feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME rela

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME related support is now enabled using feature detection option
ENABLE_FEAT_RME, this patch moves GPT support under ENABLE_FEAT_RME.

This change brings in below benefits:
- single TF-A build that works for RME and non-RME systems, when
build with ENABLE_FEAT_RME=2 (FEAT_STATE_CHECK)
- RMM loading is optional on RME systems
- SiP calls that leverages RME features to change the PAS of a memory
range from non-secure to secure is supported without need to enable
Realm PAS or RMM.
- FIRME Granule Management Interface (GMI) ABIs that handles
FEAT_RME_GPC2/FEAT_RME_GDI can be enabled without need to enable RMM

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I88d9d4e0491af2b4ae0307c018f2d4a71ee6693f

show more ...

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option perfor

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option performs RMM-specific tasks such as GPT setup, loading the RMM,
and enabling RMMD support.

Since ENABLE_RME now only controls RMM-related functionality, rename it
to ENABLE_RMM to better reflect its purpose and avoid confusion with
ENABLE_FEAT_RME.

For backward compatibility, setting the legacy ENABLE_RME=1 (until it is
deprecated) will automatically enable both ENABLE_FEAT_RME and
ENABLE_RMM.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Iac945bdffe5002161bf1161b81a5aa7abec68192

show more ...

Merge "feat(firme): initial commit of FIRME service" into integration

feat(firme): initial commit of FIRME service

This is the first FIRME service patch that adds support for basic ABIs
for retrieving the FIRME version, features, and GPI_SET.

This adds a new generic

feat(firme): initial commit of FIRME service

This is the first FIRME service patch that adds support for basic ABIs
for retrieving the FIRME version, features, and GPI_SET.

This adds a new generic granule transition function that replaces
the existing delegate/undelegate APIs that GPI_SET uses. It also
updates TRP to use GPI_SET when FIRME is supported.

FIRME spec is here, note that it is ALPHA2 quality so further changes
are to be expected:
https://developer.arm.com/documentation/den0149

Change-Id: I57b8ad7e87a0679e15c8247f8457f91f3254dedb
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(gic): init the GIC before the platform with a hook

While GIC setup is generic across platforms, its usage is not. Some
platforms won't use it at EL3, while others need to configure interrupts
(l

fix(gic): init the GIC before the platform with a hook

While GIC setup is generic across platforms, its usage is not. Some
platforms won't use it at EL3, while others need to configure interrupts
(like RAS) in the standard platform hooks. To do that, the GIC needs to
be set up and ready to use before calling the platform hooks but
currently that is only done after. Annoyingly, a handful of platforms
need to set their GIC up before initialising it necessitating the
platform hooks to be called before GIC init.

This patch resolves this contradiction by moving the general GIC setup
calls to before the platform hooks and adding a GIC-specific platform
hook just before GIC per CPU init. This way both types of platforms can
do their business at the same time.

Change-Id: I361f587ab4603162ee880addb074800cbbb97b49
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(arm): set the transfer list up earlier

It is needed to break the cyclic dependency between platform code and
GIC code. This allows GIC code to use FCONF without depending on the
rest of the

refactor(arm): set the transfer list up earlier

It is needed to break the cyclic dependency between platform code and
GIC code. This allows GIC code to use FCONF without depending on the
rest of the platform setup.

Change-Id: Idc704ece9c2292f23620448a0c87073114df87b0
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(el3-runtime): use arm_gicr_base_addrs for sp-min

Makes code ever so slightly simpler

Change-Id: I5529dbe5e0d134ebd4528a4187b259738ec7974b
Signed-off-by: Boyan Karatotev <boyan.karatotev@ar

refactor(el3-runtime): use arm_gicr_base_addrs for sp-min

Makes code ever so slightly simpler

Change-Id: I5529dbe5e0d134ebd4528a4187b259738ec7974b
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(arm): gate trusted watchdog by boot flow

Disabling the trusted watchdog is not tied to ENABLE_RME but to the boot
flow. In the default boot flow, BL1 starts the watchdog and stops it
after

refactor(arm): gate trusted watchdog by boot flow

Disabling the trusted watchdog is not tied to ENABLE_RME but to the boot
flow. In the default boot flow, BL1 starts the watchdog and stops it
after BL2 returns control before exiting BL1.

