feat(mbedtls): update mbedtls to version 3.6.4

In order to successfully update mbedtls to version 3.6.4, the
redundant-decls warning must be disabled to accomodate a change in the
definition locatio

feat(mbedtls): update mbedtls to version 3.6.4

In order to successfully update mbedtls to version 3.6.4, the
redundant-decls warning must be disabled to accomodate a change in the
definition locations of some helper functions. This is currently an open
issue for mbedtls: https://github.com/Mbed-TLS/mbedtls/issues/10376

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I57c9c14aabe75a51c74dcf2a33faf59f95ce2386

show more ...

feat(cpufeat): enable FEAT_CPA2 for EL3

FEAT_CPA2 enables checked pointer arithmetic, which in the event
of an arithmetic overflow in pointer generation will result in a
non-canonical pointer being

feat(cpufeat): enable FEAT_CPA2 for EL3

FEAT_CPA2 enables checked pointer arithmetic, which in the event
of an arithmetic overflow in pointer generation will result in a
non-canonical pointer being generated and subsequent address fault.

Note that FEAT_CPA is a trivial implementation that exists in
some hardware purely so it can run CPA2-enabled instructions
without crashing but they don't actually have checked arithmetic,
so FEAT_CPA is not explicitly enabled in TF-A.

Change-Id: I6d2ca7a7e4b986bb9e917aa8baf8091a271c168b
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view availa

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view available for EL1 timer registers. So it is
unreasonable for secure world to use non-secure EL1 physical timer
registers. Moreover, the non-secure operating system (Linux in our case)
relies heavily on these EL1 physical timer registers for scheduling
decisions. If NS_TIMER_SWITCH is enabled, it simply breaks the preemption
model of the non-secure world by disabling non-secure timer interrupts
leading to RCU stalls being observed on long running secure world tasks.

The only arch timer register which will benefit from context management
is cntkctl_el1: Counter-timer Kernel Control Register. This enables the
secure and non-secure worlds to independently control accesses to EL0
for counter-timer registers. This is something that OP-TEE uses to
enable ftrace feature for Trusted Applications and SPM_MM uses for EL0
access as well.

Lets enable context management of cntkctl_el1 by default and deprecate
conditional context management of non-secure EL1 physical timer
registers for whom there isn't any upstream user. With that deprecate
this NS_TIMER_SWITCH build option which just adds confusion for the
platform maintainers. It will be eventually dropped following
deprecation policy of TF-A.

Reported-by: Stauffer Thomas MTANA <thomas.stauffer@mt.com>
Reported-by: Andrew Davis <afd@ti.com>
Change-Id: Ifb3a919dc0bf8c05c38895352de5fe94b4f4387e
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

Merge changes from topic "xl/separate-bl2" into integration

* changes:
feat(fwu): documentation for BL2 separation
feat(fwu): separate bl2 image from rest of the FIP
feat(fwu): create flag for

Merge changes from topic "xl/separate-bl2" into integration

* changes:
feat(fwu): documentation for BL2 separation
feat(fwu): separate bl2 image from rest of the FIP
feat(fwu): create flag for BL2 separation

show more ...

feat(fwu): documentation for BL2 separation

The separation of BL2 introduce a new flag in the build
option, SEPARATE_BL2_FIP.

Change-Id: I64e231d40376c39112bce66851af9ccb37d37382
Signed-off-by: Xia

feat(fwu): documentation for BL2 separation

The separation of BL2 introduce a new flag in the build
option, SEPARATE_BL2_FIP.

Change-Id: I64e231d40376c39112bce66851af9ccb37d37382
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

feat(arm): unify Linux kernel as BL33 handling

Streamlines and unifies how Arm platforms pass arguments to the Linux
kernel when it is loaded as BL33. It replaces the FVP specific macro
`FVP_HW_CONF

feat(arm): unify Linux kernel as BL33 handling

Streamlines and unifies how Arm platforms pass arguments to the Linux
kernel when it is loaded as BL33. It replaces the FVP specific macro
`FVP_HW_CONFIG_ADDR` with a common macro `ARM_HW_CONFIG_ADDR` for
accessing the device tree blob base address.

