fix(console): create unique variable name

This corrects the MISRA violation C2012-5.7:
A tag name shall be a unique identifier.
Renamed the variable to ensure uniqueness.

Change-Id: I96e61caa8c6c7f

fix(console): create unique variable name

This corrects the MISRA violation C2012-5.7:
A tag name shall be a unique identifier.
Renamed the variable to ensure uniqueness.

Change-Id: I96e61caa8c6c7ff64759363afd24fc224d449f86
Signed-off-by: Nithin G <nithing@amd.com>
Signed-off-by: Maheedhar Bollapalli <maheedharsai.bollapalli@amd.com>

show more ...

refactor(gicv3): clarify redistributor base address usage with USE_GIC_DRIVER=3

The GICv3 driver has 2 methods of discovering the redistributors:
a) via setting gicr_base - done at boot and assumes

refactor(gicv3): clarify redistributor base address usage with USE_GIC_DRIVER=3

The GICv3 driver has 2 methods of discovering the redistributors:
a) via setting gicr_base - done at boot and assumes all GICR frames are
contiguous. This is the original method.

b) via gicv3_rdistif_probe() - called from platform code and requires
gicr_base == 0. It relaxes the requirement for frames to be
contiguous, like in a multichip configuration, and defers the
discovery to core bringup. This was introduced later.

Configurations possible with option a) are also possible with option b)
with only slightly different behaviour. USE_GIC_DRIVER=3 inherited
option b) from plat_gicv3_base.c and as such option a) is unusable.
However, it is unclear from code how this should be used. Clarify this
by requiring platforms initialise with gic_set_gicr_frames() and
adding relevant comments.

Also rename plat_arm_override_gicr_frames() to gic_set_gicr_frames() as
this is not plat arm specific and a part of the generic GIC driver.

Change-Id: I61d77211f8e65dc54cf9904069b500d26a06b5a5
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(bl31): declare function as static

This corrects the MISRA violation C2012-8.7:
Functions and objects should not be defined with external linkage
if they are referenced in only one translation un

fix(bl31): declare function as static

This corrects the MISRA violation C2012-8.7:
Functions and objects should not be defined with external linkage
if they are referenced in only one translation unit.
The functions are declared as static that are referenced only
within a translation unit.

Change-Id: I785f9cd5378fa229812786d6877a5559983d32f3
Signed-off-by: Nithin G <nithing@amd.com>
Signed-off-by: Maheedhar Bollapalli <maheedharsai.bollapalli@amd.com>

show more ...

fix(cpus): workaround for Cortex-X4 erratum 3887999

Cortex-X4 erratum 3887999 is a Cat B erratum that applies
to all revisions <= r0p3 and is still open.

The erratum can be avoided by setting CPUAC

fix(cpus): workaround for Cortex-X4 erratum 3887999

Cortex-X4 erratum 3887999 is a Cat B erratum that applies
to all revisions <= r0p3 and is still open.

The erratum can be avoided by setting CPUACTLR2[22] to 1'b1 which will
disable linking multiple Non-Cacheable or Device GRE loads to the same
read request for the cache-line. This might have a significant
performance impact to Non-cacheable and Device GRE read bandwidth for
streaming scenarios

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2432808/latest

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I851746b7b430eac85184c8d402d1aa5bb3c94a8e

show more ...

Merge changes Ic01517d5,I43af5796,I540e113f,I15646753,I180d38fe, ... into integration

* changes:
fix(cpus): organize Cortex-X2 errata entries
fix(cpus): workaround for Cortex-X2 erratum 2291219

Merge changes Ic01517d5,I43af5796,I540e113f,I15646753,I180d38fe, ... into integration

* changes:
fix(cpus): organize Cortex-X2 errata entries
fix(cpus): workaround for Cortex-X2 erratum 2291219
fix(cpus): workaround for Cortex-X2 erratum 2267065
fix(cpus): workaround for Cortex-X2 erratum 2136059
fix(cpus): workaround for Cortex-X2 erratum 1934260
fix(cpus): workaround for Cortex-X2 erratum 1927200
fix(cpus): workaround for Cortex-X2 erratum 1917258
fix(cpus): workaround for Cortex-X2 erratum 1916945
fix(cpus): workaround for Cortex-X2 erratum 1901946

show more ...

refactor(arm): unify SPSR retrieval logic

Consolidate platform-specific SPSR setup logic into a single
arm_get_spsr() function that accepts an image_id to select between BL32
and BL33. This reduces

refactor(arm): unify SPSR retrieval logic

Consolidate platform-specific SPSR setup logic into a single
arm_get_spsr() function that accepts an image_id to select between BL32
and BL33. This reduces duplication and simplifies control over SPSR
generation for later stages, particularly BL33.