In an RME-enabled boot flow, BL2 runs at EL3 and boots BL31, never
returning control to BL1, so the watchdog is not stopped in BL1. Use
BL2_RUNS_AT_EL3 instead of ENABLE_RME to control watchdog disabling.

This change prepares the codebase for later patches that add feature
detection support for RME.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I89871c119bdbbc357d49a12ac84553aa83477650

show more ...

Merge "fix(build): use assignment instead of memcpy to avoid a GCC 11 bug" into integration

fix(build): use the correct value of host-poetry

The build system reads the POETRY variable and
internally sets host-poetry to the correct path
of the poetry tool. Update the build files to always
u

fix(build): use the correct value of host-poetry

The build system reads the POETRY variable and
internally sets host-poetry to the correct path
of the poetry tool. Update the build files to always
use the internal variable to run the tool.

Change-Id: I5acec9530a80661b0dcda8fba64abaa9d09165e9
Signed-off-by: Andrei Homescu <ahomescu@xwf.google.com>

show more ...

feat(bl2): support RESET_TO_BL2 and ENABLE_RME

When RSE is used as the root of trust along with CPU that supports RME
there is a need to enable both RESET_TO_BL2 and ENABLE_RME.

In current bl2_main

feat(bl2): support RESET_TO_BL2 and ENABLE_RME

When RSE is used as the root of trust along with CPU that supports RME
there is a need to enable both RESET_TO_BL2 and ENABLE_RME.

In current bl2_main there are two different code paths for RESET_BL2,
one handles BL2 running in EL1 and other for BL2 running in EL3.

When RME is enabled, BL2 always runs at EL3 but the current flow calls
bl2_early_platform_setup2, bl2_plat_arch_setup instead of
bl2_el3_early_platform_setup, bl2_el3_plat_arch_setup. Adding RME,
TRANSFER_LIST, ROMLIB support in bl2_el3_* helpers makes
arm_bl2_el3_setup.c almost identical to arm_bl2_setup.c.

This patch removes bl2_el3_plat helpers and related files. Now different
combinations of RESET_TO_BL2, ENABLE_RME are handled in common bl2_setup
routines in arm_bl2_setup.c. This helps to have common place to support
new features and build flags for BL2 irrespective of which EL the BL2
runs.

BREAKING-CHANGE: This patch also changes all existing platform files and
functions that use format bl2_el3_* to bl2_plat helpers. If any platform
or out-of-tree platforms that need to support running BL2 in EL1 or EL3
must now handle it in bl2_early_platform_setup2 and bl2_plat_arch_setup.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I8d332dbe2de1db3b69319496c8d04626cdcf4140

show more ...

fix(arm): support FCONF when TRANSFER_LIST and RESET_BL2 is set

Enable reading HW_CONFIG device tree from transfer list entry when
RESET_BL2 is enabled.

Signed-off-by: Arunachalam Ganapathy <arunac

fix(arm): support FCONF when TRANSFER_LIST and RESET_BL2 is set

Enable reading HW_CONFIG device tree from transfer list entry when
RESET_BL2 is enabled.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Ibcd65f3946924670ede3ba354db5bc574c70b4be

show more ...

Merge changes I2485d583,I1374c482,I07e29dbb,I949e6486 into integration

* changes:
feat(qemu): enable ENABLE_FEAT_RAS and ENABLE_FEAT_SB
feat(cpufeat): update FEAT_SB's FEAT_STATE_CHECKED status

Merge changes I2485d583,I1374c482,I07e29dbb,I949e6486 into integration

* changes:
feat(qemu): enable ENABLE_FEAT_RAS and ENABLE_FEAT_SB
feat(cpufeat): update FEAT_SB's FEAT_STATE_CHECKED status
feat(cpufeat): advertise support for FEAT_RASv2
feat(cpufeat): enable FEAT_RAS for FEAT_STATE_CHECKED again

show more ...

feat(cpufeat): enable FEAT_RAS for FEAT_STATE_CHECKED again

FEAT_RAS was originally converted to FEAT_STATE_CHECKED in 6503ff291.
However, the ability to use it was removed with 970a4a8d8 by simply

feat(cpufeat): enable FEAT_RAS for FEAT_STATE_CHECKED again

FEAT_RAS was originally converted to FEAT_STATE_CHECKED in 6503ff291.
However, the ability to use it was removed with 970a4a8d8 by simply
saying it impacts execution at EL3. That's true, but FEAT_STATE_CHECKED
can still be allowed by being a bit clever about it.

