feat(psci): allow cores to wake up from powerdown

The simplistic view of a core's powerdown sequence is that power is
atomically cut upon calling `wfi`. However, it turns out that it has
lots to do

feat(psci): allow cores to wake up from powerdown

The simplistic view of a core's powerdown sequence is that power is
atomically cut upon calling `wfi`. However, it turns out that it has
lots to do - it has to talk to the interconnect to exit coherency, clean
caches, check for RAS errors, etc. These take significant amounts of
time and are certainly not atomic. As such there is a significant window
of opportunity for external events to happen. Many of these steps are
not destructive to context, so theoretically, the core can just "give
up" half way (or roll certain actions back) and carry on running. The
point in this sequence after which roll back is not possible is called
the point of no return.

One of these actions is the checking for RAS errors. It is possible for
one to happen during this lengthy sequence, or at least remain
undiscovered until that point. If the core were to continue powerdown
when that happens, there would be no (easy) way to inform anyone about
it. Rejecting the powerdown and letting software handle the error is the
best way to implement this.

Arm cores since at least the a510 have included this exact feature. So
far it hasn't been deemed necessary to account for it in firmware due to
the low likelihood of this happening. However, events like GIC wakeup
requests are much more probable. Older cores will powerdown and
immediately power back up when this happens. Travis and Gelas include a
feature similar to the RAS case above, called powerdown abandon. The
idea is that this will improve the latency to service the interrupt by
saving on work which the core and software need to do.

So far firmware has relied on the `wfi` being the point of no return and
if it doesn't explicitly detect a pending interrupt quite early on, it
will embark onto a sequence that it expects to end with shutdown. To
accommodate for it not being a point of no return, we must undo all of
the system management we did, just like in the warm boot entrypoint.

To achieve that, the pwr_domain_pwr_down_wfi hook must not be terminal.
Most recent platforms do some platform management and finish on the
standard `wfi`, followed by a panic or an endless loop as this is
expected to not return. To make this generic, any platform that wishes
to support wakeups must instead let common code call
`psci_power_down_wfi()` right after. Besides wakeups, this lets common
code handle powerdown errata better as well.

Then, the CPU_OFF case is simple - PSCI does not allow it to return. So
the best that can be done is to attempt the `wfi` a few times (the
choice of 32 is arbitrary) in the hope that the wakeup is transient. If
it isn't, the only choice is to panic, as the system is likely to be in
a bad state, eg. interrupts weren't routed away. The same applies for
SYSTEM_OFF, SYSTEM_RESET, and SYSTEM_RESET2. There the panic won't
matter as the system is going offline one way or another. The RAS case
will be considered in a separate patch.

Now, the CPU_SUSPEND case is more involved. First, to powerdown it must
wipe its context as it is not written on warm boot. But it cannot be
overwritten in case of a wakeup. To avoid the catch 22, save a copy that
will only be used if powerdown fails. That is about 500 bytes on the
stack so it hopefully doesn't tip anyone over any limits. In future that
can be avoided by having a core manage its own context.

Second, when the core wakes up, it must undo anything it did to prepare
for poweroff, which for the cores we care about, is writing
CPUPWRCTLR_EL1.CORE_PWRDN_EN. The least intrusive for the cpu library
way of doing this is to simply call the power off hook again and have
the hook toggle the bit. If in the future there need to be more complex
sequences, their direction can be advised on the value of this bit.

Third, do the actual "resume". Most of the logic is already there for
the retention suspend, so that only needs a small touch up to apply to
the powerdown case as well. The missing bit is the powerdown specific
state management. Luckily, the warmboot entrypoint does exactly that
already too, so steal that and we're done.

All of this is hidden behind a FEAT_PABANDON flag since it has a large
memory and runtime cost that we don't want to burden non pabandon cores
with.

Finally, do some function renaming to better reflect their purpose and
make names a little bit more consistent.

