Merge changes from topics "qemu-sve", "xl/simd-hash" into integration

* changes:
feat(qemu): disable fpregs traps for QEMU in BL31
feat(crypto): enable the runtime instrumentation for crypto ext

Merge changes from topics "qemu-sve", "xl/simd-hash" into integration

* changes:
feat(qemu): disable fpregs traps for QEMU in BL31
feat(crypto): enable the runtime instrumentation for crypto extension
feat(crypto): enable access to SIMD crypto in BL1 and BL2
feat(crypto): enable floating point register traps in EL3
feat(crypto): build flag for SIMD crypto extensions for v8+ platform
refactor(build): add a default filter list for lib cflags

show more ...

Merge "feat(build): add HOSTLDFLAGS to pass flags to host links" into integration

feat(crypto): build flag for SIMD crypto extensions for v8+ platform

Add new build flags ENABLE_FEAT_CRYPTO to enable SIMD crypto extension
for hash256 in bootflow authentication process and ENABLE_

feat(crypto): build flag for SIMD crypto extensions for v8+ platform

Add new build flags ENABLE_FEAT_CRYPTO to enable SIMD crypto extension
for hash256 in bootflow authentication process and ENABLE_FEAT_CRYPTO_SHA3
to enable SIMD crypto extension for sha384 and sha512 in bootflow authentication
process for Arm platform greater than v8.0.

Change-Id: I6e52feb318136910d34cafd89319bf94f90e16fc
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

refactor(build): add a default filter list for lib cflags

All libraries use the same set of cflags during compilation,
because the build macro `MAKE_C_LIB` for libraries is hard-coded
to use the com

refactor(build): add a default filter list for lib cflags

All libraries use the same set of cflags during compilation,
because the build macro `MAKE_C_LIB` for libraries is hard-coded
to use the common cflags variable `TF_CFLAGS` along with
library-specific `LIB_CFLAGS` in the make command.
However for SIMD crypto extension, some cflags have to
be removed from the build. So add an optional argument
of a list of cflags that needed to be filtered out
for a particular library, to allow more flexibility in the
choice of cflags during compilation.

Change-Id: I53f6f3c6efa28ed4fa2d451270f10f448de2af97
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

fix(build): fix BL2_CPPFLAGS when ENABLE_RME is set

Add IMAGE_AT_EL3 to BL2_CPPFLAGS as BL2 runs at EL3 when ENABLE_RME is
set. And use IMAGE_AT_EL3 for misc_helpers.S that is common for all BLs.

T

fix(build): fix BL2_CPPFLAGS when ENABLE_RME is set

Add IMAGE_AT_EL3 to BL2_CPPFLAGS as BL2 runs at EL3 when ENABLE_RME is
set. And use IMAGE_AT_EL3 for misc_helpers.S that is common for all BLs.

This fix enables cpu_reset ops in CPU libs when RME is enabled.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I9d30b6f900a5fed1993b1c09156830290203ed33

show more ...

fix(security): add workaround for CVE-2025-0647

This workaround fixes an issue with the CPP RCTX instruction by
issuing an instruction patch sequence to trap uses of the CPP RCTX
instruction from EL

fix(security): add workaround for CVE-2025-0647

This workaround fixes an issue with the CPP RCTX instruction by
issuing an instruction patch sequence to trap uses of the CPP RCTX
instruction from EL0, EL1, and EL2 to EL3 and perform a workaround
procedure using the implementation defined trap handler to ensure
the correct behavior of the system. In addition, it includes an EL3
API to be used if EL3 firmware needs to use the CPP RCTX instruction.
This saves the overhead of exception handling, and EL3 does not
generically support trapping EL3->EL3, and adding support for that
is not trivial due to the implications for context management.

The issue affects the following CPUs:

C1-Premium
C1-Ultra
Cortex-A710
Cortex-X2
Cortex-X3
Cortex-X4
Cortex-X925
Neoverse N2
Neoverse V2
Neoverse V3
Neoverse V3AE (handled same as V3 CPU in TF-A CPU-Lib)

Arm Security Bulletin Document:
https://developer.arm.com/documentation/111546

Change-Id: I5e7589afbeb69ebb79c01bec80e29f572aff3d89
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

feat(build): add HOSTLDFLAGS to pass flags to host links

There is a HOSTCCFLAGS variable to pass flags to all host compilations,
but no corresponding HOSTLDFLAGS to pass flags to host links.

Change

feat(build): add HOSTLDFLAGS to pass flags to host links

There is a HOSTCCFLAGS variable to pass flags to all host compilations,
but no corresponding HOSTLDFLAGS to pass flags to host links.

