feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME rela

feat(gpt): move gpt support under ENABLE_FEAT_RME

Granule Protection Tables (GPT) library support is enabled only when
ENABLE_RMM is set (previously this build option was ENABLE_RME). Since
RME related support is now enabled using feature detection option
ENABLE_FEAT_RME, this patch moves GPT support under ENABLE_FEAT_RME.

This change brings in below benefits:
- single TF-A build that works for RME and non-RME systems, when
build with ENABLE_FEAT_RME=2 (FEAT_STATE_CHECK)
- RMM loading is optional on RME systems
- SiP calls that leverages RME features to change the PAS of a memory
range from non-secure to secure is supported without need to enable
Realm PAS or RMM.
- FIRME Granule Management Interface (GMI) ABIs that handles
FEAT_RME_GPC2/FEAT_RME_GDI can be enabled without need to enable RMM

Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Change-Id: I88d9d4e0491af2b4ae0307c018f2d4a71ee6693f

show more ...

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full

feat(rme): split off ENABLE_FEAT_RME

ENABLE_RME currently controls multiple, distinct aspects of RME support,
including forcing BL2 to EL3, ROOT world page table setup, GPT
initialization, and full RMM loading and handling.

While full CCA support requires all of these steps, some systems running
on FEAT_RME-capable cores do not need or want an RMM. However, such
systems still require TF-A page table entries to set the .NSE bit so
that TF-A accesses are correctly attributed to the ROOT world,
otherwise, enabling the MMU may cause the system to hang.

To address this, a new build option, ENABLE_FEAT_RME, is introduced. It
handles only the .NSE PTE setup and ignores the rest of the RME/RMM
initialization. ENABLE_FEAT_RME follows the ENABLE_FEAT_* convention and
supports values 0–2, with 2 enabling runtime detection.

Full RME functionality remains gated by ENABLE_RME, which now implicitly
enables ENABLE_FEAT_RME, allowing TF-A to run safely on FEAT_RME systems
without requiring an RMM.

Change-Id: I8391652842ff2e62a73b61829c6250c3805d4a4e
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targetin

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targeting the
more recently introduced Realm world. Hence the new RMMv2.0
specification mandates that EL3 should not save and restore
the GIC registers on a world switch. This change is not backward
compatible with RMMv1.x ABI.

Note the change in implementation of cm_el2_sysregs_context_save()
and cm_el2_sysregs_context_restore() API as GIC state is not
managed by these APIs anymore.

Add new build flag RMM_V1_COMPAT to support backward compatibility
with RMMv1.x. This flag is currently enabled by default.

This patch is a reworked version of the original patch at:
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/45658

NOTE: If RMM_V1_COMPAT is not enabled, then RMM_EL3_IFC_VERSION
is bumped to 1.0 which makes it incompatible with an RMM supporting
0.x.

Change-Id: If4c53b85ef31091c254b383ed7b32c39124f0dbb
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

feat(spmd): helpers for SP live activation framework messages

This patch provides helper functions that enable an LSP to send
appropriate framework messages to SPMC in order to orchestrate
live acti

feat(spmd): helpers for SP live activation framework messages

This patch provides helper functions that enable an LSP to send
appropriate framework messages to SPMC in order to orchestrate
live activation of a physical SP.

BREAKING CHANGE: Temporarily fails to build

Change-Id: I1b7dcf91e08fc7d85b47f2b39330d1351f8294dd
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

feat(spmd): support for extended partition info descriptor

This patch adds the support for extended partition info descriptor
added in FF-A v1.3 ALP2 specification. It enables the LSP, managed by
SP

feat(spmd): support for extended partition info descriptor

This patch adds the support for extended partition info descriptor
added in FF-A v1.3 ALP2 specification. It enables the LSP, managed by
SPMD, to query the properties of a physical SP.

This is necessary to implement support for live activation of an SP
uniquely identified by its Image UUID.

BREAKING CHANGE: Temporarily fails to build but recovers in subsequent
patches.

Change-Id: Ibb2dab3124ab1838fb954f3d47e11b52e82ca7ca
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

revert(cm): don't context switch GICv3 registers on NS<->RL transitions

This reverts commit c84cf19308299de9ad68c340a4c4744a0fe2f18a.

Reason: Linux Boot in Realm test fails with this patch because

revert(cm): don't context switch GICv3 registers on NS<->RL transitions

This reverts commit c84cf19308299de9ad68c340a4c4744a0fe2f18a.

