Makefile, doc: Make OPENSSL_DIR variable as build option for tools

Openssl directory path is hardcoded to '/usr' in the makefile
of certificate generation and firmware encryption tool using
'OPENSSL

Makefile, doc: Make OPENSSL_DIR variable as build option for tools

Openssl directory path is hardcoded to '/usr' in the makefile
of certificate generation and firmware encryption tool using
'OPENSSL_DIR' variable.

Hence changes are done to make 'OPENSSL_DIR' variable as
a build option so that user can provide openssl directory
path while building the certificate generation and firmware
encryption tool.

Also, updated the document for this newly created build option

Change-Id: Ib1538370d2c59263417f5db3746d1087ee1c1339
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge "make, doc: Add build option to create chain of trust at runtime" into integration

make, doc: Add build option to create chain of trust at runtime

Added a build option 'COT_DESC_IN_DTB' to create chain of trust
at runtime using fconf.

Signed-off-by: Manish V Badarkhe <Manish.Bada

make, doc: Add build option to create chain of trust at runtime

Added a build option 'COT_DESC_IN_DTB' to create chain of trust
at runtime using fconf.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I92b257ac4ece8bbf56f05a41d1e4056e2422ab89

show more ...

Merge "Fix makefile to build on a Windows host PC" into integration

Fix makefile to build on a Windows host PC

The TF-A firmware build system is capable of building on both Unix like
and Windows host PCs. The commit ID 7ff088 "Enable MTE support" updated
the Makefil

Fix makefile to build on a Windows host PC

The TF-A firmware build system is capable of building on both Unix like
and Windows host PCs. The commit ID 7ff088 "Enable MTE support" updated
the Makefile to conditionally enable the MTE support if the AArch64
architecture revision was greater than 8.5. However, the Makefile changes
were dependent on shell commands that are only available on unix shells,
resulting in build failures on a Windows host PC.

This patch fixes the Makefile by using a more portable approach for
comparing the architecture revision.

Change-Id: Icb56cbecd8af5b0b9056d105970ff4a6edd1755a
Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>

show more ...

Merge "TF-A: Add ARMv8.5 'bti' build option" into integration

TF-A: Add ARMv8.5 'bti' build option

This patch adds BRANCH_PROTECTION = 4 'bti' build option
which turns on branch target identification mechanism.

Change-Id: I32464a6b51726a100519f449a95aea5331f0

TF-A: Add ARMv8.5 'bti' build option

This patch adds BRANCH_PROTECTION = 4 'bti' build option
which turns on branch target identification mechanism.

Change-Id: I32464a6b51726a100519f449a95aea5331f0e82d
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

show more ...

Merge changes from topic "tegra194-ras-handling" into integration

* changes:
Tegra194: ras: verbose prints for SErrors
Prevent RAS register access from lower ELs
Tegra194: SiP: clear RAS corre

Merge changes from topic "tegra194-ras-handling" into integration

* changes:
Tegra194: ras: verbose prints for SErrors
Prevent RAS register access from lower ELs
Tegra194: SiP: clear RAS corrected error records
Tegra194: add RAS exception handling

show more ...

Prevent RAS register access from lower ELs

This patch adds a build config 'RAS_TRAP_LOWER_EL_ERR_ACCESS' to set
SCR_EL3.TERR during CPU boot. This bit enables trapping RAS register
accesses from EL1

Prevent RAS register access from lower ELs

This patch adds a build config 'RAS_TRAP_LOWER_EL_ERR_ACCESS' to set
SCR_EL3.TERR during CPU boot. This bit enables trapping RAS register
accesses from EL1 or EL2 to EL3.

RAS_TRAP_LOWER_EL_ERR_ACCESS is disabled by default.

Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Change-Id: Ifb0fb0afedea7dd2a29a0b0491a1161ecd241438

show more ...

Merge changes from topic "sp_secure_boot" into integration

* changes:
dualroot: add chain of trust for secure partitions
sptool: append cert_tool arguments.
cert_create: add SiP owned secure p

Merge changes from topic "sp_secure_boot" into integration

* changes:
dualroot: add chain of trust for secure partitions
sptool: append cert_tool arguments.
cert_create: add SiP owned secure partitions support

show more ...

Merge "plat/fvp: Add support for dynamic description of secure interrupts" into integration

plat/fvp: Add support for dynamic description of secure interrupts

Using the fconf framework, the Group 0 and Group 1 secure interrupt
descriptors are moved to device tree and retrieved in runtime.

plat/fvp: Add support for dynamic description of secure interrupts

Using the fconf framework, the Group 0 and Group 1 secure interrupt
descriptors are moved to device tree and retrieved in runtime. This
feature is enabled by the build flag SEC_INT_DESC_IN_FCONF.

Change-Id: I360c63a83286c7ecc2426cd1ff1b4746d61e633c
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

sptool: append cert_tool arguments.

To support secure boot of SP's update cert tool arguments while
generating sp_gen.mk which in turn is consumed by build system.

