fix(build): include platform mk earlier

Move platform.mk inclusion in top level Makefile to permit a platform
specifying BRANCH_PROTECTION option.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.

fix(build): include platform mk earlier

Move platform.mk inclusion in top level Makefile to permit a platform
specifying BRANCH_PROTECTION option.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I1f662f82cd949eedfdbb61b9f66de15c46fb3106

show more ...

fix(arm): use EL3_PAS in MAP_BL2_TOTAL definition

Similarly to BL1 and BL31, use EL3_PAS macro from xlat_tables header
(depends on ENABLE_RME) in BL2 to define MAP_BL2_TOTAL.

Signed-off-by: Olivier

fix(arm): use EL3_PAS in MAP_BL2_TOTAL definition

Similarly to BL1 and BL31, use EL3_PAS macro from xlat_tables header
(depends on ENABLE_RME) in BL2 to define MAP_BL2_TOTAL.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I59a3b297efd2eacd082a297de6b579b7c9052883

show more ...

feat(tc): print ni-tower discovery tree

print ni-tower discovery tree to understand ni-tower hierarchy which
might be useful during debugging.

Change-Id: Ib49fef9c63f7740e04b4d8371c1083bd040f6e09
S

feat(tc): print ni-tower discovery tree

print ni-tower discovery tree to understand ni-tower hierarchy which
might be useful during debugging.

Change-Id: Ib49fef9c63f7740e04b4d8371c1083bd040f6e09
Signed-off-by: Jagdish Gediya <jagdish.gediya@arm.com>
Signed-off-by: Icen.Zeyada <Icen.Zeyada2@arm.com>

show more ...

feat(arm): use the provided hash alg to hash rotpk

No longer hard code SHA-256 hashed dev rotpks, instead
use the algorithm given by HASH_ALG. This means that
we no longer need the plat_arm_configs

feat(arm): use the provided hash alg to hash rotpk

No longer hard code SHA-256 hashed dev rotpks, instead
use the algorithm given by HASH_ALG. This means that
we no longer need the plat_arm_configs (once the protpk and
swd_rotpk are also updated to use HASH_ALG).

The rot public key is now generated at build time, as is
the header for the key.

Also support some default 3k and 4k RSA keys.

Change-Id: I33538124aeb4fa7d67918d878d17f2a84d3a6756
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

Merge changes from topic "hm/heap-info" into integration

* changes:
fix(handoff): remove XFERLIST_TB_FW_CONFIG
feat(arm): migrate heap info to fw handoff
feat(mbedtls): introduce crypto lib he

Merge changes from topic "hm/heap-info" into integration

* changes:
fix(handoff): remove XFERLIST_TB_FW_CONFIG
feat(arm): migrate heap info to fw handoff
feat(mbedtls): introduce crypto lib heap info struct
feat(handoff): add Mbed-TLS heap info entry tag
refactor(arm): refactor secure TL initialization
fix(handoff): fix message formatting of hex values
feat(handoff): add func to check and init a tl
fix(arm): resolve dangling comments around macros

show more ...

feat(arm): migrate heap info to fw handoff

Mbed-TLS requires platforms to allocate it a heap for it's own internal
usage. This heap is typically between shared by BL1 and BL2 to conserve
memory.The

feat(arm): migrate heap info to fw handoff

Mbed-TLS requires platforms to allocate it a heap for it's own internal
usage. This heap is typically between shared by BL1 and BL2 to conserve
memory.The base address and size of the heap are conveyed from BL1 to
BL2 through the config TB_FW_CONFIG.

This slightly awkward approach necessitates declaring a placeholder node
in the DTS. At runtime, this node is populated with the actual values of
the heap information. Instead, since this is dynamic information, and
simple to represent through C structures, transmit it to later stages
using the firmware handoff framework.