Reason: Linux Boot in Realm test fails with this patch because the
NS sets up ich_hcr_el2 which is not expected by RMMv1.0. The GICv3
context switch changes will need to wait till RMM migrates to
RMMv2.0.

Change-Id: I39185bd08f35bc0836d2ef199c5d930d62ee23d2
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

show more ...

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targetin

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targeting the
more recently introduced Realm world. Hence the new RMMv2.0
specification mandates that EL3 should not save and restore
the GIC registers on a world switch. This change is backward
compatible with RMMv1.x ABI.

NOTE: Change in implementation of cm_el2_sysregs_context_save()
and cm_el2_sysregs_context_restore() API as GIC state is not
managed by these APIs anymore.

Change-Id: I24d7fa26503ffad9d9fede21d8449f481e32984e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

feat(spmd): support FFA DIRECT_REQ2 for logical SP

The FFA_MSG_SEND_DIRECT_REQ2 support is added in SPMD logical
SP. This is required by certain secure partitions that needs
this type of direct requ

feat(spmd): support FFA DIRECT_REQ2 for logical SP

The FFA_MSG_SEND_DIRECT_REQ2 support is added in SPMD logical
SP. This is required by certain secure partitions that needs
this type of direct request instead of older FFA_MSG_SEND_DIRECT_REQ.

The common logic is implemented in a helper function, the handlers
for FFA_MSG_SEND_DIRECT_REQ and FFA_MSG_SEND_DIRECT_REQ2 are just
wrappers with appropriate arguments.

Change-Id: Ia82923bcd4f6a6dbedd591b771b17b998b76d0c3
Signed-off-by: Bo Yan <byan@nvidia.com>

show more ...

fix(spmd): remove a racy assert in g0 int. handler

handle_interrupt_exception calls plat_ic_get_pending_interrupt_type to
perform a first triage and route to the corresponding interrupt handler
base

fix(spmd): remove a racy assert in g0 int. handler

handle_interrupt_exception calls plat_ic_get_pending_interrupt_type to
perform a first triage and route to the corresponding interrupt handler
based on the interrupt type.
A registered handler must not assume that the HPPI hasn't changed from
the top level handler until reaching to it. The first thing a handler
must do is attempting to acknowledge the interrupt and process it if
it's a valid INTID. Meanwhile, it may have happened the interrupt has
been acknowledged by another PE, or another high priority interrupt got
asserted, or any other valid reason for the HPPI to change.
The reasoning is the same for an interrupt delegated by lower EL through
the FFA_EL3_INTR_HANDLE interface. For a G0 interrupt triggered while
secure world runs, the first triage is done by lower EL e.g. S-EL2 and
routes it to EL3 for handling. Once there, the HPPI might have changed
so the same rules as above apply.

Remove the assert from SPMD g0 interrupt handlers that is reading again
the HPPI which may unwillingly trigger in a racy situation.

Change-Id: I35f30ec3c0358953301e2b99949a6b758dabf36c
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

show more ...

feat(per-cpu): migrate spm_core_context to per-cpu framework

migrate spm_core_context objects to the NUMA-aware per-cpu framework to
optimize memory access and to efficiently utilize memory.

Signed

feat(per-cpu): migrate spm_core_context to per-cpu framework

migrate spm_core_context objects to the NUMA-aware per-cpu framework to
optimize memory access and to efficiently utilize memory.

Signed-off-by: Sammit Joshi <sammit.joshi@arm.com>
Signed-off-by: Rohit Mathew <rohit.mathew@arm.com>
Change-Id: Ie600ae755cfb738adde51cfc4af3cddbbccbbaef

show more ...

perf(spmd): don't initialise context on boot, do it on CPU_ON

Normal and Realm worlds setup their contexts whenever a core comes
online. This speeds up boot and as a side effect allows any cores tha

perf(spmd): don't initialise context on boot, do it on CPU_ON

Normal and Realm worlds setup their contexts whenever a core comes
online. This speeds up boot and as a side effect allows any cores that
are never turned on to not be initialised.

So do this for spmd's Secure world too. This makes all three worlds
consistent.

