Merge "docs(security): update info on use of OpenSSL 3.0" into integration

docs(security): update info on use of OpenSSL 3.0

OpenSSL 3.0 is a pre-requisite since v2.7 and can be installed
on the operating system by updating the previous version.
However, this may not be co

docs(security): update info on use of OpenSSL 3.0

OpenSSL 3.0 is a pre-requisite since v2.7 and can be installed
on the operating system by updating the previous version.
However, this may not be convenient for everyone, as some may
want to keep their previous versions of OpenSSL.

This update on the docs shows that there is an alternative to
install OpenSSL on the system by using a local build of
OpenSSL 3.0 and pointing both the build and run commands to
that build.

Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: Ib9ad9ee5c333f7b04e2747ae02433aa66e6397f3

show more ...

Merge "docs: re-parent BL2 platform hooks for measured boot" into integration

fix(errata): workaround for Cortex-A78C 2132064

Cortex-A78C erratum 2132064 is a cat B erratum that applies to revisions
r0p1 and r0p2 and is still open.

This patch implements workaround option 2 t

fix(errata): workaround for Cortex-A78C 2132064

Cortex-A78C erratum 2132064 is a cat B erratum that applies to revisions
r0p1 and r0p2 and is still open.

This patch implements workaround option 2 that places the data
prefetcher in the most conservative mode to greatly reduce prefetches
by writing the following bits to the value indicated:
ecltr[7:6], PF_MODE = 2'b11

SDEN can be found here:
https://developer.arm.com/documentation/SDEN2004089/latest

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Ica2561c1e257643c2482085447ef852fa62a1eb2

show more ...

docs: re-parent BL2 platform hooks for measured boot

bl2_plat_mboot_init/finish() functions documentation was incorrectly
hooked up to BL2U-specific section.

Change-Id: I758cb8142e992b0c85ee36d5671

docs: re-parent BL2 platform hooks for measured boot

bl2_plat_mboot_init/finish() functions documentation was incorrectly
hooked up to BL2U-specific section.

Change-Id: I758cb8142e992b0c85ee36d5671fc9ecd5bde29b
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

show more ...

Merge "docs(prerequisites): fix "Build Host" title" into integration

docs(prerequisites): fix "Build Host" title

Add an empty line just before the "Build Host" title.

Without this, the title is not properly recognized, it does not get
added to the table of contents

docs(prerequisites): fix "Build Host" title

Add an empty line just before the "Build Host" title.

Without this, the title is not properly recognized, it does not get
added to the table of contents and the underlining characters appear
as dashes, as can be seen here:

https://trustedfirmware-a.readthedocs.io/en/v2.7/getting_started/prerequisites.html#prerequisites

Change-Id: Ia89cf3de0588495cbe64b0247dc860619f5ea6a8
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

show more ...

Merge "fix(cpus): workaround for Neoverse-N2 erratum 2388450" into integration

feat(sve): support full SVE vector length

Currently the SVE code hard codes a maximum vector length of 512 bits
when configuring SVE rather than the architecture supported maximum.
While this is fin

feat(sve): support full SVE vector length

Currently the SVE code hard codes a maximum vector length of 512 bits
when configuring SVE rather than the architecture supported maximum.
While this is fine for current physical implementations the architecture
allows for vector lengths up to 2048 bits and emulated implementations
generally allow any length up to this maximum.

Since there may be system specific reasons to limit the maximum vector
length make the limit configurable, defaulting to the architecture
maximum. The default should be suitable for most implementations since
the hardware will limit the actual vector length selected to what is
physically supported in the system.

