fix(lfa): validate component_id before activation check

Reorder checks so component_id is validated before indexing
lfa_components.
Prevents out-of-range access when an invalid component_id is
passe

fix(lfa): validate component_id before activation check

Reorder checks so component_id is validated before indexing
lfa_components.
Prevents out-of-range access when an invalid component_id is
passed while activation is not pending.

Change-Id: Ia0ae60d95c07840dfdc52ce0b4f7e511a28541bc
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>

show more ...

fix(lfa): fix verbose message for CPU hold count

Report remaining CPUs based on the local no_of_cpus value
instead of the platform core count.
This keeps the verbose message consistent with the chec

fix(lfa): fix verbose message for CPU hold count

Report remaining CPUs based on the local no_of_cpus value
instead of the platform core count.
This keeps the verbose message consistent with the check
logic used in lfa_holding_start().

Change-Id: Ia8885f048b45e0aeea5ff9dfe5c2b32e21a5186e
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(rmmd): fix rmm_init() return convention and LFA activation failure

rmm_init() uses an inverted return convention where 0 indicates failure
and 1 indicates success. This is inconsistent with the

fix(rmmd): fix rmm_init() return convention and LFA activation failure

rmm_init() uses an inverted return convention where 0 indicates failure
and 1 indicates success. This is inconsistent with the TF-A convention
of 0=success / negative=error and creates a latent bug in
rmmd_primary_activate().

rmmd_primary_activate() correctly detects the failure case with
"if (rc == 0)" but then returns rc (which is 0) to the LFA framework.
Since LFA_SUCCESS is also defined as 0, the LFA framework treats an
RMM init failure as a successful activation, releases the CPU holding
pen with LFA_SUCCESS, and all secondary CPUs proceed into
rmmd_secondary_activate() with rmm_boot_failed set to true. The NS
world caller is falsely told the live firmware update succeeded.

Fix rmm_init() to return 0 on success and -1 on failure, matching
the standard TF-A convention. Update call sites accordingly:
- bl31_main.c: correct the failure check from == 0 to != 0
- rmmd_primary_activate(): correct the failure check from == 0 to != 0
and return the plain error code from rmm_init()
- rmmd_rmm_lfa.c: map activation failure to LFA_ACTIVATION_FAILED
instead of LFA_BUSY, keeping LFA error mapping in the LFA layer

Change-Id: Ib7e3f2a91c4d8e5f3a2b1c0d9e8f7a6b5c4d3e2f
Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>

show more ...

Merge changes from topics "mb/drtm-sec-fix", "mb/sec-fixes" into integration

* changes:
fix(drtm): validate NWd DCE region size to prevent overflow
fix(arm): bound backup GPT spec length
fix(j

Merge changes from topics "mb/drtm-sec-fix", "mb/sec-fixes" into integration

* changes:
fix(drtm): validate NWd DCE region size to prevent overflow
fix(arm): bound backup GPT spec length
fix(juno): raise BL2 max size for hardened IO checks
fix(io): validate FIP ToC bounds and catch short reads
feat(lib): add u64 overflow helper

show more ...

fix(drtm): validate NWd DCE region size to prevent overflow

The Normal World DCE region bounds were computed using 32-bit
arithmetic, allowing size+start to wrap. Use 64-bit variables and
reject siz

fix(drtm): validate NWd DCE region size to prevent overflow

The Normal World DCE region bounds were computed using 32-bit
arithmetic, allowing size+start to wrap. Use 64-bit variables and
reject sizes that overflow the address calculation, returning
INVALID_PARAMETERS with an error log. This prevents accepting
discontiguous or invalid regions.

Change-Id: I922014f96188c9b45907f9fb0eda6f9ec8c9f634
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(firme): granule management service

Report granule management service support and instances based on RME
support.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id:

fix(firme): granule management service

Report granule management service support and instances based on RME
support.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I5495df43914a495aa994c1475cb24e0d1322b7b0

show more ...

