Merge "docs(build): update GCC toolchain requirement to 15.2.Rel1" into integration

feat: enable FEATURE_DETECTION on FVP

FEATURE_DETECTION has received a lot of attention since its introduction
and at this point is quite reliable. Its experimental designation is no
longer appropri

feat: enable FEATURE_DETECTION on FVP

FEATURE_DETECTION has received a lot of attention since its introduction
and at this point is quite reliable. Its experimental designation is no
longer appropriate and it would be quite reasonable to use this feature
by default.

Always enable the feature for FVP so that we can have confidence that
the SW view of HW is up to date.

This patch also drops the mention of errata reporting around
FEATURE_DETECTION as this hasn't been true for some time.

Change-Id: I4a94dce243e430d5d3528c66154075b4352cd520
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

docs(build): update GCC toolchain requirement to 15.2.Rel1

Update documentation to reflect the use of GCC version 15.2.Rel1,
the latest production release available at:
https://developer.arm.com/dow

docs(build): update GCC toolchain requirement to 15.2.Rel1

Update documentation to reflect the use of GCC version 15.2.Rel1,
the latest production release available at:
https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: I841d494f2226cbbf0bd388c4eb89548f62e069d3

show more ...

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME rela

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME related support is now enabled using feature detection option
ENABLE_FEAT_RME, this patch moves GPT support under ENABLE_FEAT_RME.

This change brings in below benefits:
- single TF-A build that works for RME and non-RME systems, when
build with ENABLE_FEAT_RME=2 (FEAT_STATE_CHECK)
- RMM loading is optional on RME systems
- SiP calls that leverages RME features to change the PAS of a memory
range from non-secure to secure is supported without need to enable
Realm PAS or RMM.
- FIRME Granule Management Interface (GMI) ABIs that handles
FEAT_RME_GPC2/FEAT_RME_GDI can be enabled without need to enable RMM

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I88d9d4e0491af2b4ae0307c018f2d4a71ee6693f

show more ...

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option perfor

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option performs RMM-specific tasks such as GPT setup, loading the RMM,
and enabling RMMD support.

Since ENABLE_RME now only controls RMM-related functionality, rename it
to ENABLE_RMM to better reflect its purpose and avoid confusion with
ENABLE_FEAT_RME.

For backward compatibility, setting the legacy ENABLE_RME=1 (until it is
deprecated) will automatically enable both ENABLE_FEAT_RME and
ENABLE_RMM.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Iac945bdffe5002161bf1161b81a5aa7abec68192

show more ...

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full RMM loading and handling.

While full CCA support requires all of these steps, some systems running
on FEAT_RME-capable cores do not need or want an RMM. However, such
systems still require TF-A page table entries to set the .NSE bit so
that TF-A accesses are correctly attributed to the ROOT world,
otherwise, enabling the MMU may cause the system to hang.

To address this, a new build option, ENABLE_FEAT_RME, is introduced. It
handles only the .NSE PTE setup and ignores the rest of the RME/RMM
initialization. ENABLE_FEAT_RME follows the ENABLE_FEAT_* convention and
supports values 0–2, with 2 enabling runtime detection.

Full RME functionality remains gated by ENABLE_RME, which now implicitly
enables ENABLE_FEAT_RME, allowing TF-A to run safely on FEAT_RME systems
without requiring an RMM.

Change-Id: I8391652842ff2e62a73b61829c6250c3805d4a4e
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge "fix(cpus)!: make ERRATA_SME_POWER_DOWN work with the recommended state ID" into integration

Merge "fix(rmmd): set RMM_V1_COMPAT=0" into integration

fix(rmmd): set RMM_V1_COMPAT=0

Set the default value of RMM_V1_COMPAT to 0. This means by default, TF-A
will only work with an RMM which is aligned to RMMv2.0 specification.

BREAKING-CHANGE: RMM v1

fix(rmmd): set RMM_V1_COMPAT=0

Set the default value of RMM_V1_COMPAT to 0. This means by default, TF-A
will only work with an RMM which is aligned to RMMv2.0 specification.

BREAKING-CHANGE: RMM v1.x compatibility is now disabled by default.
Platforms which continue to rely on the RMM v1 ABI must explicitly
build TF-A with `RMM_V1_COMPAT=1`.

Change-Id: Icf0e2dc9ebd8991cc989930807997625282191c3
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

feat(firme): initial commit of FIRME service

This is the first FIRME service patch that adds support for basic ABIs
for retrieving the FIRME version, features, and GPI_SET.

This adds a new generic

feat(firme): initial commit of FIRME service

This is the first FIRME service patch that adds support for basic ABIs
for retrieving the FIRME version, features, and GPI_SET.

This adds a new generic granule transition function that replaces
the existing delegate/undelegate APIs that GPI_SET uses. It also
updates TRP to use GPI_SET when FIRME is supported.