Change-Id: I17441fc61e45d2ee41f9ab55a5d745bd0d2156d7
Signed-off-by: Ross Burton <ross.burton@arm.com>

show more ...

fix(build): assign the ldflags-common variable before appending to it

Otherwise the first value is lost, causing odd behaviours.

Change-Id: I6df892bf8f706db71d0aa7e67f5076cc9583e477
Signed-off-by:

fix(build): assign the ldflags-common variable before appending to it

Otherwise the first value is lost, causing odd behaviours.

Change-Id: I6df892bf8f706db71d0aa7e67f5076cc9583e477
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(morello): add Morello capability enablement changes

This patch adds a build macro ENABLE_FEAT_MORELLO which when set will
compile BL31 firmware with changes required to boot capability
aware so

feat(morello): add Morello capability enablement changes

This patch adds a build macro ENABLE_FEAT_MORELLO which when set will
compile BL31 firmware with changes required to boot capability
aware software.

It also adds helper function in c and assmbly to check if morello
hardware is present and if morello capability is enabled or not.

CE field, bits [23:20] in ID_AA64PFR1_EL1 defines whether morello
architecture is present or not, 0b0000 indicates that it is absent
and 0b0001 indicates that it is present. While whether capabilities
are enabled or not is decided at runtime with ENABLE_FEAT_MORELLO build
option.

Reference: https://developer.arm.com/documentation/ddi0606/latest/

Signed-off-by: Manoj Kumar <manoj.kumar3@arm.com>
Signed-off-by: Varshit Pandya <varshit.pandya@arm.com>
Change-Id: Ib16877acbfcb72c4bd8c08e97e44edc0a3e46089

show more ...

feat(cpufeat): enable USE_SPINLOCK_CAS to FEAT_STATE_CHECKED

The FEAT_LSE enablement predates the FEAT_STATE framework and has never
been converted. Since the introduction of USE_SPINLOCK_CAS we've

feat(cpufeat): enable USE_SPINLOCK_CAS to FEAT_STATE_CHECKED

The FEAT_LSE enablement predates the FEAT_STATE framework and has never
been converted. Since the introduction of USE_SPINLOCK_CAS we've gained
lots of quality of life features that allow for better feature
enablement. This patch converts USE_SPINLOCK_CAS to tri-state and adds
it to FEATURE_DETECTION to align with all other features.

Instead of introducing the assembly checking for tri-state, this patch
translates all locking routines to C inline assembly and uses the
standard C helpers. The main benefit is that this gives greater
visibility to the compiler about what the functions are doing and lets
it optimise better. Namely, it is able to allocate registers itself and
inline the functions when LTO is enabled.

An unsuccessful attempt was made to use the instructions directly and
have even flow control in C. This, however, made code very complicated
and less efficient in the tight loops of the spinlock.

The last use of ARM_ARCH_AT_LEAST goes away with this change and so this
macro is removed. It has now been fully superseded by the FEAT_STATE
framework.

This change exposes a limitation - RME_GPT_BITLOCK_BLOCK requires
USE_SPINLOCK_CAS. This patch does not address this in any way but makes
the relationship explicit.

Change-Id: I580081549aceded2dca3e0f4564ee7510a7e56ae
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_UINJ

FEAT_UINJ allows higher ELs to inject Undefined Instruction exceptions
into lower ELs by setting SPSR_ELx.UINJ, which updates PSTATE.UINJ on
exception return

feat(cpufeat): add support for FEAT_UINJ

FEAT_UINJ allows higher ELs to inject Undefined Instruction exceptions
into lower ELs by setting SPSR_ELx.UINJ, which updates PSTATE.UINJ on
exception return. When PSTATE.UINJ is set, instruction execution at the
lower EL raises an Undefined Instruction exception (EC=0b000000).

This patch introduces support for FEAT_UINJ by updating the
inject_undef64() to use hardware undef injection if supported.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I48ad56a58eaab7859d508cfa8dfe81130b873b6b

show more ...

feat(cpufeat): enable mandatory Armv9.4–Armv9.6 features by default

This patch sets Armv9.4-Armv9.6 mandatory features
to 1 by default.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>

feat(cpufeat): enable mandatory Armv9.4–Armv9.6 features by default

This patch sets Armv9.4-Armv9.6 mandatory features
to 1 by default.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I12382e8765f3af7a5428abb1cf1ea0407fdd3849

show more ...

fix(cpufeat): simplify AArch32 feature disablement

Remove redundant conditional checks for unsupported features
(SPE, SVE, MPAM) in aarch32 builds and set them unconditionally
to 0. Add correspondin

fix(cpufeat): simplify AArch32 feature disablement

Remove redundant conditional checks for unsupported features
(SPE, SVE, MPAM) in aarch32 builds and set them unconditionally
to 0. Add corresponding constraint checks to ensure these
features are not enabled when ARCH=aarch32.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I6486b54c69bf0c273371235d1661fafbcb7abb8c

show more ...

