Skip to content

GitLab

Switch branch/tag
  1. 25 Feb, 2020 26 commits
  3. 24 Feb, 2020 1 commit
    • Petre-Ionut Tudor's avatar
      Read-only xlat tables for BL31 memory · 60e8f3cf
      Petre-Ionut Tudor authored 
      

This patch introduces a build flag which allows the xlat tables
to be mapped in a read-only region within BL31 memory. It makes it
much harder for someone who has acquired the ability to write to
arbitrary secure memory addresses to gain control of the
translation tables.

The memory attributes of the descriptors describing the tables
themselves are changed to read-only secure data. This change
happens at the end of BL31 runtime setup. Until this point, the
tables have read-write permissions. This gives a window of
opportunity for changes to be made to the tables with the MMU on
(e.g. reclaiming init code). No changes can be made to the tables
with the MMU turned on from this point onwards. This change is also
enabled for sp_min and tspd.

To make all this possible, the base table was moved to .rodata. The
penalty we pay is that now .rodata must be aligned to the size of
the base table (512B alignment). Still, this is better than putting
the base table with the higher level tables in the xlat_table
section, as that would cost us a full 4KB page.

Changing the tables from read-write to read-only cannot be done with
the MMU on, as the break-before-make sequence would invalidate the
descriptor which resolves the level 3 page table where that very
descriptor is located. This would make the translation required for
writing the changes impossible, generating an MMU fault.

The caches are also flushed.
Signed-off-by: default avatarPetre-Ionut Tudor <petre-ionut.tudor@arm.com>
Change-Id: Ibe5de307e6dc94c67d6186139ac3973516430466
      60e8f3cf
  5. 21 Feb, 2020 5 commits
  7. 20 Feb, 2020 8 commits
    • Manish Pandey's avatar
      SPMD: generate and add Secure Partition blobs into FIP · ce2b1ec6
      Manish Pandey authored 
      

Till now TF-A allows limited number of external images to be made part
of FIP. With SPM coming along, there may exist multiple SP packages
which need to be inserted into FIP. To achieve this we need a more
scalable approach to feed SP packages to FIP.

This patch introduces changes in build system to generate and add SP
packages into FIP based on information provided by platform.
Platform provides information in form of JSON which contains layout
description of available Secure Partitions.
JSON parser script is invoked by build system early on and generates
a makefile which updates FIP, SPTOOL and FDT arguments which will be
used by build system later on for final packaging.

"SP_LAYOUT_FILE" passed as a build argument and can be outside of TF-A
tree. This option will be used only when SPD=spmd.

For each SP, generated makefile will have following entries
     - FDT_SOURCES	+=	sp1.dts
     - SPTOOL_ARGS	+= 	-i sp1.img:sp1.dtb -o sp1.pkg
     - FIP_ARGS		+=	--blob uuid=XXXX-XXX...,file=SP1.pkg
Signed-off-by: default avatarManish Pandey <manish.pandey2@arm.com>
Change-Id: Ib6a9c064400caa3cd825d9886008a3af67741af7
      ce2b1ec6
    • Varun Wadekar's avatar
      Tegra: spe: uninit console on a timeout · 8a47fe43
      Varun Wadekar authored 
      

There are chances a denial-of-service attack, if an attacker
removes the SPE firmware from the system. The console driver
would end up waiting for the firmware to respond indefinitely.
The console driver must detect such scenarios and uninit the
interface as a result.

This patch adds a timeout to the interaction with the SPE
firmware and uninits the interface if it times out.

Change-Id: I06f27a858baed25711d41105b4110865f1a01727
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      8a47fe43
    • Varun Wadekar's avatar
      Tegra: handler to check support for System Suspend · 5d52aea8
      Varun Wadekar authored 
      

Tegra210 SoCs need the sc7entry-fw to enter System Suspend mode,
but there might be certain boards that do not have this firmware
blob. To stop the NS world from issuing System suspend entry
commands on such devices, we ned to disable System Suspend from
the PSCI "features".

This patch removes the System suspend handler from the Tegra PSCI
ops, so that the framework will disable support for "System Suspend"
from the PSCI "features".

Original change by: kalyani chidambaram <kalyanic@nvidia.com>

Change-Id: Ie029f82f55990a8b3a6debb73e95e0e218bfd1f5
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      5d52aea8
    • Varun Wadekar's avatar
      Tegra: bpmp_ipc: improve cyclomatic complexity · 21368290
      Varun Wadekar authored 
      

Code complexity is a good indication of maintainability versus
testability of a piece of software.

ISO26262 introduces the following thresholds:

    complexity < 10 is accepted
    10 <= complexity < 20 has to be justified
    complexity >= 20 cannot be accepted

Rationale is that number of test cases to fully test a piece of
software can (depending on the coverage metrics) grow exponentially
with the number of branches in the software.

This patch removes redundant conditionals from 'ipc_send_req_atomic'
handler to reduce the McCabe Cyclomatic Complexity for this function

Change-Id: I20fef79a771301e1c824aea72a45ff83f97591d5
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      21368290
    • Varun Wadekar's avatar
      Tegra: platform handler to relocate BL32 image · 6f47acdb
      Varun Wadekar authored 
      

This patch provides platforms an opportunity to relocate the
BL32 image, during cold boot. Tegra186 platforms, for example,
relocate BL32 images to TZDRAM memory as the previous bootloader
relies on BL31 to do so.

Change-Id: Ibb864901e43aca5bf55d8c79e918b598c12e8a28
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      6f47acdb
    • Varun Wadekar's avatar
      Tegra: common: improve cyclomatic complexity · ee21281a
      Varun Wadekar authored 
      

Code complexity is a good indication of maintainability versus
testability of a piece of software.

ISO26262 introduces the following thresholds:

    complexity < 10 is accepted
    10 <= complexity < 20 has to be justified
    complexity >= 20 cannot be accepted

Rationale is that number of test cases to fully test a piece of
software can (depending on the coverage metrics) grow exponentially
with the number of branches in the software.

This patch removes redundant conditionals from 'bl31_early_platform_setup'
handler to reduce the McCabe Cyclomatic Complexity for this function.

Change-Id: Ifb628e33269b388f9323639cd97db761a7e049c4
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      ee21281a
    • kalyani chidambaram's avatar
      Tegra210: secure PMC hardware block · 37f76024
      kalyani chidambaram authored 
      

This patch sets the "secure" bit to mark the PMC hardware block
as accessible only from the secure world. This setting must be
programmed during cold boot and System Resume.

The sc7entry-fw, running on the COP, needs access to the PMC block
to enter System Suspend state, so "unlock" the PMC block before
passing control to the COP.

Change-Id: I00e39a49ae6b9f8c8eafe0cf7ff63fe6a67fdccf
Signed-off-by: default avatarkalyani chidambaram <kalyanic@nvidia.com>
      37f76024
    • Varun Wadekar's avatar
      Tegra: delay_timer: support for physical secure timer · dd4f0885
      Varun Wadekar authored 
      

This patch modifies the delay timer driver to switch to the ARM
secure physical timer instead of using Tegra's on-chip uS timer.

The secure timer is not accessible to the NS world and so eliminates
an important attack vector, where the Tegra timer source gets switched
off from the NS world leading to a DoS attack for the trusted world.

This timer is shared with the S-EL1 layer for now, but later patches
will mark it as exclusive to the EL3 exception mode.

Change-Id: I2c00f8cb4c48b25578971c626c314603906ad7cc
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      dd4f0885