Make executable memory non writable in the core #1459

etienne-lms · 2017-04-03T15:47:20Z

Make executable memory non writable in the OP-TEE core static mapping

(P-R title changed: drop the RFC state)

-1 core reuses the mmu xlat table when possible (allows core to map inside xlat already mapped)

Needed for non-LPAE mapping only.

-2 new core rx/ro/rw memory, align of core (private ?) memory on attributes boundaries, apply to map

CFG_CORE_RWDATA_NOEXEC=y/n Separate executable and writable memories. Defaults to 'y'.
CFG_CORE_RODATA_NOEXEC=y/n Separate executable and from rodata. Defaults to 'n'.

~~-3 pager specific case: try to make rx pages non writable through the pager aliasing.~~ => postponed
~~-4 Last: enable write-implies-execute-never in mmu (when applicable, updated plat configs)~~ => postponed

Happy review...

etienne-lms · 2017-04-06T08:00:31Z

Wipe previous proposal and build a new one on basis of #1468.

etienne-lms · 2017-04-11T08:23:30Z

Needs of rebase on top of #1468. Waiting for it to be merged before proceeding.

etienne-lms · 2017-04-12T12:12:52Z

Rebased (#1468 merged).
Dropped RFC status in P-R title. Updated P-R description on what's in these changes.

jenswi-linaro · 2017-04-12T12:30:06Z

core/arch/arm/mm/core_mmu_lpae.c

@@ -356,7 +357,7 @@ static struct tee_mmap_region *init_xlation_table(struct tee_mmap_region *mm,

 	assert(level <= 3);

-	debug_print("New xlat table (level %u):", level);
+	debug_print("New xlat table (level %u) [0x%8x]:", level, cur);


What is "cur"?

oups. bug. That a copy paste from non-lpae. I understand I did not test the LPAE with the MMU debug traces enabled.
I will fix.

jenswi-linaro · 2017-04-12T12:35:08Z

core/arch/arm/mm/core_mmu_lpae.c


-			/* Clear table before use */
+			if (*table) {


Assigning desc with *table here would make the following code a little bit easier and the call to virt_to_phys() below could be performed only when a new table is allocated.

OK, i will found a clean way.

jenswi-linaro · 2017-04-12T12:35:20Z

core/arch/arm/mm/core_mmu_lpae.c

+				xlat = phys_to_virt(*table &
+						    ~DESC_ATTRS(*table),
+						    MEM_AREA_TEE_RAM);
+			} else {
 			DMSG("xlat used: %d/%d", next_xlat, MAX_XLAT_TABLES);


Indentation

jenswi-linaro · 2017-04-12T13:06:29Z

core/arch/arm/mm/core_mmu_v7.c

-		pg_idx++;
-	}
+			desc |= ((mm->pa & ~SECTION_MASK) +
+				pg_idx * SMALL_PAGE_SIZE) | attr;


Don't need to "or" in attr as it's already assigned to desc above.

my fault. I forgot to clean it up since your previous comment.
I fix that.

jenswi-linaro · 2017-04-12T13:22:11Z

core/arch/arm/include/arm64.h

@@ -36,6 +36,8 @@
 #define SCTLR_C		BIT32(2)
 #define SCTLR_SA	BIT32(3)
 #define SCTLR_I		BIT32(12)
+#define SCTLR_WXN	BIT32(19)
+#define SCTLR_UWXN	BIT32(20)


I can't find this bit defined in AArch64 state any where, where did you find it?

true! Exists only in AArch32! Thanks. Maybe to overcome issues when LPAE is no enabled?
I will drop SCTLR_UWXN and update generic_entry_a64.S.

jenswi-linaro · 2017-04-12T13:31:11Z

core/arch/arm/plat-vexpress/conf.mk

@@ -32,8 +37,6 @@ endif

 $(call force,CFG_GENERIC_BOOT,y)
 $(call force,CFG_GIC,y)
-$(call force,CFG_HWSUPP_MEM_PERM_PXN,y)


Shouldn't these be set for all the vexpress platforms?

Yes. Juno is an A53 and an A57 ? Why does it uses cortex-a15 for aarch32 implementation ?

Shouldn't we include the cortex-a53.mk file instead. Actually, I think I should merge cortex-a53.mk and cortex-a57.mk into a cortex-armv8-0.mk and follow ARMv8 minor versions to distinguish the cores.