FIRME spec is here, note that it is ALPHA2 quality so further changes
are to be expected:
https://developer.arm.com/documentation/den0149

Change-Id: I57b8ad7e87a0679e15c8247f8457f91f3254dedb
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(cpus)!: make ERRATA_SME_POWER_DOWN work with the recommended state ID

The ERRATA_SME_POWER_DOWN flag doesn't account for the recommended state
ID encoding, only for the default one. This patch m

fix(cpus)!: make ERRATA_SME_POWER_DOWN work with the recommended state ID

The ERRATA_SME_POWER_DOWN flag doesn't account for the recommended state
ID encoding, only for the default one. This patch makes it work by
removing the generic flag and incorporating the functionality into the
CPU and platform layers.

The ERRATA_SME_POWER_DOWN is an awkward fix in generic code to a
platform problem. The PSCI layer shouldn't care about any CPU's inner
workings but it does. This isn't ideal once the issue is fixed since
we'll have to carry the "legacy" fix in generic code.

This patch is marked as breaking since the ERRATA_SME_POWER_DOWN flag is
removed and a couple of lines are required if CPU hotplug encounters a
powerdown with live SME state (CPU suspend will work as before). This
will get discovered with a panic at EL3 so this patch leaves a comment
to be able to trace it back.

Change-Id: Ia52865f527e81a8be3727093ed370901e55c5fef
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

test(bl): add short-read negative test scenario

Add an opt-in negative test mode that simulates a short read
for a selected image_id during image loading. This exercises
the partial-read error handl

test(bl): add short-read negative test scenario

Add an opt-in negative test mode that simulates a short read
for a selected image_id during image loading. This exercises
the partial-read error handling path and is intended for CI
validation only.

Disabled by default via build options.

Change-Id: I219b75898e1778c0b263f99a9370425098d52f8f
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "el3-rmm-itf" into integration

* changes:
docs(rmm): update EL3-RMM contract
feat(rmmd): expand RMM SMC return registers
fix(cm): don't context switch GICv3 registers

Merge changes from topic "el3-rmm-itf" into integration

* changes:
docs(rmm): update EL3-RMM contract
feat(rmmd): expand RMM SMC return registers
fix(cm): don't context switch GICv3 registers on NS<->RL transitions

show more ...

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targetin

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targeting the
more recently introduced Realm world. Hence the new RMMv2.0
specification mandates that EL3 should not save and restore
the GIC registers on a world switch. This change is not backward
compatible with RMMv1.x ABI.

Note the change in implementation of cm_el2_sysregs_context_save()
and cm_el2_sysregs_context_restore() API as GIC state is not
managed by these APIs anymore.

Add new build flag RMM_V1_COMPAT to support backward compatibility
with RMMv1.x. This flag is currently enabled by default.

This patch is a reworked version of the original patch at:
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/45658

NOTE: If RMM_V1_COMPAT is not enabled, then RMM_EL3_IFC_VERSION
is bumped to 1.0 which makes it incompatible with an RMM supporting
0.x.

Change-Id: If4c53b85ef31091c254b383ed7b32c39124f0dbb
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

Merge changes Iad777e77,I0eb24083 into integration

* changes:
feat(build): add Mbed TLS submodule
fix(brcm): fix bad Mbed TLS check

refactor(bl2): data cache invalidate on bl2 entry

Rely on build options BL2_RUNS_AT_EL3 and BL2_INV_DCACHE to invalidate
the data cache upon BL2 entry and this shouldn't be tied with ENABLE_RME
buil

refactor(bl2): data cache invalidate on bl2 entry

Rely on build options BL2_RUNS_AT_EL3 and BL2_INV_DCACHE to invalidate
the data cache upon BL2 entry and this shouldn't be tied with ENABLE_RME
build flag. This also ensures that if a platform sets
BL2_INV_DCACHE, it takes precedence over feature flags.

This change also restores documentation for BL2_INV_DCACHE, which was
accidentally removed by commit 43f35ef51.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I52bdfe351c730f62d79a518327f57b398c7b29c5

show more ...

feat(build): add Mbed TLS submodule

This change adds Mbed TLS 3.6.5 as a submodule to the TF-A repository.
It is no longer a requirement to pass `MBEDTLS_DIR` to the build system
when building confi

feat(build): add Mbed TLS submodule

This change adds Mbed TLS 3.6.5 as a submodule to the TF-A repository.
It is no longer a requirement to pass `MBEDTLS_DIR` to the build system
when building configurations which require it, as the build system will
now look inside the `contrib` directory if the parameter is missing.

If you cloned TF-A without the `--recurse-submodules` flag, you can
ensure that this submodule is present by running:

git submodule update --init --recursive

BREAKING-CHANGE: Mbed TLS is now included in the TF-A repository, and it
is no longer a requirement to pass `MBEDTLS_DIR` to the build system.
Please run `git submodule update --init --recursive` if you encounter
issues after migrating to the latest version of TF-A.

