feat(build): enable link-time optimization by default

Enable LTO by default for all platforms and compilers. LTO performs
optimisation at link-time rather than at compilation time, and allows
optimi

feat(build): enable link-time optimization by default

Enable LTO by default for all platforms and compilers. LTO performs
optimisation at link-time rather than at compilation time, and allows
optimisations to be made across compilation unit boundaries (i.e. C
files). This is especially useful in areas with lots of closely related
compilation units that operate on the same data structures (eg PSCI and
context management).

The only drawback is that LTO makes conditions ripe for the build to
heavily mangle all functions, making debugging a nightmare. So only
enable for release builds.

Note this will make object files unintepretable by objdump. Use lto-dump
instead.

BREAKING-CHANGE: LTO has been enabled by default, which may cause
unpredictable issues for platforms where the linker scripts have not
been designed with LTO in mind. Please report any issues to the
[mailing list](mailto:tf-a@lists.trustedfirmware.org).

Change-Id: Ia472aff1a23366d918abded7a1c5da695f2c4787
Co-authored-by: Chris Kay <chris.kay@arm.com>
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

docs: update docs w/ min tool version

The minimum Node version was updated to the latest LTS release. Update
the docs to reflect this change. While we're at it, clean up remaining
references from th

docs: update docs w/ min tool version

The minimum Node version was updated to the latest LTS release. Update
the docs to reflect this change. While we're at it, clean up remaining
references from the Arm GNU toolchain version update and set the minimum
for GNU Make to whatever is provided by Ubuntu 22.04.

Change-Id: I16923c9cf69b34f78f19bc10e3bed72b70ae8132
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge changes from topic "ar/idte3" into integration

* changes:
feat(cpufeat): add support for FEAT_IDTE3
feat(cpufeat): include enabled security state scope
feat(cpufeat): add ID register def

Merge changes from topic "ar/idte3" into integration

* changes:
feat(cpufeat): add support for FEAT_IDTE3
feat(cpufeat): include enabled security state scope
feat(cpufeat): add ID register defines and read helpers

show more ...

feat(cpufeat): add support for FEAT_IDTE3

This patch adds support for FEAT_IDTE3, which introduces support
for handling the trapping of Group 3 and Group 5 (only GMID_EL1)
registers to EL3 (unless t

feat(cpufeat): add support for FEAT_IDTE3

This patch adds support for FEAT_IDTE3, which introduces support
for handling the trapping of Group 3 and Group 5 (only GMID_EL1)
registers to EL3 (unless trapped to EL2). IDTE3 allows EL3 to
modify the view of ID registers for lower ELs, and this capability
is used to disable fields of ID registers tied to disabled features.

The ID registers are initially read as-is and stored in context.
Then, based on the feature enablement status for each world, if a
particular feature is disabled, its corresponding field in the
cached ID register is set to Res0. When lower ELs attempt to read
an ID register, the cached ID register value is returned. This
allows EL3 to prevent lower ELs from accessing feature-specific
system registers that are disabled in EL3, even though the hardware
implements them.

The emulated ID register values are stored primarily in per-world
context, except for certain debug-related ID registers such as
ID_AA64DFR0_EL1 and ID_AA64DFR1_EL1, which are stored in the
cpu_data and are unique to each PE. This is done to support feature
asymmetry that is commonly seen in debug features.

FEAT_IDTE3 traps all Group 3 ID registers in the range
op0 == 3, op1 == 0, CRn == 0, CRm == {2–7}, op2 == {0–7} and the
Group 5 GMID_EL1 register. However, only a handful of ID registers
contain fields used to detect features enabled in EL3. Hence, we
only cache those ID registers, while the rest are transparently
returned as is to the lower EL.

This patch updates the CREATE_FEATURE_FUNCS macro to generate
update_feat_xyz_idreg_field() functions that disable ID register
fields on a per-feature basis. The enabled_worlds scope is used to
disable ID register fields for security states where the feature is
not enabled.

