refactor(rpi3): use crypto-agile measured boot

Adopt the crypto-agile measured boot API for RPi3. Replace the previous
single-algorithm hash configuration with dynamic algorithm selection.
Factor co

refactor(rpi3): use crypto-agile measured boot

Adopt the crypto-agile measured boot API for RPi3. Replace the previous
single-algorithm hash configuration with dynamic algorithm selection.
Factor common measurement logic into a shared helper, update BL1/BL2
integration, and ensure event log header generation and TPM extension
use the new multi-algorithm model.

Change-Id: Id700710ad2c893fc13614c81c01b8812e8edff7d
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(tpm): changes to support TPM lib

The build system sets TPM_INTERFACE to FIFO_SPI, but this cannot be
tested by the C preprocessor. So, create new build define
TPM_INTERFACE_FIFO_SPI. Correct th

feat(tpm): changes to support TPM lib

The build system sets TPM_INTERFACE to FIFO_SPI, but this cannot be
tested by the C preprocessor. So, create new build define
TPM_INTERFACE_FIFO_SPI. Correct the #if statements to use it.

Make spi_init() in rpi3_spi.c static.
Pass timer functions as ops structure to TPM.
Remove implicit interface between TPM library and main firmware by
introducing explicit interface to allow firmware to pass structure
of function pointers to setup a timer and check whether it has elapsed.

Update build system for new TPM lib location.
Change #include statements in TPM source and header files to allow
for new directory structure.

Change-Id: Ie16b2e402b963161d7d4f35a187b9bd2765a1faa
Signed-off-by: Matthew Ellis <Matthew.Ellis@arm.com>

show more ...

Merge changes from topic "little-build-fixes" into integration

* changes:
fix(build): don't rely on Event Log build tree
fix(build): link Event Log library directly
fix(build): scan symbols un

Merge changes from topic "little-build-fixes" into integration

* changes:
fix(build): don't rely on Event Log build tree
fix(build): link Event Log library directly
fix(build): scan symbols until all are resolved
fix(build): add include directory dependencies

show more ...

fix(build): link Event Log library directly

The `libraries` target is a `.PHONY` target to which various real
library targets, including the Event Log library, have been added over
the years. This t

fix(build): link Event Log library directly

The `libraries` target is a `.PHONY` target to which various real
library targets, including the Event Log library, have been added over
the years. This target is added as a dependency to any target created
with the `MAKE_BL` function. While this might look convenient on the
surface, it also dictates that a library must be linked even to images
it is totally irrelevant for.

The Event Log library is a good example of this; the library is not
typically used by all images, but by attaching itself to the `libraries`
target it becomes mandatory for all of them.

This change returns some of the control over when and where the Event
Log goes to platform maintainers via the introduction of two new
variables:

- `LIBEVLOG_LIBS`: the path to the Event Log static library.
- `LIBEVLOG_INCLUDE_DIRS`: include directories for the public API.

These can be appended to `BLx_LIBS` and `BLx_INCLUDE_DIRS` to include
the Event Log library in the relevant bootloaders.

Change-Id: I3e1a48cd45493334590b34b2ade0c6e29cbfd47a
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

chore(libfdt): update libfdt to v1.7.2

Where previously we cherry-picked individual sources from the libfdt
project tree, this change instead integrates the entire project tree
into the TF-A reposit

chore(libfdt): update libfdt to v1.7.2

Where previously we cherry-picked individual sources from the libfdt
project tree, this change instead integrates the entire project tree
into the TF-A repository. Doing so reduces the manual overhead of
updating libfdt in the future, as we avoid the need to analyse
individual source-level dependencies.

libfdt, conveniently, also provides a Makefile designed to ease its
integration into foreign build systems (like TF-A's), which we also make
use of in this change.

Source: https://git.kernel.org/pub/scm/utils/dtc/dtc.git/tree/?h=v1.7.2
Change-Id: I8babcfd27019fdd6d255d550491e1bb733745f27
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

refactor(build): make it standard to request a custom linker script

Hoist the add_define to a global location so that platforms only have to
declare its usage. Fix up #ifdef to #if since we will now

refactor(build): make it standard to request a custom linker script

Hoist the add_define to a global location so that platforms only have to
declare its usage. Fix up #ifdef to #if since we will now always pass a
definition.

Change-Id: Ia52ad5ed4dcbd157d139c8ca2fb3d35b32343b93
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

build(measured-boot)!: move to ext event log lib

Removes in-tree Event Log library implementation and updates all
references to use the external submodule. Updates include paths,
Makefile macros, an

build(measured-boot)!: move to ext event log lib

Removes in-tree Event Log library implementation and updates all
references to use the external submodule. Updates include paths,
Makefile macros, and platform integration logic to link with lib as a
static library.

If you cloned TF-A without the `--recurse-submodules` flag, you can
ensure that this submodule is present by running:

git submodule update --init --recursive

BREAKING-CHANGE: LibEventLog is now included in TF-A as a submodule.
Please run `git submodule update --init --recursive` if you encounter
issues after migrating to the latest version of TF-A.

Change-Id: I723f493033c178759a45ea04118e7cc295dc2438
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(auth): introducing auth.mk

Introducing authentication specific makefile auth.mk to include common
auth source files.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I

feat(auth): introducing auth.mk

Introducing authentication specific makefile auth.mk to include common
auth source files.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Ifb07c48861fe415d82cb7390c3a5f6e60ba699d9

show more ...

refactor(rpi3): use renamed event log printer

Following the renaming of printer functions to follow the
event_log_{func} convention, update RPI3 to use the new function names
for consistency with th

refactor(rpi3): use renamed event log printer

Following the renaming of printer functions to follow the
event_log_{func} convention, update RPI3 to use the new function names
for consistency with the logging library.

