Tegra: fiq_glue: remove bakery locks from interrupt handler

This patch removes usage of bakery_locks from the FIQ handler, as it
creates unnecessary dependency whenever the watchdog timer interrupt

Tegra: fiq_glue: remove bakery locks from interrupt handler

This patch removes usage of bakery_locks from the FIQ handler, as it
creates unnecessary dependency whenever the watchdog timer interrupt
fires. All operations inside the interrupt handler are 'reads', so
no need for serialization.

Change-Id: I3f675e610e4dabc5b1435fdd24bc28e424f5a8e4
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

show more ...

Tegra210: SE: add context save support

Tegra210B01 SoCs support atomic context save for the two SE
hardware engines. Tegra210 SoCs have support for only one SE
engine and support a software based sa

Tegra210: SE: add context save support

Tegra210B01 SoCs support atomic context save for the two SE
hardware engines. Tegra210 SoCs have support for only one SE
engine and support a software based save/restore mechanism
instead.

This patch updates the SE driver to make this change.

Change-Id: Ia5e5ed75d0fe011f17809684bbc2ed2338925946
Signed-off-by: Harvey Hsieh <hhsieh@nvidia.com>

show more ...

Tegra210: update the PMC blacklisted registers

Update the list to include PMC registers that the NS world cannot
access even with smc calls.

Change-Id: I588179b56ebc0c29200b55e6d61535fd3a7a3b7e
Sig

Tegra210: update the PMC blacklisted registers

Update the list to include PMC registers that the NS world cannot
access even with smc calls.

Change-Id: I588179b56ebc0c29200b55e6d61535fd3a7a3b7e
Signed-off-by: kalyani chidambaram <kalyanic@nvidia.com>

show more ...

Tegra: disable CPUACTLR access from lower exception levels

This patch resets the macros to update the CPUACTLR_ELx to make
them generic for all exception levels.

Change-Id: I33e9b860efb543934b654a2

Tegra: disable CPUACTLR access from lower exception levels

This patch resets the macros to update the CPUACTLR_ELx to make
them generic for all exception levels.

Change-Id: I33e9b860efb543934b654a2f5d775135df7f1aa6
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

show more ...

cpus: denver: fixup register used to store return address

The denver_enable_dco and denver_disable_dco use register X3 to store
the return address. But X3 gets over-written by other functions,
downs

cpus: denver: fixup register used to store return address

The denver_enable_dco and denver_disable_dco use register X3 to store
the return address. But X3 gets over-written by other functions,
downstream.

This patch stores the return address to X18 instead, to fix this
anomaly.

Change-Id: Ic40bfc1d9abaa7b90348843b9ecd09521bb4ee7b
Signed-off-by: Kalyani Chidambaram <kalyanic@nvidia.com>

show more ...

Merge "aarch32: stop speculative execution past exception returns" into integration

Merge changes from topic "tbbr/fw_enc" into integration

* changes:
docs: qemu: Add instructions to boot using FIP image
docs: Update docs with firmware encryption feature
qemu: Support optiona

Merge changes from topic "tbbr/fw_enc" into integration

* changes:
docs: qemu: Add instructions to boot using FIP image
docs: Update docs with firmware encryption feature
qemu: Support optional encryption of BL31 and BL32 images
qemu: Update flash address map to keep FIP in secure FLASH0
Makefile: Add support to optionally encrypt BL31 and BL32
tools: Add firmware authenticated encryption tool
TBB: Add an IO abstraction layer to load encrypted firmwares
drivers: crypto: Add authenticated decryption framework

show more ...

docs: qemu: Add instructions to boot using FIP image

Update qemu documentation with instructions to boot using FIP image.
Also, add option to build TF-A with TBBR and firmware encryption
enabled.

S

docs: qemu: Add instructions to boot using FIP image

Update qemu documentation with instructions to boot using FIP image.
Also, add option to build TF-A with TBBR and firmware encryption
enabled.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: Ib3af485d413cd595352034c82c2268d7f4cb120a

show more ...

docs: Update docs with firmware encryption feature

Update documentation with optional firmware encryption feature.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I26691b18e1ee52a73090

docs: Update docs with firmware encryption feature

Update documentation with optional firmware encryption feature.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I26691b18e1ee52a73090954260f26f2865c4e05a

show more ...