With this migration, remove references to TB_FW_CONFIG when firmware
handoff is enabled, as it is no longer needed. The setup code now relies
solely on TL structures to configure the TB firmware

Change-Id: Iff00dc742924a055b8bd304f15eec03ce3c6d1ef
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

refactor(arm): refactor secure TL initialization

The initialization logic for the secure transfer list is currently
scattered and duplicated across platform setup code. This not only leads
to ineffi

refactor(arm): refactor secure TL initialization

The initialization logic for the secure transfer list is currently
scattered and duplicated across platform setup code. This not only leads
to inefficiency but also complicates access to transfer lists from other
parts of the code without invoking setup functions. For instance,
arm_bl2_setup_next_ep_info acts as a thin wrapper in arm_bl2_setup.c to
provide access to the secure transfer list.

To streamline the interface, all setup code has been consolidated into a
central location.

Change-Id: I99d2a567ff39df88baa57e7e08607fccb8af189c
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(arm): resolve dangling comments around macros

Fix dangling comments around define guards, addressing leftovers from
fe94a21a6 ("fix(arm): move HW_CONFIG relocation into BL31") which
implicitly r

fix(arm): resolve dangling comments around macros

Fix dangling comments around define guards, addressing leftovers from
fe94a21a6 ("fix(arm): move HW_CONFIG relocation into BL31") which
implicitly removed constraints on using HW_CONFIG with RESET_TO_BL2.

Change-Id: I19d61812fed6fa4b668875e5bf4eafd1a8a660f6
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(psa): increase psa-mbedtls heap size for rsa

The value assigned for the mbedtls heap size for large
rsa keys was too small when PSA_CRYPTO is set to 1,
leading to run-time failures if one was to

fix(psa): increase psa-mbedtls heap size for rsa

The value assigned for the mbedtls heap size for large
rsa keys was too small when PSA_CRYPTO is set to 1,
leading to run-time failures if one was to attempt
to use a large RSA key with PSA_CRYPTO=1.

Change-Id: Id9b2648ae911879f483f1b88301f28694af0721d
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

refactor(mbedtls): rename default mbedtls confs

Change the name of these confs to be version agnostic,
we will later use these configs to enforce the mbedtls
minimum version

Change-Id: I1f665c24718

refactor(mbedtls): rename default mbedtls confs

Change the name of these confs to be version agnostic,
we will later use these configs to enforce the mbedtls
minimum version

Change-Id: I1f665c2471877ecc833270c511749ff845046f10
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

fix(arm): load dt before updating entry point

For firmware handoff, ensure the device tree (dt) is loaded into memory
before setting the entry point arguments for the next bootloader stage.
This all

fix(arm): load dt before updating entry point

For firmware handoff, ensure the device tree (dt) is loaded into memory
before setting the entry point arguments for the next bootloader stage.
This allows the dt to be found and its address passed as an argument.

Change-Id: Ifedd7c573e2d4f6d68c596907d9d6c6a3eded317
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(d128): add support for FEAT_D128

This patch disables trapping to EL3 when the FEAT_D128
specific registers are accessed by setting the SCR_EL3.D128En bit.

If FEAT_D128 is implemented, then FEA

feat(d128): add support for FEAT_D128

This patch disables trapping to EL3 when the FEAT_D128
specific registers are accessed by setting the SCR_EL3.D128En bit.

If FEAT_D128 is implemented, then FEAT_SYSREG128 is implemented.
With FEAT_SYSREG128 certain system registers are treated as 128-bit,
so we should be context saving and restoring 128-bits instead of 64-bit
when FEAT_D128 is enabled.

FEAT_SYSREG128 adds support for MRRS and MSRR instruction which
helps us to read write to 128-bit system register.
Refer to Arm Architecture Manual for further details.

Change the FVP platform to default to handling this as a dynamic option
so the right decision can be made by the code at runtime.

Change-Id: I1a53db5eac29e56c8fbdcd4961ede3abfcb2411a
Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

Merge changes from topic "rd1ae-upstream" into integration

* changes:
docs(rd1ae): add RD-1 AE documentation
feat(rd1ae): enabling Trusted Board Boot(TBB) for RD-1 AE
feat(rd1ae): introduce BL

Merge changes from topic "rd1ae-upstream" into integration

* changes:
docs(rd1ae): add RD-1 AE documentation
feat(rd1ae): enabling Trusted Board Boot(TBB) for RD-1 AE
feat(rd1ae): introduce BL31 for RD-1 AE platform
feat(rd1ae): add device tree files
feat(rd1ae): introduce Arm RD-1 AE platform
build(bl2): enable check for bl2 base overflow assert
feat(arm): add support for loading CONFIG from BL2

show more ...

