Skip to content

GitLab

Switch branch/tag
  1. 11 Mar, 2020 5 commits
  3. 10 Mar, 2020 1 commit
  5. 06 Mar, 2020 3 commits
    • Alexei Fedorov's avatar
      Fix crash dump for lower EL · b4292bc6
      Alexei Fedorov authored 
      

This patch provides a fix for incorrect crash dump data for
lower EL when TF-A is built with HANDLE_EA_EL3_FIRST=1 option
which enables routing of External Aborts and SErrors to EL3.

Change-Id: I9d5e6775e6aad21db5b78362da6c3a3d897df977
Signed-off-by: default avatarAlexei Fedorov <Alexei.Fedorov@arm.com>
      b4292bc6
    • Sumit Garg's avatar
      TBB: Add an IO abstraction layer to load encrypted firmwares · 2be57b86
      Sumit Garg authored 
      

TBBR spec advocates for optional encryption of firmwares (see optional
requirement: R060_TBBR_FUNCTION). So add an IO abstaction layer to
support firmware decryption that can be stacked above any underlying IO/
packaging layer like FIP etc. It aims to provide a framework to load any
encrypted IO payload.

Also, add plat_get_enc_key_info() to be implemented in a platform
specific manner as handling of encryption key may vary from one platform
to another.
Signed-off-by: default avatarSumit Garg <sumit.garg@linaro.org>
Change-Id: I9892e0ddf00ebecb8981301dbfa41ea23e078b03
      2be57b86
    • Sumit Garg's avatar
      drivers: crypto: Add authenticated decryption framework · 7cda17bb
      Sumit Garg authored 
      

Add framework for autheticated decryption of data. Currently this
patch optionally imports mbedtls library as a backend if build option
"DECRYPTION_SUPPORT = aes_gcm" is set to perform authenticated decryption
using AES-GCM algorithm.
Signed-off-by: default avatarSumit Garg <sumit.garg@linaro.org>
Change-Id: I2966f0e79033151012bf4ffc66f484cd949e7271
      7cda17bb
  7. 04 Mar, 2020 1 commit
    • Manish Pandey's avatar
      SPMD: loading Secure Partition payloads · cb3b5344
      Manish Pandey authored 
      

This patch implements loading of Secure Partition packages using
existing framework of loading other bl images.

The current framework uses a statically defined array to store all the
possible image types and at run time generates a link list and traverse
through it to load different images.

To load SPs, a new array of fixed size is introduced which will be
dynamically populated based on number of SPs available in the system
and it will be appended to the loadable images list.

Change-Id: I8309f63595f2a71b28a73b922d20ccba9c4f6ae4
Signed-off-by: default avatarManish Pandey <manish.pandey2@arm.com>
      cb3b5344
  9. 03 Mar, 2020 4 commits
  11. 02 Mar, 2020 1 commit
  13. 01 Mar, 2020 1 commit
  15. 27 Feb, 2020 1 commit
    • Louis Mayencourt's avatar
      fconf: Fix misra issues · 845db722
      Louis Mayencourt authored 
      

MISRA C-2012 Rule 20.7:
Macro parameter expands into an expression without being wrapped by parentheses.

MISRA C-2012 Rule 12.1:
Missing explicit parentheses on sub-expression.

MISRA C-2012 Rule 18.4:
Essential type of the left hand operand is not the same as that of the right
operand.

Include does not provide any needed symbols.

Change-Id: Ie1c6451cfbc8f519146c28b2cf15c50b1f36adc8
Signed-off-by: default avatarLouis Mayencourt <louis.mayencourt@arm.com>
      845db722
  17. 25 Feb, 2020 9 commits
  19. 24 Feb, 2020 3 commits
    • Petre-Ionut Tudor's avatar
      Read-only xlat tables for BL31 memory · 60e8f3cf
      Petre-Ionut Tudor authored 
      

This patch introduces a build flag which allows the xlat tables
to be mapped in a read-only region within BL31 memory. It makes it
much harder for someone who has acquired the ability to write to
arbitrary secure memory addresses to gain control of the
translation tables.

The memory attributes of the descriptors describing the tables
themselves are changed to read-only secure data. This change
happens at the end of BL31 runtime setup. Until this point, the
tables have read-write permissions. This gives a window of
opportunity for changes to be made to the tables with the MMU on
(e.g. reclaiming init code). No changes can be made to the tables
with the MMU turned on from this point onwards. This change is also
enabled for sp_min and tspd.

To make all this possible, the base table was moved to .rodata. The
penalty we pay is that now .rodata must be aligned to the size of
the base table (512B alignment). Still, this is better than putting
the base table with the higher level tables in the xlat_table
section, as that would cost us a full 4KB page.

Changing the tables from read-write to read-only cannot be done with
the MMU on, as the break-before-make sequence would invalidate the
descriptor which resolves the level 3 page table where that very
descriptor is located. This would make the translation required for
writing the changes impossible, generating an MMU fault.

