refactor(build): absorb CFLAGS into TF_CFLAGS

CFLAGS is the standard and expected variable for passing flags to the
compiler. The build system also uses TF_CFLAGS to define its own flags.
But the bu

refactor(build): absorb CFLAGS into TF_CFLAGS

CFLAGS is the standard and expected variable for passing flags to the
compiler. The build system also uses TF_CFLAGS to define its own flags.
But the build rules need to specify both. So append CFLAGS to TF_CFLAGS
so that only the latter needs to be passed.

Change-Id: I4abb6c9dfc252a805063691e8a100f0ec0c785ad
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): use a standard rule to run the preprocessor

There are a few, functionally identical, ways to call the preprocessor
on a non-C file, depending on the file. They differ in subtle, not

refactor(build): use a standard rule to run the preprocessor

There are a few, functionally identical, ways to call the preprocessor
on a non-C file, depending on the file. They differ in subtle, not
entirely correct, ways - one is missing a dependency to the makefiles,
another generates its .d inline, and the prints are different. That has
resulted in platforms reimplementing this functionality, making the
build brittle - a change to the overall build system doesn't propagate.
So add a MAKE_PRE macro that will make a rule with all the bells and
whistles to run the preprocessor on an arbitrary file.

This patch converts the arm platforms' cot_descriptors DTS rules. The
files are renamed to fit with the build rule and all extra flags are
dropped. Those flags are only necessary for building BL2 c files, which
will be passed to the output C file. Only the DTS flags are needed for
the preprocessing step, which will be passed automatically.

Change-Id: I3c1cc0ecf93b87d828f868214928c1bc9bcb5758
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): place all cflags setting in one place

The top-level Makefile has to come up with a list of flags to pass to
the compiler. It has to do so while considering a variety of options and

refactor(build): place all cflags setting in one place

The top-level Makefile has to come up with a list of flags to pass to
the compiler. It has to do so while considering a variety of options and
constraints. This has generally done in the most convenient place in the
file. However, it causes problems with evaluation - options may be set
after they are used, there may be platform dependencies, DEFINES, etc.
As a result flags must be lazily evaluated and they lack any cohesive
design.

To enable a solution to this, extract all CFLAGS/LDFLAGS/ASFLAGS
configuration to a new file. Reorder rules slightly to put related rules
closer together and call the entire thing as late as possible - after
platform.mk and after the DEFINES are known.

There is a small number of libraries that set flags in their own sub
makefiles. As these contain the entire feature, do not move their flags
to keep them self-contained. This is okay as these makefile will be
evaluated before the cflags.

Change-Id: I1b6f69adbf885396632949966b77a5710d1c851d
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): simplify ENABLE_LTO checking

We do not support LTO with AArch32. The standard way to enforce this is
by having a rule to fail the build when this happens. There are no
AArch32 platf

refactor(build): simplify ENABLE_LTO checking

We do not support LTO with AArch32. The standard way to enforce this is
by having a rule to fail the build when this happens. There are no
AArch32 platforms which (incorrectly) try to enable LTO, so add this
rule. The benefit is that we no longer have to check the ENABLE_LTO with
ARCH whenever it is used.

Change-Id: Ic4086a1f5122269bda1d75bd4474b98fde35b5af
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_FGWTE3

Enable write traps for key EL3 system registers as per FEAT_FGWTE3,
ensuring their values remain unchanged after boot.

Excluded Registers:
MDCR_EL3 and MP

feat(cpufeat): add support for FEAT_FGWTE3

Enable write traps for key EL3 system registers as per FEAT_FGWTE3,
ensuring their values remain unchanged after boot.

