Merge changes from topics "qemu-sve", "xl/simd-hash" into integration

* changes:
feat(qemu): disable fpregs traps for QEMU in BL31
feat(crypto): enable the runtime instrumentation for crypto ext

Merge changes from topics "qemu-sve", "xl/simd-hash" into integration

* changes:
feat(qemu): disable fpregs traps for QEMU in BL31
feat(crypto): enable the runtime instrumentation for crypto extension
feat(crypto): enable access to SIMD crypto in BL1 and BL2
feat(crypto): enable floating point register traps in EL3
feat(crypto): build flag for SIMD crypto extensions for v8+ platform
refactor(build): add a default filter list for lib cflags

show more ...

Merge "fix(cpus): workaround for Cortex-A65AE erratum 1638571" into integration

fix(cpus): workaround for Cortex-A65AE erratum 1638571

Cortex-A65AE erratum 1638571 is a Cat B erratum that applies
to revisions r0p0, r1p0, r1p1, and is still open.

This erratum can be avoided by

fix(cpus): workaround for Cortex-A65AE erratum 1638571

Cortex-A65AE erratum 1638571 is a Cat B erratum that applies
to revisions r0p0, r1p0, r1p1, and is still open.

This erratum can be avoided by disable stage1 page table walk for
lower Els (EL1 and EL0) in EL3, so 'AT' speculative fetch at any
point produces either the correct result or failure without TLB
allocation.

SDEN documentation:
https://developer.arm.com/documentation/SDEN1344564/latest

Change-Id: I861230de94a105fd52f9c8ef7e7551a2633c065b
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

feat(crypto): enable floating point register traps in EL3

To prevent the leakage of EL3 information to lower ELs, access to
floating point registers needed to be traped to EL3 unless necessary
(e.g

feat(crypto): enable floating point register traps in EL3

To prevent the leakage of EL3 information to lower ELs, access to
floating point registers needed to be traped to EL3 unless necessary
(e.g the SIMD crypto extension, SIMD context save/restore).

Change-Id: I28a734c43d3e965de87ccc08e99f86669729871f
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

fix(cpus): remove C1-Premium erratum 3651221

This erratum workaround is already implemented as part
of CVE-2024-7881 [1] and is redundant. This patch removes
C1-Premium erratum 3651221 [2] support.

fix(cpus): remove C1-Premium erratum 3651221

This erratum workaround is already implemented as part
of CVE-2024-7881 [1] and is redundant. This patch removes
C1-Premium erratum 3651221 [2] support.

[1] : https://developer.arm.com/documentation/110326/latest/
[2] : https://developer.arm.com/documentation/111078/latest/
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I40b37ec62788884ae5c0a0bb3eb4b924622ffe55

show more ...

fix(cpus): remove C1-Ultra erratum 3651221

This erratum workaround is already implemented as part
of CVE-2024-7881 [1] and is redundant. This patch removes
C1-Ultra erratum 3651221 [2] support.

[1]

fix(cpus): remove C1-Ultra erratum 3651221

This erratum workaround is already implemented as part
of CVE-2024-7881 [1] and is redundant. This patch removes
C1-Ultra erratum 3651221 [2] support.

[1] : https://developer.arm.com/documentation/110326/latest/
[2] : https://developer.arm.com/documentation/111077/latest/
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: If7ea433e4614f92333e788e3f6b366db22c92f0d

show more ...

fix(cpus): correct CVE-2024-7881 workaround and drop duplicate erratum

Fix the CVE-2024-7881 [1] workaround for C1-Pro. The previously
implemented erratum 3684268 [2] programmed the same control bit

fix(cpus): correct CVE-2024-7881 workaround and drop duplicate erratum

Fix the CVE-2024-7881 [1] workaround for C1-Pro. The previously
implemented erratum 3684268 [2] programmed the same control bit and
overlapped functionally with the CVE workaround, so the duplicate
erratum is removed.

Reference:
[1] https://developer.arm.com/documentation/110326/latest/
[2] https://developer.arm.com/documentation/SDEN-3273080/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I6207c49486e4020f34c862ad40ec3137bd3684cc

show more ...

fix(build): fix BL2_CPPFLAGS when ENABLE_RME is set

Add IMAGE_AT_EL3 to BL2_CPPFLAGS as BL2 runs at EL3 when ENABLE_RME is
set. And use IMAGE_AT_EL3 for misc_helpers.S that is common for all BLs.

T

fix(build): fix BL2_CPPFLAGS when ENABLE_RME is set

Add IMAGE_AT_EL3 to BL2_CPPFLAGS as BL2 runs at EL3 when ENABLE_RME is
set. And use IMAGE_AT_EL3 for misc_helpers.S that is common for all BLs.

This fix enables cpu_reset ops in CPU libs when RME is enabled.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I9d30b6f900a5fed1993b1c09156830290203ed33

show more ...

fix(security): add CVE-2025-0647 for C1-Premium

This patch mitigates CVE-2025-0647 for C1-Premium CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: Iec

fix(security): add CVE-2025-0647 for C1-Premium

This patch mitigates CVE-2025-0647 for C1-Premium CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: Iec070b6e2a73c6218d150e32149b25ba4c94ea3a
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(security): add CVE-2025-0647 for C1-Ultra

This patch mitigates CVE-2025-0647 for C1-Ultra CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I506007

fix(security): add CVE-2025-0647 for C1-Ultra

This patch mitigates CVE-2025-0647 for C1-Ultra CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I506007ec8702b183e377be50eede72d6803b344b
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(security): add CVE-2025-0647 for Neoverse-V3

