Hi,
We use mainline TF-A and have problems using the HAB API in the
U-Boot. We see for example that the hab_auth_img command fails in the
mainline U-Boot. If we switch to the downstream NXP TF-A it works. Is
this to be expected?
--
Heiko
Hi
Arguments between the BL1 and BL2 is overlap by zeromem when BL2 start.
1. BL2 save r3 to r12
arm-trusted-firmware/bl2/aarch32/bl2_entrypoint.S
/*---------------------------------------------
* Save arguments x0 - x3 from BL1 for future
* use.
* ---------------------------------------------
*/
mov r9, r0
mov r10, r1
mov r11, r2
mov r12, r3
2. BL2 call zeromem to clear bss
arm-trusted-firmware/bl2/aarch32/bl2_entrypoint.S
ldr r0, =__BSS_START__
ldr r1, =__BSS_END__
sub r1, r1, r0
bl zeromem
arm-trusted-firmware/lib/aarch32/misc_helpers.S
tmp .req r12 /* Temporary scratch register */
r12 used as scratch register
3. r3 restore from r12
arm-trusted-firmware/bl2/aarch32/bl2_entrypoint.S
mov r0, r9
mov r1, r10
mov r2, r11
mov r3, r12
I can try to save it in other registers, but can not guarantee that the
register will not be damaged. Is there any better way to deal with this
problem?
Thanks.
Hi,
We use TF-A v2.5 with ENABLE_SVE_FOR_NS=1 and SPM_MM=1 and boot linux kernel is ok.
Atfer upgrade TF-A with patch fix(spm_mm): do not compile if SVE/SME is enabled (4333f95bedb),
we set ENABLE_SVE_FOR_NS=0 to fix compile error, but we get exception and hang in EL3 when boot kernel:
-----------------------------------------------------------------------------------
[ 0.000000] Linux version 5.10.23-003debug.ali5000.alios7.aarch64 (root(a)j66e01291.sqa.eu95) (gcc (GCC) 10.2.1 20200825 (Alibaba 10.2.1-3 2.17)
......
[ 0.000000] pcpu-alloc: [1] 80 [1] 81 [1] 82 [1] 83 [1] 84 [1] 85 [1] 86 [1] 87
[ 0.000000] pcpu-alloc: [1] 88 [1] 89 [1] 90 [1] 91 [1] 92 [1] 93 [1] 94 [1] 95
ERROR: Excepton received on 0x81000000, spsr_el3:89,reason:1 esr_el3:0x66000000
Exception Class = 19: Access to SVE functionality trapped as a result of CPACR_EL1.ZEN,CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ.
-----------------------------------------------------------------------------------
How to fix the exception issue? Can we remove the below lines?
ifeq (${ENABLE_SVE_FOR_NS},1)
$(error "Error: SPM_MM is not compatible with ENABLE_SVE_FOR_NS")
endif
Regards,
Ming Huang
TF-A Community,
This is to notify that we are planning to target the Trusted Firmware-A 2.7 release during the 4th week of May as part of the regular 6 month cadence.
The aim is to consolidate all TF-A work since the 2.6 release. As part of this, a release candidate tag will be created and release activities will commence from 23rd May across all TF-A repositories.
Essentially, we will not merge any major enhancements from this date until the release is made.
Please ensure any patches desired to make the 2.7 release are submitted in good time to be complete by 20th May.
Any major enhancement patches still open after that date will not be merged until after the release.
This will involve the various repositories making up the broader TF-A project including the TF-A mainline, TF-A Tests, Hafnium, TF-A CI Scripts and TF-A CI Jobs.
We will endeavour minimise the disruption on patch merging and complete release activities ASAP after we start.
Thanks,
Daniel
Hi All,
Currently, in Arm platforms, BL2 loads HW config in the non-secure memory so that it can be consumed by both non-secure
components (BL33) and secure (BL31, BL32) components.
In most cases, this shouldn't be an issue since no software runs in non-secure world at this time (i.e. non-secure world has not
been started yet) However, it doesn't provide a guarantee though since any malicious external NS-agents (such as an external
debugger)can take control of this memory region for update/corruption after BL2 loads this region and before BL31 consumes
it. Consider below scenario:
1. BL2 loads HW_CONFIG from flash to NS DRAM.
2. BL2 authenticates HW_CONFIG in NS DRAM.
3. A malicious non-secure agent modifies the contents of HW_CONFIG in NS DRAM, such that it induces a different
behaviour in BL31.