Excluded Registers:
MDCR_EL3 and MPAM3_EL3: Not trapped as they are part of the EL3 context.
SCTLR_EL3: Not trapped since it is overwritten during
powerdown sequence(Included when HW_ASSISTED_COHERENCY=1)

TPIDR_EL3: Excluded due to its use in crash reporting(It is included
when CRASH_REPORTING=0)

Reference:
https://developer.arm.com/documentation/ddi0601/2025-06/AArch64-Registers/FGWTE3-EL3--Fine-Grained-Write-Traps-EL3

Change-Id: Idcb32aaac7d65a0b0e5c90571af00e01a4e9edb1
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>

show more ...

feat(build): put fiptool in the build directory

For some reason, tools are not built in the build directory, but rather
in the source directory, regardless of what BUILD_BASE might say. This
is espe

feat(build): put fiptool in the build directory

For some reason, tools are not built in the build directory, but rather
in the source directory, regardless of what BUILD_BASE might say. This
is especially annoying when trying to have a few builds going at the
same time (like in a CI). For example, run A may check if a file X
exists. Seeing that it does not, it will start building the file. At the
same time, run B may also check if file X exists but before A has
written it, starting a build again. Then it is possible for A to use the
file it believes to have built right at the moment B begins writing to
it (and truncating it beforehand). This results in gcc failing to read a
fail and a failed build. The more parallel runs there are, the more
likely this is to happen, and this is virtually guaranteed to happen
with just a handful onwards.

So move fiptool and all of its build artefacts to the build directory.
Since there are platform differences between the various fiptool
incarnations, this goes in the plat build rather than a more top-level
location.

This patch adds the build macro MAKE_TOOL to do this generically for any
kind of tool since the other tools suffer from the same shortfall. This
macro takes care to use unique names for every type of argument that
building a tool might need. The fiptool makefile and platform add-ons
are updated accordingly.

This should have never been allowed in the first place, but downstream
scripts almost certainly depend on this behaviour now. So add a symlink
in the place of the old fiptool so these continue working. With any
luck, this will be removed in the future.

Change-Id: I3d4d87dab0f53deab5b43fbc6652146f0e4e7e81
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): initialise `arch-features` closer to where it is needed

Change-Id: I9bc7b609e7cb5aa42528ba151b5a30c386de0792
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

refactor(build): define the W and DEBUG flags in the standard way

We have the assert_boolean section where DEBUG belongs and W should have
an initial value (of 0) and only be allowed to be a number.

refactor(build): define the W and DEBUG flags in the standard way

We have the assert_boolean section where DEBUG belongs and W should have
an initial value (of 0) and only be allowed to be a number.

Change-Id: Ie56dc9659f32c8a202f4506bc27e8bbf84c0f73f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(build): put the cross referencing of options together

We have an immense number of incompatible options and several places to
check them, making things hard to follow and leading to some
du

refactor(build): put the cross referencing of options together

We have an immense number of incompatible options and several places to
check them, making things hard to follow and leading to some
duplication. Previous attempts at reordering helped in the short term
but things have slowly deteriorated again.

Tackle this by introducing a single file to do all cross referencing of
all options. This should remove any ambiguity as to where these go.

No functional change besides relative ordering in the top-level Makefile.

Change-Id: Ic57d46bf602bd34d3af45a05e4ac8ca0dfcd1f7b
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): remove redundant variables

The PLAT_BL_* family of variables were intended as the platform
interface to the build system. Unfortunately, only
PLAT_BL_COMMON_SOURCES has caught on and the

fix(build): remove redundant variables

The PLAT_BL_* family of variables were intended as the platform
interface to the build system. Unfortunately, only
PLAT_BL_COMMON_SOURCES has caught on and the rest remain totally
unused. As there is no ongoing effort to change that, those flags are
only noise in the makefiles. Remove them to simplify.

Change-Id: I3ad715fa7859a28cf92d3897421f7b88cdea23cc
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(dsu): support power control and autonomous powerdown config

This patch allows platforms to enable certain DSU settings
to ensure memory retention and control over
cache power requests. We also

feat(dsu): support power control and autonomous powerdown config

This patch allows platforms to enable certain DSU settings
to ensure memory retention and control over
cache power requests. We also move the driver out of css
into drivers/arm. Platforms can configure the
CLUSTERPWRCTLR and CLUSTERPWRDN registers [1] to improve
power efficiency.

These registers enable finer-grained control of
DSU power state transitions, including
powerdown and retention.

IMP_CLUSTERPWRCTLR_EL1 provides:
- Functional retention: Allows configuration of the
duration of inactivity before the DSU uses
CLUSTERPACTIVE to request functional retention.