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME rela

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME related support is now enabled using feature detection option
ENABLE_FEAT_RME, this patch moves GPT support under ENABLE_FEAT_RME.

This change brings in below benefits:
- single TF-A build that works for RME and non-RME systems, when
build with ENABLE_FEAT_RME=2 (FEAT_STATE_CHECK)
- RMM loading is optional on RME systems
- SiP calls that leverages RME features to change the PAS of a memory
range from non-secure to secure is supported without need to enable
Realm PAS or RMM.
- FIRME Granule Management Interface (GMI) ABIs that handles
FEAT_RME_GPC2/FEAT_RME_GDI can be enabled without need to enable RMM

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I88d9d4e0491af2b4ae0307c018f2d4a71ee6693f

show more ...

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option perfor

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option performs RMM-specific tasks such as GPT setup, loading the RMM,
and enabling RMMD support.

Since ENABLE_RME now only controls RMM-related functionality, rename it
to ENABLE_RMM to better reflect its purpose and avoid confusion with
ENABLE_FEAT_RME.

For backward compatibility, setting the legacy ENABLE_RME=1 (until it is
deprecated) will automatically enable both ENABLE_FEAT_RME and
ENABLE_RMM.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Iac945bdffe5002161bf1161b81a5aa7abec68192

show more ...

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full RMM loading and handling.

While full CCA support requires all of these steps, some systems running
on FEAT_RME-capable cores do not need or want an RMM. However, such
systems still require TF-A page table entries to set the .NSE bit so
that TF-A accesses are correctly attributed to the ROOT world,
otherwise, enabling the MMU may cause the system to hang.

To address this, a new build option, ENABLE_FEAT_RME, is introduced. It
handles only the .NSE PTE setup and ignores the rest of the RME/RMM
initialization. ENABLE_FEAT_RME follows the ENABLE_FEAT_* convention and
supports values 0–2, with 2 enabling runtime detection.

Full RME functionality remains gated by ENABLE_RME, which now implicitly
enables ENABLE_FEAT_RME, allowing TF-A to run safely on FEAT_RME systems
without requiring an RMM.

Change-Id: I8391652842ff2e62a73b61829c6250c3805d4a4e
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fix(trp): add new RMMv2 ABI support

support RMI_RMM_CONFIG_GET RMI_RMM_CONFIG_SET ABI

Change-Id: Ia8f1bbf4b469d66d2f8a83e10f75a7caccc2f6ed
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

fix(optee): align FDT buffer size with OP-TEE for in-place updates

The addition of new Widevine properties caused the generated device tree
to consume more space. While the final size in ATF was und

fix(optee): align FDT buffer size with OP-TEE for in-place updates

The addition of new Widevine properties caused the generated device tree
to consume more space. While the final size in ATF was under 1024 bytes,
the OP-TEE OS performs in-place updates to the FDT after handoff.
These updates exceeded the previous 1024-byte buffer, leading to silent
corruption of the adjacent opteed_sp_context array and an assertion
failure in opteed_common.c:79.

Increase OPTEED_FDT_SIZE to 2048 to provide sufficient headroom for
OP-TEE's runtime fixups. This matches OP-TEE's CFG_DTB_MAX_SIZE
setting and ensures consistency between the two components.

Change-Id: I76581779b214ff86ca1c5b141d0bb44b1ea606c5
Signed-off-by: Yidi Lin <yidilin@google.com>

show more ...

Merge changes from topic "bk/wa_fixes" into integration

* changes:
docs(cpus): explain why the ARCH_WORKAROUND_3 pseudo-erratum is needed
fix(cpus): return ERRATA_MISSING when errata not found

Merge changes from topic "bk/wa_fixes" into integration

* changes:
docs(cpus): explain why the ARCH_WORKAROUND_3 pseudo-erratum is needed
fix(cpus): return ERRATA_MISSING when errata not found
style(smccc): group the ARCH_WORKAROUND_Xs together
style(cpus): add spaces around the CVE-2022-23960 on Neoverse V2
refactor(cpus): clean up FEAT_CSV2 checkers

show more ...

feat(firme): initial commit of FIRME service

This is the first FIRME service patch that adds support for basic ABIs
for retrieving the FIRME version, features, and GPI_SET.

