Perform security setup separately for each ARM platform
authorVikram Kanigiri <vikram.kanigiri@arm.com>
Wed, 10 Feb 2016 14:50:53 +0000 (14:50 +0000)
committerVikram Kanigiri <vikram.kanigiri@arm.com>
Mon, 15 Feb 2016 11:20:54 +0000 (11:20 +0000)
Prior to this patch, it was assumed that on all ARM platforms the bare
minimal security setup required is to program TrustZone protection. This
would always be done by programming the TZC-400 which was assumed to be
present in all ARM platforms. The weak definition of
platform_arm_security_setup() in plat/arm/common/arm_security.c
reflected these assumptions.

In reality, each ARM platform either decides at runtime whether
TrustZone protection needs to be programmed (e.g. FVPs) or performs
some security setup in addition to programming TrustZone protection
(e.g. NIC setup on Juno). As a result, the weak definition of
plat_arm_security_setup() is always overridden.

When a platform needs to program TrustZone protection and implements the
TZC-400 peripheral, it uses the arm_tzc_setup() function to do so. It is
also possible to program TrustZone protection through other peripherals
that include a TrustZone controller e.g. DMC-500. The programmer's
interface is slightly different across these various peripherals.

In order to satisfy the above requirements, this patch makes the
following changes to the way security setup is done on ARM platforms.

1. arm_security.c retains the definition of arm_tzc_setup() and has been
   renamed to arm_tzc400.c. This is to reflect the reliance on the
   TZC-400 peripheral to perform TrustZone programming. The new file is
   not automatically included in all platform ports through
   arm_common.mk. Each platform must include it explicitly in a platform
   specific makefile if needed.

   This approach enables introduction of similar library code to program
   TrustZone protection using a different peripheral. This code would be
   used by the subset of ARM platforms that implement this peripheral.

2. Due to #1 above, existing platforms which implements the TZC-400 have been
   updated to include the necessary files for both BL2, BL2U and BL31
   images.

Change-Id: I513c58f7a19fff2e9e9c3b95721592095bcb2735

plat/arm/board/fvp/platform.mk
plat/arm/board/juno/platform.mk
plat/arm/common/arm_common.mk
plat/arm/common/arm_security.c [deleted file]
plat/arm/common/arm_tzc400.c [new file with mode: 0644]

index ed4c89841dbaee7b0b4aa319cc6c22ab21e11abe..3cd39ce20299def096d33ed58cb8b30a40cf1d93 100644 (file)
@@ -57,6 +57,10 @@ else
 $(error "Incorrect GIC driver chosen on FVP port")
 endif
 
+FVP_SECURITY_SOURCES   :=      drivers/arm/tzc400/tzc400.c             \
+                               plat/arm/board/fvp/fvp_security.c       \
+                               plat/arm/common/arm_tzc400.c
+
 PLAT_INCLUDES          :=      -Iplat/arm/board/fvp/include
 
 
@@ -85,19 +89,19 @@ BL2_SOURCES         +=      drivers/arm/sp804/sp804_delay_timer.c           \
                                plat/arm/board/fvp/fvp_bl2_setup.c              \
                                plat/arm/board/fvp/fvp_err.c                    \
                                plat/arm/board/fvp/fvp_io_storage.c             \
-                               plat/arm/board/fvp/fvp_security.c
+                               ${FVP_SECURITY_SOURCES}
 
 BL2U_SOURCES           +=      plat/arm/board/fvp/fvp_bl2u_setup.c             \
-                               plat/arm/board/fvp/fvp_security.c
+                               ${FVP_SECURITY_SOURCES}
 
 BL31_SOURCES           +=      ${FVP_CPU_LIBS}                                 \
                                plat/arm/board/fvp/fvp_bl31_setup.c             \
                                plat/arm/board/fvp/fvp_pm.c                     \
-                               plat/arm/board/fvp/fvp_security.c               \
                                plat/arm/board/fvp/fvp_topology.c               \
                                plat/arm/board/fvp/aarch64/fvp_helpers.S        \
                                plat/arm/board/fvp/drivers/pwrc/fvp_pwrc.c      \
-                               ${FVP_GIC_SOURCES}
+                               ${FVP_GIC_SOURCES}                              \
+                               ${FVP_SECURITY_SOURCES}
 
 # Disable the PSCI platform compatibility layer
 ENABLE_PLAT_COMPAT     :=      0
index fae30e7e1966f5bc4c5e8986a3d8b9e526663553..77014a159e92ab464f44638261cde9f9934e03fb 100644 (file)
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2015, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2013-2016, ARM Limited and Contributors. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
@@ -34,6 +34,10 @@ JUNO_GIC_SOURCES     :=      drivers/arm/gic/common/gic_common.c     \
                                plat/common/plat_gicv2.c                \
                                plat/arm/common/arm_gicv2.c
 
