feat(rng-trap): add EL3 support for FEAT_RNG_TRAP

FEAT_RNG_TRAP introduces support for EL3 trapping of reads of the
RNDR and RNDRRS registers, which is enabled by setting the
SCR_EL3.TRNDR bit. This

feat(rng-trap): add EL3 support for FEAT_RNG_TRAP

FEAT_RNG_TRAP introduces support for EL3 trapping of reads of the
RNDR and RNDRRS registers, which is enabled by setting the
SCR_EL3.TRNDR bit. This patch adds a new build flag
ENABLE_FEAT_RNG_TRAP that enables the feature.
This feature is supported only in AArch64 state from Armv8.5 onwards.

Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: Ia9f17aef3444d3822bf03809036a1f668c9f2d89

show more ...

Merge "feat(sve): support full SVE vector length" into integration

Merge "docs(security): update info on use of OpenSSL 3.0" into integration

docs(security): update info on use of OpenSSL 3.0

OpenSSL 3.0 is a pre-requisite since v2.7 and can be installed
on the operating system by updating the previous version.
However, this may not be co

docs(security): update info on use of OpenSSL 3.0

OpenSSL 3.0 is a pre-requisite since v2.7 and can be installed
on the operating system by updating the previous version.
However, this may not be convenient for everyone, as some may
want to keep their previous versions of OpenSSL.

This update on the docs shows that there is an alternative to
install OpenSSL on the system by using a local build of
OpenSSL 3.0 and pointing both the build and run commands to
that build.

Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: Ib9ad9ee5c333f7b04e2747ae02433aa66e6397f3

show more ...

docs: re-parent BL2 platform hooks for measured boot

bl2_plat_mboot_init/finish() functions documentation was incorrectly
hooked up to BL2U-specific section.

Change-Id: I758cb8142e992b0c85ee36d5671

docs: re-parent BL2 platform hooks for measured boot

bl2_plat_mboot_init/finish() functions documentation was incorrectly
hooked up to BL2U-specific section.

Change-Id: I758cb8142e992b0c85ee36d5671fc9ecd5bde29b
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

show more ...

docs(prerequisites): fix "Build Host" title

Add an empty line just before the "Build Host" title.

Without this, the title is not properly recognized, it does not get
added to the table of contents

docs(prerequisites): fix "Build Host" title

Add an empty line just before the "Build Host" title.

Without this, the title is not properly recognized, it does not get
added to the table of contents and the underlining characters appear
as dashes, as can be seen here:

https://trustedfirmware-a.readthedocs.io/en/v2.7/getting_started/prerequisites.html#prerequisites

Change-Id: Ia89cf3de0588495cbe64b0247dc860619f5ea6a8
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

show more ...

feat(sve): support full SVE vector length

Currently the SVE code hard codes a maximum vector length of 512 bits
when configuring SVE rather than the architecture supported maximum.
While this is fin

feat(sve): support full SVE vector length

Currently the SVE code hard codes a maximum vector length of 512 bits
when configuring SVE rather than the architecture supported maximum.
While this is fine for current physical implementations the architecture
allows for vector lengths up to 2048 bits and emulated implementations
generally allow any length up to this maximum.

Since there may be system specific reasons to limit the maximum vector
length make the limit configurable, defaulting to the architecture
maximum. The default should be suitable for most implementations since
the hardware will limit the actual vector length selected to what is
physically supported in the system.

Signed-off-by: Mark Brown <broonie@kernel.org>
Change-Id: I22c32c98a81c0cf9562411189d8a610a5b61ca12

show more ...

docs(rmmd): document EL3-RMM Interfaces

This patch documents the RMM-EL3 Boot and runtime interfaces.

Note that for the runtime interfaces, some services are not
documented in this patch and will b

docs(rmmd): document EL3-RMM Interfaces

This patch documents the RMM-EL3 Boot and runtime interfaces.

Note that for the runtime interfaces, some services are not
documented in this patch and will be added on a later doc patch.