Change-Id: I2405b59300c2e24ce02e266f91b7c51474c1145f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): do not force PLAT in plat_helpers.mk

After the change to allow overriding platform specific defaults [1],
the PLAT macro is forced to DEFAULT_PLAT in plat_helpers.mk. But this
makefile i

fix(build): do not force PLAT in plat_helpers.mk

After the change to allow overriding platform specific defaults [1],
the PLAT macro is forced to DEFAULT_PLAT in plat_helpers.mk. But this
makefile is also called for tools. For example in fiptool makefile, as
PLAT is reset to default plat (fvp), we cannot use specific platforms
plat_fiptool.mk files. Put back the setting of PLAT macro in Makefile.

[1]: 1b2fb6adb5 feat(build): add ability to define platform specific
defaults

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: Iadf8bc7fc831a728a9688d0afdd163c8dda737e5

show more ...

Merge "build: remove Windows compatibility layer" into integration

feat(mops): enable FEAT_MOPS in EL3 when INIT_UNUSED_NS_EL2=1

FEAT_MOPS, mandatory from Arm v8.8, is typically managed in EL2.
However, in configurations where NS_EL2 is not enabled,
EL3 must set th

feat(mops): enable FEAT_MOPS in EL3 when INIT_UNUSED_NS_EL2=1

FEAT_MOPS, mandatory from Arm v8.8, is typically managed in EL2.
However, in configurations where NS_EL2 is not enabled,
EL3 must set the HCRX_EL2.MSCEn bit to 1 to enable the feature.

This patch ensures FEAT_MOPS is enabled by setting HCRX_EL2.MSCEn to 1.

Change-Id: Ic4960e0cc14a44279156b79ded50de475b3b21c5
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>

show more ...

build: remove Windows compatibility layer

For a couple of releases now we have officially withdrawn support for
building TF-A on Windows using the native environment, relying instead
on POSIX emulat

build: remove Windows compatibility layer

For a couple of releases now we have officially withdrawn support for
building TF-A on Windows using the native environment, relying instead
on POSIX emulation layers like MSYS2, Mingw64, Cygwin or WSL.

This change removes the remainder of the OS compatibility layer
entirely, and migrates the build system over to explicitly relying on a
POSIX environment.

Change-Id: I8fb60d998162422e958009afd17eab826e3bc39b
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

feat(smccc): implement SMCCC_ARCH_FEATURE_AVAILABILITY

SMCCC_ARCH_FEATURE_AVAILABILITY [1] is a call to query firmware about
the features it is aware of and enables. This is useful when a feature
is

feat(smccc): implement SMCCC_ARCH_FEATURE_AVAILABILITY

SMCCC_ARCH_FEATURE_AVAILABILITY [1] is a call to query firmware about
the features it is aware of and enables. This is useful when a feature
is not enabled at EL3, eg due to an older FW image, but it is present in
hardware. In those cases, the EL1 ID registers do not reflect the usable
feature set and this call should provide the necessary information to
remedy that.

The call itself is very lightweight - effectively a sanitised read of
the relevant system register. Bits that are not relevant to feature
enablement are masked out and active low bits are converted to active
high.

The implementation is also very simple. All relevant, irrelevant, and
inverted bits combined into bitmasks at build time. Then at runtime the
masks are unconditionally applied to produce the right result. This
assumes that context managers will make sure that disabled features
do not have their bits set and the registers are context switched if
any fields in them make enablement ambiguous.

Features that are not yet supported in TF-A have not been added. On
debug builds, calling this function will fail an assert if any bits that
are not expected are set. In combination with CI this should allow for
this feature to to stay up to date as new architectural features are
added.

If a call for MPAM3_EL3 is made when MPAM is not enabled, the call
will return INVALID_PARAM, while if it is FEAT_STATE_CHECK, it will
return zero. This should be fairly consistent with feature detection.

The bitmask is meant to be interpreted as the logical AND of the
relevant ID registers. It would be permissible for this to return 1
while the ID returns 0. Despite this, this implementation takes steps
not to. In the general case, the two should match exactly.

Finally, it is not entirely clear whether this call replies to SMC32
requests. However, it will not, as the return values are all 64 bits.

