feat(bl2): support RESET_TO_BL2 and ENABLE_RME

When RSE is used as the root of trust along with CPU that supports RME
there is a need to enable both RESET_TO_BL2 and ENABLE_RME.

In current bl2_main

feat(bl2): support RESET_TO_BL2 and ENABLE_RME

When RSE is used as the root of trust along with CPU that supports RME
there is a need to enable both RESET_TO_BL2 and ENABLE_RME.

In current bl2_main there are two different code paths for RESET_BL2,
one handles BL2 running in EL1 and other for BL2 running in EL3.

When RME is enabled, BL2 always runs at EL3 but the current flow calls
bl2_early_platform_setup2, bl2_plat_arch_setup instead of
bl2_el3_early_platform_setup, bl2_el3_plat_arch_setup. Adding RME,
TRANSFER_LIST, ROMLIB support in bl2_el3_* helpers makes
arm_bl2_el3_setup.c almost identical to arm_bl2_setup.c.

This patch removes bl2_el3_plat helpers and related files. Now different
combinations of RESET_TO_BL2, ENABLE_RME are handled in common bl2_setup
routines in arm_bl2_setup.c. This helps to have common place to support
new features and build flags for BL2 irrespective of which EL the BL2
runs.

BREAKING-CHANGE: This patch also changes all existing platform files and
functions that use format bl2_el3_* to bl2_plat helpers. If any platform
or out-of-tree platforms that need to support running BL2 in EL1 or EL3
must now handle it in bl2_early_platform_setup2 and bl2_plat_arch_setup.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I8d332dbe2de1db3b69319496c8d04626cdcf4140

show more ...

fix(arm): build fails on RESET_TO_BL2=1 and ARM_FW_CONFIG_LOAD_ENABLE=1

Use ARM_FW_CONFIG_BASE and ARM_FW_CONFIG_MAX_SIZE instead of platform
macros PLAT_FW_CONFIG_BASE and PLAT_FW_CONFIG_MAX_SIZE w

fix(arm): build fails on RESET_TO_BL2=1 and ARM_FW_CONFIG_LOAD_ENABLE=1

Use ARM_FW_CONFIG_BASE and ARM_FW_CONFIG_MAX_SIZE instead of platform
macros PLAT_FW_CONFIG_BASE and PLAT_FW_CONFIG_MAX_SIZE when
RESET_TO_BL2 and ARM_FW_CONFIG_LOAD_ENABLE are set to 1.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I0848852250eba5a3328e25cbea4fff413f344327

show more ...

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL32 build flag is set.

Enable decryption support for FVP through setting the DECRYPTION_SUPPORT
build flag. "DECRYPTION_SUPPORT = aes_gcm" is set to perform authenticated
decryption using AES-GCM algorithm.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iebc3b360b4a0dc0d933b816d28015ac551b79405

show more ...

fix(arm): derive RMM bank size from payload

Compute the RMM bank size as half of the RMM payload size instead of
using a hardcoded value. This removes duplication and keeps the bank
size automatical

fix(arm): derive RMM bank size from payload

Compute the RMM bank size as half of the RMM payload size instead of
using a hardcoded value. This removes duplication and keeps the bank
size automatically in sync with payload size changes.

Change-Id: I064390ec50115929bf6248344bf08a19fbc15344
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(arm): move lfa componet header to common and fix the helper

Move the FVP LFA component definitions to include/plat/arm/common/
so they can be shared by all Arm platforms, and update include
path

fix(arm): move lfa componet header to common and fix the helper

Move the FVP LFA component definitions to include/plat/arm/common/
so they can be shared by all Arm platforms, and update include
paths accordingly.

On FVP, rename the input parameter to lfa_component_id to match
the function declaration, and fix callers to pass the component
ID (not image_id) to the prime-complete helper.

Change-Id: Ia1485096819d6523c4bee14c602cbde3c6e144ef
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "rmm-lfa" into integration

* changes:
feat(arm): handle RMM ep_info during LFA
feat(lfa): add helper to check LFA prime completion status
feat(lfa): enable LFA of RMM

Merge changes from topic "rmm-lfa" into integration

* changes:
feat(arm): handle RMM ep_info during LFA
feat(lfa): add helper to check LFA prime completion status
feat(lfa): enable LFA of RMM
chore(lfa): use standard int return type for prime/activate callbacks
feat(rmmd): add warm reset helpers for primary and secondary CPUs

show more ...

