Merge changes Ic8700325,I6a3a9f28,I91a28b5f,Ia69289bf,I81d9b73a, ... into integration

* changes:
feat(cpufeat): constrain RAS_TRAP_NS_ERR_REC_ACCESS on ENABLE_FEAT_RAS
fix(build): set defaults t

Merge changes Ic8700325,I6a3a9f28,I91a28b5f,Ia69289bf,I81d9b73a, ... into integration

* changes:
feat(cpufeat): constrain RAS_TRAP_NS_ERR_REC_ACCESS on ENABLE_FEAT_RAS
fix(build): set defaults to feature flags before platform.mk
refactor(cpufeat): unify FEAT_IDTE3's definitions with arch.h
refactor(el3-runtime): generalise sysreg trapping
refactor(el3-runtime): use contexted SCR_EL3 instead of the register
build: rename default_ones to set_ones

show more ...

feat: enable FEATURE_DETECTION on FVP

FEATURE_DETECTION has received a lot of attention since its introduction
and at this point is quite reliable. Its experimental designation is no
longer appropri

feat: enable FEATURE_DETECTION on FVP

FEATURE_DETECTION has received a lot of attention since its introduction
and at this point is quite reliable. Its experimental designation is no
longer appropriate and it would be quite reasonable to use this feature
by default.

Always enable the feature for FVP so that we can have confidence that
the SW view of HW is up to date.

This patch also drops the mention of errata reporting around
FEATURE_DETECTION as this hasn't been true for some time.

Change-Id: I4a94dce243e430d5d3528c66154075b4352cd520
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): constrain RAS_TRAP_NS_ERR_REC_ACCESS on ENABLE_FEAT_RAS

It is illogical to set it otherwise and it would make code more
complicated to account for it.

Change-Id: Ic87003259702ffded82

feat(cpufeat): constrain RAS_TRAP_NS_ERR_REC_ACCESS on ENABLE_FEAT_RAS

It is illogical to set it otherwise and it would make code more
complicated to account for it.

Change-Id: Ic87003259702ffded8214439fd6041295752895c
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): set defaults to feature flags before platform.mk

Keeping everything feature related in arch_features.mk is very
convenient but is subtly broken - platforms occasionally make decision
on

fix(build): set defaults to feature flags before platform.mk

Keeping everything feature related in arch_features.mk is very
convenient but is subtly broken - platforms occasionally make decision
on whether a feature was enabled on the commandline. This is usually
done with a line like `ifneq (${ENABLE_FEAT_ABC},0)` which will pass if
the flag is unset, very much the opposite of what should happen. The
easiest way to fix this is to set defaults prior to platform.mk, i.e. in
defaults.mk.

Change-Id: I6a3a9f287045b57a66c30cbda77898b2774d3da9
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

build: rename default_ones to set_ones

default_zeros is a shorthand to set a flag to 0 with `?=`. This is
useful because we want a safe value that we can do simple checks like
`ifneq (${SOME_FLAG},0

build: rename default_ones to set_ones

default_zeros is a shorthand to set a flag to 0 with `?=`. This is
useful because we want a safe value that we can do simple checks like
`ifneq (${SOME_FLAG},0)`.

default_ones' use case is a bit different. It is only used to "force" a
bunch of flags on, unless set on the commandline. It doesn't need to be
as gentle as default_zeros since its values are expected to be final.

So rename it to set_ones and change the ?= assignment to := to better
reflect this. This patch also inlines `default_one` as there were no
external callers to it.

Change-Id: I418db7a1d0186a55febd4fe3c928805ed8fcfca6
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cpus): unconstrain WORKAROUND_CVE_2025_0647

Conditional flag enables are strongly discouraged in TF-A because they
cause cyclic dependencies that we are not equipped to deal with. On a
real plat

fix(cpus): unconstrain WORKAROUND_CVE_2025_0647

Conditional flag enables are strongly discouraged in TF-A because they
cause cyclic dependencies that we are not equipped to deal with. On a
real platform, ARM_ARCH_{MAJOR, MINOR} should be set in platform.mk but
WORKAROUND_CVE_2025_0647 gets its value before platform.mk is evaluated.

