GitLab

 - In tpm_record_measurement():

   The platform layer is responsible for providing an exhaustive list
   of images to measure. If it doesn't then this should be treated as
   a programming error, as documented in [1].

   Thus, turn the error test into an assertion.

[1] https://trustedfirmware-a.readthedocs.io/en/latest/process/coding-guidelines.html#using-assert-to-check-for-programming-errors



Change-Id: I002309c2ebdf2d348a7d12a8f7f9e82465046b8e
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

- In add_event2():

  Turn the first error condition checking whether there is room for an
  extra event2 data structure into an assertion. The platform layer is
  responsible for choosing an appropriate event log buffer size based
  on the number of measurements it expects. If this assertion fires,
  the platform macro EVENT_LOG_SIZE should be adjusted and the
  firmware recompiled.

  Call this assumption out in the function documentation.

  Also remove the second error condition check, which is a subset of
  the first one and thus is redundant.

  As a result of these changes, add_event2() can no longer fail. Thus,
  change its return type from int to void.

  Also, the 'size_of_event' local variable is now unused in release
  builds so remove it and move its value into the assertion.

Change-Id: I113fc141de59708b20435a0c7126255561ab7786
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

 - In event_log_init():

   Throughout the function, we are incrementing a pointer by some fixed
   amounts of bytes (corresponding to the size of some data structure or
   to some constant number of bytes), there is no variable-size
   increments in the picture. Thus it seems pointless to verify that the
   pointer has indeed been incremented by this fixed amount of bytes
   afterwards.

   For this reason, remove these checks altogether. As a result, the
   start_ptr local variable is now unused so remove it as well.

Change-Id: I612e2278cd3a63d1417427e45d81e285503f5efe
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

Change-Id: I5b84a28ed254a7c7bb95c18fa999592a4e3f6d90
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

* changes:
  refactor(plat/fvp): tidy up list of images to measure
  docs: explain Measured Boot dependency on Trusted Boot

* changes:
  feat(plat/mediatek/mt8195): add SPM suspend driver
  feat(plat/mediatek/mt8195): support MCUSYS off when system suspend
  feat(plat/mediatek/mt8195): add support for PTP3
  fix(plat/mediatek/mt8195): extend MMU region size

Support DRAM/MAINPLL/26M off when system suspend.
Signed-off-by: Edward-JW Yang <edward-jw.yang@mediatek.corp-partner.google.com>
Change-Id: Ib8502f9b0b4e47aa405e5449f0b6d483bd3f5d77

Add drivers to support MCUSYS off when system suspend.
Signed-off-by: Edward-JW Yang <edward-jw.yang@mediatek.corp-partner.google.com>
Change-Id: I388fd2318f471083158992464ecdf2181fc7d87a

Add PTP3 drivers to protect CPU excessive voltage drop
in CPU heavy loading.

Change-Id: I7bd37912c32d5328ba0287fccc8409794bd19c1d
Signed-off-by: Elly Chiang <elly.chiang@mediatek.com>

In mt8195 suspend/resume flow, ATF has to communicate with a subsys by
read/write the subsys registers. However, the register region of subsys
doesn't include in the MMU mapping region. It triggers MMU faults.

This patch extends the MMU region 0 size to cover all mt8195 HW modules.
This patch also remove MMU region 1 because region 0 covers region 1.

Change-Id: I3a186ed71d0d963b59ae55e27a6d27a01fe4f638
Signed-off-by: Tinghan Shen <tinghan.shen@mediatek.com>

The partition layout description JSON file generated by TF-A tests
declares a fourth test partition called Ivy demonstrating the
implementation of a S-EL0 partition supported by a S-EL1 shim.

Change-Id: If8562acfc045d6496dfdb3df0524b3a069357f8e
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

* changes:
  fix(plat/st): correct IO compensation disabling
  fix(plat/st): correct BSEC error code management
  fix(drivers/st/pmic): missing error check
  fix(drivers/st/pmic): initialize i2c_state
  fix(drivers/st/clk): use correct return value

Merge "refactor(measured boot): remove weak definition of plat_get_measured_boot_data()" into integration

Weak definitions are confusing and should be avoided if possible.
Thus, turn plat_get_measured_boot_data() into a strong definition that
platforms must provide (if they need measured boot).