Another solution is to simply add here

$(call force,CFG_HWSUPP_MEM_PERM_PXN,y) $(call force,CFG_HWSUPP_MEM_PERM_WXN,y)

cortex-a15 is used because gcc didn't like cortex-a53 when the initial port was made, perhaps that has changed now. Juno is actually both A53 and A57.

jenswi-linaro · 2017-04-12T13:34:54Z

core/arch/arm/kernel/kern.ld.S

 OUTPUT_FORMAT(CFG_KERN_LINKER_FORMAT)
 OUTPUT_ARCH(CFG_KERN_LINKER_ARCH)

 ENTRY(_start)
 SECTIONS
 {
 	. = CFG_TEE_LOAD_ADDR;
+	. = ALIGN(SMALL_PAGE_SIZE);
+	__core_unpg_rx_start = .;


The "core" part isn't needed and also inconsistent with all the other symbols defined here.
Isn't __core_unpg_rx_start supposed to be exactly the same thing as __text_start or am I missing something?

you're right. __core_unpg_rx_start aims at being __text_start.
I would tend to keep definition of each __core_(unpg|init)_r(x|o|w)_(start|end|size) and add a PROVIDE(__core_unpg_rx_start = __text_start) but maybe you would prefer to not introduce the useless _core_XXXX_rX_XXX and use the already defined flag. I felt my way helped more understanding the mapping when reading 'kernel.ld.S'.

I'm basically OK with having redundant definitions as it helps understanding, but definitions that are supposed to be the same should be assigned at the same place. I think the new locations are better so please move __text_start and friends.

jenswi-linaro · 2017-04-12T13:35:51Z

core/arch/arm/kernel/kern.ld.S

@@ -50,13 +50,19 @@

 #include <platform_config.h>

+#ifndef SMALL_PAGE_SIZE
+#define SMALL_PAGE_SIZE		4096


Since this is introduced, please update all the other cases here where we align on small page boundary.

ok. it seems i was a bit lazy this time.

jenswi-linaro · 2017-04-12T13:46:15Z

core/arch/arm/kernel/kern.ld.S

@@ -250,6 +268,10 @@ SECTIONS
 		__text_init_end = .;
 	}

+	. = ALIGN(SMALL_PAGE_SIZE);


Is it that harmful to mix ro-data with code in a page?
If an attacker is able to select some address to jump to the code pages has to be so much have so much more potential to contain useful code any way.

True. An alternate implementation of this P-R simply splits read-only and red-write memory. It can be easily done and could save some kbytes (dear pager!). But when pager is disabled, we don't expect to struggle for few kBytes.

I would not like a new configuration switch as CFG_CORE_MAPS_READONLY_EXECUTABLE.
It's about reducing attack surface. Should we cowardly restrict this, or nicely waste memory few maybe-useless extra hardening?

I think it's silly, but I seem to be the only one that cares so never mind.

I understand your feeling about wasting memory and I fully agree with when pager is used. I will go for a CFG_CORE_RODATA_NONEXECUTABLE switch and default switch it off.

jenswi-linaro · 2017-04-12T13:55:38Z

core/arch/arm/kernel/kern.ld.S

-		. = ALIGN(8);
+
+		/*
+		 * Insure init sections ends on mapping page


Parts of the code in the init section is even after OP-TEE is fully initialized so it will never be paged out for good.
This aligning wastes memory for with the only win that a few lines of code can be removed from init_runtime()

This alignment is required when separating executable memory from read-only memory.
Can onoly drop it if we discard the read-only/non-executable requirement.

Again I understand your concern about physical memory waste in paged configuration.

I will propose a CFG_CORE_RODATA_NONEXECUTABLE=y|n.

One way to overcome this specific alignment could be to swap paged executable text and paged read-only-data. Would you agree with this change ?

Yes, sounds good.

etienne-lms

This P-R build on buggy reuse of xlat tables.
I will submit in a specific P-R.

etienne-lms · 2017-04-19T07:00:49Z

core/arch/arm/mm/core_mmu_lpae.c


 			/* Recurse to fill in new table */
-			mm = init_xlation_table(mm, base_va, new_table,
-					   level + 1);
+			mm = init_xlation_table(mm, base_va, xlat, level + 1);


This is crappy. If a mm reference is leaves room for the next mm in the xlat, the increment table++ below craps the later reuse of same xlat table.