For FVP the DT address is set to use `ARM_PRELOADED_DTB_BASE` if
provided, falling back to a default address otherwise.

This provides a consistent mechanism for Arm platforms to define and
override the DTB base address used during kernel handoff. It reduces the
chance of misconfiguration, and simplifies platform integration.

Change-Id: Ib668dbb1de9d42cf41c0b0ee9a316f054891752a
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support

Implement support for FEAT_MPAM_PE_BW_CTRL, allowing lower
Exception Levels to access MPAM_PE_BW_CTRL control registers
by disabling their traps to

feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support

Implement support for FEAT_MPAM_PE_BW_CTRL, allowing lower
Exception Levels to access MPAM_PE_BW_CTRL control registers
by disabling their traps to EL3.

When INIT_UNUSED_NS_EL2=1, configure MPAMBW2_EL2 in EL3 so
that MPAM_PE_BW_CTRL accesses from EL0/EL1 do not trap to EL2.

At this stage, PE-side MPAM bandwidth controls remain disabled
in EL3.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I8e359b0eb912cff3bdda109b21727a627cac3a7e

show more ...

refactor(gicv3): clarify redistributor base address usage with USE_GIC_DRIVER=3

The GICv3 driver has 2 methods of discovering the redistributors:
a) via setting gicr_base - done at boot and assumes

refactor(gicv3): clarify redistributor base address usage with USE_GIC_DRIVER=3

The GICv3 driver has 2 methods of discovering the redistributors:
a) via setting gicr_base - done at boot and assumes all GICR frames are
contiguous. This is the original method.

b) via gicv3_rdistif_probe() - called from platform code and requires
gicr_base == 0. It relaxes the requirement for frames to be
contiguous, like in a multichip configuration, and defers the
discovery to core bringup. This was introduced later.

Configurations possible with option a) are also possible with option b)
with only slightly different behaviour. USE_GIC_DRIVER=3 inherited
option b) from plat_gicv3_base.c and as such option a) is unusable.
However, it is unclear from code how this should be used. Clarify this
by requiring platforms initialise with gic_set_gicr_frames() and
adding relevant comments.

Also rename plat_arm_override_gicr_frames() to gic_set_gicr_frames() as
this is not plat arm specific and a part of the generic GIC driver.

Change-Id: I61d77211f8e65dc54cf9904069b500d26a06b5a5
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(common): add support for kernel DT handoff convention

TF-A currently supports multiple DT handoff conventions:

1. Firmware Handoff (FH): DT passed in x0, with x1–x3 carrying
additional data

feat(common): add support for kernel DT handoff convention

TF-A currently supports multiple DT handoff conventions:

1. Firmware Handoff (FH): DT passed in x0, with x1–x3 carrying
additional data.
2. Kernel-compatible handoff (ARM_LINUX_KERNEL_AS_BL33): DT passed in
x0, x1–x3 zeroed.
3. Legacy TF-A convention: DT passed in x1, with x0 used for MPIDR or
NT_FW_CONFIG.

After discussions with folks in EDK2 and U-Boot, it's clear that there
is no strict requirement for placing the DT in x1. Both projects support
x0 for Arm platforms. To standardize behavior and support firmware
handoff migration, this patch introduces USE_KERNEL_DT_CONVENTION as a
configurable build flag. When enabled, the DT will be passed in x0 for
BL33.

This aligns TF-A’s behavior with Linux boot expectations and simplifies
integration across bootloaders.

Change-Id: I6bd7154fe07cb2e16e25c058f7cf862f9ae007e7
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_FGWTE3

Enable write traps for key EL3 system registers as per FEAT_FGWTE3,
ensuring their values remain unchanged after boot.

Excluded Registers:
MDCR_EL3 and MP

feat(cpufeat): add support for FEAT_FGWTE3

Enable write traps for key EL3 system registers as per FEAT_FGWTE3,
ensuring their values remain unchanged after boot.