We could have moved the old weak implementation under plat/common as a
sane, default implementation that platforms may pull in if it suits
them. However, this implementation right now simply measures BL2,
which is not enough to get a complete measured boot flow, so this
patch just removes it.

This change only affects the Arm FVP platform, as no other upstream
platform implements measured boot at the moment.

Change-Id: If8680a39ae0ef1044ee981315439d5e0c8461229
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

Add maintainer entry for NXP platform code
Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Change-Id: Idd5407b8a9c1aa50ba812b2b1a7ce45e8fac5027

* changes:
  fix(tc0): remove ffa and optee device tree node
  fix(tc0): set cactus-tertiary vcpu count to 1
  fix(tc0): change UUID to string format

We don't ever expect to load a binary with an STM32 header on the Arm
FVP platform so remove this type of image from the list of
measurements.

Also remove the GPT image type from the list, as it does not get
measured. GPT is a container, just like FIP is. We don't measure the FIP
but rather the images inside it. It would seem logical to treat GPT the
same way.

Besides, only images that get loaded through load_auth_image() get
measured right now. GPT processing happens before that and is handled in
a different way (see partition_init()).

Change-Id: Iac4de75380ed625b228e69ee4564cf9e67e19336
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

Change-Id: I04d9439d5967e93896dfdb0f3d7b0aec96c743f9
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

For Arm platforms PIE is enabled when RESET_TO_BL31=1 in aarch64 mode on
the similar lines enable PIE when RESET_TO_SP_MIN=1 in aarch32 mode.
The underlying changes for enabling PIE in aarch32 is submitted in
commit 4324a14b

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ib8bb860198b3f97cdc91005503a3184d63e15469

* changes:
  feat(tc0): add cpu capacity to provide scheduling information
  fix(tc0): remove "arm,psci" from psci node
  feat(tc0): update mhuv2 dts node to align with upstream driver

Signed-off-by: Usama Arif <usama.arif@arm.com>
Change-Id: I8d3342315a46c78b4c41582ec114f0364a194316

"arm,psci" expects the FIDs for cpu-on, cpu-off and cpu-suspend, which
arent present in the device tree, so remove it from psci compatible.
Signed-off-by: Usama Arif <usama.arif@arm.com>
Change-Id: Icd1ce8ec7fd3f270925e4b3d5d0187088ffe4ba5

The MHUv2 driver has been merged upstream, and it has a different
dts format compared to what was previously used. This patch aligns
with the upstream driver.
Signed-off-by: Usama Arif <usama.arif@arm.com>
Change-Id: Ic963c21c1475d301c3a75686718e6e17841831c3

Enables SVE support for the secure world via ENABLE_SVE_FOR_SWD.
ENABLE_SVE_FOR_SWD defaults to 0 and has to be explicitly set by the
platform. SVE is configured during initial setup and then uses EL3
context save/restore routine to switch between SVE configurations for
different contexts.
Reset value of CPTR_EL3 changed to be most restrictive by default.
Signed-off-by: Max Shvetsov <maksims.svecovs@arm.com>
Change-Id: I889fbbc2e435435d66779b73a2d90d1188bf4116

As FF-A driver probes OP-TEE SP dynamically, these entries are no more
required.
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Ica091722a7fad13e02662b9b2cd11ca1879b9f80

Third instance of cactus is a UP SP. Set its vcpu count to 1.
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I34b7feb2915e6d335e690e89dea466e75944ed1b

Change OP-TEE, Cactus SPs UUID to string format
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I32dbf40e4c5aa959bb92d3e853072aea63409ddc

Cortex A78 erratum 1821534 is a Cat B erratum present in r0p0 and
r1p0 of the A78 processor core, it is fixed in r1p1.

SDEN can be found here:
https://documentation-service.arm.com/static/603e3733492bde1625aa8780

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I71057c4b9625cd9edc1a06946b453cf16ae5ea2c