Rename symbols and files relating to CVE-2017-5715 ...

This patch renames symbols and files relating to CVE-2017-5715 to make
it easier to introduce new symbols and files for new CVE mitigations.

Change-Id: I24c23822862ca73648c772885f1690bed043dbc7
Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>

Merge pull request #1378 from vwadekar/denver-cve-2017-5715 ...

CVE-2017-5715 mitigation for Denver CPUs

Workaround for CVE-2017-5715 on NVIDIA Denver CPUs ...

Flush the indirect branch predictor and RSB on entry to EL3 by issuing
a newly added instruction for Denver CPUs. Support for this operation
can be determined by comparing bits 19:16 of ID_AFR0_EL1 with 0b0001.

To achieve this without performing any branch instruction, a per-cpu
vbar is installed which executes the workaround and then branches off
to the corresponding vector entry in the main vector table. A side
effect of this change is that the main vbar is configured before any
reset handling. This is to allow the per-cpu reset function to override
the vbar setting.

Change-Id: Ief493cd85935bab3cfee0397e856db5101bc8011
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

Merge pull request #1376 from vwadekar/cm-init-actlr-el1 ...

lib: el3_runtime: initialise actlr_el1 to hardware defaults

Merge pull request #1373 from jeenu-arm/ras-support ...

RAS support

lib: el3_runtime: initialise actlr_el1 to hardware defaults ...

The context management library initialises the CPU context for the
secure/non-secure worlds to zero. This leads to zeros being stored
to the actual registers when we restore the CPU context, during a
world switch. Denver CPUs dont expect zero to be written to the
implementation defined, actlr_el1 register, at any point of time.
Writing a zero to some fields of this register, results in an
UNDEFINED exception.

This patch bases the context actlr_el1 value on the actual hardware
register, to maintain parity with the expected settings

Change-Id: I1c806d7ff12daa7fd1e5c72825494b81454948f2
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

Merge pull request #1377 from robertovargas-arm/compiler-warnings ...

Compiler warnings

Don't use variables as tf_printf format strings ...

Using variables as format strings can generate security problems when
the user can control those strings. Some compilers generate warnings
in that cases, even when the variables are constants and are not
controlled by the user.

Change-Id: I65dee1d1b66feab38cbf298290a86fa56e6cca40
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>

Merge pull request #1354 from robertovargas-arm/mem_protect ...

ARM platforms: Demonstrate mem_protect from el3_runtime

RAS: Add fault injection support ...

The ARMv8.4 RAS extensions introduce architectural support for software
to inject faults into the system in order to test fault-handling
software. This patch introduces the build option FAULT_HANDLING_SUPPORT
to allow for lower ELs to use registers in the Standard Error Record to
inject fault. The build option RAS_EXTENSIONS must also be enabled along
with fault injection.

This feature is intended for testing purposes only, and is advisable to
keep disabled for production images.

Change-Id: I6f7a4454b15aec098f9505a10eb188c2f928f7ea
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

RAS: Allow individual interrupt registration ...

EHF currently allows for registering interrupt handlers for a defined
priority ranges. This is primarily targeted at various EL3 dispatchers
to own ranges of secure interrupt priorities in order to delegate
execution to lower ELs.

The RAS support added by earlier patches necessitates registering
handlers based on interrupt number so that error handling agents shall
receive and handle specific Error Recovery or Fault Handling interrupts
at EL3.

This patch introduces a macro, RAS_INTERRUPTS() to declare an array of
interrupt numbers and handlers. Error handling agents can use this macro
to register handlers for individual RAS interrupts. The array is
expected to be sorted in the increasing order of interrupt numbers.

As part of RAS initialisation, the list of all RAS interrupts are sorted
based on their ID so that, given an interrupt, its handler can be looked
up with a simple binary search.

For an error handling agent that wants to handle a RAS interrupt,
platform must:

  - Define PLAT_RAS_PRI to be the priority of all RAS exceptions.

  - Enumerate interrupts to have the GIC driver program individual EL3
    interrupts to the required priority range. This is required by EHF
    even before this patch.

