From a9cc84d7f7fa99297f7ed98707ee3bd2962192e6 Mon Sep 17 00:00:00 2001 From: Vikram Kanigiri Date: Wed, 10 Feb 2016 14:50:53 +0000 Subject: [PATCH] Perform security setup separately for each ARM platform Prior to this patch, it was assumed that on all ARM platforms the bare minimal security setup required is to program TrustZone protection. This would always be done by programming the TZC-400 which was assumed to be present in all ARM platforms. The weak definition of platform_arm_security_setup() in plat/arm/common/arm_security.c reflected these assumptions. In reality, each ARM platform either decides at runtime whether TrustZone protection needs to be programmed (e.g. FVPs) or performs some security setup in addition to programming TrustZone protection (e.g. NIC setup on Juno). As a result, the weak definition of plat_arm_security_setup() is always overridden. When a platform needs to program TrustZone protection and implements the TZC-400 peripheral, it uses the arm_tzc_setup() function to do so. It is also possible to program TrustZone protection through other peripherals that include a TrustZone controller e.g. DMC-500. The programmer's interface is slightly different across these various peripherals. In order to satisfy the above requirements, this patch makes the following changes to the way security setup is done on ARM platforms. 1. arm_security.c retains the definition of arm_tzc_setup() and has been renamed to arm_tzc400.c. This is to reflect the reliance on the TZC-400 peripheral to perform TrustZone programming. The new file is not automatically included in all platform ports through arm_common.mk. Each platform must include it explicitly in a platform specific makefile if needed. This approach enables introduction of similar library code to program TrustZone protection using a different peripheral. This code would be used by the subset of ARM platforms that implement this peripheral. 2. Due to #1 above, existing platforms which implements the TZC-400 have been updated to include the necessary files for both BL2, BL2U and BL31 images. Change-Id: I513c58f7a19fff2e9e9c3b95721592095bcb2735 --- plat/arm/board/fvp/platform.mk | 12 ++++++++---- plat/arm/board/juno/platform.mk | 16 ++++++++++------ plat/arm/common/arm_common.mk | 12 +++--------- plat/arm/common/{arm_security.c => arm_tzc400.c} | 0 4 files changed, 21 insertions(+), 19 deletions(-) rename plat/arm/common/{arm_security.c => arm_tzc400.c} (100%) diff --git a/plat/arm/board/fvp/platform.mk b/plat/arm/board/fvp/platform.mk index ed4c8984..3cd39ce2 100644 --- a/plat/arm/board/fvp/platform.mk +++ b/plat/arm/board/fvp/platform.mk @@ -57,6 +57,10 @@ else $(error "Incorrect GIC driver chosen on FVP port") endif +FVP_SECURITY_SOURCES := drivers/arm/tzc400/tzc400.c \ + plat/arm/board/fvp/fvp_security.c \ + plat/arm/common/arm_tzc400.c + PLAT_INCLUDES := -Iplat/arm/board/fvp/include @@ -85,19 +89,19 @@ BL2_SOURCES += drivers/arm/sp804/sp804_delay_timer.c \ plat/arm/board/fvp/fvp_bl2_setup.c \ plat/arm/board/fvp/fvp_err.c \ plat/arm/board/fvp/fvp_io_storage.c \ - plat/arm/board/fvp/fvp_security.c + ${FVP_SECURITY_SOURCES} BL2U_SOURCES += plat/arm/board/fvp/fvp_bl2u_setup.c \ - plat/arm/board/fvp/fvp_security.c + ${FVP_SECURITY_SOURCES} BL31_SOURCES += ${FVP_CPU_LIBS} \ plat/arm/board/fvp/fvp_bl31_setup.c \ plat/arm/board/fvp/fvp_pm.c \ - plat/arm/board/fvp/fvp_security.c \ plat/arm/board/fvp/fvp_topology.c \ plat/arm/board/fvp/aarch64/fvp_helpers.S \ plat/arm/board/fvp/drivers/pwrc/fvp_pwrc.c \ - ${FVP_GIC_SOURCES} + ${FVP_GIC_SOURCES} \ + ${FVP_SECURITY_SOURCES} # Disable the PSCI platform compatibility layer ENABLE_PLAT_COMPAT := 0 diff --git a/plat/arm/board/juno/platform.mk b/plat/arm/board/juno/platform.mk index fae30e7e..77014a15 100644 --- a/plat/arm/board/juno/platform.mk +++ b/plat/arm/board/juno/platform.mk @@ -1,5 +1,5 @@ # -# Copyright (c) 2013-2015, ARM Limited and Contributors. All rights reserved. +# Copyright (c) 2013-2016, ARM Limited and Contributors. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: @@ -34,6 +34,10 @@ JUNO_GIC_SOURCES := drivers/arm/gic/common/gic_common.c \ plat/common/plat_gicv2.c \ plat/arm/common/arm_gicv2.c +JUNO_SECURITY_SOURCES := drivers/arm/tzc400/tzc400.c \ + plat/arm/board/juno/juno_security.c \ + plat/arm/common/arm_tzc400.c + PLAT_INCLUDES := -Iplat/arm/board/juno/include PLAT_BL_COMMON_SOURCES := plat/arm/board/juno/aarch64/juno_helpers.S @@ -44,17 +48,17 @@ BL1_SOURCES += lib/cpus/aarch64/cortex_a53.S \ plat/arm/board/juno/juno_bl1_setup.c \ plat/arm/board/juno/juno_err.c -BL2_SOURCES += plat/arm/board/juno/juno_security.c \ - plat/arm/board/juno/juno_err.c +BL2_SOURCES += plat/arm/board/juno/juno_err.c \ + ${JUNO_SECURITY_SOURCES} -BL2U_SOURCES += plat/arm/board/juno/juno_security.c +BL2U_SOURCES += ${JUNO_SECURITY_SOURCES} BL31_SOURCES += lib/cpus/aarch64/cortex_a53.S \ lib/cpus/aarch64/cortex_a57.S \ lib/cpus/aarch64/cortex_a72.S \ plat/arm/board/juno/juno_pm.c \ - plat/arm/board/juno/juno_security.c \ - ${JUNO_GIC_SOURCES} + ${JUNO_GIC_SOURCES} \ + ${JUNO_SECURITY_SOURCES} # Enable workarounds for selected Cortex-A57 erratas. ERRATA_A57_806969 := 0 diff --git a/plat/arm/common/arm_common.mk b/plat/arm/common/arm_common.mk index 32027355..40ea1be5 100644 --- a/plat/arm/common/arm_common.mk +++ b/plat/arm/common/arm_common.mk @@ -1,5 +1,5 @@ # -# Copyright (c) 2015, ARM Limited and Contributors. All rights reserved. +# Copyright (c) 2015-2016, ARM Limited and Contributors. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: @@ -102,26 +102,20 @@ ifdef EL3_PAYLOAD_BASE BL1_SOURCES += plat/arm/common/arm_pm.c endif -BL2_SOURCES += drivers/arm/tzc400/tzc400.c \ - drivers/io/io_fip.c \ +BL2_SOURCES += drivers/io/io_fip.c \ drivers/io/io_memmap.c \ drivers/io/io_storage.c \ plat/arm/common/arm_bl2_setup.c \ plat/arm/common/arm_io_storage.c \ - plat/arm/common/arm_security.c \ plat/common/aarch64/platform_up_stack.S -BL2U_SOURCES += drivers/arm/tzc400/tzc400.c \ - plat/arm/common/arm_bl2u_setup.c \ - plat/arm/common/arm_security.c \ +BL2U_SOURCES += plat/arm/common/arm_bl2u_setup.c \ plat/common/aarch64/platform_up_stack.S BL31_SOURCES += drivers/arm/cci/cci.c \ drivers/arm/ccn/ccn.c \ - drivers/arm/tzc400/tzc400.c \ plat/arm/common/arm_bl31_setup.c \ plat/arm/common/arm_pm.c \ - plat/arm/common/arm_security.c \ plat/arm/common/arm_topology.c \ plat/common/aarch64/platform_mp_stack.S \ plat/common/aarch64/plat_psci_common.c diff --git a/plat/arm/common/arm_security.c b/plat/arm/common/arm_tzc400.c similarity index 100% rename from plat/arm/common/arm_security.c rename to plat/arm/common/arm_tzc400.c -- 2.30.2