GitLab

In BL2, the DDR can be mapped as secured in MMU, as no other SW
has access to it during its execution.
The TZC400 configuration is also updated to reflect this. When using
OP-TEE, the TZC400 is reconfigured at the end of BL2, to match OP-TEE
mapping. Else, SP_min will be in charge to reconfigure TZC400 to set
DDR non-secure.

Change-Id: Ic5ec614b218f733796feeab1cdc425d28cc7c103
Signed-off-by: Yann Gautier <yann.gautier@st.com>

Add new static functions to factorize code in stm32mp1_security.c.

Change-Id: Ifa5a1aaf7c56c25dba9a0ab8e985496d7cb06990
Signed-off-by: Yann Gautier <yann.gautier@st.com>

Change-Id: I65da6ead356e3f4ee47c5a6bf391f65309bafcdd
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

Change-Id: Ia660b6554fe4544effd1810e1aca202f95e3c447
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

* changes:
  fix(plat/xilinx/versal): use sync method for blocking calls
  fix(plat/xilinx/zynqmp): use sync method for blocking calls

All API calls except non-blocking should wait for
IPI response and read buffer to check return status
from firmware. Some of API calls are not reading
status from IPI payload data. Use sync method which
reads actual return status from IPI payload.
Signed-off-by: Abhyuday Godhasara <abhyuday.godhasara@xilinx.com>
Change-Id: I6f568b85d0da639c264f507122e3015807d8423d

All API calls except non-blocking should wait for
IPI response and read buffer to check return status
from firmware. Some of API calls are not reading
status from IPI payload data. Use sync method which
reads actual return status from IPI payload.
Signed-off-by: Abhyuday Godhasara <abhyuday.godhasara@xilinx.com>
Change-Id: I78f9c061a80cee6d524ade4ef124ca88ce1848cf

* changes:
  refactor(measured boot): revisit error handling (3/3)
  refactor(measured boot): revisit error handling (2/3)
  refactor(measured boot): revisit error handling (1/3)

* changes:
  refactor(plat/st): add stm32image_io_setup
  fix(plat/st): panic if boot interface is wrong

* changes:
  fix(tools/stm32image): improve the tool
  fix(plat/st): add STM32IMAGE_SRC

 - In tpm_record_measurement():

   The platform layer is responsible for providing an exhaustive list
   of images to measure. If it doesn't then this should be treated as
   a programming error, as documented in [1].

   Thus, turn the error test into an assertion.

[1] https://trustedfirmware-a.readthedocs.io/en/latest/process/coding-guidelines.html#using-assert-to-check-for-programming-errors



Change-Id: I002309c2ebdf2d348a7d12a8f7f9e82465046b8e
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

- In add_event2():

  Turn the first error condition checking whether there is room for an
  extra event2 data structure into an assertion. The platform layer is
  responsible for choosing an appropriate event log buffer size based
  on the number of measurements it expects. If this assertion fires,
  the platform macro EVENT_LOG_SIZE should be adjusted and the
  firmware recompiled.

  Call this assumption out in the function documentation.

  Also remove the second error condition check, which is a subset of
  the first one and thus is redundant.

  As a result of these changes, add_event2() can no longer fail. Thus,
  change its return type from int to void.

  Also, the 'size_of_event' local variable is now unused in release
  builds so remove it and move its value into the assertion.

Change-Id: I113fc141de59708b20435a0c7126255561ab7786
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

 - In event_log_init():

   Throughout the function, we are incrementing a pointer by some fixed
   amounts of bytes (corresponding to the size of some data structure or
   to some constant number of bytes), there is no variable-size
   increments in the picture. Thus it seems pointless to verify that the
   pointer has indeed been incremented by this fixed amount of bytes
   afterwards.

   For this reason, remove these checks altogether. As a result, the
   start_ptr local variable is now unused so remove it as well.

