feat(el3-runtime): translate EL3 handled exceptions to C and always call prepare_el3_entryException handling in BL31 is tricky business and to satisfy the varyingrequirements of the different code
feat(el3-runtime): translate EL3 handled exceptions to C and always call prepare_el3_entryException handling in BL31 is tricky business and to satisfy the varyingrequirements of the different code paths it has thus far largely beenwritten in assembly. However, assembly is extremely tedious to read andmodify. Similar to context management, it is desirable to have as muchas possible in C. C code is generally easier to follow and can enablethe compiler to do more optimisations on surrounding code.Most exceptions that BL31 deals with are the synchronous exceptions andthose are processed within BL31. They already get prepared for EL3 entryand after the initial dispatch end up in C. So the dispatch can also beconverted in C. Interrupt exceptions are very similar so are convertedtoo. Finally, asynchronous external aborts share some code withsynchronous external aborts and may end up being processed deeper inBL31. So they can safely be prepared for EL3 entry too and converted toC so that they can share code properly.The IMP DEF exceptions are not part of this refactor as their speed maybe important. There is currently little that uses them, but they can beconverted to C too once their use expands and usage allows it.This refactor allows to expand the responsibilities ofprepare_el3_entry(). Its role is already to prepare context forexecuting within EL3 but with this patch EL3 execution is synonymouswith C runtime execution. So it's given the responsibility of savingspsr and elr as well as putting the runtime stack in.When a synchronous exception happens, the only possible paths are toenter the C EL3 runtime, exiting via el3_exit(), or to panic. In the EL3runtime case, we always need prepare_el3_entry() and the runtime stack,whereas in the panic case, this doesn't matter as we will never return.So hoist the prepare_el3_entry() call and the changing of the stacks asearly as possible and make the rest of the code agnostic of this.This patch also gets rid of smc_prohibited. It is an optimisation byskipping prepare_el3_entry() when a bad smc call happens. However, speeddoesn't matter in this case as this is an erroneous case.Change-Id: I411af9d17ef4046a736b1f4f5f8fbc9c28e66106Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
show more ...
refactor: unify blx_setup() and blx_main()All BLs have a bl_setup() for things that need to happen early, a fallback into assembly and then bl_main() for the main functionality. Thiswas necessary
refactor: unify blx_setup() and blx_main()All BLs have a bl_setup() for things that need to happen early, a fallback into assembly and then bl_main() for the main functionality. Thiswas necessary in order to fiddle with PAuth related things that tend tobreak C calls. Since then PAuth's enablement has seen a lot ofrefactoring and this is now worked around cleanly so the distinction canbe removed. The only tradeoff is that this requires pauth to not be usedfor the top-level main function.There are two main benefits to doing this: First, code is easier tounderstand as it's all together and the entrypoint is smaller. Second,the compiler gets to see more of the code and apply optimisations(importantly LTO).Change-Id: Iddb93551115a2048988017547eb7b8db441dbd37Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
refactor(bl1): clean up bl2 layout calculationLayout calculation is spread out between core BL1 logic and commonplatform code. Relocate these into common platform code so they areorganised logica
refactor(bl1): clean up bl2 layout calculationLayout calculation is spread out between core BL1 logic and commonplatform code. Relocate these into common platform code so they areorganised logically.Change-Id: I8b05403e41b800957a0367316cecd373d10bb1a4Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>
style: remove useless trailing semicolon and line continuationsfound using checkpatch.pl[1][1]: https://review.coreboot.org/plugins/gitiles/coreboot/+/refs/heads/master/util/lint/checkpatch.plS
style: remove useless trailing semicolon and line continuationsfound using checkpatch.pl[1][1]: https://review.coreboot.org/plugins/gitiles/coreboot/+/refs/heads/master/util/lint/checkpatch.plSigned-off-by: Elyes Haouas <ehaouas@noos.fr>Change-Id: I7957c9694300fefb85d11f7819c43af95271f14c
Specify signed-ness of constantsWe relyed on the default signed-ness of constants, which is usuallysigned. This can create MISRA violations, such as: bl1/bl1_main.c:257:[MISRA C-2012 10.8 (r