Documentation to follow.

Change-Id: I9471e4887ff541f8a7a63309e9cd8f771f76aeda
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

RAS: Add support for node registration ...

Previous patches added frameworks for handling RAS errors. This patch
introduces features that the platform can use to enumerate and iterate
RAS nodes:

  - The REGISTER_RAS_NODES() can be used to expose an array of
    ras_node_info_t structures. Each ras_node_info_t describes a RAS
    node, along with handlers for probing the node for error, and if
    did record an error, another handler to handle it.

  - The macro for_each_ras_node() can be used to iterate over the
    registered RAS nodes, probe for, and handle any errors.

The common platform EA handler has been amended using error handling
primitives introduced by both this and previous patches.

Change-Id: I2e13f65a88357bc48cd97d608db6c541fad73853
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

RAS: Add helpers to access Standard Error Records ...

The ARMv8 RAS Extensions introduced Standard Error Records which are a
set of standard registers through which:

  - Platform can configure RAS node policy; e.g., notification
    mechanism;

  - RAS nodes can record and expose error information for error handling
    agents.

Standard Error Records can either be accessed via. memory-mapped
or System registers. This patch adds helper functions to access
registers and fields within an error record.

Change-Id: I6594ba799f4a1789d7b1e45b3e17fd40e7e0ba5c
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

AArch64: Introduce RAS handling ...

RAS extensions are mandatory for ARMv8.2 CPUs, but are also optional
extensions to base ARMv8.0 architecture.

This patch adds build system support to enable RAS features in ARM
Trusted Firmware. A boolean build option RAS_EXTENSION is introduced for
this.

With RAS_EXTENSION, an Exception Synchronization Barrier (ESB) is
inserted at all EL3 vector entry and exit. ESBs will synchronize pending
external aborts before entering EL3, and therefore will contain and
attribute errors to lower EL execution. Any errors thus synchronized are
detected via. DISR_EL1 register.

When RAS_EXTENSION is set to 1, HANDLE_EL3_EA_FIRST must also be set to 1.

Change-Id: I38a19d84014d4d8af688bd81d61ba582c039383a
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

AArch64: Refactor GP register restore to separate function ...

At present, the function that restores general purpose registers also
does ERET. Refactor the restore code to restore general purpose
registers without ERET to complement the save function.

The macro save_x18_to_x29_sp_el0 was used only once, and is therefore
removed, and its contents expanded inline for readability.

No functional changes, but with this patch:

  - The SMC return path will incur an branch-return and an additional
    register load.

  - The unknown SMC path restores registers x0 to x3.

Change-Id: I7a1a63e17f34f9cde810685d70a0ad13ca3b7c50
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Merge pull request #1370 from antonio-nino-diaz-arm/an/fix-parange ...

xlat: Have all values of PARange for 8.x architectures

xlat: Have all values of PARange for 8.x architectures ...

In AArch64, the field ID_AA64MMFR0_EL1.PARange has a different set of
allowed values depending on the architecture version.

Previously, we only compiled the Trusted Firmware with the values that
were allowed by the architecture. However, given that this field is
read-only, it is easier to compile the code with all values regardless
of the target architecture.

Change-Id: I57597ed103dd0189b1fb738a9ec5497391c10dd1
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

ARM platforms: Demonstrate mem_protect from el3_runtime ...

Previously mem_protect used to be only supported from BL2. This is not
helpful in the case when ARM TF-A BL2 is not used. This patch demonstrates
mem_protect from el3_runtime firmware on ARM Platforms specifically
when RESET_TO_BL31 or RESET_TO_SP_MIN flag is set as BL2 may be absent
in these cases. The Non secure DRAM is dynamically mapped into EL3 mmap
tables temporarily and then the protected regions are then cleared. This
avoids the need to map the non secure DRAM permanently to BL31/sp_min.

The stack size is also increased, because DYNAMIC_XLAT_TABLES require
a bigger stack.

Change-Id: Ia44c594192ed5c5adc596c0cff2c7cc18c001fde
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>

xlat: Set AP[1] to 1 when it is RES1 ...