Further, WORKAROUND_CVE_2025_0647 is only present on cores the feature
set of which is known ahead of time. Using ARM_ARCH_{MAJOR, MINOR} is
redundant and incorrect (as it sidesteps the feature detection
mechanism).

This patch solves both of these issues by making
WORKAROUND_CVE_2025_0647 unconstrained by ARM_ARCH_{MAJOR, MINOR} and
making it buildable on a v8.0 target. Running the workaround will only
happen on affected cores which, by definition, all implement armv8.5 so
doing any checks in unnecessary.

Change-Id: Ia164077f09b552d42b558ada4f6036cabbd34f64
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME rela

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME related support is now enabled using feature detection option
ENABLE_FEAT_RME, this patch moves GPT support under ENABLE_FEAT_RME.

This change brings in below benefits:
- single TF-A build that works for RME and non-RME systems, when
build with ENABLE_FEAT_RME=2 (FEAT_STATE_CHECK)
- RMM loading is optional on RME systems
- SiP calls that leverages RME features to change the PAS of a memory
range from non-secure to secure is supported without need to enable
Realm PAS or RMM.
- FIRME Granule Management Interface (GMI) ABIs that handles
FEAT_RME_GPC2/FEAT_RME_GDI can be enabled without need to enable RMM

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I88d9d4e0491af2b4ae0307c018f2d4a71ee6693f

show more ...

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option perfor

feat(rmmd): replace ENABLE_RME with ENABLE_RMM

RME architectural requirements are now handled under the feature
detection option ENABLE_FEAT_RME. However, the existing ENABLE_RME build
option performs RMM-specific tasks such as GPT setup, loading the RMM,
and enabling RMMD support.

Since ENABLE_RME now only controls RMM-related functionality, rename it
to ENABLE_RMM to better reflect its purpose and avoid confusion with
ENABLE_FEAT_RME.

For backward compatibility, setting the legacy ENABLE_RME=1 (until it is
deprecated) will automatically enable both ENABLE_FEAT_RME and
ENABLE_RMM.

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: Iac945bdffe5002161bf1161b81a5aa7abec68192

show more ...

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full RMM loading and handling.

While full CCA support requires all of these steps, some systems running
on FEAT_RME-capable cores do not need or want an RMM. However, such
systems still require TF-A page table entries to set the .NSE bit so
that TF-A accesses are correctly attributed to the ROOT world,
otherwise, enabling the MMU may cause the system to hang.

To address this, a new build option, ENABLE_FEAT_RME, is introduced. It
handles only the .NSE PTE setup and ignores the rest of the RME/RMM
initialization. ENABLE_FEAT_RME follows the ENABLE_FEAT_* convention and
supports values 0–2, with 2 enabling runtime detection.

Full RME functionality remains gated by ENABLE_RME, which now implicitly
enables ENABLE_FEAT_RME, allowing TF-A to run safely on FEAT_RME systems
without requiring an RMM.

Change-Id: I8391652842ff2e62a73b61829c6250c3805d4a4e
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fix(cpufeat)!: do not enable FEAT_RNG with v8.5

FEAT_RNG is never a mandatory feature, it is only optional from Armv8.4
so it never belonged on the list. This patch removes this setting as it
will p

fix(cpufeat)!: do not enable FEAT_RNG with v8.5

FEAT_RNG is never a mandatory feature, it is only optional from Armv8.4
so it never belonged on the list. This patch removes this setting as it
will prevent FEATURE_DETECTION from working on an 8.5 system with no
FEAT_RNG.

There are very few FEAT_RNG uses in TF-A so this change is not expected
to have any impact. The only platform that sets ARM_ARCH_MINOR=5 has
been checked and it's FEAT_RNG setting is correct. Still, this patch
could be a breaking change for downstreams.

