Merge changes from topic "mb/partition-uuid-lookup" into integration

* changes:
feat(arm): prefer GUID-based GPT partition lookup
feat(guid-partition): add type+index GPT lookup

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME rela

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME related support is now enabled using feature detection option
ENABLE_FEAT_RME, this patch moves GPT support under ENABLE_FEAT_RME.

This change brings in below benefits:
- single TF-A build that works for RME and non-RME systems, when
build with ENABLE_FEAT_RME=2 (FEAT_STATE_CHECK)
- RMM loading is optional on RME systems
- SiP calls that leverages RME features to change the PAS of a memory
range from non-secure to secure is supported without need to enable
Realm PAS or RMM.
- FIRME Granule Management Interface (GMI) ABIs that handles
FEAT_RME_GPC2/FEAT_RME_GDI can be enabled without need to enable RMM

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I88d9d4e0491af2b4ae0307c018f2d4a71ee6693f

show more ...

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option perfor

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option performs RMM-specific tasks such as GPT setup, loading the RMM,
and enabling RMMD support.

Since ENABLE_RME now only controls RMM-related functionality, rename it
to ENABLE_RMM to better reflect its purpose and avoid confusion with
ENABLE_FEAT_RME.

For backward compatibility, setting the legacy ENABLE_RME=1 (until it is
deprecated) will automatically enable both ENABLE_FEAT_RME and
ENABLE_RMM.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Iac945bdffe5002161bf1161b81a5aa7abec68192

show more ...

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full RMM loading and handling.

While full CCA support requires all of these steps, some systems running
on FEAT_RME-capable cores do not need or want an RMM. However, such
systems still require TF-A page table entries to set the .NSE bit so
that TF-A accesses are correctly attributed to the ROOT world,
otherwise, enabling the MMU may cause the system to hang.

To address this, a new build option, ENABLE_FEAT_RME, is introduced. It
handles only the .NSE PTE setup and ignores the rest of the RME/RMM
initialization. ENABLE_FEAT_RME follows the ENABLE_FEAT_* convention and
supports values 0–2, with 2 enabling runtime detection.

Full RME functionality remains gated by ENABLE_RME, which now implicitly
enables ENABLE_FEAT_RME, allowing TF-A to run safely on FEAT_RME systems
without requiring an RMM.

Change-Id: I8391652842ff2e62a73b61829c6250c3805d4a4e
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

feat(arm): prefer GUID-based GPT partition lookup

Add platform overrideable GUID defaults for FWU metadata
and FIP image lookup.
Prefer GUID-based lookup with name fallback and clearer
error handlin

feat(arm): prefer GUID-based GPT partition lookup

Add platform overrideable GUID defaults for FWU metadata
and FIP image lookup.
Prefer GUID-based lookup with name fallback and clearer
error handling.
Use FWU metadata image GUIDs when present to select active
FIP partition

Change-Id: I81c87ad9794dc6e29a4b7f9a121eb2d41c9afa37
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

refactor(platforms): add generic hold pen

Introduce a common hold pen implementation for SMP secondary CPU
bring-up. Each core has a cache-line-aligned hold_slot struct
whose 'entry' field holds HO

refactor(platforms): add generic hold pen

Introduce a common hold pen implementation for SMP secondary CPU
bring-up. Each core has a cache-line-aligned hold_slot struct
whose 'entry' field holds HOLD_STATE_WAIT (all-ones sentinel)
while the core should keep polling, or the warm boot entrypoint
address when it should go.

plat_hold_pen_init() sets all slots to HOLD_STATE_WAIT and flushes
them to main memory. This is called once during boot to
establish a known-good state, overwriting any stale cached data
left by earlier boot stages (e.g. a BL2 dcsw_op_all).

plat_hold_pen_signal() writes the entrypoint into the target slot,
flushes it, and issues SEV.

The plat_hold_pen_wait_and_jump assembly macro provides the
secondary CPU polling loop for both AArch64 and AArch32.

Change-Id: Id7322cb9e8caa6a750348d194b4db66e2a515623
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>

show more ...