According to the ARMv8 ARM issue C.a:

    AP[1] is valid only for stage 1 of a translation regime that can
    support two VA ranges. It is RES 1 when stage 1 translations can
    support only one VA range.

This means that, even though this bit is ignored, it should be set to 1
in the EL3 and EL2 translation regimes.

For translation regimes consisting on EL0 and a higher regime this bit
selects between control at EL0 or at the higher Exception level. The
regimes that support two VA ranges are EL1&0 and EL2&0 (the later one
is only available since ARMv8.1).

This fix has to be applied to both versions of the translation tables
library.

Change-Id: If19aaf588551bac7aeb6e9a686cf0c2068e7c181
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Merge pull request #1357 from antonio-nino-diaz-arm/an/fix-misra ...

Fix some MISRA defects in SPM code

Fix some MISRA defects in SPM code ...

Change-Id: I989c1f4aef8e3cb20d5d19e6347575e6449bb60b
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Check presence of fix for errata 835769 in Cortex-A53 ...

A fix for errata 835769 may be available in revisions r0p2, r0p3 or r0p4
of the Cortex-A53 processor. The presence of the fix is determined by
checking bit 7 in the REVIDR register.

If the fix is present we report ERRATA_NOT_APPLIES which silences the
erroneous 'missing workaround' warning.

Change-Id: Ib75b008e755e9ac648554ca9398024fdbea4a91a
Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>

Check presence of fix for errata 843419 in Cortex-A53 ...

A fix for errata 843419 may be available in revision r0p4 of the
Cortex-A53 processor. The presence of the fix is determined by checking
bit 8 in the REVIDR register.

If the fix is present we report ERRATA_NOT_APPLIES which silences the
erroneous 'missing workaround' warning.

Change-Id: Ibd2a478df3e2a6325442a6a48a0bb0259dcfc1d7
Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>

lib: xlat_tables_v2: reduce time required to add a mmap region ...

The last entry in the mapping table is not necessarily the same as the
end of the table. This patch loops through the table to find the last
entry marker, on every new mmap addition. The memove operation then
has to only move the memory between current entry and the last entry.
For platforms that arrange their MMIO map properly, this opearation
turns out to be a NOP.

The previous implementation added significant overhead per mmap
addition as the memmove operation always moved the difference between
the current mmap entry and the end of the table.

Tested on Tegra platforms and this new approach improves the memory
mapping time by ~75%, thus significantly reducing boot time on some
platforms.

Change-Id: Ie3478fa5942379282ef58bee2085da799137e2ca
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

Merge pull request #1313 from jonathanwright-ARM/jw/MISRA-switch-statements ...

Fix switch statements to comply with MISRA rules

Merge pull request #1335 from JoelHutton/jh/cleanup_void_pointers ...

Clean usage of void pointers to access symbols

psci: initialize array fully to comply with MISRA ...

Initializes each element of the last_cpu_in_non_cpu_pd array in PSCI
stat implementation to -1, the reset value. This satisfies MISRA rule
9.3.

Previously, only the first element of the array was initialized to -1.

Change-Id: I666c71e6c073710c67c6d24c07a219b1feb5b773
Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>

Clean usage of void pointers to access symbols ...

Void pointers have been used to access linker symbols, by declaring an
extern pointer, then taking the address of it. This limits symbols
values to aligned pointer values. To remove this restriction an
IMPORT_SYM macro has been introduced, which declares it as a char
pointer and casts it to the required type.

Change-Id: I89877fc3b13ed311817bb8ba79d4872b89bfd3b0
Signed-off-by: Joel Hutton <Joel.Hutton@Arm.com>

lib: fix switch statements to comply with MISRA rules ...

Ensure (where possible) that switch statements in lib comply with MISRA
rules 16.1 - 16.7.

Change-Id: I52bc896fb7094d2b7569285686ee89f39f1ddd84
Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>

Merge pull request #1311 from jonathanwright-ARM/jw/MISRA-EOF-usage ...

stdlib: remove comparison with EOF macro to comply with MISRA