This patch mitigates CVE-2025-0647 for Neoverse-V3 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I

fix(security): add CVE-2025-0647 for Neoverse-V3

This patch mitigates CVE-2025-0647 for Neoverse-V3 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: Ic52ad93474c5f81e01eb4839ece726c84c3348ff
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(security): add CVE-2025-0647 for Neoverse-V2

This patch mitigates CVE-2025-0647 for Neoverse-V2 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I

fix(security): add CVE-2025-0647 for Neoverse-V2

This patch mitigates CVE-2025-0647 for Neoverse-V2 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I7ec215a9dd168eb045366b589a02b54148f587c2
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(security): add CVE-2025-0647 for Neoverse-N2

This patch mitigates CVE-2025-0647 for Neoverse-N2 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I

fix(security): add CVE-2025-0647 for Neoverse-N2

This patch mitigates CVE-2025-0647 for Neoverse-N2 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I366c2683cca22403d33f0761487e1ffa62e964ce
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(security): add CVE-2025-0647 for Cortex-X925

This patch mitigates CVE-2025-0647 for Cortex-X925 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I

fix(security): add CVE-2025-0647 for Cortex-X925

This patch mitigates CVE-2025-0647 for Cortex-X925 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I4c1ac2be3620566813c90f5815ffcc7205bb5ac9
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(security): add CVE-2025-0647 for Cortex-X4

This patch mitigates CVE-2025-0647 for Cortex-X4 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I585a

fix(security): add CVE-2025-0647 for Cortex-X4

This patch mitigates CVE-2025-0647 for Cortex-X4 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I585a7ea516515fe16a3eca907695728068cef611
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(security): add CVE-2025-0647 for Cortex-X3

This patch mitigates CVE-2025-0647 for Cortex-X3 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: Ic276

fix(security): add CVE-2025-0647 for Cortex-X3

This patch mitigates CVE-2025-0647 for Cortex-X3 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: Ic276befafc1ca0b456826532437ca453eb7717a6
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(security): add CVE-2025-0647 for Cortex-X2

This patch mitigates CVE-2025-0647 for Cortex-X2 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: Idba6

fix(security): add CVE-2025-0647 for Cortex-X2

This patch mitigates CVE-2025-0647 for Cortex-X2 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: Idba607340d944a6387759c856e8eacc967e0ec06
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(security): add CVE-2025-0647 for Cortex-A710

This patch mitigates CVE-2025-0647 for Cortex-A710 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I

fix(security): add CVE-2025-0647 for Cortex-A710

This patch mitigates CVE-2025-0647 for Cortex-A710 CPU.

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I522dedfffd3108f7a94df1ce2cabd742ce682334
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(security): add workaround for CVE-2025-0647

This workaround fixes an issue with the CPP RCTX instruction by
issuing an instruction patch sequence to trap uses of the CPP RCTX
instruction from EL

fix(security): add workaround for CVE-2025-0647

This workaround fixes an issue with the CPP RCTX instruction by
issuing an instruction patch sequence to trap uses of the CPP RCTX
instruction from EL0, EL1, and EL2 to EL3 and perform a workaround
procedure using the implementation defined trap handler to ensure
the correct behavior of the system. In addition, it includes an EL3
API to be used if EL3 firmware needs to use the CPP RCTX instruction.
This saves the overhead of exception handling, and EL3 does not
generically support trapping EL3->EL3, and adding support for that
is not trivial due to the implications for context management.

The issue affects the following CPUs:

C1-Premium
C1-Ultra
Cortex-A710
Cortex-X2
Cortex-X3
Cortex-X4
Cortex-X925
Neoverse N2
Neoverse V2
Neoverse V3
Neoverse V3AE (handled same as V3 CPU in TF-A CPU-Lib)

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I5e7589afbeb69ebb79c01bec80e29f572aff3d89
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

Merge changes I2485d583,I1374c482,I07e29dbb,I949e6486 into integration

* changes:
feat(qemu): enable ENABLE_FEAT_RAS and ENABLE_FEAT_SB
feat(cpufeat): update FEAT_SB's FEAT_STATE_CHECKED status

Merge changes I2485d583,I1374c482,I07e29dbb,I949e6486 into integration

* changes:
feat(qemu): enable ENABLE_FEAT_RAS and ENABLE_FEAT_SB
feat(cpufeat): update FEAT_SB's FEAT_STATE_CHECKED status
feat(cpufeat): advertise support for FEAT_RASv2
feat(cpufeat): enable FEAT_RAS for FEAT_STATE_CHECKED again

show more ...

Merge changes from topic "xl/c1-workaround-fix" into integration

* changes:
fix(cpus): fix the ordering of errata for C1 Premium
fix(cpus): fix the ordering of errata for C1 Ultra

fix(cpus): fix the ordering of errata for C1 Premium

Reorder the errata to comply with the convention.

Change-Id: Ifd1c73224060c1c2e94c5f7978e9dc79e0229bd4
Signed-off-by: Xialin Liu <xialin.liu@arm

fix(cpus): fix the ordering of errata for C1 Premium

Reorder the errata to comply with the convention.

Change-Id: Ifd1c73224060c1c2e94c5f7978e9dc79e0229bd4
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

fix(cpus): fix the ordering of errata for C1 Ultra

The CVE workaround is placed before errata workaround,
fix it to comply with the convention.

Change-Id: I6482ce4015541c64d9ac0d9c9df2e84d0c9eaae0

fix(cpus): fix the ordering of errata for C1 Ultra

The CVE workaround is placed before errata workaround,
fix it to comply with the convention.

Change-Id: I6482ce4015541c64d9ac0d9c9df2e84d0c9eaae0
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

Merge "refactor(psci): make CMOs target the whole psci_cpu_data_t" into integration

Merge "fix(cpufeat): give `stxr` distinct src and ret registers" into integration