Merge changes from topic "hm/dfs" into integration

* changes:
fix(debugfs): return negative value on error
fix(debugfs): guard against negative ch offsets

fix(debugfs): return negative value on error

The current implementation of buf_to_channel() returns 0 even on invalid
input, making it difficult for callers to distinguish between an error
and a suc

fix(debugfs): return negative value on error

The current implementation of buf_to_channel() returns 0 even on invalid
input, making it difficult for callers to distinguish between an error
and a successful zero-byte transfer.

Change the return behavior to return -1 for error conditions.

Change-Id: Id57d7fd9365f5961a72ba7633dbedd701740e7c4
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(debugfs): guard against negative ch offsets

The `chan` struct’s `offset` field was previously a signed long,
allowing negative values. When used in comparisons in `buf_to_channel`,
a negative of

fix(debugfs): guard against negative ch offsets

The `chan` struct’s `offset` field was previously a signed long,
allowing negative values. When used in comparisons in `buf_to_channel`,
a negative offset would be cast to a large unsigned integer, causing the
bounds check to silently fail. This could allow a negative offset to
bypass validation and lead to an out-of-bounds access during operations
like `memcpy`.

This patch changes the `offset` field to `unsigned long` and updates
affected functions to use the correct types, ensuring all offset
comparisons are safe and negative values are disallowed at the type
level.

Change-Id: I5d37bbd2fe6d7d3a19628c1a0376c3bf83947f27
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>
Reported-by: Bartek Piekarski <bartek.piekarski@arm.com>

show more ...

refactor(el3-runtime): streamline cpu_data assembly offsets using the cpu_ops template

The cpu_data structure, just like cpu_ops, is collection of disparate
data that must be accessible from both C

refactor(el3-runtime): streamline cpu_data assembly offsets using the cpu_ops template

The cpu_data structure, just like cpu_ops, is collection of disparate
data that must be accessible from both C and assembly. Achieving this is
tricky as there is no way to export structure offsets from C directly so
they must be manually recreated with `#define`s and asserts. However,
the cpu_data structure is quite old and the assembly offsets are a
patchwork of additions and extremely difficult to reason with and
modify. In fact, certain currently unused builds with
ENABLE_RUNTIME_INSTRUMENTATION=1 fail to build.

To untangle this, convert the assembly offsets to the pattern used for
the cpu_ops structure. That is, first define the sizes of every member,
as generically as possible, and then chain their offsets one after the
other. To make sure this is always correct, add a CASSERT for the offset
of every member. This makes it easy to modify the structure and fixes
the build failures.

Change-Id: I61aeb55e9c494896663a3c719c10e3c072f56349
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(el3-runtime): move context security states to context.h

The three security states (S, NS, RL) are architecturally quite
consistent - anything that uses them has the same numerical assignmen

refactor(el3-runtime): move context security states to context.h

The three security states (S, NS, RL) are architecturally quite
consistent - anything that uses them has the same numerical assignments
(0, 1, 2) and they are quite convenient for indexing. However, we're not
as consistent in tf-a and this is defined in a few places. Since
cpu_data has a dependency on the context management library, use its
security state convention in a few more places and take away this
responsibility from cpu_data.

Change-Id: Iec73b2be2eef91975554767557de72424d0031f1
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cpus): workaround for Cortex-A510 erratum 3704847

Cortex-A510 erratum 3704847 is a Cat B erratum that applies to
revisions r0p0, r0p1, r0p2, r0p3, r1p0, r1p1, r1p2 and r1p3, and
is still open.

fix(cpus): workaround for Cortex-A510 erratum 3704847

Cortex-A510 erratum 3704847 is a Cat B erratum that applies to
revisions r0p0, r0p1, r0p2, r0p3, r1p0, r1p1, r1p2 and r1p3, and
is still open.

The workaround is to set bit 9 in CPUACTLR_EL1.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1873361/latest/

Change-Id: I2c7c8da9c66471115b5bf8fb5c87d4de46ca265c
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-A510 erratum 3672349

Cortex-A510 erratum 3672349 is a Cat B erratum that applies to
revisions r0p0, r0p1, r0p2, r0p3, r1p0, r1p1, r1p2 and r1p3, and
is still open.

fix(cpus): workaround for Cortex-A510 erratum 3672349

Cortex-A510 erratum 3672349 is a Cat B erratum that applies to
revisions r0p0, r0p1, r0p2, r0p3, r1p0, r1p1, r1p2 and r1p3, and
is still open.

The workaround is to clear the WFE_RET_CTRL and WFI_RET_CTRL fields
in CPUPWRCTLR_EL1 to disable full retention.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1873361/latest/

Change-Id: I9786ab8843a2eab45e650c6af50b6933481527ec
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-A510 erratum 2420992

Cortex-A510 erratum 2420992 is a Cat B erratum that applies only to
revisions r1p0 and r1p1, and is fixed in r1p1.

The workaround is to set bit

fix(cpus): workaround for Cortex-A510 erratum 2420992

Cortex-A510 erratum 2420992 is a Cat B erratum that applies only to
revisions r1p0 and r1p1, and is fixed in r1p1.