1. BL31 consumes HW_CONFIG without noticing it has changed.
To overcome this issue, I created a patch [1] to load the HW-config into secure memory, and that eventually will be used by
BL31/sp_min and BL32 components. Additionally, BL31/sp_min copies the HW-config present in secure memory to a non-secure
location before passing it on to BL33. In order to accomplish this, mapped secure DRAM in BL31/sp_min and BL32, and non-secure
DRAM in BL31/sp_min.
I believe some platforms may have similar kind of issue i.e. HW config placed in non-secure memory consumed by both secure and
non-secure components. It is appreciated if you review the patch [1] I posted and provide feedback.
This patch [1] also mitigates threat ID #3 for FVP platform as per the TF-A threat model [2] (Bypass image authentication scenario).
[1]: https://review.trustedfirmware.org/q/topic:%22refactor-hw-config-load%22+(s…
[2]: https://trustedfirmware-a.readthedocs.io/en/latest/threat_model/threat_mode…
Thanks,
Manish Badarkhe
Topic: FF-A v1.1 Boot protocol implementation
Presented by: Joao Alves
Agenda: This session presents the recently introduced FF-A v1.1 Boot protocol implementation, motivations and challenges. The change set spans across TF-A, Hafnium and TF-A-tests repositories. The presentation covers the TF-A build flow and Secure Partitions packaging, how Hafnium consumes the new SP package format and passes boot data to SPs.
Link to changes: FF-A v1.1 boot protocol<https://review.trustedfirmware.org/q/topic:%22ja%252Fboot_protocol%22+(stat…>
================================================= We run an open technical forum call for anyone to participate and it is not restricted to Trusted Firmware project members. It will operate under the guidance of the TF TSC.
Feel free to forward this invite to colleagues. Invites are via the TF-A mailing list and also published on the Trusted Firmware website. Details are here: https://www.trustedfirmware.org/meetings/tf-a-technical-forum/https://www.g…
Trusted Firmware is inviting you to a scheduled Zoom meeting.
Join Zoom Meeting https://zoom.us/j/9159704974https://www.google.com/url?q=https://zoom.us/j/…
Meeting ID: 915 970 4974
One tap mobile +16465588656,,9159704974# US (New York) +16699009128,,9159704974# US (San Jose)
Dial by your location +1 646 558 8656 US (New York) +1 669 900 9128 US (San Jose) 877 853 5247 US Toll-free 888 788 0099 US Toll-free Meeting ID: 915 970 4974 Find your local number: https://zoom.us/u/ad27hc6t7hhttps://www.google.com/url?q=https://zoom.us/u/…
Thanks & best regards,
--Bipin Ravi
Hi,
Please find the latest report on new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
3 new defect(s) introduced to ARM-software/arm-trusted-firmware found with Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 3 of 3 defect(s)
** CID 378361: Null pointer dereferences (NULL_RETURNS)
/plat/arm/board/fvp/fvp_bl2_setup.c: 84 in plat_get_next_bl_params()
________________________________________________________________________________________________________
*** CID 378361: Null pointer dereferences (NULL_RETURNS)
/plat/arm/board/fvp/fvp_bl2_setup.c: 84 in plat_get_next_bl_params()
78
79 /* To retrieve actual size of the HW_CONFIG */
80 param_node = get_bl_mem_params_node(HW_CONFIG_ID);
81 assert(param_node != NULL);
82
83 /* Copy HW config from Secure address to NS address */
>>> CID 378361: Null pointer dereferences (NULL_RETURNS)
>>> Dereferencing "hw_config_info", which is known to be "NULL".
