refactor(aarch64): move BL31 specific setup out of the PSCI entrypoint

We've charged the PSCI entrypoint with doing BL31 specific things like
setting up the EL3 context and doing feature detection.

refactor(aarch64): move BL31 specific setup out of the PSCI entrypoint

We've charged the PSCI entrypoint with doing BL31 specific things like
setting up the EL3 context and doing feature detection. Well, this is
irrelevant for sp_min and not really appropriate for PSCI. So move it to
the bl31_warmboot() function to reflect this correctly and bring the
feature detection a bit earlier, hopefully spotting more errors.

This allows for a pair of minor cleanups - we can pass the core_pos to
psci_warmboot_entrypoint() without having to refetch it, and we can put
the pauth enablement in cm_manage_extensions_el3() along with all
others. The call of that function is kept after the MMU is turned on so
that we have nicer (coherent) access to cpu_data.

Change-Id: Id031cfa0e1d8fe98919a14f9db73eb5bc9e00f67
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor: unify blx_setup() and blx_main()

All BLs have a bl_setup() for things that need to happen early, a fall
back into assembly and then bl_main() for the main functionality. This
was necessary

refactor: unify blx_setup() and blx_main()

All BLs have a bl_setup() for things that need to happen early, a fall
back into assembly and then bl_main() for the main functionality. This
was necessary in order to fiddle with PAuth related things that tend to
break C calls. Since then PAuth's enablement has seen a lot of
refactoring and this is now worked around cleanly so the distinction can
be removed. The only tradeoff is that this requires pauth to not be used
for the top-level main function.

There are two main benefits to doing this: First, code is easier to
understand as it's all together and the entrypoint is smaller. Second,
the compiler gets to see more of the code and apply optimisations
(importantly LTO).

Change-Id: Iddb93551115a2048988017547eb7b8db441dbd37
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(lib): add cache unit alignment attribute to cpu_context_t

This patch ensures that the dirty cache lines associated with a single
CPU's context are contained within that core, preventing the

refactor(lib): add cache unit alignment attribute to cpu_context_t

This patch ensures that the dirty cache lines associated with a single
CPU's context are contained within that core, preventing them from
being shared with other CPUs. The alignment applied to cpu_context_t
is consistent with the existing alignment for cpu_data_t.

Change-Id: I4973cd46fe85724f61cd83e4d26ec366671061e2
Signed-off-by: Noah Woo <namyoon@google.com>

show more ...

fix(smccc): cleanup unused declaration

Remove check_wa_cve_2024_7881() declaration left behind by patch
fd04156eb792963cb21144063e421d074efa6386.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakas

fix(smccc): cleanup unused declaration

Remove check_wa_cve_2024_7881() declaration left behind by patch
fd04156eb792963cb21144063e421d074efa6386.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Iae81e0bcbd2feb2b72a4e4e8fd27a27ae00c9cb4

show more ...

Merge "feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support" into integration

Merge changes Id38d6f1b,I5fcfe8dd,I7f3b50e5 into integration

* changes:
fix(cpus): inform the compiler that struct cpu_ops is aligned
refactor(el3-runtime): move the initialisation of the cpu_op

Merge changes Id38d6f1b,I5fcfe8dd,I7f3b50e5 into integration

* changes:
fix(cpus): inform the compiler that struct cpu_ops is aligned
refactor(el3-runtime): move the initialisation of the cpu_ops_ptr to C
fix(aarch32): make get_cpu_ops_ptr() PCS compliant

show more ...

fix(cpus): inform the compiler that struct cpu_ops is aligned

The only way to access a cpu_ops structure is through a pointer returned
from assembly so the compiler can't know its alignment and it m

fix(cpus): inform the compiler that struct cpu_ops is aligned

The only way to access a cpu_ops structure is through a pointer returned
from assembly so the compiler can't know its alignment and it must
assume the worst. As a result, it's scared to do 64 bit loads and must
do 8 single byte loads that it then can combine together.

Well, the cpu assembly macros take care to align the cpu_ops entries to
a word boundary so we can propagate that information to the structure
definition as well and removed the compiler's paranoia.

Change-Id: Id38d6f1b92527b8a414cfbb856a5a82c76a1b1a8
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(el3-runtime): move the initialisation of the cpu_ops_ptr to C

The difference between AArch32 and AArch64 is insignificant and the
usage is identical. The only thing that required the use of

refactor(el3-runtime): move the initialisation of the cpu_ops_ptr to C

The difference between AArch32 and AArch64 is insignificant and the
usage is identical. The only thing that required the use of assembly was
that the get_cpu_ops_ptr() function was not PCS compliant and needed a
wrapper to do that instead. That has now been fixed so move this to C so
it's more readable and more optimise-able by the compiler.

Change-Id: I5fcfe8ddb122dd35d58adc6d44a7484c5c595815
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support

Implement support for FEAT_MPAM_PE_BW_CTRL, allowing lower
Exception Levels to access MPAM_PE_BW_CTRL control registers
by disabling their traps to

feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support

Implement support for FEAT_MPAM_PE_BW_CTRL, allowing lower
Exception Levels to access MPAM_PE_BW_CTRL control registers
by disabling their traps to EL3.