This adds a new generic

feat(firme): initial commit of FIRME service

This is the first FIRME service patch that adds support for basic ABIs
for retrieving the FIRME version, features, and GPI_SET.

This adds a new generic granule transition function that replaces
the existing delegate/undelegate APIs that GPI_SET uses. It also
updates TRP to use GPI_SET when FIRME is supported.

FIRME spec is here, note that it is ALPHA2 quality so further changes
are to be expected:
https://developer.arm.com/documentation/den0149

Change-Id: I57b8ad7e87a0679e15c8247f8457f91f3254dedb
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge "fix(errata-abi): use boolean and braces" into integration

Merge "feat(trp): add support for rmm 2.0 abis" into integration

feat(trp): add support for rmm 2.0 abis

add support for RMI_GRANULE_RANGE_(UN)DELEGATE
RMI_RMM_ACTIVATE commands

Change-Id: I4c9d5e598bbc4a033048b33a4377aafdf7e2d3de
Signed-off-by: Shruti Gupta <sh

feat(trp): add support for rmm 2.0 abis

add support for RMI_GRANULE_RANGE_(UN)DELEGATE
RMI_RMM_ACTIVATE commands

Change-Id: I4c9d5e598bbc4a033048b33a4377aafdf7e2d3de
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

fix(lfa): no need to decrement activation_count

The activation_count variable is used to decide if all the secondary
cores are holding the pen before proceeding with the activation. The
`lfa_holding

fix(lfa): no need to decrement activation_count

The activation_count variable is used to decide if all the secondary
cores are holding the pen before proceeding with the activation. The
`lfa_holding_start` handler increments the counter for each core and
`lfa_holding_release` eventually resets it to `0`. The previous code
decremented the counter from `lfa_holding_wait` which caused an
imbalance on subsequent activations.

Imagine a scenario, where the leader CPU activates an image and unlocks
the pen, thus reseting the counter. The secondary cores will then end
up creating an underflow during their exit from 'lfa_holding_pen'. For
tracking purposes, we just need to know that we have taken the lock on
all secondary cores, so no need to decrement the counter.

This patch removes the logic to decrement the counter to fix this
underflow issue.

Verified with multiple back to back activations that require CPU
rendezvous.

Change-Id: Idfbae8008abac933d13f2100dd6c7e50ac1a1c4d
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

show more ...

feat(cros): add GSC, DRM, and Stable HUK SMC handlers

Add new SMC handlers to set the GSC counter key, DRM device key, and
Stable Hardware Unique Key for ChromeOS Widevine. These keys are then
passe

feat(cros): add GSC, DRM, and Stable HUK SMC handlers

Add new SMC handlers to set the GSC counter key, DRM device key, and
Stable Hardware Unique Key for ChromeOS Widevine. These keys are then
passed to the OP-TEE device tree node.

Change-Id: Id31f8101d9783e709c9984089674220d93596531
Signed-off-by: Yidi Lin <yidilin@google.com>

show more ...

fix(errata-abi): use boolean and braces

MISRA violation C2012-14.4:
The controlling expression of an if statement and the controlling
expression of an iteration-statement shall have essentially Bool

fix(errata-abi): use boolean and braces

MISRA violation C2012-14.4:
The controlling expression of an if statement and the controlling
expression of an iteration-statement shall have essentially Boolean
type.
Used boolean in control expressions for fixing this violation.

MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement
shall be a compound-statement. Enclosed statement body within
the curly braces.