These services are:

* RMMD_GTSI_DELEGATE
* RMMD_GTSI_UNDELEGATE
* RMMD_RMI_REQ_COMPLETE

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I8fcc89d91fe5a334c2f68c6bfd1fd672a8738b5c

show more ...

feat(rmmd): add support to create a boot manifest

This patch also adds an initial RMM Boot Manifest (v0.1) for fvp
platform.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Ch

feat(rmmd): add support to create a boot manifest

This patch also adds an initial RMM Boot Manifest (v0.1) for fvp
platform.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I1374f8f9cb207028f1820953cd2a5cf6d6c3b948

show more ...

feat(rmmd): add support for RMM Boot interface

This patch adds the infrastructure needed to pass boot arguments from
EL3 to RMM and allocates a shared buffer between both worlds that can
be used, am

feat(rmmd): add support for RMM Boot interface

This patch adds the infrastructure needed to pass boot arguments from
EL3 to RMM and allocates a shared buffer between both worlds that can
be used, among others, to pass a boot manifest to RMM. The buffer is
composed a single memory page be used by a later EL3 <-> RMM interface
by all CPUs.

The RMM boot manifest is not implemented by this patch.

In addition to that, this patch also enables support for RMM when
RESET_TO_BL31 is enabled.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I855cd4758ee3843eadd9fb482d70a6d18954d82a

show more ...

feat(trbe): add trbe under feature detection mechanism

This change adds "FEAT_TRBE" to be part of feature detection mechanism.

Previously feature enablement flags were of boolean type, containing
e

feat(trbe): add trbe under feature detection mechanism

This change adds "FEAT_TRBE" to be part of feature detection mechanism.

Previously feature enablement flags were of boolean type, containing
either 0 or 1. With the introduction of feature detection procedure
we now support three states for feature enablement build flags(0 to 2).

Accordingly, "ENABLE_TRBE_FOR_NS" flag is now modified from boolean
to numeric type to align with the feature detection.

Change-Id: I53d3bc8dc2f6eac63feef22dfd627f3a48480afc
Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>

show more ...

feat(brbe): add brbe under feature detection mechanism

This change adds "FEAT_BRBE" to be part of feature detection mechanism.

Previously feature enablement flags were of boolean type, possessing
e

feat(brbe): add brbe under feature detection mechanism

This change adds "FEAT_BRBE" to be part of feature detection mechanism.

Previously feature enablement flags were of boolean type, possessing
either 0 or 1. With the introduction of feature detection procedure
we now support three states for feature enablement build flags(0 to 2).

Accordingly, "ENABLE_BRBE_FOR_NS" flag is now modified from boolean
to numeric type to align with the feature detection.

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: I1eb52863b4afb10b808e2f0b6584a8a210d0f38c

show more ...

fix(build): use DWARF 4 when building debug

GCC 11 and Clang 14 now use the DWARF 5 standard by default however
Arm-DS currently only supports up to version 4. Therefore, for debug
builds, ensure th

fix(build): use DWARF 4 when building debug

GCC 11 and Clang 14 now use the DWARF 5 standard by default however
Arm-DS currently only supports up to version 4. Therefore, for debug
builds, ensure the DWARF 4 standard is used.
Also update references for Arm DS-5 to it's successor Arm-DS (Arm
Development Studio).

Change-Id: Ica59588de3d121c1b795b3699f42c31f032cee49
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

show more ...

docs(build): add build option for DRTM support

Documented the build option for DRTM support.

Signed-off-by: Manish V Badarkhe <manish.badarkhe@arm.com>
Signed-off-by: Lucian Paul-Trifu <lucian.paul

docs(build): add build option for DRTM support

Documented the build option for DRTM support.

Signed-off-by: Manish V Badarkhe <manish.badarkhe@arm.com>
Signed-off-by: Lucian Paul-Trifu <lucian.paultrifu@gmail.com>
Change-Id: Ic1543ee5f1d0046d5062d9744bd1a136d940b687

show more ...

refactor(security): upgrade tools to OpenSSL 3.0

Host tools cert_tool and encrypt_fw refactored to be fully
compatible with OpenSSL v3.0.

Changes were made following the OpenSSL 3.0 migration guide

refactor(security): upgrade tools to OpenSSL 3.0

Host tools cert_tool and encrypt_fw refactored to be fully
compatible with OpenSSL v3.0.

