Perform security setup separately for each ARM platform
Prior to this patch, it was assumed that on all ARM platforms the bare
minimal security setup required is to program TrustZone protection. This
would always be done by programming the TZC-400 which was assumed to be
present in all ARM platforms. The weak definition of
platform_arm_security_setup() in plat/arm/common/arm_security.c
reflected these assumptions.
In reality, each ARM platform either decides at runtime whether
TrustZone protection needs to be programmed (e.g. FVPs) or performs
some security setup in addition to programming TrustZone protection
(e.g. NIC setup on Juno). As a result, the weak definition of
plat_arm_security_setup() is always overridden.
When a platform needs to program TrustZone protection and implements the
TZC-400 peripheral, it uses the arm_tzc_setup() function to do so. It is
also possible to program TrustZone protection through other peripherals
that include a TrustZone controller e.g. DMC-500. The programmer's
interface is slightly different across these various peripherals.
In order to satisfy the above requirements, this patch makes the
following changes to the way security setup is done on ARM platforms.
1. arm_security.c retains the definition of arm_tzc_setup() and has been
renamed to arm_tzc400.c. This is to reflect the reliance on the
TZC-400 peripheral to perform TrustZone programming. The new file is
not automatically included in all platform ports through
arm_common.mk. Each platform must include it explicitly in a platform
specific makefile if needed.
This approach enables introduction of similar library code to program
TrustZone protection using a different peripheral. This code would be
used by the subset of ARM platforms that implement this peripheral.
2. Due to #1 above, existing platforms which implements the TZC-400 have been
updated to include the necessary files for both BL2, BL2U and BL31
images.
Change-Id: I513c58f7a19fff2e9e9c3b95721592095bcb2735
diff --git a/plat/arm/board/fvp/platform.mk b/plat/arm/board/fvp/platform.mk
index ed4c898..3cd39ce 100644
--- a/plat/arm/board/fvp/platform.mk
+++ b/plat/arm/board/fvp/platform.mk
@@ -57,6 +57,10 @@
$(error "Incorrect GIC driver chosen on FVP port")
endif
+FVP_SECURITY_SOURCES := drivers/arm/tzc400/tzc400.c \
+ plat/arm/board/fvp/fvp_security.c \
+ plat/arm/common/arm_tzc400.c
+
PLAT_INCLUDES := -Iplat/arm/board/fvp/include
@@ -85,19 +89,19 @@
plat/arm/board/fvp/fvp_bl2_setup.c \
plat/arm/board/fvp/fvp_err.c \
plat/arm/board/fvp/fvp_io_storage.c \
- plat/arm/board/fvp/fvp_security.c
+ ${FVP_SECURITY_SOURCES}
BL2U_SOURCES += plat/arm/board/fvp/fvp_bl2u_setup.c \
- plat/arm/board/fvp/fvp_security.c
+ ${FVP_SECURITY_SOURCES}
BL31_SOURCES += ${FVP_CPU_LIBS} \
plat/arm/board/fvp/fvp_bl31_setup.c \
plat/arm/board/fvp/fvp_pm.c \
- plat/arm/board/fvp/fvp_security.c \
plat/arm/board/fvp/fvp_topology.c \
plat/arm/board/fvp/aarch64/fvp_helpers.S \
plat/arm/board/fvp/drivers/pwrc/fvp_pwrc.c \
- ${FVP_GIC_SOURCES}
+ ${FVP_GIC_SOURCES} \
+ ${FVP_SECURITY_SOURCES}
# Disable the PSCI platform compatibility layer
ENABLE_PLAT_COMPAT := 0