Change-Id: Ifb7b5794d9c86612f76e67310fac8339fd5604a1
Signed-off-by: Sai Varun Venkatapuram <saivarun.venkatapuram@amd.com>

show more ...

Merge changes from topic "el3-rmm-itf" into integration

* changes:
docs(rmm): update EL3-RMM contract
feat(rmmd): expand RMM SMC return registers
fix(cm): don't context switch GICv3 registers

Merge changes from topic "el3-rmm-itf" into integration

* changes:
docs(rmm): update EL3-RMM contract
feat(rmmd): expand RMM SMC return registers
fix(cm): don't context switch GICv3 registers on NS<->RL transitions

show more ...

feat(rmmd): expand RMM SMC return registers

This change expands the number of return registers
that RMM can use when returning from SMC calls,
increasing from 5 registers (x0-x4) to 8 registers (x0-

feat(rmmd): expand RMM SMC return registers

This change expands the number of return registers
that RMM can use when returning from SMC calls,
increasing from 5 registers (x0-x4) to 8 registers (x0-x7).
The RMM-EL3 Interface version is bumped to 2.0 as this
is an incompatible change.

This maintains SMCCC v1.2 compliance where x4-x7 are
preserved unless used as return values.
The responsibility for preserving these registers
when not used lies with RMM.

Changed TRP to handle additional return values x0-x7.

Change-Id: Ifd88a3bd68f53beb230e830f0d6e4365cedfd728
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targetin

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targeting the
more recently introduced Realm world. Hence the new RMMv2.0
specification mandates that EL3 should not save and restore
the GIC registers on a world switch. This change is not backward
compatible with RMMv1.x ABI.

Note the change in implementation of cm_el2_sysregs_context_save()
and cm_el2_sysregs_context_restore() API as GIC state is not
managed by these APIs anymore.

Add new build flag RMM_V1_COMPAT to support backward compatibility
with RMMv1.x. This flag is currently enabled by default.

This patch is a reworked version of the original patch at:
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/45658

NOTE: If RMM_V1_COMPAT is not enabled, then RMM_EL3_IFC_VERSION
is bumped to 1.0 which makes it incompatible with an RMM supporting
0.x.

Change-Id: If4c53b85ef31091c254b383ed7b32c39124f0dbb
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

feat(drtm): check for DLME image auth plat support

Check if DLME image authentication (Bit[6]) is supported by platform.
Reject with invalid parameters if not supported.

Signed-off-by: Lauren Wehrm

feat(drtm): check for DLME image auth plat support

Check if DLME image authentication (Bit[6]) is supported by platform.
Reject with invalid parameters if not supported.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I69aec9f81add4b32b4268775a6289ccc63f21642

show more ...

Merge changes from topic "mp/live_activate_sp" into integration

* changes:
docs(spm): describe support for SP live activation and relevant build flags
docs(spm): document ff-a manifest binding f

Merge changes from topic "mp/live_activate_sp" into integration

* changes:
docs(spm): describe support for SP live activation and relevant build flags
docs(spm): document ff-a manifest binding for SP live activation
feat(fvp): implement SP live activation callback
feat(fvp): enable discovery of two Secure Partitions for live activation
feat(fvp): introduce SP live activation component manager
feat(spmd): helpers for SP live activation framework messages
feat(lfa): build flags for SP live activation support
chore(fvp): remove the dummy function fvp_get_partition_info
feat(spmd): support for extended partition info descriptor

show more ...

feat(spmd): helpers for SP live activation framework messages

This patch provides helper functions that enable an LSP to send
appropriate framework messages to SPMC in order to orchestrate
live acti

feat(spmd): helpers for SP live activation framework messages

This patch provides helper functions that enable an LSP to send
appropriate framework messages to SPMC in order to orchestrate
live activation of a physical SP.

BREAKING CHANGE: Temporarily fails to build

Change-Id: I1b7dcf91e08fc7d85b47f2b39330d1351f8294dd
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...