Merge "fdts: a5ds: add ethernet node in devicetree" into integration

Merge "uniphier: shrink UNIPHIER_ROM_REGION_SIZE" into integration

Merge "TSP: corrected log information" into integration

Necessary fix in drivers to upgrade to mbedtls-2.18.0

Include x509.h header file explicitly. Update docs.

Change-Id: If2e52c2cd3056654406b7b6779b67eea5cc04a48
Signed-off-by: Madhukar Pappireddy <ma

Necessary fix in drivers to upgrade to mbedtls-2.18.0

Include x509.h header file explicitly. Update docs.

Change-Id: If2e52c2cd3056654406b7b6779b67eea5cc04a48
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

locks: bakery: add a DMB to the 'read_cache_op' macro

ARM has a weak memory ordering model. This means that without
explicit barriers, memory accesses can be observed differently
than program order.

locks: bakery: add a DMB to the 'read_cache_op' macro

ARM has a weak memory ordering model. This means that without
explicit barriers, memory accesses can be observed differently
than program order. In this case, the cache invalidate instruction
can be observed after the subsequent read to address.

To solve this, a DMB instruction is required between the cache
invalidate and the read. This ensures that the cache invalidate
completes before all memory accesses in program order after the DMB.

This patch updates the 'read_cache_op' macro to issue a DMB after
the cache invalidate instruction to fix this anomaly.

Change-Id: Iac9a90d228c57ba8bcdca7e409ea6719546ab441
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

show more ...

TSP: corrected log information

In CPU resume function, CPU suspend count was printed instead of CPU
resume count.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I0c081dc03a4ccfb21

TSP: corrected log information

In CPU resume function, CPU suspend count was printed instead of CPU
resume count.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I0c081dc03a4ccfb2129687f690667c5ceed00a5f

show more ...

Fix crash dump for lower EL

This patch provides a fix for incorrect crash dump data for
lower EL when TF-A is built with HANDLE_EA_EL3_FIRST=1 option
which enables routing of External Aborts and SEr

Fix crash dump for lower EL

This patch provides a fix for incorrect crash dump data for
lower EL when TF-A is built with HANDLE_EA_EL3_FIRST=1 option
which enables routing of External Aborts and SErrors to EL3.

Change-Id: I9d5e6775e6aad21db5b78362da6c3a3d897df977
Signed-off-by: Alexei Fedorov <Alexei.Fedorov@arm.com>

show more ...

uniphier: shrink UNIPHIER_ROM_REGION_SIZE

Currently, the ROM region is needlessly too large.

The on-chip SRAM region of the next SoC will start from 0x04000000,
and this will cause the region overl

uniphier: shrink UNIPHIER_ROM_REGION_SIZE

Currently, the ROM region is needlessly too large.

The on-chip SRAM region of the next SoC will start from 0x04000000,
and this will cause the region overlap.

Mapping 0x04000000 for the ROM is enough.

Change-Id: I85ce0bb1120ebff2e3bc7fd13dc0fd15dfff5ff6
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

show more ...

Merge "driver/arm/css: minor bug fix" into integration

qemu: Support optional encryption of BL31 and BL32 images

Enable encryption IO layer to be stacked above FIP IO layer for optional
encryption of Bl31 and BL32 images in case ENCRYPT_BL31 or ENCRYPT_

qemu: Support optional encryption of BL31 and BL32 images

Enable encryption IO layer to be stacked above FIP IO layer for optional
encryption of Bl31 and BL32 images in case ENCRYPT_BL31 or ENCRYPT_BL32
build flag is set.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I24cba64728861e833abffc3d5d9807599c49feb6

show more ...

qemu: Update flash address map to keep FIP in secure FLASH0

Secure FLASH0 memory map looks like:
- Offset: 0 to 256K -> bl1.bin
- Offset: 256K to 4.25M -> fip.bin

FLASH1 is normally used via UEFI/e

qemu: Update flash address map to keep FIP in secure FLASH0

Secure FLASH0 memory map looks like:
- Offset: 0 to 256K -> bl1.bin
- Offset: 256K to 4.25M -> fip.bin

FLASH1 is normally used via UEFI/edk2 to keep varstore.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I6883f556c22d6a5d3fa3846c703bebc2abe36765

show more ...

