refactor(rmmd): plat token requests in pieces

Until now, the attestation token size was limited by the size of the
shared buffer between RMM and TF-A. With this change, RMM can now
request the token

refactor(rmmd): plat token requests in pieces

Until now, the attestation token size was limited by the size of the
shared buffer between RMM and TF-A. With this change, RMM can now
request the token in pieces, so they fit in the shared buffer. A new
output parameter was added to the SMC call, which will return (along
with the size of bytes copied into the buffer) the number of bytes
of the token that remain to be retrieved.

TF-A will keep an offset variable that will indicate the position in
the token where the next call will retrieve bytes from. This offset
will be increased on every call by adding the number number of bytes
copied. If the received hash size is not 0, TF-A will reset the
offset to 0 and copy from that position on.

The SMC call will now return at most the size of the shared buffer
in bytes on every call. Therefore, from now on, multiple SMC calls
may be needed to be issued if the token size exceeds the shared
buffer size.

Change-Id: I591f7013d06f64e98afaf9535dbea6f815799723
Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>

show more ...

feat(bl): add plat handler for image loading

In case of load error, platform may need to try another instance, either
from another storage, or from the same storage in case of PSA FWU. On
MTD device

feat(bl): add plat handler for image loading

In case of load error, platform may need to try another instance, either
from another storage, or from the same storage in case of PSA FWU. On
MTD devices such as NAND, it is required to define backup partitions.
A new function plat_setup_try_img_ops() should be called by platform
code to register handlers (plat_try_images_ops) to manage loading
other images.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Change-Id: Ideaecaf296c0037a26fb4e6680f33e507111378a

show more ...

refactor(bl)!: remove unused plat_try_next_boot_source

The plat_try_next_boot_source() API is not used by any upstream platform
and not used by platforms that asked for this API. It is then removed.

refactor(bl)!: remove unused plat_try_next_boot_source

The plat_try_next_boot_source() API is not used by any upstream platform
and not used by platforms that asked for this API. It is then removed.
It will be replaced with a more generic interface in next patch.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I298c7acace8c5efb3c66422d8d9280ecd08e5ade

show more ...

Merge changes from topic "early_console" into integration

* changes:
feat(stm32mp2): use early traces
feat(st-bsec): use early traces
refactor(st): replace STM32MP_EARLY_CONSOLE with EARLY_CON

Merge changes from topic "early_console" into integration

* changes:
feat(stm32mp2): use early traces
feat(st-bsec): use early traces
refactor(st): replace STM32MP_EARLY_CONSOLE with EARLY_CONSOLE
feat(console): introduce EARLY_CONSOLE
feat(bl32): create an sp_min_setup function

show more ...

refactor(bl1): clean up bl2 layout calculation

Layout calculation is spread out between core BL1 logic and common
platform code. Relocate these into common platform code so they are
organised logica

refactor(bl1): clean up bl2 layout calculation

Layout calculation is spread out between core BL1 logic and common
platform code. Relocate these into common platform code so they are
organised logically.

Change-Id: I8b05403e41b800957a0367316cecd373d10bb1a4
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(console): introduce EARLY_CONSOLE

This is a generic porting of what was done on ST platforms with flag
STM32MP_EARLY_CONSOLE. It creates the flag and the prototype for
plat_setup_early_console(

feat(console): introduce EARLY_CONSOLE

This is a generic porting of what was done on ST platforms with flag
STM32MP_EARLY_CONSOLE. It creates the flag and the prototype for
plat_setup_early_console(). This function depends on platform
implementation. This function call is added at the beginning of each BL
image early setup function.
The patch also introduce an extra log macro: EARLY_ERROR. This can
replace ERROR macro in code that will only be executed before the
default console is enabled, and will do nothing when the EARLY_CONSOLE
is not enabled. This can then save some space in memory.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I77bf0a0c4289b4c7df94e4bfb783a938e05bf023

show more ...

Merge changes from topic "DPE" into integration

* changes:
feat(tc): group components into certificates
feat(dice): add cert_id argument to dpe_derive_context()
refactor(sds): modify log level

Merge changes from topic "DPE" into integration

* changes:
feat(tc): group components into certificates
feat(dice): add cert_id argument to dpe_derive_context()
refactor(sds): modify log level for region validity
feat(tc): add dummy TRNG support to be able to boot pVMs
feat(tc): get the parent component provided DPE context_handle
feat(tc): share DPE context handle with child component
feat(tc): add DPE context handle node to device tree
feat(tc): add DPE backend to the measured boot framework
feat(auth): add explicit entries for key OIDs
feat(dice): add DPE driver to measured boot
feat(dice): add client API for DICE Protection Environment
feat(dice): add QCBOR library as a dependency of DPE
feat(dice): add typedefs from the Open DICE repo
docs(changelog): add 'dice' scope
refactor(tc): align image identifier string macros
refactor(fvp): align image identifier string macros
refactor(imx8m): align image identifier string macros
refactor(qemu): align image identifier string macros
fix(measured-boot): add missing image identifier string
refactor(measured-boot): move metadata size macros to a common header
refactor(measured-boot): move image identifier strings to a common header

show more ...

