feat(romlib): add PSA Crypto ROMLIB support

Adding PSA Crypto MBedTLS specific jump table to allow use of ROMLIB, to
be included when PSA_CRYPTO=1 and enabled.

Signed-off-by: Lauren Wehrmeister <la

feat(romlib): add PSA Crypto ROMLIB support

Adding PSA Crypto MBedTLS specific jump table to allow use of ROMLIB, to
be included when PSA_CRYPTO=1 and enabled.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iff7f0e3c5cba6b89f1732f6c80d3060498e3675d

show more ...

chore: rename arcadia to Cortex-A320

Cortex-A320 has been announced, rename arcadia to Cortex-A320.

Ref:
https://newsroom.arm.com/blog/introducing-arm-cortex-a320-cpu
https://www.arm.com/products/s

chore: rename arcadia to Cortex-A320

Cortex-A320 has been announced, rename arcadia to Cortex-A320.

Ref:
https://newsroom.arm.com/blog/introducing-arm-cortex-a320-cpu
https://www.arm.com/products/silicon-ip-cpu/cortex-a/cortex-a320

Change-Id: Ifb3743d43dca3d8caaf1e7416715ccca4fdf195f
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

feat(fvp): add stub function to retrieve DLME image auth features

DLME image authentication features are currently not supported on FVP.
This patch introduces a stub function in fvp_drtm_stub.c as a

feat(fvp): add stub function to retrieve DLME image auth features

DLME image authentication features are currently not supported on FVP.
This patch introduces a stub function in fvp_drtm_stub.c as a
placeholder for retrieving DLME image authentication features.

Change-Id: I6d274834245774c5442d67ee93fcd641f3a9cd1a
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

feat(fvp): add stub platform function to get ACPI table region size

Introduces a stub platform function for FVP to retrieve the ACPI table
region size.

Change-Id: Icbf1ae0cb89c393502de2c2f4f66df6b5

feat(fvp): add stub platform function to get ACPI table region size

Introduces a stub platform function for FVP to retrieve the ACPI table
region size.

Change-Id: Icbf1ae0cb89c393502de2c2f4f66df6b510e6b81
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

Merge changes from topic "bk/errata_speed" into integration

* changes:
refactor(cpus): declare runtime errata correctly
perf(cpus): make reset errata do fewer branches
perf(cpus): inline the i

Merge changes from topic "bk/errata_speed" into integration

* changes:
refactor(cpus): declare runtime errata correctly
perf(cpus): make reset errata do fewer branches
perf(cpus): inline the init_cpu_data_ptr function
perf(cpus): inline the reset function
perf(cpus): inline the cpu_get_rev_var call
perf(cpus): inline cpu_rev_var checks
refactor(cpus): register DSU errata with the errata framework's wrappers
refactor(cpus): convert checker functions to standard helpers
refactor(cpus): convert the Cortex-A65 to use the errata framework
fix(cpus): declare reset errata correctly

show more ...

refactor(cpus): register DSU errata with the errata framework's wrappers

The existing DSU errata workarounds hijack the errata framework's inner
workings to register with it. However, that is undesi

refactor(cpus): register DSU errata with the errata framework's wrappers

The existing DSU errata workarounds hijack the errata framework's inner
workings to register with it. However, that is undesirable as any change
to the framework may end up missing these workarounds. So convert the
checks and workarounds to macros and have them included with the
standard wrappers.

The only problem with this is the is_scu_present_in_dsu weak function.
Fortunately, it is only needed for 2 of the errata and only on 3 cores.
So drop it, assuming the default behaviour and have the callers handle
the exception.

Change-Id: Iefa36325804ea093e938f867b9a6f49a6984b8ae
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(rme): map DEVICE0_BASE as EL3_PAS

To pass SMMUv3 Realm Page 0 address to RMM
in Boot Manifest, BL31 needs to read SMMU_ROOT_IDR0
register. BL31 at EL3 runs in Root mode, but
CoreSight and periph

fix(rme): map DEVICE0_BASE as EL3_PAS

To pass SMMUv3 Realm Page 0 address to RMM
in Boot Manifest, BL31 needs to read SMMU_ROOT_IDR0
register. BL31 at EL3 runs in Root mode, but
CoreSight and peripherals at DEVICE0_BASE
(0x2000_0000) including SMMUv3 at 0x2B40_0000 are
mapped as MT_SECURE which results in RAZ access
to all SMMUv3 registers after enabling MMU.
This patch changes MT_SECURE mapping to EL3_PAS
resulting in MT_SECURE (ENABLE_RME = 0), and
MT_ROOT (ENABLE_RME = 1).