Excluded Registers:
MDCR_EL3 and MPAM3_EL3: Not trapped as they are part of the EL3 context.
SCTLR_EL3: Not trapped since it is overwritten during
powerdown sequence(Included when HW_ASSISTED_COHERENCY=1)

TPIDR_EL3: Excluded due to its use in crash reporting(It is included
when CRASH_REPORTING=0)

Reference:
https://developer.arm.com/documentation/ddi0601/2025-06/AArch64-Registers/FGWTE3-EL3--Fine-Grained-Write-Traps-EL3

Change-Id: Idcb32aaac7d65a0b0e5c90571af00e01a4e9edb1
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>

show more ...

feat(dsu): support power control and autonomous powerdown config

This patch allows platforms to enable certain DSU settings
to ensure memory retention and control over
cache power requests. We also

feat(dsu): support power control and autonomous powerdown config

This patch allows platforms to enable certain DSU settings
to ensure memory retention and control over
cache power requests. We also move the driver out of css
into drivers/arm. Platforms can configure the
CLUSTERPWRCTLR and CLUSTERPWRDN registers [1] to improve
power efficiency.

These registers enable finer-grained control of
DSU power state transitions, including
powerdown and retention.

IMP_CLUSTERPWRCTLR_EL1 provides:
- Functional retention: Allows configuration of the
duration of inactivity before the DSU uses
CLUSTERPACTIVE to request functional retention.

- Cache power request: These bits are output on
CLUSTERPACTIVE[19:16] to indicate to the power controller
which cache portions must remain powered.

IMP_CLUSTERPWRDN_EL1 includes:
- Powerdown: Triggers full cluster powerdown, including
control logic.

- Memory retention: Requests memory retention mode,
keeping L3 RAM contents while powering off
the rest of the DSU.

The DSU-120 TRM [2] provides the full field definitions,
which are used as references in the `dsu_driver_data` structure.

References:
[1]: https://developer.arm.com/documentation/100453/latest/
[2]: https://developer.arm.com/documentation/102547/0201/?lang=en

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I2eba808b8f2a27797782a333c65dd092b03208fe

show more ...

feat(lfa): create LFA SMC handler template

As per the specification v1.0[1], added all Live Firmware Activation
(LFA) SMCs, including their Function IDs (FIDs) and associated error
codes.
A dummy ha

feat(lfa): create LFA SMC handler template

As per the specification v1.0[1], added all Live Firmware Activation
(LFA) SMCs, including their Function IDs (FIDs) and associated error
codes.
A dummy handler function has been created as a template. Subsequent
patches will implement the handling of these SMCs.

[1]: https://developer.arm.com/documentation/den0147/latest/

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I5d6500dcff35aa4a438cd5f97f349cd57406ddce

show more ...

Merge changes Ia34bc0f4,I0be3773b,I701e357a,Icdbe1992 into integration

* changes:
refactor(versal2): guard handoff logic w/ build flag
refactor(qemu): guard handoff logic w/ build flag
refacto

Merge changes Ia34bc0f4,I0be3773b,I701e357a,Icdbe1992 into integration

* changes:
refactor(versal2): guard handoff logic w/ build flag
refactor(qemu): guard handoff logic w/ build flag
refactor(optee): guard handoff logic w/ build flag
feat(handoff): support libtl submodule builds

show more ...

feat(gicv5): add support for building with gicv5

The Generic Interrupt Controller v5 (GICv5) is the next generation of
Arm interrupt controllers. It is a clean slate design and has native
support fo

feat(gicv5): add support for building with gicv5

The Generic Interrupt Controller v5 (GICv5) is the next generation of
Arm interrupt controllers. It is a clean slate design and has native
support for the latest Armv9 features. As such it is entirely backwards
incompatible with GICv3/v4.

This patch adds the necessary boilerplate to select a build with GICv5.
The GIC has always had two parts. BL31 deals directly with the CPU
interface while platform code is responsible for managing the IRI. In v5
this split is formalised and the CPU interface, FEAT_GCIE, may be
implemented on its own. So reflect this split in our code with
ENABLE_FEAT_GCIE which only affects BL31 and the GICv5 IRI lies in the
generic GIC driver.

