fix(security): remove CVE_2022_23960 Neoverse V3

Neoverse V3 has ECBHB implemented and is protected against X-Context
attacks.

Ref: https://developer.arm.com/documentation/110280/latest/
TRM: https

fix(security): remove CVE_2022_23960 Neoverse V3

Neoverse V3 has ECBHB implemented and is protected against X-Context
attacks.

Ref: https://developer.arm.com/documentation/110280/latest/
TRM: https://developer.arm.com/documentation/107734/0002/The-Neoverse--V3--core/Supported-standards-and-specifications?lang=en

Remove WORKAROUND_CVE_2022_23960 to avoid accidental enabling of this
workaround and using loop workaround.

This was accidentally added with
commit@c2a15217c3053117f4d39233002cb1830fa96670

Change-Id: I13b27c04c3da5ec80fa79422b4ef4fee64738caa
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(security): remove CVE_2022_23960 Cortex-A720

Cortex-A720 has ECBHB implemented and is protected against X-Context
attacks.

Ref: https://developer.arm.com/documentation/110280/latest/
TRM: https

fix(security): remove CVE_2022_23960 Cortex-A720

Cortex-A720 has ECBHB implemented and is protected against X-Context
attacks.

Ref: https://developer.arm.com/documentation/110280/latest/
TRM: https://developer.arm.com/documentation/102530/0002/The-Cortex-A720--core/Supported-standards-and-specifications?lang=en

Remove WORKAROUND_CVE_2022_23960 for Cortex-A720 to avoid accidental
enabling of this workaround and using loop workaround.

This was accidentally added with
commit@c2a15217c3053117f4d39233002cb1830fa96670

Change-Id: I3c68b5f5d85ede37a6a039369de8ed2aa9205395
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(docs): fix some broken links

Fix few broken links from docs.

Link check was done with following steps -

[..]
tf-a/docs$ make clean -j8; poetry run make html -j8
tf-a/docs$ poetry run sphinx-bu

fix(docs): fix some broken links

Fix few broken links from docs.

Link check was done with following steps -

[..]
tf-a/docs$ make clean -j8; poetry run make html -j8
tf-a/docs$ poetry run sphinx-build -j8 -q -b linkcheck . build/
[..]

Add link check conf values to config.py
- avoid reporting false broken links when `#`(anchors) are present
in the link.
- avoid checking for broken links in "change-log.md", this is summary
of commit msg's we are not going to fix broken links in cmt-msg's

Change-Id: I384094c8dcf3e93875c9052afa79ad826b9901d9
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

docs(security): update Advisory TFV-6

Update Advisory TFV-6 based on -
https://developer.arm.com/documentation/110280/latest/

Link all the impacted variants to this page correctly.

Change-Id: Icb3

docs(security): update Advisory TFV-6

Update Advisory TFV-6 based on -
https://developer.arm.com/documentation/110280/latest/

Link all the impacted variants to this page correctly.

Change-Id: Icb3d039c8949fd6036c729a845646170710ba011
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

docs(security): security advisory for CVE-2024-7881

Add CVE-2024-7881 security advisory document.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Ide976bc8754dc94d23e76001a

docs(security): security advisory for CVE-2024-7881

Add CVE-2024-7881 security advisory document.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Ide976bc8754dc94d23e76001aaecf52556e7039a

show more ...

Merge changes I801cea04,I4abb6c9d,I3c1cc0ec,I1b6f69ad,Ic4086a1f into integration

* changes:
refactor(build): pass TF_CFLAGS to the assembler
refactor(build): absorb CFLAGS into TF_CFLAGS
refac

Merge changes I801cea04,I4abb6c9d,I3c1cc0ec,I1b6f69ad,Ic4086a1f into integration

* changes:
refactor(build): pass TF_CFLAGS to the assembler
refactor(build): absorb CFLAGS into TF_CFLAGS
refactor(build): use a standard rule to run the preprocessor
refactor(build): place all cflags setting in one place
refactor(build): simplify ENABLE_LTO checking

show more ...

refactor(build): use a standard rule to run the preprocessor

There are a few, functionally identical, ways to call the preprocessor
on a non-C file, depending on the file. They differ in subtle, not

refactor(build): use a standard rule to run the preprocessor

There are a few, functionally identical, ways to call the preprocessor
on a non-C file, depending on the file. They differ in subtle, not
entirely correct, ways - one is missing a dependency to the makefiles,
another generates its .d inline, and the prints are different. That has
resulted in platforms reimplementing this functionality, making the
build brittle - a change to the overall build system doesn't propagate.
So add a MAKE_PRE macro that will make a rule with all the bells and
whistles to run the preprocessor on an arbitrary file.

This patch converts the arm platforms' cot_descriptors DTS rules. The
files are renamed to fit with the build rule and all extra flags are
dropped. Those flags are only necessary for building BL2 c files, which
will be passed to the output C file. Only the DTS flags are needed for
the preprocessing step, which will be passed automatically.

Change-Id: I3c1cc0ecf93b87d828f868214928c1bc9bcb5758
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

docs(security): security advisory for CVE-2024-5660

Add CVE-2024-5660 security advisory document.

Change-Id: I0d0428061f60b6fe83d03362b27b960f6ddcc6f4
Signed-off-by: Govindraj Raja <govindraj.raja@

docs(security): security advisory for CVE-2024-5660

Add CVE-2024-5660 security advisory document.

Change-Id: I0d0428061f60b6fe83d03362b27b960f6ddcc6f4
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...