Signed-off-by: Mark Brown <broonie@kernel.org>
Change-Id: I22c32c98a81c0cf9562411189d8a610a5b61ca12

show more ...

fix(cpus): workaround for Neoverse-N2 erratum 2388450

Neoverse-N2 erratum 2388450 is a cat B erratum that applies to
revision r0p0 and is fixed in r0p1. The workaround is to set
bit[40] of CPUACTLR2

fix(cpus): workaround for Neoverse-N2 erratum 2388450

Neoverse-N2 erratum 2388450 is a cat B erratum that applies to
revision r0p0 and is fixed in r0p1. The workaround is to set
bit[40] of CPUACTLR2_EL1 to disable folding of demand requests into
older prefetches with L2 miss requests outstanding.

SDEN can be found here:
https://developer.arm.com/documentation/SDEN1982442/latest

Change-Id: I6dd949c79cea8dbad322e569aa5de86cf8cf9639
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

show more ...

docs(rmmd): add myself as RMMD and RME owner

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I93f5e622e37f3156bd5326b7d3a3d0d7f73b2c2e

Merge changes from topic "jas/rmm-el3-ifc" into integration

* changes:
docs(rmmd): document EL3-RMM Interfaces
feat(rmmd): add support to create a boot manifest
fix(rme): use RMM shared buffer

Merge changes from topic "jas/rmm-el3-ifc" into integration

* changes:
docs(rmmd): document EL3-RMM Interfaces
feat(rmmd): add support to create a boot manifest
fix(rme): use RMM shared buffer for attest SMCs
feat(rmmd): add support for RMM Boot interface

show more ...

docs(rmmd): document EL3-RMM Interfaces

This patch documents the RMM-EL3 Boot and runtime interfaces.

Note that for the runtime interfaces, some services are not
documented in this patch and will b

docs(rmmd): document EL3-RMM Interfaces

This patch documents the RMM-EL3 Boot and runtime interfaces.

Note that for the runtime interfaces, some services are not
documented in this patch and will be added on a later doc patch.

These services are:

* RMMD_GTSI_DELEGATE
* RMMD_GTSI_UNDELEGATE
* RMMD_RMI_REQ_COMPLETE

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I8fcc89d91fe5a334c2f68c6bfd1fd672a8738b5c

show more ...

feat(rmmd): add support to create a boot manifest

This patch also adds an initial RMM Boot Manifest (v0.1) for fvp
platform.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Ch

feat(rmmd): add support to create a boot manifest

This patch also adds an initial RMM Boot Manifest (v0.1) for fvp
platform.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I1374f8f9cb207028f1820953cd2a5cf6d6c3b948

show more ...

feat(rmmd): add support for RMM Boot interface

This patch adds the infrastructure needed to pass boot arguments from
EL3 to RMM and allocates a shared buffer between both worlds that can
be used, am

feat(rmmd): add support for RMM Boot interface

This patch adds the infrastructure needed to pass boot arguments from
EL3 to RMM and allocates a shared buffer between both worlds that can
be used, among others, to pass a boot manifest to RMM. The buffer is
composed a single memory page be used by a later EL3 <-> RMM interface
by all CPUs.

The RMM boot manifest is not implemented by this patch.

In addition to that, this patch also enables support for RMM when
RESET_TO_BL31 is enabled.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Change-Id: I855cd4758ee3843eadd9fb482d70a6d18954d82a

show more ...

docs: add Manish Badarkhe to maintainer list

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I8fd116962bb9775e2f96faee37bbf73073e15512

Merge changes from topic "mb/gic600-errata" into integration

* changes:
refactor(arm): update BL2 base address
refactor(nxp): use DPG0 mask from Arm GICv3 header
fix(gic600): implement workaro

Merge changes from topic "mb/gic600-errata" into integration

* changes:
refactor(arm): update BL2 base address
refactor(nxp): use DPG0 mask from Arm GICv3 header
fix(gic600): implement workaround to forward highest priority interrupt

show more ...

Merge "docs(security): update security advisory for CVE-2022-23960" into integration

docs(security): update security advisory for CVE-2022-23960

Update advisory document following Spectre-BHB mitigation support for
additional CPUs.

