feat(fwu): separate bl2 image from rest of the FIP

Create a separate partition for BL2 image in the GPT.
Modify the makefile to package BL2 image and its certificates
into a different FIP image.

Ch

feat(fwu): separate bl2 image from rest of the FIP

Create a separate partition for BL2 image in the GPT.
Modify the makefile to package BL2 image and its certificates
into a different FIP image.

Change-Id: I950883ea0c393a2a063ad9e51bb963cbac742705
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support

Implement support for FEAT_MPAM_PE_BW_CTRL, allowing lower
Exception Levels to access MPAM_PE_BW_CTRL control registers
by disabling their traps to

feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support

Implement support for FEAT_MPAM_PE_BW_CTRL, allowing lower
Exception Levels to access MPAM_PE_BW_CTRL control registers
by disabling their traps to EL3.

When INIT_UNUSED_NS_EL2=1, configure MPAMBW2_EL2 in EL3 so
that MPAM_PE_BW_CTRL accesses from EL0/EL1 do not trap to EL2.

At this stage, PE-side MPAM bandwidth controls remain disabled
in EL3.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I8e359b0eb912cff3bdda109b21727a627cac3a7e

show more ...

feat(fwu): create flag for BL2 separation

Adding a flag for BL2 separation in common
Makefile, for the usage of non FVP platform

Change-Id: I45ecb6833cdbc4873ffe460fd448814d81d6fa4d
Signed-off-by:

feat(fwu): create flag for BL2 separation

Adding a flag for BL2 separation in common
Makefile, for the usage of non FVP platform

Change-Id: I45ecb6833cdbc4873ffe460fd448814d81d6fa4d
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

fix(simd): enforce FP regs context mgmt when SVE regs are enabled

Due to architectural dependency, FP register context management
needs to be enabled when SVE register context management is enabled.

fix(simd): enforce FP regs context mgmt when SVE regs are enabled

Due to architectural dependency, FP register context management
needs to be enabled when SVE register context management is enabled.
This patch adds a make-time constraint for the same.

Change-Id: I8ae52edcb10085105c6e0c5504f427093059f50d
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

Merge "feat(common): add support for kernel DT handoff convention" into integration

feat(common): add support for kernel DT handoff convention

TF-A currently supports multiple DT handoff conventions:

1. Firmware Handoff (FH): DT passed in x0, with x1–x3 carrying
additional data

feat(common): add support for kernel DT handoff convention

TF-A currently supports multiple DT handoff conventions:

1. Firmware Handoff (FH): DT passed in x0, with x1–x3 carrying
additional data.
2. Kernel-compatible handoff (ARM_LINUX_KERNEL_AS_BL33): DT passed in
x0, x1–x3 zeroed.
3. Legacy TF-A convention: DT passed in x1, with x0 used for MPIDR or
NT_FW_CONFIG.

After discussions with folks in EDK2 and U-Boot, it's clear that there
is no strict requirement for placing the DT in x1. Both projects support
x0 for Arm platforms. To standardize behavior and support firmware
handoff migration, this patch introduces USE_KERNEL_DT_CONVENTION as a
configurable build flag. When enabled, the DT will be passed in x0 for
BL33.

This aligns TF-A’s behavior with Linux boot expectations and simplifies
integration across bootloaders.

Change-Id: I6bd7154fe07cb2e16e25c058f7cf862f9ae007e7
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(build): fix Makefile syntax in constraints helpers

Make is notoriously picky about tabs vs. spaces at the beginning of a
line, and some error paths in our Makefile helpers are suffering from
thi

fix(build): fix Makefile syntax in constraints helpers

Make is notoriously picky about tabs vs. spaces at the beginning of a
line, and some error paths in our Makefile helpers are suffering from
this.

Replace the indentation by tabs with spaces when it's not a (shell)
recipe, to fix the error reporting in some cases:

$ make PLAT=fvp ENABLE_SPMD_LP=1 SPMC_AT_EL3=1
make_helpers/constraints.mk:54: *** recipe commences before first target. Stop.

Change-Id: Ie8c49c8535e4b9b968d808113aa72b9dafeef906
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): pass TF_CFLAGS to the assembler

The assembler is already invoked through the gcc/llvm wrapper so will
understand the TF_CFLAGS out of the box. TF_CFLAGS are also quite
comprehensive

refactor(build): pass TF_CFLAGS to the assembler

The assembler is already invoked through the gcc/llvm wrapper so will
understand the TF_CFLAGS out of the box. TF_CFLAGS are also quite
comprehensive. So don't duplicate the definitions and use it directly.
This also allows to absorb TF_CFLAGS_$(ARCH) and CPPFLAGS and reduce
the number of permutations of flags we pass.