When INIT_UNUSED_NS_EL2=1, configure MPAMBW2_EL2 in EL3 so
that MPAM_PE_BW_CTRL accesses from EL0/EL1 do not trap to EL2.

At this stage, PE-side MPAM bandwidth controls remain disabled
in EL3.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I8e359b0eb912cff3bdda109b21727a627cac3a7e

show more ...

feat(cpus): add support for Canyon CPU

Add basic CPU library code to support the Canyon CPU.

Change-Id: I82edc4384c4fe35ec2cf6b4bfd877a24ad8725dc
Signed-off-by: Icen Zeyada <Icen.Zeyada2@arm.com>
S

feat(cpus): add support for Canyon CPU

Add basic CPU library code to support the Canyon CPU.

Change-Id: I82edc4384c4fe35ec2cf6b4bfd877a24ad8725dc
Signed-off-by: Icen Zeyada <Icen.Zeyada2@arm.com>
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
Signed-off-by: Min Yao Ng <minyao.ng@arm.com>
Signed-off-by: Aditya Deshpande <aditya.deshpande@arm.com>

show more ...

fix(cpus): workaround for Cortex-X4 erratum 3887999

Cortex-X4 erratum 3887999 is a Cat B erratum that applies
to all revisions <= r0p3 and is still open.

The erratum can be avoided by setting CPUAC

fix(cpus): workaround for Cortex-X4 erratum 3887999

Cortex-X4 erratum 3887999 is a Cat B erratum that applies
to all revisions <= r0p3 and is still open.

The erratum can be avoided by setting CPUACTLR2[22] to 1'b1 which will
disable linking multiple Non-Cacheable or Device GRE loads to the same
read request for the cache-line. This might have a significant
performance impact to Non-cacheable and Device GRE read bandwidth for
streaming scenarios

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2432808/latest

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I851746b7b430eac85184c8d402d1aa5bb3c94a8e

show more ...

Merge changes Ic01517d5,I43af5796,I540e113f,I15646753,I180d38fe, ... into integration

* changes:
fix(cpus): organize Cortex-X2 errata entries
fix(cpus): workaround for Cortex-X2 erratum 2291219

Merge changes Ic01517d5,I43af5796,I540e113f,I15646753,I180d38fe, ... into integration

* changes:
fix(cpus): organize Cortex-X2 errata entries
fix(cpus): workaround for Cortex-X2 erratum 2291219
fix(cpus): workaround for Cortex-X2 erratum 2267065
fix(cpus): workaround for Cortex-X2 erratum 2136059
fix(cpus): workaround for Cortex-X2 erratum 1934260
fix(cpus): workaround for Cortex-X2 erratum 1927200
fix(cpus): workaround for Cortex-X2 erratum 1917258
fix(cpus): workaround for Cortex-X2 erratum 1916945
fix(cpus): workaround for Cortex-X2 erratum 1901946

show more ...

feat(el3-spmc): deliver TPM event log via hob list

Add MM_TPM_EVENT_LOG hob type and deliver tpm meaured event logs
passed via secure transfer list to secure partition with hob list in
SPMC_AT_EL3.

feat(el3-spmc): deliver TPM event log via hob list

Add MM_TPM_EVENT_LOG hob type and deliver tpm meaured event logs
passed via secure transfer list to secure partition with hob list in
SPMC_AT_EL3.

So that secure partition could get the meausred event log by TF-A.

Change-Id: I14f7f8cb8f8f54e07a13f40748ca551bcd265a51
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

fix(cpus): workaround for Cortex-X2 erratum 1934260

Cortex-X2 erratum 1934260 is a Cat B erratum that applies only
to revision r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[25:18

fix(cpus): workaround for Cortex-X2 erratum 1934260

Cortex-X2 erratum 1934260 is a Cat B erratum that applies only
to revision r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[25:18] to 0xFF. This
workaround will result in reduced performance for workloads
that benefit from write streaming.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: I180d38fee27175dc8ac5fa6726e5b71c3340285f
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-X2 erratum 1901946

Cortex-X2 erratum 1901946 is a Cat B erratum that applies to
revision r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[15]. This

fix(cpus): workaround for Cortex-X2 erratum 1901946

Cortex-X2 erratum 1901946 is a Cat B erratum that applies to
revision r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[15]. This has a small
performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: I5a65db60f06982191994db49815419c4d72506cf
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that CPUs handled a pabandon
feat(psci): make pabandon support generic
refactor(psci): unify coherency exit between AArch64 and AArch32
refactor(psci): absorb psci_power_down_wfi() into common code
refactor(platforms): remove usage of psci_power_down_wfi
fix(cm): disable SPE/TRBE correctly

show more ...

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this i

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this is indeed the case. The chosen method is with a return value
that is highly unlikely on cores that are unaware of pabandon (x0 will
be primed with 1 and if used should be overwritten with the value of
CPUPWRCTLR_EL1 which should have its last bit set to power off and its
top bits RES0; the ACK value is chosen to be the exact opposite). An
alternative method would have been to add a field in cpu_ops, however
that would have required more major refactoring across many cpus and
would have taken up more memory on older platforms, so it was not
chosen.