Merge changes from topic "mp/live_activate_sp" into integration

* changes:
docs(spm): describe support for SP live activation and relevant build flags
docs(spm): document ff-a manifest binding f

Merge changes from topic "mp/live_activate_sp" into integration

* changes:
docs(spm): describe support for SP live activation and relevant build flags
docs(spm): document ff-a manifest binding for SP live activation
feat(fvp): implement SP live activation callback
feat(fvp): enable discovery of two Secure Partitions for live activation
feat(fvp): introduce SP live activation component manager
feat(spmd): helpers for SP live activation framework messages
feat(lfa): build flags for SP live activation support
chore(fvp): remove the dummy function fvp_get_partition_info
feat(spmd): support for extended partition info descriptor

show more ...

feat(fvp): enable discovery of two Secure Partitions for live activation

This patch helps the LFA host to discover the presence of two Secure
Partitions for FVP platform that are capable of being li

feat(fvp): enable discovery of two Secure Partitions for live activation

This patch helps the LFA host to discover the presence of two Secure
Partitions for FVP platform that are capable of being live activated.
Necessary attributes of these two Secure Partitions are defined to
allow the LFA agent to report them to the host when the host performs
initial discovery of LFA support.

BREAKING CHANGE: Temporarily failing to build

Change-Id: Ibf0405559543cf19aaf45637c11ba5cf2e3a1619
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

feat(a8k): add user callback for skip_image

Add a user_defined.check function pointer to struct skip_image,
allowing platforms to implement custom skip image detection logic.
When set and returning

feat(a8k): add user callback for skip_image

Add a user_defined.check function pointer to struct skip_image,
allowing platforms to implement custom skip image detection logic.
When set and returning non-zero, BLE signals the bootloader to load
the recovery image.

This enables boards without dedicated recovery GPIOs to implement
software-based recovery triggers (e.g., UART key press detection).

Original-concept-by: Nicolas Schichan <nschichan@freebox.fr>
Change-Id: Ib58033fb1440f701dab027d77505f2582e3d98da
Signed-off-by: Vincent Jardin <vjardin@free.fr>

show more ...

Merge changes I8d332dbe,I9d30b6f9,I2fd7eece,Ibcd65f39,I86cc5e97 into integration

* changes:
feat(bl2): support RESET_TO_BL2 and ENABLE_RME
fix(build): fix BL2_CPPFLAGS when ENABLE_RME is set
f

Merge changes I8d332dbe,I9d30b6f9,I2fd7eece,Ibcd65f39,I86cc5e97 into integration

* changes:
feat(bl2): support RESET_TO_BL2 and ENABLE_RME
fix(build): fix BL2_CPPFLAGS when ENABLE_RME is set
fix(fvp): increase resident text size of BL2
fix(arm): support FCONF when TRANSFER_LIST and RESET_BL2 is set
fix(arm): update next image's ep info with the FW config address

show more ...

feat(bl2): support RESET_TO_BL2 and ENABLE_RME

When RSE is used as the root of trust along with CPU that supports RME
there is a need to enable both RESET_TO_BL2 and ENABLE_RME.

In current bl2_main

feat(bl2): support RESET_TO_BL2 and ENABLE_RME

When RSE is used as the root of trust along with CPU that supports RME
there is a need to enable both RESET_TO_BL2 and ENABLE_RME.

In current bl2_main there are two different code paths for RESET_BL2,
one handles BL2 running in EL1 and other for BL2 running in EL3.

When RME is enabled, BL2 always runs at EL3 but the current flow calls
bl2_early_platform_setup2, bl2_plat_arch_setup instead of
bl2_el3_early_platform_setup, bl2_el3_plat_arch_setup. Adding RME,
TRANSFER_LIST, ROMLIB support in bl2_el3_* helpers makes
arm_bl2_el3_setup.c almost identical to arm_bl2_setup.c.

This patch removes bl2_el3_plat helpers and related files. Now different
combinations of RESET_TO_BL2, ENABLE_RME are handled in common bl2_setup
routines in arm_bl2_setup.c. This helps to have common place to support
new features and build flags for BL2 irrespective of which EL the BL2
runs.

