feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME rela

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME related support is now enabled using feature detection option
ENABLE_FEAT_RME, this patch moves GPT support under ENABLE_FEAT_RME.

This change brings in below benefits:
- single TF-A build that works for RME and non-RME systems, when
build with ENABLE_FEAT_RME=2 (FEAT_STATE_CHECK)
- RMM loading is optional on RME systems
- SiP calls that leverages RME features to change the PAS of a memory
range from non-secure to secure is supported without need to enable
Realm PAS or RMM.
- FIRME Granule Management Interface (GMI) ABIs that handles
FEAT_RME_GPC2/FEAT_RME_GDI can be enabled without need to enable RMM

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I88d9d4e0491af2b4ae0307c018f2d4a71ee6693f

show more ...

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option perfor

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option performs RMM-specific tasks such as GPT setup, loading the RMM,
and enabling RMMD support.

Since ENABLE_RME now only controls RMM-related functionality, rename it
to ENABLE_RMM to better reflect its purpose and avoid confusion with
ENABLE_FEAT_RME.

For backward compatibility, setting the legacy ENABLE_RME=1 (until it is
deprecated) will automatically enable both ENABLE_FEAT_RME and
ENABLE_RMM.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Iac945bdffe5002161bf1161b81a5aa7abec68192

show more ...

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full RMM loading and handling.

While full CCA support requires all of these steps, some systems running
on FEAT_RME-capable cores do not need or want an RMM. However, such
systems still require TF-A page table entries to set the .NSE bit so
that TF-A accesses are correctly attributed to the ROOT world,
otherwise, enabling the MMU may cause the system to hang.

To address this, a new build option, ENABLE_FEAT_RME, is introduced. It
handles only the .NSE PTE setup and ignores the rest of the RME/RMM
initialization. ENABLE_FEAT_RME follows the ENABLE_FEAT_* convention and
supports values 0–2, with 2 enabling runtime detection.

Full RME functionality remains gated by ENABLE_RME, which now implicitly
enables ENABLE_FEAT_RME, allowing TF-A to run safely on FEAT_RME systems
without requiring an RMM.

Change-Id: I8391652842ff2e62a73b61829c6250c3805d4a4e
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge "fix(psci): have generic code call psci_pwrdown_cpu_start() on system off/reset" into integration

fix(psci): have generic code call psci_pwrdown_cpu_start() on system off/reset

This is a generic PSCI operation and should not be called in platform
code. Mainly, it is needed for the ordering of th

fix(psci): have generic code call psci_pwrdown_cpu_start() on system off/reset

This is a generic PSCI operation and should not be called in platform
code. Mainly, it is needed for the ordering of the GIC driver - the
platform hook is likely to raise SGIs to other cores so turning the GIC
off must happen after. But turning the GIC off is a non-trivial
operation with many data accesses so it must be called before the D
cache is turned off (from psci_pwrdown_cpu_start());

Change-Id: Ia7fdc3a93956edfd1b374597866998b743fbaa32
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(gic): init the GIC before the platform with a hook

While GIC setup is generic across platforms, its usage is not. Some
platforms won't use it at EL3, while others need to configure interrupts
(l

fix(gic): init the GIC before the platform with a hook

While GIC setup is generic across platforms, its usage is not. Some
platforms won't use it at EL3, while others need to configure interrupts
(like RAS) in the standard platform hooks. To do that, the GIC needs to
be set up and ready to use before calling the platform hooks but
currently that is only done after. Annoyingly, a handful of platforms
need to set their GIC up before initialising it necessitating the
platform hooks to be called before GIC init.

This patch resolves this contradiction by moving the general GIC setup
calls to before the platform hooks and adding a GIC-specific platform
hook just before GIC per CPU init. This way both types of platforms can
do their business at the same time.

Change-Id: I361f587ab4603162ee880addb074800cbbb97b49
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "fix(mhu): relax 4-byte align in buffer size" into integration

fix: remove unused scu driver

Patch 19d6b6b776e2628fadd72b18f342bdedcd7c5b57 removed the A5DS
platform which was the only user of this driver. Remove it too as it is
now dead code.