84 memcpy((void *)hw_config_info->ns_config_addr,
85 (void *)hw_config_info->config_addr,
86 (size_t)param_node->image_info.image_size);
87
88 /*
89 * Ensure HW-config device tree committed to memory, as there is
** CID 378360: (NULL_RETURNS)
/plat/renesas/rzg/bl2_plat_setup.c: 411 in bl2_plat_handle_post_image_load()
/plat/renesas/rcar/bl2_plat_setup.c: 446 in bl2_plat_handle_post_image_load()
/plat/st/stm32mp1/bl2_plat_setup.c: 466 in bl2_plat_handle_post_image_load()
/plat/renesas/rcar/bl2_plat_setup.c: 465 in bl2_plat_handle_post_image_load()
/plat/renesas/rzg/bl2_plat_setup.c: 407 in bl2_plat_handle_post_image_load()
/plat/st/stm32mp1/bl2_plat_setup.c: 472 in bl2_plat_handle_post_image_load()
/plat/renesas/rcar/bl2_plat_setup.c: 448 in bl2_plat_handle_post_image_load()
/plat/renesas/rcar/bl2_plat_setup.c: 440 in bl2_plat_handle_post_image_load()
/plat/renesas/rzg/bl2_plat_setup.c: 397 in bl2_plat_handle_post_image_load()
/plat/renesas/rzg/bl2_plat_setup.c: 404 in bl2_plat_handle_post_image_load()
/plat/st/stm32mp1/bl2_plat_setup.c: 529 in bl2_plat_handle_post_image_load()
________________________________________________________________________________________________________
*** CID 378360: (NULL_RETURNS)
/plat/renesas/rzg/bl2_plat_setup.c: 411 in bl2_plat_handle_post_image_load()
405 }
406
407 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
408 sizeof(entry_point_info_t));
409 break;
410 case BL33_IMAGE_ID:
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "&bl_mem_params->ep_info" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.]
411 memcpy(¶ms->bl33_ep_info, &bl_mem_params->ep_info,
412 sizeof(entry_point_info_t));
413 break;
414 default:
415 break;
416 }
/plat/renesas/rcar/bl2_plat_setup.c: 446 in bl2_plat_handle_post_image_load()
440 bl_mem_params->image_info.image_base = dest;
441 break;
442 case BL32_IMAGE_ID:
443 ret = rcar_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
444 &dest);
445 if (!ret)
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
446 bl_mem_params->image_info.image_base = dest;
447
448 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
449 sizeof(entry_point_info_t));
450 break;
451 case BL33_IMAGE_ID:
/plat/st/stm32mp1/bl2_plat_setup.c: 466 in bl2_plat_handle_post_image_load()
460 switch (image_ids[i]) {
461 case BL32_IMAGE_ID:
462 bl_mem_params->ep_info.pc = config_info->config_addr;
463
464 /* In case of OPTEE, initialize address space with tos_fw addr */
465 pager_mem_params = get_bl_mem_params_node(BL32_EXTRA1_IMAGE_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "pager_mem_params", which is known to be "NULL".
466 pager_mem_params->image_info.image_base = config_info->config_addr;
467 pager_mem_params->image_info.image_max_size =
468 config_info->config_max_size;
469
470 /* Init base and size for pager if exist */
471 paged_mem_params = get_bl_mem_params_node(BL32_EXTRA2_IMAGE_ID);
/plat/renesas/rcar/bl2_plat_setup.c: 465 in bl2_plat_handle_post_image_load()
459 } else {
460 /* plain image, copy it in place */
461 memcpy((void *)BL33_BASE, (void *)BL33_COMP_BASE,
462 bl_mem_params->image_info.image_size);
463 }
464 #endif
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "&bl_mem_params->ep_info" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.]
465 memcpy(¶ms->bl33_ep_info, &bl_mem_params->ep_info,
466 sizeof(entry_point_info_t));
467 break;
468 }
469
470 return 0;
/plat/renesas/rzg/bl2_plat_setup.c: 407 in bl2_plat_handle_post_image_load()
401 ret = rzg_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
402 &dest);
403 if (ret == 0U) {
404 bl_mem_params->image_info.image_base = dest;
405 }
406
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "&bl_mem_params->ep_info" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.]
407 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
408 sizeof(entry_point_info_t));
409 break;
410 case BL33_IMAGE_ID:
411 memcpy(¶ms->bl33_ep_info, &bl_mem_params->ep_info,
412 sizeof(entry_point_info_t));
/plat/st/stm32mp1/bl2_plat_setup.c: 472 in bl2_plat_handle_post_image_load()
466 pager_mem_params->image_info.image_base = config_info->config_addr;
467 pager_mem_params->image_info.image_max_size =
468 config_info->config_max_size;
469
470 /* Init base and size for pager if exist */
471 paged_mem_params = get_bl_mem_params_node(BL32_EXTRA2_IMAGE_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "paged_mem_params", which is known to be "NULL".