The SPD remains responsible for setting the SPSR for BL32.

Change-Id: Ibbba708d607e7676989f5c7ceffe33d7bb2195f1
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge changes from topics "refactor_stmm", "stmm_crb_area", "stmm_with_xferlist" into integration

* changes:
feat(fvp): organize fvp_stmm_manifest.dts
feat(juno): add pseudo CRB area
feat(fvp)

Merge changes from topics "refactor_stmm", "stmm_crb_area", "stmm_with_xferlist" into integration

* changes:
feat(fvp): organize fvp_stmm_manifest.dts
feat(juno): add pseudo CRB area
feat(fvp): add pseudo CRB area
feat(arm): add pseudo CRB area
feat(juno): increase xtable for pseudo CRB
feat(fvp): increase xtable for pseudo CRB for SPMC_AT_EL3
feat(el3-spmc): deliver TPM event log via hob list
feat(el3-spmc): get sp_manifest via xferlist
feat(fvp): tos_fw_config with transfer list
feat(arm): load tos_fw_cfg using xferlist in SPMC_AT_EL3
feat(fvp): increase secure partition's table mapping count
feat(fvp): increase bl2 mmap tables for handoff

show more ...

Merge "feat(common): add support for kernel DT handoff convention" into integration

Merge changes Ib220a866,I38e6af65,I1554efdb,Iae99985e,I96f96267, ... into integration

* changes:
feat(stm32mp25-fdts): enable rng nodes for ST boards
feat(stm32mp2): prepare DDR secure area encr

Merge changes Ib220a866,I38e6af65,I1554efdb,Iae99985e,I96f96267, ... into integration

* changes:
feat(stm32mp25-fdts): enable rng nodes for ST boards
feat(stm32mp2): prepare DDR secure area encryption
feat(stm32mp2): add some platform helpers
feat(st-drivers): add RISAF driver
feat(fdts): add RISAF nodes for STM32MP25
feat(stm32mp2-fdts): add memory firewall node
feat(stm32mp2-fdts): add firewall nodes in fw-config
feat(stm32mp2): add RIF dt-binding defines
feat(stm32mp1-fdts): add MCE support for STM32MP13 DK board
feat(stm32mp1): prepare DDR secure area encryption for STM32MP13
feat(stm32mp1): enable MCE driver for STM32MP13
feat(st-drivers): add Memory Cipher Engine driver
feat(dt-bindings): add MCE DT bindings for STM32MP13
fix(st-crypto): improve RNG health test configuration
feat(st): add RNG minor version
feat(st-crypto): add multi instance and error management in RNG driver
feat(stm32mp2): add HASH and RNG compilation
feat(stm32mp25-fdts): add RNG node

show more ...

feat(common): add support for kernel DT handoff convention

TF-A currently supports multiple DT handoff conventions:

1. Firmware Handoff (FH): DT passed in x0, with x1–x3 carrying
additional data

feat(common): add support for kernel DT handoff convention

TF-A currently supports multiple DT handoff conventions:

1. Firmware Handoff (FH): DT passed in x0, with x1–x3 carrying
additional data.
2. Kernel-compatible handoff (ARM_LINUX_KERNEL_AS_BL33): DT passed in
x0, x1–x3 zeroed.
3. Legacy TF-A convention: DT passed in x1, with x0 used for MPIDR or
NT_FW_CONFIG.

After discussions with folks in EDK2 and U-Boot, it's clear that there
is no strict requirement for placing the DT in x1. Both projects support
x0 for Arm platforms. To standardize behavior and support firmware
handoff migration, this patch introduces USE_KERNEL_DT_CONVENTION as a
configurable build flag. When enabled, the DT will be passed in x0 for
BL33.

This aligns TF-A’s behavior with Linux boot expectations and simplifies
integration across bootloaders.

Change-Id: I6bd7154fe07cb2e16e25c058f7cf862f9ae007e7
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(arm): add pseudo CRB area

To support StandaloneMm with fTPM, add pseudo CRB areas used by fTPM.
These areas are allocated:
- For Normal world localities (0 ~ 3), allocates NS_CRB at
ARM_N

feat(arm): add pseudo CRB area

To support StandaloneMm with fTPM, add pseudo CRB areas used by fTPM.
These areas are allocated:
- For Normal world localities (0 ~ 3), allocates NS_CRB at
ARM_NS_DRAM1_BASE as much as 0x4000.
- For Secure world locality (4), allocates S_CRB at
the end of HEAP as much as 0x1000.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Change-Id: I71521a7b418fed4aae5a7d1ae5f8228955776b27

show more ...

feat(el3-spmc): deliver TPM event log via hob list

Add MM_TPM_EVENT_LOG hob type and deliver tpm meaured event logs
passed via secure transfer list to secure partition with hob list in
SPMC_AT_EL3.

feat(el3-spmc): deliver TPM event log via hob list

Add MM_TPM_EVENT_LOG hob type and deliver tpm meaured event logs
passed via secure transfer list to secure partition with hob list in
SPMC_AT_EL3.