This EXPERIMENTAL feature is controlled by the ENABLE_FEAT_IDTE3
build flag and is currently disabled by default.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I5f998eeab81bb48c7595addc5595313a9ebb96d5

show more ...

docs(cpufeat): add a checklist on how to add a feature

Adding features is an arcane job with a long list of things to consider.
There is no single place to list these things so someone new to this
m

docs(cpufeat): add a checklist on how to add a feature

Adding features is an arcane job with a long list of things to consider.
There is no single place to list these things so someone new to this
must be guided along, usually at code review. Further, the process
changes occasionally so it can be difficult even for an experienced
contributor to get right.

So add a checklist along with brief explanations on what to look for so
we can make our job nicer.

Change-Id: I09dd0062b742c9fce5a8f86a2067adc941db6899
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "fix(security): add clrbhb support" into integration

Merge "refactor(docs): deduplicate PSCI documentation" into integration

fix(security): add clrbhb support

TF-A mitigates spectre-bhb(CVE-2022-23960) issue with loop
workaround based on - https://developer.arm.com/documentation/110280/latest/

On platforms that support `

fix(security): add clrbhb support

TF-A mitigates spectre-bhb(CVE-2022-23960) issue with loop
workaround based on - https://developer.arm.com/documentation/110280/latest/

On platforms that support `clrbhb` instruction it is recommended to
use `clrbhb` instruction instead of the loop workaround.

Ref- https://developer.arm.com/documentation/102898/0108/

Change-Id: Ie6e56e96378503456a1617d5e5d51bc64c2e0f0b
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

refactor(docs): deduplicate PSCI documentation

It is already described in the porting guide and context management
sections so it's largely redundant. It also hasn't been updated for a
while despite

refactor(docs): deduplicate PSCI documentation

It is already described in the porting guide and context management
sections so it's largely redundant. It also hasn't been updated for a
while despite lots going on around PSCI so it's clearly not read often.
The only part that isn't is that for describing a new secure dispatcher,
which belongs in the porting guide.

Change-Id: Icdc53e19565f0785bc8a112e5eb49df1b365c66c
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

docs(build): update GCC toolchain requirement to 14.3.Rel1

Update documentation to reflect the use of GCC version 14.3.Rel1,
the latest production release available at:
https://developer.arm.com/dow

docs(build): update GCC toolchain requirement to 14.3.Rel1

Update documentation to reflect the use of GCC version 14.3.Rel1,
the latest production release available at:
https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: I4387ccf519593b804d3e8541e8aaf9723a2aedeb

show more ...

feat(mbedtls): update mbedtls to version 3.6.5

Change-Id: Ia5366faa71007024e098a05ee391a2ff8e8676c0
Signed-off-by: Slava Andrianov <slava.andrianov@arm.com>

feat(cpufeat): enable FEAT_PFAR support

Implement support for FEAT_PFAR, which introduces the PFAR_ELx system
register, recording the faulting physical address for some aborts.
Those system register

feat(cpufeat): enable FEAT_PFAR support

Implement support for FEAT_PFAR, which introduces the PFAR_ELx system
register, recording the faulting physical address for some aborts.
Those system registers are trapped by the SCR_EL3.PFARen bit, so set the
bit for the non-secure world context to allow OSes to use the feature.

This is controlled by the ENABLE_FEAT_PFAR build flag, which follows the
usual semantics of 2 meaning the feature being runtime detected.
Let the default for this flag be 0, but set it to 2 for the FVP.