[1]: https://developer.arm.com/documentation/den0028/galp1/?lang=en

Co-developed-by: Charlie Bareham <charlie.bareham@arm.com>
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I1a74e7d0b3459b1396961b8fa27f84e3f0ad6a6f

show more ...

feat(fpmr): disable FPMR trap

This patch enables support of FEAT_FPMR by enabling access
to FPMR register. It achieves it by setting the EnFPM bit of
SCR_EL3. This feature is currently enabled for N

feat(fpmr): disable FPMR trap

This patch enables support of FEAT_FPMR by enabling access
to FPMR register. It achieves it by setting the EnFPM bit of
SCR_EL3. This feature is currently enabled for NS world only.

Reference:
https://developer.arm.com/documentation/109697/2024_09/
Feature-descriptions/The-Armv9-5-architecture-extension?lang=en

Change-Id: I580c409b9b22f8ead0737502280fb9093a3d5dd2
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>

show more ...

feat(lib): introduce Hob creation library

According to Platform Initialization (PI) Specification [1] and
discussion on edk2 mailing list [2],
StandaloneMm shouldn't create Hob but it should be pass

feat(lib): introduce Hob creation library

According to Platform Initialization (PI) Specification [1] and
discussion on edk2 mailing list [2],
StandaloneMm shouldn't create Hob but it should be passed from TF-A.
IOW, TF-A should pass boot information via HOB list to initialise
StandaloneMm properly.

And this HOB lists could be delivered via
- SPM_MM: Transfer List according to the firmware handoff spec[3]

- FF-A v1.1 >= : FF-A boot protocol.

This patch introduces a TF-A HOB creation library and
some of definitions which StandaloneMm requires to boot.

Link: https://uefi.org/sites/default/files/resources/PI_Spec_1_6.pdf [1]
Link: https://edk2.groups.io/g/devel/topic/103675962#114283 [2]
Link: https://github.com/FirmwareHandoff/firmware_handoff [3]
Signed-off-by: Levi Yun <yeoreum.yun@arm.com>
Change-Id: I5e0838adce487110206998a8b79bc3adca922cec

show more ...

build: use parameters in calls to `MAKE_DEP`

This is a small change to the behaviour of the `MAKE_DEP` macro to force
it to take its inputs as arguments, rather than assuming the variables
that its

build: use parameters in calls to `MAKE_DEP`

This is a small change to the behaviour of the `MAKE_DEP` macro to force
it to take its inputs as arguments, rather than assuming the variables
that its inputs come from.

Change-Id: Ibe44f19e6bea43c9feed34710cdd30704576b4d7
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

build: disable suffix rules globally

This change centralises the logic that disables the default suffix rules
that Make provides. These rules are a hold-over from legacy standards of
Make, and occas

build: disable suffix rules globally

This change centralises the logic that disables the default suffix rules
that Make provides. These rules are a hold-over from legacy standards of
Make, and occasionally conflict with our rules.

Change-Id: I9e023edbc01b5ae48a96fa1078d0b81faabb0cb9
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

build: use full paths for generated libraries

This change modifies the build rules for static libraries so that
individual rules which use those libraries depend directly on the
archive files that a

build: use full paths for generated libraries

This change modifies the build rules for static libraries so that
individual rules which use those libraries depend directly on the
archive files that are generated, rather than their phony target aliases
and `-lX` link flags.

The goal of this is to clean up Make's view of the dependencies between
files, avoiding phony targets (which do not honour timestamps) making
their way into intermediate dependencies.

Change-Id: I96d655fcd94dc259ffa6e8970b2be7b8c7e11123
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

Merge "fix(build): correct feature assignment for ARM v8.8 compliance" into integration

Merge changes If56ed0ab,I632236a1 into integration

* changes:
perf(build): don't check the compiler's flags for every target
perf(build): be clever about uppercasing

perf(build): don't check the compiler's flags for every target

The TF_FLAGS variable must be recursively expanded as the rules that use
it are defined before it has been fully defined. That has the

perf(build): don't check the compiler's flags for every target

The TF_FLAGS variable must be recursively expanded as the rules that use
it are defined before it has been fully defined. That has the
unfortunate side effect of spawning a subshell that calls the compiler
for every file that is being built, thrashing multicore build times.