- Cache power request: These bits are output on
CLUSTERPACTIVE[19:16] to indicate to the power controller
which cache portions must remain powered.

IMP_CLUSTERPWRDN_EL1 includes:
- Powerdown: Triggers full cluster powerdown, including
control logic.

- Memory retention: Requests memory retention mode,
keeping L3 RAM contents while powering off
the rest of the DSU.

The DSU-120 TRM [2] provides the full field definitions,
which are used as references in the `dsu_driver_data` structure.

References:
[1]: https://developer.arm.com/documentation/100453/latest/
[2]: https://developer.arm.com/documentation/102547/0201/?lang=en

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I2eba808b8f2a27797782a333c65dd092b03208fe

show more ...

feat(lfa): create LFA SMC handler template

As per the specification v1.0[1], added all Live Firmware Activation
(LFA) SMCs, including their Function IDs (FIDs) and associated error
codes.
A dummy ha

feat(lfa): create LFA SMC handler template

As per the specification v1.0[1], added all Live Firmware Activation
(LFA) SMCs, including their Function IDs (FIDs) and associated error
codes.
A dummy handler function has been created as a template. Subsequent
patches will implement the handling of these SMCs.

[1]: https://developer.arm.com/documentation/den0147/latest/

Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Change-Id: I5d6500dcff35aa4a438cd5f97f349cd57406ddce

show more ...

feat(gicv5): add support for building with gicv5

The Generic Interrupt Controller v5 (GICv5) is the next generation of
Arm interrupt controllers. It is a clean slate design and has native
support fo

feat(gicv5): add support for building with gicv5

The Generic Interrupt Controller v5 (GICv5) is the next generation of
Arm interrupt controllers. It is a clean slate design and has native
support for the latest Armv9 features. As such it is entirely backwards
incompatible with GICv3/v4.

This patch adds the necessary boilerplate to select a build with GICv5.
The GIC has always had two parts. BL31 deals directly with the CPU
interface while platform code is responsible for managing the IRI. In v5
this split is formalised and the CPU interface, FEAT_GCIE, may be
implemented on its own. So reflect this split in our code with
ENABLE_FEAT_GCIE which only affects BL31 and the GICv5 IRI lies in the
generic GIC driver.

No actual functionality yet.

Change-Id: I97a0c3ba708877c213e50e7ef148e3412aa2af90
Co-developed-by: Achin Gupta <achin.gupta@arm.com>
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(build): remove SUPPORT_STACK_MEMTAG

This flag enables the memtag sanitizer in clang. However, for this to
work, other generic and platform-specific logic is required that was
never implemented.

fix(build): remove SUPPORT_STACK_MEMTAG

This flag enables the memtag sanitizer in clang. However, for this to
work, other generic and platform-specific logic is required that was
never implemented. So in effect, the feature is half-baked and at best a
simple test (of which we have plenty in tftf) or a NOP at worst.

So remove the option to simplify code a little.

Change-Id: Iab4150871c89545d813c5ae14be67bf6459d051a
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): add support for FEAT_PAUTH_LR

This patch enables FEAT_PAUTH_LR at EL3 on systems that support it when
the new ENABLE_FEAT_PAUTH_LR flag is set.

Currently, PAUTH_LR is only supported

feat(cpufeat): add support for FEAT_PAUTH_LR

This patch enables FEAT_PAUTH_LR at EL3 on systems that support it when
the new ENABLE_FEAT_PAUTH_LR flag is set.

Currently, PAUTH_LR is only supported by arm clang compiler and not GCC.

Change-Id: I7db1e34b661ed95cad75850b62878ac5d98466ea
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

refactor(gic): promote most of the GIC driver to common code

More often than not, Arm based systems include some revision of a GIC.
There are two ways of adding support for them in platform code - c

refactor(gic): promote most of the GIC driver to common code

More often than not, Arm based systems include some revision of a GIC.
There are two ways of adding support for them in platform code - calling
the top-level helpers from plat/arm/common/arm_gicvX.c or by using the
driver directly. Both of these methods allow for a high degree of
customisation - most functions are defined to be weak and there are no
calls to any of them in generic code.