BREAKING-CHANGE: This patch also changes all existing platform files and
functions that use format bl2_el3_* to bl2_plat helpers. If any platform
or out-of-tree platforms that need to support running BL2 in EL1 or EL3
must now handle it in bl2_early_platform_setup2 and bl2_plat_arch_setup.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I8d332dbe2de1db3b69319496c8d04626cdcf4140

show more ...

Merge "feat(marvell): add odyssey platform header files" into integration

feat(marvell): add odyssey platform header files

Add register files for marvell odyssey platform.

Change-Id: I09000f453303aca2a389c061d02c4151a5386f6b
Signed-off-by: Jaiprakash Singh <jaiprakashs@m

feat(marvell): add odyssey platform header files

Add register files for marvell odyssey platform.

Change-Id: I09000f453303aca2a389c061d02c4151a5386f6b
Signed-off-by: Jaiprakash Singh <jaiprakashs@marvell.com>

show more ...

fix(arm): build fails on RESET_TO_BL2=1 and ARM_FW_CONFIG_LOAD_ENABLE=1

Use ARM_FW_CONFIG_BASE and ARM_FW_CONFIG_MAX_SIZE instead of platform
macros PLAT_FW_CONFIG_BASE and PLAT_FW_CONFIG_MAX_SIZE w

fix(arm): build fails on RESET_TO_BL2=1 and ARM_FW_CONFIG_LOAD_ENABLE=1

Use ARM_FW_CONFIG_BASE and ARM_FW_CONFIG_MAX_SIZE instead of platform
macros PLAT_FW_CONFIG_BASE and PLAT_FW_CONFIG_MAX_SIZE when
RESET_TO_BL2 and ARM_FW_CONFIG_LOAD_ENABLE are set to 1.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I0848852250eba5a3328e25cbea4fff413f344327

show more ...

feat(el3-runtime): translate EL3 handled exceptions to C and always call prepare_el3_entry

Exception handling in BL31 is tricky business and to satisfy the varying
requirements of the different code

feat(el3-runtime): translate EL3 handled exceptions to C and always call prepare_el3_entry

Exception handling in BL31 is tricky business and to satisfy the varying
requirements of the different code paths it has thus far largely been
written in assembly. However, assembly is extremely tedious to read and
modify. Similar to context management, it is desirable to have as much
as possible in C. C code is generally easier to follow and can enable
the compiler to do more optimisations on surrounding code.

Most exceptions that BL31 deals with are the synchronous exceptions and
those are processed within BL31. They already get prepared for EL3 entry
and after the initial dispatch end up in C. So the dispatch can also be
converted in C. Interrupt exceptions are very similar so are converted
too. Finally, asynchronous external aborts share some code with
synchronous external aborts and may end up being processed deeper in
BL31. So they can safely be prepared for EL3 entry too and converted to
C so that they can share code properly.

The IMP DEF exceptions are not part of this refactor as their speed may
be important. There is currently little that uses them, but they can be
converted to C too once their use expands and usage allows it.

This refactor allows to expand the responsibilities of
prepare_el3_entry(). Its role is already to prepare context for
executing within EL3 but with this patch EL3 execution is synonymous
with C runtime execution. So it's given the responsibility of saving
spsr and elr as well as putting the runtime stack in.

When a synchronous exception happens, the only possible paths are to
enter the C EL3 runtime, exiting via el3_exit(), or to panic. In the EL3
runtime case, we always need prepare_el3_entry() and the runtime stack,
whereas in the panic case, this doesn't matter as we will never return.
So hoist the prepare_el3_entry() call and the changing of the stacks as
early as possible and make the rest of the code agnostic of this.

This patch also gets rid of smc_prohibited. It is an optimisation by
skipping prepare_el3_entry() when a bad smc call happens. However, speed
doesn't matter in this case as this is an erroneous case.

Change-Id: I411af9d17ef4046a736b1f4f5f8fbc9c28e66106
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL

feat(fvp): extend image decryption support for FVP

Add encryption IO layer to be stacked above FIP IO layer for optional
encryption of the BL31 and BL32 images in case the ENCRYPT_BL31 or
ENCRYPT_BL32 build flag is set.

