Add support for GCC stack protection ...

Introduce new build option ENABLE_STACK_PROTECTOR. It enables
compilation of all BL images with one of the GCC -fstack-protector-*
options.

A new platform function plat_get_stack_protector_canary() is introduced.
It returns a value that is used to initialize the canary for stack
corruption detection. Returning a random value will prevent an attacker
from predicting the value and greatly increase the effectiveness of the
protection.

A message is printed at the ERROR level when a stack corruption is
detected.

To be effective, the global data must be stored at an address
lower than the base of the stacks. Failure to do so would allow an
attacker to overwrite the canary as part of an attack which would void
the protection.

FVP implementation of plat_get_stack_protector_canary is weak as
there is no real source of entropy on the FVP. It therefore relies on a
timer's value, which could be predictable.

Change-Id: Icaaee96392733b721fa7c86a81d03660d3c1bc06
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>

Merge pull request #879 from Summer-ARM/sq/mt-support ...

ARM platforms: Add support for MT bit in MPIDR

ARM platforms: Add support for MT bit in MPIDR ...

This patch modifies some of the functions in ARM platform layer to cater
for the case when multi-threading `MT` is set in MPIDR. A new build flag
`ARM_PLAT_MT` is added, and when enabled, the functions accessing MPIDR
now assume that the `MT` bit is set for the platform and access the bit
fields accordingly.

Also, a new API plat_arm_get_cpu_pe_count is added when `ARM_PLAT_MT` is
enabled, returning the PE count within the physical cpu corresponding to
`mpidr`.

Change-Id: I04ccf212ac3054a60882761f4087bae299af13cb
Signed-off-by: Summer Qin <summer.qin@arm.com>

Merge pull request #860 from jeenu-arm/hw-asstd-coh ...

Patches for platforms with hardware-assisted coherency

build: Define build option for hardware-assisted coherency ...

The boolean build option HW_ASSISTED_COHERENCY is introduced to enable
various optimizations in ARM Trusted Software, when built for such
systems. It's set to 0 by default.

Change-Id: I638390da6e1718fe024dcf5b402e07084f1eb014
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Update LOAD_IMAGE_V2 user guide documentation ...

Now the TRUSTED_BOARD_BOOT is supported for AArch64 when LOAD_IMAGE_V2
is enabled. This patch updates the user-guide.md documentation for the
same.

Change-Id: I97de07435c81258c2a5f41a30a69736863a10bd1
Signed-off-by: Summer Qin <summer.qin@arm.com>

Merge pull request #843 from jeenu-arm/cas-lock ...

Introduce locking primitives using CAS instruction

Merge pull request #838 from davidcunado-arm/dc/update_userguide ...

Migrate to Linaro Release 16.12

Introduce locking primitives using CAS instruction ...

The ARMv8v.1 architecture extension has introduced support for far
atomics, which includes compare-and-swap. Compare and Swap instruction
is only available for AArch64.

Introduce build options to choose the architecture versions to target
ARM Trusted Firmware:

  - ARM_ARCH_MAJOR: selects the major version of target ARM
    Architecture. Default value is 8.

  - ARM_ARCH_MINOR: selects the minor version of target ARM
    Architecture. Default value is 0.

When:

  (ARM_ARCH_MAJOR > 8) || ((ARM_ARCH_MAJOR == 8) && (ARM_ARCH_MINOR >= 1)),

for AArch64, Compare and Swap instruction is used to implement spin
locks. Otherwise, the implementation falls back to using
load-/store-exclusive instructions.

Update user guide, and introduce a section in Firmware Design guide to
summarize support for features introduced in ARMv8 Architecture
Extensions.

Change-Id: I73096a0039502f7aef9ec6ab3ae36680da033f16
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Migrate to Linaro Release 16.12 ...

This Linaro release updates both the binaries and the toolchain:
Linaro binaries upgraded 16.06 --> 16.12
AArch64 compiler upgraded 15.05 (gcc 4.9) --> 5.3-2015.05 (gcc 5.3)
AArch32 compiler upgraded 15.05 (gcc 4.9) --> 5.3-2015.05 (gcc 5.3)

The ARM TF codebase has been tested against these new binaries. This patch
updates the User Guide to reflect that the 16.12 release is now a supported
Linaro Release.

Change-Id: I6247e820f591df7d05df4f622ee45a3abf2c2d72
Signed-off-by: David Cunado <david.cunado@arm.com>

Merge pull request #826 from dp-arm/dp/psci-stat-abstraction ...

Decouple PSCI stat residency calculation from PMF

PSCI: Decouple PSCI stat residency calculation from PMF ...

This patch introduces the following three platform interfaces:

* void plat_psci_stat_accounting_start(const psci_power_state_t *state_info)

  This is an optional hook that platforms can implement in order
  to perform accounting before entering a low power state.  This
  typically involves capturing a timestamp.