Change-Id: Iac73

fix: remove unused scu driver

Patch 19d6b6b776e2628fadd72b18f342bdedcd7c5b57 removed the A5DS
platform which was the only user of this driver. Remove it too as it is
now dead code.

Change-Id: Iac737e868e3cc15d955ee8b7de2eed2a7d99cff0
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "fix(build): use assignment instead of memcpy to avoid a GCC 11 bug" into integration

fix(mhu): relax 4-byte align in buffer size

This is a port of patch cee0d3649 from TF-M. It is functionally
identical and the original commit message follows:

The MHU wrapper handles the data from

fix(mhu): relax 4-byte align in buffer size

This is a port of patch cee0d3649 from TF-M. It is functionally
identical and the original commit message follows:

The MHU wrapper handles the data from and to the driver with a 4-byte
alignment. This may not fit the caller, which may need to transfer a
buffer or arbitrary size. Add some logic to internally handle the case
where the buffer size is not multiple of 4 bytes.

Change-Id: I07210385940f4e2de0728ae9235823e516d224f7
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(sfcp): add SFCP stack and PSA call

Add SFCP stack from trusted-firmware-m commit 8eb72a3bc5cc. SFCP is the
Simple Firmware Communication Protocol, which is a more substantial
software stack des

feat(sfcp): add SFCP stack and PSA call

Add SFCP stack from trusted-firmware-m commit 8eb72a3bc5cc. SFCP is the
Simple Firmware Communication Protocol, which is a more substantial
software stack designed to replace the existing RSE comms (and indeed
wider communication between firmware components in the system). It has
support for both polling mode and interrupt driver communication
handling, and is able to support any underlying transport (this patch
adds MHU only). It requires a static routing layout between system
components.

This patch adds the link layer (with support for the MHU transport),
top-level SFCP API implementation and the implementation of PSA
call making use of the SFCP API.

Note that encryption support is not implemented and only the stub
encryption implementation is added in this patch. This can be
implemented when TF-A needs it.

The sfcp_link_hal.c implementation is the same as that in
trusted-firmware-m, and it makes use of the MHU V2 and V3 drivers
directly. This is possible as the underlying MHU driver APIs is the same
in trusted-firmware-m and trusted-firmware-a.

Change-Id: I2318ea4bdb4e533b8a4a5000040aec0635a83857
Signed-off-by: Jackson Cooper-Driver <jackson.cooper-driver@arm.com>

show more ...

feat(rse): fix iovec parameter check in rse comms

Allow NULL pointers as in/outvec pointer, but only if the
corresponding length is 0, in which case it is not used.
Introduce check for outvec as wel

feat(rse): fix iovec parameter check in rse comms

Allow NULL pointers as in/outvec pointer, but only if the
corresponding length is 0, in which case it is not used.
Introduce check for outvec as well, where NULL pointer
would cause illegal dereferencing on evaluation of
out_vec[0].base

Signed-off-by: Martin Fonai <martin.fonai@arm.com>
Change-Id: Ie5ea11ed63d942a063a9cfed8333b553b96e9924

show more ...

fix(build): use assignment instead of memcpy to avoid a GCC 11 bug

GCC11 has a bug where it may produce an incorrect warning "writing 1 or
more bytes into a region of size 0 overflows the destinatio

fix(build): use assignment instead of memcpy to avoid a GCC 11 bug

GCC11 has a bug where it may produce an incorrect warning "writing 1 or
more bytes into a region of size 0 overflows the destination" when using
memcpy and memset [0]. Since we use -Werror, this warning is fatal and
prevents building certain configurations with GCC11. Enabling LTO makes
the problem worse as the compiler has more visibility to do a wider
analysis.

This patch fixes this by using syntactic assignment rather than library
functions in the places that most often cause problems. GCC11 is able to
correctly analyse those scenarios and does not emit a warning. There is
a slight upside to this in that it may be able to produce more optimal
code.

