refactor(imx): use crypto-agile measured boot

Update the i.MX measured boot flow to use the crypto-agile API. Replace
the previous single-algorithm hash configuration with dynamic algorithm
selectio

refactor(imx): use crypto-agile measured boot

Update the i.MX measured boot flow to use the crypto-agile API. Replace
the previous single-algorithm hash configuration with dynamic algorithm
selection. Align image measurement and event log header generation with
the new hashing model and update platform glue code accordingly.

Change-Id: Ia60b5c927c1d7e4262562fb1eee2e4602b832e78
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(imx8m): keep console at runtime when building TF-A/bl31 with DEBUG

Have informal console output at runtime is useful when searching
errors in TF-A.

Change-Id: I56b5c4fc184e571f79d92bd0aa4fc74f

feat(imx8m): keep console at runtime when building TF-A/bl31 with DEBUG

Have informal console output at runtime is useful when searching
errors in TF-A.

Change-Id: I56b5c4fc184e571f79d92bd0aa4fc74ff4ed6074
Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>

show more ...

Merge changes from topic "little-build-fixes" into integration

* changes:
fix(build): don't rely on Event Log build tree
fix(build): link Event Log library directly
fix(build): scan symbols un

Merge changes from topic "little-build-fixes" into integration

* changes:
fix(build): don't rely on Event Log build tree
fix(build): link Event Log library directly
fix(build): scan symbols until all are resolved
fix(build): add include directory dependencies

show more ...

fix(build): link Event Log library directly

The `libraries` target is a `.PHONY` target to which various real
library targets, including the Event Log library, have been added over
the years. This t

fix(build): link Event Log library directly

The `libraries` target is a `.PHONY` target to which various real
library targets, including the Event Log library, have been added over
the years. This target is added as a dependency to any target created
with the `MAKE_BL` function. While this might look convenient on the
surface, it also dictates that a library must be linked even to images
it is totally irrelevant for.

The Event Log library is a good example of this; the library is not
typically used by all images, but by attaching itself to the `libraries`
target it becomes mandatory for all of them.

This change returns some of the control over when and where the Event
Log goes to platform maintainers via the introduction of two new
variables:

- `LIBEVLOG_LIBS`: the path to the Event Log static library.
- `LIBEVLOG_INCLUDE_DIRS`: include directories for the public API.

These can be appended to `BLx_LIBS` and `BLx_INCLUDE_DIRS` to include
the Event Log library in the relevant bootloaders.

Change-Id: I3e1a48cd45493334590b34b2ade0c6e29cbfd47a
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

chore(libfdt): update libfdt to v1.7.2

Where previously we cherry-picked individual sources from the libfdt
project tree, this change instead integrates the entire project tree
into the TF-A reposit

chore(libfdt): update libfdt to v1.7.2

Where previously we cherry-picked individual sources from the libfdt
project tree, this change instead integrates the entire project tree
into the TF-A repository. Doing so reduces the manual overhead of
updating libfdt in the future, as we avoid the need to analyse
individual source-level dependencies.

libfdt, conveniently, also provides a Makefile designed to ease its
integration into foreign build systems (like TF-A's), which we also make
use of in this change.

Source: https://git.kernel.org/pub/scm/utils/dtc/dtc.git/tree/?h=v1.7.2
Change-Id: I8babcfd27019fdd6d255d550491e1bb733745f27
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

Merge changes from topic "imx8m-rdc" into integration

* changes:
refactor(imx8m): simplify RDC console config
fix(imx8m): add RDC entries for all missing UARTs

build(measured-boot)!: move to ext event log lib

Removes in-tree Event Log library implementation and updates all
references to use the external submodule. Updates include paths,
Makefile macros, an

build(measured-boot)!: move to ext event log lib

Removes in-tree Event Log library implementation and updates all
references to use the external submodule. Updates include paths,
Makefile macros, and platform integration logic to link with lib as a
static library.

If you cloned TF-A without the `--recurse-submodules` flag, you can
ensure that this submodule is present by running:

git submodule update --init --recursive

BREAKING-CHANGE: LibEventLog is now included in TF-A as a submodule.
Please run `git submodule update --init --recursive` if you encounter
issues after migrating to the latest version of TF-A.

Change-Id: I723f493033c178759a45ea04118e7cc295dc2438
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

refactor(imx8m): simplify RDC console config

imx_rdc_console_access_enable() only updates the RDC configuration for
console UART. Early return was only happening when the correct
configuration was a

refactor(imx8m): simplify RDC console config

imx_rdc_console_access_enable() only updates the RDC configuration for
console UART. Early return was only happening when the correct
configuration was already set.
Return early once the correct entry has been found and updated.

Change-Id: Ic21dd8186b051dd0f51192df68a652ff79d8b8c0
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>

show more ...

fix(imx8m): add RDC entries for all missing UARTs

Commit f7434fa13 ("fix(imx8m): ensure domain permissions for the
console") sets RDC domain to Cortex-A only for console UART. But
this only works if

fix(imx8m): add RDC entries for all missing UARTs

Commit f7434fa13 ("fix(imx8m): ensure domain permissions for the
console") sets RDC domain to Cortex-A only for console UART. But
this only works if there is an RDC configuration entry provided.
Add missing RDC entries using the (reset) default value, so
imx_rdc_console_access_enable() can actually configuration domain
access.

