linker_script: move .data section to bl_common.ld.h ...

Move the data section to the common header.

I slightly tweaked some scripts as follows:

[1] bl1.ld.S has ALIGN(16). I added DATA_ALIGN macro, which is 1
    by default, but overridden by bl1.ld.S. Currently, ALIGN(16)
    of the .data section is redundant because commit 412865907699
    ("Fix boot failures on some builds linked with ld.lld.") padded
    out the previous section to work around the issue of LLD version
    <= 10.0. This will be fixed in the future release of LLVM, so
    I am keeping the proper way to align LMA.

[2] bl1.ld.S and bl2_el3.ld.S define __DATA_RAM_{START,END}__ instead
    of __DATA_{START,END}__. I put them out of the .data section.

[3] SORT_BY_ALIGNMENT() is missing tsp.ld.S, sp_min.ld.S, and
    mediatek/mt6795/bl31.ld.S. This commit adds SORT_BY_ALIGNMENT()
    for all images, so the symbol order in those three will change,
    but I do not think it is a big deal.

Change-Id: I215bb23c319f045cd88e6f4e8ee2518c67f03692
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

linker_script: move stacks section to bl_common.ld.h ...

The stacks section is the same for all BL linker scripts.

Move it to the common header file.

Change-Id: Ibd253488667ab4f69702d56ff9e9929376704f6c
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

bl1: remove '.' from stacks section in linker script ...

Only BL1 specifies '.' in the address field of the stacks section.

Commit 4f59d8359f97 ("Make BL1 RO and RW base addresses configurable")
added '.' on purpose but the commit message does not help to understand
why.

This commit gets rid of it in order to factor out the stacks section
into include/common/bl_common.ld.h

I compared the build result for PLAT=qemu.

'aarch64-linux-gnu-nm -n build/qemu/release/bl1/bl1.elf' will change
as follows:

@@ -336,8 +336,8 @@
 000000000e04e0e0 d max_log_level
 000000000e04e0e4 D console_state
 000000000e04e0e5 D __DATA_RAM_END__
-000000000e04e0e5 B __STACKS_START__
 000000000e04e100 b platform_normal_stacks
+000000000e04e100 B __STACKS_START__
 000000000e04f100 b bl1_cpu_context
 000000000e04f100 B __BSS_START__
 000000000e04f100 B __STACKS_END__

After this change, __STACKS_START__ will match to platform_normal_stacks,
and I think it makes more sense.

'aarch64-linux-gnu-objdump -h build/qemu/release/bl1/bl1.elf' will change
as follows:

@@ -9,11 +9,11 @@
                   CONTENTS, ALLOC, LOAD, READONLY, DATA
   2 .data         000000e5  000000000e04e000  0000000000004a60  0001e000  2**4
                   CONTENTS, ALLOC, LOAD, DATA
-  3 stacks        0000101b  000000000e04e0e5  000000000e04e0e5  0001e0e5  2**6
+  3 stacks        00001000  000000000e04e100  0000000000004b45  0001e100  2**6
                   ALLOC
-  4 .bss          000007e0  000000000e04f100  000000000e04f100  0001e0e5  2**5
+  4 .bss          000007e0  000000000e04f100  0000000000004b50  0001f100  2**5
                   ALLOC
-  5 xlat_table    00006000  000000000e050000  000000000e050000  0001e0e5  2**12
+  5 xlat_table    00006000  000000000e050000  0000000000004b45  00020000  2**12
                   ALLOC
   6 coherent_ram  00000000  000000000e056000  000000000e056000  0001f000  2**12
                   CONTENTS

Sandrine pointed me to a useful document [1] to understand why LMAs of
stacks, .bss, and xlat_table section have changed.

Before this patch, they fell into this scenario:
 "If the section has a specific VMA address, then this is used as the
  LMA address as well."

With this commit, the following applies:
 "Otherwise if a memory region can be found that is compatible with the
  current section, and this region contains at least one section, then
  the LMA is set so the difference between the VMA and LMA is the same
  as the difference between the VMA and LMA of the last section in the
  located region."

Anyway, those three sections are not loaded, so the LMA changes will not
be a problem. The size of bl1.bin is still the same.

QEMU still boots successfully with this change.