Makefile: Add support to optionally encrypt BL31 and BL32

Following build flags have been added to support optional firmware
encryption:

- FW_ENC_STATUS: Top level firmware's encryption numeric fla

Makefile: Add support to optionally encrypt BL31 and BL32

Following build flags have been added to support optional firmware
encryption:

- FW_ENC_STATUS: Top level firmware's encryption numeric flag, values:
0: Encryption is done with Secret Symmetric Key (SSK) which is
common for a class of devices.
1: Encryption is done with Binding Secret Symmetric Key (BSSK) which
is unique per device.

- ENC_KEY: A 32-byte (256-bit) symmetric key in hex string format. It
could be SSK or BSSK depending on FW_ENC_STATUS flag.

- ENC_NONCE: A 12-byte (96-bit) encryption nonce or Initialization Vector
(IV) in hex string format.

- ENCRYPT_BL31: Binary flag to enable encryption of BL31 firmware.

- ENCRYPT_BL32: Binary flag to enable encryption of Secure BL32 payload.

Similar flags can be added to encrypt other firmwares as well depending
on use-cases.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I94374d6830ad5908df557f63823e58383d8ad670

show more ...

tools: Add firmware authenticated encryption tool

Add firmware authenticated encryption tool which utilizes OpenSSL
library to encrypt firmwares using a key provided via cmdline. Currently
this tool

tools: Add firmware authenticated encryption tool

Add firmware authenticated encryption tool which utilizes OpenSSL
library to encrypt firmwares using a key provided via cmdline. Currently
this tool supports AES-GCM as an authenticated encryption algorithm.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I60e296af1b98f1912a19d5f91066be7ea85836e4

show more ...

TBB: Add an IO abstraction layer to load encrypted firmwares

TBBR spec advocates for optional encryption of firmwares (see optional
requirement: R060_TBBR_FUNCTION). So add an IO abstaction layer to

TBB: Add an IO abstraction layer to load encrypted firmwares

TBBR spec advocates for optional encryption of firmwares (see optional
requirement: R060_TBBR_FUNCTION). So add an IO abstaction layer to
support firmware decryption that can be stacked above any underlying IO/
packaging layer like FIP etc. It aims to provide a framework to load any
encrypted IO payload.

Also, add plat_get_enc_key_info() to be implemented in a platform
specific manner as handling of encryption key may vary from one platform
to another.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I9892e0ddf00ebecb8981301dbfa41ea23e078b03

show more ...

drivers: crypto: Add authenticated decryption framework

Add framework for autheticated decryption of data. Currently this
patch optionally imports mbedtls library as a backend if build option
"DECRY

drivers: crypto: Add authenticated decryption framework

Add framework for autheticated decryption of data. Currently this
patch optionally imports mbedtls library as a backend if build option
"DECRYPTION_SUPPORT = aes_gcm" is set to perform authenticated decryption
using AES-GCM algorithm.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Change-Id: I2966f0e79033151012bf4ffc66f484cd949e7271

show more ...

Merge changes from topic "spmd-sel2" into integration

* changes:
SPMD: add command line parameter to run SPM at S-EL2 or S-EL1
SPMD: smc handler qualify secure origin using booleans
SPMD: SPMC

Merge changes from topic "spmd-sel2" into integration

* changes:
SPMD: add command line parameter to run SPM at S-EL2 or S-EL1
SPMD: smc handler qualify secure origin using booleans
SPMD: SPMC init, SMC handler cosmetic changes
SPMD: [tegra] rename el1_sys_regs structure to sys_regs
SPMD: Adds partially supported EL2 registers.
SPMD: save/restore EL2 system registers.

show more ...