Reword the description of threat #9 to make it more future-proof for
Arm CCA. By avoiding specific references to secure or non-secure
contexts, in favour of "worlds" and "security contexts", we make the
description equally applicable to 2-world and 4-world architectures.
Note that there are other threats that would benefit from such a
similar revamp but this is out of scope of this patch.
Also list malicious secure world code as a potential threat
agent. This seems to be an oversight in the first version of the
threat model (i.e. this change is not related to Arm CCA).
Change-Id: Id8c8424b0a801104c4f3dc70e344ee702d2b259a
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
By nature, experimental features are incomplete pieces of work,
sometimes going under rapid change. Typically, the threat model
implications have not been fully considered yet.
Change-Id: Ice8d4273a789558e912f82cde592da4747b37fdf
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
- Add empty lines after titles.
- Reduce number of highlighting characters to fit title length.
- Remove most ``monospaced text``.
I think most of it looked weird in the rendered HTML version and
it had no obvious meaning.
Change-Id: I5f746a3de035d8ac59eec0af491c187bfe86dad7
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
MISRA Violation: MISRA-C:2012 R.8.3
- Declaration uses a different parameter name than the one present in the
definition.
Signed-off-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@xilinx.com>
Change-Id: Id0521afd7383df13870710b7dd2894e788896e5e
Host tools cert_tool and encrypt_fw refactored to be fully
compatible with OpenSSL v3.0.
Changes were made following the OpenSSL 3.0 migration guide:
https://www.openssl.org/docs/man3.0/man7/migration_guide.html
In some cases, those changes are straightforward and only
a small modification on the types or API calls was needed
(e.g.: replacing BN_pseudo_rand() with BN_rand(). Both identical
since v1.1.0).
The use of low level APIs is now deprecated. In some cases,
the new API provides a simplified solution for our goals and
therefore the code was simplified accordingly (e.g.: generating
RSA keys through EVP_RSA_gen() without the need of handling the
exponent). However, in some cases, a more
sophisticated approach was necessary, as the use of a context
object was required (e.g.: when retrieving the digest value from
an SHA file).
Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: I978e8578fe7ab3e71307450ebe7e7812fbcaedb6
MISRA Violation: MISRA-C:2012 R.8.4
- Function definition does not have a visible prototype.
Signed-off-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@xilinx.com>
Change-Id: I50a2c1adf2e099217770ac665f135302f990b162
* changes:
feat(spmd): allow forwarding of FFA_FRAG_RX/TX calls
feat(spmc): add support for FFA_SPM_ID_GET
feat(spmc): add support for forwarding a secure interrupt to the SP
feat(spmc): add support for FF-A power mgmt. messages in the EL3 SPMC
Enable the SPMD to forward FFA_FRAG_RX/TX calls between
the normal world and the SPMC.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I097a48552827a8527dd3efe1155bc601d7cbf887
Enable a Secure Partition to query the ID assigned to the SPMC.
The SPMD will take care of any calls from the normal world
therefore we should not need to handle this case in the SPMC.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I97903e920e928df385addbb2d383f24e602bf2db
This patch adds support for forwarding a secure interrupt that
preempts the normal world to a SP for top-half interrupt handling.
Signed-off-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: Iaa6e96f4cf8922ba5b6d128a19359df15e44158d
Add TF-A implementation defined behaviour to provide the linear core
ID in the x4 register when bringing up an SP.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I6cb215841097b264d252ec0262b0b7272be99d41
This patch adds support for forwarding the following PSCI messages
received by the SPMC at EL3 to the S-EL1 SP if the SP has indicated
that it wishes to receive the appropriate message via its manifest.
1. A PSCI CPU_OFF message in response to a cpu hot unplug request
from the OS.
2. A message to indicate warm boot of a cpu in response to a cpu
hot plug request from the OS.
3. A PSCI CPU_SUSPEND message in response to a cpu idle event
initiated from the OS.
4. A message to indicate warm boot of a cpu from a shallow power
state in response to a cpu resume power event.
This patch also implements the FFA_SECONDARY_EP_REGISTER function to
enable the SP specify its secondary entrypoint.
