Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-04-18 02:24:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge changes from topic "mp/ras_refactoring" into integration

Browse source 
* changes:
  docs: document do_panic() and panic() helper functions
  fix(ras): restrict RAS support for NS world
This commit is contained in:
Olivier Deprez 2022-11-10 17:46:21 +01:00 • committed by TrustedFirmware Code Review
commit f41e23ea73
17 changed files with 72 additions and 56 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
Makefile
View file

@ -715,8 +715,8 @@ endif
# For RAS_EXTENSION, require that EAs are handled in EL3 first
ifeq ($(RAS_EXTENSION),1)
ifneq ($(HANDLE_EA_EL3_FIRST),1)
$(error For RAS_EXTENSION, HANDLE_EA_EL3_FIRST must also be 1)
ifneq ($(HANDLE_EA_EL3_FIRST_NS),1)
$(error For RAS_EXTENSION, HANDLE_EA_EL3_FIRST_NS must also be 1)
endif
endif
@ -1033,7 +1033,7 @@ $(eval $(call assert_booleans,\
FAULT_INJECTION_SUPPORT \
GENERATE_COT \
GICV2_G0_FOR_EL3 \
HANDLE_EA_EL3_FIRST \
HANDLE_EA_EL3_FIRST_NS \
HW_ASSISTED_COHERENCY \
INVERTED_MEMMAP \
MEASURED_BOOT \
@ -1173,7 +1173,7 @@ $(eval $(call add_defines,\
ERROR_DEPRECATED \
FAULT_INJECTION_SUPPORT \
GICV2_G0_FOR_EL3 \
HANDLE_EA_EL3_FIRST \
HANDLE_EA_EL3_FIRST_NS \
HW_ASSISTED_COHERENCY \
LOG_LEVEL \
MEASURED_BOOT \

4
common/aarch64/debug.S
View file

@ -168,7 +168,7 @@ func do_panic
mrs x0, currentel
ubfx x0, x0, #MODE_EL_SHIFT, #MODE_EL_WIDTH
cmp x0, #MODE_EL3
#if !HANDLE_EA_EL3_FIRST
#if !HANDLE_EA_EL3_FIRST_NS
ldr x0, [sp], #0x10
b.eq el3_panic
#else
@ -184,7 +184,7 @@ func do_panic
to_panic_common:
ldr x0, [sp], #0x10
#endif /* HANDLE_EA_EL3_FIRST */
#endif /* HANDLE_EA_EL3_FIRST_NS */
#endif /* CRASH_REPORTING */
panic_common:

15
docs/components/ras.rst
View file

@ -6,10 +6,11 @@ Serviceability (RAS) extensions. RAS is a mandatory extension for Armv8.2 and
later CPUs, and also an optional extension to the base Armv8.0 architecture.
In conjunction with the |EHF|, support for RAS extension enables firmware-first
paradigm for handling platform errors: exceptions resulting from errors are
routed to and handled in EL3. Said errors are Synchronous External Abort (SEA),
Asynchronous External Abort (signalled as SErrors), Fault Handling and Error
Recovery interrupts. The |EHF| document mentions various :ref:`error handling
paradigm for handling platform errors: exceptions resulting from errors in
Non-secure world are routed to and handled in EL3.
Said errors are Synchronous External Abort (SEA), Asynchronous External Abort
(signalled as SErrors), Fault Handling and Error Recovery interrupts.
The |EHF| document mentions various :ref:`error handling
use-cases <delegation-use-cases>` .
For the description of Arm RAS extensions, Standard Error Records, and the
@ -29,7 +30,7 @@ introduced by the RAS extensions.
.. __: `Standard Error Record helpers`_
The build option ``RAS_EXTENSION`` when set to ``1`` includes the RAS in run
time firmware; ``EL3_EXCEPTION_HANDLING`` and ``HANDLE_EA_EL3_FIRST`` must also
time firmware; ``EL3_EXCEPTION_HANDLING`` and ``HANDLE_EA_EL3_FIRST_NS`` must also
be set ``1``. ``RAS_TRAP_NS_ERR_REC_ACCESS`` controls the access to the RAS
error record registers from Non-secure.
@ -198,8 +199,8 @@ related, build options:
- ``EL3_EXCEPTION_HANDLING=1`` enables handling of exceptions at EL3. See
`Interaction with Exception Handling Framework`_;
- ``HANDLE_EA_EL3_FIRST=1`` enables routing of External Aborts and SErrors to
EL3.
- ``HANDLE_EA_EL3_FIRST_NS=1`` enables routing of External Aborts and SErrors,
resulting from errors in NS world, to EL3.
The RAS support in |TF-A| introduces a default implementation of
``plat_ea_handler``, the External Abort handler in EL3. When ``RAS_EXTENSION``