Change-Id: I801cea0421dab5a07bf720be9693dce3ef220dcf
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): absorb CFLAGS into TF_CFLAGS

CFLAGS is the standard and expected variable for passing flags to the
compiler. The build system also uses TF_CFLAGS to define its own flags.
But the bu

refactor(build): absorb CFLAGS into TF_CFLAGS

CFLAGS is the standard and expected variable for passing flags to the
compiler. The build system also uses TF_CFLAGS to define its own flags.
But the build rules need to specify both. So append CFLAGS to TF_CFLAGS
so that only the latter needs to be passed.

Change-Id: I4abb6c9dfc252a805063691e8a100f0ec0c785ad
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): use a standard rule to run the preprocessor

There are a few, functionally identical, ways to call the preprocessor
on a non-C file, depending on the file. They differ in subtle, not

refactor(build): use a standard rule to run the preprocessor

There are a few, functionally identical, ways to call the preprocessor
on a non-C file, depending on the file. They differ in subtle, not
entirely correct, ways - one is missing a dependency to the makefiles,
another generates its .d inline, and the prints are different. That has
resulted in platforms reimplementing this functionality, making the
build brittle - a change to the overall build system doesn't propagate.
So add a MAKE_PRE macro that will make a rule with all the bells and
whistles to run the preprocessor on an arbitrary file.

This patch converts the arm platforms' cot_descriptors DTS rules. The
files are renamed to fit with the build rule and all extra flags are
dropped. Those flags are only necessary for building BL2 c files, which
will be passed to the output C file. Only the DTS flags are needed for
the preprocessing step, which will be passed automatically.

Change-Id: I3c1cc0ecf93b87d828f868214928c1bc9bcb5758
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): place all cflags setting in one place

The top-level Makefile has to come up with a list of flags to pass to
the compiler. It has to do so while considering a variety of options and

refactor(build): place all cflags setting in one place

The top-level Makefile has to come up with a list of flags to pass to
the compiler. It has to do so while considering a variety of options and
constraints. This has generally done in the most convenient place in the
file. However, it causes problems with evaluation - options may be set
after they are used, there may be platform dependencies, DEFINES, etc.
As a result flags must be lazily evaluated and they lack any cohesive
design.

To enable a solution to this, extract all CFLAGS/LDFLAGS/ASFLAGS
configuration to a new file. Reorder rules slightly to put related rules
closer together and call the entire thing as late as possible - after
platform.mk and after the DEFINES are known.

There is a small number of libraries that set flags in their own sub
makefiles. As these contain the entire feature, do not move their flags
to keep them self-contained. This is okay as these makefile will be
evaluated before the cflags.

Change-Id: I1b6f69adbf885396632949966b77a5710d1c851d
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): simplify ENABLE_LTO checking

We do not support LTO with AArch32. The standard way to enforce this is
by having a rule to fail the build when this happens. There are no
AArch32 platf

refactor(build): simplify ENABLE_LTO checking

We do not support LTO with AArch32. The standard way to enforce this is
by having a rule to fail the build when this happens. There are no
AArch32 platforms which (incorrectly) try to enable LTO, so add this
rule. The benefit is that we no longer have to check the ENABLE_LTO with
ARCH whenever it is used.

Change-Id: Ic4086a1f5122269bda1d75bd4474b98fde35b5af
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_FGWTE3

Enable write traps for key EL3 system registers as per FEAT_FGWTE3,
ensuring their values remain unchanged after boot.

Excluded Registers:
MDCR_EL3 and MP

feat(cpufeat): add support for FEAT_FGWTE3

Enable write traps for key EL3 system registers as per FEAT_FGWTE3,
ensuring their values remain unchanged after boot.

Excluded Registers:
MDCR_EL3 and MPAM3_EL3: Not trapped as they are part of the EL3 context.
SCTLR_EL3: Not trapped since it is overwritten during
powerdown sequence(Included when HW_ASSISTED_COHERENCY=1)

TPIDR_EL3: Excluded due to its use in crash reporting(It is included
when CRASH_REPORTING=0)

Reference:
https://developer.arm.com/documentation/ddi0601/2025-06/AArch64-Registers/FGWTE3-EL3--Fine-Grained-Write-Traps-EL3

Change-Id: Idcb32aaac7d65a0b0e5c90571af00e01a4e9edb1
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>

show more ...

feat(build): put fiptool in the build directory

For some reason, tools are not built in the build directory, but rather
in the source directory, regardless of what BUILD_BASE might say. This
is espe

feat(build): put fiptool in the build directory

For some reason, tools are not built in the build directory, but rather
in the source directory, regardless of what BUILD_BASE might say. This
is especially annoying when trying to have a few builds going at the
same time (like in a CI). For example, run A may check if a file X
exists. Seeing that it does not, it will start building the file. At the
same time, run B may also check if file X exists but before A has
written it, starting a build again. Then it is possible for A to use the
file it believes to have built right at the moment B begins writing to
it (and truncating it beforehand). This results in gcc failing to read a
fail and a failed build. The more parallel runs there are, the more
likely this is to happen, and this is virtually guaranteed to happen
with just a handful onwards.