Merge "fix(build): set linker to lld before evaluating ld_option" into integration

fix(build): shell-escape toolchain wrapper commands

When we split toolchain tool commands into their wrapper and program
shell fragments, we do so by iterating over each shell word and
forwarding it

fix(build): shell-escape toolchain wrapper commands

When we split toolchain tool commands into their wrapper and program
shell fragments, we do so by iterating over each shell word and
forwarding it to `toolchain-guess-tool`.

However, we receive each word in its raw form, but we pass it to a
function which expects a fragment. If the raw word contains characters
which are syntactically-meaningful to the shell, then the command can
misbehave, and the build system can unwittingly do some funky things.

This small change just ensures that we re-quote the shell word we
receive before forwarding it on.

Change-Id: I325e1c135fee97d749da927c08e181775b14d146
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

fix(build): fix incorrect parentheses expansion in `shell-map`

The previous commit which attempted to fix the expansions in `shell-map`
doubled up on the dollar signs for all of the escape substitut

fix(build): fix incorrect parentheses expansion in `shell-map`

The previous commit which attempted to fix the expansions in `shell-map`
doubled up on the dollar signs for all of the escape substitutions; this
"fixed" the Windows build.

However, the expansion of the parentheses is actually still wrong.
Consider the following example:

print = $(warning $(1))

$(call shell-map,print,'$$' '$(lparen)' '$(rparen)')

... which prints:

make_helpers/utilities.mk:620: $
make_helpers/utilities.mk:620: ${lparen}
make_helpers/utilities.mk:620: ${rparen}

However, what we expect to see is:

make_helpers/utilities.mk:620: $
make_helpers/utilities.mk:620: (
make_helpers/utilities.mk:620: )

The reason we do these substitutions is because, behind the scenes, the
function generates a small snippet of Make which calls the map function
provided by the user. To do that safely, we need to escape characters
which can cause premature expansion (`$`), and any characters which can
interfere with the syntax of the `call` function (`(` and `)`).

The shell snippet that we *expected* the example above to generate was:

$(call print,$$,1)
$(call print,${lparen},2)
$(call print,${rparen},3)

However, as of the last "fix", what it is actually generating is:

$(call print,$$,1)
$(call print,$${lparen},2)
$(call print,$${rparen},3)

This breaks the Windows build again but that's because this bug was
actually three bugs from the start.

Change-Id: Ibaf044806101334ddf4080df8da18f9aac8667e5
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

Merge "fix(build): fix incorrect expansions in `shell-map`" into integration

fix(build): fix incorrect expansions in `shell-map`

The `shell-map` function needs to pass values it receives from the shell
back into Make for evaluation, which requires certain special characters

fix(build): fix incorrect expansions in `shell-map`

The `shell-map` function needs to pass values it receives from the shell
back into Make for evaluation, which requires certain special characters
to be escaped.

This escaping is currently resulting in those characters *not* being
escaped, and consequently instead generates some funky (unhelpful)
syntax errors half-way through reading the Makefile.

This change corrects the escape substitutions so that they are evaluated
as expected within Make.

Change-Id: I7b47a48342f626efe362e05283ee59520673375f
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

fix(build): set linker to lld before evaluating ld_option

This ensures ld_option is called with valid -fuse-ld option, therefore
filtering options against ones supported by lld and not the
system de

fix(build): set linker to lld before evaluating ld_option

This ensures ld_option is called with valid -fuse-ld option, therefore
filtering options against ones supported by lld and not the
system default linker Clang chooses without the option specified.

This change should not affect toolchains other than llvm-clang, since it
only moves a conditional concerning the said toolchain.

Resolves the following linking error that manifests itself when using
Clang versions 21 and higher for building TF-A:

> ld.lld: error: unknown argument '--no-warn-rwx-segments'

Change-Id: I466f733377327a7c38ee27899be6681debf61e11
Signed-off-by: Dmitrii Sharshakov <d3dx12.xx@gmail.com>

show more ...

feat(cpufeat): add support for FEAT_IDTE3

This patch adds support for FEAT_IDTE3, which introduces support
for handling the trapping of Group 3 and Group 5 (only GMID_EL1)
registers to EL3 (unless t

feat(cpufeat): add support for FEAT_IDTE3

This patch adds support for FEAT_IDTE3, which introduces support
for handling the trapping of Group 3 and Group 5 (only GMID_EL1)
registers to EL3 (unless trapped to EL2). IDTE3 allows EL3 to
modify the view of ID registers for lower ELs, and this capability
is used to disable fields of ID registers tied to disabled features.