Specify signed-ness of constantsWe relyed on the default signed-ness of constants, which is usuallysigned. This can create MISRA violations, such as: bl1/bl1_main.c:257:[MISRA C-2012 10.8 (required)] Cast of composite expression off essential type signed to essential type unsignedThese constants were only used as unsigned, so this patch makes themexplicitly unsigned.Change-Id: I5f1310c881e936077035fbb1d5ffb449b45de3adSigned-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
coverity: fix MISRA violationsFixes for the following MISRA violations:- Missing explicit parentheses on sub-expression- An identifier or macro name beginning with an underscore, shall not be d
coverity: fix MISRA violationsFixes for the following MISRA violations:- Missing explicit parentheses on sub-expression- An identifier or macro name beginning with an underscore, shall not be declared- Type mismatch in BL1 SMC handlers and tspd_main.cChange-Id: I7a92abf260da95acb0846b27c2997b59b059efc4Signed-off-by: Zelalem <zelalem.aweke@arm.com>
Replace __ASSEMBLY__ with compiler-builtin __ASSEMBLER__NOTE: __ASSEMBLY__ macro is now deprecated in favor of __ASSEMBLER__.All common C compilers predefine a macro called __ASSEMBLER__ whenpre
Replace __ASSEMBLY__ with compiler-builtin __ASSEMBLER__NOTE: __ASSEMBLY__ macro is now deprecated in favor of __ASSEMBLER__.All common C compilers predefine a macro called __ASSEMBLER__ whenpreprocessing a .S file. There is no reason for TF-A to define it's own__ASSEMBLY__ macro for this purpose instead. To unify code with theexport headers (which use __ASSEMBLER__ to avoid one extra dependency),let's deprecate __ASSEMBLY__ and switch the code base over to thepredefined standard.Change-Id: Id7d0ec8cf330195da80499c68562b65cb5ab7417Signed-off-by: Julius Werner <jwerner@chromium.org>
BL1: Enable pointer authentication supportThe size increase after enabling options related to ARMv8.3-PAuth is:+----------------------------+-------+-------+-------+--------+|
BL1: Enable pointer authentication supportThe size increase after enabling options related to ARMv8.3-PAuth is:+----------------------------+-------+-------+-------+--------+| | text | bss | data | rodata |+----------------------------+-------+-------+-------+--------+| CTX_INCLUDE_PAUTH_REGS = 1 | +108 | +192 | +0 | +0 || | 0.5% | 0.8% | | |+----------------------------+-------+-------+-------+--------+| ENABLE_PAUTH = 1 | +748 | +192 | +16 | +0 || | 3.7% | 0.8% | 7.0% | |+----------------------------+-------+-------+-------+--------+Results calculated with the following build configuration: make PLAT=fvp SPD=tspd DEBUG=1 \ SDEI_SUPPORT=1 \ EL3_EXCEPTION_HANDLING=1 \ TSP_NS_INTR_ASYNC_PREEMPT=1 \ CTX_INCLUDE_PAUTH_REGS=1 \ ENABLE_PAUTH=1Change-Id: I3a7d02feb6a6d212be32a01432b0c7c1a261f567Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Sanitise includes across codebaseEnforce full include path for includes. Deprecate old paths.The following folders inside include/lib have been left unchanged:- include/lib/cpus/${ARCH}- inclu
Sanitise includes across codebaseEnforce full include path for includes. Deprecate old paths.The following folders inside include/lib have been left unchanged:- include/lib/cpus/${ARCH}- include/lib/el3_runtime/${ARCH}The reason for this change is that having a global namespace forincludes isn't a good idea. It defeats one of the advantages of havingfolders and it introduces problems that are sometimes subtle (becauseyou may not know the header you are actually including if there are twoof them).For example, this patch had to be created because two headers werecalled the same way: e0ea0928d5b7 ("Fix gpio includes of mt8173 platformto avoid collision."). More recently, this patch has had similarproblems: 46f9b2c3a282 ("drivers: add tzc380 support").This problem was introduced in commit 4ecca33988b9 ("Move include andsource files to logical locations"). At that time, there weren't toomany headers so it wasn't a real issue. However, time has shown thatthis creates problems.Platforms that want to preserve the way they include headers may add theremoved paths to PLAT_INCLUDES, but this is discouraged.Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8fSigned-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Standardise header guards across codebaseAll identifiers, regardless of use, that start with two underscores arereserved. This means they can't be used in header guards.The style that this proje