No actual functionality yet.

Change-Id: I97a0c3ba708877c213e50e7ef148e3412aa2af90
Co-developed-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): remove SUPPORT_STACK_MEMTAG

This flag enables the memtag sanitizer in clang. However, for this to
work, other generic and platform-specific logic is required that was
never implemented.

fix(build): remove SUPPORT_STACK_MEMTAG

This flag enables the memtag sanitizer in clang. However, for this to
work, other generic and platform-specific logic is required that was
never implemented. So in effect, the feature is half-baked and at best a
simple test (of which we have plenty in tftf) or a NOP at worst.

So remove the option to simplify code a little.

Change-Id: Iab4150871c89545d813c5ae14be67bf6459d051a
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(handoff): support libtl submodule builds

Refactor transfer list support to enable building the transfer list
and updates include paths accordingly.

Change-Id: Icdbe19924678a4023c15897a9765b8e7

feat(handoff): support libtl submodule builds

Refactor transfer list support to enable building the transfer list
and updates include paths accordingly.

Change-Id: Icdbe19924678a4023c15897a9765b8e7f150d9e3
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

build(poetry): wrap docs build in poetry

Simplify building documentation by wrapping the Sphinx command inside
a Poetry environment. Previously, the developer had to manually
activate Poetry and in

build(poetry): wrap docs build in poetry

Simplify building documentation by wrapping the Sphinx command inside
a Poetry environment. Previously, the developer had to manually
activate Poetry and install the docs group. This change makes the
process consistent with other build targets and reduces user error.
Falls back gracefully if Poetry is not installed.

Change-Id: I1dfea58314253773bec5e2c70d27e2216e3143d9
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(smcc): introduce a new vendor_el3 service for ACS SMC handler

In preparation to add support for the Architecture Compliance Suite
SMC services, reserve a SMC ID and introduce a handler function

feat(smcc): introduce a new vendor_el3 service for ACS SMC handler

In preparation to add support for the Architecture Compliance Suite
SMC services, reserve a SMC ID and introduce a handler function.
Currently, an empty placeholder function is added and future support
will be introduced for the handler support.

More info on System ACS, please refer below link,
https://developer.arm.com/Architectures/Architectural%20Compliance%20Suite

Signed-off-by: Nandan J <Nandan.J@arm.com>
Change-Id: Ib13ccae9d3829e3dcd1cd33c4a7f27efe1436d03

show more ...

feat(cpufeat): add support for FEAT_PAUTH_LR

This patch enables FEAT_PAUTH_LR at EL3 on systems that support it when
the new ENABLE_FEAT_PAUTH_LR flag is set.

Currently, PAUTH_LR is only supported

feat(cpufeat): add support for FEAT_PAUTH_LR

This patch enables FEAT_PAUTH_LR at EL3 on systems that support it when
the new ENABLE_FEAT_PAUTH_LR flag is set.

Currently, PAUTH_LR is only supported by arm clang compiler and not GCC.

Change-Id: I7db1e34b661ed95cad75850b62878ac5d98466ea
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

refactor(gic): promote most of the GIC driver to common code

More often than not, Arm based systems include some revision of a GIC.
There are two ways of adding support for them in platform code - c

refactor(gic): promote most of the GIC driver to common code

More often than not, Arm based systems include some revision of a GIC.
There are two ways of adding support for them in platform code - calling
the top-level helpers from plat/arm/common/arm_gicvX.c or by using the
driver directly. Both of these methods allow for a high degree of
customisation - most functions are defined to be weak and there are no
calls to any of them in generic code.

As it turns out, requirements around those GICs are largely the same.
Platforms that use arm_gicvX.c use the helpers identically among each
other. Platforms that use the driver directly tend to end up with calls
that look a lot like the arm_gicvX.c helpers and the weakness of the
functions are never exercised.

All of this results in a lot of code duplication to do what is
essentially the same thing. Even though it's not a lot of code, when
multiplied among many platforms it becomes significant and makes
refactoring it quite difficult. It's also bug prone since the steps are
a little convoluted and things are likely to work even with subtle
errors (see 50009f61177421118f42d6a000611ba0e613d54b).