So move fiptool and all of its build artefacts to the build directory.
Since there are platform differences between the various fiptool
incarnations, this goes in the plat build rather than a more top-level
location.

This patch adds the build macro MAKE_TOOL to do this generically for any
kind of tool since the other tools suffer from the same shortfall. This
macro takes care to use unique names for every type of argument that
building a tool might need. The fiptool makefile and platform add-ons
are updated accordingly.

This should have never been allowed in the first place, but downstream
scripts almost certainly depend on this behaviour now. So add a symlink
in the place of the old fiptool so these continue working. With any
luck, this will be removed in the future.

Change-Id: I3d4d87dab0f53deab5b43fbc6652146f0e4e7e81
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): initialise `arch-features` closer to where it is needed

Change-Id: I9bc7b609e7cb5aa42528ba151b5a30c386de0792
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

refactor(build): define the W and DEBUG flags in the standard way

We have the assert_boolean section where DEBUG belongs and W should have
an initial value (of 0) and only be allowed to be a number.

refactor(build): define the W and DEBUG flags in the standard way

We have the assert_boolean section where DEBUG belongs and W should have
an initial value (of 0) and only be allowed to be a number.

Change-Id: Ie56dc9659f32c8a202f4506bc27e8bbf84c0f73f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): put the cross referencing of options together

We have an immense number of incompatible options and several places to
check them, making things hard to follow and leading to some
du

refactor(build): put the cross referencing of options together

We have an immense number of incompatible options and several places to
check them, making things hard to follow and leading to some
duplication. Previous attempts at reordering helped in the short term
but things have slowly deteriorated again.

Tackle this by introducing a single file to do all cross referencing of
all options. This should remove any ambiguity as to where these go.

No functional change besides relative ordering in the top-level Makefile.

Change-Id: Ic57d46bf602bd34d3af45a05e4ac8ca0dfcd1f7b
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): remove redundant variables

The PLAT_BL_* family of variables were intended as the platform
interface to the build system. Unfortunately, only
PLAT_BL_COMMON_SOURCES has caught on and the

fix(build): remove redundant variables

The PLAT_BL_* family of variables were intended as the platform
interface to the build system. Unfortunately, only
PLAT_BL_COMMON_SOURCES has caught on and the rest remain totally
unused. As there is no ongoing effort to change that, those flags are
only noise in the makefiles. Remove them to simplify.

Change-Id: I3ad715fa7859a28cf92d3897421f7b88cdea23cc
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(dsu): support power control and autonomous powerdown config

This patch allows platforms to enable certain DSU settings
to ensure memory retention and control over
cache power requests. We also

feat(dsu): support power control and autonomous powerdown config

This patch allows platforms to enable certain DSU settings
to ensure memory retention and control over
cache power requests. We also move the driver out of css
into drivers/arm. Platforms can configure the
CLUSTERPWRCTLR and CLUSTERPWRDN registers [1] to improve
power efficiency.

These registers enable finer-grained control of
DSU power state transitions, including
powerdown and retention.

IMP_CLUSTERPWRCTLR_EL1 provides:
- Functional retention: Allows configuration of the
duration of inactivity before the DSU uses
CLUSTERPACTIVE to request functional retention.

- Cache power request: These bits are output on
CLUSTERPACTIVE[19:16] to indicate to the power controller
which cache portions must remain powered.

IMP_CLUSTERPWRDN_EL1 includes:
- Powerdown: Triggers full cluster powerdown, including
control logic.

- Memory retention: Requests memory retention mode,
keeping L3 RAM contents while powering off
the rest of the DSU.

The DSU-120 TRM [2] provides the full field definitions,
which are used as references in the `dsu_driver_data` structure.

References:
[1]: https://developer.arm.com/documentation/100453/latest/
[2]: https://developer.arm.com/documentation/102547/0201/?lang=en

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I2eba808b8f2a27797782a333c65dd092b03208fe

show more ...

feat(lfa): create LFA SMC handler template

As per the specification v1.0[1], added all Live Firmware Activation
(LFA) SMCs, including their Function IDs (FIDs) and associated error
codes.
A dummy ha

feat(lfa): create LFA SMC handler template

As per the specification v1.0[1], added all Live Firmware Activation
(LFA) SMCs, including their Function IDs (FIDs) and associated error
codes.
A dummy handler function has been created as a template. Subsequent
patches will implement the handling of these SMCs.

