Skip to content

GitLab

Switch branch/tag
  1. 09 Feb, 2021 2 commits
    • Manish V Badarkhe's avatar
      plat/arm: fvp: Protect GICR frames for fused/unused cores · f98630fb
      Manish V Badarkhe authored 
      

Currently, BLs are mapping the GIC memory region as read-write
for all cores on boot-up.

This opens up the security hole where the active core can write
the GICR frame of fused/inactive core. To avoid this issue, disable
the GICR frame of all inactive cores as below:

1. After primary CPU boots up, map GICR region of all cores as
   read-only.
2. After primary CPU boots up, map its GICR region as read-write
   and initialize its redistributor interface.
3. After secondary CPU boots up, map its GICR region as read-write
   and initialize its redistributor interface.
4. All unused/fused core's redistributor regions remain read-only and
   write attempt to such protected regions results in an exception.

As mentioned above, this patch offers only the GICR memory-mapped
region protection considering there is no facility at the GIC IP
level to avoid writing the redistributor area.

These changes are currently done in BL31 of Arm FVP and guarded under
the flag 'FVP_GICR_REGION_PROTECTION'.

As of now, this patch is tested manually as below:
1. Disable the FVP cores (core 1, 2, 3) with core 0 as an active core.
2. Verify data abort triggered by manually updating the ‘GICR_CTLR’
   register of core 1’s(fused) redistributor from core 0(active).

Change-Id: I86c99c7b41bae137b2011cf2ac17fad0a26e776d
Signed-off-by: default avatarManish V Badarkhe <Manish.Badarkhe@arm.com>
      f98630fb
    • Manish V Badarkhe's avatar
      plat/arm: fvp: Do not map GIC region in BL1 and BL2 · e0cea783
      Manish V Badarkhe authored 
      

GIC memory region is not getting used in BL1 and BL2.
Hence avoid its mapping in BL1 and BL2 that freed some
page table entries to map other memory regions in the
future.

Retains mapping of CCN interconnect region in BL1 and BL2
overlapped with the GIC memory region.

Change-Id: I880dd0690f94b140e59e4ff0c0d436961b9cb0a7
Signed-off-by: default avatarManish V Badarkhe <Manish.Badarkhe@arm.com>
      e0cea783
  3. 08 Dec, 2020 4 commits
  5. 30 Nov, 2020 1 commit
  7. 21 Oct, 2020 1 commit
  9. 20 Oct, 2020 1 commit
  11. 09 Oct, 2020 1 commit
    • Jimmy Brisson's avatar
      Don't return error information from console_flush · 831b0e98
      Jimmy Brisson authored 
      

And from crash_console_flush.

We ignore the error information return by console_flush in _every_
place where we call it, and casting the return type to void does not
work around the MISRA violation that this causes. Instead, we collect
the error information from the driver (to avoid changing that API), and
don't return it to the caller.

Change-Id: I1e35afe01764d5c8f0efd04f8949d333ffb688c1
Signed-off-by: default avatarJimmy Brisson <jimmy.brisson@arm.com>
      831b0e98
  13. 05 Oct, 2020 2 commits
  15. 15 Sep, 2020 2 commits
  17. 10 Sep, 2020 1 commit
  19. 02 Sep, 2020 1 commit
  21. 28 Aug, 2020 1 commit
  23. 20 Aug, 2020 1 commit
  25. 19 Aug, 2020 1 commit
  27. 18 Aug, 2020 1 commit
  29. 17 Aug, 2020 1 commit
  31. 14 Aug, 2020 2 commits
  33. 31 Jul, 2020 1 commit
  35. 30 Jul, 2020 1 commit
  37. 22 Jul, 2020 1 commit
    • Alexei Fedorov's avatar
      plat/arm/board/fvp: Add support for Measured Boot · 4a135bc3
      Alexei Fedorov authored 
      

This patch adds support for Measured Boot functionality
to FVP platform code. It also defines new properties
in 'tpm_event_log' node to store Event Log address and
it size
'tpm_event_log_sm_addr'
'tpm_event_log_addr'
'tpm_event_log_size'
in 'event_log.dtsi' included in 'fvp_tsp_fw_config.dts'
and 'fvp_nt_fw_config.dts'. The node and its properties
are described in binding document
'docs\components\measured_boot\event_log.rst'.