Change-Id: I8676d2a03a472074176e4db06910fc2b6cbf269a
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes from topic "rustspmc_with_xferlist" into integration

* changes:
feat(fvp): introduce fvp_stmm_bl2_sp_list.dts for StandaloneMm
feat(fvp): update evtlog info in the xferlist's DT_SP

Merge changes from topic "rustspmc_with_xferlist" into integration

* changes:
feat(fvp): introduce fvp_stmm_bl2_sp_list.dts for StandaloneMm
feat(fvp): update evtlog info in the xferlist's DT_SPMC_MANIFEST entry
feat(fvp): move PLAT_ARM_SPMC_SP_MANIFEST_SIZE definition
feat(spmd): get spmc manifest from xferlist

show more ...

feat(spmd): support for FFA_ABORT invocation from SWd

SPMC can propagate abort handling to SPMD when an SP specifies suitable
abort action in its manifest. SPMD panics upon receiving FFA_ABORT from

feat(spmd): support for FFA_ABORT invocation from SWd

SPMC can propagate abort handling to SPMD when an SP specifies suitable
abort action in its manifest. SPMD panics upon receiving FFA_ABORT from
SPMC.

Change-Id: I3b573fdfc203c3446b1d629f579e333162d5ff72
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

feat(spmd): get spmc manifest from xferlist

When TRANSFER_LIST build option is used, arg0 doesn't pass the
SPMC manifest. but it should be passed to load SPMC.

For this, adds the spmc manifest entr

feat(spmd): get spmc manifest from xferlist

When TRANSFER_LIST build option is used, arg0 doesn't pass the
SPMC manifest. but it should be passed to load SPMC.

For this, adds the spmc manifest entry in the transfer list
with TL_TAG_DT_SPMC_MANIFEST tag and
let spmd load the spmc manifest from transfer list.

Change-Id: I3b84c3d8a17bba4ac94afe00e1e19044449360b0
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

feat(spmd): add FFA_NS_RES_INFO_GET ABI

Call should be forwarded to the SPMC from the NWd,
but not the other way around.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: Ic0951ffc6610c31f94fe

feat(spmd): add FFA_NS_RES_INFO_GET ABI

Call should be forwarded to the SPMC from the NWd,
but not the other way around.

Signed-off-by: J-Alves <joao.alves@arm.com>
Change-Id: Ic0951ffc6610c31f94fec5fd38f07a8081f35d94

show more ...

fix(spmd): skip spurious id while group0 interrupt handling

A spurious ID might be reported by interrupt controller when EL3 starts
handling a Group0 interrupt. This could happen if the interrupt go

fix(spmd): skip spurious id while group0 interrupt handling

A spurious ID might be reported by interrupt controller when EL3 starts
handling a Group0 interrupt. This could happen if the interrupt got
deasserted while the EL3 software triages it.

Change-Id: I3b0e0d9203fec4c0c76b9704eee53f2208ae64c9
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

fix(el3-spmc): fixed x8-x17 register handling for FFA 1.2

Changed spmd_smc_switch_state to return all 18 registers for 64 bit
calls, and set x8-17 to zero if necessary.

BREAKING CHANGE: Zeroes or f

fix(el3-spmc): fixed x8-x17 register handling for FFA 1.2

Changed spmd_smc_switch_state to return all 18 registers for 64 bit
calls, and set x8-17 to zero if necessary.

BREAKING CHANGE: Zeroes or forwards a different set of registers,
depending on the FF-A version of the source and destination.
E.g. a call from a v1.1 caller to a v1.2 destination will zero
out the extended registers, which is different from the old behavior
of forwarding everything to EL2 SPMC, but only x0-x7 to the EL3 SPMC.

Change-Id: Ic31755af0fbb117b0ed74565fba9decebab353c4
Signed-off-by: Jay Monkman <jmonkman@google.com>
Signed-off-by: Andrei Homescu <ahomescu@google.com>

show more ...

fix(spmd): check pwr mgmt status for SPMC framework response

The direct message response received by the SPMD upon a CPU_OFF power
management operation must be a framework message. If message indica

fix(spmd): check pwr mgmt status for SPMC framework response

The direct message response received by the SPMD upon a CPU_OFF power
management operation must be a framework message. If message indicates
SPMC denied the CPU_OFF operation, SPMD shall panic.

However, if SPMC does not support receiving power management
related framework messages from SPMD, it will return FFA_ERROR.
In such case, SPMD takes an implementation defined choice to ignore the
the FFA_ERROR and proceed with power management operation.

Change-Id: I18b9ee3fb8fd605bcd4aaa6802c969e9d36ccbe1
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...