472 paged_mem_params->image_info.image_base = STM32MP_DDR_BASE +
473 (dt_get_ddr_size() - STM32MP_DDR_S_SIZE -
474 STM32MP_DDR_SHMEM_SIZE);
475 paged_mem_params->image_info.image_max_size = STM32MP_DDR_S_SIZE;
476 break;
477
/plat/renesas/rcar/bl2_plat_setup.c: 448 in bl2_plat_handle_post_image_load()
442 case BL32_IMAGE_ID:
443 ret = rcar_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
444 &dest);
445 if (!ret)
446 bl_mem_params->image_info.image_base = dest;
447
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "&bl_mem_params->ep_info" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.]
448 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
449 sizeof(entry_point_info_t));
450 break;
451 case BL33_IMAGE_ID:
452 #if RCAR_GEN3_BL33_GZIP == 1
453 if ((mmio_read_32(BL33_COMP_BASE) & 0xffff) == 0x8b1f) {
/plat/renesas/rcar/bl2_plat_setup.c: 440 in bl2_plat_handle_post_image_load()
434
435 switch (image_id) {
436 case BL31_IMAGE_ID:
437 ret = rcar_get_dest_addr_from_cert(SOC_FW_CONTENT_CERT_ID,
438 &dest);
439 if (!ret)
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
440 bl_mem_params->image_info.image_base = dest;
441 break;
442 case BL32_IMAGE_ID:
443 ret = rcar_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
444 &dest);
445 if (!ret)
/plat/renesas/rzg/bl2_plat_setup.c: 397 in bl2_plat_handle_post_image_load()
391
392 switch (image_id) {
393 case BL31_IMAGE_ID:
394 ret = rzg_get_dest_addr_from_cert(SOC_FW_CONTENT_CERT_ID,
395 &dest);
396 if (ret == 0U) {
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
397 bl_mem_params->image_info.image_base = dest;
398 }
399 break;
400 case BL32_IMAGE_ID:
401 ret = rzg_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
402 &dest);
/plat/renesas/rzg/bl2_plat_setup.c: 404 in bl2_plat_handle_post_image_load()
398 }
399 break;
400 case BL32_IMAGE_ID:
401 ret = rzg_get_dest_addr_from_cert(TRUSTED_OS_FW_CONTENT_CERT_ID,
402 &dest);
403 if (ret == 0U) {
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
404 bl_mem_params->image_info.image_base = dest;
405 }
406
407 memcpy(¶ms->bl32_ep_info, &bl_mem_params->ep_info,
408 sizeof(entry_point_info_t));
409 break;
/plat/st/stm32mp1/bl2_plat_setup.c: 529 in bl2_plat_handle_post_image_load()
523 bl_mem_params->ep_info.args.arg1 = 0; /* Unused */
524 bl_mem_params->ep_info.args.arg2 = 0; /* No DT supported */
525 } else {
526 #if !STM32MP_USE_STM32IMAGE
527 bl_mem_params->ep_info.pc = bl_mem_params->image_info.image_base;
528 tos_fw_mem_params = get_bl_mem_params_node(TOS_FW_CONFIG_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "tos_fw_mem_params", which is known to be "NULL".
529 bl_mem_params->image_info.image_max_size +=
530 tos_fw_mem_params->image_info.image_max_size;
531 #endif /* !STM32MP_USE_STM32IMAGE */
532 bl_mem_params->ep_info.args.arg0 = 0;
533 }
534 break;
** CID 378359: Null pointer dereferences (NULL_RETURNS)
/plat/st/common/bl2_io_storage.c: 413 in bl2_plat_handle_pre_image_load()
________________________________________________________________________________________________________
*** CID 378359: Null pointer dereferences (NULL_RETURNS)
/plat/st/common/bl2_io_storage.c: 413 in bl2_plat_handle_pre_image_load()
407 image_block_spec.length = entry->length;
408 #endif
409 gpt_init_done = true;
410 } else {
411 bl_mem_params_node_t *bl_mem_params = get_bl_mem_params_node(image_id);
412
>>> CID 378359: Null pointer dereferences (NULL_RETURNS)
>>> Dereferencing "bl_mem_params", which is known to be "NULL".
413 mmc_block_dev_spec.buffer.offset = bl_mem_params->image_info.image_base;
414 mmc_block_dev_spec.buffer.length = bl_mem_params->image_info.image_max_size;
415 }
416
417 break;
418 #endif
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…