Merge "fix(arm): don't override the gic redistributor frames" into integration

refactor(arm/common): gate coherency behind flag

Introduce a macro guard so platform coherency functions are only
compiled when HW_ASSISTED_COHERENCY is 0 (disabled). Many platforms
enable HW-assist

refactor(arm/common): gate coherency behind flag

Introduce a macro guard so platform coherency functions are only
compiled when HW_ASSISTED_COHERENCY is 0 (disabled). Many platforms
enable HW-assisted coherency by default, so compiling empty
definitions is unnecessary.

This refactor removes those empty functions for Arm CSS platforms.

Change-Id: I102ead46960e9da2d8b968f60cbfd3e5e5da1096
Signed-off-by: Ahmed Azeem <ahmed.azeem@arm.com>

show more ...

fix(arm): don't override the gic redistributor frames

Patch 75170704c made an oversight - it would provide a default value for
the gicr_frames variable but would always set to it, regardless of
whet

fix(arm): don't override the gic redistributor frames

Patch 75170704c made an oversight - it would provide a default value for
the gicr_frames variable but would always set to it, regardless of
whether the platform might want to use something different. The thinking
was to provide a default and then let each platform override it, however
the order was swapped.

To fix this, put the gic_set_gicr_frames() in bl31_platform_setup()
rather than arm_bl31_platform_setup(). This way, platforms that use the
default can still enjoy it automatically pulled in from common code,
platforms that need fully custom gicr_frames can simply set it, and
platforms that override bl31_platform_setup() for unrelated reasons only
have to redo the call to gic_set_gicr_frames(). This has a tiny benefit
over the old approach in that there will never be 2 gicr_frames arrays.

Change-Id: I734737d3bd37ddbb3286abcdd92c88676c68cdc3
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(arm): handle RMM ep_info during LFA

Update the logic for next image handoff to correctly manage the
RMM entry point information when LFA is in progress.
This ensures control is passed back into

feat(arm): handle RMM ep_info during LFA

Update the logic for next image handoff to correctly manage the
RMM entry point information when LFA is in progress.
This ensures control is passed back into RMM during the
activation sequence.

This change only affects during LFA run, normal boot behavior
is unchanged.

Change-Id: I8f85e9a7e0a7e9dab196c69ecf55abb9e7717982
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

feat(rmmd): add RMM_RESERVE_MEMORY SMC handler

At the moment any memory required by an R-EL2 manager (RMM) needs to
be known at compile time: that sets the size of the .data and .bss
segments. Some

feat(rmmd): add RMM_RESERVE_MEMORY SMC handler

At the moment any memory required by an R-EL2 manager (RMM) needs to
be known at compile time: that sets the size of the .data and .bss
segments. Some resources depend on the particular machine this will be
running on, the prime example is TF-RMM's granule array, which needs to
know the maximum memory supported beforehand. Other data structures
might depend on the number of CPU cores.

To provide more flexibility, but keep the memory footprint as small as
possible, let's introduce some memory reservation SMC. Any RMM
implementation can ask EL3 for some memory, and would get the physical
address of a usable chunk of memory back. This must happen at RMM boot
time, so before the RMM concluded the boot phase with the
RMM_BOOT_COMPLETE SMC call. Also there is no provision to free memory
again, this would not be needed for the use case of sizing platform
resources, and avoids the complexity of a full-fledged memory allocator.

Add the new RMM_RESERVE_MEMORY command to the implementation defined
RMM-EL3 SMC interface, both in code and documentation. The actual memory
reservation is made a platform implementation, but a simple
implementation is provided, which is used for the FVP platform already:
it will just pick the next matching chunk of memory from the top end of
the RMM carveout. This way the memory reservation will grow down from
the end of the carveout, in a stack-like fashion, until it reaches the
end of the RMM payload, located at the beginning of the carveout. Since
secondary cores might also reserve memory at boot time, there is a
spinlock to protect the simple allocation algorithm.
Other platforms can choose to provide a more sophisticated reservation
algorithm, for instance one taking NUMA locality into account.