Change-Id: I7a009e78611398f0978e362a7ee5327276286126
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(rpi3): expose BL1_RW to BL2 map for mboot

BL2 requires the ability to access the TCG Event Log during
Measured Boot. Currently the Platform hangs since the Event Log
is not exposed to BL2's mma

fix(rpi3): expose BL1_RW to BL2 map for mboot

BL2 requires the ability to access the TCG Event Log during
Measured Boot. Currently the Platform hangs since the Event Log
is not exposed to BL2's mmap. Define a RPI3_BL1_RW region to be
added to the BL2 Image, if Measured Boot is enabled.

Change-Id: Ic236a80e73ea342b4590cfb65bafbb8ffac17085
Signed-off-by: Abhi Singh <abhi.singh@arm.com>

show more ...

feat(rpi3): add dTPM backed measured boot

In BL1 and BL2 add support for the use of an Infineon Optiga SLB 9670
TPM2.0.
The platform utilizes the gpio_spi.c driver to bit-bang gpio pins in
order to

feat(rpi3): add dTPM backed measured boot

In BL1 and BL2 add support for the use of an Infineon Optiga SLB 9670
TPM2.0.
The platform utilizes the gpio_spi.c driver to bit-bang gpio pins in
order to send commands and receive responses to/from the TPM.
In BL1 & BL2:
-utilize TPM commands to initialize the gpio pins for "spi"
communication, and extend image hashes to the TPM's PCR 0,
at the end of the measured boot phase for the bootloader,
the TPM locality is released.
-Bl1 executes a tpm_startup command in order to flush the TPM.

Change-Id: I2f2fa28f60a262a0aa25a674c72a9904b3cf4d8a
Signed-off-by: Tushar Khandelwal <tushar.khandelwal@arm.com>
Signed-off-by: Abhi Singh <abhi.singh@arm.com>

show more ...

feat(rpi3): implement eventlog handoff to BL33

At the end of BL2 measured boot, write the address
and size of the TCG Event Log to NT_FW_CONFIG so
that the log can be consumed later by BL33.
-add dy

feat(rpi3): implement eventlog handoff to BL33

At the end of BL2 measured boot, write the address
and size of the TCG Event Log to NT_FW_CONFIG so
that the log can be consumed later by BL33.
-add dynamic configuration helpers for the fdt
-write the eventlog address and size to the fdt

Change-Id: I099dd9cc96d740ae13cb8b8e8c6b9f2e6c02accc
Signed-off-by: Abhi Singh <abhi.singh@arm.com>

show more ...

feat(rpi3): implement mboot for rpi3

Add Measured Boot support using the Event Log backend for the rpi3
platform.
-Implement measured boot infrastructure in BL1 & BL2, including
the init, measure i

feat(rpi3): implement mboot for rpi3

Add Measured Boot support using the Event Log backend for the rpi3
platform.
-Implement measured boot infrastructure in BL1 & BL2, including
the init, measure image, and finish phases.
-Pass the eventlog addr and size from BL1 to BL2 using the
image entry point args.
-dump the eventlog after measuring BL2, and after all images are
measured in BL2.

Signed-off-by: Tushar Khandelwal <tushar.khandelwal@arm.com>
Signed-off-by: Abhi Singh <abhi.singh@arm.com>
Change-Id: I7c040c4a2d001a933fefb0b16f0fdf2a43a11be9

show more ...

chore(docs): drop the "wfi" from `pwr_domain_pwr_down_wfi`

To allow for generic handling of a wakeup, this hook is no longer
expected to call wfi itself. Update the name everywhere to reflect this
e

chore(docs): drop the "wfi" from `pwr_domain_pwr_down_wfi`

To allow for generic handling of a wakeup, this hook is no longer
expected to call wfi itself. Update the name everywhere to reflect this
expectation so that future platform implementers don't get misled.

Change-Id: Ic33f0b6da74592ad6778fd802c2f0b85223af614
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(rpi3): move mbedtls helper to common code

In order to support measured boot we need plat_get_mbedtls_heap,
this function currently resides in rpi3_trusted_boot.c, but we do
not need trusted

refactor(rpi3): move mbedtls helper to common code

In order to support measured boot we need plat_get_mbedtls_heap,
this function currently resides in rpi3_trusted_boot.c, but we do
not need trusted board boot to use measured boot, so moving this
to common code removes the need to compile rpi3_trusted_boot.c

Change-Id: I6ac6dfa8c540e456d7cb6932098c921907ad086a
Signed-off-by: Tushar Khandelwal <tushar.khandelwal@arm.com>
Signed-off-by: Abhi Singh <abhi.singh@arm.com>

show more ...

fix(rpi3): use correct name for include guards

fixed rpi_shared.h include guard, previously the commented
endif was RPI3_PRIVATE, which could be a cause for confusion
when searching through header f

fix(rpi3): use correct name for include guards

fixed rpi_shared.h include guard, previously the commented
endif was RPI3_PRIVATE, which could be a cause for confusion
when searching through header files.

Change-Id: I721f9f7c38cd14cda0385593b307cdfc71f810f8
Signed-off-by: Abhi Singh <abhi.singh@arm.com>

show more ...

fix(build): ensure `$(ROT_KEY)` depends on correct directory rules

In order for directories to be automatically created when used as a
dependency, they must end with a forward slash (`/`). This is b

fix(build): ensure `$(ROT_KEY)` depends on correct directory rules

In order for directories to be automatically created when used as a
dependency, they must end with a forward slash (`/`). This is because we
have a pattern rule (`%/`) to create a directory anywhere where a
directory is required as a direct dependency.

Change-Id: Ib632d59da0745f6cadb0a839a62360aeca25c178
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

Merge "fix(rpi3): manually populate CNTFRQ reg" into integration