Merge "build: make Poetry optional" into integration

feat(rd1ae): introduce BL31 for RD-1 AE platform

This commit introduces BL31 to the RD-1 AE platform. The RD-1 AE
platform incorporates an SCP for CPU power control.

Additinaly introducing the memo

feat(rd1ae): introduce BL31 for RD-1 AE platform

This commit introduces BL31 to the RD-1 AE platform. The RD-1 AE
platform incorporates an SCP for CPU power control.

Additinaly introducing the memory descriptor provides BL image
information that gets used by BL2 to load the images

Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Divin Raj <divin.raj@arm.com>
Change-Id: I035cbfd09f254aa47483ad35676f1cb3ffb661bd

show more ...

build(bl2): enable check for bl2 base overflow assert

Currently, the BL2 base overflow check asserts for all cases,
but this check is only necessary if not reset to BL2 case.
Therefore, adding a con

build(bl2): enable check for bl2 base overflow assert

Currently, the BL2 base overflow check asserts for all cases,
but this check is only necessary if not reset to BL2 case.
Therefore, adding a condition for this check.

Signed-off-by: Divin Raj <divin.raj@arm.com>
Change-Id: Ia129921d76bcd32058ea0767db0319e6724be8ab

show more ...

feat(arm): add support for loading CONFIG from BL2

This commit introduces a new ARM platform-specific build option called
`ARM_FW_CONFIG_LOAD_ENABLE`. This option enables the loading of the
`fw_conf

feat(arm): add support for loading CONFIG from BL2

This commit introduces a new ARM platform-specific build option called
`ARM_FW_CONFIG_LOAD_ENABLE`. This option enables the loading of the
`fw_config` device tree when resetting to the BL2 scenario.

Additionally, the FW_CONFIG image reference has been added to the
fdts/tbbr_cot_descriptors.dtsi file in order to use in the scenario of
RESET_TO_BL2.

Signed-off-by: Divin Raj <divin.raj@arm.com>
Change-Id: I11de497b7dbb1386ed84d939d6fd2a11856e9e1b

show more ...

Merge changes from topic "rd-v3-reset-to-bl31" into integration

* changes:
feat(neoverse-rd): allow RESET_TO_BL31 for third gen platforms
feat(arm): setup GPT in BL31 in RESET_TO_BL31 boot flow

Merge changes from topic "rd-v3-reset-to-bl31" into integration

* changes:
feat(neoverse-rd): allow RESET_TO_BL31 for third gen platforms
feat(arm): setup GPT in BL31 in RESET_TO_BL31 boot flow
feat(neoverse-rd): enable RESET_TO_BL31 for RD-V3
feat(neoverse-rd): add a routine to update NT_FW_CONFIG in BL31

show more ...

build: make Poetry optional

The Yocto team has requested that we do not use Poetry from within the
Makefile, as Yocto does not have network access during the build
process.

We want to maintain the

build: make Poetry optional

The Yocto team has requested that we do not use Poetry from within the
Makefile, as Yocto does not have network access during the build
process.

We want to maintain the current behaviour, so this change makes our use
of Poetry contigent on it being available in the environment.

Additionally, explicitly passing an empty toolchain parameter now allows
a tool to be *disabled* (e.g. passing `POETRY=` will prevent the build
system from trying to use Poetry).

Change-Id: Ibf552a3fee1eaadee767a1b948b559700083b401
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

feat(arm): setup GPT in BL31 in RESET_TO_BL31 boot flow

In the normal boot flow, BL2 sets up the Granule Protection Tables
(GPT). As BL2 is not a part of RESET_TO_BL31, BL31 needs to set up GPT
for

feat(arm): setup GPT in BL31 in RESET_TO_BL31 boot flow

In the normal boot flow, BL2 sets up the Granule Protection Tables
(GPT). As BL2 is not a part of RESET_TO_BL31, BL31 needs to set up GPT
for CPUs supporting FEAT_RME.

