I want to know if we have a chance to support the compiler-based CFI(eg clang cfi, kernel support it.) function in tf-a.
I want to know that is anyone doing this, or if everyone is interested in this?
Cheers,
Feng
Hi HPChen
1. Can try setting PLATFORM_MAX_AFFLVL to MPIDR_AFFLVL2? I am assuming your platform has 1 cluster with 2 cores.
2. The project currently supports a limited number of platforms. The default test suite[1] contains several smaller test suites. The tests are designed to auto-detect critical features supported by the platform. Rather than fail, tftf will skip tests if a feature is not supported.
Please refer to the documentation for the tf-a-tests project here: https://trustedfirmware-a-tests.readthedocs.io/en/latest/index.html
[1] https://git.trustedfirmware.org/TF-A/tf-a-tests.git/tree/tftf/tests/tests-s…
Thanks,
Madhukar
-----Original Message-----
From: TF-A <mailman-bounces(a)lists.trustedfirmware.org> On Behalf Of MS10 HPChen0
Sent: Tuesday, October 12, 2021 10:43 PM
To: tf-a-owner(a)lists.trustedfirmware.org
Subject: TFA affinity power level
Hi,
I'm Nuvoton software engineer. We have an A35 dual core platform. I ported the TFA for this platform.
Now I want test the TFA on test suite. I have some questions. Please help to answer. Thanks!
1. If define 'PLATFORM_MAX_AFFLVL' to MPIDR_AFFLVL1. The tftf test only identify single core no matter 'PLATFORM_CORES_PER_CLUSTER' define to 2.
How should I define 'PLATFORM_MAX_AFFLVL'?
2. How to select the test items? Should our platform need to pass all test items? Now I only test the tftf.
I'm new for TFA. Please help. Thanks!
Best regards,
HPChen
________________________________
________________________________
The privileged confidential information contained in this email is intended for use only by the addressees as indicated by the original sender of this email. If you are not the addressee indicated in this email or are not responsible for delivery of the email to such a person, please kindly reply to the sender indicating this fact and delete all copies of it from your computer and network server immediately. Your cooperation is highly appreciated. It is advised that any unauthorized use of confidential information of Nuvoton is strictly prohibited; and any information in this email irrelevant to the official business of Nuvoton shall be deemed as neither given nor endorsed by Nuvoton.
I noticed TF-A currently supports passing in 4 parameters and returning
up to 8. But SMCCC 1.1+ supports passing up to 18 and returning 18 in
AArch64 mode, and passing in/out 8 in AArch32.
I was wondering if there are any plans to add support for handling the
full set of parameters?
--
Rebecca Cran
Hi
I'm new to TF-A and OP Tee.
While I am using qemu to start TF-A, I got BL1 detected and failed to load
BL2, due to BL2 size out of bounds.
I changed TF-A BL1 source code to show more information:
diff --git a/common/bl_common.c b/common/bl_common.c
index 2fcb5385d9..a6239a5257 100644
--- a/common/bl_common.c
+++ b/common/bl_common.c
@@ -110,7 +111,7 @@ static int load_image(unsigned int image_id,
image_info_t *image_data)
/* Check that the image size to load is within limit */
if (image_size > image_data->image_max_size) {
- WARN("Image id=%u size out of bounds\n", image_id);
+ WARN("Image id=%u size(%lu, %u) out of bounds\n", image_id,
image_size, image_data->image_max_size);
io_result = -EFBIG;
goto exit;
}
the log shows:
NOTICE: Booting Trusted Firmware
NOTICE: BL1: v2.3():v2.3-dirty
NOTICE: BL1: Built : 15:56:43, Apr 20 2020
INFO: BL1: RAM 0xe04e000 - 0xe056000
VERBOSE: BL1: cortex_a57: CPU workaround for 806969 was not applied
WARNING: BL1: cortex_a57: CPU workaround for 813419 was missing!
VERBOSE: BL1: cortex_a57: CPU workaround for 813420 was not applied
VERBOSE: BL1: cortex_a57: CPU workaround for 814670 was not applied
WARNING: BL1: cortex_a57: CPU workaround for 817169 was missing!
INFO: BL1: cortex_a57: CPU workaround for disable_ldnp_overread was
applied
WARNING: BL1: cortex_a57: CPU workaround for 826974 was missing!
WARNING: BL1: cortex_a57: CPU workaround for 826977 was missing!