First, the remainder of common code can be converted to use the
is_feat_ras_supported() helper instead of the `#if FEATURE` pattern.
There are no corner cases to consider there. The feature is either
present (and appropriate action must be taken) or the feature is not (so
we can skip RAS code).

A conscious choice is taken to check the RAS code in synchronize_errors
despite it being in a hot path. Any fixed platform that seeks to be
performant should be setting features to 0 or 1. Then, the
SCTLR_EL3.IESB bit is always set if ENABLE_FEAT_RAS != 0 since we expect
FEAT_IESB to be present if FEAT_RAS is (despite the architecture not
guaranteeing it). If FEAT_RAS isn't present then we don't particularly
care about the status of FEAT_IESB.

Second, platforms that don't set ENABLE_FEAT_RAS must continue to work.
This is true out of the box with the is_feat_xyz_supported() helpers, as
they make sure to fully disable code within them.

Third, platforms that do set ENABLE_FEAT_RAS=1 must continue to work.
This is also true out of the box and no logical change is undertaken in
common code.

Finally, ENABLE_FEAT_RAS is set to 2 on FVP. Having RAS implies that the
whole handling machinery will be built-in and registered as appropriate.
However, when RAS is built-in but not present in hardware, these
registrations can still happen, they will only never be invoked at
runtime.

Change-Id: I949e648601dc0951ef9c2b217f34136b6ea4b3dc
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(arm): build fails on RESET_TO_BL2=1 and ARM_FW_CONFIG_LOAD_ENABLE=1

Use ARM_FW_CONFIG_BASE and ARM_FW_CONFIG_MAX_SIZE instead of platform
macros PLAT_FW_CONFIG_BASE and PLAT_FW_CONFIG_MAX_SIZE w

fix(arm): build fails on RESET_TO_BL2=1 and ARM_FW_CONFIG_LOAD_ENABLE=1

Use ARM_FW_CONFIG_BASE and ARM_FW_CONFIG_MAX_SIZE instead of platform
macros PLAT_FW_CONFIG_BASE and PLAT_FW_CONFIG_MAX_SIZE when
RESET_TO_BL2 and ARM_FW_CONFIG_LOAD_ENABLE are set to 1.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I0848852250eba5a3328e25cbea4fff413f344327

show more ...

feat(morello): add capability load/store/track support to MMU

Morello architecture adds additional bits to TCR_EL3 and uses the
HWU bits of page/block descriptors to provision permission for
loading

feat(morello): add capability load/store/track support to MMU

Morello architecture adds additional bits to TCR_EL3 and uses the
HWU bits of page/block descriptors to provision permission for
loading, storing and tracking of valid capability tags.

This patch reserves bit 31 of the existing translation table
attribute field which can be used by the user to enable capability
load/store/track permission for a given memory region.

This patch also enables this permission for BL31 region.

Signed-off-by: Manoj Kumar <manoj.kumar3@arm.com>
Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
Change-Id: I1939c70aac3585969d74b0956529681e840d6f63

show more ...

fix(build): use assignment instead of memcpy to avoid a GCC 11 bug

GCC11 has a bug where it may produce an incorrect warning "writing 1 or
more bytes into a region of size 0 overflows the destinatio

fix(build): use assignment instead of memcpy to avoid a GCC 11 bug

GCC11 has a bug where it may produce an incorrect warning "writing 1 or
more bytes into a region of size 0 overflows the destination" when using
memcpy and memset [0]. Since we use -Werror, this warning is fatal and
prevents building certain configurations with GCC11. Enabling LTO makes
the problem worse as the compiler has more visibility to do a wider
analysis.

This patch fixes this by using syntactic assignment rather than library
functions in the places that most often cause problems. GCC11 is able to
correctly analyse those scenarios and does not emit a warning. There is
a slight upside to this in that it may be able to produce more optimal
code.