So that secure partition could get the meausred event log by TF-A.

Change-Id: I14f7f8cb8f8f54e07a13f40748ca551bcd265a51
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

fix(console): match function parameter is decleration

This corrects the MISRA violation C2012-8.3:
matching the function parameter name in declaration with
the function definition.

Change-Id: Ib9a3

fix(console): match function parameter is decleration

This corrects the MISRA violation C2012-8.3:
matching the function parameter name in declaration with
the function definition.

Change-Id: Ib9a3b82db85bbf4fa94dc1e9a9203262c5606cd4
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...

feat(arm): introduce ARM_SPM_NS_MEM_BASE and move NS buffer

PLAT_SP_IMAGE_NS_BUF_BASE in arm_spm_def.h is located in
ARM_AP_TZC_DRAM1_BASE.
Because of this, to use PLAT_SP_IMAGE_NS_BUF_BASE in norma

feat(arm): introduce ARM_SPM_NS_MEM_BASE and move NS buffer

PLAT_SP_IMAGE_NS_BUF_BASE in arm_spm_def.h is located in
ARM_AP_TZC_DRAM1_BASE.
Because of this, to use PLAT_SP_IMAGE_NS_BUF_BASE in normal world,
the TZC region configuration is required like this:

0: ARM_AP_TZC_DRAM1_BASE to PLAT_SP_IMAGE_NS_BUF_BASE (secure only)
1: PLAT_SP_IMAGE_NS_BUF_BASE to PLAT_SP_IMAGE_NS_BUF_SIZE
(ns and secure)
2: PLAT_SP_IMAGE_NS_BASE + PLAT_SP_IMAGE_NS_BUF_SIZE to
ARM_AP_TZC_DRAM1_BASE + ARM_EL3_TZC_DRAM1_END (secure only)

To reduce TZC area for PLAT_SP_IMAGE_NS_BUF_BASE
Let add ARM_SPM_NS_MEM_BASE where located in
(ARM_AP_TZC_DRAM1_BASE) - 1MB as much as 1MB.
and locate PLAT_SP_IMAGE_NS_BUF in this area.

So that reduce the TZC region in ARM_TZC_REGIONS_DEF.

Change-Id: Ia6170f5eec893dde2e3bbd85de46788c4bf35292
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

fix(cpus): workaround for Cortex-X2 erratum 1934260

Cortex-X2 erratum 1934260 is a Cat B erratum that applies only
to revision r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[25:18

fix(cpus): workaround for Cortex-X2 erratum 1934260

Cortex-X2 erratum 1934260 is a Cat B erratum that applies only
to revision r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[25:18] to 0xFF. This
workaround will result in reduced performance for workloads
that benefit from write streaming.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: I180d38fee27175dc8ac5fa6726e5b71c3340285f
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-X2 erratum 1901946

Cortex-X2 erratum 1901946 is a Cat B erratum that applies to
revision r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[15]. This

fix(cpus): workaround for Cortex-X2 erratum 1901946

Cortex-X2 erratum 1901946 is a Cat B erratum that applies to
revision r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[15]. This has a small
performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: I5a65db60f06982191994db49815419c4d72506cf
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

feat(smccc): add SoC name support to SMCCC_ARCH_SOC_ID

This patch adds support for getting the SoC name string
using the SMCCC_ARCH_SOC_ID interface. The SoC name query
was introduced in SMCCC versi

feat(smccc): add SoC name support to SMCCC_ARCH_SOC_ID

This patch adds support for getting the SoC name string
using the SMCCC_ARCH_SOC_ID interface. The SoC name query
was introduced in SMCCC version 1.6. It is available only
through SMC64 calls.

A new function ID, SMCCC_GET_SOC_NAME, is added. It returns
the SoC name as a null-terminated ASCII string, spread across
registers X1 to X17 in little endian order.
The total length is 136 bytes, including the null byte.
Any space after the null terminator is filled
with zeros.

A platform hook plat_get_soc_name() is added to return the
SoC name. A weak default version is also provided that returns
SMC_ARCH_CALL_NOT_SUPPORTED for platforms that do not support
this feature.

The name should follow the SMCCC rule that it must not expose
any information that is not already reported
by the SoC version and revision calls.