Signed-off-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I375d0655b2c6fc27445facc39213d1d0678557f4
Enable a partition to release its RX buffer and the SPMC
to update the appropriate state tracking.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I5fb6d92244b5ed5f032269b29b102aa874bf3ae3
Enable the SPMC to handle the FFA_RUN ABI and update
the state tracking accordingly.
Change-Id: I3e8a3fa3ec9b03830055d2fbd6124b8ff1ed4103
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Allow for a partition to retrieve its own partition ID.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I1a19ac30b86736d818673c239b2f8fd2d6128c06
Enable the spmc to report the features that it currently supports.
Populated with the currently implemented functionality.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I00e51ded284efd87cd50a0e9416dbc33f22ced85
Enable the SPMC to handle calls to FFA_PARTITION_INFO_GET.
This allows the normal world to discover which partitions
are running in the secure world including logical partitions
in EL3.
This implementation supports both the v1.0 and v1.1
implementations of the Partition Info Get Descriptor.
The SPMC populates the appropriate descriptor in the
partitions RX buffer, if requested, according to the
version of FF-A that the caller is using.
Additionally rename the common/uuid UUID_H include guard
due to a conflict with another header file.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: I0a85f1dae50fae1fe47a3cafb765fbe9f40619e1
Enable handling of FFA_RXTX_MAP and FFA_RXTX_UNMAP ABIs
and ensure these buffers are mapped as required to allow
access by the SPMC.
Signed-off-by: Marc Bonnici <marc.bonnici@arm.com>
Change-Id: Ifc425f1ee16c90d1d95b6ae4ac9992d6f785227b
Adding Sandrine Bailleux for the PSA APIs and myself for the
MHU and RSS comms drivers as code owner.
Change-Id: Ib948479cc6e46163aae59c938877a2d0bcf91754
Signed-off-by: David Vincze <david.vincze@arm.com>
This patch is to fix configuration status command now returns
the result based on the last config start command made to the
runtime software. The status type can be either:
- NO_REQUEST (default)
- RECONFIGURATION
- BITSTREAM_AUTH
Signed-off-by: Sieu Mun Tang <sieu.mun.tang@intel.com>
Change-Id: I1ce4b7b4c741d88de88778f8fbed7dfe83a39fbc
This patch is to align the sequence of function in header file.
Signed-off-by: Sieu Mun Tang <sieu.mun.tang@intel.com>
Change-Id: I9658aef78b06b744c6c14f95b2821daf5dbb0082
This patch is to remove redundant NOC declarations in
system manager header file. The NOC headers are shareable
across both Stratix 10 and Agilex platforms.
Signed-off-by: Sieu Mun Tang <sieu.mun.tang@intel.com>
Change-Id: I40ff55eb1d8fe280db1d099d5d1a3c2bf4b4b459
This call is used to register and reset SGI interrupt.
Before this functionality was performed using IOCTL_REGISTER_SGI
pm_ioctl EEMI call. It's not correct use of PM_IOCTL as it is
not EEMI functionality. Instead this new SMCCC call will be
handled by TF-A specific handler.
Change-Id: If2408af38b889d29a5c584e8eec5f1672eab4fb5
Signed-off-by: Tanmay Shah <tanmay.shah@xilinx.com>
Add "reset" parameter in pm_register_sgi() to reset
SGI number. This will be required if OS wants to reset
SGI number to default state. Caller can reset param to
1 to reset SGI in ATF.
Change-Id: If485ff275df884f74eb67671cac7fa953458afe9
Signed-off-by: Rajan Vaja <rajan.vaja@xilinx.com>
Signed-off-by: Tanmay Shah <tanmay.shah@xilinx.com>
This patch adds support to load nt_fw_config with the information from
plat_info sds structure which is then passed from BL2 to BL33.