Signed-off-by: Rakshit Goyal <rakshit.goyal@arm.com>
Change-Id: I9ad16bd93ea9fbad422dd56e2ba1d600a30eea30

show more ...

feat(handoff): make tl generation flexible

Make the process of compiling a TL from DT source flexible. Provide a
top level recipe to make it easier for developers to build a transfer
list. Clean up

feat(handoff): make tl generation flexible

Make the process of compiling a TL from DT source flexible. Provide a
top level recipe to make it easier for developers to build a transfer
list. Clean up integration of TLC into the build system.

Change-Id: I4466e27a457dfd5bf709dc3a360a2b63bf6030ce
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(arm): add extra hash config to validate ROTPK

The default mbedTLS configuration enables hash algorithms based on
the HASH_ALG or MBOOT_EL_HASH_ALG selected. However, the Arm ROTPK
is always embe

fix(arm): add extra hash config to validate ROTPK

The default mbedTLS configuration enables hash algorithms based on
the HASH_ALG or MBOOT_EL_HASH_ALG selected. However, the Arm ROTPK
is always embedded as a SHA256 hash in BL1 and BL2. In the future,
we may need to adjust this to use the HASH_ALG algorithm for
embedding the ROTPK hash.

As a temporary workaround, a separate mbedTLS configuration has
been created for Arm platforms to explicitly set SHA256 defines,
rather than relying on the default configuration. This adjustment
is reflected in the mbedTLS configuration file for the TC platform
as well as in the PSA Crypto configuration file.

Change-Id: Ib3128ce7b0fb5c0858624ecbc998d456968beddf
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "mbedtls-config-cleanup" into integration

* changes:
chore(qemu): remove duplicate define
chore(imx): remove duplicate define
chore(arm): remove duplicate defines
ch

Merge changes from topic "mbedtls-config-cleanup" into integration

* changes:
chore(qemu): remove duplicate define
chore(imx): remove duplicate define
chore(arm): remove duplicate defines
chore(mbedtls): remove hash configs

show more ...

chore(arm): remove duplicate defines

Change-Id: I9eea1610660bfa92f7781deab60e29eae11c4ba6
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

fix(cot-dt2c): fix various breakages

This change fixes several breakages that were introduced in some build
configurations by the introduction of the cot-dt2c tool.

Some Python environments cannot

fix(cot-dt2c): fix various breakages

This change fixes several breakages that were introduced in some build
configurations by the introduction of the cot-dt2c tool.

Some Python environments cannot be managed directly via `pip`, and
invocations of `make`, including `make distclean`, would cause errors
along the lines of:

error: externally-managed-environment

× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
python3-xyz, where xyz is the package you are trying to
install.

This change has been resolved by ensuring that calls to the cot-dt2c
tool from the build system happen exclusively through Poetry, which
automatically sets up a virtual environment that *can* be modified.

Some environments saw the following error when building platforms where
the cot-dt2c tool was used:

make: *** No rule to make target '<..>/debug/bl2_cot.c', needed
by '<..>/debug/bl2/bl2_cot.o'. Stop.

Additionally, environments with a more recent version of Python saw the
following error:

File "<...>/lib/python3.12/site-packages/cot_dt2c/cot_parser.py",
line 637, in img_to_c
if ifdef:
^^^^^
NameError: name 'ifdef' is not defined

Both of these errors have now been resolved by modifications to the
build system and the cot-dt2c tool to enable preprocessing of the device
tree source file before it is processed by the tool.

As a consequence of this change, the `pydevicetree` library is no longer
vendored into the repository tree, and we instead pull it in via a
dependency in Poetry.

This change also resolves several MyPy warnings and errors related to
missing type hints.

Change-Id: I72b2d01caca3fcb789d3fe2549f318a9c92d77d1
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...