Merge changes from topic "image_decryption" into integration

* changes:
feat(fvp): extend image decryption support for FVP
fix(io): add NULL check for spec io_open FIP

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL32 build flag is set.

Enable decryption support for FVP through setting the DECRYPTION_SUPPORT
build flag. "DECRYPTION_SUPPORT = aes_gcm" is set to perform authenticated
decryption using AES-GCM algorithm.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iebc3b360b4a0dc0d933b816d28015ac551b79405

show more ...

Merge "refactor(arm): refine FIP offset handling for BL1 with GPT support" into integration

refactor(arm): refine FIP offset handling for BL1 with GPT support

Restrict use of PLAT_ARM_FIP_OFFSET_IN_GPT to BL1 when ARM_GPT_SUPPORT
is enabled. BL2 can derive the FIP offset from the partition

refactor(arm): refine FIP offset handling for BL1 with GPT support

Restrict use of PLAT_ARM_FIP_OFFSET_IN_GPT to BL1 when ARM_GPT_SUPPORT
is enabled. BL2 can derive the FIP offset from the partition table at
runtime, so a fixed offset is unnecessary. Also cleaned up the FIP
address handling comment for clarity.

Change-Id: I03f003a9307d66d16666eefcff1f45bb010779c9
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "gpt_updates" into integration

* changes:
refactor(arm): use gpt_partition_init
feat(partition): add interface to init gpt
refactor(partition): convert warn to verbose

Merge changes from topic "gpt_updates" into integration

* changes:
refactor(arm): use gpt_partition_init
feat(partition): add interface to init gpt
refactor(partition): convert warn to verbose
feat(partition): add support to use backup GPT header
refactor(partition): get GPT header location from MBR
feat(arm): add IO policy to use backup gpt header
feat(tbbr): add image id for backup GPT

show more ...

feat(partition): add support to use backup GPT header

Currently we just use primary GPT header which is located in second
entry after MBR header, but if this block is corrupted or CRC
mismatch occur

feat(partition): add support to use backup GPT header

Currently we just use primary GPT header which is located in second
entry after MBR header, but if this block is corrupted or CRC
mismatch occurs we could try to use the backup GPT header located at
LBAn and GPT entries following this from LBA-33.

Add suitable warning messages before returning any errors to identify
the cause of issue.

Change-Id: I0018ae9eafbacb683a18784d2c8bd917c70f50e1
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

feat(arm): add IO policy to use backup gpt header

Add a IO block spec to use GPT backup header if primary fails.
Currently we use only the primary gpt header which is in the second
block(LBA-1) afte

feat(arm): add IO policy to use backup gpt header

Add a IO block spec to use GPT backup header if primary fails.
Currently we use only the primary gpt header which is in the second
block(LBA-1) after the MBR block(LBA-0) so we restrict IO access to
primary gpt header and its entries.

But we plan to use backup GPT which is the last block of the
partition (LBA-n) in case our primary GPT header fails verification
or is corrupted.

Offset and length of the block spec will be updated runtime from
partition driver after parsing MBR data.

Change-Id: Id1d49841d6f4cbcc3248af19faf2fbd8e24a8ba1
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

Merge changes I2c4e826f,I388e8dcd,I6fd20225 into integration

* changes:
chore(ethos-n): use non blocking soft reset on npu
docs(ethos-n): update build-options.rst
refactor(ethos-n): move build

Merge changes I2c4e826f,I388e8dcd,I6fd20225 into integration

* changes:
chore(ethos-n): use non blocking soft reset on npu
docs(ethos-n): update build-options.rst
refactor(ethos-n): move build flags to ethosn_npu.mk

show more ...

refactor(ethos-n): move build flags to ethosn_npu.mk

The build flags to enable the Arm(R) Ethos(TM)-N NPU driver are in arm
platform specific make files i.e. plat/arm/common/arm_common.mk. These
fla

refactor(ethos-n): move build flags to ethosn_npu.mk

The build flags to enable the Arm(R) Ethos(TM)-N NPU driver are in arm
platform specific make files i.e. plat/arm/common/arm_common.mk. These
flags are renamed and moved to ethosn_npu.mk. Other source and make
files are changed to reflect the changes in these flags.

Signed-off-by: Rajasekaran Kalidoss <rajasekaran.kalidoss@arm.com>
Change-Id: I6fd20225343c574cb5ac1f0f32ff2fc28ef37ea6

show more ...