Fixes: f7434fa13507 ("fix(imx8m): ensure domain permissions for the console")
Change-Id: I550dbf2b53795ab43839139c455f2468442a3251
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>

show more ...

Merge "fix(imx8mp): assign wdog1 to domain0 only" into integration

fix(imx8mp): assign wdog1 to domain0 only

Normally, wdog1 is used by A53 side, and it should be stopped when
A53 domain enters STOP mode. After Power-on-Reset this watchdog is owned
by both M7 & A53

fix(imx8mp): assign wdog1 to domain0 only

Normally, wdog1 is used by A53 side, and it should be stopped when
A53 domain enters STOP mode. After Power-on-Reset this watchdog is owned
by both M7 & A53 side. This watchdog can only enter STOP mode only when
both A53 & M7 enter STOP mode. This is not reasonable as this watchdog
is only used by A53 side, so assign wdog1 to domain0(a53 side) only.

Change-Id: I4c04a8c7f3cba4713f410866c18fef88fcbe9f11
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>

show more ...

fix(imx8m): don't reconfigure default region0

The current code and comments can be read as: "The TZC-380 region 0 can
be configured in size and attributes". This is not true, only the
attributes can

fix(imx8m): don't reconfigure default region0

The current code and comments can be read as: "The TZC-380 region 0 can
be configured in size and attributes". This is not true, only the
attributes can be set.

The TZC-380 region 0 is the TZC default (fallback) region. This region
is used if access to a certain DRAM address was done which isn't covered
by any other region (see [1] for more information). Region 0 covers the
complete AXI space from 0x0 to AXI-bus width. The access is secure-only
after reset.

The TZC-380 is not memory alias aware (see [1] for more information) and
due to the DDR controller, the i.MX8M allows memory alias access.

Configuring region 0 as secure + non-secure RW access opens the
potential security risk of allowing access to secure only memory e.g.
TEE memory area if the TEE didn't configure all memory aliases for its
memory. In such case region 0 is used as fallback if an attackers access
the TEE memory via memory aliases.

To fix this don't touch the TZC-380 at all. The TZC-380 is bypassed
by default if a platform doesn't require a TEE. If the platform requires
a TEE, the TEE is the one which knows the secure areas so let the TEE
configure the TZC-380 accordingly.

Furthmore, since commits:
- 0324081af010 ("feat(imx8mp): restrict peripheral access to secure
world")
- 1156c76361c1 ("feat(imx8mm): restrict peripheral access to secure
world")
the access is limited to the TEE too.

[1] https://developer.arm.com/documentation/ddi0431/c

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Change-Id: I0a0f9b5ad0017f38d767f583d7765a2f79861589

show more ...

Merge "fix(imx8mp): remove ERR050463 VPUMIX workaround" into integration

fix(imx8mp): remove ERR050463 VPUMIX workaround

Errata ERR050463 has been fixed in A1 silicon.

Change-Id: I263531c6eef44a679002cd048e71fb50c63d9030
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Signe

fix(imx8mp): remove ERR050463 VPUMIX workaround

Errata ERR050463 has been fixed in A1 silicon.

Change-Id: I263531c6eef44a679002cd048e71fb50c63d9030
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>

show more ...

feat(auth): introducing auth.mk

Introducing authentication specific makefile auth.mk to include common
auth source files.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I

feat(auth): introducing auth.mk

Introducing authentication specific makefile auth.mk to include common
auth source files.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Ifb07c48861fe415d82cb7390c3a5f6e60ba699d9

show more ...

Merge "fix(imx8mp): apply ERRATA_A53_1530924 erratum" into integration

refactor(imx8m): use renamed event log printer

Following the renaming of printer functions to follow the
event_log_{func} convention, update IMX8M to use the new function names
for consistency with

refactor(imx8m): use renamed event log printer

Following the renaming of printer functions to follow the
event_log_{func} convention, update IMX8M to use the new function names
for consistency with the logging library.

Change-Id: I2e5afc3ef077b45dfd2cdd284d45a7b4230ac479
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(imx8mp): apply ERRATA_A53_1530924 erratum

Apply erratum ERRATA_A53_1530924.

Change-Id: I971bb75bd0bda05f823599919a6936b61a2509ca
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>

Merge changes from topic "imx8mq_build_fix" into integration

* changes:
fix(imx8m): fix imx8mq build break
fix(imx8mq): fix imx8mq build break due to hab

chore(docs): drop the "wfi" from `pwr_domain_pwr_down_wfi`

To allow for generic handling of a wakeup, this hook is no longer
expected to call wfi itself. Update the name everywhere to reflect this
e

chore(docs): drop the "wfi" from `pwr_domain_pwr_down_wfi`

To allow for generic handling of a wakeup, this hook is no longer
expected to call wfi itself. Update the name everywhere to reflect this
expectation so that future platform implementers don't get misled.

Change-Id: Ic33f0b6da74592ad6778fd802c2f0b85223af614
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...