A good thing is, this fixes the error for the latest LLD. If I use the
mainline LLVM, I see the following error. The alignment check will probably
be included in the LLVM 11 release, so it is better to fix it now.

$ PLAT=qemu CC=clang CROSS_COMPILE=aarch64-linux-gnu-
  [ snip ]
ld.lld: error: address (0xe04e0e5) of section stacks is not a multiple of alignment (64)
make: *** [Makefile:1050: build/qemu/release/bl1/bl1.elf] Error 1

[1]: https://sourceware.org/binutils/docs/ld/Output-Section-LMA.html#Output-Section-LMA

Change-Id: I3d2f3cc2858be8b3ce2eab3812a76d1e0b5f3a32
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Merge "Fix MISRA C issues in BL1/BL2/BL31" into integration

Fix MISRA C issues in BL1/BL2/BL31 ...

Attempts to address MISRA compliance issues in BL1, BL2, and BL31 code.
Mainly issues like not using boolean expressions in conditionals,
conflicting variable names, ignoring return values without (void), adding
explicit casts, etc.

Change-Id: If1fa18ab621b9c374db73fa6eaa6f6e5e55c146a
Signed-off-by: John Powell <john.powell@arm.com>

linker_script: move bss section to bl_common.ld.h ...

Move the bss section to the common header. This adds BAKERY_LOCK_NORMAL
and PMF_TIMESTAMP, which previously existed only in BL31. This is not
a big deal because unused data should not be compiled in the first
place. I believe this should be controlled by BL*_SOURCES in Makefiles,
not by linker scripts.

I investigated BL1, BL2, BL2U, BL31 for plat=fvp, and BL2-AT-EL3,
BL31, BL31 for plat=uniphier. I did not see any more  unexpected
code addition.

The bss section has bigger alignment. I added BSS_ALIGN for this.

Currently, SORT_BY_ALIGNMENT() is missing in sp_min.ld.S, and with this
change, the BSS symbols in SP_MIN will be sorted by the alignment.
This is not a big deal (or, even better in terms of the image size).

Change-Id: I680ee61f84067a559bac0757f9d03e73119beb33
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

linker_script: replace common read-only data with RODATA_COMMON ...

The common section data are repeated in many linker scripts (often
twice in each script to support SEPARATE_CODE_AND_RODATA). When you
add a new read-only data section, you end up with touching lots of
places.

After this commit, you will only need to touch bl_common.ld.h when
you add a new section to RODATA_COMMON.

Replace a series of RO section with RODATA_COMMON, which contains
6 sections, some of which did not exist before.

This is not a big deal because unneeded data should not be compiled
in the first place. I believe this should be controlled by BL*_SOURCES
in Makefiles, not by linker scripts.

When I was working on this commit, the BL1 image size increased
due to the fconf_populator. Commit c452ba159c14 ("fconf: exclude
fconf_dyn_cfg_getter.c from BL1_SOURCES") fixed this issue.

I investigated BL1, BL2, BL2U, BL31 for plat=fvp, and BL2-AT-EL3,
BL31, BL31 for plat=uniphier. I did not see any more  unexpected
code addition.

Change-Id: I5d14d60dbe3c821765bce3ae538968ef266f1460
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

linker_script: move more common code to bl_common.ld.h ...

These are mostly used to collect data from special structure,
and repeated in many linker scripts.

To differentiate the alignment size between aarch32/aarch64, I added
a new macro STRUCT_ALIGN.

While I moved the PMF_SVC_DESCS, I dropped #if ENABLE_PMF conditional.
As you can see in include/lib/pmf/pmf_helpers.h, PMF_REGISTER_SERVICE*
are no-op when ENABLE_PMF=0. So, pmf_svc_descs and pmf_timestamp_array
data are not populated.

Change-Id: I3f4ab7fa18f76339f1789103407ba76bda7e56d0
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Factor xlat_table sections in linker scripts out into a header file ...

TF-A has so many linker scripts, at least one linker script for each BL
image, and some platforms have their own ones. They duplicate quite
similar code (and comments).

When we add some changes to linker scripts, we end up with touching
so many files. This is not nice in the maintainability perspective.

