feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL32 build flag is set.

Enable decryption support for FVP through setting the DECRYPTION_SUPPORT
build flag. "DECRYPTION_SUPPORT = aes_gcm" is set to perform authenticated
decryption using AES-GCM algorithm.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iebc3b360b4a0dc0d933b816d28015ac551b79405

show more ...

Merge "fix(arm): derive RMM bank size from payload" into integration

Merge changes from topic "mb/lfa-rmm-test" into integration

* changes:
fix(rmmd): avoid race conditions in CPU finish
fix(arm): move lfa componet header to common and fix the helper
chore(lfa)

Merge changes from topic "mb/lfa-rmm-test" into integration

* changes:
fix(rmmd): avoid race conditions in CPU finish
fix(arm): move lfa componet header to common and fix the helper
chore(lfa): rename component_id to lfa_component_id

show more ...

Merge changes from topic "xl/fwu-trial-run" into integration

* changes:
fix(fwu): fwu NV ctr upgraded on trial run
feat(docs): platform hook for whether NV ctr is shared
feat(fwu): add platfor

Merge changes from topic "xl/fwu-trial-run" into integration

* changes:
fix(fwu): fwu NV ctr upgraded on trial run
feat(docs): platform hook for whether NV ctr is shared
feat(fwu): add platform hook for shared NV ctr

show more ...

feat(fwu): add platform hook for shared NV ctr

The NV ctr should not update when it is shared among
Bl1 and BL2. This is platform specific, therefore add
a platform hook to query the platform for th

feat(fwu): add platform hook for shared NV ctr

The NV ctr should not update when it is shared among
Bl1 and BL2. This is platform specific, therefore add
a platform hook to query the platform for this infor-
mation.

Change-Id: Ib180c8e6a183f7aaa7586e3f008273860d55b414
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

fix(css): don't require the GICC frame to be defined on GICv3

It's used for GICv2 operation, which won't happen with v3. CSS will
always use USE_GIC_DRIVER with the correct version so we can rely on

fix(css): don't require the GICC frame to be defined on GICv3

It's used for GICv2 operation, which won't happen with v3. CSS will
always use USE_GIC_DRIVER with the correct version so we can rely on
that to skip passing the GICC frame.

Change-Id: I358b99646f98bd7c6ea398bc8d8900cc80ca15bb
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(arm): derive RMM bank size from payload

Compute the RMM bank size as half of the RMM payload size instead of
using a hardcoded value. This removes duplication and keeps the bank
size automatical

fix(arm): derive RMM bank size from payload

Compute the RMM bank size as half of the RMM payload size instead of
using a hardcoded value. This removes duplication and keeps the bank
size automatically in sync with payload size changes.

Change-Id: I064390ec50115929bf6248344bf08a19fbc15344
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(arm): move lfa componet header to common and fix the helper

Move the FVP LFA component definitions to include/plat/arm/common/
so they can be shared by all Arm platforms, and update include
path

fix(arm): move lfa componet header to common and fix the helper

Move the FVP LFA component definitions to include/plat/arm/common/
so they can be shared by all Arm platforms, and update include
paths accordingly.

On FVP, rename the input parameter to lfa_component_id to match
the function declaration, and fix callers to pass the component
ID (not image_id) to the prime-complete helper.

Change-Id: Ia1485096819d6523c4bee14c602cbde3c6e144ef
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "lfa-plat-activate" into integration

* changes:
feat(fvp): add stub implementation for plat_lfa_notify_activate()
feat(lfa): add platform hook for activation notification

Merge changes from topic "rmm-lfa" into integration

* changes:
feat(arm): handle RMM ep_info during LFA
feat(lfa): add helper to check LFA prime completion status
feat(lfa): enable LFA of RMM

Merge changes from topic "rmm-lfa" into integration

* changes:
feat(arm): handle RMM ep_info during LFA
feat(lfa): add helper to check LFA prime completion status
feat(lfa): enable LFA of RMM
chore(lfa): use standard int return type for prime/activate callbacks
feat(rmmd): add warm reset helpers for primary and secondary CPUs

show more ...

Merge "fix(arm): don't override the gic redistributor frames" into integration

feat(guid-partition): platform hook to log corrupted GPT

Notification of the GPT corruption can be beneficial,
using the handoff structure from BL2 to
BL32 for logging the GPT corruption information

feat(guid-partition): platform hook to log corrupted GPT

Notification of the GPT corruption can be beneficial,
using the handoff structure from BL2 to
BL32 for logging the GPT corruption information

Change-Id: Ie1af7eb6d97ec76f3f6d1cffad292782bdedda21
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

feat(lfa): add platform hook for activation notification

Introduce a new platform API, plat_lfa_notify_activate(), which allows
the platform to notify its security engine to begin component
activati

feat(lfa): add platform hook for activation notification

Introduce a new platform API, plat_lfa_notify_activate(), which allows
the platform to notify its security engine to begin component
activation. The function accepts a component identifier and should
return 0 on success or an error code on failure.

Documentation and header files are updated accordingly, and the call is
integrated into the LFA activation path.

