When a platform decides to use FEAT_RNG_TRAP, every RNDR or RNDRSS read
will trap into EL3. The platform can then emulate those instructions, by
either executing the real CPU instructions, potentially conditioning the
results, or use rate-limiting or filtering to protect the hardware
entropy pool. Another possiblitiy would be to use some platform specific
TRNG device to get entropy and returning this.
To demonstrate platform specific usage, add a demo implementation for the
FVP: It will execute the actual CPU instruction and just return the
result. This should serve as reference code to implement platform specific
policies.
We change the definition of read_rndr() and read_rndrrs() to use the
alternative sysreg encoding, so that all assemblers can handle that.
Add documentation about the new platform specific RNG handler function.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Change-Id: Ibce817b3b06ad20129d15531b81402e3cc3e9a9e
At the moment we only handle SMC traps from lower ELs, but ignore any
other synchronous traps and just panic.
To cope with system register traps, which we might need to emulate,
introduce a C function to handle those traps, and wire that up in the
exception handler to be called.
We provide a dispatcher function (in C), that will call platform
specific implementation for certain (classes of) system registers.
For now this is empty.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Change-Id: If147bcb49472eb02791498700300926afbcf75ff
Moving ARM_ROTPK_S to default to arm_dev_rotpk.S as it was not being
set for Juno cryptocell and this should be the value in most cases.
Change-Id: I56a5a4e61f1ca728b87322b0b09a0d73ed1d5ee0
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
This patch adds Delegated Attestation and Measured Boot tests to the
plat/arm/board/tc platform.
The test suite can be activated by adding the build time option
`PLATFORM_TEST=1` to the make command. In this case the boot sequence is
not finished, plat_error_handler is called after the tests are run
(regardless of the test result.)
The actual test code is coming from the Trusted-Firmware-M project. Some
of the files of the tf-m-tests and tf-m-extras repo are linked to the
BL31 image.
Versions used for testing:
https://git.trustedfirmware.org/TF-M/tf-m-tests
614e8c358377e4146e8ee13d1246e59d01b4bf1b
https: //git.trustedfirmware.org/TF-M/tf-m-extras
3be9fdd557e6df449de93c2101973fb011699b3d
Change-Id: I98f0f5f760a39d2d7e0dd11d33663ddb75f0b6fc
Signed-off-by: Mate Toth-Pal <mate.toth-pal@arm.com>
OEN Number 48 to 63 is for Trusted App and OS.
GET_SMC_OEN limits the return value of OEN number to 63 by bitwise AND
operation with 0x3F. Thus the upper limit check for OEN value returned
by GET_SMC_OEN is not required.
Removing the upper limit check for the OEN value returned by GET_SMC_OEN
resolves integer handling issue CONSTANT_EXPRESSION_RESULT
Signed-off-by: Akshay Belsare <akshay.belsare@amd.com>
Change-Id: Ie04a4e2fb7cc85ec6055a5662736a805a89f7085
* changes:
docs(build): describes the SPMC_OPTEE build option
feat(qemu): support el3 spmc
feat(el3-spmc): make platform logical partition optional
feat(qemu): support s-el2 spmc
feat(qemu): update abi between spmd and spmc
fix(sptool): add dependency to SP image
Add 2 more mailbox error return status for FCS_DECRYPTION when sending
mailbox command to SDM
Signed-off-by: Sieu Mun Tang <sieu.mun.tang@intel.com>
Change-Id: Ifff4faa397232cc0080f9fca6f6948ac305915c4
Clear Ncore CCU snoop filter. There is hardware bug in NCORE CCU IP
and it is causing an issue in the coherent directory tracking of
outstanding cache lines.
Signed-off-by: Jit Loon Lim <jit.loon.lim@intel.com>
Change-Id: I9ee67c94e6379d318516ae8f660a62323ce8d563
Explains that the SPMC_OPTEE build option is used to load the SPMC at
S-EL1 using an OP-TEE specific mechanism.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Change-Id: I71757d2d9ac98caf0ac6d8e64b221adaa0f70846
SCR_EL3.EA is set to 1 in BL31 initialization and is cleared before
entering to lower ELs(except for RAS FFH case "HANDLE_EA_EL3_FIRST_NS").