[0]: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106199

Change-Id: I897e6360b8619ba1d4587d3abf84ffdd31f17273
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): use ARM_ARCH_FEATURE instead of -march directly

The -march compiler flag is owned by make_helpers/march.mk and its
output is controlled by ARM_ARCH_MAJOR, ARM_ARCH_MINOR, and
ARM_ARCH_FE

fix(build): use ARM_ARCH_FEATURE instead of -march directly

The -march compiler flag is owned by make_helpers/march.mk and its
output is controlled by ARM_ARCH_MAJOR, ARM_ARCH_MINOR, and
ARM_ARCH_FEATURE. Setting -march directly can lead to unexpected results
when using the above flags and is generally not recommended within tfa.

This patch migrates all instances of -march=armv8-a+crc to
ARM_ARCH_FEATURE=crc. Arm platforms (via arm_common.mk) are checked and
those that support cores greater than arm8.1 do not get the flag as it
is automatically pulled in.

Change-Id: I846f97367eab9529524a2805d5b87d34cce2360f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(drtm): use crypto-agile measured boot

Update the DRTM boot flow to use the crypto-agile API. Replace the
previous single-algorithm hash configuration with dynamic algorithm
selection. Align

refactor(drtm): use crypto-agile measured boot

Update the DRTM boot flow to use the crypto-agile API. Replace the
previous single-algorithm hash configuration with dynamic algorithm
selection. Align image measurement and event log header generation with
the new hashing model and update platform glue code accordingly.

Change-Id: I22930440476895c23dbd4e04502757d2f6726e33
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge "feat(fvp): load SP_PKGs with TRANSFER_LIST" into integration

Merge changes from topic "image_decryption" into integration

* changes:
feat(fvp): extend image decryption support for FVP
fix(io): add NULL check for spec io_open FIP

feat(arm): allow custom BL2 mem params

Introduce the ARM_PLAT_PROVIDES_BL2_MEM_PARAMS flag so that
Arm platforms can supply their own bl2_mem_params_desc.c
implementation if needed. When this overri

feat(arm): allow custom BL2 mem params

Introduce the ARM_PLAT_PROVIDES_BL2_MEM_PARAMS flag so that
Arm platforms can supply their own bl2_mem_params_desc.c
implementation if needed. When this override is enabled,
the common arm_bl2_mem_params_desc.c implementation is
excluded from BL2_SOURCES. The platform must then append
its own bl2_mem_params_desc.c file to BL2_SOURCES.

Change-Id: I8e3e0ce6e9c2c55ec3feb18a45890f1716fe690b
Signed-off-by: Ahmed Azeem <ahmed.azeem@arm.com>

show more ...

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL32 build flag is set.

Enable decryption support for FVP through setting the DECRYPTION_SUPPORT
build flag. "DECRYPTION_SUPPORT = aes_gcm" is set to perform authenticated
decryption using AES-GCM algorithm.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iebc3b360b4a0dc0d933b816d28015ac551b79405

show more ...

fix(io): add NULL check for spec io_open FIP

Add check to skip io_open() when spec is NULL to prevent invalid access.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I9e9d

fix(io): add NULL check for spec io_open FIP

Add check to skip io_open() when spec is NULL to prevent invalid access.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I9e9df8028c16d57bb9293c00afc1ce61601d8fd8

show more ...

feat(fvp): load SP_PKGs with TRANSFER_LIST

To enable loading of SP_PKGs when using the TRANSFER_LIST build option,
this patch loads TB_FW_CONFIG in BL1 and populates sp_mem_params_descs
in arm_trans

feat(fvp): load SP_PKGs with TRANSFER_LIST

To enable loading of SP_PKGs when using the TRANSFER_LIST build option,
this patch loads TB_FW_CONFIG in BL1 and populates sp_mem_params_descs
in arm_transfer_list_dyn_cfg_init().

Since there is no standard tag_id defined for TB_FW_CONFIG in the
transfer list, define PLAT_ARM_TB_FW_CONFIG_TL_TAG as a platform-specific
identifier to load TB_FW_CONFIG.

With this change, BL2 can load the SP_PKGs specified in TB_FW_CONFIG.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Change-Id: I2470c1ef3bf2bf921d0de1fff541565df13eaee4

show more ...