Updated following sections to document implementation of the FF-A boot
information protocol:
- Describing secure partitions.
- Secure Partition Packages.
- Passing boot data to the SP.
Also updated description of the manifest field 'gp-register-num'.
Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I5c856437b60cdf05566dd636a01207c9b9f42e61
* changes:
feat(fvp): add plat hook for memory transactions
feat(spmc): enable handling of the NS bit
feat(spmc): add support for v1.1 FF-A memory data structures
feat(spmc/mem): prevent duplicated sharing of memory regions
feat(spmc/mem): support multiple endpoints in memory transactions
feat(spmc): add support for v1.1 FF-A boot protocol
feat(plat/fvp): introduce accessor function to obtain datastore
feat(spmc/mem): add FF-A memory management code
Add call to platform hooks upon successful transmission of a
memory transaction request and as part of a memory reclaim request.
This allows for platform specific functionality to be performed
accordingly.
Note the hooks must be placed in the initial share request and final
reclaim to prevent order dependencies with operations that may take
place in the normal world without visibility of the SPMC.
Add a dummy implementation to the FVP platform.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I0c7441a9fdf953c4db0651512e5e2cdbc6656c79
In FF-A v1.1 the NS bit is used by the SPMC to specify the
security state of a memory region retrieved by a SP.
Enable the SPMC to set the bit for v1.1 callers or v1.0
callers that explicitly request the usage via FFA_FEATURES.
In this implementation the sender of the memory region must
reside in the normal world and the SPMC does not support
changing the security state of memory regions therefore
always set the NS bit if required by the caller.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I215756b28e2382082933ba1dcc7584e7faf4b36b
Add support for the FF-A v1.1 data structures to the EL3 SPMC
and enable the ability to convert between v1.0 and the v1.1
forwards compatible data structures.
The SPMC now uses the v1.1 data structures internally and will
convert descriptors as required depending on the FF-A version
supported by the calling partition.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: Ic14a95ea2e49c989aecf19b927a6b21ac50f863e
Allow the SPMC to reject incoming memory sharing/lending requests
that contain memory regions which overlap with an existing
request.
To enable this functionality the SPMC compares each requested
memory region to those in ongoing memory transactions and rejects
the request if the ranges overlap.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I7588846f272ec2add2a341d9f24836c73a046e2f
Enable FFA_MEM_LEND and FFA_MEM_SHARE transactions to support multiple
borrowers and add the appropriate validation. Since we currently
only support a single S-EL1 partition, this functionality is to
support the use case where a VM shares or lends memory to one or
more VMs in the normal world as part of the same transaction to
the SP.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: Ia12c4357e9d015cb5f9b38e518b7a25b1ea2e30e
* changes:
build(changelog): add new scope for Arm SMMU driver
feat(smmu): add SMMU abort transaction function
docs(build): add build option for DRTM support
build(drtm): add DRTM support build option
* changes:
docs(threat-model): remove some redundant text in threat #08
docs(threat-model): make experimental features out of scope
docs(threat-model): cosmetic changes
A partition can request the use of the FF-A boot protocol via
an entry in its manifest along with the register (0-3)
that should be populated with a pointer to a data structure
containing boot related information. Currently the boot
information consists of an allocated memory region
containing the SP's manifest, allowing it to map and parse
any extra information as required.
This implementation only supports the v1.1 data structures
and will return an error if a v1.0 client requests the usage
of the protocol.
Signed-off-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I67692553a90a7e7d94c64fe275edd247b512efca
In order to provide the EL3 SPMC a sufficient datastore to
record memory descriptors, a accessor function is used.
This allows for the backing memory to be allocated in a
platform defined manner, to accommodate memory constraints
and desired use cases.
Provide an implementation for the Arm FVP platform to
use a default value of 512KB memory allocated in the
TZC RAM section.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I92bc55ba6e04bdad429eb52f0d2960ceda682804
Originally taken from the downstream Trusty SPD [1]
implementation and modified to integrate with
the EL3 SPMC internals.
Add support to the EL3 SPMC for a subset of the FF-A
memory management ABIs:
- FFA_MEM_SHARE
- FFA_MEM_LEND
- FFA_MEM_RETRIEVE_REQ
- FFA_MEM_RETRIEVE_RESP
- FFA_MEM_RELINQUISH
- FFA_MEM_RECLAIM
- FFA_MEM_FRAG_RX
- FFA_MEM_FRAG_TX
This implementation relies on a datastore allocated in
platform specific code in order to store memory descriptors
about ongoing memory transactions. This mechanism
will be implemented in the following commit.
[1] https://android.googlesource.com/trusty/external/trusted-firmware-a/+/refs/heads/master/services/spd/trusty/
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: Ib042f73c8a6e0f0aed00f6762be175cb9dedc042
Add an explicit note that measured boot is out of scope of the threat
model. For example, we have no threat related to the secure
management of measurements, nor do we list its security benefits
(e.g. in terms of repudiation).
This might be a future improvement to the threat model but for now
just acknowledge it is not considered.
Change-Id: I2fb799a2ef0951aa681a755a948bd2b67415d156
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Created a function to abort all pending NS DMA transactions to
engage complete DMA protection. This call will be used by the
subsequent DRTM implementation changes.
Signed-off-by: Manish V Badarkhe <manish.badarkhe@arm.com>
Signed-off-by: Lucian Paul-Trifu <lucian.paultrifu@gmail.com>
Change-Id: I94992b54c570327d6746295073822a9c0ebdc85d
Added DRTM support build option in the makefiles.
This build option will be used by the DRTM implementation
in the subsequent patches.