etienne-lms · 2017-04-19T07:05:36Z

core/arch/arm/mm/core_mmu_v7.c

@@ -712,7 +710,7 @@ static void map_memarea(struct tee_mmap_region *mm, uint32_t *ttb)
 				mm->attr & TEE_MATTR_SECURE ? "S" : "NS");

 		attr = mattr_to_desc(1, mm->attr | TEE_MATTR_TABLE);
-		pa = map_page_memarea(mm);
+		pa = map_page_memarea(mm, ttb[mm->va >> SECTION_SHIFT]);


This fails if the mm reference covers several ttb entries.

etienne-lms · 2017-04-27T14:24:24Z

This 2nd commit "core: reuse xlat table when possible" could be simplified.
Actually the LPAE implementation already well handles reuse of xlat tables. Only the non-LPAE needs to be updated.

etienne-lms · 2017-04-28T12:59:05Z

Rebased since no comment. Previous comments addressed and squashed.
LPAE mapping untouched. Checkpatch and sunxi build fixed.

jforissier · 2017-05-02T07:39:57Z

core/arch/arm/mm/core_mmu.c

@@ -571,11 +571,19 @@ static void init_mem_map(struct tee_mmap_region *memory_map, size_t num_elems)
 	assert(end <= CFG_TEE_RAM_START + CFG_TEE_RAM_VA_SIZE);

 	if (core_mmu_place_tee_ram_at_top(va)) {
+		bool __maybe_unused va_is_secure = true; /* any init fits */


Move outside of the block since it's also used in the else part.

The 2 are unrelated (but from functional purpose. Yet, ok to move definition to function header.

jforissier · 2017-05-02T07:42:45Z

core/arch/arm/mm/core_mmu_v7.c

+				const char *str __maybe_unused)
+{
+	if (!(mm->attr & TEE_MATTR_VALID_BLOCK))
+		debug_print("%s [%08" PRIxVA " %08" PRIxVA "] not-mapped",


s/not-mapped/not mapped/

jforissier · 2017-05-02T07:44:00Z

core/arch/arm/mm/core_mmu_v7.c

+				mm->attr & (TEE_MATTR_CACHE_CACHED <<
+					TEE_MATTR_CACHE_SHIFT) ? "MEM" : "DEV",
+				mm->attr & TEE_MATTR_PW ? "RW" : "RO",
+				mm->attr & TEE_MATTR_PX ? "X" : "XN",


s/XN/NX/ maybe?

"XN" is the ARM convention for eXecute-Never. I would prefer to use it instead of a "NX".
Maybe I should rename CFG_CORE_RxDATA_NOEXEC into CFG_CORE_RxDATA_XN ?

XN is ok. And I'm fine with _NOEXEC in config settings, it's easier to read I think.

Ok, i'll keep xxx_NOEXEC then.

jforissier · 2017-05-02T07:51:39Z

core/arch/arm/mm/core_mmu.c

+
+	return NULL;
+found:
+	return map_pa2va(mmap, pa);


Would be more compact as:

mmap = find_map_by_type_and_pa(MEM_AREA_TEE_RAM, pa); if (!mmap) mmap = find_map_by_type_and_pa(MEM_AREA_TEE_RAM_RW, pa); if (!mmap) mmap = find_map_by_type_and_pa(MEM_AREA_TEE_RAM_RO, pa); if (!mmap) mmap = find_map_by_type_and_pa(MEM_AREA_TEE_RAM_RX, pa); return map_pa2va(mmap, pa);

jforissier · 2017-05-02T07:55:04Z

core/arch/arm/include/mm/core_mmu.h

@@ -145,6 +145,8 @@ static inline const char *teecore_memtype_name(enum teecore_memtypes type)
 	return names[type];
 }

+#define MEM_AREA_TEE_RAM_DATA		MEM_AREA_TEE_RAM


Wouldn't MEM_AREA_TEE_RAM_RW_DATA be a better name? (I mean,the TEE core has a RO data section, too).

jforissier · 2017-05-02T08:16:50Z

core/arch/arm/kernel/kern.ld.S


-	.rodata : ALIGN(8) {
-		__rodata_start = .;
+	__rodata_start = .;


I have no strong opinion on this, and it may be a matter of personal taste, but I'd rather keep an align statement here for clarity (although it's not strictly needed since there is one in the previous block). In fact, I like the previous syntax better (it's clear and compact).
Same below of course.