11
docs/getting_started/build-options.rst
View file

@ -569,10 +569,11 @@ Common build options
EL1 for handling. The default value of this option is ``0``, which means the
Group 0 interrupts are assumed to be handled by Secure EL1.
- ``HANDLE_EA_EL3_FIRST``: When set to ``1``, External Aborts and SError
Interrupts will be always trapped in EL3 i.e. in BL31 at runtime. When set to
``0`` (default), these exceptions will be trapped in the current exception
level (or in EL1 if the current exception level is EL0).
- ``HANDLE_EA_EL3_FIRST_NS``: When set to ``1``, External Aborts and SError
Interrupts, resulting from errors in NS world, will be always trapped in
EL3 i.e. in BL31 at runtime. When set to ``0`` (default), these exceptions
will be trapped in the current exception level (or in EL1 if the current
exception level is EL0).
- ``HW_ASSISTED_COHERENCY``: On most Arm systems to-date, platform-specific
software operations are required for CPUs to enter and exit coherency.
@ -725,7 +726,7 @@ Common build options
or later CPUs. This flag can take the values 0 to 2, to align with the
``FEATURE_DETECTION`` mechanism.
When ``RAS_EXTENSION`` is set to ``1``, ``HANDLE_EA_EL3_FIRST`` must also be
When ``RAS_EXTENSION`` is set to ``1``, ``HANDLE_EA_EL3_FIRST_NS`` must also be
set to ``1``.
This option is disabled by default.

28
docs/getting_started/porting-guide.rst
View file

@ -3156,6 +3156,34 @@ Register* (``GICD_IGROUPRn``) and *Interrupt Group Modifier Register*
(``GICD_IGRPMODRn``) is read to figure out whether the interrupt is configured
as Group 0 secure interrupt, Group 1 secure interrupt or Group 1 NS interrupt.
Common helper functions
-----------------------
Function : do_panic()
~~~~~~~~~~~~~~~~~~~~~
::
Argument : void
Return : void
This API is called from assembly files when encountering a critical failure that
cannot be recovered from. It also invokes elx_panic() which allows to report a
crash from lower exception level. This function assumes that it is invoked from
a C runtime environment i.e. valid stack exists. This call **must not** return.
Function : panic()
~~~~~~~~~~~~~~~~~~
::
Argument : void
Return : void
This API called from C files when encountering a critical failure that cannot
be recovered from. This function in turn prints backtrace (if enabled) and calls
do_panic(). This call **must not** return.
Crash Reporting mechanism (in BL31)
-----------------------------------