As it turns out, requirements around those GICs are largely the same.
Platforms that use arm_gicvX.c use the helpers identically among each
other. Platforms that use the driver directly tend to end up with calls
that look a lot like the arm_gicvX.c helpers and the weakness of the
functions are never exercised.

All of this results in a lot of code duplication to do what is
essentially the same thing. Even though it's not a lot of code, when
multiplied among many platforms it becomes significant and makes
refactoring it quite difficult. It's also bug prone since the steps are
a little convoluted and things are likely to work even with subtle
errors (see 50009f61177421118f42d6a000611ba0e613d54b).

So promote as much of the GIC to be called from common code. Do the
setup in bl31_main() and have every PSCI method do the state management
directly instead of delegating it to the platform hooks. We can base
this implementation on arm_gicvX.c since they already offer logical
names and have worked quite well so far with minimal changes.

The main benefit of doing this is reduced code duplication. If we assume
that, outside of some platform setup, GIC management is identical, then
a platform can add support by telling the build system, regardless of
GIC revision. The other benefit is performance - BL31 and PSCI already
know the core_pos and they can pass it as an argument instead of having
to call plat_my_core_pos(). Now, the only platform specific GIC actions
necessary are the saving and restoring of context on entering and
exiting a power domain. The PSCI library does not keep track of this so
it is unable perform it itself. The routines themselves are also
provided.

For compatibility all of this is hidden behind a build flag. Platforms
are encouraged to adopt this driver, but it would not be practical to
convert and validate every GIC based platform.

This patch renames the functions in question to follow the
gic_<function>() convention. This allows the names to be version
agnostic.

Finally, drop the weak definitions - they are unused, likely to remain
so, and can be added back if the need arises.

Change-Id: I5b5267f4b72f633fb1096400ec8e4b208694135f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(rmmd): el3-rmm ide key management interface

Patch introduces the EL3-RMM SMC Interface for Root Port
Key management as per RFC discussed here:
https://github.com/TF-RMM/tf-rmm/wiki/RFC:-EL3-RMM

feat(rmmd): el3-rmm ide key management interface

Patch introduces the EL3-RMM SMC Interface for Root Port
Key management as per RFC discussed here:
https://github.com/TF-RMM/tf-rmm/wiki/RFC:-EL3-RMM-IDE-KM-Interface

Three IDE Key management smc calls have been added:
- RMM_IDE_KEY_PROG()
- RMM_IDE_KEY_SET_GO()
- RMM_IDE_KEY_SET_STOP()
- RMM_IDE_KM_PULL_RESPONSE()

Due to the absence of root port support in FVP, we are
currently adding placeholders in this patch for the platform
APIs to return success irrespective of the arguments being passed
by the caller(Realms). The SMCs are guarded by
`RMMD_ENABLE_IDE_KEY_PROG` build flag and is disabled by default.
We expect that once the SMCs are stabilized, this build flag will
not be required anymore.

Change-Id: I9411eb7787dac2a207bd14710d251503bd9626ce
Signed-off-by: Sona Mathew <sonarebecca.mathew@arm.com>

show more ...

feat(tpm): add tpm drivers and framework

Add tpm2 drivers to tf-a with adequate framework
-implement a fifo spi interface that works
with discrete tpm chip.
-implement tpm command layer interfaces

feat(tpm): add tpm drivers and framework

Add tpm2 drivers to tf-a with adequate framework
-implement a fifo spi interface that works
with discrete tpm chip.
-implement tpm command layer interfaces that are used
to initialize, start and make measurements and
close the interface.
-tpm drivers are built using their own make file
to allow for ease in porting across platforms,
and across different interfaces.

Signed-off-by: Tushar Khandelwal <tushar.khandelwal@arm.com>
Signed-off-by: Abhi Singh <abhi.singh@arm.com>
Change-Id: Ie1a189f45c80f26f4dea16c3bd71b1503709e0ea

show more ...

feat(rmmd): add FEAT_MEC support

This patch provides architectural support for further use of
Memory Encryption Contexts (MEC) by declaring the necessary
registers, bits, masks, helpers and values a

feat(rmmd): add FEAT_MEC support

This patch provides architectural support for further use of
Memory Encryption Contexts (MEC) by declaring the necessary
registers, bits, masks, helpers and values and modifying the
necessary registers to enable FEAT_MEC.

