fix(cpus): workaround for Cortex-X2 erratum 1934260

Cortex-X2 erratum 1934260 is a Cat B erratum that applies only
to revision r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[25:18

fix(cpus): workaround for Cortex-X2 erratum 1934260

Cortex-X2 erratum 1934260 is a Cat B erratum that applies only
to revision r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[25:18] to 0xFF. This
workaround will result in reduced performance for workloads
that benefit from write streaming.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: I180d38fee27175dc8ac5fa6726e5b71c3340285f
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-X2 erratum 1927200

Cortex-X2 erratum 1927200 is a Cat B erratum that applies to
revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to use instruction p

fix(cpus): workaround for Cortex-X2 erratum 1927200

Cortex-X2 erratum 1927200 is a Cat B erratum that applies to
revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to use instruction patching to insert a DMB ST
before acquire atomic instructions without release semantics.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: I8d9038df1907888b3c5b2520d06bc150665e74a1
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-X2 erratum 1917258

Cortex-X2 erratum 1917258 is a Cat B erratum that applies to
revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1

fix(cpus): workaround for Cortex-X2 erratum 1917258

Cortex-X2 erratum 1917258 is a Cat B erratum that applies to
revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[43]. This has no
performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: Ic18a5179856f861701f09b2556906a6722db8150
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-X2 erratum 1916945

Cortex-X2 erratum 1916945 is a Cat B erratum that applies to
revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[

fix(cpus): workaround for Cortex-X2 erratum 1916945

Cortex-X2 erratum 1916945 is a Cat B erratum that applies to
revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[8]. This has a small
performance impact (<0.5%).

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: If810b1d0a07c43b3e1aa70d2ec88c1dcfa6f735f
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): workaround for Cortex-X2 erratum 1901946

Cortex-X2 erratum 1901946 is a Cat B erratum that applies to
revision r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[15]. This

fix(cpus): workaround for Cortex-X2 erratum 1901946

Cortex-X2 erratum 1901946 is a Cat B erratum that applies to
revision r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[15]. This has a small
performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: I5a65db60f06982191994db49815419c4d72506cf
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

fix(cpus): put back the global declaration for erratum #3701747

Patch 89dba82df accidentally removed it. Put it back.

Change-Id: Ic7a5a13ae89b0b86ccbea56fecfe12bef57a90b9
Signed-off-by: Boyan Karat

fix(cpus): put back the global declaration for erratum #3701747

Patch 89dba82df accidentally removed it. Put it back.

Change-Id: Ic7a5a13ae89b0b86ccbea56fecfe12bef57a90b9
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes from topic "hm/handoff-cot" into integration

* changes:
docs(fconf): streamline TB_FW_CONFIG bindings
refactor(fconf): use macro to set image info

feat(cpufeat): do feature detection on secondary cores too

Feature detection currently only happens on the boot core, however, it
is possible to have asymmetry between cores. TF-A supports limited s

feat(cpufeat): do feature detection on secondary cores too

Feature detection currently only happens on the boot core, however, it
is possible to have asymmetry between cores. TF-A supports limited such
configurations so it should check secondary cores too.

Change-Id: Iee4955714685be9ae6a017af4a6c284e835ff299
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that

Merge changes from topic "bk/pabandon_cleanup" into integration

* changes:
feat(cpus): add pabandon support to the Alto cpu
feat(psci): optimise clock init on a pabandon
feat(psci): check that CPUs handled a pabandon
feat(psci): make pabandon support generic
refactor(psci): unify coherency exit between AArch64 and AArch32
refactor(psci): absorb psci_power_down_wfi() into common code
refactor(platforms): remove usage of psci_power_down_wfi
fix(cm): disable SPE/TRBE correctly

show more ...

Merge changes from topic "ffa_mem_perm_get_update" into integration

* changes:
feat(spm): update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface
feat(el3-spmc): update FFA_MEM_PERM_GET interface

feat(cpus): add pabandon support to the Alto cpu

Alto supports powerdown abandon. That support has flown under the radar
so add it in the same way as other pabandon CPUs.

Change-Id: I15f9e8cd77bf5a

feat(cpus): add pabandon support to the Alto cpu

Alto supports powerdown abandon. That support has flown under the radar
so add it in the same way as other pabandon CPUs.

Change-Id: I15f9e8cd77bf5aa23df8e548eb3d35d5c1f4eb2d
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): optimise clock init on a pabandon

When a powerdown abandon happens, all state will be preserved. As such,
there is no need to re-initialise the timer counter when unwinding.

Change-Id:

feat(psci): optimise clock init on a pabandon

When a powerdown abandon happens, all state will be preserved. As such,
there is no need to re-initialise the timer counter when unwinding.

Change-Id: I64185792a118fd04ca036abbb9be8f670d0d8328
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this i

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this is indeed the case. The chosen method is with a return value
that is highly unlikely on cores that are unaware of pabandon (x0 will
be primed with 1 and if used should be overwritten with the value of
CPUPWRCTLR_EL1 which should have its last bit set to power off and its
top bits RES0; the ACK value is chosen to be the exact opposite). An
alternative method would have been to add a field in cpu_ops, however
that would have required more major refactoring across many cpus and
would have taken up more memory on older platforms, so it was not
chosen.