Ok, i will restore the old way.

jforissier · 2017-05-02T08:24:38Z

core/arch/arm/kernel/kern.ld.S

+ * __vcore_/unpg_|ro_/start    ordering: |  __flatmap_unpg_ro_start / +size
+ *         \init \rw \size               |  __flatmap_unpg_rw_start / +size
+ *                                       v  __flatmap_init_rx_start / +size
+ *                                          __flatmap_init_ro_start / +size


It took me a few seconds to parse that ;) in fact I don't think this comment has much value, it just repeats what can be seen in the file. Same for sunxi.

etienne-lms · 2017-05-02T08:55:01Z

core/arch/arm/mm/core_mmu.c

+
+	return NULL;
+found:
+	return map_pa2va(mmap, pa);


etienne-lms · 2017-05-02T08:55:17Z

core/arch/arm/kernel/kern.ld.S

+ * __vcore_/unpg_|ro_/start    ordering: |  __flatmap_unpg_ro_start / +size
+ *         \init \rw \size               |  __flatmap_unpg_rw_start / +size
+ *                                       v  __flatmap_init_rx_start / +size
+ *                                          __flatmap_init_ro_start / +size


etienne-lms · 2017-05-02T08:59:35Z

core/arch/arm/kernel/kern.ld.S

+PROVIDE(__vcore_init_rx_start = 0);
+PROVIDE(__vcore_init_ro_start = 0);
+PROVIDE(__vcore_init_rx_size = 0);
+PROVIDE(__vcore_init_ro_size = 0);


Will remove these definition as __vcore_init_xxx are not used when CFG_WITH_PAGER is disabled.

etienne-lms · 2017-05-02T09:14:15Z

core/arch/arm/kernel/kern.ld.S


-	.rodata : ALIGN(8) {
-		__rodata_start = .;
+	__rodata_start = .;


Ok, i will restore the old way.

etienne-lms · 2017-05-02T09:17:57Z

core/arch/arm/mm/core_mmu_v7.c

+				const char *str __maybe_unused)
+{
+	if (!(mm->attr & TEE_MATTR_VALID_BLOCK))
+		debug_print("%s [%08" PRIxVA " %08" PRIxVA "] not-mapped",


etienne-lms · 2017-05-02T09:21:09Z

core/arch/arm/mm/core_mmu_v7.c

+				mm->attr & (TEE_MATTR_CACHE_CACHED <<
+					TEE_MATTR_CACHE_SHIFT) ? "MEM" : "DEV",
+				mm->attr & TEE_MATTR_PW ? "RW" : "RO",
+				mm->attr & TEE_MATTR_PX ? "X" : "XN",


"XN" is the ARM convention for eXecute-Never. I would prefer to use it instead of a "NX".
Maybe I should rename CFG_CORE_RxDATA_NOEXEC into CFG_CORE_RxDATA_XN ?

jenswi-linaro · 2017-05-03T06:31:23Z

core/arch/arm/mm/core_mmu_v7.c

+		l2 = core_mmu_alloc_l2(mm->size);
+	else
+		l2 = phys_to_virt(xlat & SECTION_PT_ATTR_MASK,
+				  MEM_AREA_TEE_RAM_DATA);


Need to check that core_mmu_alloc_l2() or phys_to_virt() returned a valid pointer.

jenswi-linaro · 2017-05-03T06:52:23Z

core/arch/arm/kernel/kern.ld.S

 	_end_of_ram = .;

+#ifndef CFG_WITH_PAGER
+	. = ALIGN(SMALL_PAGE_SIZE);


True, this is useless. I guess it is even useless to move this before _end_of_ram = .;.
I will remove it.

jenswi-linaro · 2017-05-03T06:53:43Z

core/arch/arm/kernel/kern.ld.S

+
+#ifdef CFG_WITH_PAGER
+/*
+ * Core init mapping shall mapped up to end of physical RAM.


s/shall mapped/shall cover/

jenswi-linaro · 2017-05-03T07:00:37Z

core/arch/arm/mm/core_mmu_v7.c

+		l2 = core_mmu_alloc_l2(mm->size);
+	else
+		l2 = phys_to_virt(xlat & SECTION_PT_ATTR_MASK,
+				  MEM_AREA_TEE_RAM_RW_DATA);


Need to check that l2 is a valid pointer

You mean something like an assert(l2); ?
By construction, core_mmu_alloc_l2() returns a valid address or panics.
By construction, if xlat is not null, it already stores a valid L2 table address (+ attributes/descc. type). map_page_memarea_in_pgdirs() will assert that attributes are valid. Maybe, in this case, we could assert here that the attribute do match ?