Signed-off-by: Tushar Khandelwal <tushar.khandelwal@arm.com>
Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: I670dbfcef46e131dcbf3a0b927467ebf6f438fa4

show more ...

feat(arm): add initrd props to dtb at build time

Add initrd properties to the device tree blob at build time, giving
users the ability to run a linux kernel and successfully boot it to
the terminal.

feat(arm): add initrd props to dtb at build time

Add initrd properties to the device tree blob at build time, giving
users the ability to run a linux kernel and successfully boot it to
the terminal. Users can boot a linux kernel in a normal flow as well
as in RESET_TO_BL31. This function is an extension of the build time
option "ARM_LINUX_KERNEL_AS_BL33=1".

The build time options INITRD_SIZE or INITRD_PATH will trigger the
insertion of initrd properties in to the DTB. If both options are
provided then the INITRD_SIZE will take precedence.

The available options are:
INITRD_SIZE: Provide the initrd size in dec or hex (hex format must
precede with '0x'.
Example: INITRD_SIZE=0x1000000

INITRD_PATH: Provide an initrd path for the build time to find its
exact size.

INITRD_BASE: A required build time option that sets the initrd base
address in hex format. A default value can be set by the platform.
Example: INITRD_BASE=0x90000000

Change-Id: Ief8de5f00c453509bcc6e978e0a95d768f1f509c
Signed-off-by: Salman Nabi <salman.nabi@arm.com>

show more ...

perf(amu): greatly simplify AMU context management

The current code is incredibly resilient to updates to the spec and
has worked quite well so far. However, recent implementations expose a
weakness

perf(amu): greatly simplify AMU context management

The current code is incredibly resilient to updates to the spec and
has worked quite well so far. However, recent implementations expose a
weakness in that this is rather slow. A large part of it is written in
assembly, making it opaque to the compiler for optimisations. The
future proofness requires reading registers that are effectively
`volatile`, making it even harder for the compiler, as well as adding
lots of implicit barriers, making it hard for the microarchitecutre to
optimise as well.

We can make a few assumptions, checked by a few well placed asserts, and
remove a lot of this burden. For a start, at the moment there are 4
group 0 counters with static assignments. Contexting them is a trivial
affair that doesn't need a loop. Similarly, there can only be up to 16
group 1 counters. Contexting them is a bit harder, but we can do with a
single branch with a falling through switch. If/when both of these
change, we have a pair of asserts and the feature detection mechanism to
guard us against pretending that we support something we don't.

We can drop contexting of the offset registers. They are fully
accessible by EL2 and as such are its responsibility to preserve on
powerdown.

Another small thing we can do, is pass the core_pos into the hook.
The caller already knows which core we're running on, we don't need to
call this non-trivial function again.

Finally, knowing this, we don't really need the auxiliary AMUs to be
described by the device tree. Linux doesn't care at the moment, and any
information we need for EL3 can be neatly placed in a simple array.

All of this, combined with lifting the actual saving out of assembly,
reduces the instructions to save the context from 180 to 40, including a
lot fewer branches. The code is also much shorter and easier to read.

Also propagate to aarch32 so that the two don't diverge too much.

Change-Id: Ib62e6e9ba5be7fb9fb8965c8eee148d5598a5361
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

perf(mpmm): greatly simplify MPMM enablement

MPMM is a core-specific microarchitectural feature. It has been present
in every Arm core since the Cortex-A510 and has been implemented in
exactly the s

perf(mpmm): greatly simplify MPMM enablement

MPMM is a core-specific microarchitectural feature. It has been present
in every Arm core since the Cortex-A510 and has been implemented in
exactly the same way. Despite that, it is enabled more like an
architectural feature with a top level enable flag. This utilised the
identical implementation.