Change-Id: I5826c0e4802e104d295c4ecbd80b5f676d2cd871
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): unify coherency exit between AArch64 and AArch32

The procedure is fairly simple: if we have hardware assisted coherency,
call into the cpu driver and let it do its thing. If we don't

refactor(psci): unify coherency exit between AArch64 and AArch32

The procedure is fairly simple: if we have hardware assisted coherency,
call into the cpu driver and let it do its thing. If we don't, then we
must turn data caches off, handle the confusion that causes with the
stack, and call into the cpu driver which will flush the caches that
need flushing.

On AArch32 the above happens in common code. On AArch64, however, the
turning off of the caches happens in the cpu driver. Since we're dealing
with the stack, we must exercise control over it and implement this in
assembly. But as the two implementations are nominally different (in the
ordering of operations), the part that is in assembly is quite large as
jumping back to C to handle the difference might involve the stack.

Presumably, the AArch difference was introduced in order to cater for a
possible implementation where turning off the caches requires an IMP DEF
sequence. Well, Arm no longer makes cores without hardware assisted
coherency, so this eventually is not possible.

So take this part out of the cpu driver and put it into common code,
just like in AArch32. With this, there is no longer a need call
prepare_cpu_pwr_dwn() in a different order either - we can delay it a
bit to happen after the stack management. So the two AArch-s flows
become identical. We can convert prepare_cpu_pwr_dwn() to C and leave
psci_do_pwrdown_cache_maintenance() only to exercise control over stack.

Change-Id: Ie4759ebe20bb74b60533c6a47dbc2b101875900f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called f

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called from
non-PSCI code as PSCI is smart enough to handle this after platform
hooks. So absorb the functions into common code.

This allows for a tiny bit of optimisation: there will be no branch
(that can be missed or non-cached) to a non-inlineable function. Then in
the terminal case we can call wfi() directly with the application of the
erratum before the loop. And finally in the wakeup case, we don't have
to explicitly clear the errata as that will happen automatically on the
second call of prepare_cpu_pwr_dwn().

The A510 erratum requires a tsb csync before the dsb+wfi combo to turn
the core off. We can do this a little bit earlier in the cpu hook and
relieve common code from the responsibility. EL3 is always a prohibited
region so the buffer will stay empty.

Change-Id: I5f950df3fb7b0736df4ce25a21f78b29896de215
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cm): disable SPE/TRBE correctly

SPE and TRBE are unusual features. They have multi-bit enables whose
function is not immediately apparent and disabling them is not
straightforward.

While attemp

fix(cm): disable SPE/TRBE correctly

SPE and TRBE are unusual features. They have multi-bit enables whose
function is not immediately apparent and disabling them is not
straightforward.

While attempting to figure this out, the disables were made a mess of.
Patch fc7dca72b began changing the owning security state of SPE and
TRBE. This was first used in patch 79c0c7fac0 with calls to
spe_disable() and trbe_disbale(). However, patch 13f4a2525 reverted the
security state ownership, making the spe_disable() and trbe_disable()
redundant and their comments incorrect - the DoS protection is achieved
by the psb/tsb barriers on context switch, introduces separately in
f80887337 and 73d98e375.

Those patches got the behaviour full circle to what it was in fc7dca72b
so the disables can be fully removed for clarity.

However, the original method for disabling these features is not fully
correct - letting the "disabled" state be all zeroes made the features
seem enabled for secure world but they would trap. That is not a problem
while secure world doesn't use them, but could lead to some confusing
debugging in the future. NS and Realm worlds were not affected. This
patch fully establishes the pattern for SPE and TRBE's enablement,
documents it, and implements it such.

The description comments in the features boil down to 2 rules. There is
a third rule possible:
3. To enable TRBE/SPE for world X with a dirty buffer:
* world X owns the buffer
* trapping enabled
This is not listed as it would not work correctly with
SMCCC_ARCH_FEATURE_AVAILABILITY which relies on trapping to be disabled
to report correctly. If that is ever implemented, the SMCCC
implementation should be considered too.

Change-Id: I5588a3d5fc074c2445470954d8c3b172bec77d43
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(cm): unify RMM context

setup_realm_context() is the de facto place to put any code that relates
to the RMM's context. It is frequently updated and contains the vast
majority of code. manage

refactor(cm): unify RMM context

setup_realm_context() is the de facto place to put any code that relates
to the RMM's context. It is frequently updated and contains the vast
majority of code. manage_extensions_realm() on the other hand is out of
date and obscure.

So absorb manage_extensions_realm() and rmm_el2_context_init() into
setup_realm_context().

We can also combine the write to sctlr_el2 for all worlds as they should
all observe the RES1 values.

Finally, the SPSR_EL2.PAN comment in the realm copy is updated.

