fix(cpus): workaround for Cortex-X3 erratum 2615812

Cortex-X3 erratum 2615812 is a Cat B erratum that applies to revisions
r0p0, r1p0, and r1p1, and is still open. The workaround is to disable
the u

fix(cpus): workaround for Cortex-X3 erratum 2615812

Cortex-X3 erratum 2615812 is a Cat B erratum that applies to revisions
r0p0, r1p0, and r1p1, and is still open. The workaround is to disable
the use of the Full Retention power mode in the core (setting
WFI_RET_CTRL and WFE_RET_CTRL in CORTEX_X3_IMP_CPUPWRCTLR_EL1 to 0b000).

SDEN can be found here:
https://developer.arm.com/documentation/SDEN2055130/latest

Change-Id: I5ad66df3e18fc85a6b23f6662239494ee001d82f
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge changes from topic "ja/spm_doc" into integration

* changes:
docs(spm): ff-a v1.1 indirect message
docs(spm): s-el0 partition support update

docs(spm): interrupt handling guidance FF-A v1.1 EAC0

This patch documents the actions taken by Hafnium SPMC in response
to non-secure and secure interrupts.

Change-Id: I97687f188ca97aeb255e3e5b55d

docs(spm): interrupt handling guidance FF-A v1.1 EAC0

This patch documents the actions taken by Hafnium SPMC in response
to non-secure and secure interrupts.

Change-Id: I97687f188ca97aeb255e3e5b55d44ddf5d66b6e0
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

docs(changelog): changelog for v2.8 release

Change-Id: I1d99ea46ad527993ee786c34a67f94d74470f960
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>

docs(spm): partition runtime model and schedule modes

This patch documents the support for partition runtime models, call
chains and schedule modes in Hafnium SPMC.

Change-Id: I91d5718bb2c21d475499

docs(spm): partition runtime model and schedule modes

This patch documents the support for partition runtime models, call
chains and schedule modes in Hafnium SPMC.

Change-Id: I91d5718bb2c21d475499e402f6f27076930336cb
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

Merge "docs(marvell): fix typo 8K => A8K" into integration

docs(spm): ff-a v1.1 indirect message

Update secure partition manager documentation to include
FF-A v1.1 indirect messaging implementation.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: If

docs(spm): ff-a v1.1 indirect message

Update secure partition manager documentation to include
FF-A v1.1 indirect messaging implementation.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: Ifbca45347f775080ef98ac896d31650204318ba4

show more ...

Merge changes If90a18ee,I02e88f8c,Iea447fb5,Ie0570481,Ieeb14cfc into integration

* changes:
docs: add top level section numbering
docs(build): clarify getting started section
docs(build): clar

Merge changes If90a18ee,I02e88f8c,Iea447fb5,Ie0570481,Ieeb14cfc into integration

* changes:
docs: add top level section numbering
docs(build): clarify getting started section
docs(build): clarify docs building instructions
fix(docs): prevent a sphinx warning
fix(docs): prevent a virtual environment from failing a build

show more ...

Merge "docs(spm): update FF-A manifest binding" into integration

docs: add top level section numbering

Top level sections are not numbered. Adding numbers makes referring to
sections easier. For example the Maintainers page changes from
"about/3.1" to simply "1.3

docs: add top level section numbering

Top level sections are not numbered. Adding numbers makes referring to
sections easier. For example the Maintainers page changes from
"about/3.1" to simply "1.3.1".

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: If90a18ee8d6a6858d58f0687f31ea62b69399e04

show more ...

docs(build): clarify getting started section

The Getting started section is very difficult to follow. Building the
fip comes before building the files it needs, the BL33 requirement is
given in a so

docs(build): clarify getting started section

The Getting started section is very difficult to follow. Building the
fip comes before building the files it needs, the BL33 requirement is
given in a somewhat hand wavy way, and the Arm Developer website
download provides a lot of targets and the guide is not clear which ones
are needed on download.

Swapping the initial build and supporting tools sections makes the flow
more natural and the supporting tools section then becomes clear.
Explicitly mentioning the GCC targets avoids confusion for people less
familiar with the project (eg. new starters).

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I02e88f8c279db6d8eda68f634e8473c02b733963

show more ...

docs(build): clarify docs building instructions

Using virtual environments with pip is a generally recommended good
practice but the docs do not acknowledge it. As a result fresh installs
might fail

docs(build): clarify docs building instructions

Using virtual environments with pip is a generally recommended good
practice but the docs do not acknowledge it. As a result fresh installs
might fail builds due to missing $PATH entries. The Prerequisites
section is also a bit verbose which is difficult to read.

This patch adds the virtual environment mention and clarifies wording.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: Iea447fb59dc471a502454650c8548192d93ba879

show more ...

fix(docs): prevent a sphinx warning

Some newer versions of sphinx (tried on v5.3) will warn about language
being None which will fail the build. Change it to the default (en) to
prevent this.

Signe

fix(docs): prevent a sphinx warning

Some newer versions of sphinx (tried on v5.3) will warn about language
being None which will fail the build. Change it to the default (en) to
prevent this.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: Ie0570481f42aeb293e885ca936e0765f6cb299a8

show more ...

fix(docs): prevent a virtual environment from failing a build

sphinx-build is passed a blanket "." to build all docs. However, if a
virtual environment is placed within the docs directory, sphinx wi

fix(docs): prevent a virtual environment from failing a build

sphinx-build is passed a blanket "." to build all docs. However, if a
virtual environment is placed within the docs directory, sphinx will try
to build it which will fail due to some weird files it has.