Change-Id: I3d9ae7c86e4836dd6722fa64116a14d8c8aed8da
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>

show more ...

Merge changes from topic "memory_bank" into integration

* changes:
fix(qemu): statically allocate bitlocks array
feat(qemu): update for renamed struct memory_bank
feat(fvp): increase GPT PPS t

Merge changes from topic "memory_bank" into integration

* changes:
fix(qemu): statically allocate bitlocks array
feat(qemu): update for renamed struct memory_bank
feat(fvp): increase GPT PPS to 1TB
feat(gpt): statically allocate bitlocks array
chore(gpt): define PPS in platform header files
feat(fvp): allocate L0 GPT at the top of SRAM
feat(fvp): change size of PCIe memory region 2
feat(rmm): add PCIe IO info to Boot manifest
feat(fvp): define single Root region

show more ...

Merge changes I765a7fa0,Ic33f0b6d,I8d1a88c7,I381f96be,I698fa849, ... into integration

* changes:
fix(cpus): clear CPUPWRCTLR_EL1.CORE_PWRDN_EN_BIT on reset
chore(docs): drop the "wfi" from `pwr_

Merge changes I765a7fa0,Ic33f0b6d,I8d1a88c7,I381f96be,I698fa849, ... into integration

* changes:
fix(cpus): clear CPUPWRCTLR_EL1.CORE_PWRDN_EN_BIT on reset
chore(docs): drop the "wfi" from `pwr_domain_pwr_down_wfi`
chore(psci): drop skip_wfi variable
feat(arm): convert arm platforms to expect a wakeup
fix(cpus): avoid SME related loss of context on powerdown
feat(psci): allow cores to wake up from powerdown
refactor: panic after calling psci_power_down_wfi()
refactor(cpus): undo errata mitigations
feat(cpus): add sysreg_bit_toggle

show more ...

feat(fvp): increase GPT PPS to 1TB

- Increase PPS for FVP from 64GB to 1TB.
- GPT L0 table for 1TB PPS requires 8KB memory.
- Set FVP_TRUSTED_SRAM_SIZE to 384 with ENABLE_RME=1
option.
- Add 256MB

feat(fvp): increase GPT PPS to 1TB

- Increase PPS for FVP from 64GB to 1TB.
- GPT L0 table for 1TB PPS requires 8KB memory.
- Set FVP_TRUSTED_SRAM_SIZE to 384 with ENABLE_RME=1
option.
- Add 256MB of PCIe memory region 1 and 3GB of
PCIe memory region 2 to FVP PAS regions array.

Change-Id: Icadd528576f53c55b5d461ff4dcd357429ba622a
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>

show more ...

feat(gpt): statically allocate bitlocks array

Statically allocate 'gpt_bitlock' array of fine-grained
'bitlock_t' data structures in arm_bl31_setup.c.
The amount of memory needed for this array is c

feat(gpt): statically allocate bitlocks array

Statically allocate 'gpt_bitlock' array of fine-grained
'bitlock_t' data structures in arm_bl31_setup.c.
The amount of memory needed for this array is controlled
by 'RME_GPT_BITLOCK_BLOCK' build option and 'PLAT_ARM_PPS'
macro defined in platform_def.h which specifies the size
of protected physical address space in bytes.
'PLAT_ARM_PPS' takes values from 4GB to 4PB supported by
Arm architecture.

Change-Id: Icf620b5039e45df6828d58fca089cad83b0bc669
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>

show more ...

chore(gpt): define PPS in platform header files

Define protected physical address size in bytes
PLAT_ARM_PPS macro for FVP and RDV3 in platform_def.h
files.

Change-Id: I7f6529dfbb8df864091fbefc0813

chore(gpt): define PPS in platform header files

Define protected physical address size in bytes
PLAT_ARM_PPS macro for FVP and RDV3 in platform_def.h
files.