Change-Id: I104f450199b0ec1d4fae9f91b5b41e3aa5a3bf0b
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "fix(cpus)!: make ERRATA_SME_POWER_DOWN work with the recommended state ID" into integration

Merge "fix(rmmd): set RMM_V1_COMPAT=0" into integration

fix(rmmd): set RMM_V1_COMPAT=0

Set the default value of RMM_V1_COMPAT to 0. This means by default, TF-A
will only work with an RMM which is aligned to RMMv2.0 specification.

BREAKING-CHANGE: RMM v1

fix(rmmd): set RMM_V1_COMPAT=0

Set the default value of RMM_V1_COMPAT to 0. This means by default, TF-A
will only work with an RMM which is aligned to RMMv2.0 specification.

BREAKING-CHANGE: RMM v1.x compatibility is now disabled by default.
Platforms which continue to rely on the RMM v1 ABI must explicitly
build TF-A with `RMM_V1_COMPAT=1`.

Change-Id: Icf0e2dc9ebd8991cc989930807997625282191c3
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

feat(firme): initial commit of FIRME service

This is the first FIRME service patch that adds support for basic ABIs
for retrieving the FIRME version, features, and GPI_SET.

This adds a new generic

feat(firme): initial commit of FIRME service

This is the first FIRME service patch that adds support for basic ABIs
for retrieving the FIRME version, features, and GPI_SET.

This adds a new generic granule transition function that replaces
the existing delegate/undelegate APIs that GPI_SET uses. It also
updates TRP to use GPI_SET when FIRME is supported.

FIRME spec is here, note that it is ALPHA2 quality so further changes
are to be expected:
https://developer.arm.com/documentation/den0149

Change-Id: I57b8ad7e87a0679e15c8247f8457f91f3254dedb
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(cpus)!: make ERRATA_SME_POWER_DOWN work with the recommended state ID

The ERRATA_SME_POWER_DOWN flag doesn't account for the recommended state
ID encoding, only for the default one. This patch m

fix(cpus)!: make ERRATA_SME_POWER_DOWN work with the recommended state ID

The ERRATA_SME_POWER_DOWN flag doesn't account for the recommended state
ID encoding, only for the default one. This patch makes it work by
removing the generic flag and incorporating the functionality into the
CPU and platform layers.

The ERRATA_SME_POWER_DOWN is an awkward fix in generic code to a
platform problem. The PSCI layer shouldn't care about any CPU's inner
workings but it does. This isn't ideal once the issue is fixed since
we'll have to carry the "legacy" fix in generic code.

This patch is marked as breaking since the ERRATA_SME_POWER_DOWN flag is
removed and a couple of lines are required if CPU hotplug encounters a
powerdown with live SME state (CPU suspend will work as before). This
will get discovered with a panic at EL3 so this patch leaves a comment
to be able to trace it back.

Change-Id: Ia52865f527e81a8be3727093ed370901e55c5fef
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

test(bl): add short-read negative test scenario

Add an opt-in negative test mode that simulates a short read
for a selected image_id during image loading. This exercises
the partial-read error handl

test(bl): add short-read negative test scenario

Add an opt-in negative test mode that simulates a short read
for a selected image_id during image loading. This exercises
the partial-read error handling path and is intended for CI
validation only.

Disabled by default via build options.

Change-Id: I219b75898e1778c0b263f99a9370425098d52f8f
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targetin

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targeting the
more recently introduced Realm world. Hence the new RMMv2.0
specification mandates that EL3 should not save and restore
the GIC registers on a world switch. This change is not backward
compatible with RMMv1.x ABI.

Note the change in implementation of cm_el2_sysregs_context_save()
and cm_el2_sysregs_context_restore() API as GIC state is not
managed by these APIs anymore.

Add new build flag RMM_V1_COMPAT to support backward compatibility
with RMMv1.x. This flag is currently enabled by default.

This patch is a reworked version of the original patch at:
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/45658

NOTE: If RMM_V1_COMPAT is not enabled, then RMM_EL3_IFC_VERSION
is bumped to 1.0 which makes it incompatible with an RMM supporting
0.x.

Change-Id: If4c53b85ef31091c254b383ed7b32c39124f0dbb
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

feat(lfa): build flags for SP live activation support

This patch introduces new build flags necessary for SP live activation
support and ensures all constraints are met.