+JUNO_SECURITY_SOURCES  :=      drivers/arm/tzc400/tzc400.c             \
+                               plat/arm/board/juno/juno_security.c     \
+                               plat/arm/common/arm_tzc400.c
+
 PLAT_INCLUDES          :=      -Iplat/arm/board/juno/include
 
 PLAT_BL_COMMON_SOURCES :=      plat/arm/board/juno/aarch64/juno_helpers.S
@@ -44,17 +48,17 @@ BL1_SOURCES         +=      lib/cpus/aarch64/cortex_a53.S           \
                                plat/arm/board/juno/juno_bl1_setup.c    \
                                plat/arm/board/juno/juno_err.c
 
-BL2_SOURCES            +=      plat/arm/board/juno/juno_security.c     \
-                               plat/arm/board/juno/juno_err.c
+BL2_SOURCES            +=      plat/arm/board/juno/juno_err.c          \
+                               ${JUNO_SECURITY_SOURCES}
 
-BL2U_SOURCES           +=      plat/arm/board/juno/juno_security.c
+BL2U_SOURCES           +=      ${JUNO_SECURITY_SOURCES}
 
 BL31_SOURCES           +=      lib/cpus/aarch64/cortex_a53.S           \
                                lib/cpus/aarch64/cortex_a57.S           \
                                lib/cpus/aarch64/cortex_a72.S           \
                                plat/arm/board/juno/juno_pm.c           \
-                               plat/arm/board/juno/juno_security.c     \
-                               ${JUNO_GIC_SOURCES}
+                               ${JUNO_GIC_SOURCES}                     \
+                               ${JUNO_SECURITY_SOURCES}
 
 # Enable workarounds for selected Cortex-A57 erratas.
 ERRATA_A57_806969      :=      0
index 320273553992e48112fca5dfd550bcb82553544c..40ea1be5854af23592ef8f4e0a2228a6064ae7e7 100644 (file)
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2015-2016, ARM Limited and Contributors. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
@@ -102,26 +102,20 @@ ifdef EL3_PAYLOAD_BASE
 BL1_SOURCES            +=      plat/arm/common/arm_pm.c
 endif
 
-BL2_SOURCES            +=      drivers/arm/tzc400/tzc400.c                     \
-                               drivers/io/io_fip.c                             \
+BL2_SOURCES            +=      drivers/io/io_fip.c                             \
                                drivers/io/io_memmap.c                          \
                                drivers/io/io_storage.c                         \
                                plat/arm/common/arm_bl2_setup.c                 \
                                plat/arm/common/arm_io_storage.c                \
-                               plat/arm/common/arm_security.c                  \
                                plat/common/aarch64/platform_up_stack.S
 
-BL2U_SOURCES           +=      drivers/arm/tzc400/tzc400.c                     \
-                               plat/arm/common/arm_bl2u_setup.c                \
-                               plat/arm/common/arm_security.c                  \
+BL2U_SOURCES           +=      plat/arm/common/arm_bl2u_setup.c                \
                                plat/common/aarch64/platform_up_stack.S
 