* void plat_psci_stat_accounting_stop(const psci_power_state_t *state_info)

  This is an optional hook that platforms can implement in order
  to perform accounting after exiting from a low power state.  This
  typically involves capturing a timestamp.

* u_register_t plat_psci_stat_get_residency(unsigned int lvl,
	const psci_power_state_t *state_info,
	unsigned int last_cpu_index)

  This is an optional hook that platforms can implement in order
  to calculate the PSCI stat residency.

If any of these interfaces are overridden by the platform, it is
recommended that all of them are.

By default `ENABLE_PSCI_STAT` is disabled.  If `ENABLE_PSCI_STAT`
is set but `ENABLE_PMF` is not set then an alternative PSCI stat
collection backend must be provided.  If both are set, then default
weak definitions of these functions are provided, using PMF to
calculate the residency.

NOTE: Previously, platforms did not have to explicitly set
`ENABLE_PMF` since this was automatically done by the top-level
Makefile.

Change-Id: I17b47804dea68c77bc284df15ee1ccd66bc4b79b
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

Update AEM and Cortex Models versions ...

AEMv8-A Model release v8.2 has been made available and Trusted Firmware
has been tested against these versions as part of its CI system. This
patch updates the user guide documentation to reflect the version of AEM
and Cortex Models that Trusted Firmware has been tested against.

Also, the Linaro Release Notes link was broken and this patch updates the
link.

Change-Id: I88729cef909a69fff629036f480fd6168ad7dc9a
Signed-off-by: David Cunado <david.cunado@arm.com>

user-guide.md: Fix FVP references ...

The current user guide mentions that Foundation model doesn't support
debugger interface. Clarify that all FVPs support --cadi-server option
such that a CADI-compliant debugger can connect to and control model
execution.

Also fix broken URL to FVP home page.

Change-Id: Ia14d618a4e0abb4b228eb1616040f9b51fb3f6f9
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Update Foundation Model version ...

Foundation Model release 10.2 has been made available and Trusted
Firmware has been tested against that it as part of its CI system.

This patch updates the user guide documentation to reflect the version
of Foundation Model that Trusted Firmware has been tested against.

Change-Id: I8571e1027b24892b41d04b93b24245a371ca2cae
Signed-off-by: David Cunado <david.cunado@arm.com>

Docs: Fix monospace formatting in user guide ...

Change-Id: I28b2790ff2f87b9fe3cf1020e59e1e0a00be6f97
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Clarify dependency for PSCI_EXTENDED_STATE_ID ...

Add dependency information in the user guide for ARM_RECOM_STATE_ID_ENC
that needs to be set when using PSCI_EXTENDED_STATE_ID on ARM
platforms. Also clarify the build error message.

Change-Id: Id125a0299b179f5f222bca4e2503204bf89a3c59
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>

docs: Reorder build options alphabetically ...

At present, build options in the user guide aren't listed in any
specific order. Ordering them alphabetically is a standard practice, and
is also easier on the reader.

Contents unchanged.

Change-Id: Ibc36f3a2a576edb86c1a402430d2ef5adcb2f144
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

user guide: Document `ENABLE_RUNTIME_INSTRUMENTATION` option ...

Change-Id: I8e50df67e860b9589834445761a7b9927690fdce
Signed-off-by: dp-arm <dimitris.papastamos@arm.com>

Release v1.3: Minor updates to user guide ...

Updated the user guide to clarify building FIP for AArch32.
The instructions were previously specific to building a FIP for AArch64.

Change-Id: I7bd1a6b8e810cfda411f707e04f479006817858e
Signed-off-by: David Cunado <david.cunado@arm.com>

Merge pull request #731 from danh-arm/an/fix-juno-doc ...

Fix documentation of bootwrapper boot on juno

Fix documentation of bootwrapper boot on juno ...

The user guide incorrectly claimed that it is possible to load a
bootwrapped kernel over JTAG on Juno in the same manner as an EL3
payload. In the EL3 payload boot flow, some of the platform
initialisations in BL2 are modified. In particular, the TZC settings
are modified to allow unrestricted access to DRAM. This in turn allows
the debugger to access the DRAM and therefore to load the image there.

In the BL33-preloaded boot flow though, BL2 uses the default TZC
programming, which prevent access to most of the DRAM from secure state.
When execution reaches the SPIN_ON_BL1_EXIT loop, the MMU is disabled
and thus DS-5 presumably issues secure access transactions while trying
to load the image, which fails.

One way around it is to stop execution at the end of BL2 instead. At
this point, the MMU is still enabled and the DRAM is mapped as
non-secure memory. Therefore, the debugger is allowed to access this
memory in this context and to sucessfully load the bootwrapped kernel in
DRAM. The user guide is updated to suggest this alternative method.