Change-Id: I612e2278cd3a63d1417427e45d81e285503f5efe
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

In the qemu memory map 1GB and up is RAM. Change the
size of NS DRAM to 3GB to support VM's with more
memory requirements.
Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Change-Id: If15cf3b9d3e2e7876c40ce888f22e887893fe696

Change-Id: I5b84a28ed254a7c7bb95c18fa999592a4e3f6d90
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

* changes:
  refactor(plat/fvp): tidy up list of images to measure
  docs: explain Measured Boot dependency on Trusted Boot

* changes:
  feat(plat/mediatek/mt8195): add SPM suspend driver
  feat(plat/mediatek/mt8195): support MCUSYS off when system suspend
  feat(plat/mediatek/mt8195): add support for PTP3
  fix(plat/mediatek/mt8195): extend MMU region size

Support DRAM/MAINPLL/26M off when system suspend.
Signed-off-by: Edward-JW Yang <edward-jw.yang@mediatek.corp-partner.google.com>
Change-Id: Ib8502f9b0b4e47aa405e5449f0b6d483bd3f5d77

Add drivers to support MCUSYS off when system suspend.
Signed-off-by: Edward-JW Yang <edward-jw.yang@mediatek.corp-partner.google.com>
Change-Id: I388fd2318f471083158992464ecdf2181fc7d87a

Add PTP3 drivers to protect CPU excessive voltage drop
in CPU heavy loading.

Change-Id: I7bd37912c32d5328ba0287fccc8409794bd19c1d
Signed-off-by: Elly Chiang <elly.chiang@mediatek.com>

In mt8195 suspend/resume flow, ATF has to communicate with a subsys by
read/write the subsys registers. However, the register region of subsys
doesn't include in the MMU mapping region. It triggers MMU faults.

This patch extends the MMU region 0 size to cover all mt8195 HW modules.
This patch also remove MMU region 1 because region 0 covers region 1.

Change-Id: I3a186ed71d0d963b59ae55e27a6d27a01fe4f638
Signed-off-by: Tinghan Shen <tinghan.shen@mediatek.com>

The partition layout description JSON file generated by TF-A tests
declares a fourth test partition called Ivy demonstrating the
implementation of a S-EL0 partition supported by a S-EL1 shim.

Change-Id: If8562acfc045d6496dfdb3df0524b3a069357f8e
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

* changes:
  fix(plat/st): correct IO compensation disabling
  fix(plat/st): correct BSEC error code management
  fix(drivers/st/pmic): missing error check
  fix(drivers/st/pmic): initialize i2c_state
  fix(drivers/st/clk): use correct return value

Merge "refactor(measured boot): remove weak definition of plat_get_measured_boot_data()" into integration

Weak definitions are confusing and should be avoided if possible.
Thus, turn plat_get_measured_boot_data() into a strong definition that
platforms must provide (if they need measured boot).

We could have moved the old weak implementation under plat/common as a
sane, default implementation that platforms may pull in if it suits
them. However, this implementation right now simply measures BL2,
which is not enough to get a complete measured boot flow, so this
patch just removes it.

This change only affects the Arm FVP platform, as no other upstream
platform implements measured boot at the moment.

Change-Id: If8680a39ae0ef1044ee981315439d5e0c8461229
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>

Add maintainer entry for NXP platform code
Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com>
Change-Id: Idd5407b8a9c1aa50ba812b2b1a7ce45e8fac5027

Add a generic function to setup the stm32image IO.

Change-Id: I0f7cf4a6030605037643f3119b809e0319d926af
Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com>
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>

Add a panic() at the end of stm32mp_io_setup() if the boot interface
given in ROM code boot context is not supported.

Change-Id: I0d50f21a11231febd21041b6e63108cc3e6f4f0c
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>

* changes:
  fix(tc0): remove ffa and optee device tree node
  fix(tc0): set cactus-tertiary vcpu count to 1
  fix(tc0): change UUID to string format