Change-Id: I7f6529dfbb8df864091fbefc08131a0e6d689eb6
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>

show more ...

feat(fvp): allocate L0 GPT at the top of SRAM

This patch allocates level 0 GPT at the top of SRAM
for FVP. This helps to meet L0 GPT alignment requirements
and prevent the occurrence of possible unu

feat(fvp): allocate L0 GPT at the top of SRAM

This patch allocates level 0 GPT at the top of SRAM
for FVP. This helps to meet L0 GPT alignment requirements
and prevent the occurrence of possible unused gaps in SRAM.
Load addresses for FVP TB_FW, SOC_FW and TOS_FW DTBs are
defined in fvp_fw_config.dts via ARM_BL_RAM_BASE macro.

Change-Id: Iaa52e302373779d9fdbaf4e1ba40c10aa8d1f8bd
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>

show more ...

feat(rmm): add PCIe IO info to Boot manifest

- Add PCIe and SMMUv3 related information to DTS for
configurations with ENABLE_RME=1.
- Add entries for PCIe IO memory regions to Boot manifest
- Upda

feat(rmm): add PCIe IO info to Boot manifest

- Add PCIe and SMMUv3 related information to DTS for
configurations with ENABLE_RME=1.
- Add entries for PCIe IO memory regions to Boot manifest
- Update RMMD_MANIFEST_VERSION_MINOR from 3 to 4.
- Read PCIe related information from DTB and write it to
Boot manifest.
- Rename structures that used to describe DRAM layout
and now describe both DRAM and PCIe IO memory regions:
- ns_dram_bank -> memory_bank
- ns_dram_info -> memory_info.

Change-Id: Ib75d1af86076f724f5c330074e231f1c2ba8e21d
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>

show more ...

feat(fvp): define single Root region

For FVP model define single Root PAS which
includes EL3 DRAM data, L1 GPTs and SCP TZC.
This allows to decrease the number of PAS
regions passed to GPT library a

feat(fvp): define single Root region

For FVP model define single Root PAS which
includes EL3 DRAM data, L1 GPTs and SCP TZC.
This allows to decrease the number of PAS
regions passed to GPT library and use GPT
mapping with Contiguous descriptor of
larger block size.

Change-Id: I70f6babaebc14e5e0bce033783ec423c8a26c542
Signed-off-by: AlexeiFedorov <Alexei.Fedorov@arm.com>

show more ...

feat(cpus): add ENABLE_ERRATA_ALL flag

Now that all errata flags are all conveniently in a single list we can
make sweeping decisions about their values. The first use-case is to
enable all errata i

feat(cpus): add ENABLE_ERRATA_ALL flag

Now that all errata flags are all conveniently in a single list we can
make sweeping decisions about their values. The first use-case is to
enable all errata in TF-A. This is useful for CI runs where it is
impractical to list every single one. This should help with the long
standing issue of errata not being built or tested.

Also add missing CPUs with errata to `ENABLE_ERRATA_ALL` to enable all
errata builds in CI.

Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I2b456d304d7bf3215c7c4f4fd70b56ecbcb09979

show more ...

feat(arm): convert arm platforms to expect a wakeup

Newer cores in upcoming platforms may refuse to power down. The PSCI
library is already prepared for this so convert platform code to also
allow t

feat(arm): convert arm platforms to expect a wakeup

Newer cores in upcoming platforms may refuse to power down. The PSCI
library is already prepared for this so convert platform code to also
allow this. This is simple - drop the `wfi` + panic and let common code
deal with the fallout. The end result will be the same (sans the
message) except the platform will have fewer responsibilities. The only
exception is for cores being signalled to power off gracefully ahead of
system reset. That path must also be terminal so replace the end with
the same psci_pwrdown_cpu_end() to behave the same as the generic
implementation. It will handle wakeups and panic, hoping that the system
gets reset from under it. The dmb is upgraded to a dsb so no functional
change.

Change-Id: I381f96bec8532bda6ccdac65de57971aac42e7e8
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cpus): avoid SME related loss of context on powerdown

Travis' and Gelas' TRMs tell us to disable SME (set PSTATE.{ZA, SM} to
0) when we're attempting to power down. What they don't tell us is th

fix(cpus): avoid SME related loss of context on powerdown

Travis' and Gelas' TRMs tell us to disable SME (set PSTATE.{ZA, SM} to
0) when we're attempting to power down. What they don't tell us is that
if this isn't done, the powerdown request will be rejected. On the
CPU_OFF path that's not a problem - we can force SVCR to 0 and be
certain the core will power off.