Co-Authored-By: Sandrine Bailleux <sandrine.bailleux@arm.com>
Signed-off-by: Dan Handley <dan.handley@arm.com>

Change-Id: I537ea1c6d2f96edc06bc3f512e770c748bcabe94

AArch32: Update user-guide and add DTBs ...

This patch adds necessary updates for building and running Trusted
Firmware for AArch32 to user-guide.md. The instructions for running
on both `FVP_Base_AEMv8A-AEMv8A` in AArch32 mode and
`FVP_Base_Cortex-A32x4` models are added. The device tree files for
AArch32 Linux kernel are also added in the `fdts` folder.

Change-Id: I0023b6b03e05f32637cb5765fdeda8c8df2d0d3e

Merge pull request #718 from sandrine-bailleux-arm/sb/update-deps-v1.3 ...

Upgrade Linaro release, FVPs and mbed TLS versions

Upgrade Linaro release, FVPs and mbed TLS versions ...

This patch updates the User Guide to recommend the latest version
of some of the software dependencies of ARM Trusted Firmware.

 - Upgrade Linaro release:     16.02 -> 16.06

 - Upgrade FVPs
    - Foundation v8 FVP:       9.5 -> 10.1
    - Base FVPs:               7.6 -> 7.7

 - Upgrade mbed TLS library:   2.2.0 -> 2.2.1

Note that the latest release of mbed TLS as of today is 2.3.0 but it has
compilations issues with the set of library configuration options that
Trusted Firmware uses. 2.2.1 is the next most recent release known to
build with TF.

This patch also fixes the markdown formatting of a link in the
User Guide.

Change-Id: Ieb7dd336f4d3110fba060afec4ad580ae707a8f1

Add new version of image loading. ...

This patch adds capability to load BL images based on image
descriptors instead of hard coded way of loading BL images.
This framework is designed such that it can be readily adapted
by any BL stage that needs to load images.

In order to provide the above capability the following new
platform functions are introduced:

  bl_load_info_t *plat_get_bl_image_load_info(void);
    This function returns pointer to the list of images that the
    platform has populated to load.

  bl_params_t *plat_get_next_bl_params(void);
    This function returns a pointer to the shared memory that the
    platform has kept aside to pass trusted firmware related
    information that next BL image needs.

  void plat_flush_next_bl_params(void);
    This function flushes to main memory all the params that
    are passed to next image.

  int bl2_plat_handle_post_image_load(unsigned int image_id)
    This function can be used by the platforms to update/use
    image information for given `image_id`.

`desc_image_load.c` contains utility functions which can be used
by the platforms to generate, load and executable, image list
based on the registered image descriptors.

This patch also adds new version of `load_image/load_auth_image`
functions in-order to achieve the above capability.

Following are the changes for the new version as compared to old:
  - Refactor the signature and only keep image_id and image_info_t
    arguments. Removed image_base argument as it is already passed
    through image_info_t. Given that the BL image base addresses and
    limit/size are already provided by the platforms, the meminfo_t
    and entry_point_info arguments are not needed to provide/reserve
    the extent of free memory for the given BL image.

  - Added check for the image size against the defined max size.
    This is needed because the image size could come from an
    unauthenticated source (e.g. the FIP header).
    To make this check, new member is added to the image_info_t
    struct for identifying the image maximum size.

New flag `LOAD_IMAGE_V2` is added in the Makefile.
Default value is 0.

NOTE: `TRUSTED_BOARD_BOOT` is currently not supported when
      `LOAD_IMAGE_V2` is enabled.

Change-Id: Ia7b643f4817a170d5a2fbf479b9bc12e63112e79

fiptool: Add support for printing the sha256 digest with info command ...

This feature allows one to quickly verify that the expected
image is contained in the FIP without extracting the image and
running sha256sum(1) on it.

The sha256 digest is only shown when the verbose flag is used.

This change requires libssl-dev to be installed in order to build
Trusted Firmware. Previously, libssl-dev was optionally needed only
to support Trusted Board Boot configurations.

Fixes ARM-Software/tf-issues#124

Change-Id: Ifb1408d17f483d482bb270a589ee74add25ec5a6

Merge pull request #678 from soby-mathew/sm/PSCI_AArch32 ...

Introduce AArch32 support for PSCI library

Move up to Base FVP version 7.6 ...

This patch updates the User Guide to move up from version 7.2 to 7.6
of the Base FVP.

Change-Id: I792b2250deb4836266e14b40992ae59a5ab5f729

AArch32: Enable build at top level Makefile for FVP ...

This patch enables the AArch32 build including SP_MIN in the
top level Makefile. The build flag `ARCH` now can specify either
`aarch64`(default) or `aarch32`. Currently only FVP AEM model is
supported for AArch32 build. Another new build flag `AARCH32_SP`
is introduced to specify the AArch32 secure payload to be built.

Change-Id: Ie1198cb9e52d7da1b79b93243338fc3868b08faa