Merge changes from topic "ethos-n" into integration

* changes:
docs(maintainers): update NPU driver files
docs(ethos-n): update porting-guide.rst for NPU
feat(ethos-n): add separate RO and RW

Merge changes from topic "ethos-n" into integration

* changes:
docs(maintainers): update NPU driver files
docs(ethos-n): update porting-guide.rst for NPU
feat(ethos-n): add separate RO and RW NSAIDs
feat(ethos-n)!: add protected NPU firmware setup
feat(ethos-n): add stream extends and attr support
feat(ethos-n): add reserved memory address support
feat(ethos-n): add event and aux control support
feat(ethos-n): add SMC call to get FW properties
refactor(ethos-n): split up SMC call handling
feat(ethos-n): add NPU firmware validation
feat(ethos-n): add check for NPU in SiP setup
feat(ethos-n)!: load NPU firmware at BL2
feat(juno): support ARM_IO_IN_DTB option for Juno
fix(fconf): fix FCONF_ARM_IO_UUID_NUMBER value
fix(fvp): incorrect UUID name in FVP tb_fw_config
fix(ethos-n): add workaround for erratum 2838783
feat(ethos-n): add support for NPU to cert_create
feat(ethos-n): add NPU support in fiptool
feat(ethos-n): add support to set up NSAID
build(fiptool): add object dependency generation
feat(ethos-n): add NPU sleeping SMC call
feat(ethos-n): add multiple asset allocators
feat(ethos-n): add reset type to reset SMC calls
feat(ethos-n): add protected NPU TZMP1 regions
build(ethos-n): add TZMP1 build flag

show more ...

feat(ethos-n)!: load NPU firmware at BL2

BL2 on Juno now loads the Arm(R) Ethos(TM)-N NPU firmware into a fixed
address, using the existing image loading framework.

Includes support for TRUSTED_BOA

feat(ethos-n)!: load NPU firmware at BL2

BL2 on Juno now loads the Arm(R) Ethos(TM)-N NPU firmware into a fixed
address, using the existing image loading framework.

Includes support for TRUSTED_BOARD_BOOT, if enabled, using the firmware
content and key certificates from the FIP.

Supports the ARM_IO_IN_DTB option so can specify the firmware location
from the dtb rather than it being hardcoded to the FIP

Update makefile to automatically embed the appropriate images into the
FIP.

BREAKING CHANGE: Building the FIP when TZMP1 support is enabled in the
NPU driver now requires a parameter to specify the NPU firmware file.

Signed-off-by: Rob Hughes <robert.hughes@arm.com>
Signed-off-by: Mikael Olsson <mikael.olsson@arm.com>
Change-Id: I8cd64fb20d58f8bd539facb085606213d6cead06

show more ...

fix(fconf): fix FCONF_ARM_IO_UUID_NUMBER value

The FCONF_ARM_IO_UUID_NUMBER macro is hardcoded to the number of entries
in the `load_info` array, but this number did not match the actual
length of t

fix(fconf): fix FCONF_ARM_IO_UUID_NUMBER value

The FCONF_ARM_IO_UUID_NUMBER macro is hardcoded to the number of entries
in the `load_info` array, but this number did not match the actual
length of the array in the case that TRUSTED_BOARD_BOOT is defined, but
SPD_spmd is not defined.

This patch fixes the hardcoded length by replacing it with a more
flexible calculation which sums up the various contributing groups of
entries.

Signed-off-by: Rob Hughes <robert.hughes@arm.com>
Signed-off-by: Mikael Olsson <mikael.olsson@arm.com>
Change-Id: I557bca7dd32c3be084bbba11d84dfa2818cb6790

show more ...

Merge changes from topic "lw/cca_cot" into integration

* changes:
feat(arm): retrieve the right ROTPK for cca
feat(arm): add support for cca CoT
feat(arm): provide some swd rotpk files
build

Merge changes from topic "lw/cca_cot" into integration

* changes:
feat(arm): retrieve the right ROTPK for cca
feat(arm): add support for cca CoT
feat(arm): provide some swd rotpk files
build(tbbr): drive cert_create changes for cca CoT
refactor(arm): add cca CoT certificates to fconf
feat(fiptool): add cca, core_swd, plat cert in FIP
feat(cert_create): define the cca chain of trust
feat(cca): introduce new "cca" chain of trust
build(changelog): add new scope for CCA
refactor(fvp): increase bl2 size when bl31 in DRAM

show more ...

refactor(arm): add cca CoT certificates to fconf

Adding support in fconf for the cca CoT certificates for cca, core_swd,
and plat key.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>

refactor(arm): add cca CoT certificates to fconf

Adding support in fconf for the cca CoT certificates for cca, core_swd,
and plat key.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I8019cbcb7ccd4de6da624aebf3611b429fb53f96

show more ...

Merge changes from topic "za/feat_rme" into integration

* changes:
refactor(gpt): productize and refactor GPT library
feat(rme): disable Watchdog for Arm platforms if FEAT_RME enabled
docs(rme

Merge changes from topic "za/feat_rme" into integration

* changes:
refactor(gpt): productize and refactor GPT library
feat(rme): disable Watchdog for Arm platforms if FEAT_RME enabled
docs(rme): add build and run instructions for FEAT_RME
fix(plat/fvp): bump BL2 stack size
fix(plat/fvp): allow changing the kernel DTB load address
refactor(plat/arm): rename ARM_DTB_DRAM_NS region macros
refactor(plat/fvp): update FVP platform DTS for FEAT_RME
feat(plat/arm): add GPT initialization code for Arm platforms
feat(plat/fvp): add memory map for FVP platform for FEAT_RME
refactor(plat/arm): modify memory region attributes to account for FEAT_RME
feat(plat/fvp): add RMM image support for FVP platform
feat(rme): add GPT Library
feat(rme): add ENABLE_RME build option and support for RMM image
refactor(makefile): remove BL prefixes in build macros
feat(rme): add context management changes for FEAT_RME
feat(rme): add Test Realm Payload (TRP)
feat(rme): add RMM dispatcher (RMMD)
feat(rme): run BL2 in root world when FEAT_RME is enabled
feat(rme): add xlat table library changes for FEAT_RME
feat(rme): add Realm security state definition
feat(rme): add register definitions and helper functions for FEAT_RME

show more ...