BREAKING CHANGE: Temporaril

feat(lfa): build flags for SP live activation support

This patch introduces new build flags necessary for SP live activation
support and ensures all constraints are met.

BREAKING CHANGE: Temporarily fails to build

Change-Id: I17fba2ee935845816ae40067ca349b1eb9bb310c
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

feat(cpufeat): add support for FEAT_HACDBS

The Hardware accelerator for cleaning Dirty state feature also has two
register just like FEAT_HDBSS. They are guarded by a SCR_EL3 bit which
set for NS wo

feat(cpufeat): add support for FEAT_HACDBS

The Hardware accelerator for cleaning Dirty state feature also has two
register just like FEAT_HDBSS. They are guarded by a SCR_EL3 bit which
set for NS world only and are not context switched as a result. There is
no use for this feature at EL3.

Change-Id: Ica7a312d891a1671df8e9f2adbfe464d96bbcd4d
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_HDBSS

The Hardware Dirty state tracking structure feature has two registers to
enable tracking at lower ELs which are guarded by an SCR_EL3 bit. Set
that bit for

feat(cpufeat): add support for FEAT_HDBSS

The Hardware Dirty state tracking structure feature has two registers to
enable tracking at lower ELs which are guarded by an SCR_EL3 bit. Set
that bit for NS only and do not context switch the registers. There is
no use of the feature at EL3.

Change-Id: I174a256d70a99abfafc65eed3a2fbdaea5ea946d
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_STEP2

This feature only needs MDCR_EL3.EnSTEPOP to be written and mdstepop_el1
to be context switched when the next EL is EL1.

Change-Id: I70e2a488f4e50da4b181a0

feat(cpufeat): add support for FEAT_STEP2

This feature only needs MDCR_EL3.EnSTEPOP to be written and mdstepop_el1
to be context switched when the next EL is EL1.

Change-Id: I70e2a488f4e50da4b181a00648c4f608e1da451c
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): pass -flto-partition to the linker and not the compiler

It's irrelevant to the compiler, although most of the times it gets
enabled when compiler==linker so this doesn't show up. It is p

fix(build): pass -flto-partition to the linker and not the compiler

It's irrelevant to the compiler, although most of the times it gets
enabled when compiler==linker so this doesn't show up. It is possible
that compiler!=linker (eg compiler=armclang, linker=gcc) with LTO
enabled though. Then this blows up since the check was done on the
linker and the argument passed to the compiler.

Change-Id: Ibc740599c71e892cae873976fed35e1b57658ff4
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes from topics "qemu-sve", "xl/simd-hash" into integration

* changes:
feat(qemu): disable fpregs traps for QEMU in BL31
feat(crypto): enable the runtime instrumentation for crypto ext

Merge changes from topics "qemu-sve", "xl/simd-hash" into integration

* changes:
feat(qemu): disable fpregs traps for QEMU in BL31
feat(crypto): enable the runtime instrumentation for crypto extension
feat(crypto): enable access to SIMD crypto in BL1 and BL2
feat(crypto): enable floating point register traps in EL3
feat(crypto): build flag for SIMD crypto extensions for v8+ platform
refactor(build): add a default filter list for lib cflags

show more ...

Merge "feat(build): add HOSTLDFLAGS to pass flags to host links" into integration

feat(crypto): build flag for SIMD crypto extensions for v8+ platform

Add new build flags ENABLE_FEAT_CRYPTO to enable SIMD crypto extension
for hash256 in bootflow authentication process and ENABLE_

feat(crypto): build flag for SIMD crypto extensions for v8+ platform

Add new build flags ENABLE_FEAT_CRYPTO to enable SIMD crypto extension
for hash256 in bootflow authentication process and ENABLE_FEAT_CRYPTO_SHA3
to enable SIMD crypto extension for sha384 and sha512 in bootflow authentication
process for Arm platform greater than v8.0.

Change-Id: I6e52feb318136910d34cafd89319bf94f90e16fc
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...