WARNING: BL1: cortex_a57: CPU workaround for 828024 was missing!
WARNING: BL1: cortex_a57: CPU workaround for 829520 was missing!
WARNING: BL1: cortex_a57: CPU workaround for 833471 was missing!
WARNING: BL1: cortex_a57: CPU workaround for 859972 was missing!
INFO: BL1: cortex_a57: CPU workaround for cve_2017_5715 was applied
INFO: BL1: cortex_a57: CPU workaround for cve_2018_3639 was applied
INFO: BL1: Loading BL2
VERBOSE: Using Memmap
WARNING: Firmware Image Package header check failed.
VERBOSE: Trying alternative IO
VERBOSE: Using Semi-hosting IO
INFO: Loading image id=1 at address 0xe01b000
WARNING: Image id=1 size(4294967295, 151552) out of bounds
ERROR: Failed to load BL2 firmware.
I'm using yocto (dunfell) + meta-arm to build / test TF-A + OP TEE under
qemuarm64.
meta-arm rev: c4f04f3fb66f8f4365b08b553af8206372e90a63
variables defined inside conf/local.conf ( for test )
23 MACHINE ?= "qemuarm64"
25
26 INSANE_SKIP_pn-optee-examples = "ldflags"
27 COMPATIBLE_MACHINE_pn-optee-examples = "qemuarm64"
28 COMPATIBLE_MACHINE_pn-optee-os = "qemuarm64"
29 COMPATIBLE_MACHINE_pn-optee-client = "qemuarm64"
30 COMPATIBLE_MACHINE_pn-trusted-firmware-a = "qemuarm64"
31
32 TFA_PLATFORM = "qemu"
33 TFA_UBOOT = "1"
34 TFA_DEBUG = "1"
35 TFA_SPD = "opteed"
36 TFA_BUILD_TARGET = "bl1 bl2 bl31"
37
38 OPTEEMACHINE:qemuarm64 = "vexpress-qemu_armv8a"
39 OPTEEOUTPUTMACHINE:qemuarm64 = "vexpress"
40
41 UBOOT_MACHINE_qemuarm64 = "qemu_arm64_defconfig"
I started qemu using following command line:
BIOS=tmp/deploy/images/qemuarm64/bl1.bin \
KERNEL=tmp/deploy/images/qemuarm64/Image-qemuarm64.bin \
runqemu mydefined-image-core-image-dev-optee nographic -d \
qemuparams=" \
-machine secure=on \
-m 4096 \
-d unimp -semihosting -semihosting-config enable=on,target=native \
"
Thanks
Hi all,
We made a few changes to the UFS driver. The proposed patches are posted
here:
https://review.trustedfirmware.org/q/topic:%22ufs_patches%22+(status:open%2…
.
The patches mainly consist of the below changes:
1. Delete asserts. Return error values instead.
2. Add retry logic and timeouts.
3. Reuse ufshc_send_uic_cmd() for DME_GET and DME_SET commands.
Any feedback/comments on these patches would be greatly appreciated.
Thanks!
Jorge Troncoso
+ TF-A ML (for the benefit of other trying to use firmware encryption
feature)
Hi Promod,
On Fri, 8 Oct 2021 at 00:09, pramod kumar <pramod.jnumca04(a)gmail.com> wrote:
> Hi Sumit,
>
> This is Pramod, Presently working in Amazon Lab126. I'm working in ATF and
> was going through your patch which provides f/w image encryption/decryption
> support.
>
> commit 7cda17bb0f92db39d123a4f2a1732c9978556453
> Author: Sumit Garg <sumit.garg(a)linaro.org>
> Date: Fri Nov 15 10:43:00 2019 +0530
>
> drivers: crypto: Add authenticated decryption framework
>
> Add framework for autheticated decryption of data. Currently this
> patch optionally imports mbedtls library as a backend if build option
> "DECRYPTION_SUPPORT = aes_gcm" is set to perform authenticated
> decryption
> using AES-GCM algorithm.
>
> Signed-off-by: Sumit Garg <sumit.garg(a)linaro.org>
> Change-Id: I2966f0e79033151012bf4ffc66f484cd949e7271
>
> I see that this support comes under DECRYPTION_SUPPORT macro hence can't
> be used dynamically. I see the TBBR spec provides a flag for this which
> could be used to exercise this feature dynamically-
> [image: image.png]
>
>
> Just wanted to understand that did you see any limitation to use this flag
> for making this feature support dynamically? Or do you have any plan to
> push follow up patches for this?