Change-Id: I087e1423afcb269d6cfe79c1af9c348931991292
Signed-off-by: default avatarAlexei Fedorov <Alexei.Fedorov@arm.com>
      4a135bc3
  39. 20 Jul, 2020 1 commit
    • Alexei Fedorov's avatar
      TF-A GICv2 driver: Introduce makefile · 1322dc94
      Alexei Fedorov authored 
      

This patch moves all GICv2 driver files into new added
'gicv2.mk' makefile for the benefit of the generic driver
which can evolve in the future without affecting platforms.

NOTE: Usage of 'drivers/arm/gic/common/gic_common.c' file
is now deprecated and platforms with GICv2 driver need to
be modified to include 'drivers/arm/gic/v2/gicv2.mk' in
their makefiles.

Change-Id: Ib10e71bdda0e5c7e80a049ddce2de1dd839602d1
Signed-off-by: default avatarAlexei Fedorov <Alexei.Fedorov@arm.com>
      1322dc94
  41. 10 Jul, 2020 2 commits
    • Manish V Badarkhe's avatar
      plat/arm: Fix build failure due to increase in BL2 size · fdf50a25
      Manish V Badarkhe authored 
      

BL2 size gets increased due to the libfdt library update and 
that eventually cause no-optimization build failure for BL2 as below:
aarch64-none-elf-ld.bfd: BL2 image has exceeded its limit.
aarch64-none-elf-ld.bfd: region `RAM' overflowed by 4096 bytes
Makefile:1070: recipe for target 'build/fvp/debug/bl2/bl2.elf' failed
make: *** [build/fvp/debug/bl2/bl2.elf] Error 1

Fixed build failure by increasing BL2 image size limit by 4Kb.
Signed-off-by: default avatarManish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I92a57eb4db601561a98e254b64994bb921a88db3
      fdf50a25
    • Manish V Badarkhe's avatar
      plat/arm, dts: Update platform device tree for CoT · 2a0ef943
      Manish V Badarkhe authored 
      

Included cot_descriptors.dtsi in platform device tree
(fvp_tb_fw_config.dts).

Also, updated the maximum size of tb_fw_config to 0x1800
in order to accomodate the device tree for CoT descriptors.

Follow up patch will parse the device tree for these CoT descriptors
and fill the CoT descriptor structures at runtime instead of using
static CoT descriptor structures in the code base.
Signed-off-by: default avatarManish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I90122bc713f6842b82fb019b04caf42629b4f45a
      2a0ef943
  43. 26 Jun, 2020 1 commit
  45. 25 Jun, 2020 1 commit
    • Manish V Badarkhe's avatar
      plat/arm: Increase size of firmware configuration area · ce4ca1a8
      Manish V Badarkhe authored 
      

Increased the size of firmware configuration area to accommodate
all configs.

Updated maximum size of following bootloaders due to increase
in firmware configs size and addition of the code in the BL2.

1. Increased maximum size of BL2 for Juno platform in no
   optimisation case.
2. Reduced maximum size of BL31 for fvp and Juno platform.
3. Reduced maximum size of BL32 for Juno platform.

Change-Id: Ifba0564df0d1fe86175bed9fae87fdcf013b1831
Signed-off-by: default avatarManish V Badarkhe <Manish.Badarkhe@arm.com>
      ce4ca1a8
  47. 24 Jun, 2020 3 commits
  49. 09 Jun, 2020 3 commits
    • Madhukar Pappireddy's avatar
      plat/fvp: Add support for dynamic description of secure interrupts · 452d5e5e
      Madhukar Pappireddy authored 
      

Using the fconf framework, the Group 0 and Group 1 secure interrupt
descriptors are moved to device tree and retrieved in runtime. This
feature is enabled by the build flag SEC_INT_DESC_IN_FCONF.