An assert() would be nice, together with a short explanation why l2 can't be NULL.

jenswi-linaro · 2017-05-08T11:40:54Z

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

etienne-lms · 2017-05-09T07:20:28Z

(rebased, squash on-going...)

etienne-lms · 2017-05-09T07:51:19Z

Oups ! I have squashed 2 commit into a single one. Commit comment for "core: label the bounds of core flat mapped memory" does not reflect the changes made. I will fix and push back.

etienne-lms · 2017-05-09T08:43:19Z

rebased, squash issue fixed, tag applied.

etienne-lms · 2017-05-15T09:28:32Z

rebased,
a bit too early: i've included #1531 :( => i will wait it is merged (it's a small straightforward fix) and will rebase back.

etienne-lms · 2017-05-15T13:26:56Z

rebased

jforissier · 2017-05-16T08:49:37Z

FYI, works on HiKey (64 bits, 32 bits, 32 bits with CFG_WITH_PAGER=y, 64 bits with CFG_CORE_RODATA_NOEXEC=y, 64 bits with CFG_CORE_RODATA_NOEXEC=n CFG_CORE_RWDATA_NOEXEC=n).

Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey)

etienne-lms · 2017-05-16T09:07:53Z

Thanks. I'll add my "tested-by": on qemu_virt and qemu_armv8, with several configs; pager (when applicable), rw-xn/ro-xn, debug, lpae/no-lpae (when applicable).

etienne-lms · 2017-05-16T09:10:40Z

Tested-by tags applied.

etienne-lms · 2017-05-17T07:07:36Z

...rebased...

etienne-lms · 2017-05-17T09:21:43Z

Dear all,
Can we merge this if it reached a satisfactory state ?
I would like to propose 2 P-R on top of it but I would rather like this current P-R to be merge before pushing the proposals to ease review process:

CFG_HWSUPP_MEM_PERM_WXN (2 commits: this + this)
pager-aliases not always writable (1 commit: this).

(edited: fix)

etienne-lms · 2017-05-18T10:09:29Z

I added a later patch to fix a weakness in the patch serie.
However, since this later change can be related to few other cleaning, I proposed them as separated PR: #1547.

EDITED: extra later patch not required => being reviewed (& hopefully merged) from #1547. Current PR only needs a rebase without any extra change (applied tags are still valid) once #1547 is merged.

Before this patch, core static mapping did not insure level2 tables do not mix secure and non-secure virtual memory mappings. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

When a level2 translation table is already used for a virtual mapping range, allow core to reuse it to extend mapping in the same virtual region. map_memarea() now maps a single given "memory map area" based on MMU root table knowledge. Each non-LPAE level2 table is reset to zero when allocated since the code now map_page_memarea() only the fills the mapped virtual range in the target MMU table. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Define new memory type IDs for the core private memory: - MEM_AREA_TEE_RAM_RX defines read-only/executable memory. - MEM_AREA_TEE_RAM_RO defines read-only/non-executable memory. - MEM_AREA_TEE_RAM_RW defines read/write/non-executable memory. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

This change prepares split of executable and writable from rw memory. Upon configuration the core private memory "TEE RAM" (heap, stack, ...) will either be in TEE_RAM or TEE_RAM_RW. This MEM_AREA_TEE_RAM_RW_DATA abstracts the memory used for core data. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Use __init_start and __init_end to refer to "init" bounds. Removed unused __text_init_start/_end, __rodata_init_start/_end, ... Define SMALL_PAGE_SIZE locally to linker file kernel.ld.S. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Define labels to identify the core memory layout. These labels will be later use to define the mapping bounds between executable and writable memories. Update plat-sunxi/kernel.ld.S to match support of generic_boot.c. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Make executable memory non-writable and writable memory no-executable. Effective upon CFG_CORE_RWDATA_NOEXEC=y. Default configuration enables this directive. If CFG_CORE_RWDATA_NOEXEC is enabled, the read-only sections are mapped read-only/executable while the read/write memories are mapped read/write/not-executable. Potential 4KB of secure RAM wasted since the page alignment between unpaged text/rodata and unpaged read/write data. If CFG_CORE_RWDATA_NOEXEC not disabled, all text/rodata/data/... sections of the core are mapped read/write/executable. Both code and rodata and mapped together without alignment constraint. Hence define all "ro" are inside the "rx" relate area: __vcore_init_ro_size = 0 or init "ro" effective size. As init sections are mapped read-only, core won't be able to fill trailing content of the init last page. Hence __init_end and __init_size are page aligned. Core must premap all physical memory as readable to allow move of has tables to the allocated buffer during core inits. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org> Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey) Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (qemu_virt) Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (qemu_armv8) Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)