Changes were made following the OpenSSL 3.0 migration guide:
https://www.openssl.org/docs/man3.0/man7/migration_guide.html
In some cases, those changes are straightforward and only
a small modification on the types or API calls was needed
(e.g.: replacing BN_pseudo_rand() with BN_rand(). Both identical
since v1.1.0).
The use of low level APIs is now deprecated. In some cases,
the new API provides a simplified solution for our goals and
therefore the code was simplified accordingly (e.g.: generating
RSA keys through EVP_RSA_gen() without the need of handling the
exponent). However, in some cases, a more
sophisticated approach was necessary, as the use of a context
object was required (e.g.: when retrieving the digest value from
an SHA file).

Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: I978e8578fe7ab3e71307450ebe7e7812fbcaedb6

show more ...

feat(lib/psa): mock PSA APIs

Introduce PLAT_RSS_NOT_SUPPORTED build config to
provide a mocked version of PSA APIs. The goal is
to test the RSS backend based measured boot and
attestation token requ

feat(lib/psa): mock PSA APIs

Introduce PLAT_RSS_NOT_SUPPORTED build config to
provide a mocked version of PSA APIs. The goal is
to test the RSS backend based measured boot and
attestation token request integration on such
a platform (AEM FVP) where RSS is otherwise
unsupported. The mocked PSA API version does
not send a request to the RSS, it only returns
with success and hard-coded values.

Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: Ice8d174adf828c1df08fc589f0e17abd1e382a4d

show more ...

feat(brbe): add BRBE support for NS world

This patch enables access to the branch record buffer control registers
in non-secure EL2 and EL1 using the new build option ENABLE_BRBE_FOR_NS.
It is disab

feat(brbe): add BRBE support for NS world

This patch enables access to the branch record buffer control registers
in non-secure EL2 and EL1 using the new build option ENABLE_BRBE_FOR_NS.
It is disabled for all secure world, and cannot be used with ENABLE_RME.

This option is disabled by default, however, the FVP platform makefile
enables it for FVP builds.

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I576a49d446a8a73286ea6417c16bd0b8de71fca0

show more ...

Merge changes from topic "hm/make-refactor" into integration

* changes:
docs(prerequisites): use LLVM utilities to build with clang
build(make): use clang binutils to compile

Merge changes I47014d72,Ibf00c386 into integration

* changes:
docs(bl31): aarch64: RESET_TO_BL31_WITH_PARAMS
feat(bl31): aarch64: RESET_TO_BL31_WITH_PARAMS

docs(bl31): aarch64: RESET_TO_BL31_WITH_PARAMS

Document the RESET_TO_BL31 with parameters feature.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Change-Id: I47014d724f2eb822b69a112c3acee5

docs(bl31): aarch64: RESET_TO_BL31_WITH_PARAMS

Document the RESET_TO_BL31 with parameters feature.

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Change-Id: I47014d724f2eb822b69a112c3acee546fbfe82d5

show more ...

docs(prerequisites): use LLVM utilities to build with clang

Makefile updated to use LLVM utilities instead of GNU utilities when
compiling with clang. `CROSS_COMPILE` is not required since this
depe

docs(prerequisites): use LLVM utilities to build with clang

Makefile updated to use LLVM utilities instead of GNU utilities when
compiling with clang. `CROSS_COMPILE` is not required since this
dependency has been removed.

Change-Id: I19706b84b9310e07935516681b86596c04ef8ad6
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge "docs(build): update GCC to version 11.2-2022.02" into integration

Merge "refactor(twed): improve TWED enablement in EL-3" into integration

Merge changes from topic "sb/mbedtls-2.28" into integration

* changes:
docs(prerequisites): upgrade to mbed TLS 2.28.0
build(deps): upgrade to mbed TLS 2.28.0

docs(prerequisites): upgrade to mbed TLS 2.28.0

Upgrade to the latest and greatest 2.x release of Mbed TLS library
(i.e. v2.28.0) to take advantage of their bug fixes.

Note that the Mbed TLS projec

docs(prerequisites): upgrade to mbed TLS 2.28.0

Upgrade to the latest and greatest 2.x release of Mbed TLS library
(i.e. v2.28.0) to take advantage of their bug fixes.

Note that the Mbed TLS project published version 3.x some time
ago. However, as this is a major release with API breakages, upgrading
to 3.x might require some more involved changes in TF-A, which we are
not ready to do. We shall upgrade to mbed TLS 3.x after the v2.7
release of TF-A.

Change-Id: I887dfd87893169c7be53b986e6c43338d15949d7
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

show more ...