>
>
Actually there are security concerns associated if we use an unsigned
encryption flag in the header (see earlier discussions [1]).
> If this feature is made available, with the help of "disable_auth" flag,
> BL1 would be able to boot plane images even when TRUSTED_BOARD_BOOT is
> enabled in development mode.
>
I agree here that it would be useful to have such a flag in development
mode. For TRUSTED_BOARD_BOOT in development mode, I guess you are referring
to DYN_DISABLE_AUTH. If yes then I think such a macro makes sense for
encryption as well in order to disable decryption at runtime in development
mode, patches are very much welcome.
[1]
https://lists.trustedfirmware.org/pipermail/tf-a/2020-February/000288.html
-Sumit
> Regards,
> Pramod
>
Hi All,
We have refactored/redesigned the existing measured boot driver present in the TF-A repo to support it with multiple backend driver(s) (for example, TCG Event Log, physical TPM, etc) instead of it being strongly coupled with the TCG Event Log driver.
Proposed refactored patches are posted here: https://review.trustedfirmware.org/q/topic:%22refactor-mb%22+(status:open%2…
Any feedback/comments on these patches are much appreciated.
These patches mainly consist of the below changes:
1. Move image measurement in the generic layer, just after loading and authentication of the image. Previously, the platform layer was responsible for the measurement. For example, the Arm FVP platform layer was doing it as part of the post-load hook operation.
2. Measurement and recording of the images loaded by BL1. Previously, DTB config files loaded by BL1 were not part of measured at all. Also, it looks safer and cleaner approach to record the measurement taken by BL1 straightaway in TCG Event log buffer/physical TPM/any other TPM backend instead of deferring these recordings to BL2.
3. Pass Event Log buffer information from BL1 to BL2 so that the TCG Event Log buffer initialised by BL1 extended further with the measurements taken by BL2.
Note: These patches neither add any new functional backend driver for measured boot nor update any existing backend driver functionality (i.e. TCG Event Log driver). These changes only structured the measured boot code to provide a space to plug in any new backend driver(s) in future for the measured boot.
Thanks,
Manish Badarkhe
This event has been canceled with this note:
"Cancelling this weeks TF-A Tech Forum as we have no subjects/topics to
present for this meeting.
The TF-A project community is always looking for subjects/topics so if you
have something to present/discuss please do reach out to me and we can
schedule a session.
Thanks all."
Title: TF-A Tech Forum
We run an open technical forum call for anyone to participate and it is not
restricted to Trusted Firmware project members. It will operate under the
guidance of the TF TSC. Feel free to forward this invite to
colleagues. Invites are via the TF-A mailing list and also published on the
Trusted Firmware website. Details are
here: https://www.trustedfirmware.org/meetings/tf-a-technical-forum/Tr…
Firmware is inviting you to a scheduled Zoom meeting.Join Zoom
Meetinghttps://zoom.us/j/9159704974Meeting ID: 915 970 4974One tap
mobile+16465588656,,9159704974# US (New York)+16699009128,,9159704974# US
(San Jose)Dial by your location +1 646 558
8656 US (New York) +1 669 900
9128 US (San Jose) 877 853 5247 US
Toll-free 888 788 0099 US Toll-freeMeeting ID:
915 970 4974Find your local
number: https://zoom.us/u/ad27hc6t7h
When: Thu Oct 7, 2021 4pm – 5pm United Kingdom Time
Calendar: tf-a(a)lists.trustedfirmware.org
Who:
* Bill Fletcher - creator
* marek.bykowski(a)gmail.com
* okash.khawaja(a)gmail.com
* tf-a(a)lists.trustedfirmware.org
Invitation from Google Calendar: https://calendar.google.com/calendar/
You are receiving this courtesy email at the account
tf-a(a)lists.trustedfirmware.org because you are an attendee of this event.
To stop receiving future updates for this event, decline this event.
Alternatively you can sign up for a Google account at
https://calendar.google.com/calendar/ and control your notification
settings for your entire calendar.
Forwarding this invitation could allow any recipient to send a response to
the organizer and be added to the guest list, or invite others regardless
of their own invitation status, or to modify your RSVP. Learn more at
https://support.google.com/calendar/answer/37135#forwarding