CFG_CORE_RODATA_NOEXEC=y/n allows to map non-executable memory with a not-executable attribute. Added alignments that may waste secure memory: - unpaged text/rodata bound - init text/rodata bound To prevent wasting at least one page, the sections text_paged and rodata_paged are swapped in the memory layout. Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org> Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org> Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey) Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (qemu_virt) Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (qemu_armv8) Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)

etienne-lms · 2017-05-19T14:23:57Z

rebased, travis happy. ready to be merged.

etienne-lms mentioned this pull request Apr 6, 2017

Add flexibility to core static mapping #1468

Merged

etienne-lms force-pushed the rxrorw2 branch from f540043 to da46904 Compare April 6, 2017 08:00

etienne-lms force-pushed the rxrorw2 branch from da46904 to f8a3b9e Compare April 12, 2017 11:57

etienne-lms changed the title ~~[RFC] Make executable memory non writable in the core~~ Make executable memory non writable in the core Apr 12, 2017

jenswi-linaro reviewed Apr 12, 2017

View reviewed changes

etienne-lms commented Apr 19, 2017

View reviewed changes

etienne-lms force-pushed the rxrorw2 branch from 10c09f0 to 213a76b Compare April 24, 2017 11:56

etienne-lms mentioned this pull request Apr 27, 2017

fix core static mapping #1501

Merged

etienne-lms force-pushed the rxrorw2 branch from e79d5d4 to acb4cbe Compare April 28, 2017 10:33

jforissier reviewed May 2, 2017

View reviewed changes

etienne-lms commented May 2, 2017

View reviewed changes

jenswi-linaro reviewed May 3, 2017

View reviewed changes

etienne-lms force-pushed the rxrorw2 branch from 6d26590 to f799971 Compare May 9, 2017 07:18

etienne-lms force-pushed the rxrorw2 branch from f799971 to 170cca9 Compare May 9, 2017 07:47

etienne-lms force-pushed the rxrorw2 branch from 170cca9 to d434d72 Compare May 9, 2017 08:41

etienne-lms force-pushed the rxrorw2 branch from d434d72 to 93f8417 Compare May 15, 2017 09:25

etienne-lms force-pushed the rxrorw2 branch from 93f8417 to f7bb2aa Compare May 15, 2017 13:26

etienne-lms force-pushed the rxrorw2 branch from f7bb2aa to 9e07079 Compare May 16, 2017 09:10

etienne-lms force-pushed the rxrorw2 branch from 9e07079 to c2e7fa1 Compare May 17, 2017 07:06

This was referenced May 18, 2017

Support for *flat mapped* coherent secure RAM #1533

Closed

Remove some useless mandated mapping verifications #1547

Merged

etienne-lms added 8 commits May 19, 2017 15:31

etienne-lms force-pushed the rxrorw2 branch from 3b1aa22 to 3181c73 Compare May 19, 2017 13:46

jforissier merged commit 3181c73 into OP-TEE:master May 19, 2017

glneo mentioned this pull request May 22, 2017

TI platforms broken on master #1556

Closed

etienne-lms deleted the rxrorw2 branch May 30, 2017 11:20

Make executable memory non writable in the core #1459

Make executable memory non writable in the core #1459

Conversation

etienne-lms commented Apr 3, 2017 • edited Loading

etienne-lms commented Apr 6, 2017

etienne-lms commented Apr 11, 2017

etienne-lms commented Apr 12, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

etienne-lms left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

etienne-lms commented Apr 27, 2017

etienne-lms commented Apr 28, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jenswi-linaro commented May 8, 2017

etienne-lms commented May 9, 2017

etienne-lms commented May 9, 2017

etienne-lms commented May 9, 2017

etienne-lms commented May 15, 2017

etienne-lms commented May 15, 2017

jforissier commented May 16, 2017

etienne-lms commented May 16, 2017

etienne-lms commented May 16, 2017

etienne-lms commented May 17, 2017

etienne-lms commented May 17, 2017 • edited Loading

etienne-lms commented May 18, 2017 • edited Loading

etienne-lms commented May 19, 2017

etienne-lms commented Apr 3, 2017 •

edited

Loading

etienne-lms commented May 17, 2017 •

edited

Loading

etienne-lms commented May 18, 2017 •

edited

Loading