Change-Id: I5c9ae750417e75792f693732df3869e02b6e4319
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge "feat(cpufeat): enable FEAT_AIE support" into integration

Merge "fix(docs): fix some broken links" into integration

Merge changes Id711e387,I531a2ee1,Ic5b48514,I81f5f663,I6c529c13, ... into integration

* changes:
refactor(romlib): absorb WRAPPER_FLAGS into LDFLAGS
fix(build): simplify the -target options
fe

Merge changes Id711e387,I531a2ee1,Ic5b48514,I81f5f663,I6c529c13, ... into integration

* changes:
refactor(romlib): absorb WRAPPER_FLAGS into LDFLAGS
fix(build): simplify the -target options
feat(build): allow full LTO builds with clang
refactor(build): make sorting of sections generic
feat(build): use clang as a linker
fix(build): correctly detect that an option is missing with ld_option
feat(build): pass cflags to the linker when LTO is enabled

show more ...

refactor(build): make it standard to request a custom linker script

Hoist the add_define to a global location so that platforms only have to
declare its usage. Fix up #ifdef to #if since we will now

refactor(build): make it standard to request a custom linker script

Hoist the add_define to a global location so that platforms only have to
declare its usage. Fix up #ifdef to #if since we will now always pass a
definition.

Change-Id: Ia52ad5ed4dcbd157d139c8ca2fb3d35b32343b93
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "fix(cm): deprecate use of NS_TIMER_SWITCH" into integration

feat(build): allow full LTO builds with clang

GCC doesn't like LTOing __builtins. This has been broken for time
immemorial (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63215) and
there is no fi

feat(build): allow full LTO builds with clang

GCC doesn't like LTOing __builtins. This has been broken for time
immemorial (see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63215) and
there is no fix coming. Prior to GCC 14 a build of the libc with LTO
will simply not work. From GCC14 a workaround is possible passing
-ffat-lto-objects. The underlying issue is that the linker "forgets"
about builtin symbols it added during LTO. The non-LTO copies make these
forgotten functions available during final resolution. However, this
still does not LTO the libc, it just allows for it to build with -flto.

Since GCC is our main compiler, and we do not differentiate the libc
from any other lib we build, we have simply not built libs with LTO so
far. However, there is no need to kneecap clang for GCC's failings, so
LTO all libs on clang when enabled.

When GCC14 becomes the oldest reasonable compiler we support, this can
be done for GCC too, although with the workaround above. This still
won't LTO the libc, but it will at least LTO other libs.

Change-Id: Ic5b4851480131f4e8aefd678cc05d4dd02ee01ef
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(build): use clang as a linker

To support LTO, the gcc binary is used as a compiler, assembler, and
linker. Do the same for clang and enable LTO builds with it as a side
effect.

This simplifies

feat(build): use clang as a linker

To support LTO, the gcc binary is used as a compiler, assembler, and
linker. Do the same for clang and enable LTO builds with it as a side
effect.

This simplifies code quite a bit as the gcc/clang different is much
smaller. Support for ld/lld (if overriden with LD) is maintained.

This is a good time to convert tabs to spaces to conform to make's
expectations on syntax.

Change-Id: I6c529c1393f7e9e8046ed537f871fc3ad91d599a
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): enable FEAT_AIE support

Implement support for FEAT_AIE, which introduces the AMAIR2_ELx and
MAIR2_ELx system registers, extending the memory attributes described
by {A}MAIR_ELx.
Those

feat(cpufeat): enable FEAT_AIE support

Implement support for FEAT_AIE, which introduces the AMAIR2_ELx and
MAIR2_ELx system registers, extending the memory attributes described
by {A}MAIR_ELx.
Those system registers are trapped by the SCR_EL3.AIEn bit, so set the
bit for the non-secure world context to allow OSes to use the feature.

This is controlled by the ENABLE_FEAT_AIE build flag, which follows the
usual semantics of 2 meaning the feature being runtime detected.
Let the default for this flag be 0, but set it to 2 for the FVP.

Change-Id: Iba2011719013a89f9cb3a4317bde18254f45cd25
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fix(docs): fix some broken links

Fix few broken links from docs.

Link check was done with following steps -

[..]
tf-a/docs$ make clean -j8; poetry run make html -j8
tf-a/docs$ poetry run sphinx-bu

fix(docs): fix some broken links

Fix few broken links from docs.