On the suspend to powerdown path, however, we cannot do this. The TRM
also tells us that the sequence could also be aborted on eg. GIC
interrupts. If this were to happen when we have overwritten SVCR to 0,
upon a return to the caller they would experience a loss of context. We
know that at least Linux may call into PSCI with SVCR != 0. One option
is to save the entire SME context which would be quite expensive just to
work around. Another option is to downgrade the request to a normal
suspend when SME was left on. This option is better as this is expected
to happen rarely enough to ignore the wasted power and we don't want to
burden the generic (correct) path with needless context management.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I698fa8490ebf51461f6aa8bba84f9827c5c46ad4

show more ...

feat(psci): allow cores to wake up from powerdown

The simplistic view of a core's powerdown sequence is that power is
atomically cut upon calling `wfi`. However, it turns out that it has
lots to do

feat(psci): allow cores to wake up from powerdown

The simplistic view of a core's powerdown sequence is that power is
atomically cut upon calling `wfi`. However, it turns out that it has
lots to do - it has to talk to the interconnect to exit coherency, clean
caches, check for RAS errors, etc. These take significant amounts of
time and are certainly not atomic. As such there is a significant window
of opportunity for external events to happen. Many of these steps are
not destructive to context, so theoretically, the core can just "give
up" half way (or roll certain actions back) and carry on running. The
point in this sequence after which roll back is not possible is called
the point of no return.

One of these actions is the checking for RAS errors. It is possible for
one to happen during this lengthy sequence, or at least remain
undiscovered until that point. If the core were to continue powerdown
when that happens, there would be no (easy) way to inform anyone about
it. Rejecting the powerdown and letting software handle the error is the
best way to implement this.

Arm cores since at least the a510 have included this exact feature. So
far it hasn't been deemed necessary to account for it in firmware due to
the low likelihood of this happening. However, events like GIC wakeup
requests are much more probable. Older cores will powerdown and
immediately power back up when this happens. Travis and Gelas include a
feature similar to the RAS case above, called powerdown abandon. The
idea is that this will improve the latency to service the interrupt by
saving on work which the core and software need to do.

So far firmware has relied on the `wfi` being the point of no return and
if it doesn't explicitly detect a pending interrupt quite early on, it
will embark onto a sequence that it expects to end with shutdown. To
accommodate for it not being a point of no return, we must undo all of
the system management we did, just like in the warm boot entrypoint.

To achieve that, the pwr_domain_pwr_down_wfi hook must not be terminal.
Most recent platforms do some platform management and finish on the
standard `wfi`, followed by a panic or an endless loop as this is
expected to not return. To make this generic, any platform that wishes
to support wakeups must instead let common code call
`psci_power_down_wfi()` right after. Besides wakeups, this lets common
code handle powerdown errata better as well.

Then, the CPU_OFF case is simple - PSCI does not allow it to return. So
the best that can be done is to attempt the `wfi` a few times (the
choice of 32 is arbitrary) in the hope that the wakeup is transient. If
it isn't, the only choice is to panic, as the system is likely to be in
a bad state, eg. interrupts weren't routed away. The same applies for
SYSTEM_OFF, SYSTEM_RESET, and SYSTEM_RESET2. There the panic won't
matter as the system is going offline one way or another. The RAS case
will be considered in a separate patch.

Now, the CPU_SUSPEND case is more involved. First, to powerdown it must
wipe its context as it is not written on warm boot. But it cannot be
overwritten in case of a wakeup. To avoid the catch 22, save a copy that
will only be used if powerdown fails. That is about 500 bytes on the
stack so it hopefully doesn't tip anyone over any limits. In future that
can be avoided by having a core manage its own context.

Second, when the core wakes up, it must undo anything it did to prepare
for poweroff, which for the cores we care about, is writing
CPUPWRCTLR_EL1.CORE_PWRDN_EN. The least intrusive for the cpu library
way of doing this is to simply call the power off hook again and have
the hook toggle the bit. If in the future there need to be more complex
sequences, their direction can be advised on the value of this bit.