feat(plat/fvp): add RMM image support for FVP platform

This patch adds the necessary changes needed to build
and load RMM image for the FVP platform. RMM image is
loaded by BL2 after BL32 (if BL32 e

feat(plat/fvp): add RMM image support for FVP platform

This patch adds the necessary changes needed to build
and load RMM image for the FVP platform. RMM image is
loaded by BL2 after BL32 (if BL32 exists) and before BL33.

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I1ac9eade84c2e35c7479a322ca1d090b4e626819

show more ...

Merge changes from topic "fw-update-2" into integration

* changes:
feat(sw_crc32): add software CRC32 support
refactor(hw_crc32): renamed hw_crc32 to tf_crc32
feat(fwu): avoid booting with an

Merge changes from topic "fw-update-2" into integration

* changes:
feat(sw_crc32): add software CRC32 support
refactor(hw_crc32): renamed hw_crc32 to tf_crc32
feat(fwu): avoid booting with an alternate boot source
docs(fwu): add firmware update documentation
feat(fwu): avoid NV counter upgrade in trial run state
feat(plat/arm): add FWU support in Arm platforms
feat(fwu): initialize FWU driver in BL2
feat(fwu): add FWU driver
feat(fwu): introduce FWU platform-specific functions declarations
docs(fwu_metadata): add FWU metadata build options
feat(fwu_metadata): add FWU metadata header and build options

show more ...

feat(plat/arm): add FWU support in Arm platforms

Added firmware update support in Arm platforms by using
FWU platform hooks and compiling FWU driver in BL2
component.

Change-Id: I71af06c09d95c2c58e

feat(plat/arm): add FWU support in Arm platforms

Added firmware update support in Arm platforms by using
FWU platform hooks and compiling FWU driver in BL2
component.

Change-Id: I71af06c09d95c2c58e3fd766c4a61c5652637151
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "fw-update" into integration

* changes:
docs: add build options for GPT support enablement
feat(plat/arm): add GPT parser support

feat(plat/arm): add GPT parser support

Added GPT parser support in BL2 for Arm platforms to get the entry
address and length of the FIP in the GPT image.

Also, increased BL2 maximum size for FVP pl

feat(plat/arm): add GPT parser support

Added GPT parser support in BL2 for Arm platforms to get the entry
address and length of the FIP in the GPT image.

Also, increased BL2 maximum size for FVP platform to successfully
compile ROM-enabled build with this change.

Verified this change using a patch:
https://review.trustedfirmware.org/c/ci/tf-a-ci-scripts/+/9654

Change-Id: Ie8026db054966653b739a82d9ba106d283f534d0
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge "refactor(plat/arm): replace FIP base and size macro with a generic name" into integration

Merge "refactor(plat/arm): store UUID as a string, rather than ints" into integration

refactor(plat/arm): store UUID as a string, rather than ints

NOTE: Breaking change to the way UUIDs are stored in the DT

Currently, UUIDs are stored in the device tree as
sequences of 4 integers. T

refactor(plat/arm): store UUID as a string, rather than ints

NOTE: Breaking change to the way UUIDs are stored in the DT

Currently, UUIDs are stored in the device tree as
sequences of 4 integers. There is a mismatch in endianness
between the way UUIDs are represented in memory and the way
they are parsed from the device tree. As a result, we must either
store the UUIDs in little-endian format in the DT (which means
that they do not match up with their string representations)
or perform endianness conversion after parsing them.

Currently, TF-A chooses the second option, with unwieldy
endianness-conversion taking place after reading a UUID.

To fix this problem, and to make it convenient to copy and
paste UUIDs from other tools, change to store UUIDs in string
format, using a new wrapper function to parse them from the
device tree.

Change-Id: I38bd63c907be14e412f03ef0aab9dcabfba0eaa0
Signed-off-by: David Horstmann <david.horstmann@arm.com>

show more ...

refactor(plat/arm): replace FIP base and size macro with a generic name

Replaced PLAT_ARM_FIP_BASE and PLAT_ARM_FIP_MAX_SIZE macro with a
generic name PLAT_ARM_FLASH_IMAGE_BASE and PLAT_ARM_FLASH_IM

refactor(plat/arm): replace FIP base and size macro with a generic name

Replaced PLAT_ARM_FIP_BASE and PLAT_ARM_FIP_MAX_SIZE macro with a
generic name PLAT_ARM_FLASH_IMAGE_BASE and PLAT_ARM_FLASH_IMAGE_MAX_SIZE
so that these macros can be reused in the subsequent GPT based support
changes.

Change-Id: I88fdbd53e1966578af4f1e8e9d5fef42c27b1173
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge "SPM: Get rid of uint32_t array representation of UUID" into integration