The workaround is to set bit 3 in CPUACTLR3_EL1 which will have no
performance impact, but will increase power consumption by 0.3-0.5%.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1873361/latest/

Change-Id: Ia76ba2431d76f14c08b95a998806986190d682c3
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-A510 erratum 2218134

Cortex-A510 erratum 2218134 is a Cat B erratum that applies only to
revision r1p0 and is fixed in r1p1.

The workaround is to set bit 43 in CPUA

fix(cpus): workaround for Cortex-A510 erratum 2218134

Cortex-A510 erratum 2218134 is a Cat B erratum that applies only to
revision r1p0 and is fixed in r1p1.

The workaround is to set bit 43 in CPUACTLR2_EL1 which will correct
the instruction fetch stream with no performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1873361/latest/

Change-Id: Ifec40dee2f7e42c56c9ed447b6b1997b170f9453
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-A510 erratum 2169012

Cortex-A510 erratum 2169012 is a Cat B erratum that applies to
revisions r0p0, r0p1, r0p2, r0p3 and r1p0, and is fixed in r1p1.

This erratum ha

fix(cpus): workaround for Cortex-A510 erratum 2169012

Cortex-A510 erratum 2169012 is a Cat B erratum that applies to
revisions r0p0, r0p1, r0p2, r0p3 and r1p0, and is fixed in r1p1.

This erratum has an identical workaround to 1922240 and resolves
a similar issue, but that erratum only applies to r0p0 which is
not used in any production hardware, so it has been removed.

This workaround has a negligible performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1873361/latest/

Change-Id: Ifdd59c09e84252dc292600630d81d32986fd6c0c
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-A510 erratum 2008766

Cortex-A510 erratum 2008766 is a Cat B erratum that applies to
revisions r0p0, r0p1, r0p2, r0p3, r1p0, r1p1, r1p2 and r1p3, and
is still open.

fix(cpus): workaround for Cortex-A510 erratum 2008766

Cortex-A510 erratum 2008766 is a Cat B erratum that applies to
revisions r0p0, r0p1, r0p2, r0p3, r1p0, r1p1, r1p2 and r1p3, and
is still open.

The workaround is to clear the ERXCTLR_EL1.ED bit before power
down, which will cause any detected errors during power down to
be ignored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1873361/latest/

Change-Id: Id1aa0f2c518a055363c962f9abdb27e1ee8bff18
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(tc): fix c1_pro power down abandon

Following merge of [1] and [2] the fix to power down abandon for Arm
C1-Pro core got lost. Restore it.

[1] https://review.trustedfirmware.org/c/TF-A/trusted-f

fix(tc): fix c1_pro power down abandon

Following merge of [1] and [2] the fix to power down abandon for Arm
C1-Pro core got lost. Restore it.

[1] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/43191
[2] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/42920

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I7da12e5ffc61248922adaf629eb52a5283993188

show more ...

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view availa

fix(cm): deprecate use of NS_TIMER_SWITCH

On AArch64, secure world has it's own EL3 physical timer registers
accessible to secure EL1 in absence of S-EL2. With S-EL2 there is
virtualized view available for EL1 timer registers. So it is
unreasonable for secure world to use non-secure EL1 physical timer
registers. Moreover, the non-secure operating system (Linux in our case)
relies heavily on these EL1 physical timer registers for scheduling
decisions. If NS_TIMER_SWITCH is enabled, it simply breaks the preemption
model of the non-secure world by disabling non-secure timer interrupts
leading to RCU stalls being observed on long running secure world tasks.

The only arch timer register which will benefit from context management
is cntkctl_el1: Counter-timer Kernel Control Register. This enables the
secure and non-secure worlds to independently control accesses to EL0
for counter-timer registers. This is something that OP-TEE uses to
enable ftrace feature for Trusted Applications and SPM_MM uses for EL0
access as well.

Lets enable context management of cntkctl_el1 by default and deprecate
conditional context management of non-secure EL1 physical timer
registers for whom there isn't any upstream user. With that deprecate
this NS_TIMER_SWITCH build option which just adds confusion for the
platform maintainers. It will be eventually dropped following
deprecation policy of TF-A.

Reported-by: Stauffer Thomas MTANA <thomas.stauffer@mt.com>
Reported-by: Andrew Davis <afd@ti.com>
Change-Id: Ifb3a919dc0bf8c05c38895352de5fe94b4f4387e
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

show more ...

chore(tc): align core names to Arm Lumex

Adopt core names aligned to Arm Lumex [1]

Nevis => C1-Nano
Gelas => C1-Pro
Travis => C1-Ultra
Alto => C1-Premium

C1-Pro TRM: https://developer.arm.com/docu

chore(tc): align core names to Arm Lumex

Adopt core names aligned to Arm Lumex [1]

Nevis => C1-Nano
Gelas => C1-Pro
Travis => C1-Ultra
Alto => C1-Premium

C1-Pro TRM: https://developer.arm.com/documentation/107771/0102/
C1-Ultra TRM: https://developer.arm.com/documentation/108014/0100/
C1-Premium TRM: https://developer.arm.com/documentation/109416/0100/
C1-Nano TRM: https://developer.arm.com/documentation/107753/0001/

[1]:
https://www.arm.com/product-filter?families=c1%20cpus
https://www.arm.com/products/mobile/compute-subsystems/lumex

Signed-off-by: Min Yao Ng <minyao.ng@arm.com>
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Id4b487ef6a6fd1b00b75b09c5d06d81bce50a15d
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

Merge "feat(cpus): add pabandon support to Nevis" into integration

feat(cpus): add pabandon support to Nevis

Nevis' TRM says that a powerdown attempt may be abandoned for a handful
of reasons. Add support for handling this.