Signed-off-by: Manish Pandey <man

sptool: append cert_tool arguments.

To support secure boot of SP's update cert tool arguments while
generating sp_gen.mk which in turn is consumed by build system.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I2293cee9b7c684c27d387aba18e0294c701fb1cc

show more ...

Merge "plat/arm/fvp: Support performing SDEI platform setup in runtime" into integration

plat/arm/fvp: Support performing SDEI platform setup in runtime

This patch introduces dynamic configuration for SDEI setup and is supported
when the new build flag SDEI_IN_FCONF is enabled. Instead

plat/arm/fvp: Support performing SDEI platform setup in runtime

This patch introduces dynamic configuration for SDEI setup and is supported
when the new build flag SDEI_IN_FCONF is enabled. Instead of using C arrays
and processing the configuration at compile time, the config is moved to
dts files. It will be retrieved at runtime during SDEI init, using the fconf
layer.

Change-Id: If5c35a7517ba00a9f258d7f3e7c8c20cee169a31
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
Co-authored-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

Merge "Implement workaround for AT speculative behaviour" into integration

Implement workaround for AT speculative behaviour

During context switching from higher EL (EL2 or higher)
to lower EL can cause incorrect translation in TLB due to
speculative execution of AT instru

Implement workaround for AT speculative behaviour

During context switching from higher EL (EL2 or higher)
to lower EL can cause incorrect translation in TLB due to
speculative execution of AT instruction using out-of-context
translation regime.

Workaround is implemented as below during EL's (EL1 or EL2)
"context_restore" operation:
1. Disable page table walk using SCTLR.M and TCR.EPD0 & EPD1
bits for EL1 or EL2 (stage1 and stage2 disabled)
2. Save all system registers except TCR and SCTLR (for EL1 and EL2)
3. Do memory barrier operation (isb) to ensure all
system register writes are done.
4. Restore TCR and SCTLR registers (for EL1 and EL2)

Errata details are available for various CPUs as below:
Cortex-A76: 1165522
Cortex-A72: 1319367
Cortex-A57: 1319537
Cortex-A55: 1530923
Cortex-A53: 1530924

More details can be found in mail-chain:
https://lists.trustedfirmware.org/pipermail/tf-a/2020-April/000445.html

Currently, Workaround is implemented as build option which is default
disabled.

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: If8545e61f782cb0c2dda7ffbaf50681c825bd2f0

show more ...

Merge "Fix build type is empty in version string" into integration

Fix build type is empty in version string

Signed-off-by: Peiyuan Song <squallatf@gmail.com>
Change-Id: I97c2e6f8c12ecf828605811019d47a24293c1ebb

Merge "Incrementing the minor version to reflect upcoming v2.3 release" into integration

Incrementing the minor version to reflect upcoming v2.3 release

Change-Id: I27f7d92988fc16f68041c2ddaa8dd3a60362ddd1
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

Merge changes from topic "macro-cleanup" into integration

* changes:
plat: remove redundant =1 from -D option
Pass more -D options to BL*_CPPFLAGS instead of BL*_CFLAGS

Merge "cryptocell: add support for Cryptocell 713" into integration

Pass more -D options to BL*_CPPFLAGS instead of BL*_CFLAGS

Commit d5e97a1d2c79 ("Build: define IMAGE_AT_EL1 or IMAGE_AT_EL3
globally for C files") does not have commit 848a7e8ce1d9 ("Build:
introduc

Pass more -D options to BL*_CPPFLAGS instead of BL*_CFLAGS

Commit d5e97a1d2c79 ("Build: define IMAGE_AT_EL1 or IMAGE_AT_EL3
globally for C files") does not have commit 848a7e8ce1d9 ("Build:
introduce per-BL CPPFLAGS and ASFLAGS") as an ancestor because
they were pulled almost at the same time.

This is a follow-up conversion to be consistent with commit
11a3c5ee7325 ("plat: pass -D option to BL*_CPPFLAGS instead of
BL*_CFLAGS").

With this change, the command line option, IMAGE_AT_EL3, will be
passed to .S files as well.

I remove the definition in include/lib/cpus/aarch64/cpu_macros.S

Otherwise, the following error would happen.

include/lib/cpus/aarch64/cpu_macros.S:29:0: error: "IMAGE_AT_EL3" redefined [-Werror]

Change-Id: I943c8f22356483c2ae3c57b515c69243a8fa6889
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

cryptocell: add support for Cryptocell 713

Add Crypto 713 support as crypto module and NVM counter provider.

As files under include/drivers/arm/cryptocell/713/ are copied verbatim
from the CryptoCe

cryptocell: add support for Cryptocell 713

Add Crypto 713 support as crypto module and NVM counter provider.

As files under include/drivers/arm/cryptocell/713/ are copied verbatim
from the CryptoCell SBROM lib project they are filtered from checkpatch
coding style check.

Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
Change-Id: I7c361772f00ca7d96481f81ac6cbb2704467e52c

show more ...