Change-Id: I21dccad0c13301e3249db6f6e292beb5d853563e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cpus): check minor revision before applying runtime errata

Patch db9ee83432 removed cpu_rev checking for runtime errata
within cpu functions with the argument that if we're in the cpu file,
we'v

fix(cpus): check minor revision before applying runtime errata

Patch db9ee83432 removed cpu_rev checking for runtime errata
within cpu functions with the argument that if we're in the cpu file,
we've already check the MIDR and matched against the CPU. However, that
also removes the revision check which being in the cpu file does not
guarantee. Reintroduce the MIDR checking so that the revision check
happens and errata can be skipped if they don't apply.

Change-Id: I46b2ba8b524a073e02b4b5de641ae97795bc176b
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page_count
to set search range and get the range having the same
permission from base_va.

This change is backward compatible with former FF-A v1.2 interface.

Links: https://developer.arm.com/documentation/den0140/latest/
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Change-Id: I5c9679c9da1126b1df65f22a803776029ab52b12

show more ...

feat(libc): add __2snprintf alias for armclang-specific name mangling

The Arm Compiler (armclang) toolchain replaces standard library calls
like `snprintf` with renamed versions such as `__2snprintf

feat(libc): add __2snprintf alias for armclang-specific name mangling

The Arm Compiler (armclang) toolchain replaces standard library calls
like `snprintf` with renamed versions such as `__2snprintf` in
generated object files and binaries. This name mangling is part of
armclang’s internal handling of standard functions and can lead to
undefined reference errors if these symbols are not defined.

To resolve this, this patch introduces a new assembly stub for
`__2snprintf` in AArch64-specific implementation.
This stub is a minimal alias that branch directly to the
underlying `snprintf` implementation. This mirrors the existing
solution for `__0printf`, `__1printf`, and `__2printf` aliases that
redirect to `printf`.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Id64d490fc3ff19ae619af03279f30338e8aa8bba

show more ...

fix(cpus): workaround for Cortex-X3 erratum 3213672

Cortex-X3 erratum 3213672 is a Cat B erratum that applies to
r0p0, r1p0, r1p1 and r1p2. It is still open.

This erratum can be worked around by se

fix(cpus): workaround for Cortex-X3 erratum 3213672

Cortex-X3 erratum 3213672 is a Cat B erratum that applies to
r0p0, r1p0, r1p1 and r1p2. It is still open.

This erratum can be worked around by setting CPUACTLR_EL1[36]
before enabling icache.

SDEN Documentation:
https://developer.arm.com/documentation/SDEN-2055130/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Ia1c03217f4e1816b4e8754a090cf5bc17546be40

show more ...

fix(cpus): workaround for Cortex-X3 erratum 3827463

Cortex-X3 erratum 3827463 is a Cat B erratum that applies to
r0p0, r1p0 and r1p1. It is fixed in r1p2.

This erratum can be avoided by setting CPU

fix(cpus): workaround for Cortex-X3 erratum 3827463

Cortex-X3 erratum 3827463 is a Cat B erratum that applies to
r0p0, r1p0 and r1p1. It is fixed in r1p2.

This erratum can be avoided by setting CPUACTLR_EL1[1]
prior to enabling MMU. This bit will disable a branch predictor
power savings feature. Disabling this power feature
results in negligible power movement and no performance impact.

SDEN Documentation:
https://developer.arm.com/documentation/SDEN-2055130/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I1d4a2b9641400d8b9061f7cb32a8312c3995613e

show more ...

fix(cpus): workaround for Cortex-X3 erratum 3692984

Cortex-X3 erratum 3692984 is a Cat B erratum that applies to
r0p0, r1p0, r1p1 and r1p2 and is still open.

The erratum can be avoided by disabling

fix(cpus): workaround for Cortex-X3 erratum 3692984

Cortex-X3 erratum 3692984 is a Cat B erratum that applies to
r0p0, r1p0, r1p1 and r1p2 and is still open.

The erratum can be avoided by disabling the
affected prefetcher setting CPUACTLR6_EL1[41].

SDEN Documentation:
https://developer.arm.com/documentation/SDEN-2055130/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I054b47d33fd1ff7bde3ae12e8ee3d99e9203965f

show more ...

feat(cpufeat): add support for FEAT_FGWTE3

Enable write traps for key EL3 system registers as per FEAT_FGWTE3,
ensuring their values remain unchanged after boot.

Excluded Registers:
MDCR_EL3 and MP

feat(cpufeat): add support for FEAT_FGWTE3

Enable write traps for key EL3 system registers as per FEAT_FGWTE3,
ensuring their values remain unchanged after boot.

Excluded Registers:
MDCR_EL3 and MPAM3_EL3: Not trapped as they are part of the EL3 context.
SCTLR_EL3: Not trapped since it is overwritten during
powerdown sequence(Included when HW_ASSISTED_COHERENCY=1)

TPIDR_EL3: Excluded due to its use in crash reporting(It is included
when CRASH_REPORTING=0)

Reference:
https://developer.arm.com/documentation/ddi0601/2025-06/AArch64-Registers/FGWTE3-EL3--Fine-Grained-Write-Traps-EL3

Change-Id: Idcb32aaac7d65a0b0e5c90571af00e01a4e9edb1
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>

show more ...