It also says that if the SME2 engine is

feat(cpus): add pabandon support to Nevis

Nevis' TRM says that a powerdown attempt may be abandoned for a handful
of reasons. Add support for handling this.

It also says that if the SME2 engine is not properly disconnected, then
a powerdown request will be rejected. Require ERRATA_SME_POWER_DOWN be
set to avoid this.

Just like Gelas/Travis, the 11.28 model doesn't reset the bit, so a
workaround is necessary.

Change-Id: I0d5de1b0e772f6b4d656e841fb4bcf8fd859f293
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "feat(cpus): fix external LLC presence bit in Neoverse N3" into integration

Merge "fix(cpufeat): configure CPTR_EL2.ZEN and CPTR_EL2.TZ to match Linux" into integration

feat(cpus): fix external LLC presence bit in Neoverse N3

Unlike Neoverse N2, Neoverse N3 incorporates the External LLC presence
bit in CPUECTLR2_EL1.SW_EXT_LLC. In addition, the default value is
ext

feat(cpus): fix external LLC presence bit in Neoverse N3

Unlike Neoverse N2, Neoverse N3 incorporates the External LLC presence
bit in CPUECTLR2_EL1.SW_EXT_LLC. In addition, the default value is
external LLC in Neoverse N3, so the bit will be cleared when
NEOVERSE_Nx_EXTERNAL_LLC is not enabled.

Change-Id: I1182aba5423e74748efd2571cc3817634ada748d
Signed-off-by: Younghyun Park <younghyunpark@google.com>

show more ...

build(measured-boot)!: move to ext event log lib

Removes in-tree Event Log library implementation and updates all
references to use the external submodule. Updates include paths,
Makefile macros, an

build(measured-boot)!: move to ext event log lib

Removes in-tree Event Log library implementation and updates all
references to use the external submodule. Updates include paths,
Makefile macros, and platform integration logic to link with lib as a
static library.

If you cloned TF-A without the `--recurse-submodules` flag, you can
ensure that this submodule is present by running:

git submodule update --init --recursive

BREAKING-CHANGE: LibEventLog is now included in TF-A as a submodule.
Please run `git submodule update --init --recursive` if you encounter
issues after migrating to the latest version of TF-A.

Change-Id: I723f493033c178759a45ea04118e7cc295dc2438
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge "fix(debugfs): set debugfs smc start to vendor EL3" into integration

Merge changes from topic "sbsa2" into integration

* changes:
feat(qemu): skip paged image info
feat(optee): check paged image size
feat(qemu-sbsa): support s-el2 and s-el1 spmc

Merge changes from topic "bk/no_blx_setup" into integration

* changes:
fix: replace stray BL2_AT_EL3 with RESET_TO_BL2
refactor(aarch64): move BL31 specific setup out of the PSCI entrypoint
re

Merge changes from topic "bk/no_blx_setup" into integration

* changes:
fix: replace stray BL2_AT_EL3 with RESET_TO_BL2
refactor(aarch64): move BL31 specific setup out of the PSCI entrypoint
refactor: unify blx_setup() and blx_main()
fix(bl2): unify the BL2 EL3 and RME entrypoints

show more ...

feat(optee): check paged image size

The base and size of the paged image is passed in arg1 and arg2. If the
image size is 0 it's unnecessary to pass an unused image base, so check
the size before up

feat(optee): check paged image size

The base and size of the paged image is passed in arg1 and arg2. If the
image size is 0 it's unnecessary to pass an unused image base, so check
the size before updating arg1 and arg2.

Change-Id: Iebf621cc1a86a99d9128ddfbc327285cf8cf771c
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

fix(cpufeat): configure CPTR_EL2.ZEN and CPTR_EL2.TZ to match Linux

Linux Documentation/arch/arm64/booting.rst states that:
"
For CPUs with the Scalable Vector Extension (FEAT_SVE) present:
...
-

fix(cpufeat): configure CPTR_EL2.ZEN and CPTR_EL2.TZ to match Linux

Linux Documentation/arch/arm64/booting.rst states that:
"
For CPUs with the Scalable Vector Extension (FEAT_SVE) present:
...
- If the kernel is entered at EL1 and EL2 is present:
- CPTR_EL2.TZ (bit 8) must be initialised to 0b0.
- CPTR_EL2.ZEN (bits 17:16) must be initialised to 0b11.
"
Without these settings, Linux kernel hangs on boot when trying
to use SVE. Adjust the register settings to match Linux kernel
expectations.

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Change-Id: I9a72810dd902b08f9c61f157cc31e603aad2f73a

show more ...