We don't cater to the possibility of the toolchain changing mid build so
precomputing this value would be more sensible. Doing a clean build on
an Intel dual socket Xeon Gold 5218 (i.e. 64 threads) workstation used
to take about 9 seconds. After this patch it takes about 1.5. Single
core performance went from ~45 seconds to about 25.

Change-Id: If56ed0ab3cc42bc482d9dd05a41ffbff4dd7f147
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

perf(build): be clever about uppercasing

Most of the macros in build_macros.mk get lazily evaluated. That's
mostly fine, except for the fact that the `uppercase` macro needs to
spawn a subshell to g

perf(build): be clever about uppercasing

Most of the macros in build_macros.mk get lazily evaluated. That's
mostly fine, except for the fact that the `uppercase` macro needs to
spawn a subshell to get its output. And the target for every file
requires calling `uppercase` many, MANY, times, thrashing performance on
even the most trivial of make commands.

We can be a little clever and only call `uppercase` a handful of times
and then pass around the already uppercased strings.

The same is true about the verbosity augmentation variables. Simply
changing them to simply expanded variables allows for them to be
pre-processed and then used over and over again.

`make realclean` is a pretty good benchmark for this as it doesn't do
much else but must process all the rules, like every other make command.
On a clean checkout of TF-A on an Intel Xeon Gold 5218 (i.e. slow
single-core) workstation, that command used to take about 7 seconds.
With this patch it takes about 0.5.

Change-Id: I632236a12a40f169e834974ecbc73ff80aac3462
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): correct feature assignment for ARM v8.8 compliance

Correct feature list assignment to apply ARM v8.7 features
to `armv8-8-a-feats` instead of `armv8-7-a-feats` for ARM v8.8
compliance.
T

fix(build): correct feature assignment for ARM v8.8 compliance

Correct feature list assignment to apply ARM v8.7 features
to `armv8-8-a-feats` instead of `armv8-7-a-feats` for ARM v8.8
compliance.
This was highlighted during the build of TC4 with ARM_ARCH_MAJOR=8
and ARM_ARCH_MINOR=8.

Change-Id: I6c48a3ffa2f1e18d5e4a6484a823c9112dddd751
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge "build(bl31): support separated memory for RW DATA" into integration

feat(cpufeat): add ENABLE_FEAT_LS64_ACCDATA

Armv8.6 introduced the FEAT_LS64 extension, which provides a 64 *byte*
store instruction. A related instruction is ST64BV0, which will replace
the lowest

feat(cpufeat): add ENABLE_FEAT_LS64_ACCDATA

Armv8.6 introduced the FEAT_LS64 extension, which provides a 64 *byte*
store instruction. A related instruction is ST64BV0, which will replace
the lowest 32 bits of the data with a value taken from the ACCDATA_EL1
system register (so that EL0 cannot alter them).
Using that ST64BV0 instruction and accessing the ACCDATA_EL1 system
register is guarded by two SCR_EL3 bits, which we should set to avoid a
trap into EL3, when lower ELs use one of those.

Add the required bits and pieces to make this feature usable:
- Add the ENABLE_FEAT_LS64_ACCDATA build option (defaulting to 0).
- Add the CPUID and SCR_EL3 bit definitions associated with FEAT_LS64.
- Add a feature check to check for the existing four variants of the
LS64 feature and detect future extensions.
- Add code to save and restore the ACCDATA_EL1 register on
secure/non-secure context switches.
- Enable the feature with runtime detection for FVP and Arm FPGA.

Please note that the *basic* FEAT_LS64 feature does not feature any trap
bits, it's only the addition of the ACCDATA_EL1 system register that
adds these traps and the SCR_EL3 bits.

