Merge changes from topic "ja/boot_protocol" into integration

* changes:
fix(sptool): update Optee FF-A manifest
feat(sptool): delete c version of the sptool
feat(sptool): use python version of

Merge changes from topic "ja/boot_protocol" into integration

* changes:
fix(sptool): update Optee FF-A manifest
feat(sptool): delete c version of the sptool
feat(sptool): use python version of sptool
feat(sptool): python version of the sptool
refactor(sptool): use SpSetupActions in sp_mk_generator.py
feat(sptool): add python SpSetupActions framework

show more ...

fix(sptool): update Optee FF-A manifest

Change the OPTEE FF-A manifest to comply with changes to the sp pkg [1].
The sptool packs the image at the default offset of 0x4000, if it is not
provided in

fix(sptool): update Optee FF-A manifest

Change the OPTEE FF-A manifest to comply with changes to the sp pkg [1].
The sptool packs the image at the default offset of 0x4000, if it is not
provided in the arguments.

[1] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/14507

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: I647950410114f7fc24926696212bb7f8101390ac

show more ...

feat(fvp): update HW_CONFIG DT loading mechanism

Currently, HW-config is loaded into non-secure memory, which mean
a malicious NS-agent could tamper with it. Ideally, this shouldn't
be an issue sinc

feat(fvp): update HW_CONFIG DT loading mechanism

Currently, HW-config is loaded into non-secure memory, which mean
a malicious NS-agent could tamper with it. Ideally, this shouldn't
be an issue since no software runs in non-secure world at this time
(non-secure world has not been started yet).

It does not provide a guarantee though since malicious external
NS-agents can take control of this memory region for update/corruption
after BL2 loads it and before BL31/BL32/SP_MIN consumes it. The threat
is mapped to Threat ID#3 (Bypass authentication scenario) in threat
model [1].

Hence modified the code as below -
1. BL2 loads the HW_CONFIG into secure memory
2. BL2 makes a copy of the HW_CONFIG in the non-secure memory at an
address provided by the newly added property(ns-load-address) in
the 'hw-config' node of the FW_CONFIG
3. SP_MIN receives the FW_CONFIG address from BL2 via arg1 so that
it can retrieve details (address and size) of HW_CONFIG from
FW_CONFIG
4. A secure and non-secure HW_CONFIG address will eventually be used
by BL31/SP_MIN/BL32 and BL33 components respectively
5. BL31/SP_MIN dynamically maps the Secure HW_CONFIG region and reads
information from it to local variables (structures) and then
unmaps it
6. Reduce HW_CONFIG maximum size from 16MB to 1MB; it appears
sufficient, and it will also create a free space for any future
components to be added to memory

[1]: https://trustedfirmware-a.readthedocs.io/en/latest/threat_model/threat_model.html

Change-Id: I1d431f3e640ded60616604b1c33aa638b9a1e55e
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(fvp): op-tee sp manifest doesn't map gicd

Following I2d274fa897171807e39b0ce9c8a28824ff424534:
Remove GICD registers S2 mapping from OP-TEE partition when it runs in a
secure partition on top of

fix(fvp): op-tee sp manifest doesn't map gicd

Following I2d274fa897171807e39b0ce9c8a28824ff424534:
Remove GICD registers S2 mapping from OP-TEE partition when it runs in a
secure partition on top of Hafnium.
The partition is not meant to access the GIC directly but use the
Hafnium provided interfaces.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I1a38101f6ae9911662828734a3c9572642123f32

show more ...

fix(spmd): revert workaround hafnium as hypervisor

This change essentially reverts [1] by removing the BL31 workaround
forcing the dtb address when Hafnium is loaded as an Hypervisor.

[1] https://r

fix(spmd): revert workaround hafnium as hypervisor

This change essentially reverts [1] by removing the BL31 workaround
forcing the dtb address when Hafnium is loaded as an Hypervisor.

[1] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/9569

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I302161d027261448113c66b7fafa9c11620b54ef

show more ...

feat(measured_boot): update tb_fw_config with event log properties

Making tb_fw_config ready to pass the Event Log base address
and size information to BL2.

Change-Id: I5dd0e79007e3848b5d6d0e69275a

feat(measured_boot): update tb_fw_config with event log properties

Making tb_fw_config ready to pass the Event Log base address
and size information to BL2.