Change-Id: Iad777e77936d1c373065f17fe5c4aadc45e56b64
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

docs(spm): describe support for SP live activation and relevant build flags

This patch documents the support for SP live activation by a reference
SPM implementation as well as provides the guidance

docs(spm): describe support for SP live activation and relevant build flags

This patch documents the support for SP live activation by a reference
SPM implementation as well as provides the guidance for platform
integrators to build Logical Secure Partition, which is needed to
orchestrate live activation of an SP in coordination with SPMC.

The corresponding build flags have been documented as well.

Change-Id: I88920344267f86f5e9916ea3632de78af32469ef
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

feat(cpufeat): add support for FEAT_HACDBS

The Hardware accelerator for cleaning Dirty state feature also has two
register just like FEAT_HDBSS. They are guarded by a SCR_EL3 bit which
set for NS wo

feat(cpufeat): add support for FEAT_HACDBS

The Hardware accelerator for cleaning Dirty state feature also has two
register just like FEAT_HDBSS. They are guarded by a SCR_EL3 bit which
set for NS world only and are not context switched as a result. There is
no use for this feature at EL3.

Change-Id: Ica7a312d891a1671df8e9f2adbfe464d96bbcd4d
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_HDBSS

The Hardware Dirty state tracking structure feature has two registers to
enable tracking at lower ELs which are guarded by an SCR_EL3 bit. Set
that bit for

feat(cpufeat): add support for FEAT_HDBSS

The Hardware Dirty state tracking structure feature has two registers to
enable tracking at lower ELs which are guarded by an SCR_EL3 bit. Set
that bit for NS only and do not context switch the registers. There is
no use of the feature at EL3.

Change-Id: I174a256d70a99abfafc65eed3a2fbdaea5ea946d
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_STEP2

This feature only needs MDCR_EL3.EnSTEPOP to be written and mdstepop_el1
to be context switched when the next EL is EL1.

Change-Id: I70e2a488f4e50da4b181a0

feat(cpufeat): add support for FEAT_STEP2

This feature only needs MDCR_EL3.EnSTEPOP to be written and mdstepop_el1
to be context switched when the next EL is EL1.

Change-Id: I70e2a488f4e50da4b181a00648c4f608e1da451c
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes from topics "qemu-sve", "xl/simd-hash" into integration

* changes:
feat(qemu): disable fpregs traps for QEMU in BL31
feat(crypto): enable the runtime instrumentation for crypto ext

Merge changes from topics "qemu-sve", "xl/simd-hash" into integration

* changes:
feat(qemu): disable fpregs traps for QEMU in BL31
feat(crypto): enable the runtime instrumentation for crypto extension
feat(crypto): enable access to SIMD crypto in BL1 and BL2
feat(crypto): enable floating point register traps in EL3
feat(crypto): build flag for SIMD crypto extensions for v8+ platform
refactor(build): add a default filter list for lib cflags

show more ...

fix(cpus): workaround for Cortex-A65AE erratum 1638571

Cortex-A65AE erratum 1638571 is a Cat B erratum that applies
to revisions r0p0, r1p0, r1p1, and is still open.

This erratum can be avoided by

fix(cpus): workaround for Cortex-A65AE erratum 1638571

Cortex-A65AE erratum 1638571 is a Cat B erratum that applies
to revisions r0p0, r1p0, r1p1, and is still open.

This erratum can be avoided by disable stage1 page table walk for
lower Els (EL1 and EL0) in EL3, so 'AT' speculative fetch at any
point produces either the correct result or failure without TLB
allocation.

SDEN documentation:
https://developer.arm.com/documentation/SDEN1344564/latest

Change-Id: I861230de94a105fd52f9c8ef7e7551a2633c065b
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

feat(crypto): build flag for SIMD crypto extensions for v8+ platform

Add new build flags ENABLE_FEAT_CRYPTO to enable SIMD crypto extension
for hash256 in bootflow authentication process and ENABLE_

feat(crypto): build flag for SIMD crypto extensions for v8+ platform

Add new build flags ENABLE_FEAT_CRYPTO to enable SIMD crypto extension
for hash256 in bootflow authentication process and ENABLE_FEAT_CRYPTO_SHA3
to enable SIMD crypto extension for sha384 and sha512 in bootflow authentication
process for Arm platform greater than v8.0.

Change-Id: I6e52feb318136910d34cafd89319bf94f90e16fc
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

feat(cpufeat): update FEAT_SB's FEAT_STATE_CHECKED status

FEAT_SB is mostly FEAT_STATE_CHECKED enabled but that is not apparent
from docs and code's check is sub-optimal. Update docs to make this
ap

feat(cpufeat): update FEAT_SB's FEAT_STATE_CHECKED status

FEAT_SB is mostly FEAT_STATE_CHECKED enabled but that is not apparent
from docs and code's check is sub-optimal. Update docs to make this
apparent and update code to have a proper FEAT_STATE_CHECKED fallback.

Also enable it for FVP so it's tested a bit more.

Change-Id: I1374c4828b235ad16904f6c4ac9e39b9c2596a37
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...