Change-Id: Ie3e2ca2d9c4fbbd45c0cc6089accbb825579138a
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

build(bl31): support separated memory for RW DATA

Update linker file and init codes to allow using separated
memory region for RW DATA. Init codes will copy the RW DATA
from the image to the linked

build(bl31): support separated memory for RW DATA

Update linker file and init codes to allow using separated
memory region for RW DATA. Init codes will copy the RW DATA
from the image to the linked address.

On some NXP platforms, after the BL31 image has been verified,
the bl31 image space will be locked/protected as RO only, so
need to move the RW DATA and NOBITS out of the bl31 image.

Signed-off-by: Ye Li <ye.li@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Change-Id: I361d9a715890961bf30790a3325f8085a40c0c39

show more ...

Merge "build: fix grouped targets on Make <= 4.2" into integration

Merge "feat(d128): add support for FEAT_D128" into integration

build: fix grouped targets on Make <= 4.2

Grouped targets are a feature introduced with GNU Make 4.3 which enable
rules with multiple targets to communicate that all of the targets of
that rule are

build: fix grouped targets on Make <= 4.2

Grouped targets are a feature introduced with GNU Make 4.3 which enable
rules with multiple targets to communicate that all of the targets of
that rule are built simultaneously, rather than independently.

For example, without grouped targets the following rule may be executed
twice:

a.txt b.txt:
touch a.txt b.txt

# $ remake -j2 a.txt b.txt
# touch a.txt b.txt
# touch a.txt b.txt

In this example, both `a.txt` and `b.txt` are touched twice, when the
rule should only be executed once. Instead, this rule can use a grouped
target:

a.txt b.txt &:
touch a.txt b.txt

# $ remake -j2 a.txt b.txt
# touch a.txt b.txt
# remake: 'b.txt' is up to date.

In this case, both `a.txt` and `b.txt` are created once only, as Make
now knows that the recipe will create both files.

Note that pattern rules with multiple targets always behave this way.

Previously, we assumed that the grouped target feature was available,
but on systems still packaging Make 4.2, most prominently Ubuntu 20.04,
this is not the case. This change adds a check to ensure that we do not
use grouped targets if they are unavailable.

Change-Id: Ifd9da35421ae11468d7a25d3cbc76f6036921749
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

Merge "fix(mte): remove deprecated CTX_INCLUDE_MTE_REGS/FEAT_MTE" into integration

feat(d128): add support for FEAT_D128

This patch disables trapping to EL3 when the FEAT_D128
specific registers are accessed by setting the SCR_EL3.D128En bit.

If FEAT_D128 is implemented, then FEA

feat(d128): add support for FEAT_D128

This patch disables trapping to EL3 when the FEAT_D128
specific registers are accessed by setting the SCR_EL3.D128En bit.

If FEAT_D128 is implemented, then FEAT_SYSREG128 is implemented.
With FEAT_SYSREG128 certain system registers are treated as 128-bit,
so we should be context saving and restoring 128-bits instead of 64-bit
when FEAT_D128 is enabled.

FEAT_SYSREG128 adds support for MRRS and MSRR instruction which
helps us to read write to 128-bit system register.
Refer to Arm Architecture Manual for further details.

Change the FVP platform to default to handling this as a dynamic option
so the right decision can be made by the code at runtime.

Change-Id: I1a53db5eac29e56c8fbdcd4961ede3abfcb2411a
Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(mte): remove deprecated CTX_INCLUDE_MTE_REGS/FEAT_MTE

Remove all instances of macros CTX_INCLUDE_MTE_REGS and FEAT_MTE
since these have been deprecated in v2.11

Change-Id: I7838a865755326f03668

fix(mte): remove deprecated CTX_INCLUDE_MTE_REGS/FEAT_MTE

Remove all instances of macros CTX_INCLUDE_MTE_REGS and FEAT_MTE
since these have been deprecated in v2.11

Change-Id: I7838a865755326f03668e43768140929a2d9e418
Signed-off-by: Sona Mathew <sonarebecca.mathew@arm.com>

show more ...