The ID registers are initially read as-is and stored in context.
Then, based on the feature enablement status for each world, if a
particular feature is disabled, its corresponding field in the
cached ID register is set to Res0. When lower ELs attempt to read
an ID register, the cached ID register value is returned. This
allows EL3 to prevent lower ELs from accessing feature-specific
system registers that are disabled in EL3, even though the hardware
implements them.

The emulated ID register values are stored primarily in per-world
context, except for certain debug-related ID registers such as
ID_AA64DFR0_EL1 and ID_AA64DFR1_EL1, which are stored in the
cpu_data and are unique to each PE. This is done to support feature
asymmetry that is commonly seen in debug features.

FEAT_IDTE3 traps all Group 3 ID registers in the range
op0 == 3, op1 == 0, CRn == 0, CRm == {2–7}, op2 == {0–7} and the
Group 5 GMID_EL1 register. However, only a handful of ID registers
contain fields used to detect features enabled in EL3. Hence, we
only cache those ID registers, while the rest are transparently
returned as is to the lower EL.

This patch updates the CREATE_FEATURE_FUNCS macro to generate
update_feat_xyz_idreg_field() functions that disable ID register
fields on a per-feature basis. The enabled_worlds scope is used to
disable ID register fields for security states where the feature is
not enabled.

This EXPERIMENTAL feature is controlled by the ENABLE_FEAT_IDTE3
build flag and is currently disabled by default.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I5f998eeab81bb48c7595addc5595313a9ebb96d5

show more ...

feat(per-cpu): introduce linker changes for NUMA aware per-cpu framework

This commit introduces linker changes for NUMA aware per-cpu objects in
the BL31 and BL32 images. The per-cpu framework is de

feat(per-cpu): introduce linker changes for NUMA aware per-cpu framework

This commit introduces linker changes for NUMA aware per-cpu objects in
the BL31 and BL32 images. The per-cpu framework is designed to minimise
cache thrashing, and the linker layout ensures each CPU’s per-cpu data
is placed on a separate cache line. This isolation is expected to
improve performance when the per-cpu framework is enabled.

Signed-off-by: Sammit Joshi <sammit.joshi@arm.com>
Signed-off-by: Rohit Mathew <rohit.mathew@arm.com>
Change-Id: Ie4d8b4e444971adbd9dba0446d1ab8cafaca1556

show more ...

feat(cpufeat): introduce FEAT_RME_GDI support

This patch adds a new build flag ENABLE_FEAT_RME_GDI to enable this
feature, along with defining various related register fields. At this
point, when en

feat(cpufeat): introduce FEAT_RME_GDI support

This patch adds a new build flag ENABLE_FEAT_RME_GDI to enable this
feature, along with defining various related register fields. At this
point, when enabled, this feature enables the SA and NSP GPI encodings
by setting the corresponding bits in GPCCR_EL3.

Change-Id: I54152fbb3d19b176264e5d16acbcc866725dc290
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Timothy Hayes <timothy.hayes@arm.com>

show more ...

fix(cpufeat): extend FEAT_EBEP handling to delegate PMU control to EL2

Currently, the FEAT_EBEP feature presence check is only used for UNDEF
injection into lower ELs. However, this feature also aff

fix(cpufeat): extend FEAT_EBEP handling to delegate PMU control to EL2

Currently, the FEAT_EBEP feature presence check is only used for UNDEF
injection into lower ELs. However, this feature also affects the access
behavior of MDCR_EL2. Specifically, if the PMEE bits in MDCR_EL3 are not
set to 0b01, then the MDCR_EL2.PMEE bits cannot be configured by EL2.

This patch extends the use of FEAT_EBEP to delegate PMU IRQ and
profiling exception control to EL2 by setting MDCR_EL3.PMEE = 0b01.This
ensures that lower ELs can manage PMU configuration.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ib7e1d5c72f017b8ffc2131fc57309dd9d811c973

show more ...

Merge changes from topic "little-build-fixes" into integration

* changes:
fix(build): don't rely on Event Log build tree
fix(build): link Event Log library directly
fix(build): scan symbols un

Merge changes from topic "little-build-fixes" into integration

* changes:
fix(build): don't rely on Event Log build tree
fix(build): link Event Log library directly
fix(build): scan symbols until all are resolved
fix(build): add include directory dependencies

show more ...

Merge changes Ie8453359,Icd58a49c into integration

* changes:
docs: deprecate SPM_MM build option
docs: deprecate NS_TIMER_SWITCH build option