Change-Id: I5dd0e79007e3848b5d6d0e69275a46c2e9807a98
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

refactor(measured_boot): remove passing of BL2 hash via device tree

Subsequent patches will provide a solution to do the BL2 hash measurement
and recording in BL1 itself, hence in preparation to ado

refactor(measured_boot): remove passing of BL2 hash via device tree

Subsequent patches will provide a solution to do the BL2 hash measurement
and recording in BL1 itself, hence in preparation to adopt that solution
remove the logic of passing BL2 hash measurement to BL2 component
via TB_FW config.

Change-Id: Iff9b3d4c6a236a33b942898fcdf799cbab89b724
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix: OP-TEE SP manifest per latest SPMC changes

Update UUID to little endian:
The SPMC expects a little endian representation of the UUID as an array
of four integers in the SP manifest.

Add manage

fix: OP-TEE SP manifest per latest SPMC changes

Update UUID to little endian:
The SPMC expects a little endian representation of the UUID as an array
of four integers in the SP manifest.

Add managed exit field and cosmetic comments updates.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Icad93ca70bc27bc9d83b8cf888fe5f8839cb1288

show more ...

feat(fvp): enable external SP images in BL2 config

Currently the list of SP UUIDs loaded by BL2 is hardcoded in the DT.
This is a problem when building a system with other SPs (e.g. from
Trusted Ser

feat(fvp): enable external SP images in BL2 config

Currently the list of SP UUIDs loaded by BL2 is hardcoded in the DT.
This is a problem when building a system with other SPs (e.g. from
Trusted Services). This commit implements a workaround to enable adding
SP UUIDs to the list at build time.

Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
Change-Id: Iff85d3778596d23d777dec458f131bd7a8647031

show more ...

feat(ff-a): update FF-A version to v1.1

Bump the required FF-A version in framework and manifests to v1.1 as
upstream feature development goes.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com

feat(ff-a): update FF-A version to v1.1

Bump the required FF-A version in framework and manifests to v1.1 as
upstream feature development goes.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I89b2bd3828a13fc4344ccd53bc3ac9c0c22ab29f

show more ...

feat(ff-a): change manifest messaging method

Align documentation with changes of messaging method for partition
manifest:
- Bit[0]: support for receiving direct message requests
- Bit[1]

feat(ff-a): change manifest messaging method

Align documentation with changes of messaging method for partition
manifest:
- Bit[0]: support for receiving direct message requests
- Bit[1]: support for sending direct messages
- Bit[2]: support for indirect messaging
- Bit[3]: support for managed exit
Change the optee_sp_manifest to align with the new messaging method
description.

Signed-off-by: Maksims Svecovs <maksims.svecovs@arm.com>
Change-Id: I333e82c546c03698c95f0c77293018f8dca5ba9c

show more ...

feat(spm): add Ivy partition to tb fw config

The partition layout description JSON file generated by TF-A tests
declares a fourth test partition called Ivy demonstrating the
implementation of a S-EL

feat(spm): add Ivy partition to tb fw config

The partition layout description JSON file generated by TF-A tests
declares a fourth test partition called Ivy demonstrating the
implementation of a S-EL0 partition supported by a S-EL1 shim.

Change-Id: If8562acfc045d6496dfdb3df0524b3a069357f8e
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

show more ...

Merge changes from topic "od/cleanup-changes" into integration

* changes:
perf(spmd): omit sel1 context save if sel2 present
fix(fvp): spmc optee manifest remove SMC allowlist
fix: random typo

Merge changes from topic "od/cleanup-changes" into integration

* changes:
perf(spmd): omit sel1 context save if sel2 present
fix(fvp): spmc optee manifest remove SMC allowlist
fix: random typos in tf-a code base

show more ...

fix(fvp): spmc optee manifest remove SMC allowlist

Fix a remainder from early prototyping. OP-TEE as a secure partition
does not need specific SMC function id pass through to EL3.

Signed-off-by: Ol

fix(fvp): spmc optee manifest remove SMC allowlist

Fix a remainder from early prototyping. OP-TEE as a secure partition
does not need specific SMC function id pass through to EL3.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I2843d1b9a5eb4c966f82790e1655fb569c2de7d4

show more ...

fix(plat/arm): correct UUID strings in FVP DT

The UUID strings used in FW_CONFIG DT are not aligned with UUIDs defined
in include/tools_share/firmware_image_package.h for BL32_EXTRA1 and
TRUSTED_KEY

fix(plat/arm): correct UUID strings in FVP DT

The UUID strings used in FW_CONFIG DT are not aligned with UUIDs defined
in include/tools_share/firmware_image_package.h for BL32_EXTRA1 and
TRUSTED_KEY_CERT.

Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I517f8f9311585931f2cb931e0588414da449b694

show more ...

refactor(plat/arm): store UUID as a string, rather than ints

NOTE: Breaking change to the way UUIDs are stored in the DT

Currently, UUIDs are stored in the device tree as
sequences of 4 integers. T

refactor(plat/arm): store UUID as a string, rather than ints

NOTE: Breaking change to the way UUIDs are stored in the DT

Currently, UUIDs are stored in the device tree as
sequences of 4 integers. There is a mismatch in endianness
between the way UUIDs are represented in memory and the way
they are parsed from the device tree. As a result, we must either
store the UUIDs in little-endian format in the DT (which means
that they do not match up with their string representations)
or perform endianness conversion after parsing them.

Currently, TF-A chooses the second option, with unwieldy
endianness-conversion taking place after reading a UUID.

To fix this problem, and to make it convenient to copy and
paste UUIDs from other tools, change to store UUIDs in string
format, using a new wrapper function to parse them from the
device tree.

Change-Id: I38bd63c907be14e412f03ef0aab9dcabfba0eaa0
Signed-off-by: David Horstmann <david.horstmann@arm.com>

show more ...

plat/arm: move compile time switch from source to dt file

This will help in keeping source file generic and conditional
compilation can be contained in platform provided dt files.

Signed-off-by: Ma

plat/arm: move compile time switch from source to dt file

This will help in keeping source file generic and conditional
compilation can be contained in platform provided dt files.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I3c6e0a429073f0afb412b9ba521ce43f880b57fe

show more ...

plat/arm: don't provide NT_FW_CONFIG when booting hafnium

NT_FW_CONFIG file is meant to be passed from BL31 to be consumed by
BL33, fvp platforms use this to pass measured boot configuration and
the

plat/arm: don't provide NT_FW_CONFIG when booting hafnium

NT_FW_CONFIG file is meant to be passed from BL31 to be consumed by
BL33, fvp platforms use this to pass measured boot configuration and
the x0 register is used to pass the base address of it.

In case of hafnium used as hypervisor in normal world, hypervisor
manifest is expected to be passed from BL31 and its base address is
passed in x0 register.

As only one of NT_FW_CONFIG or hypervisor manifest base address can be
passed in x0 register and also measured boot is not required for SPM so
disable passing NT_FW_CONFIG.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ifad9d3658f55ba7d70f468a88997d5272339e53e

show more ...

SPM: declare third cactus instance as UP SP

The FF-A v1.0 spec allows two configurations for the number of EC/vCPU
instantiated in a Secure Partition:
-A MultiProcessor (MP) SP instantiates as many

SPM: declare third cactus instance as UP SP

The FF-A v1.0 spec allows two configurations for the number of EC/vCPU
instantiated in a Secure Partition:
-A MultiProcessor (MP) SP instantiates as many ECs as the number of PEs.
An EC is pinned to a corresponding physical CPU.
-An UniProcessor (UP) SP instantiates a single EC. The EC is migrated to
the physical CPU from which the FF-A call is originating.
This change permits exercising the latter case within the TF-A-tests
framework.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I7fae0e7b873f349b34e57de5cea496210123aea0

show more ...

spm: provide number of vCPUs and VM size for first SP

The primary VM concept is removed from the SPMC.
Update the SPMC manifests with number of Execution Contexts
and SP workspace size for the first

spm: provide number of vCPUs and VM size for first SP

The primary VM concept is removed from the SPMC.
Update the SPMC manifests with number of Execution Contexts
and SP workspace size for the first Secure Partition (as it
is done for NWd secondary VMs and other SPs).

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I3b9c52666f7dfe74ab1f7d2148ad0070ee44b54e

show more ...

spm: remove chosen node from SPMC manifests

The chosen node is no longer required as the SPMC implements
a specific boot flow which no longer requires this node.

Signed-off-by: Olivier Deprez <oliv

spm: remove chosen node from SPMC manifests

The chosen node is no longer required as the SPMC implements
a specific boot flow which no longer requires this node.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Ib566b602a7f83003a1b2d0ba5f6ebf4d8b7a9156

show more ...

spm: move OP-TEE SP manifest DTS to FVP platform

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I0981c43e2ef8172138f65d95eac7b20f8969394e

spm: remove device-memory node from SPMC manifests

The PVM concept is removed from the SPMC so the device-memory
node which is specifying the device memory range for the PVM
is no longer applicable.

spm: remove device-memory node from SPMC manifests

The PVM concept is removed from the SPMC so the device-memory
node which is specifying the device memory range for the PVM
is no longer applicable.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: If0cb956e0197028b24ecb78952c66ec454904516

show more ...