as part of an attack which would voidthe protection.FVP implementation of plat_get_stack_protector_canary is weak asthere is no real source of entropy on the FVP. It therefore relies on atimer's value, which could be predictable.Change-Id: Icaaee96392733b721fa7c86a81d03660d3c1bc06Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
Introduce unified API to zero memoryIntroduce zeromem_dczva function on AArch64 that can handle unalignedaddresses and make use of DC ZVA instruction to zero a whole block at atime. This zeroing
Introduce unified API to zero memoryIntroduce zeromem_dczva function on AArch64 that can handle unalignedaddresses and make use of DC ZVA instruction to zero a whole block at atime. This zeroing takes place directly in the cache to speed it upwithout doing external memory access.Remove the zeromem16 function on AArch64 and replace it with an alias tozeromem. This zeromem16 function is now deprecated.Remove the 16-bytes alignment constraint on __BSS_START__ infirmware-design.md as it is now not mandatory anymore (it used to complywith zeromem16 requirements).Change the 16-bytes alignment constraints in SP min's linker script to a8-bytes alignment constraint as the AArch32 zeromem implementation is nowmore efficient on 8-bytes aligned addresses.Introduce zero_normalmem and zeromem helpers in platform agnostic headerthat are implemented this way:* AArch32: * zero_normalmem: zero using usual data access * zeromem: alias for zero_normalmem* AArch64: * zero_normalmem: zero normal memory using DC ZVA instruction (needs MMU enabled) * zeromem: zero using usual data accessUsage guidelines: in most cases, zero_normalmem should be preferred.There are 2 scenarios where zeromem (or memset) must be used instead:* Code that must run with MMU disabled (which means all memory is considered device memory for data accesses).* Code that fills device memory with null bytes.Optionally, the following rule can be applied if performance isimportant:* Code zeroing small areas (few bytes) that are not secrets should use memset to take advantage of compiler optimizations. Note: Code zeroing security-related critical information should use zero_normalmem/zeromem instead of memset to avoid removal by compilers' optimizations in some cases or misbehaving versions of GCC.Fixes ARM-software/tf-issues#408Change-Id: Iafd9663fc1070413c3e1904e54091cf60effaa82Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
Define and use no_ret macro where no return is expectedThere are many instances in ARM Trusted Firmware where control istransferred to functions from which return isn't expected. Such jumpsare ma
Define and use no_ret macro where no return is expectedThere are many instances in ARM Trusted Firmware where control istransferred to functions from which return isn't expected. Such jumpsare made using 'bl' instruction to provide the callee with the locationfrom which it was jumped to. Additionally, debuggers infer the caller byexamining where 'lr' register points to. If a 'bl' of the naturedescribed above falls at the end of an assembly function, 'lr' will beleft pointing to a location outside of the function range. This misleadsthe debugger back trace.This patch defines a 'no_ret' macro to be used when jumping to functionsfrom which return isn't expected. The macro ensures to use 'bl'instruction for the jump, and also, for debug builds, places a 'nop'instruction immediately thereafter (unless instructed otherwise) so asto leave 'lr' pointing within the function range.Change-Id: Ib34c69fc09197cfd57bc06e147cc8252910e01b0Co-authored-by: Douglas Raillard <douglas.raillard@arm.com>Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
Remove all non-configurable dead loopsAdded a new platform porting function plat_panic_handler, to allowplatforms to handle unexpected error situations. It must beimplemented in assembly as it ma
Remove all non-configurable dead loopsAdded a new platform porting function plat_panic_handler, to allowplatforms to handle unexpected error situations. It must beimplemented in assembly as it may be called before the C environmentis initialized. A default implementation is provided, which simplyspins.Corrected all dead loops in generic code to call this functioninstead. This includes the dead loop that occurs at the end of thecall to panic().All unnecesary wfis from bl32/tsp/aarch64/tsp_exceptions.S havebeen removed.Change-Id: I67cb85f6112fa8e77bd62f5718efcef4173d8134
FWU: Add Generic BL2U FWU image support in BL2The Firmware Update (FWU) feature needs support for an optionalsecure world image, BL2U, to allow additional secure worldinitialization required by F
FWU: Add Generic BL2U FWU image support in BL2The Firmware Update (FWU) feature needs support for an optionalsecure world image, BL2U, to allow additional secure worldinitialization required by FWU, for example DDR initialization.This patch adds generic framework support to create BL2U.NOTE: A platform makefile must supply additional `BL2U_SOURCES` to build the bl2u target. A subsequent patch adds bl2u support for ARM platforms.Change-Id: If2ce036199bb40b39b7f91a9332106bcd4e25413