Change-Id: I5826c0e4802e104d295c4ecbd80b5f676d2cd871
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called f

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called from
non-PSCI code as PSCI is smart enough to handle this after platform
hooks. So absorb the functions into common code.

This allows for a tiny bit of optimisation: there will be no branch
(that can be missed or non-cached) to a non-inlineable function. Then in
the terminal case we can call wfi() directly with the application of the
erratum before the loop. And finally in the wakeup case, we don't have
to explicitly clear the errata as that will happen automatically on the
second call of prepare_cpu_pwr_dwn().

The A510 erratum requires a tsb csync before the dsb+wfi combo to turn
the core off. We can do this a little bit earlier in the cpu hook and
relieve common code from the responsibility. EL3 is always a prohibited
region so the buffer will stay empty.

Change-Id: I5f950df3fb7b0736df4ce25a21f78b29896de215
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cm): disable SPE/TRBE correctly

SPE and TRBE are unusual features. They have multi-bit enables whose
function is not immediately apparent and disabling them is not
straightforward.

While attemp

fix(cm): disable SPE/TRBE correctly

SPE and TRBE are unusual features. They have multi-bit enables whose
function is not immediately apparent and disabling them is not
straightforward.

While attempting to figure this out, the disables were made a mess of.
Patch fc7dca72b began changing the owning security state of SPE and
TRBE. This was first used in patch 79c0c7fac0 with calls to
spe_disable() and trbe_disbale(). However, patch 13f4a2525 reverted the
security state ownership, making the spe_disable() and trbe_disable()
redundant and their comments incorrect - the DoS protection is achieved
by the psb/tsb barriers on context switch, introduces separately in
f80887337 and 73d98e375.

Those patches got the behaviour full circle to what it was in fc7dca72b
so the disables can be fully removed for clarity.

However, the original method for disabling these features is not fully
correct - letting the "disabled" state be all zeroes made the features
seem enabled for secure world but they would trap. That is not a problem
while secure world doesn't use them, but could lead to some confusing
debugging in the future. NS and Realm worlds were not affected. This
patch fully establishes the pattern for SPE and TRBE's enablement,
documents it, and implements it such.

The description comments in the features boil down to 2 rules. There is
a third rule possible:
3. To enable TRBE/SPE for world X with a dirty buffer:
* world X owns the buffer
* trapping enabled
This is not listed as it would not work correctly with
SMCCC_ARCH_FEATURE_AVAILABILITY which relies on trapping to be disabled
to report correctly. If that is ever implemented, the SMCCC
implementation should be considered too.

Change-Id: I5588a3d5fc074c2445470954d8c3b172bec77d43
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page_count
to set search range and get the range having the same
permission from base_va.

This change is backward compatible with former FF-A v1.2 interface.

Links: https://developer.arm.com/documentation/den0140/latest/
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Change-Id: I5c9679c9da1126b1df65f22a803776029ab52b12

show more ...

fix(el3-runtime): typecast operands to match data type

This corrects the MISRA violation C2012-10.3:
The value of an expression shall not be assigned to an object with a
narrower essential type or o

fix(el3-runtime): typecast operands to match data type

This corrects the MISRA violation C2012-10.3:
The value of an expression shall not be assigned to an object with a
narrower essential type or of a different essential type category.
Replaced usage of 'unsigned int' with 'size_t' to ensure type
consistency and prevent assignment to a narrower or different
essential type.

Change-Id: I79501e216a04753ebd005d64375357b9332440d9
Signed-off-by: Nithin G <nithing@amd.com>
Signed-off-by: Maheedhar Bollapalli <maheedharsai.bollapalli@amd.com>

show more ...

Merge "feat(locks): add non-blocking spinlock_try() API" into integration

refactor(cm): gather per-world context management to the same place

The per-world calls are disparate - they get called in different places,
are guarded in different ways, and the code is apart.

Si

refactor(cm): gather per-world context management to the same place

The per-world calls are disparate - they get called in different places,
are guarded in different ways, and the code is apart.

Since they just need to be called once at boot, add a function that we
can call from BL31 and be done with it.

Change-Id: Id0ade302e35f2b00ca37c552a53038942ab7b58e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(lib): add mmio read with timeout

In several cases, drivers poll a register using a blocking 'while'
or 'for' loop without a timeout mechanism. Introducing a timeout
would be beneficial, as it a

feat(lib): add mmio read with timeout

In several cases, drivers poll a register using a blocking 'while'
or 'for' loop without a timeout mechanism. Introducing a timeout
would be beneficial, as it allows the system to log an error and
delegate the decision to the caller - whether to continue execution
or halt with a panic.

To address this, the mmio_read_poll_timeout() helper can be used. It
exits with -ETIMEDOUT if the timeout is reached, or 0 on success.
Additionally, the final value read from the register is stored in the
'val' variable, avoiding the need for an extra read after polling
completes.

Change-Id: I2ef53299b12ece6bc7be0e1234d5c2708e36ecf9
Signed-off-by: Ghennadi Procopciuc <ghennadi.procopciuc@nxp.com>

show more ...