 BL31_SOURCES           +=      drivers/arm/cci/cci.c                           \
                                drivers/arm/ccn/ccn.c                           \
-                               drivers/arm/tzc400/tzc400.c                     \
                                plat/arm/common/arm_bl31_setup.c                \
                                plat/arm/common/arm_pm.c                        \
-                               plat/arm/common/arm_security.c                  \
                                plat/arm/common/arm_topology.c                  \
                                plat/common/aarch64/platform_mp_stack.S         \
                                plat/common/aarch64/plat_psci_common.c
diff --git a/plat/arm/common/arm_security.c b/plat/arm/common/arm_security.c
deleted file mode 100644 (file)
index 8b46aae..0000000
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * Copyright (c) 2014-2015, ARM Limited and Contributors. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * Redistributions of source code must retain the above copyright notice, this
- * list of conditions and the following disclaimer.
- *
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- *
- * Neither the name of ARM nor the names of its contributors may be used
- * to endorse or promote products derived from this software without specific
- * prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <arm_def.h>
-#include <debug.h>
-#include <platform_def.h>
-#include <tzc400.h>
-
-
-/* Weak definitions may be overridden in specific ARM standard platform */
-#pragma weak plat_arm_security_setup
-
-
-/*******************************************************************************
- * Initialize the TrustZone Controller for ARM standard platforms.
- * Configure:
- *   - Region 0 with no access;
- *   - Region 1 with secure access only;
- *   - the remaining DRAM regions access from the given Non-Secure masters.
- *
- * When booting an EL3 payload, this is simplified: we configure region 0 with
- * secure access only and do not enable any other region.
- ******************************************************************************/
-void arm_tzc_setup(void)
-{
-       INFO("Configuring TrustZone Controller\n");
-
-       tzc_init(PLAT_ARM_TZC_BASE);
-
-       /* Disable filters. */
-       tzc_disable_filters();
-
-#ifndef EL3_PAYLOAD_BASE
-       /* Region 0 set to no access by default */
-       tzc_configure_region0(TZC_REGION_S_NONE, 0);
-
-       /* Region 1 set to cover Secure part of DRAM */
-       tzc_configure_region(PLAT_ARM_TZC_FILTERS, 1,
-                       ARM_AP_TZC_DRAM1_BASE, ARM_AP_TZC_DRAM1_END,
-                       TZC_REGION_S_RDWR,
-                       0);
-
-       /* Region 2 set to cover Non-Secure access to 1st DRAM address range.
-        * Apply the same configuration to given filters in the TZC. */
-       tzc_configure_region(PLAT_ARM_TZC_FILTERS, 2,
-                       ARM_NS_DRAM1_BASE, ARM_NS_DRAM1_END,
-                       TZC_REGION_S_NONE,
-                       PLAT_ARM_TZC_NS_DEV_ACCESS);
-
-       /* Region 3 set to cover Non-Secure access to 2nd DRAM address range */
-       tzc_configure_region(PLAT_ARM_TZC_FILTERS, 3,
-                       ARM_DRAM2_BASE, ARM_DRAM2_END,
-                       TZC_REGION_S_NONE,
-                       PLAT_ARM_TZC_NS_DEV_ACCESS);
-#else
-       /* Allow secure access only to DRAM for EL3 payloads. */
-       tzc_configure_region0(TZC_REGION_S_RDWR, 0);
-#endif /* EL3_PAYLOAD_BASE */
-
-       /*
-        * Raise an exception if a NS device tries to access secure memory
-        * TODO: Add interrupt handling support.
-        */
-       tzc_set_action(TZC_ACTION_ERR);
-
-       /* Enable filters. */
-       tzc_enable_filters();
-}
-
-void plat_arm_security_setup(void)
-{
-       arm_tzc_setup();
-}
diff --git a/plat/arm/common/arm_tzc400.c b/plat/arm/common/arm_tzc400.c
new file mode 100644 (file)
index 0000000..8b46aae
--- /dev/null
@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2014-2015, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <arm_def.h>
+#include <debug.h>
+#include <platform_def.h>
+#include <tzc400.h>
+
+
+/* Weak definitions may be overridden in specific ARM standard platform */
+#pragma weak plat_arm_security_setup
+
+
+/*******************************************************************************
+ * Initialize the TrustZone Controller for ARM standard platforms.
+ * Configure:
+ *   - Region 0 with no access;
+ *   - Region 1 with secure access only;
+ *   - the remaining DRAM regions access from the given Non-Secure masters.
+ *
+ * When booting an EL3 payload, this is simplified: we configure region 0 with
+ * secure access only and do not enable any other region.
+ ******************************************************************************/
+void arm_tzc_setup(void)
+{
+       INFO("Configuring TrustZone Controller\n");
+
+       tzc_init(PLAT_ARM_TZC_BASE);
+
+       /* Disable filters. */
+       tzc_disable_filters();
+
+#ifndef EL3_PAYLOAD_BASE
+       /* Region 0 set to no access by default */
+       tzc_configure_region0(TZC_REGION_S_NONE, 0);
+
+       /* Region 1 set to cover Secure part of DRAM */
+       tzc_configure_region(PLAT_ARM_TZC_FILTERS, 1,
+                       ARM_AP_TZC_DRAM1_BASE, ARM_AP_TZC_DRAM1_END,
+                       TZC_REGION_S_RDWR,
+                       0);
+
+       /* Region 2 set to cover Non-Secure access to 1st DRAM address range.
+        * Apply the same configuration to given filters in the TZC. */
+       tzc_configure_region(PLAT_ARM_TZC_FILTERS, 2,
+                       ARM_NS_DRAM1_BASE, ARM_NS_DRAM1_END,
+                       TZC_REGION_S_NONE,
+                       PLAT_ARM_TZC_NS_DEV_ACCESS);
+
+       /* Region 3 set to cover Non-Secure access to 2nd DRAM address range */
+       tzc_configure_region(PLAT_ARM_TZC_FILTERS, 3,
+                       ARM_DRAM2_BASE, ARM_DRAM2_END,
+                       TZC_REGION_S_NONE,
+                       PLAT_ARM_TZC_NS_DEV_ACCESS);
+#else
+       /* Allow secure access only to DRAM for EL3 payloads. */
+       tzc_configure_region0(TZC_REGION_S_RDWR, 0);
+#endif /* EL3_PAYLOAD_BASE */
+
+       /*
+        * Raise an exception if a NS device tries to access secure memory
+        * TODO: Add interrupt handling support.
+        */
+       tzc_set_action(TZC_ACTION_ERR);
+
+       /* Enable filters. */
+       tzc_enable_filters();
+}
+
+void plat_arm_security_setup(void)
+{
+       arm_tzc_setup();
+}