10
docs/getting_started/psci-lib-integration-guide.rst
View file

@ -337,16 +337,6 @@ at address ``addr`` (first argument) address and of size ``size`` (second argume
This function invalidates (flushes) the data cache for memory at address
``addr`` (first argument) address and of size ``size`` (second argument).
**Function : do_panic()**
::
Argument : void
Return : void
This function will be called by the PSCI library on encountering a critical
failure that cannot be recovered from. This function **must not** return.
CPU Context management API
~~~~~~~~~~~~~~~~~~~~~~~~~~

16
docs/plat/marvell/armada/build.rst
View file

@ -165,14 +165,14 @@ Globalscale MOCHAbin specific build options:
Armada37x0 specific build options:
- HANDLE_EA_EL3_FIRST
- HANDLE_EA_EL3_FIRST_NS
When ``HANDLE_EA_EL3_FIRST=1``, External Aborts and SError Interrupts will be always trapped
in TF-A. TF-A in this case enables dirty hack / workaround for a bug found in U-Boot and
Linux kernel PCIe controller driver pci-aardvark.c, traps and then masks SError interrupt
caused by AXI SLVERR on external access (syndrome 0xbf000002).
When ``HANDLE_EA_EL3_FIRST_NS=1``, External Aborts and SError Interrupts, resulting from errors
in NS world, will be always trapped in TF-A. TF-A in this case enables dirty hack / workaround for
a bug found in U-Boot and Linux kernel PCIe controller driver pci-aardvark.c, traps and then masks
SError interrupt caused by AXI SLVERR on external access (syndrome 0xbf000002).
Otherwise when ``HANDLE_EA_EL3_FIRST=0``, these exceptions will be trapped in the current
Otherwise when ``HANDLE_EA_EL3_FIRST_NS=0``, these exceptions will be trapped in the current
exception level (or in EL1 if the current exception level is EL0). So exceptions caused by
U-Boot will be trapped in U-Boot, exceptions caused by Linux kernel (or user applications)
will be trapped in Linux kernel.
@ -185,8 +185,8 @@ Armada37x0 specific build options:
recommended to not enable this workaround as it disallows propagating of all External Aborts
to running Linux kernel and makes correctable errors as fatal aborts.
This option is now disabled by default. In past this option was enabled by default in
TF-A versions v2.2, v2.3, v2.4 and v2.5.
This option is now disabled by default. In past this option has different name "HANDLE_EA_EL3_FIRST" and
was enabled by default in TF-A versions v2.2, v2.3, v2.4 and v2.5.
- CM3_SYSTEM_RESET

16
lib/el3_runtime/aarch64/context_mgmt.c
View file

@ -206,6 +206,11 @@ static void setup_ns_context(cpu_context_t *ctx, const struct entry_point_info *
/* Allow access to Allocation Tags when MTE is implemented. */
scr_el3 |= SCR_ATA_BIT;
#if HANDLE_EA_EL3_FIRST_NS
/* SCR_EL3.EA: Route External Abort and SError Interrupt to EL3. */
scr_el3 |= SCR_EA_BIT;
#endif
#if RAS_TRAP_NS_ERR_REC_ACCESS
/*
* SCR_EL3.TERR: Trap Error record accesses. Accesses to the RAS ERR
@ -279,7 +284,7 @@ static void setup_context_common(cpu_context_t *ctx, const entry_point_info_t *e
* Security state and entrypoint attributes of the next EL.
*/
scr_el3 = read_scr();
scr_el3 &= ~(SCR_NS_BIT | SCR_RW_BIT | SCR_FIQ_BIT | SCR_IRQ_BIT |
scr_el3 &= ~(SCR_NS_BIT | SCR_RW_BIT | SCR_EA_BIT | SCR_FIQ_BIT | SCR_IRQ_BIT |
SCR_ST_BIT | SCR_HCE_BIT | SCR_NSE_BIT);
/*