Enable decryption support for FVP through setting the DECRYPTION_SUPPORT
build flag. "DECRYPTION_SUPPORT = aes_gcm" is set to perform authenticated
decryption using AES-GCM algorithm.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iebc3b360b4a0dc0d933b816d28015ac551b79405

show more ...

Merge "fix(arm): derive RMM bank size from payload" into integration

Merge changes from topic "mb/lfa-rmm-test" into integration

* changes:
fix(rmmd): avoid race conditions in CPU finish
fix(arm): move lfa componet header to common and fix the helper
chore(lfa)

Merge changes from topic "mb/lfa-rmm-test" into integration

* changes:
fix(rmmd): avoid race conditions in CPU finish
fix(arm): move lfa componet header to common and fix the helper
chore(lfa): rename component_id to lfa_component_id

show more ...

Merge changes from topic "xl/fwu-trial-run" into integration

* changes:
fix(fwu): fwu NV ctr upgraded on trial run
feat(docs): platform hook for whether NV ctr is shared
feat(fwu): add platfor

Merge changes from topic "xl/fwu-trial-run" into integration

* changes:
fix(fwu): fwu NV ctr upgraded on trial run
feat(docs): platform hook for whether NV ctr is shared
feat(fwu): add platform hook for shared NV ctr

show more ...

feat(fwu): add platform hook for shared NV ctr

The NV ctr should not update when it is shared among
Bl1 and BL2. This is platform specific, therefore add
a platform hook to query the platform for th

feat(fwu): add platform hook for shared NV ctr

The NV ctr should not update when it is shared among
Bl1 and BL2. This is platform specific, therefore add
a platform hook to query the platform for this infor-
mation.

Change-Id: Ib180c8e6a183f7aaa7586e3f008273860d55b414
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

fix(css): don't require the GICC frame to be defined on GICv3

It's used for GICv2 operation, which won't happen with v3. CSS will
always use USE_GIC_DRIVER with the correct version so we can rely on

fix(css): don't require the GICC frame to be defined on GICv3

It's used for GICv2 operation, which won't happen with v3. CSS will
always use USE_GIC_DRIVER with the correct version so we can rely on
that to skip passing the GICC frame.

Change-Id: I358b99646f98bd7c6ea398bc8d8900cc80ca15bb
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(arm): derive RMM bank size from payload

Compute the RMM bank size as half of the RMM payload size instead of
using a hardcoded value. This removes duplication and keeps the bank
size automatical

fix(arm): derive RMM bank size from payload

Compute the RMM bank size as half of the RMM payload size instead of
using a hardcoded value. This removes duplication and keeps the bank
size automatically in sync with payload size changes.

Change-Id: I064390ec50115929bf6248344bf08a19fbc15344
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(arm): move lfa componet header to common and fix the helper

Move the FVP LFA component definitions to include/plat/arm/common/
so they can be shared by all Arm platforms, and update include
path

fix(arm): move lfa componet header to common and fix the helper

Move the FVP LFA component definitions to include/plat/arm/common/
so they can be shared by all Arm platforms, and update include
paths accordingly.

On FVP, rename the input parameter to lfa_component_id to match
the function declaration, and fix callers to pass the component
ID (not image_id) to the prime-complete helper.

Change-Id: Ia1485096819d6523c4bee14c602cbde3c6e144ef
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "lfa-plat-activate" into integration

* changes:
feat(fvp): add stub implementation for plat_lfa_notify_activate()
feat(lfa): add platform hook for activation notification

Merge changes from topic "rmm-lfa" into integration

* changes:
feat(arm): handle RMM ep_info during LFA
feat(lfa): add helper to check LFA prime completion status
feat(lfa): enable LFA of RMM

Merge changes from topic "rmm-lfa" into integration

* changes:
feat(arm): handle RMM ep_info during LFA
feat(lfa): add helper to check LFA prime completion status
feat(lfa): enable LFA of RMM
chore(lfa): use standard int return type for prime/activate callbacks
feat(rmmd): add warm reset helpers for primary and secondary CPUs

show more ...