[0]: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106199

Change-Id: I897e6360b8619ba1d4587d3abf84ffdd31f17273
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(gicv3): add an isb between the ICC_SRE_EL2 and ICC_SRE_EL1 writes

While ICC_SRE_EL2.SRE is 0, ICC_SRE_EL1.SRE is RAZ/WI. Except for an
isb between the two writes, there is nothing to guarantee t

fix(gicv3): add an isb between the ICC_SRE_EL2 and ICC_SRE_EL1 writes

While ICC_SRE_EL2.SRE is 0, ICC_SRE_EL1.SRE is RAZ/WI. Except for an
isb between the two writes, there is nothing to guarantee that the
ICC_SRE_EL2.SRE write has taken effect by the time the ICC_SRE_EL1.SRE
write occurs. Add the isb to guarantee that the write is successful.

Change-Id: Ib84193f49e67ed0a64d6e2c6c71fb99b5b58a211
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(gic): fix coverity issue INTEGER_OVERFLOW

Avoid unsigned underflow when spi_id_min is below the base.
Make all shifts in the CHIPR value composition 64-bit, to
avoid flagging overflow.

Change-I

fix(gic): fix coverity issue INTEGER_OVERFLOW

Avoid unsigned underflow when spi_id_min is below the base.
Make all shifts in the CHIPR value composition 64-bit, to
avoid flagging overflow.

Change-Id: I376809fc110ff45dd0682b4bcf8dab43cf03d300
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(scmi): fix coverity issue INTEGER_OVERFLOW

Fixes the following coverity issue -

CID 457917: (#1 of 1): Overflowed constant (INTEGER_OVERFLOW)
overflow_const: Expression lvl - 1U, where lvl is k

fix(scmi): fix coverity issue INTEGER_OVERFLOW

Fixes the following coverity issue -

CID 457917: (#1 of 1): Overflowed constant (INTEGER_OVERFLOW)
overflow_const: Expression lvl - 1U, where lvl is known to be equal
to 0, underflows the type of lvl - 1U, which is type unsigned int.

Change-Id: Id965c4b95159793944b3ef4658fd92e881d53c59
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

feat(scmi): support graceful system power set

Add conditional compiler to control the flags in css_scp_suspend and
css_scp_system_off. This enable each platform can decide to use
graceful or forcefu

feat(scmi): support graceful system power set

Add conditional compiler to control the flags in css_scp_suspend and
css_scp_system_off. This enable each platform can decide to use
graceful or forceful flag in SCMI system power set command per
their use cases.

Upstream-Status: Pending
Change-Id: I99129a680927b9401385fca6094b476126e2f8c7
Signed-off-by: Jun Wu <jun.wu@arm.com>

show more ...

fix(dsu): fix illegal address Coverity finding

Based on -
https://scan4.scan.coverity.com/#/project-view/68818/11439?selectedIssue=425813
https://scan4.scan.coverity.com/#/project-view/68818/11439?s

fix(dsu): fix illegal address Coverity finding

Based on -
https://scan4.scan.coverity.com/#/project-view/68818/11439?selectedIssue=425813
https://scan4.scan.coverity.com/#/project-view/68818/11439?selectedIssue=425812
CID 425812: (#1 of 1): Illegal address computation (OVERRUN)

This patch avoids the OVERRUN/illegal address Coverity finding.

Change-Id: I8b2521c9f1f1e8c815c5a2940f98464bbb59e111
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

feat(dsu): enable PMU registers access at EL1

- Disable trapping of write accesses to DSU cluster PMU registers
at EL3 and EL2.
- Clear the SPME bit in CLUSTERPMMDCR_EL3 to prohibit PMU event
co

feat(dsu): enable PMU registers access at EL1

- Disable trapping of write accesses to DSU cluster PMU registers
at EL3 and EL2.
- Clear the SPME bit in CLUSTERPMMDCR_EL3 to prohibit PMU event
counting in the secure state.