This duality has left MPMM in an awkward place, where its enablement
should be generic, like an architectural feature, but since it is not,
it should also be core-specific if it ever changes. One choice to do
this has been through the device tree.

This has worked just fine so far, however, recent implementations expose
a weakness in that this is rather slow - the device tree has to be read,
there's a long call stack of functions with many branches, and system
registers are read. In the hot path of PSCI CPU powerdown, this has a
significant and measurable impact. Besides it being a rather large
amount of code that is difficult to understand.

Since MPMM is a microarchitectural feature, its correct placement is in
the reset function. The essence of the current enablement is to write
CPUPPMCR_EL3.MPMM_EN if CPUPPMCR_EL3.MPMMPINCTL == 0. Replacing the C
enablement with an assembly macro in each CPU's reset function achieves
the same effect with just a single close branch and a grand total of 6
instructions (versus the old 2 branches and 32 instructions).

Having done this, the device tree entry becomes redundant. Should a core
that doesn't support MPMM arise, this can cleanly be handled in the
reset function. As such, the whole ENABLE_MPMM_FCONF and platform hooks
mechanisms become obsolete and are removed.

Change-Id: I1d0475b21a1625bb3519f513ba109284f973ffdf
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes I765a7fa0,Ic33f0b6d,I8d1a88c7,I381f96be,I698fa849, ... into integration

* changes:
fix(cpus): clear CPUPWRCTLR_EL1.CORE_PWRDN_EN_BIT on reset
chore(docs): drop the "wfi" from `pwr_

Merge changes I765a7fa0,Ic33f0b6d,I8d1a88c7,I381f96be,I698fa849, ... into integration

* changes:
fix(cpus): clear CPUPWRCTLR_EL1.CORE_PWRDN_EN_BIT on reset
chore(docs): drop the "wfi" from `pwr_domain_pwr_down_wfi`
chore(psci): drop skip_wfi variable
feat(arm): convert arm platforms to expect a wakeup
fix(cpus): avoid SME related loss of context on powerdown
feat(psci): allow cores to wake up from powerdown
refactor: panic after calling psci_power_down_wfi()
refactor(cpus): undo errata mitigations
feat(cpus): add sysreg_bit_toggle

show more ...

feat(cpus): add ENABLE_ERRATA_ALL flag

Now that all errata flags are all conveniently in a single list we can
make sweeping decisions about their values. The first use-case is to
enable all errata i

feat(cpus): add ENABLE_ERRATA_ALL flag

Now that all errata flags are all conveniently in a single list we can
make sweeping decisions about their values. The first use-case is to
enable all errata in TF-A. This is useful for CI runs where it is
impractical to list every single one. This should help with the long
standing issue of errata not being built or tested.

Also add missing CPUs with errata to `ENABLE_ERRATA_ALL` to enable all
errata builds in CI.

Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I2b456d304d7bf3215c7c4f4fd70b56ecbcb09979

show more ...

fix(cpus): avoid SME related loss of context on powerdown

Travis' and Gelas' TRMs tell us to disable SME (set PSTATE.{ZA, SM} to
0) when we're attempting to power down. What they don't tell us is th

fix(cpus): avoid SME related loss of context on powerdown

Travis' and Gelas' TRMs tell us to disable SME (set PSTATE.{ZA, SM} to
0) when we're attempting to power down. What they don't tell us is that
if this isn't done, the powerdown request will be rejected. On the
CPU_OFF path that's not a problem - we can force SVCR to 0 and be
certain the core will power off.

On the suspend to powerdown path, however, we cannot do this. The TRM
also tells us that the sequence could also be aborted on eg. GIC
interrupts. If this were to happen when we have overwritten SVCR to 0,
upon a return to the caller they would experience a loss of context. We
know that at least Linux may call into PSCI with SVCR != 0. One option
is to save the entire SME context which would be quite expensive just to
work around. Another option is to downgrade the request to a normal
suspend when SME was left on. This option is better as this is expected
to happen rarely enough to ignore the wasted power and we don't want to
burden the generic (correct) path with needless context management.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I698fa8490ebf51461f6aa8bba84f9827c5c46ad4

show more ...