From e6d2aea159f4b88fc128ae62432c8fff4b0c2e5f Mon Sep 17 00:00:00 2001 From: dp-arm Date: Tue, 28 Feb 2017 14:43:15 +0000 Subject: [PATCH] Juno: Initialize stack protector canary from the trusted entropy source Change-Id: I7f3e4bfd46613c6311ba4015d56705414fd6feab Signed-off-by: dp-arm --- plat/arm/board/juno/juno_def.h | 1 + plat/arm/board/juno/juno_stack_protector.c | 55 ++++++++++++++++++++++ plat/arm/board/juno/platform.mk | 6 ++- 3 files changed, 61 insertions(+), 1 deletion(-) create mode 100644 plat/arm/board/juno/juno_stack_protector.c diff --git a/plat/arm/board/juno/juno_def.h b/plat/arm/board/juno/juno_def.h index d7e2ac6b9..a8e9872b4 100644 --- a/plat/arm/board/juno/juno_def.h +++ b/plat/arm/board/juno/juno_def.h @@ -83,6 +83,7 @@ #define TRNG_INTMASK 0x14 #define TRNG_CONFIG 0x18 #define TRNG_CONTROL 0x1C +#define TRNG_NBYTES 16 /* Number of bytes generated per round. */ /******************************************************************************* * MMU-401 related constants diff --git a/plat/arm/board/juno/juno_stack_protector.c b/plat/arm/board/juno/juno_stack_protector.c new file mode 100644 index 000000000..720a522e1 --- /dev/null +++ b/plat/arm/board/juno/juno_stack_protector.c @@ -0,0 +1,55 @@ +/* + * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * Redistributions of source code must retain the above copyright notice, this + * list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of ARM nor the names of its contributors may be used + * to endorse or promote products derived from this software without specific + * prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include +#include +#include +#include "juno_decl.h" +#include "juno_def.h" + +u_register_t plat_get_stack_protector_canary(void) +{ + u_register_t c[TRNG_NBYTES / sizeof(u_register_t)]; + u_register_t ret = 0; + size_t i; + + if (juno_getentropy(c, sizeof(c)) != 0) { + ERROR("Not enough entropy to initialize canary value\n"); + panic(); + } + + /* + * On Juno we get 128-bits of entropy in one round. + * Fuse the values together to form the canary. + */ + for (i = 0; i < ARRAY_SIZE(c); i++) + ret ^= c[i]; + return ret; +} diff --git a/plat/arm/board/juno/platform.mk b/plat/arm/board/juno/platform.mk index 924a40218..161443b45 100644 --- a/plat/arm/board/juno/platform.mk +++ b/plat/arm/board/juno/platform.mk @@ -42,6 +42,9 @@ JUNO_SECURITY_SOURCES := drivers/arm/tzc/tzc400.c \ plat/arm/board/juno/juno_trng.c \ plat/arm/common/arm_tzc400.c +ifneq (${ENABLE_STACK_PROTECTOR}, 0) +JUNO_SECURITY_SOURCES += plat/arm/board/juno/juno_stack_protector.c +endif PLAT_INCLUDES := -Iplat/arm/board/juno/include @@ -52,7 +55,8 @@ BL1_SOURCES += lib/cpus/aarch64/cortex_a53.S \ lib/cpus/aarch64/cortex_a72.S \ plat/arm/board/juno/juno_bl1_setup.c \ plat/arm/board/juno/juno_err.c \ - ${JUNO_INTERCONNECT_SOURCES} + ${JUNO_INTERCONNECT_SOURCES} \ + ${JUNO_SECURITY_SOURCES} BL2_SOURCES += plat/arm/board/juno/juno_err.c \ ${JUNO_SECURITY_SOURCES}