Change-Id: If3eb6e997330ae86f45760e0e862c003861f3d66
Signed-off-by: Amr Mohamed <amr.mohamed@arm.com>

show more ...

feat(gicv3): add GIC-720AE model id

Add GIC-720AE model id to power up its Redistributor in BL31 GIC
initialization.
No use case so far for multichip support on GIC-720AE.

Change-Id: Id6ca8144b0c02

feat(gicv3): add GIC-720AE model id

Add GIC-720AE model id to power up its Redistributor in BL31 GIC
initialization.
No use case so far for multichip support on GIC-720AE.

Change-Id: Id6ca8144b0c02557ba7569a536cece37e4c1fe98
Signed-off-by: David Hu <david.hu2@arm.com>
Signed-off-by: Ahmed Azeem <ahmed.azeem@arm.com>

show more ...

fix(gicv3): avoid incrementing global gicr_frames pointer

commit 75170704c9119a4947 (refactor(gicv3): clarify redistributor base
address usage with USE_GIC_DRIVER=3) introduced changes to walk the
r

fix(gicv3): avoid incrementing global gicr_frames pointer

commit 75170704c9119a4947 (refactor(gicv3): clarify redistributor base
address usage with USE_GIC_DRIVER=3) introduced changes to walk the
redistributor frames by incrementing the global `gicr_frames` pointer.
This leaves the pointer advanced after the first miss, so subsequent
CPUs do not start from the beginning of the array. Such behaviour is
incorrect in the presence of CPU hotplug or out-of-order CPU_ON
operations, where each CPU must be able to probe the full set of
redistributor frames independently.

Fix this by using a local iterator instead of modifying the global
`gicr_frames` pointer, preserving the array state for all CPUs.

While here, fix a typo in a comment and replace the `do…while`
loop with a safer `while` loop to avoid probing the zero terminator in
case a platform erroneously passes an empty array.

Signed-off-by: Rohit Mathew <rohit.mathew@arm.com>
Change-Id: I6d6f73fb172c48f8e50b29ec2232648be3a6a6a0

show more ...

Merge changes from topic "xlnx_misra_fix_gen_gicv3" into integration

* changes:
fix(gicv3): typecast operands to match data type
fix(gicv3): add missing curly braces
fix(gicv3): fix misra viol

Merge changes from topic "xlnx_misra_fix_gen_gicv3" into integration

* changes:
fix(gicv3): typecast operands to match data type
fix(gicv3): add missing curly braces
fix(gicv3): fix misra violation 12.1
fix(gicv3): match function definition and declaration
fix(gicv3): typecast operands to match data type

show more ...

Merge changes from topic "xlnx_misra_fix_gen_arm" into integration

* changes:
fix(arm-drivers): add missing curly braces
fix(arm): typecast operands to match data type
fix(arm-drivers): declar

Merge changes from topic "xlnx_misra_fix_gen_arm" into integration

* changes:
fix(arm-drivers): add missing curly braces
fix(arm): typecast operands to match data type
fix(arm-drivers): declare unused parameters as void

show more ...

Merge changes from topic "Add-i.MX94/95-suport" into integration

* changes:
docs(maintainers): add i.MX9 to maintained paths
feat(imx94): add initial support for imx94
feat(imx95): add optee s

Merge changes from topic "Add-i.MX94/95-suport" into integration

* changes:
docs(maintainers): add i.MX9 to maintained paths
feat(imx94): add initial support for imx94
feat(imx95): add optee support
feat(imx95): support trusty os
feat(imx95): implement a semaphore for GIC quiescing
feat(imx95): add initial support for i.MX95
feat(imx9): add necessary ele api call support
feat(imx9): add imx9 common code base
refactor(imx): drop the __dead2 attribute
fix(imx): add static attribute for platform specific gic struct
feat(gic): change gic_cpuif_enable/disable to weak
feat(scmi): add i.MX9 SCMI vendor CPU protocol
feat(scmi): add base protocol agent API
feat(scmi): update version to 3.0
build(changelog): update for imx94/95 support

show more ...

Merge "fix(dcc): typecast operands to match data type" into integration