Change-Id: I360c63a83286c7ecc2426cd1ff1b4746d61e633c
Signed-off-by: default avatarMadhukar Pappireddy <madhukar.pappireddy@arm.com>
      452d5e5e
    • Andre Przywara's avatar
      GICv3: GIC-600: Detect GIC-600 at runtime · b4ad365a
      Andre Przywara authored 
      

The only difference between GIC-500 and GIC-600 relevant to TF-A is the
differing power management sequence.
A certain GIC implementation is detectable at runtime, for instance by
checking the IIDR register. Let's add that test before initiating the
GIC-600 specific sequence, so the code can be used on both GIC-600 and
GIC-500 chips alike, without deciding on a GIC chip at compile time.

This means that the GIC-500 "driver" is now redundant. To allow minimal
platform support, add a switch to disable GIC-600 support.

Change-Id: I17ea97d9fb05874772ebaa13e6678b4ba3415557
Signed-off-by: default avatarAndre Przywara <andre.przywara@arm.com>
      b4ad365a
    • Manish Pandey's avatar
      dualroot: add chain of trust for secure partitions · 44f1aa8e
      Manish Pandey authored 
      

A new certificate "sip-sp-cert" has been added for Silicon Provider(SiP)
owned Secure Partitions(SP). A similar support for Platform owned SP can
be added in future. The certificate is also protected against anti-
rollback using the trusted Non-Volatile counter.

To avoid deviating from TBBR spec, support for SP CoT is only provided
in dualroot.
Secure Partition content certificate is assigned image ID 31 and SP
images follows after it.

The CoT for secure partition look like below.
+------------------+       +-------------------+
| ROTPK/ROTPK Hash |------>| Trusted Key       |
+------------------+       | Certificate       |
                           | (Auth Image)      |
                          /+-------------------+
                         /                   |
                        /                    |
                       /                     |
                      /                      |
                     L                       v
+------------------+       +-------------------+
| Trusted World    |------>| SiP owned SPs     |
| Public Key       |       | Content Cert      |
+------------------+       | (Auth Image)      |
                        /   +-------------------+
                       /                      |
                      /                      v|
+------------------+ L     +-------------------+
| SP_PKG1 Hash     |------>| SP_PKG1           |
|                  |       | (Data Image)      |
+------------------+       +-------------------+
        .                           .
        .                           .
        .                           .
+------------------+       +-------------------+
| SP_PKG8 Hash     |------>| SP_PKG8           |
|                  |       | (Data Image)      |
+------------------+       +-------------------+
Signed-off-by: default avatarManish Pandey <manish.pandey2@arm.com>
Change-Id: Ia31546bac1327a3e0b5d37e8b99c808442d5e53f
      44f1aa8e
  51. 08 Jun, 2020 1 commit
    • Manish Pandey's avatar
      plat/arm: do not include export header directly · 81de5bf7
      Manish Pandey authored 
      

As per "include/export/README", TF-A code should never include export
headers directly. Instead, it should include a wrapper header that
ensures the export header is included in the right manner.

"tbbr_img_def_exp.h" is directly included in TF-A code, this patch
replaces it with its  wrapper header "tbbr_img_def.h".
Signed-off-by: default avatarManish Pandey <manish.pandey2@arm.com>
Change-Id: I31c1a42e6a7bcac4c396bb17e8548567ecd8147d
      81de5bf7
  53. 01 Jun, 2020 1 commit
  55. 25 May, 2020 1 commit
    • J-Alves's avatar
      SPCI is now called PSA FF-A · 662af36d
      J-Alves authored 
      

SPCI is renamed as PSA FF-A which stands for Platform Security
Architecture Firmware Framework for A class processors.
This patch replaces the occurrence of SPCI with PSA FF-A(in documents)
or simply FFA(in code).

Change-Id: I4ab10adb9ffeef1ff784641dfafd99f515133760
Signed-off-by: default avatarJ-Alves <joao.alves@arm.com>
      662af36d