Signed-off-by: Bipin Ravi <bipin.ravi@arm.com>
Cha

docs(security): update security advisory for CVE-2022-23960

Update advisory document following Spectre-BHB mitigation support for
additional CPUs.

Signed-off-by: Bipin Ravi <bipin.ravi@arm.com>
Change-Id: I4492397f18882f514beff4da06afe973acecf1f0

show more ...

Merge "fix(errata): workaround for Neoverse-V1 erratum 2372203" into integration

Merge "fix(errata): workaround for Cortex-A77 erratum 2356587" into integration

fix(errata): workaround for Cortex-A77 erratum 2356587

Cortex-A77 erratum 2356587 is a cat B erratum that applies to revisions
r0p0 - r1p1 and is still open. The workaround is to set bit[0] of
CPUAC

fix(errata): workaround for Cortex-A77 erratum 2356587

Cortex-A77 erratum 2356587 is a cat B erratum that applies to revisions
r0p0 - r1p1 and is still open. The workaround is to set bit[0] of
CPUACTLR2_EL1 to force PLDW/PFRM ST to behave like PLD/PRFM LD and not
cause invalidations to other PE caches.

SDEN can be found here:
https://developer.arm.com/documentation/SDEN1152370/latest

Signed-off-by: Bipin Ravi <bipin.ravi@arm.com>
Change-Id: I243cfd587bca06ffd2a7be5bce28f8d2c5e68230

show more ...

fix(errata): workaround for Neoverse-V1 erratum 2372203

Neoverse-V1 erratum 2372203 is a cat B erratum that applies to revisions
r0p0 - r1p1 and is still open. The workaround is to set bit[40] of
CP

fix(errata): workaround for Neoverse-V1 erratum 2372203

Neoverse-V1 erratum 2372203 is a cat B erratum that applies to revisions
r0p0 - r1p1 and is still open. The workaround is to set bit[40] of
CPUACTLR2_EL1 to disable folding of demand requests into older
prefetches with L2 miss requests outstanding.

SDEN can be found here:
https://developer.arm.com/documentation/SDEN1401781/latest

Signed-off-by: Bipin Ravi <bipin.ravi@arm.com>
Change-Id: Ice8c2e5a0152972a35219c8245a2e07e646d0557

show more ...

fix(gic600): implement workaround to forward highest priority interrupt

If the interrupt being targeted is released from the CPU before the
CLEAR command is sent to the CPU then a subsequent SET com

fix(gic600): implement workaround to forward highest priority interrupt

If the interrupt being targeted is released from the CPU before the
CLEAR command is sent to the CPU then a subsequent SET command may not
be delivered in a finite time. To workaround this, issue an unblocking
event by toggling GICR_CTLR.DPG* bits after clearing the cpu group
enable (EnableGrp* bits of GIC CPU interface register)
This fix is implemented as per the errata 2384374-part 2 workaround
mentioned here:
https://developer.arm.com/documentation/sden892601/latest/

Change-Id: I13926ceeb7740fa4c05cc5b43170e7ce49598f70
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(errata): workaround for Neoverse-V1 erratum 2294912

Neoverse-V1 erratum 2294912 is a cat B erratum that applies to revisions
r0p0 - r1p1 and is still open. The workaround is to set bit[0] of
CPU

fix(errata): workaround for Neoverse-V1 erratum 2294912

Neoverse-V1 erratum 2294912 is a cat B erratum that applies to revisions
r0p0 - r1p1 and is still open. The workaround is to set bit[0] of
CPUACTLR2_EL1 to force PLDW/PFRM ST to behave like PLD/PRFM LD and not
cause invalidations to other PE caches.

SDEN can be found here:
https://developer.arm.com/documentation/SDEN1401781/latest

Signed-off-by: Bipin Ravi <bipin.ravi@arm.com>
Change-Id: Ia7afb4c42fe66b36fdf38a7d4281a0d168f68354

show more ...