Reference: https://developer.arm.com/documentation/den0028/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Idc69997c509bcbfb1cecb38ed1003b29627ade4b

show more ...

feat(cpufeat): do feature detection on secondary cores too

Feature detection currently only happens on the boot core, however, it
is possible to have asymmetry between cores. TF-A supports limited s

feat(cpufeat): do feature detection on secondary cores too

Feature detection currently only happens on the boot core, however, it
is possible to have asymmetry between cores. TF-A supports limited such
configurations so it should check secondary cores too.

Change-Id: Iee4955714685be9ae6a017af4a6c284e835ff299
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that CPUs handled a pabandon
feat(psci): make pabandon support generic
refactor(psci): unify coherency exit between AArch64 and AArch32
refactor(psci): absorb psci_power_down_wfi() into common code
refactor(platforms): remove usage of psci_power_down_wfi
fix(cm): disable SPE/TRBE correctly

show more ...

Merge changes from topic "ffa_mem_perm_get_update" into integration

* changes:
feat(spm): update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface
feat(el3-spmc): update FFA_MEM_PERM_GET interface

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this i

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this is indeed the case. The chosen method is with a return value
that is highly unlikely on cores that are unaware of pabandon (x0 will
be primed with 1 and if used should be overwritten with the value of
CPUPWRCTLR_EL1 which should have its last bit set to power off and its
top bits RES0; the ACK value is chosen to be the exact opposite). An
alternative method would have been to add a field in cpu_ops, however
that would have required more major refactoring across many cpus and
would have taken up more memory on older platforms, so it was not
chosen.

Change-Id: I5826c0e4802e104d295c4ecbd80b5f676d2cd871
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called f

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called from
non-PSCI code as PSCI is smart enough to handle this after platform
hooks. So absorb the functions into common code.

This allows for a tiny bit of optimisation: there will be no branch
(that can be missed or non-cached) to a non-inlineable function. Then in
the terminal case we can call wfi() directly with the application of the
erratum before the loop. And finally in the wakeup case, we don't have
to explicitly clear the errata as that will happen automatically on the
second call of prepare_cpu_pwr_dwn().

The A510 erratum requires a tsb csync before the dsb+wfi combo to turn
the core off. We can do this a little bit earlier in the cpu hook and
relieve common code from the responsibility. EL3 is always a prohibited
region so the buffer will stay empty.

Change-Id: I5f950df3fb7b0736df4ce25a21f78b29896de215
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cm): disable SPE/TRBE correctly

SPE and TRBE are unusual features. They have multi-bit enables whose
function is not immediately apparent and disabling them is not
straightforward.

While attemp

fix(cm): disable SPE/TRBE correctly

SPE and TRBE are unusual features. They have multi-bit enables whose
function is not immediately apparent and disabling them is not
straightforward.

While attempting to figure this out, the disables were made a mess of.
Patch fc7dca72b began changing the owning security state of SPE and
TRBE. This was first used in patch 79c0c7fac0 with calls to
spe_disable() and trbe_disbale(). However, patch 13f4a2525 reverted the
security state ownership, making the spe_disable() and trbe_disable()
redundant and their comments incorrect - the DoS protection is achieved
by the psb/tsb barriers on context switch, introduces separately in
f80887337 and 73d98e375.

Those patches got the behaviour full circle to what it was in fc7dca72b
so the disables can be fully removed for clarity.

However, the original method for disabling these features is not fully
correct - letting the "disabled" state be all zeroes made the features
seem enabled for secure world but they would trap. That is not a problem
while secure world doesn't use them, but could lead to some confusing
debugging in the future. NS and Realm worlds were not affected. This
patch fully establishes the pattern for SPE and TRBE's enablement,
documents it, and implements it such.

The description comments in the features boil down to 2 rules. There is
a third rule possible:
3. To enable TRBE/SPE for world X with a dirty buffer:
* world X owns the buffer
* trapping enabled
This is not listed as it would not work correctly with
SMCCC_ARCH_FEATURE_AVAILABILITY which relies on trapping to be disabled
to report correctly. If that is ever implemented, the SMCCC
implementation should be considered too.

Change-Id: I5588a3d5fc074c2445470954d8c3b172bec77d43
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(cm): unify RMM context

setup_realm_context() is the de facto place to put any code that relates
to the RMM's context. It is frequently updated and contains the vast
majority of code. manage

refactor(cm): unify RMM context

setup_realm_context() is the de facto place to put any code that relates
to the RMM's context. It is frequently updated and contains the vast
majority of code. manage_extensions_realm() on the other hand is out of
date and obscure.

So absorb manage_extensions_realm() and rmm_el2_context_init() into
setup_realm_context().

We can also combine the write to sctlr_el2 for all worlds as they should
all observe the RES1 values.

Finally, the SPSR_EL2.PAN comment in the realm copy is updated.

Change-Id: I21dccad0c13301e3249db6f6e292beb5d853563e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...