The cleared value persist even during run time when execution comes
back to EL3.
When SCR_EL3.EA is 0 and execution state is EL3, Async EAs(delivered
as SErrors) are implicitly masked and hence any Async EA by EL3 will
remain pending and will trap at the exception level EA is targeted
to and unmasked when entering lower EL.
This causes unexpected EA at lower EL. This is a very rare
to get SError in EL3 until unless there is any programming error.
This patch sets SCR_EL3.EA to 1 when entering EL3 from lower EL.
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ibb593369edb034f670fd85ee79adc9829b900a83
scr_el3 registers cannot be modified in lower ELs which means it retains
the same value which is stored in the EL3 cpu context structure for the
given world. So, we should not save the register when entering to EL3
from lower EL as we have the copy of it present in cpu context.
During EL3 execution SCR_EL3 value can be modifed for following cases
1. Changes which is required for EL3 execution, this change is temp
and do not need to be saved.
2. Changes which affects lower EL execution, these changes need to be
written to cpu context as well and will be retrieved when scr_el3
is restored as part of exiting EL3
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I9cc984ddf50e27d09e361bd83b1b3c9f068cf2fd
* changes:
feat(imx8mq): add BL31 PIE support
refactor(imx8mq): introduce BL31_SIZE
refactor(imx8mq): make use of setup_page_tables()
feat(imx8mq): always set up console
feat(imx8mq): remove empty bl31_plat_runtime_setup
feat(imx8mq): make IMX_BOOT_UART_BASE configurable via build parameter
Enable PIE support so the BL31 firmware can be loaded from anywhere
within the OCRAM (SRAM). For the PIE support we only need to replace
the BL31_BASE define by the BL31_START symbol which is a relocatable
and we need to enable it by setting ENABLE_PIE := 1.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Change-Id: Ie6a13e4ae0fdc6627a94798d7a86df7d5b310896
No functional change.
Introduce BL31_SIZE define and calculate the limits based on the
BL31_BASE and the BL31_SIZE define. Also make use of SZ_64K to make
it easier to read. This is required for later BL31 PIE support since
it drops the calculation based on the BL31_LIMIT and BL31_BASE.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Change-Id: I517074b866b5bf11841b51777f87c926b304488d
Improve code readability and align with other i.MX8M* platforms.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Change-Id: Ifd29b74872e3a567288d208de4827403078164e9
This aligns the i.MX8MQ platform behaviour with the other i.MX8M*
platforms by always setting up the console UART.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Change-Id: I1279d9cb4feb6e789422b9844cab711b8daae74e
Having this empty definition is actively harmful, as it prevents the
default weak function to be used, which does a switch of the console
state.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Change-Id: I3b78e0c524c4907714036dba573a44d8f9c48b09
This aligns the i.MX8MQ build with the other i.MX8M platforms by
allowing to override the default IMX_BOOT_UART_BASE value via a make
parameter.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Change-Id: Iad9b844517209fc7d051c61767f71ac9fa2b55c7
with reference to feature 04c730 (feat(cpus): make cache ops conditional),
booting with caches in debug recovery means SCTLR_C_BIT will be 0.
Wrap the assert for the d-cache enabled check in CONDITIONAL_CMO and
plat_can_cmo calls to allow booting with d-cache disabled.
Signed-off-by: Channagoud kadabi <kadabi@google.com>
Change-Id: I80153df493d1ec9e5e354c7c2e6a14322d22c446
If compiling with STM32MP13 with DECRYPTION_SUPPORT != none, there is
a compilation error:
plat/st/common/stm32mp_crypto_lib.c:
In function 'plat_get_enc_key_info':
plat/st/common/stm32mp_crypto_lib.c:532:25:
error: implicit declaration of function 'zeromem'
[-Werror=implicit-function-declaration]
532 | zeromem(key, *key_len);
| ^~~~~~~
Adding #include <lib/utils.h> solves the error.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I0a20c5632f0379612149333e69875369d4cfca15
There is no reason to use macros from trusty spd header and creating
dependency on it. Use directly macros from lib/smccc.h
Co-developed-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Akshay Belsare <akshay.belsare@amd.com>
Change-Id: I7cf1f76a5358ffc297c914f41c437469f5a42411
Updating documentation to reflect the new ARM_ROTPK_LOCATION variant of
the full ROTPK, as opposed to the hash of it.