Link check was done with following steps -

[..]
tf-a/docs$ make clean -j8; poetry run make html -j8
tf-a/docs$ poetry run sphinx-build -j8 -q -b linkcheck . build/
[..]

Add link check conf values to config.py
- avoid reporting false broken links when `#`(anchors) are present
in the link.
- avoid checking for broken links in "change-log.md", this is summary
of commit msg's we are not going to fix broken links in cmt-msg's

Change-Id: I384094c8dcf3e93875c9052afa79ad826b9901d9
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

feat(dsu): enable PMU registers access at EL1

- Disable trapping of write accesses to DSU cluster PMU registers
at EL3 and EL2.
- Clear the SPME bit in CLUSTERPMMDCR_EL3 to prohibit PMU event
co

feat(dsu): enable PMU registers access at EL1

- Disable trapping of write accesses to DSU cluster PMU registers
at EL3 and EL2.
- Clear the SPME bit in CLUSTERPMMDCR_EL3 to prohibit PMU event
counting in the secure state.

Change-Id: If3eb6e997330ae86f45760e0e862c003861f3d66
Signed-off-by: Amr Mohamed <amr.mohamed@arm.com>

show more ...

feat(mbedtls): update mbedtls to version 3.6.4

In order to successfully update mbedtls to version 3.6.4, the
redundant-decls warning must be disabled to accomodate a change in the
definition locatio

feat(mbedtls): update mbedtls to version 3.6.4

In order to successfully update mbedtls to version 3.6.4, the
redundant-decls warning must be disabled to accomodate a change in the
definition locations of some helper functions. This is currently an open
issue for mbedtls: https://github.com/Mbed-TLS/mbedtls/issues/10376

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I57c9c14aabe75a51c74dcf2a33faf59f95ce2386

show more ...

feat(cpufeat): enable FEAT_CPA2 for EL3

FEAT_CPA2 enables checked pointer arithmetic, which in the event
of an arithmetic overflow in pointer generation will result in a
non-canonical pointer being

feat(cpufeat): enable FEAT_CPA2 for EL3

FEAT_CPA2 enables checked pointer arithmetic, which in the event
of an arithmetic overflow in pointer generation will result in a
non-canonical pointer being generated and subsequent address fault.

Note that FEAT_CPA is a trivial implementation that exists in
some hardware purely so it can run CPA2-enabled instructions
without crashing but they don't actually have checked arithmetic,
so FEAT_CPA is not explicitly enabled in TF-A.

Change-Id: I6d2ca7a7e4b986bb9e917aa8baf8091a271c168b
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view availa

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view available for EL1 timer registers. So it is
unreasonable for secure world to use non-secure EL1 physical timer
registers. Moreover, the non-secure operating system (Linux in our case)
relies heavily on these EL1 physical timer registers for scheduling
decisions. If NS_TIMER_SWITCH is enabled, it simply breaks the preemption
model of the non-secure world by disabling non-secure timer interrupts
leading to RCU stalls being observed on long running secure world tasks.

The only arch timer register which will benefit from context management
is cntkctl_el1: Counter-timer Kernel Control Register. This enables the
secure and non-secure worlds to independently control accesses to EL0
for counter-timer registers. This is something that OP-TEE uses to
enable ftrace feature for Trusted Applications and SPM_MM uses for EL0
access as well.

Lets enable context management of cntkctl_el1 by default and deprecate
conditional context management of non-secure EL1 physical timer
registers for whom there isn't any upstream user. With that deprecate
this NS_TIMER_SWITCH build option which just adds confusion for the
platform maintainers. It will be eventually dropped following
deprecation policy of TF-A.

Reported-by: Stauffer Thomas MTANA <thomas.stauffer@mt.com>
Reported-by: Andrew Davis <afd@ti.com>
Change-Id: Ifb3a919dc0bf8c05c38895352de5fe94b4f4387e
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...