[1]: https://developer.arm.com/documentation/den0147/latest/

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I5d6500dcff35aa4a438cd5f97f349cd57406ddce

show more ...

feat(gicv5): add support for building with gicv5

The Generic Interrupt Controller v5 (GICv5) is the next generation of
Arm interrupt controllers. It is a clean slate design and has native
support fo

feat(gicv5): add support for building with gicv5

The Generic Interrupt Controller v5 (GICv5) is the next generation of
Arm interrupt controllers. It is a clean slate design and has native
support for the latest Armv9 features. As such it is entirely backwards
incompatible with GICv3/v4.

This patch adds the necessary boilerplate to select a build with GICv5.
The GIC has always had two parts. BL31 deals directly with the CPU
interface while platform code is responsible for managing the IRI. In v5
this split is formalised and the CPU interface, FEAT_GCIE, may be
implemented on its own. So reflect this split in our code with
ENABLE_FEAT_GCIE which only affects BL31 and the GICv5 IRI lies in the
generic GIC driver.

No actual functionality yet.

Change-Id: I97a0c3ba708877c213e50e7ef148e3412aa2af90
Co-developed-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): remove SUPPORT_STACK_MEMTAG

This flag enables the memtag sanitizer in clang. However, for this to
work, other generic and platform-specific logic is required that was
never implemented.

fix(build): remove SUPPORT_STACK_MEMTAG

This flag enables the memtag sanitizer in clang. However, for this to
work, other generic and platform-specific logic is required that was
never implemented. So in effect, the feature is half-baked and at best a
simple test (of which we have plenty in tftf) or a NOP at worst.

So remove the option to simplify code a little.

Change-Id: Iab4150871c89545d813c5ae14be67bf6459d051a
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_PAUTH_LR

This patch enables FEAT_PAUTH_LR at EL3 on systems that support it when
the new ENABLE_FEAT_PAUTH_LR flag is set.

Currently, PAUTH_LR is only supported

feat(cpufeat): add support for FEAT_PAUTH_LR

This patch enables FEAT_PAUTH_LR at EL3 on systems that support it when
the new ENABLE_FEAT_PAUTH_LR flag is set.

Currently, PAUTH_LR is only supported by arm clang compiler and not GCC.

Change-Id: I7db1e34b661ed95cad75850b62878ac5d98466ea
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

refactor(gic): promote most of the GIC driver to common code

More often than not, Arm based systems include some revision of a GIC.
There are two ways of adding support for them in platform code - c

refactor(gic): promote most of the GIC driver to common code

More often than not, Arm based systems include some revision of a GIC.
There are two ways of adding support for them in platform code - calling
the top-level helpers from plat/arm/common/arm_gicvX.c or by using the
driver directly. Both of these methods allow for a high degree of
customisation - most functions are defined to be weak and there are no
calls to any of them in generic code.

As it turns out, requirements around those GICs are largely the same.
Platforms that use arm_gicvX.c use the helpers identically among each
other. Platforms that use the driver directly tend to end up with calls
that look a lot like the arm_gicvX.c helpers and the weakness of the
functions are never exercised.

All of this results in a lot of code duplication to do what is
essentially the same thing. Even though it's not a lot of code, when
multiplied among many platforms it becomes significant and makes
refactoring it quite difficult. It's also bug prone since the steps are
a little convoluted and things are likely to work even with subtle
errors (see 50009f61177421118f42d6a000611ba0e613d54b).

So promote as much of the GIC to be called from common code. Do the
setup in bl31_main() and have every PSCI method do the state management
directly instead of delegating it to the platform hooks. We can base
this implementation on arm_gicvX.c since they already offer logical
names and have worked quite well so far with minimal changes.

The main benefit of doing this is reduced code duplication. If we assume
that, outside of some platform setup, GIC management is identical, then
a platform can add support by telling the build system, regardless of
GIC revision. The other benefit is performance - BL31 and PSCI already
know the core_pos and they can pass it as an argument instead of having
to call plat_my_core_pos(). Now, the only platform specific GIC actions
necessary are the saving and restoring of context on entering and
exiting a power domain. The PSCI library does not keep track of this so
it is unable perform it itself. The routines themselves are also
provided.

For compatibility all of this is hidden behind a build flag. Platforms
are encouraged to adopt this driver, but it would not be practical to
convert and validate every GIC based platform.

This patch renames the functions in question to follow the
gic_<function>() convention. This allows the names to be version
agnostic.

Finally, drop the weak definitions - they are unused, likely to remain
so, and can be added back if the need arises.

Change-Id: I5b5267f4b72f633fb1096400ec8e4b208694135f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...