Change-Id: Ic66aa675bba62633cc92992b965d144a6f9ef129
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

refactor(arm/common): gate coherency behind flag

Introduce a macro guard so platform coherency functions are only
compiled when HW_ASSISTED_COHERENCY is 0 (disabled). Many platforms
enable HW-assist

refactor(arm/common): gate coherency behind flag

Introduce a macro guard so platform coherency functions are only
compiled when HW_ASSISTED_COHERENCY is 0 (disabled). Many platforms
enable HW-assisted coherency by default, so compiling empty
definitions is unnecessary.

This refactor removes those empty functions for Arm CSS platforms.

Change-Id: I102ead46960e9da2d8b968f60cbfd3e5e5da1096
Signed-off-by: Ahmed Azeem <ahmed.azeem@arm.com>

show more ...

fix(arm): don't override the gic redistributor frames

Patch 75170704c made an oversight - it would provide a default value for
the gicr_frames variable but would always set to it, regardless of
whet

fix(arm): don't override the gic redistributor frames

Patch 75170704c made an oversight - it would provide a default value for
the gicr_frames variable but would always set to it, regardless of
whether the platform might want to use something different. The thinking
was to provide a default and then let each platform override it, however
the order was swapped.

To fix this, put the gic_set_gicr_frames() in bl31_platform_setup()
rather than arm_bl31_platform_setup(). This way, platforms that use the
default can still enjoy it automatically pulled in from common code,
platforms that need fully custom gicr_frames can simply set it, and
platforms that override bl31_platform_setup() for unrelated reasons only
have to redo the call to gic_set_gicr_frames(). This has a tiny benefit
over the old approach in that there will never be 2 gicr_frames arrays.

Change-Id: I734737d3bd37ddbb3286abcdd92c88676c68cdc3
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(arm): handle RMM ep_info during LFA

Update the logic for next image handoff to correctly manage the
RMM entry point information when LFA is in progress.
This ensures control is passed back into

feat(arm): handle RMM ep_info during LFA

Update the logic for next image handoff to correctly manage the
RMM entry point information when LFA is in progress.
This ensures control is passed back into RMM during the
activation sequence.

This change only affects during LFA run, normal boot behavior
is unchanged.

Change-Id: I8f85e9a7e0a7e9dab196c69ecf55abb9e7717982
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(platforms): typedef operands to match data type

This corrects the MISRA violation C2012-10.3:
The value of an expression shall not be assigned to an object with a
narrower essential type or of a

fix(platforms): typedef operands to match data type

This corrects the MISRA violation C2012-10.3:
The value of an expression shall not be assigned to an object with a
narrower essential type or of a different essential type category.
The condition is explicitly checked against 0U, appending 'U' and
typecasting for unsigned comparison.

Change-Id: I1ed3b7fc1866b34f1086e449ffe648f53c33b008
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...

Merge changes from topic "bk/no_blx_setup" into integration

* changes:
fix: replace stray BL2_AT_EL3 with RESET_TO_BL2
refactor(aarch64): move BL31 specific setup out of the PSCI entrypoint
re

Merge changes from topic "bk/no_blx_setup" into integration

* changes:
fix: replace stray BL2_AT_EL3 with RESET_TO_BL2
refactor(aarch64): move BL31 specific setup out of the PSCI entrypoint
refactor: unify blx_setup() and blx_main()
fix(bl2): unify the BL2 EL3 and RME entrypoints

show more ...

refactor(rmmd): modify MEC update call to meet FIRME

Previous version of MEC refresh call was not compliant with FIRME [1].
This patch modifies the call so it is compliant with the specification.

[

refactor(rmmd): modify MEC update call to meet FIRME

Previous version of MEC refresh call was not compliant with FIRME [1].
This patch modifies the call so it is compliant with the specification.

[1] https://developer.arm.com/documentation/den0149/1-0alp0/

Change-Id: I15a652a021561edca16e79d127e6f08975cf1361
Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>

show more ...

fix: replace stray BL2_AT_EL3 with RESET_TO_BL2

For FVP, patch 259b67c08 should have used the latter but introduced the
former. That was a mistake, correct it.

The nuvoton platform seems to have co

fix: replace stray BL2_AT_EL3 with RESET_TO_BL2

For FVP, patch 259b67c08 should have used the latter but introduced the
former. That was a mistake, correct it.

The nuvoton platform seems to have copied arm_def.h and would have been
missed at some point. Update that too.

Change-Id: I28123186bb4b69c5d5154dcdd24e5dee9d9e33b8
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(rmmd): add RMM_RESERVE_MEMORY SMC handler

At the moment any memory required by an R-EL2 manager (RMM) needs to
be known at compile time: that sets the size of the .data and .bss
segments. Some

feat(rmmd): add RMM_RESERVE_MEMORY SMC handler

At the moment any memory required by an R-EL2 manager (RMM) needs to
be known at compile time: that sets the size of the .data and .bss
segments. Some resources depend on the particular machine this will be
running on, the prime example is TF-RMM's granule array, which needs to
know the maximum memory supported beforehand. Other data structures
might depend on the number of CPU cores.