So promote as much of the GIC to be called from common code. Do the
setup in bl31_main() and have every PSCI method do the state management
directly instead of delegating it to the platform hooks. We can base
this implementation on arm_gicvX.c since they already offer logical
names and have worked quite well so far with minimal changes.

The main benefit of doing this is reduced code duplication. If we assume
that, outside of some platform setup, GIC management is identical, then
a platform can add support by telling the build system, regardless of
GIC revision. The other benefit is performance - BL31 and PSCI already
know the core_pos and they can pass it as an argument instead of having
to call plat_my_core_pos(). Now, the only platform specific GIC actions
necessary are the saving and restoring of context on entering and
exiting a power domain. The PSCI library does not keep track of this so
it is unable perform it itself. The routines themselves are also
provided.

For compatibility all of this is hidden behind a build flag. Platforms
are encouraged to adopt this driver, but it would not be practical to
convert and validate every GIC based platform.

This patch renames the functions in question to follow the
gic_<function>() convention. This allows the names to be version
agnostic.

Finally, drop the weak definitions - they are unused, likely to remain
so, and can be added back if the need arises.

Change-Id: I5b5267f4b72f633fb1096400ec8e4b208694135f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes Id942c20c,Idd286bea,I8917a26e,Iec8c3477,If3c25dcd, ... into integration

* changes:
feat(cpufeat): enable FEAT_PAuth to FEAT_STATE_CHECKED
perf(cpufeat): centralise PAuth key saving

Merge changes Id942c20c,Idd286bea,I8917a26e,Iec8c3477,If3c25dcd, ... into integration

* changes:
feat(cpufeat): enable FEAT_PAuth to FEAT_STATE_CHECKED
perf(cpufeat): centralise PAuth key saving
refactor(cpufeat): convert FEAT_PAuth setup to C
refactor(cpufeat): prepare FEAT_PAuth for FEATURE_DETECTION
chore(cpufeat): remove PAuth presence checks
feat(cpufeat): enable FEAT_BTI to FEAT_STATE_CHECKED

show more ...

feat(cpufeat): enable FEAT_PAuth to FEAT_STATE_CHECKED

FEAT_PAuth is the second to last feature to be a boolean choice - it's
either unconditionally compiled in and must be present in hardware or
it

feat(cpufeat): enable FEAT_PAuth to FEAT_STATE_CHECKED

FEAT_PAuth is the second to last feature to be a boolean choice - it's
either unconditionally compiled in and must be present in hardware or
it's not compiled in. FEAT_PAuth is architected to be backwards
compatible - a subset of the branch guarding instructions (pacia/autia)
execute as NOPs when PAuth is not present. That subset is used with
`-mbranch-protection=standard` and -march pre-8.3. This patch adds the
necessary logic to also check accesses of the non-backward compatible
registers and allow a fully checked implementation.

Note that a checked support requires -march to be pre 8.3, as otherwise
the compiler will include branch protection instructions that are not
NOPs without PAuth (eg retaa) which cannot be checked.

Change-Id: Id942c20cae9d15d25b3d72b8161333642574ddaa
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

docs(build): update GCC toolchain requirement to 14.2.Rel1

Update documentation to reflect the use of GCC version 14.2.Rel1,
the latest production release available at:
https://developer.arm.com/dow

docs(build): update GCC toolchain requirement to 14.2.Rel1

Update documentation to reflect the use of GCC version 14.2.Rel1,
the latest production release available at:
https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads

TF-A is built in CI using x86_64 Linux-hosted cross toolchains:
---------------------------------------------------------------
* AArch32 bare-metal target (arm-none-eabi)
* AArch64 bare-metal target (aarch64-none-elf)

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: I4cd2c16fa9daac1ce518d2280169e92562e3766d

show more ...

docs(prerequisites): update mbedtls to v3.6.3

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I62bc0fd6e40a38143ad3118a2e8e8d63c728a675