When you look at Linux kernel, the common code is macrofied in
include/asm-generic/vmlinux.lds.h, which is included from each arch
linker script, arch/*/kernel/vmlinux.lds.S

TF-A can follow this approach. Let's factor out the common code into
include/common/bl_common.ld.h

As a start point, this commit factors out the xlat_table section.

Change-Id: Ifa369e9b48e8e12702535d721cc2a16d12397895
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

aarch32: stop speculative execution past exception returns ...

aarch32 CPUs speculatively execute instructions following a
ERET as if it was not a jump instruction. This could lead to
cache-based side channel vulnerabilities. The software fix is
to place barrier instructions following ERET.

The counterpart patch for aarch64 is merged:
https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=f461fe3

Change-Id: I2aa3105bee0b92238f389830b3a3b8650f33af3d
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

Merge "coverity: fix MISRA violations" into integration

coverity: fix MISRA violations ...

Fixes for the following MISRA violations:
- Missing explicit parentheses on sub-expression
- An identifier or macro name beginning with an
  underscore, shall not be declared
- Type mismatch in BL1 SMC handlers and tspd_main.c

Change-Id: I7a92abf260da95acb0846b27c2997b59b059efc4
Signed-off-by: Zelalem <zelalem.aweke@arm.com>

Fix boot failures on some builds linked with ld.lld. ...

Pad the .rodata section to 16 bytes as ld.lld does not apply the ALIGN
statement on the .data section to the LMA. Fixes boot failure on builds
where the .rodata section happens to not be 16 bytes aligned.

Change-Id: I4e95678f73d8b326c5fc749dc7d0ce84e2d603f5
Signed-off-by: Arve Hjønnevåg <arve@android.com>

coverity: Fix MISRA null pointer violations ...

Fix code that violates the MISRA rule:
MISRA C-2012 Rule 11.9: Literal "0" shall not be used as
null pointer constant.

The fix explicitly checks whether a pointer is NULL.

Change-Id: Ibc318dc0f464982be9a34783f24ccd1d44800551
Signed-off-by: Zelalem <zelalem.aweke@arm.com>

Coverity: remove unnecessary header file includes ...

This patch removes unnecessary header file includes
discovered by Coverity HFA option.

Change-Id: I2827c37c1c24866c87db0e206e681900545925d4
Signed-off-by: Zelalem <zelalem.aweke@arm.com>

Prevent speculative execution past ERET ...

Even though ERET always causes a jump to another address, aarch64 CPUs
speculatively execute following instructions as if the ERET
instruction was not a jump instruction.
The speculative execution does not cross privilege-levels (to the jump
target as one would expect), but it continues on the kernel privilege
level as if the ERET instruction did not change the control flow -
thus execution anything that is accidentally linked after the ERET
instruction. Later, the results of this speculative execution are
always architecturally discarded, however they can leak data using
microarchitectural side channels. This speculative execution is very
reliable (seems to be unconditional) and it manages to complete even
relatively performance-heavy operations (e.g. multiple dependent
fetches from uncached memory).

This was fixed in Linux, FreeBSD, OpenBSD and Optee OS:
https://github.com/torvalds/linux/commit/679db70801da9fda91d26caf13bf5b5ccc74e8e8
https://github.com/freebsd/freebsd/commit/29fb48ace4186a41c409fde52bcf4216e9e50b61
https://github.com/openbsd/src/commit/3a08873ece1cb28ace89fd65e8f3c1375cc98de2
https://github.com/OP-TEE/optee_os/commit/abfd092aa19f9c0251e3d5551e2d68a9ebcfec8a

It is demonstrated in a SafeSide example:
https://github.com/google/safeside/blob/master/demos/eret_hvc_smc_wrapper.cc
https://github.com/google/safeside/blob/master/kernel_modules/kmod_eret_hvc_smc/eret_hvc_smc_module.c

Signed-off-by: Anthony Steinhauser <asteinhauser@google.com>
Change-Id: Iead39b0b9fb4b8d8b5609daaa8be81497ba63a0f

Merge "PIE: make call to GDT relocation fixup generalized" into integration

PIE: make call to GDT relocation fixup generalized ...

When a Firmware is complied as Position Independent Executable it needs
to request GDT fixup by passing size of the memory region to
el3_entrypoint_common macro.
The Global descriptor table fixup will be done early on during cold boot
process of primary core.