To provide more flexibility, but keep the memory footprint as small as
possible, let's introduce some memory reservation SMC. Any RMM
implementation can ask EL3 for some memory, and would get the physical
address of a usable chunk of memory back. This must happen at RMM boot
time, so before the RMM concluded the boot phase with the
RMM_BOOT_COMPLETE SMC call. Also there is no provision to free memory
again, this would not be needed for the use case of sizing platform
resources, and avoids the complexity of a full-fledged memory allocator.

Add the new RMM_RESERVE_MEMORY command to the implementation defined
RMM-EL3 SMC interface, both in code and documentation. The actual memory
reservation is made a platform implementation, but a simple
implementation is provided, which is used for the FVP platform already:
it will just pick the next matching chunk of memory from the top end of
the RMM carveout. This way the memory reservation will grow down from
the end of the carveout, in a stack-like fashion, until it reaches the
end of the RMM payload, located at the beginning of the carveout. Since
secondary cores might also reserve memory at boot time, there is a
spinlock to protect the simple allocation algorithm.
Other platforms can choose to provide a more sophisticated reservation
algorithm, for instance one taking NUMA locality into account.

This patch just provides the call, at this point there is no obligation
to use the feature, although future TF-RMM versions would rely on it.

Change-Id: I096ac8870ee38f44e18850779fcae829a43a8fd1
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fix(drtm): remove plat_system_reset()

The name plat_system_reset() has been in use for some time by a mediatek
platform (in plat/mediatek/mt8173/plat_pm.c). However, DRTM added a
global hook, that i

fix(drtm): remove plat_system_reset()

The name plat_system_reset() has been in use for some time by a mediatek
platform (in plat/mediatek/mt8173/plat_pm.c). However, DRTM added a
global hook, that is only implemented on FVP, that conflicts with it.
This sometimes results in failed builds.

DRTM remediation ends with a platform reset. However, there is currently
an error message printed that this is not supported. In this case, the
correct thing to do is to panic and as such this hook is not needed.

Further, the correct sequence to reset the system is different and is
only fully implemented by psci_system_reset(). This is a portable
implementation supported by a wide variety of platform.

So remove plat_system_reset(). Once DRTM remediation properly supports
resetting, the psci_system_reset() function should be used to achieve
reset correctly and portably.

Change-Id: Ia4e150c51aeec613838464fbb0e1d0542f19ccab
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(gicv3): clarify redistributor base address usage with USE_GIC_DRIVER=3

The GICv3 driver has 2 methods of discovering the redistributors:
a) via setting gicr_base - done at boot and assumes

refactor(gicv3): clarify redistributor base address usage with USE_GIC_DRIVER=3

The GICv3 driver has 2 methods of discovering the redistributors:
a) via setting gicr_base - done at boot and assumes all GICR frames are
contiguous. This is the original method.

b) via gicv3_rdistif_probe() - called from platform code and requires
gicr_base == 0. It relaxes the requirement for frames to be
contiguous, like in a multichip configuration, and defers the
discovery to core bringup. This was introduced later.

Configurations possible with option a) are also possible with option b)
with only slightly different behaviour. USE_GIC_DRIVER=3 inherited
option b) from plat_gicv3_base.c and as such option a) is unusable.
However, it is unclear from code how this should be used. Clarify this
by requiring platforms initialise with gic_set_gicr_frames() and
adding relevant comments.

Also rename plat_arm_override_gicr_frames() to gic_set_gicr_frames() as
this is not plat arm specific and a part of the generic GIC driver.

Change-Id: I61d77211f8e65dc54cf9904069b500d26a06b5a5
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(arm): unify SPSR retrieval logic

Consolidate platform-specific SPSR setup logic into a single
arm_get_spsr() function that accepts an image_id to select between BL32
and BL33. This reduces

refactor(arm): unify SPSR retrieval logic

Consolidate platform-specific SPSR setup logic into a single
arm_get_spsr() function that accepts an image_id to select between BL32
and BL33. This reduces duplication and simplifies control over SPSR
generation for later stages, particularly BL33.

The SPD remains responsible for setting the SPSR for BL32.

Change-Id: Ibbba708d607e7676989f5c7ceffe33d7bb2195f1
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge changes from topics "refactor_stmm", "stmm_crb_area", "stmm_with_xferlist" into integration

* changes:
feat(fvp): organize fvp_stmm_manifest.dts
feat(juno): add pseudo CRB area
feat(fvp)

Merge changes from topics "refactor_stmm", "stmm_crb_area", "stmm_with_xferlist" into integration

* changes:
feat(fvp): organize fvp_stmm_manifest.dts
feat(juno): add pseudo CRB area
feat(fvp): add pseudo CRB area
feat(arm): add pseudo CRB area
feat(juno): increase xtable for pseudo CRB
feat(fvp): increase xtable for pseudo CRB for SPMC_AT_EL3
feat(el3-spmc): deliver TPM event log via hob list
feat(el3-spmc): get sp_manifest via xferlist
feat(fvp): tos_fw_config with transfer list
feat(arm): load tos_fw_cfg using xferlist in SPMC_AT_EL3
feat(fvp): increase secure partition's table mapping count
feat(fvp): increase bl2 mmap tables for handoff

show more ...