This patch just provides the call, at this point there is no obligation
to use the feature, although future TF-RMM versions would rely on it.

Change-Id: I096ac8870ee38f44e18850779fcae829a43a8fd1
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fix(drtm): remove plat_system_reset()

The name plat_system_reset() has been in use for some time by a mediatek
platform (in plat/mediatek/mt8173/plat_pm.c). However, DRTM added a
global hook, that i

fix(drtm): remove plat_system_reset()

The name plat_system_reset() has been in use for some time by a mediatek
platform (in plat/mediatek/mt8173/plat_pm.c). However, DRTM added a
global hook, that is only implemented on FVP, that conflicts with it.
This sometimes results in failed builds.

DRTM remediation ends with a platform reset. However, there is currently
an error message printed that this is not supported. In this case, the
correct thing to do is to panic and as such this hook is not needed.

Further, the correct sequence to reset the system is different and is
only fully implemented by psci_system_reset(). This is a portable
implementation supported by a wide variety of platform.

So remove plat_system_reset(). Once DRTM remediation properly supports
resetting, the psci_system_reset() function should be used to achieve
reset correctly and portably.

Change-Id: Ia4e150c51aeec613838464fbb0e1d0542f19ccab
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(gicv3): clarify redistributor base address usage with USE_GIC_DRIVER=3

The GICv3 driver has 2 methods of discovering the redistributors:
a) via setting gicr_base - done at boot and assumes

refactor(gicv3): clarify redistributor base address usage with USE_GIC_DRIVER=3

The GICv3 driver has 2 methods of discovering the redistributors:
a) via setting gicr_base - done at boot and assumes all GICR frames are
contiguous. This is the original method.

b) via gicv3_rdistif_probe() - called from platform code and requires
gicr_base == 0. It relaxes the requirement for frames to be
contiguous, like in a multichip configuration, and defers the
discovery to core bringup. This was introduced later.

Configurations possible with option a) are also possible with option b)
with only slightly different behaviour. USE_GIC_DRIVER=3 inherited
option b) from plat_gicv3_base.c and as such option a) is unusable.
However, it is unclear from code how this should be used. Clarify this
by requiring platforms initialise with gic_set_gicr_frames() and
adding relevant comments.

Also rename plat_arm_override_gicr_frames() to gic_set_gicr_frames() as
this is not plat arm specific and a part of the generic GIC driver.

Change-Id: I61d77211f8e65dc54cf9904069b500d26a06b5a5
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(arm): unify SPSR retrieval logic

Consolidate platform-specific SPSR setup logic into a single
arm_get_spsr() function that accepts an image_id to select between BL32
and BL33. This reduces

refactor(arm): unify SPSR retrieval logic

Consolidate platform-specific SPSR setup logic into a single
arm_get_spsr() function that accepts an image_id to select between BL32
and BL33. This reduces duplication and simplifies control over SPSR
generation for later stages, particularly BL33.

The SPD remains responsible for setting the SPSR for BL32.

Change-Id: Ibbba708d607e7676989f5c7ceffe33d7bb2195f1
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(arm): add pseudo CRB area

To support StandaloneMm with fTPM, add pseudo CRB areas used by fTPM.
These areas are allocated:
- For Normal world localities (0 ~ 3), allocates NS_CRB at
ARM_N

feat(arm): add pseudo CRB area

To support StandaloneMm with fTPM, add pseudo CRB areas used by fTPM.
These areas are allocated:
- For Normal world localities (0 ~ 3), allocates NS_CRB at
ARM_NS_DRAM1_BASE as much as 0x4000.
- For Secure world locality (4), allocates S_CRB at
the end of HEAP as much as 0x1000.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Change-Id: I71521a7b418fed4aae5a7d1ae5f8228955776b27

show more ...

feat(arm): introduce ARM_SPM_NS_MEM_BASE and move NS buffer

PLAT_SP_IMAGE_NS_BUF_BASE in arm_spm_def.h is located in
ARM_AP_TZC_DRAM1_BASE.
Because of this, to use PLAT_SP_IMAGE_NS_BUF_BASE in norma

feat(arm): introduce ARM_SPM_NS_MEM_BASE and move NS buffer

PLAT_SP_IMAGE_NS_BUF_BASE in arm_spm_def.h is located in
ARM_AP_TZC_DRAM1_BASE.
Because of this, to use PLAT_SP_IMAGE_NS_BUF_BASE in normal world,
the TZC region configuration is required like this:

0: ARM_AP_TZC_DRAM1_BASE to PLAT_SP_IMAGE_NS_BUF_BASE (secure only)
1: PLAT_SP_IMAGE_NS_BUF_BASE to PLAT_SP_IMAGE_NS_BUF_SIZE
(ns and secure)
2: PLAT_SP_IMAGE_NS_BASE + PLAT_SP_IMAGE_NS_BUF_SIZE to
ARM_AP_TZC_DRAM1_BASE + ARM_EL3_TZC_DRAM1_END (secure only)

To reduce TZC area for PLAT_SP_IMAGE_NS_BUF_BASE
Let add ARM_SPM_NS_MEM_BASE where located in
(ARM_AP_TZC_DRAM1_BASE) - 1MB as much as 1MB.
and locate PLAT_SP_IMAGE_NS_BUF in this area.

So that reduce the TZC region in ARM_TZC_REGIONS_DEF.

Change-Id: Ia6170f5eec893dde2e3bbd85de46788c4bf35292
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

build(handoff)!: switch to LibTL submodule

Removes in-tree Transfer List implementation and updates all references
to use the external LibTL submodule. Updates include paths, Makefile
macros, and pl

build(handoff)!: switch to LibTL submodule

Removes in-tree Transfer List implementation and updates all references
to use the external LibTL submodule. Updates include paths, Makefile
macros, and platform integration logic to link with LibTL as a static
library.

If you cloned TF-A without the `--recurse-submodules` flag, you can
ensure that this submodule is present by running:

git submodule update --init --recursive

BREAKING-CHANGE: LibTL is now included in TF-A as a submodule.
Please run `git submodule update --init --recursive` if you encounter
issues after migrating to the latest version of TF-A.

Change-Id: I1fa31f7b730066c27985d968698e553b00b07c38
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(smcc): introduce a new vendor_el3 service for ACS SMC handler

In preparation to add support for the Architecture Compliance Suite
SMC services, reserve a SMC ID and introduce a handler function

feat(smcc): introduce a new vendor_el3 service for ACS SMC handler

In preparation to add support for the Architecture Compliance Suite
SMC services, reserve a SMC ID and introduce a handler function.
Currently, an empty placeholder function is added and future support
will be introduced for the handler support.

More info on System ACS, please refer below link,
https://developer.arm.com/Architectures/Architectural%20Compliance%20Suite

Signed-off-by: Nandan J <Nandan.J@arm.com>
Change-Id: Ib13ccae9d3829e3dcd1cd33c4a7f27efe1436d03

show more ...

fix(arm): update tsp_early_platform_setup prototype

The prototype for tsp_early_platform_setup has been redefined. Update
the platform implementation to match the new function signature and
ensure c

fix(arm): update tsp_early_platform_setup prototype

The prototype for tsp_early_platform_setup has been redefined. Update
the platform implementation to match the new function signature and
ensure compatibility with the updated TSP interface. Also, update the
prototype for arm_tsp_early_platform_setup to make use of these
arguments in common code.

Change-Id: I3831776be58d6ebf672890d0f30bbbd1780976f7
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

refactor(gic): promote most of the GIC driver to common code

More often than not, Arm based systems include some revision of a GIC.
There are two ways of adding support for them in platform code - c

refactor(gic): promote most of the GIC driver to common code

More often than not, Arm based systems include some revision of a GIC.
There are two ways of adding support for them in platform code - calling
the top-level helpers from plat/arm/common/arm_gicvX.c or by using the
driver directly. Both of these methods allow for a high degree of
customisation - most functions are defined to be weak and there are no
calls to any of them in generic code.

As it turns out, requirements around those GICs are largely the same.
Platforms that use arm_gicvX.c use the helpers identically among each
other. Platforms that use the driver directly tend to end up with calls
that look a lot like the arm_gicvX.c helpers and the weakness of the
functions are never exercised.

All of this results in a lot of code duplication to do what is
essentially the same thing. Even though it's not a lot of code, when
multiplied among many platforms it becomes significant and makes
refactoring it quite difficult. It's also bug prone since the steps are
a little convoluted and things are likely to work even with subtle
errors (see 50009f61177421118f42d6a000611ba0e613d54b).