This excludes the most common virtual environment directories from the
build to prevent this.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: Ieeb14cfc5730d21c986611feb0ed379c58dfcae2

show more ...

fix(docs): unify referenced Ubuntu versions

Documentation is inconsistent when referring to Ubuntu versioning.
Change this to a single reference that is consistent with the stated
version for TF-A t

fix(docs): unify referenced Ubuntu versions

Documentation is inconsistent when referring to Ubuntu versioning.
Change this to a single reference that is consistent with the stated
version for TF-A tests.

The change was tested with a full build on a clean install of Ubuntu 20.04.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: Ibb135ed938e9d92332668fa5caf274cf61b822d3

show more ...

docs(spm): s-el0 partition support update

S-EL0 partitions already support indirect messaging and notifications
so add that to supported features.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change

docs(spm): s-el0 partition support update

S-EL0 partitions already support indirect messaging and notifications
so add that to supported features.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I08e04593653ba38a2b82395f6f2d3ca7b212d494

show more ...

Merge changes I256959d7,I721376bf into integration

* changes:
fix(cpus): remove plat_can_cmo check for aarch32
fix(cpus): update doc and check for plat_can_cmo

fix(cpus): update doc and check for plat_can_cmo

plat_can_cmo must not clobber x1 but the doc doesn't mention that. This
patch updates the doc to mention x1. It also adds check for plat_can_cmo
to `

fix(cpus): update doc and check for plat_can_cmo

plat_can_cmo must not clobber x1 but the doc doesn't mention that. This
patch updates the doc to mention x1. It also adds check for plat_can_cmo
to `dcsw_op_louis` which was missed out in original patch.

Signed-off-by: Okash Khawaja <okash@google.com>
Change-Id: I721376bf3726520d0d5b0df0f33f98ce92257287

show more ...

refactor(stm32mp1): remove STM32MP_USE_STM32IMAGE

The code managing legacy boot (without FIP) that was under
STM32MP_USE_STM32IMAGE flag is remove.

Change-Id: I04452453ed84567b0de39e900594a81526562

refactor(stm32mp1): remove STM32MP_USE_STM32IMAGE

The code managing legacy boot (without FIP) that was under
STM32MP_USE_STM32IMAGE flag is remove.

Change-Id: I04452453ed84567b0de39e900594a81526562259
Signed-off-by: Yann Gautier <yann.gautier@st.com>

show more ...

docs(st): update documentation for TRUSTED_BOARD_BOOT

Update the documentation to indicate commands needed for
TRUSTED_BOARD_BOOT management.

Change-Id: I7b8781eaa7f8b6b8d675a625c7ff2e1ee767222a
Si

docs(st): update documentation for TRUSTED_BOARD_BOOT

Update the documentation to indicate commands needed for
TRUSTED_BOARD_BOOT management.

Change-Id: I7b8781eaa7f8b6b8d675a625c7ff2e1ee767222a
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>

show more ...

feat(auth): allow to verify PublicKey with platform format PK

In some platform the digest of the public key saved in the OTP is not
the digest of the exact same public key buffer needed to check the

feat(auth): allow to verify PublicKey with platform format PK

In some platform the digest of the public key saved in the OTP is not
the digest of the exact same public key buffer needed to check the
signature. Typically, platform checks signature using the DER ROTPK
whereas some others add some related information. Add a new platform
weak function to transform the public key buffer used by
verify_signature to a platform specific public key.

Mark this new weak function as deprecated as it will be replaced
by another framework implementation.

Change-Id: I71017b41e3eca9398cededf317ad97e9b511be5f
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>

show more ...

feat(cert-create): update for ECDSA brainpoolP256r/t1 support

Updated cert_tool to be able to select brainpool P256r/t1
or NIST prim256v1 curve for certificates signature.

Change-Id: I6e80014469706

feat(cert-create): update for ECDSA brainpoolP256r/t1 support

Updated cert_tool to be able to select brainpool P256r/t1
or NIST prim256v1 curve for certificates signature.

Change-Id: I6e800144697069ea83660053b8ba6e21c229243a
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>

show more ...

Merge "refactor(security): add OpenSSL 1.x compatibility" into integration

refactor(security): add OpenSSL 1.x compatibility

When updated to work with OpenSSL 3.0, the host tools lost their
compatibility with previous versions (1.x) of OpenSSL. This is
mainly due to the fa

refactor(security): add OpenSSL 1.x compatibility

When updated to work with OpenSSL 3.0, the host tools lost their
compatibility with previous versions (1.x) of OpenSSL. This is
mainly due to the fact that 1.x APIs became deprecated in 3.0 and
therefore their use cause compiling errors. In addition, updating
for a newer version of OpenSSL meant improving the stability
against security threats. However, although version 1.1.1 is
now deprecated, it still receives security updates, so it would
not imply major security issues to keep compatibility with it too.

This patch adds backwards compatibility with OpenSSL 1.x versions
by adding back 1.x API code. It defines a macro USING_OPENSSL3,
which will select the appropriate OpenSSL API version depending on
the OpenSSL library path chosen (which is determined by the
already-existing OPENSSL_DIR variable).

In addition, cleanup items were packed in functions and moved to
the proper modules in order to make the code more maintainable and
legible.

Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: I8deceb5e419edc73277792861882404790ccd33c

show more ...

Merge "fix(docs): add LTS maintainers" into integration