Change-Id: I0f83c519bd607ef1270c7d30ee9bc55451ce4ae2
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Add support for ARM_ROTPK_LOCATION=devel_full_dev_rsa_key, which
implements the scenario where the platform provides the full ROTPK, as
opposed to the hash of it. This returns a 2kB development RSA key
embedded into the firmware.
The motivation for this patch is to extend our test coverage in the CI.
Right now, the authentication framework allows platforms to return
either the full ROTPK or a hash of it (*). However, the FVP platform
only supports returning a hash currently so we cannot easily exercise
the full key scenario. This patch adds that capability.
(*) Or even no key at all if it's not deployed on the platform yet, as
is typically the case on pre-production/developement platforms.
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Ie869cca1082410e63894e2b7dea2d31155684105
* changes:
fix(st-clock): avoid arithmetics on pointers
fix(st-clock): give the size for parent_mp13 and dividers_mp13 tables
fix(st-clock): remove useless switch
fix(st-clock): use Boolean type for tests
fix(st-regulator): use Boolean type for tests
fix(st-regulator): enclose macro parameters in parentheses
fix(st-regulator): rework for_each_*rdev macros
fix(st-regulator): explicitly check operators precedence
fix(st-pmic): define pmic_regs table size
fix(st-pmic): enclose macro parameter in parentheses
* changes:
fix(stm32mp1): rework DWL buffer cache invalidation
fix(stm32mp1): add const for strings in stm32mp_get_soc_name()
fix(st): use Boolean type for tests
fix(st): rework secure-status check in fdt_get_status()
fix(st): use indices when counting GPIOs in DT
fix(st): add U suffix for unsigned numbers
fix(st): explicitly check operators precedence
This patch fixes compilation error for gpt_init_l0_tables()
function in lib/gpt_rme/gpt_rme.c reported by GCC 13.0.0:
"gpt_rme/gpt_rme.c:765:5: error: conflicting types for
'gpt_init_l0_tables' due to enum/integer mismatch;
have 'int(unsigned int, uintptr_t, size_t)'
{aka 'int(unsigned int, long unsigned int, long unsigned int)'}"
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>
Change-Id: I38f28be290337e7d37d59b52cad7bde5b96b8d51
Introduce additional defines needed when compiling the QEMU platform
with SPMC at EL3.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Change-Id: If6dbe41fa8761637e39579a1f6818dabc769c139
Prior to this commit a logical platform specific partition is added when
compiling with SPMC at EL3. Not all platform need to add a logical
platform so make this optional.
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Change-Id: I3bdd2a91350330c1637e8d84765974bfb6b225d7
Supports S-EL2 SPMC + S-EL1 SP on qemu. S-EL1 SPs packaged in .pkg files
are added to the FIP as blob with an UUID. BL2 parses TB_FW_CONFIG to
know which SP blobs to load into memory.
Co-developed-by: Olivier Deprez <olivier.deprez@arm.com>
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Change-Id: I4b61c4c048f31540d4f1ef9e05f0b12deb341e06
Updates the ABI between SPMD and the SPMC at S-EL1 so that the hard
coded SPMC manifest can be replaced by a proper manifest via TOS FW
Config. TOS FW Config is provided via QEMU_TOS_FW_CONFIG_DTS as a DTS
file when building. The DTS is turned into a DTB which is added to the
FIP.
Note that this is an incompatible change and requires corresponding
change in OP-TEE ("core: sel1 spmc: boot abi update").
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Change-Id: Ibabe78ef50a24f775492854ce5ac54e4d471e369