Third, do the actual "resume". Most of the logic is already there for
the retention suspend, so that only needs a small touch up to apply to
the powerdown case as well. The missing bit is the powerdown specific
state management. Luckily, the warmboot entrypoint does exactly that
already too, so steal that and we're done.

All of this is hidden behind a FEAT_PABANDON flag since it has a large
memory and runtime cost that we don't want to burden non pabandon cores
with.

Finally, do some function renaming to better reflect their purpose and
make names a little bit more consistent.

Change-Id: I2405b59300c2e24ce02e266f91b7c51474c1145f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "chore(fvp): use correct dts for dynamiq cores" into integration

Merge "build: remove Windows compatibility layer" into integration

feat(mops): enable FEAT_MOPS in EL3 when INIT_UNUSED_NS_EL2=1

FEAT_MOPS, mandatory from Arm v8.8, is typically managed in EL2.
However, in configurations where NS_EL2 is not enabled,
EL3 must set th

feat(mops): enable FEAT_MOPS in EL3 when INIT_UNUSED_NS_EL2=1

FEAT_MOPS, mandatory from Arm v8.8, is typically managed in EL2.
However, in configurations where NS_EL2 is not enabled,
EL3 must set the HCRX_EL2.MSCEn bit to 1 to enable the feature.

This patch ensures FEAT_MOPS is enabled by setting HCRX_EL2.MSCEn to 1.

Change-Id: Ic4960e0cc14a44279156b79ded50de475b3b21c5
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>

show more ...

build: remove Windows compatibility layer

For a couple of releases now we have officially withdrawn support for
building TF-A on Windows using the native environment, relying instead
on POSIX emulat

build: remove Windows compatibility layer

For a couple of releases now we have officially withdrawn support for
building TF-A on Windows using the native environment, relying instead
on POSIX emulation layers like MSYS2, Mingw64, Cygwin or WSL.

This change removes the remainder of the OS compatibility layer
entirely, and migrates the build system over to explicitly relying on a
POSIX environment.

Change-Id: I8fb60d998162422e958009afd17eab826e3bc39b
Signed-off-by: Chris Kay <chris.kay@arm.com>

show more ...

fix(fvp): exclude extend memory map TZC regions

The commit
192287523350 ("fix(spm-mm): carve out NS buffer TZC400 region")
removes overlaps of ns shared buffer in secure memory region.
Unfortunate

fix(fvp): exclude extend memory map TZC regions

The commit
192287523350 ("fix(spm-mm): carve out NS buffer TZC400 region")
removes overlaps of ns shared buffer in secure memory region.
Unfortunately, this separation increases 1 region and over maximum
number of TZC programmable regions when they include
extended memory map regions (DRAM3 to DRAM6).

This causes boot failure of StandaloneMm with spmc_el3 && sp_el0 with

ASSERT: drivers/arm/tzc/tzc400.c:256.

To fix this, like SPM_MM, exclude setting extended memory map regions when
it uses SPMC_AT_EL3 && SPC_AT_EL3_SEL0_SP.

Signed-off-by: Levi Yun <yeoreum.yun@arm.com>
Change-Id: I2d40bea066ca030050dfe951218cd17171010676

show more ...

feat(fvp): add StandaloneMm manifest in fvp

Support StandaloneMm running with FF-A as S-EL0 SP
when TF-A is built with EL3 SPMC partition manager.

For this
1. add manifest file describing Stand

feat(fvp): add StandaloneMm manifest in fvp

Support StandaloneMm running with FF-A as S-EL0 SP
when TF-A is built with EL3 SPMC partition manager.

For this
1. add manifest file describing StandaloneMm partition.
2. add number of page mapping area.
3. StandaloneMm should use SRAM with 512K.

while enabling, StandaloneMm, BL1 image requires more size:
aarch64-none-elf/bin/ld: BL31 image has exceeded its limit.
aarch64-none-elf/bin/ld: region `RAM' overflowed by 16384 bytes

So, when using SRAM size with 512K configuration,
increase size limit of BL1 binary.

Signed-off-by: Levi Yun <yeoreum.yun@arm.com>
Change-Id: Idaa1db510340ebb812cfd13588610b2eea941918

show more ...