@ -317,15 +322,6 @@ static void setup_context_common(cpu_context_t *ctx, const entry_point_info_t *e
scr_el3 |= SCR_TRNDR_BIT;
#endif
#if !HANDLE_EA_EL3_FIRST
/*
* SCR_EL3.EA: Do not route External Abort and SError Interrupt External
* to EL3 when executing at a lower EL. When executing at EL3, External
* Aborts are taken to EL3.
*/
scr_el3 &= ~SCR_EA_BIT;
#endif
#if FAULT_INJECTION_SUPPORT
/* Enable fault injection from lower ELs */
scr_el3 |= SCR_FIEN_BIT;

4
make_helpers/defaults.mk
View file

@ -216,9 +216,9 @@ GENERATE_COT := 0
# default, they are for Secure EL1.
GICV2_G0_FOR_EL3 := 0
# Route External Aborts to EL3. Disabled by default; External Aborts are handled
# Route NS External Aborts to EL3. Disabled by default; External Aborts are handled
# by lower ELs.
HANDLE_EA_EL3_FIRST := 0
HANDLE_EA_EL3_FIRST_NS := 0
# Secure hash algorithm flag, accepts 3 values: sha256, sha384 and sha512.
# The default value is sha256.

2
plat/arm/board/tc/platform.mk
View file

@ -21,7 +21,7 @@ SDEI_SUPPORT := 0
EL3_EXCEPTION_HANDLING := 0
HANDLE_EA_EL3_FIRST := 0
HANDLE_EA_EL3_FIRST_NS := 0
# System coherency is managed in hardware
HW_ASSISTED_COHERENCY := 1

2
plat/arm/css/sgi/sgi-common.mk
View file

@ -14,7 +14,7 @@ SDEI_SUPPORT := 0
EL3_EXCEPTION_HANDLING := 0
HANDLE_EA_EL3_FIRST := 0
HANDLE_EA_EL3_FIRST_NS := 0
CSS_SGI_CHIP_COUNT := 1

2
plat/common/aarch64/plat_common.c
View file

@ -93,7 +93,7 @@ void plat_default_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *co
ERROR("Unhandled External Abort received on 0x%lx from %s\n",
read_mpidr_el1(), get_el_str(level));
ERROR("exception reason=%u syndrome=0x%" PRIx64 "\n", ea_reason, syndrome);
#if HANDLE_EA_EL3_FIRST
#if HANDLE_EA_EL3_FIRST_NS
/* Skip backtrace for lower EL */
if (level != MODE_EL3) {
console_flush();

2
plat/marvell/armada/a3k/common/a3700_common.mk
View file

@ -62,7 +62,7 @@ BL31_SOURCES += lib/cpus/aarch64/cortex_a53.S \
$(PLAT_COMMON_BASE)/a3700_sip_svc.c \
$(MARVELL_DRV)
ifeq ($(HANDLE_EA_EL3_FIRST),1)
ifeq ($(HANDLE_EA_EL3_FIRST_NS),1)
BL31_SOURCES += $(PLAT_COMMON_BASE)/a3700_ea.c
endif

2
plat/marvell/armada/a3k/common/a3700_ea.c
View file

@ -18,7 +18,7 @@
/*
* This source file with custom plat_ea_handler function is compiled only when
* building TF-A with compile option HANDLE_EA_EL3_FIRST=1
* building TF-A with compile option HANDLE_EA_EL3_FIRST_NS=1
*/
void plat_ea_handler(unsigned int ea_reason, uint64_t syndrome, void *cookie,
void *handle, uint64_t flags)

2
plat/nvidia/tegra/soc/t194/platform_t194.mk
View file

@ -33,7 +33,7 @@ MAX_MMAP_REGIONS := 30
$(eval $(call add_define,MAX_MMAP_REGIONS))
# enable RAS handling
HANDLE_EA_EL3_FIRST := 1
HANDLE_EA_EL3_FIRST_NS := 1
RAS_EXTENSION := 1
# platform files

2
plat/renesas/common/common.mk
View file

@ -15,7 +15,7 @@ ENABLE_SVE_FOR_NS := 0
MULTI_CONSOLE_API := 1
CRASH_REPORTING := 1
HANDLE_EA_EL3_FIRST := 1
HANDLE_EA_EL3_FIRST_NS := 1
# This option gets enabled automatically if the TRUSTED_BOARD_BOOT
# is set via root Makefile, but Renesas support Trusted-Boot without

2
plat/ti/k3/common/plat_common.mk
View file

@ -27,7 +27,7 @@ ERRATA_A72_859971 := 1
ERRATA_A72_1319367 := 1
CRASH_REPORTING := 1
HANDLE_EA_EL3_FIRST := 1
HANDLE_EA_EL3_FIRST_NS := 1
# Split out RO data into a non-executable section
SEPARATE_CODE_AND_RODATA := 1