Currently only BL31 supports PIE, but in future when BL2_AT_EL3 will be
compiled as PIE, it can simply pass fixup size to the common el3
entrypoint macro to fixup GDT.

The reason for this patch was to overcome the bug introduced by SHA
330ead806 which called fixup routine for each core causing
re-initializing of global pointers thus overwriting any changes
done by the previous core.

Change-Id: I55c792cc3ea9e7eef34c2e4653afd04572c4f055
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>

Reduce space lost to object alignment ...

Currently, sections within .text/.rodata/.data/.bss are emitted in the
order they are seen by the linker. This leads to wasted space, when a
section with a larger alignment follows one with a smaller alignment.
We can avoid this wasted space by sorting the sections.

To take full advantage of this, we must disable generation of common
symbols, so "common" data can be sorted along with the rest of .bss.

An example of the improvement, from `make DEBUG=1 PLAT=sun50i_a64 bl31`:
  .text   => no change
  .rodata => 16 bytes saved
  .data   => 11 bytes saved
  .bss    => 576 bytes saved

As a side effect, the addition of `-fno-common` in TF_CFLAGS makes it
easier to spot bugs in header files.

Signed-off-by: Samuel Holland <samuel@sholland.org>
Change-Id: I073630a9b0b84e7302a7a500d4bb4b547be01d51

TF-A: Add support for ARMv8.3-PAuth in BL1 SMC calls and BL2U ...

This patch adds support for ARMv8.3-PAuth in BL1 SMC calls and
BL2U image for firmware updates by programming APIAKey_EL1 registers
and enabling Pointer Authentication in EL3 and EL1 respectively.

Change-Id: I875d952aba8242caf74fb5f4f2d2af6f0c768c08
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

Merge changes from topic "db/unsigned_long" into integration ...

* changes:
  Unsigned long should not be used as per coding guidelines
  SCTLR and ACTLR are 32-bit for AArch32 and 64-bit for AArch64

Unsigned long should not be used as per coding guidelines ...

We should either change them to `unsigned int` or `unsigned long long`
when the size of the variable is the same in AArch64 and AArch32 or
to `u_register_t` if it is supposed to be 32 bit wide in AArch32
and 64 bit wide in AArch64.

Signed-off-by: Deepika Bhavnani <deepika.bhavnani@arm.com>
Change-Id: I80e2a6edb33248ee88be395829abbd4c36c89abe

Refactor ARMv8.3 Pointer Authentication support code ...

This patch provides the following features and makes modifications
listed below:
- Individual APIAKey key generation for each CPU.
- New key generation on every BL31 warm boot and TSP CPU On event.
- Per-CPU storage of APIAKey added in percpu_data[]
  of cpu_data structure.
- `plat_init_apiakey()` function replaced with `plat_init_apkey()`
  which returns 128-bit value and uses Generic timer physical counter
  value to increase the randomness of the generated key.
  The new function can be used for generation of all ARMv8.3-PAuth keys
- ARMv8.3-PAuth specific code placed in `lib\extensions\pauth`.
- New `pauth_init_enable_el1()` and `pauth_init_enable_el3()` functions
  generate, program and enable APIAKey_EL1 for EL1 and EL3 respectively;
  pauth_disable_el1()` and `pauth_disable_el3()` functions disable
  PAuth for EL1 and EL3 respectively;
  `pauth_load_bl31_apiakey()` loads saved per-CPU APIAKey_EL1 from
  cpu-data structure.
- Combined `save_gp_pauth_registers()` function replaces calls to
  `save_gp_registers()` and `pauth_context_save()`;
  `restore_gp_pauth_registers()` replaces `pauth_context_restore()`
  and `restore_gp_registers()` calls.
- `restore_gp_registers_eret()` function removed with corresponding
  code placed in `el3_exit()`.
- Fixed the issue when `pauth_t pauth_ctx` structure allocated space
  for 12 uint64_t PAuth registers instead of 10 by removal of macro
  CTX_PACGAKEY_END from `include/lib/el3_runtime/aarch64/context.h`
  and assigning its value to CTX_PAUTH_REGS_END.
- Use of MODE_SP_ELX and MODE_SP_EL0 macro definitions
  in `msr	spsel`  instruction instead of hard-coded values.
- Changes in documentation related to ARMv8.3-PAuth and ARMv8.5-BTI.