Merge "fix(gic600): workaround for Part 1 of GIC600 erratum 2384374" into integration

fix(gic600): workaround for Part 1 of GIC600 erratum 2384374

GIC600 erratum 2384374 is a Category B erratum. Part 1 is fixed
in this patch, and the Part 1 failure mode is described as
'If the packet

fix(gic600): workaround for Part 1 of GIC600 erratum 2384374

GIC600 erratum 2384374 is a Category B erratum. Part 1 is fixed
in this patch, and the Part 1 failure mode is described as
'If the packet to be sent is a SET packet, then a higher priority SET
may not be sent when it should be until an unblocking event occurs.'

This is handled by calling gicv3_apply_errata_wa_2384374() in the
ehf_deactivate_priority() path, so that when EHF restores the priority
to the original priority, the interrupt packet buffered
in the GIC can be sent.

gicv3_apply_errata_wa_2384374() is the workaround for
the Part 2 of erratum 2384374 which flush packets from the GIC buffer
and is being used in this patch.

SDEN can be found here:
https://developer.arm.com/documentation/sden892601/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I4bb6dcf86c94125cbc574e0dc5119abe43e84731

show more ...

feat(tc): add DPE backend to the measured boot framework

The client platform relies on the DICE attestation
scheme. RSS provides the DICE Protection Environment
(DPE) service. TF-A measured boot fra

feat(tc): add DPE backend to the measured boot framework

The client platform relies on the DICE attestation
scheme. RSS provides the DICE Protection Environment
(DPE) service. TF-A measured boot framework supports
multiple backends. A given platform always enables
the corresponding backend which is required by the
attestation scheme.

Signed-off-by: Tamas Ban <tamas.ban@arm.com>
Change-Id: Idc3360d0d7216e4859e99b5db3d377407e0aeee5

show more ...

feat(drtm): update references to DRTM beta0

Update all references to DRTM beta0 to be 1.0 instead.

Signed-off-by: Stuart Yoder <stuart.yoder@arm.com>
Change-Id: Ieda70f26f3be42f4705e9b267706674c94f

feat(drtm): update references to DRTM beta0

Update all references to DRTM beta0 to be 1.0 instead.

Signed-off-by: Stuart Yoder <stuart.yoder@arm.com>
Change-Id: Ieda70f26f3be42f4705e9b267706674c94f120f2

show more ...

feat(drtm): for TPM features fw hash algorithm should be 16-bits

The DRTM 1.0 spec changed the Firmware hash algorithm field
size from 32-bits to 16-bits.

Signed-off-by: Stuart Yoder <stuart.yoder@

feat(drtm): for TPM features fw hash algorithm should be 16-bits

The DRTM 1.0 spec changed the Firmware hash algorithm field
size from 32-bits to 16-bits.

Signed-off-by: Stuart Yoder <stuart.yoder@arm.com>
Change-Id: I713e32e01b1983bf21d97c93bbb28c77dc94a541

show more ...

feat(platforms): update SZ_* macros

Use unsigned long values for __aarch64__ version of SZ_* macros.
This allows using masks with ~SZ_* without losing the 32 upper bits.

Signed-off-by: Yann Gautier

feat(platforms): update SZ_* macros

Use unsigned long values for __aarch64__ version of SZ_* macros.
This allows using masks with ~SZ_* without losing the 32 upper bits.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: Ie485fad65088df17e6c489ebb3159220d6add647

show more ...

fix(smccc): ensure that mpidr passed through SMC is valid

There are various SMC calls which pass mpidr as an argument which is
currently tested at random places in SMC call path.
To make the mpidr v

fix(smccc): ensure that mpidr passed through SMC is valid

There are various SMC calls which pass mpidr as an argument which is
currently tested at random places in SMC call path.
To make the mpidr validation check consistent across SMC calls, do
this check as part of SMC argument validation.

This patch introduce a helper function is_valid_mpidr() to validate
mpidr and call it as part of validating SMC arguments at starting of
SMC handlers (which expect mpidr as an argument).

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I11ea50e22caf17896cf4b2059b87029b2ba136b1

show more ...

refactor(el3-runtime): plat_ic_has_interrupt_type returns bool

Rather than returning 0 or 1, the above function returns bool false
or true. No functional change.

Change-Id: Iea904ffc368568208fa8203

refactor(el3-runtime): plat_ic_has_interrupt_type returns bool

Rather than returning 0 or 1, the above function returns bool false
or true. No functional change.

Change-Id: Iea904ffc368568208fa8203e0d2e0cdaa500b1e0
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...