Standardise header guards across codebaseAll identifiers, regardless of use, that start with two underscores arereserved. This means they can't be used in header guards.The style that this project is now to use the full name of the file incapital letters followed by 'H'. For example, for a file called"uart_example.h", the header guard is UART_EXAMPLE_H.The exceptions are files that are imported from other projects:- CryptoCell driver- dt-bindings folders- zlib headersChange-Id: I50561bf6c88b491ec440d0c8385c74650f3c106eSigned-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Fix MISRA rule 8.4 Part 1Rule 8.4: A compatible declaration shall be visible when an object or function with external linkage is definedFixed for: make DEBUG=1 PLAT=fvp LOG_LEVEL=50 al
Fix MISRA rule 8.4 Part 1Rule 8.4: A compatible declaration shall be visible when an object or function with external linkage is definedFixed for: make DEBUG=1 PLAT=fvp LOG_LEVEL=50 allChange-Id: I7c2ad3f5c015411c202605851240d5347e4cc8c7Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
Fix MISRA rule 8.4 in common codeRule 8.4: A compatible declaration shall be visible when an object or function with external linkage is defined.Change-Id: I26e042cb251a6f9590afa1340fda
Fix MISRA rule 8.4 in common codeRule 8.4: A compatible declaration shall be visible when an object or function with external linkage is defined.Change-Id: I26e042cb251a6f9590afa1340fdac73e42f23979Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
BL1: Deprecate the `bl1_init_bl2_mem_layout()` APIThe `bl1_init_bl2_mem_layout()` API is now deprecated. The default weakimplementation of `bl1_plat_handle_post_image_load()` calculates theBL2 me
BL1: Deprecate the `bl1_init_bl2_mem_layout()` APIThe `bl1_init_bl2_mem_layout()` API is now deprecated. The default weakimplementation of `bl1_plat_handle_post_image_load()` calculates theBL2 memory layout and populates the same in x1(r1). This ensurescompatibility for the deprecated API.Change-Id: Id44bdc1f572dc42ee6ceef4036b3a46803689315Signed-off-by: Soby Mathew <soby.mathew@arm.com>
FWU: Introduce FWU_SMC_IMAGE_RESETThis SMC is as a means for the image loading state machine to go fromCOPYING, COPIED or AUTHENTICATED states to RESET state. Previously, thiswas only done when t
FWU: Introduce FWU_SMC_IMAGE_RESETThis SMC is as a means for the image loading state machine to go fromCOPYING, COPIED or AUTHENTICATED states to RESET state. Previously, thiswas only done when the authentication of an image failed or when theexecution of the image finished.Documentation updated.Change-Id: Ida6d4c65017f83ae5e27465ec36f54499c6534d9Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Use SPDX license identifiersTo make software license auditing simpler, use SPDX[0] licenseidentifiers instead of duplicating the license text in every file.NOTE: Files that have been imported by
Use SPDX license identifiersTo make software license auditing simpler, use SPDX[0] licenseidentifiers instead of duplicating the license text in every file.NOTE: Files that have been imported by FreeBSD have not been modified.[0]: https://spdx.org/Change-Id: I80a00e1f641b8cc075ca5a95b10607ed9ed8761aSigned-off-by: dp-arm <dimitris.papastamos@arm.com>
FWU: Add Generic Firmware Update framework support in BL1Firmware update(a.k.a FWU) feature is part of the TBB architecture.BL1 is responsible for carrying out the FWU process if platformspecific
FWU: Add Generic Firmware Update framework support in BL1Firmware update(a.k.a FWU) feature is part of the TBB architecture.BL1 is responsible for carrying out the FWU process if platformspecific code detects that it is needed.This patch adds support for FWU feature support in BL1 which isincluded by enabling `TRUSTED_BOARD_BOOT` compile time flag.This patch adds bl1_fwu.c which contains all the core operationsof FWU, which are; SMC handler, image copy, authentication, executionand resumption. It also adds bl1.h introducing #defines for allBL1 SMCs.Following platform porting functions are introduced:int bl1_plat_mem_check(uintptr_t mem_base, unsigned int mem_size,unsigned int flags); This function can be used to add platform specific memory checks for the provided base/size for the given security state. The weak definition will invoke `assert()` and return -ENOMEM.__dead2 void bl1_plat_fwu_done(void *cookie, void *reserved); This function can be used to initiate platform specific procedure to mark completion of the FWU process. The weak definition waits forever calling `wfi()`.plat_bl1_common.c contains weak definitions for above functions.FWU process starts when platform detects it and return the image_idother than BL2_IMAGE_ID by using `bl1_plat_get_next_image_id()` in`bl1_main()`.NOTE: User MUST provide platform specific real definition forbl1_plat_mem_check() in order to use it for Firmware update.Change-Id: Ice189a0885d9722d9e1dd03f76cac1aceb0e25ed