The caches are also flushed.
Signed-off-by: default avatarPetre-Ionut Tudor <petre-ionut.tudor@arm.com>
Change-Id: Ibe5de307e6dc94c67d6186139ac3973516430466
      60e8f3cf
    • Sandrine Bailleux's avatar
      plat/arm: Pass cookie argument down to arm_get_rotpk_info() · 88005701
      Sandrine Bailleux authored 
      

The cookie will be leveraged in the next commit.

Change-Id: Ie8bad275d856d84c27466461cf815529dd860446
Signed-off-by: default avatarSandrine Bailleux <sandrine.bailleux@arm.com>
      88005701
    • Sandrine Bailleux's avatar
      Introduce a new "dualroot" chain of trust · 5ab8b717
      Sandrine Bailleux authored 
      

This new chain of trust defines 2 independent signing domains:

1) One for the silicon firmware (BL1, BL2, BL31) and optionally the
   Trusted OS. It is rooted in the Silicon ROTPK, just as in the TBBR
   CoT.

2) One for the Normal World Bootloader (BL33). It is rooted in a new key
   called Platform ROTPK, or PROTPK for short.

In terms of certificates chain,

- Signing domain 1) is similar to what TBBR advocates (see page 21 of
  the TBBR specification), except that the Non-Trusted World Public Key
  has been removed from the Trusted Key Certificate.

- Signing domain 2) only contains the Non-Trusted World Content
  certificate, which provides the hash of the Non-Trusted World
  Bootloader. Compared to the TBBR CoT, there's no Non-Trusted World
  Key certificate for simplicity.

Change-Id: I62f1e952522d84470acc360cf5ee63e4c4b0b4d9
Signed-off-by: default avatarSandrine Bailleux <sandrine.bailleux@arm.com>
      5ab8b717
  21. 20 Feb, 2020 4 commits
    • Varun Wadekar's avatar
      Tegra: delay_timer: support for physical secure timer · dd4f0885
      Varun Wadekar authored 
      

This patch modifies the delay timer driver to switch to the ARM
secure physical timer instead of using Tegra's on-chip uS timer.

The secure timer is not accessible to the NS world and so eliminates
an important attack vector, where the Tegra timer source gets switched
off from the NS world leading to a DoS attack for the trusted world.

This timer is shared with the S-EL1 layer for now, but later patches
will mark it as exclusive to the EL3 exception mode.

Change-Id: I2c00f8cb4c48b25578971c626c314603906ad7cc
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      dd4f0885
    • Varun Wadekar's avatar
      include: move MHZ_TICKS_PER_SEC to utils_def.h · d4b29105
      Varun Wadekar authored 
      

This patch moves the MHZ_TICKS_PER_SEC macro to utils_def.h
for other platforms to use.
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
Change-Id: I6c4dc733f548d73cfdb3515ec9ad89a9efaf4407
      d4b29105
    • Varun Wadekar's avatar
      cpus: higher performance non-cacheable load forwarding · cd0ea184
      Varun Wadekar authored 
      

The CPUACTLR_EL1 register on Cortex-A57 CPUs supports a bit to enable
non-cacheable streaming enhancement. Platforms can set this bit only
if their memory system meets the requirement that cache line fill
requests from the Cortex-A57 processor are atomic.

This patch adds support to enable higher performance non-cacheable load
forwarding for such platforms. Platforms must enable this support by
setting the 'A57_ENABLE_NONCACHEABLE_LOAD_FWD' flag from their
makefiles. This flag is disabled by default.

Change-Id: Ib27e55dd68d11a50962c0bbc5b89072208b4bac5
Signed-off-by: default avatarVarun Wadekar <vwadekar@nvidia.com>
      cd0ea184
    • Manish V Badarkhe's avatar
      Use consistent SMCCC error code · af10d224
      Manish V Badarkhe authored 
      

Removed duplicate error code present for SMCCC and used
proper error code for "SMCCC_ARCH_WORKAROUND_2" call.
Signed-off-by: default avatarManish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I76fc7c88095f78a7e2c3d205838f8eaf3132ed5c
      af10d224
  23. 19 Feb, 2020 3 commits
  25. 18 Feb, 2020 3 commits
  27. 10 Feb, 2020 1 commit
    • Achin Gupta's avatar
      SPMD: add SPM dispatcher based upon SPCI Beta 0 spec · bdd2596d
      Achin Gupta authored 
      

This patch adds a rudimentary SPM dispatcher component in EL3.
It does the following:

- Consumes the TOS_FW_CONFIG to determine properties of the SPM core
  component
- Initialises the SPM core component which resides in the BL32 image
- Implements a handler for SPCI calls from either security state. Some
  basic validation is done for each call but in most cases it is simply
  forwarded as-is to the "other" security state.
Signed-off-by: default avatarAchin Gupta <achin.gupta@arm.com>
Signed-off-by: default avatarArtsem Artsemenka <artsem.artsemenka@arm.com>
Change-Id: I7d116814557f7255f4f4ebb797d1619d4fbab590
      bdd2596d