PIE: Position Independant Executable support for BL31 ...

This patch introduces Position Independant Executable(PIE) support
in TF-A. As a initial prototype, only BL31 can support PIE. A trivial
dynamic linker is implemented which supports fixing up Global Offset
Table(GOT) and Dynamic relocations(.rela.dyn). The fixup_gdt_reloc()
helper function implements this linker and this needs to be called
early in the boot sequence prior to invoking C functions. The GOT is
placed in the RO section of BL31 binary for improved security and the
BL31 linker script is modified to export the appropriate symbols
required for the dynamic linker.

The C compiler always generates PC relative addresses to linker symbols
and hence referencing symbols exporting constants are a problem when
relocating the binary. Hence the reference to the
`__PERCPU_TIMESTAMP_SIZE__` symbol in PMF is removed and is now calculated
at runtime based on start and end addresses.

Change-Id: I1228583ff92cf432963b7cef052e95d995cca93d
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

Make errata reporting mandatory for CPU files ...

Previously the errata reporting was optional for CPU operation
files and this was achieved by making use of weak reference to
resolve to 0 if the symbol is not defined. This is error prone
when adding new CPU operation files and weak references are
problematic when fixing up dynamic relocations. Hence this patch
removes the weak reference and makes it mandatory for the CPU
operation files to define the errata reporting function.

Change-Id: I8af192e19b85b7cd8c7579e52f8f05a4294e5396
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

PIE: Use PC relative adrp/adr for symbol reference ...

This patch fixes up the AArch64 assembly code to use
adrp/adr instructions instead of ldr instruction for
reference to symbols. This allows these assembly
sequences to be Position Independant. Note that the
the reference to sizes have been replaced with
calculation of size at runtime. This is because size
is a constant value and does not depend on execution
address and using PC relative instructions for loading
them makes them relative to execution address. Also
we cannot use `ldr` instruction to load size as it
generates a dynamic relocation entry which must *not*
be fixed up and it is difficult for a dynamic loader
to differentiate which entries need to be skipped.

Change-Id: I8bf4ed5c58a9703629e5498a27624500ef40a836
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

xlat: Fix compatibility between v1 and v2 ...

There are several platforms using arm_setup_page_tables(), which is
supposed to be Arm platform only. This creates several dependency
problems between platforms.

This patch adds the definition XLAT_TABLES_LIB_V2 to the xlat tables lib
v2 makefile. This way it is possible to detect from C code which version
is being used and include the correct header.

The file arm_xlat_tables.h has been renamed to xlat_tables_compat.h and
moved to a common folder. This way, when in doubt, this header can be
used to guarantee compatibility, as it includes the correct header based
on XLAT_TABLES_LIB_V2.

This patch also removes the usage of ARM_XLAT_TABLES_V1 from QEMU (so
that is now locked in xlat lib v2) and ZynqMP (where it was added as a
workaround).

Change-Id: Ie1e22a23b44c549603d1402a237a70d0120d3e04
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Merge pull request #1643 from antonio-nino-diaz-arm/an/libfdt ...

Update libfdt to version 1.4.7

Merge pull request #1641 from jeenu-arm/ptrauth ...

AArch64: Enable lower ELs to use pointer authentication

libfdt: Import version v1.4.7 ...

Change-Id: Iad7adaf0b16a3d086594cb3432210ac2c4e207f8
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

libfdt: Remove current version ...

The current version of libfdt (1.4.2) has been modified to integrate it
in this repository. In order to do a clean import it is needed to remove
the current version first.

Change-Id: I2cab8c8e5632280d282fa7a2f2339768a0ad1e0f
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

libc: Integrate strrchr in libc ...

Change-Id: I3ddc07cb02d73cd7614af7a5b21827aae155f9a0
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

libc: Import strrchr from FreeBSD ...

Imported from lib/libc/string/strrchr.c from commit:

59fd2fb

Change-Id: I898206c6f0372d4d211c149ec0fb9522d0a5b01c
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

ti: k3: common: Do not disable cache on TI K3 core powerdown ...

Leave the caches on and explicitly flush any data that
may be stale when the core is powered down. This prevents
non-coherent interconnect access which has negative side-
effects on AM65x.

Signed-off-by: Andrew F. Davis <afd@ti.com>

AArch64: Enable lower ELs to use pointer authentication ...

Pointer authentication is an Armv8.3 feature that introduces
instructions that can be used to authenticate and verify pointers.

Pointer authentication instructions are allowed to be accessed from all
ELs but only when EL3 explicitly allows for it; otherwise, their usage
will trap to EL3. Since EL3 doesn't have trap handling in place, this
patch unconditionally disables all related traps to EL3 to avoid
potential misconfiguration leading to an unhandled EL3 exception.