Change-Id: Id18b81cc46f52a783a7e6a09b9f149b6ce803211
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

AArch64: Disable Secure Cycle Counter ...

This patch fixes an issue when secure world timing information
can be leaked because Secure Cycle Counter is not disabled.
For ARMv8.5 the counter gets disabled by setting MDCR_El3.SCCD
bit on CPU cold/warm boot.
For the earlier architectures PMCR_EL0 register is saved/restored
on secure world entry/exit from/to Non-secure state, and cycle
counting gets disabled by setting PMCR_EL0.DP bit.
'include\aarch64\arch.h' header file was tided up and new
ARMv8.5-PMU related definitions were added.

Change-Id: I6f56db6bc77504634a352388990ad925a69ebbfa
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

Switch AARCH32/AARCH64 to __aarch64__ ...

NOTE: AARCH32/AARCH64 macros are now deprecated in favor of __aarch64__.

All common C compilers pre-define the same macros to signal which
architecture the code is being compiled for: __arm__ for AArch32 (or
earlier versions) and __aarch64__ for AArch64. There's no need for TF-A
to define its own custom macros for this. In order to unify code with
the export headers (which use __aarch64__ to avoid another dependency),
let's deprecate the AARCH32 and AARCH64 macros and switch the code base
over to the pre-defined standard macro. (Since it is somewhat
unintuitive that __arm__ only means AArch32, let's standardize on only
using __aarch64__.)

Change-Id: Ic77de4b052297d77f38fc95f95f65a8ee70cf200
Signed-off-by: Julius Werner <jwerner@chromium.org>

Refactor SPSR initialisation code ...

Change-Id: Ic3b30de13e314efca30fc71370227d3e76f1148b
Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>

Add support for Branch Target Identification ...

This patch adds the functionality needed for platforms to provide
Branch Target Identification (BTI) extension, introduced to AArch64
in Armv8.5-A by adding BTI instruction used to mark valid targets
for indirect branches. The patch sets new GP bit [50] to the stage 1
Translation Table Block and Page entries to denote guarded EL3 code
pages which will cause processor to trap instructions in protected
pages trying to perform an indirect branch to any instruction other
than BTI.
BTI feature is selected by BRANCH_PROTECTION option which supersedes
the previous ENABLE_PAUTH used for Armv8.3-A Pointer Authentication
and is disabled by default. Enabling BTI requires compiler support
and was tested with GCC versions 9.0.0, 9.0.1 and 10.0.0.
The assembly macros and helpers are modified to accommodate the BTI
instruction.
This is an experimental feature.
Note. The previous ENABLE_PAUTH build option to enable PAuth in EL3
is now made as an internal flag and BRANCH_PROTECTION flag should be
used instead to enable Pointer Authentication.
Note. USE_LIBROM=1 option is currently not supported.

Change-Id: Ifaf4438609b16647dc79468b70cd1f47a623362e
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

BL1: Fix type consistency ...

Change function signatures and fix sign-compare warnings.

Change-Id: Iaf755d61e6c54c3dcf4f41aa3c27ea0f6e665fee
Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>

Remove several warnings reported with W=2 ...

Improved support for W=2 compilation flag by solving some nested-extern
and sign-compare warnings.

The libraries are compiling with warnings (which turn into errors with
the Werror flag).

Outside of libraries, some warnings cannot be fixed.

Change-Id: I06b1923857f2a6a50e93d62d0274915b268cef05
Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>

bl1-smc-handler: Ensure the lower-order 16 bits of SPSR are programmed ...

A bug recently fixed in bl2/aarch32/bl2_el3_entrypoint.S relates to
programming the lower-order 16 bits of the SPSR to populate into the CPSR
on eret.

The BL1 smc-handler code is identical and has the same shortfall in
programming the SPSR from the platform defined struct
entry_point_info->spsr.

msr spsr, r1 will only update bits f->[31:24] and c->[7:0] respectively. In
order to ensure the 16 lower-order processor mode bits x->[15:8] and
c->[7:0] this patch changes msr spsr, r1 to msr spsr_xc, r1.

This change ensures we capture the x field, which we are interested in and
not the f field which we are not.

Fixes: f3b4914be3b4 ('AArch32: Add generic changes in BL1')

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>