So promote as much of the GIC to be called from common code. Do the
setup in bl31_main() and have every PSCI method do the state management
directly instead of delegating it to the platform hooks. We can base
this implementation on arm_gicvX.c since they already offer logical
names and have worked quite well so far with minimal changes.

The main benefit of doing this is reduced code duplication. If we assume
that, outside of some platform setup, GIC management is identical, then
a platform can add support by telling the build system, regardless of
GIC revision. The other benefit is performance - BL31 and PSCI already
know the core_pos and they can pass it as an argument instead of having
to call plat_my_core_pos(). Now, the only platform specific GIC actions
necessary are the saving and restoring of context on entering and
exiting a power domain. The PSCI library does not keep track of this so
it is unable perform it itself. The routines themselves are also
provided.

For compatibility all of this is hidden behind a build flag. Platforms
are encouraged to adopt this driver, but it would not be practical to
convert and validate every GIC based platform.

This patch renames the functions in question to follow the
gic_<function>() convention. This allows the names to be version
agnostic.

Finally, drop the weak definitions - they are unused, likely to remain
so, and can be added back if the need arises.

Change-Id: I5b5267f4b72f633fb1096400ec8e4b208694135f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(arm): support AArch32 booting with handoff

Configre SP-MIN to receive information via the firmare handoff
framework. In BL1 and BL2, select the 32-bit variants of the SRAM layout
and entry poin

feat(arm): support AArch32 booting with handoff

Configre SP-MIN to receive information via the firmare handoff
framework. In BL1 and BL2, select the 32-bit variants of the SRAM layout
and entry point info to enable booting in aarch32 mode. In SP-MIN
process expected data directly from the transfer list in secure memory.

Change-Id: If0417cdd4c47b772332eb6fd4b71ef0ea474f0fa
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

refactor(arm): simplify early platform setup function in BL31

Refactor `arm_bl31_early_platform_setup` to accept generic u_register_t
values, enabling support for firmware handoff boot arguments in

refactor(arm): simplify early platform setup function in BL31

Refactor `arm_bl31_early_platform_setup` to accept generic u_register_t
values, enabling support for firmware handoff boot arguments in
common code. This simplifies the interface for early platform setup.

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: Iff20300d2372e1a9825827ddccbd1b3bc6751e40

show more ...

refactor(arm): simplify early platform setup function in BL2

Refactor `arm_bl2_early_platform_setup` to accept generic u_register_t
values, enabling support for firmware handoff boot arguments in
co

refactor(arm): simplify early platform setup function in BL2

Refactor `arm_bl2_early_platform_setup` to accept generic u_register_t
values, enabling support for firmware handoff boot arguments in
common code. This simplifies the interface for early platform setup.

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: Ie0dbe4d32bbef22bd185fdafe50091a2ea5f550f

show more ...

refactor(arm): simplify early platform setup functions

Refactor `arm_sp_min_early_platform_setup` to accept generic
`u_register_r` values to support receiving firmware handoff boot
arguments in comm

refactor(arm): simplify early platform setup functions

Refactor `arm_sp_min_early_platform_setup` to accept generic
`u_register_r` values to support receiving firmware handoff boot
arguments in common code. This has the added benefit of simplifying the
interface into common early platform setup.

Change-Id: Idfc3d41f94f2bf3a3a0c7ca39f6b9b0013836e3a
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(fvp): increase GPT PPS to 1TB

- Increase PPS for FVP from 64GB to 1TB.
- GPT L0 table for 1TB PPS requires 8KB memory.
- Set FVP_TRUSTED_SRAM_SIZE to 384 with ENABLE_RME=1
option.
- Add 256MB

feat(fvp): increase GPT PPS to 1TB

- Increase PPS for FVP from 64GB to 1TB.
- GPT L0 table for 1TB PPS requires 8KB memory.
- Set FVP_TRUSTED_SRAM_SIZE to 384 with ENABLE_RME=1
option.
- Add 256MB of PCIe memory region 1 and 3GB of
PCIe memory region 2 to FVP PAS regions array.

Change-Id: Icadd528576f53c55b5d461ff4dcd357429ba622a
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>

show more ...