Signed-off-by: sahil <sahil@arm.com>
Change-Id: I2fcf13b7bf5ab042ef830157fd9cceedbdca617a
* changes:
fix(intel): add flash dcache after return response for INTEL_SIP_SMC_MBOX_SEND_CMD
fix(intel): extending to support large file size for SHA2/HMAC get digest and verifying
fix(intel): extending to support large file size for SHA-2 ECDSA data signing and signature verifying
fix(intel): extending to support large file size for AES encryption and decryption
feat(intel): support version 2 SiP SVC SMC function ID for mailbox commands
feat(intel): support version 2 SiP SVC SMC function ID for non-mailbox commands
fix(intel): update certificate mask for FPGA Attestation
feat(intel): update to support maximum response data size
feat(intel): support ECDSA HASH Verification
feat(intel): support ECDSA HASH Signing
feat(intel): support ECDH request
feat(intel): support ECDSA SHA-2 Data Signature Verification
feat(intel): support ECDSA SHA-2 Data Signing
feat(intel): support ECDSA Get Public Key
feat(intel): support session based SDOS encrypt and decrypt
feat(intel): support AES Crypt Service
feat(intel): support HMAC SHA-2 MAC verify request
feat(intel): support SHA-2 hash digest generation on a blob
feat(intel): support extended random number generation
feat(intel): support crypto service key operation
feat(intel): support crypto service session
feat(intel): extend attestation service to Agilex family
fix(intel): flush dcache before sending certificate to mailbox
fix(intel): introduce a generic response error code
fix(intel): allow non-secure access to FPGA Crypto Services (FCS)
feat(intel): single certificate feature enablement
feat(intel): initial commit for attestation service
fix(intel): update encryption and decryption command logic
When RECLAIM_INIT_CODE is enabled, functions with __init attribute can
be reclaimed after boot and marked as Execute Never.
Because of a bug in linker script the functions starting with "init"
were also marked XN and causing instruction abort.
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I2221973c05af170acf4e723cd44645b9ff9d58d2
Implements the loop workaround for Cortex Makalu/Makalu-ELP/Hunter
and Neoverse Demeter/Poseidon.
Signed-off-by: Bipin Ravi <bipin.ravi@arm.com>
Change-Id: If5f6689b662ecac92491e0c0902df4270051ce5b
DSU-110 erratum 2313941 is a Cat B erratum and applies to revisions
r0p0, r1p0, r2p0, r2p1, r3p0, r3p1 and is still open.
The workaround sets IMP_CLUSTERACTLR_EL1[16:15] bits to 0b11 to disable
clock gating of the SCLK domain. This will increase the idle power
consumption.
This patch applies the fix for Cortex-X2/A510/A710 and Neoverse N2.
SDEN can be found here:
https://developer.arm.com/documentation/SDEN1781796/latest
Signed-off-by: Bipin Ravi <bipin.ravi@arm.com>
Change-Id: I54d948b23e8e01aaf1898ed9fe4e2255dd209318
Signed-off-by: Bipin Ravi <bipin.ravi@arm.com>
This is required to prevent Nwd context corruption during StMM
execution.
Standalone MM uses OpenSSL for secure boot, which uses FP registers for
floating point calculations.
Signed-off-by: Nishant Sharma <nishant.sharma@arm.com>
Change-Id: I6ed11d4fa5d64c3089a24b66fd048a841c480792
Add the support to save Nwd's floating point registers before switching
to SEL0 and then restore it after coming out of it. Emit a warning
message if SPM_MM is built with CTX_INCLUDE_FPREGS == 0
There is no need to save FP registers of SEL0 because secure partitions
run to completion.
This change is used to prevent context corruption if secure partition
enabled and Nwd decide to use floating point registers.
Signed-off-by: Nishant Sharma <nishant.sharma@arm.com>
Change-Id: I1eea16ea2311a4f00a806ea72c118752821b9abb
Enable the RSS backend based measured boot feature.
In the absence of RSS the mocked version of PSA APIs
are used. They always return with success and hard-code data.
Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: I7543e9033a7a21f1b836d911d8d9498c6e09b956
Sandrine Bailleux
Venkatesh Yadav Abbarapu
Madhukar Pappireddy
Juan Pablo Conde
Olivier Deprez
Marc Bonnici
Achin Gupta
Joanna Farley
David Vincze
Sieu Mun Tang
Tanmay Shah
sahil
Manish Pandey
Bipin Ravi
Nishant Sharma
Tamas Ban