Fixes ARM-software/tf-issues#629

Change-Id: I9bd2efe0dc714196f503713b721ffbf05672c14d
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>

Merge pull request #1624 from glneo/less-cache-flushing ...

PSCI cache flush and comment fixup

psci: platform control of SYSTEM_SUSPEND entry ...

Some platforms can only resume from system suspend from the boot
CPU, hence they should only enter that state from that same core.

The following commit presents an interface that allows the platform to
reject system suspend entry near its very last stage (last CPU).

PSCI: Do not flush cache when unneeded ...

When a platform enables its caches before it accesses the
psci_non_cpu_pd_nodes structure then explicit cache maintenance
is not needed.

Signed-off-by: Andrew F. Davis <afd@ti.com>

PSCI: Update comment on MMU disablement ...

The MMU is not disabled in this path, update the comment to
reflect this. Also clarify that both paths call prepare_cpu_pwr_dwn(),
but the second path does stack cache maintenance.

Signed-off-by: Andrew F. Davis <afd@ti.com>

xlat: Fix checks in mmap_add() and mmap_add_ctx() ...

Commit 79621f0 broke sgi575.

It is possible to have a region with 0 as value for the attributes. It
means device memory, read only, secure, executable. This is legitimate
if the code is in flash and the code is executed from there.

This is the case for SGI_MAP_FLASH0_RO, defined in the file
plat/arm/css/sgi/sgi_plat.c.

This problem is solved by checking both size and attributes in xlat v1.
In xlat v2, it is enough to check the granularity, as it can never be 0.

Change-Id: I7be11f1b0e51c4c2ffd560b4a6cdfbf15de2c276
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Merge pull request #1603 from antonio-nino-diaz-arm/db/reclaim-init ...

Reclaim BL31 initialization code memory for runtime data

Merge pull request #1584 from danielboulby-arm/db/Switches ...

Ensure the flow through switch statements is clear

Mark xlat tables initialization code ...

Mark the xlat tables code only used in BL31 initialization as
__init to be reclaimed once no longer needed

Change-Id: I3106bfd994706a57c578624573bcfa525fbbd3c4
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

Mark BL31 initialization functions ...

Mark the initialization functions in BL31, such as context management,
EHF, RAS and PSCI as __init so that they can be reclaimed by the
platform when no longer needed

Change-Id: I7446aeee3dde8950b0f410cb766b7a2312c20130
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

xlat: Change check in mmap_add and mmap_add_ctx() ...

Depending on the build flags it is possible that some of the memory
regions mapped in page table setup could have a size of 0. In this
case we simply want to do nothing but still wish to map the other
regions in the array. Therefore we cannot only use size == 0 as
the termination logic for the loop.

Since an attributes field with value 0 means that the region is
device memory, read only, secure and executable. Device memory
can't be executable, so this combination should never be used
and it is safe to use as a terminator value.

Therefore by changing the termination logic to use attributes
instead of size we prevent terminating the loop when we don't
intend to.

Change-Id: I92fc7f689ab08543497be6be4896dace2ed7b66a
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

Remove all other deprecated interfaces and files ...

Change-Id: Icd1cdd42afdc78895a9be6c46b414b0a155cfa63
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

xlat: Remove deprecated interfaces ...

Change-Id: I83de2ae3e0795e6fec3c1e5b37c441b64b0c9cb6
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Remove deprecated file plat_psci_common.c ...

Change-Id: I9fd8016527ad7706494f34356fdae8efacef5f72
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

PSCI: Remove platform compatibility layer ...

Change-Id: I40d040aa05bcbf11536a96ce59827711456b93a8
Co-authored-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Ensure the flow through switch statements is clear ...

Ensure case clauses:
*   Terminate with an unconditional break, return or goto statement.
*   Use conditional break, return or goto statements as long as the end
    of the case clause is unreachable; such case clauses must terminate
    with assert(0) /* Unreachable */ or an unconditional  __dead2 function
    call
*   Only fallthough when doing otherwise would result in less
    readable/maintainable code; such case clauses must terminate with a
    /* Fallthrough */ comment to make it clear this is the case and
    indicate that a fallthrough is intended.

This reduces the chance of bugs appearing due to unintended flow through a
switch statement

Change-Id: I70fc2d1f4fd679042397dec12fd1982976646168
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

Merge pull request #1568 from soby-mathew/sm/fix_ares_err_report ...

Fix the Cortex-ares errata reporting function name

Fix the Cortex-ares errata reporting function name ...

This patch fixes the name of the Cortex-ares errata function which was
previously named `cortex_a72_errata_report` which was an error.

Change-Id: Ia124df4628261021baa8d9a30308bc286d45712b
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

RAS: Fix assert condition ...

Change-Id: Ia02a2dbfd4e25547776e78bed40a91f3452553d7
Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>