Signed-off-by: Manish V Badarkhe <manish.badarkhe@arm.com>
Signed-off-by: Lucian Paul-Trifu <lucian.paultrifu@gmail.com>
Change-Id: I15366f86b3ebd6ab2ebcb192753015d547cdddee
When SPMC is present at S-EL2, EL1 context registers don't need to be
initialized for Secure state. This patch makes sure that EL1 context
registers are initialized only for Non-secure state, and when SPMC is
not present at S-EL2
Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I4a60b258c31ce5f6472a243e2687159cc495259b
This change makes use of 32-bit crc for calculating gpt header crc
and compares it with the given value.
Signed-off-by: Rohit Ner <rohitner@google.com>
Change-Id: I49bca7aab2c3884881c4b7d90d31786a895290e6
This change makes the necessary additions to makefile of
platforms using partition driver.
Signed-off-by: Rohit Ner <rohitner@google.com>
Change-Id: I0d524760bf52e1d9b4a103f556231f20146bd78e
This change makes the necessary additions to makefile of
platforms using partition driver.
Signed-off-by: Rohit Ner <rohitner@google.com>
Change-Id: I1290972c7d2626262d4b6d68b99bb8f2c4b6744c
This change makes the necessary additions to makefile of
platforms using partition driver.
Signed-off-by: Rohit Ner <rohitner@google.com>
Change-Id: Ie26d9e5943453ce54ee8c72c6e44170577e3afc0
This change makes the necessary additions to makefile of
platforms using partition driver.
Signed-off-by: Rohit Ner <rohitner@google.com>
Change-Id: I66f6daaa0deac984b0aa5f2a182385410189ba8a
Invalidate the SP holding `smc_ctx_t` prior to enabling the data cache
when handling SMCs from the secure world. Enabling the data cache
without doing so results in dirty data either being evicted into main
memory, or being used directly from bl1. This corrupted data causes
system failure as the SMC handler attempts to use it.
Change-Id: I5b7225a6fdd1fcfe34ee054ca46dffea06b84b7d
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>
stm32mp1 platform build failed with the error [1] in the coverity, to
fix it included assert.h file.
Including bl32/sp_min/sp_min.mk
plat/st/stm32mp1/plat_image_load.c: In function
'plat_get_bl_image_load_info':
plat/st/stm32mp1/plat_image_load.c:30:2: error: implicit declaration of
function 'assert' [-Werror=implicit-function-declaration]
30 | assert(bl33 != NULL);
| ^~~~~~
plat/st/stm32mp1/plat_image_load.c:9:1: note: 'assert' is defined in
header '<assert.h>'; did you forget to '#include <assert.h>'?
8 | #include <plat/common/platform.h>
+++ |+#include <assert.h>
9 |
cc1: all warnings being treated as errors
Signed-off-by: Manish V Badarkhe <manish.badarkhe@arm.com>
Change-Id: I486bd695298798c05008158545668020babb3eca
Update supported models list according to changes for v2.7 release in
ci/tf-a-ci-scripts repository:
* general FVP model update: 5c54251
* CSS model update: 3bd12fb
Signed-off-by: Maksims Svecovs <maksims.svecovs@arm.com>
Change-Id: I38c2ef2991b23873821c7e34ad2900b9ad023c4b
On STM32MP13, OP-TEE will be loaded at the beginning of the secure
memory, and will be responsible for its shared memory.
The memory allocated to OP-TEE is then 32MB, and the shared memory
does no more appear in the STM32MP13 fw-config DT file.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I4e9238ddb4d82079b9ddf8fc8f6916b5b989d263
John Powell is no longer part of the TF-A core team at Arm.
Change-Id: Iaa91474cb2c5c334b9ae6f2376724fad2677e285
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Jimmy Brisson is no longer part of the TF-A core team at Arm.
Change-Id: I2966c513a0c2cda438a05dedd42149d16190cbf6
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
The threat description was repeating the threat title.
Change-Id: I67de2c0aab6e86bf33eb91e7562e075fcb76259b
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Reword the description of threat #9 to make it more future-proof for
Arm CCA. By avoiding specific references to secure or non-secure
contexts, in favour of "worlds" and "security contexts", we make the
description equally applicable to 2-world and 4-world architectures.
Note that there are other threats that would benefit from such a
similar revamp but this is out of scope of this patch.
Also list malicious secure world code as a potential threat
agent. This seems to be an oversight in the first version of the
threat model (i.e. this change is not related to Arm CCA).
Change-Id: Id8c8424b0a801104c4f3dc70e344ee702d2b259a
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
By nature, experimental features are incomplete pieces of work,
sometimes going under rapid change. Typically, the threat model
implications have not been fully considered yet.
Change-Id: Ice8d4273a789558e912f82cde592da4747b37fdf
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
- Add empty lines after titles.
- Reduce number of highlighting characters to fit title length.
- Remove most ``monospaced text``.
I think most of it looked weird in the rendered HTML version and
it had no obvious meaning.
Change-Id: I5f746a3de035d8ac59eec0af491c187bfe86dad7
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
MISRA Violation: MISRA-C:2012 R.8.3
- Declaration uses a different parameter name than the one present in the
definition.
Signed-off-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@xilinx.com>
Change-Id: Id0521afd7383df13870710b7dd2894e788896e5e
J-Alves
Bipin Ravi
Madhukar Pappireddy
Olivier Deprez
Marc Bonnici
Manish Pandey
Sandrine Bailleux
Achin Gupta
Manish V Badarkhe
Lucian Paul-Trifu
Zelalem Aweke
Rohit Ner
dependabot[bot]
Harrison Mutai
Maksims Svecovs
Yann Gautier
Venkatesh Yadav Abbarapu