feat(spmd): support for extended partition info descriptor

This patch adds the support for extended partition info descriptor
added in FF-A v1.3 ALP2 specification. It enables the LSP, managed by
SP

feat(spmd): support for extended partition info descriptor

This patch adds the support for extended partition info descriptor
added in FF-A v1.3 ALP2 specification. It enables the LSP, managed by
SPMD, to query the properties of a physical SP.

This is necessary to implement support for live activation of an SP
uniquely identified by its Image UUID.

BREAKING CHANGE: Temporarily fails to build but recovers in subsequent
patches.

Change-Id: Ibb2dab3124ab1838fb954f3d47e11b52e82ca7ca
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

fix(optee): match variable type

This corrects MISRA violation C2012-10.3:
The value of an expression shall not be assigned to an object with a
narrower essential type or of a different essential typ

fix(optee): match variable type

This corrects MISRA violation C2012-10.3:
The value of an expression shall not be assigned to an object with a
narrower essential type or of a different essential type category.
Changed type of variable to match return type.

Change-Id: I9415e05f602c6723ba627dc630501f41747b0c14
Signed-off-by: Sai Varun Venkatapuram <saivarun.venkatapuram@amd.com>

show more ...

fix(lfa): update activation_pending flag on SUCCESS

This patch updates the 'activation_pending' only if the activator
was able to successfully activate the component. The expectation
is that the cal

fix(lfa): update activation_pending flag on SUCCESS

This patch updates the 'activation_pending' only if the activator
was able to successfully activate the component. The expectation
is that the caller will either re-issue the activation or issue
the LFA_CANCEL command.

Change-Id: I1079a544adfbb90c7189e98a4fac991273a2fe30
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

show more ...

docs(cpus): explain why the ARCH_WORKAROUND_3 pseudo-erratum is needed

This caused quite a lot of confusion when cores affected by the
respective CVEs did not return SMC_WA_DO (0) when queried for t

docs(cpus): explain why the ARCH_WORKAROUND_3 pseudo-erratum is needed

This caused quite a lot of confusion when cores affected by the
respective CVEs did not return SMC_WA_DO (0) when queried for the
respective workarounds. Add a comment so this doesn't happen again.

Change-Id: I740486a239b40e4813841a936760855d93fb62cf
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

revert(cm): don't context switch GICv3 registers on NS<->RL transitions

This reverts commit c84cf19308299de9ad68c340a4c4744a0fe2f18a.

Reason: Linux Boot in Realm test fails with this patch because

revert(cm): don't context switch GICv3 registers on NS<->RL transitions

This reverts commit c84cf19308299de9ad68c340a4c4744a0fe2f18a.

Reason: Linux Boot in Realm test fails with this patch because the
NS sets up ich_hcr_el2 which is not expected by RMMv1.0. The GICv3
context switch changes will need to wait till RMM migrates to
RMMv2.0.

Change-Id: I39185bd08f35bc0836d2ef199c5d930d62ee23d2
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

show more ...

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targetin

fix(cm): don't context switch GICv3 registers on NS<->RL transitions

The GICv3 is architectured to solely manage interrupts targeted to
Normal and Secure world. It doesn't manage interrupts targeting the
more recently introduced Realm world. Hence the new RMMv2.0
specification mandates that EL3 should not save and restore
the GIC registers on a world switch. This change is backward
compatible with RMMv1.x ABI.

NOTE: Change in implementation of cm_el2_sysregs_context_save()
and cm_el2_sysregs_context_restore() API as GIC state is not
managed by these APIs anymore.

Change-Id: I24d7fa26503ffad9d9fede21d8449f481e32984e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Signed-off-by: Shruti Gupta <shruti.gupta@arm.com>

show more ...

Merge "fix(build): use assignment instead of memcpy to avoid a GCC 11 bug" into integration

fix(cpus): return ERRATA_MISSING when errata not found

There are 2 cases in which an erratum will not be found in the list:
a) there is no workaround implemented
b) there is a workaround implemented

fix(cpus): return ERRATA_MISSING when errata not found

There are 2 cases in which an erratum will not be found in the list:
a) there is no workaround implemented
b) there is a workaround implemented but it has not been compiled in

Neither case implies that the erratum does not apply - for option a) it
could mean that the erratum is newer than TF-A's awareness and in option
b) it could mean that the flag was forgotten to be set.

Unfortunately, this can't be done in isolation and must be accompanied
by untangling the complicated relationship between CVE identifiers and
the return codes to ensure everything remains the same. First, make
the CVE_2017_5715 and CVE_2022_23960 relationship in the WA_3 SMC call
explicit instead of relying on the checker functions. Then, add semantic
defines for the return values of the workarounds as 0, 1, and -1 are
ambiguous and confusing. This allows the application of a consistent
return pattern.

Change-Id: Ibfae2cd06212dc59b4730a6dca6e9aee1f341609
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

style(smccc): group the ARCH_WORKAROUND_Xs together

Instead of separating them with ARCH_FEATURE_AVAILABILITY. Also remove
the fallthrough annotation as there is nothing that can fall through.

Chan

style(smccc): group the ARCH_WORKAROUND_Xs together

Instead of separating them with ARCH_FEATURE_AVAILABILITY. Also remove
the fallthrough annotation as there is nothing that can fall through.

Change-Id: I82c507a5d4e0c4b05ceccda893ad141a9733b7f4
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(spmd): support FFA DIRECT_REQ2 for logical SP

The FFA_MSG_SEND_DIRECT_REQ2 support is added in SPMD logical
SP. This is required by certain secure partitions that needs
this type of direct requ

feat(spmd): support FFA DIRECT_REQ2 for logical SP

The FFA_MSG_SEND_DIRECT_REQ2 support is added in SPMD logical
SP. This is required by certain secure partitions that needs
this type of direct request instead of older FFA_MSG_SEND_DIRECT_REQ.

The common logic is implemented in a helper function, the handlers
for FFA_MSG_SEND_DIRECT_REQ and FFA_MSG_SEND_DIRECT_REQ2 are just
wrappers with appropriate arguments.

Change-Id: Ia82923bcd4f6a6dbedd591b771b17b998b76d0c3
Signed-off-by: Bo Yan <byan@nvidia.com>

show more ...

fix(drtm): map DLME and DRTM parameter region as execute-never

Replace MT_MEMORY | MT_NS | MT_RO with MT_NS | MT_RO_DATA for the DRTM
parameter and DLME dynamic mappings. This maps the regions as re

fix(drtm): map DLME and DRTM parameter region as execute-never

Replace MT_MEMORY | MT_NS | MT_RO with MT_NS | MT_RO_DATA for the DRTM
parameter and DLME dynamic mappings. This maps the regions as read-only
data and execute-never. This is as per DRTM specification.

Change-Id: I3e0f555e9a26726389a7c5f6b4fef65cb4078ee2
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(optee): initialize the structure

This corrects the MISRA violation C2012-9.1:
Initialize the structure with memset to ensures the structure
contains predictable zero values before being passed t

fix(optee): initialize the structure

This corrects the MISRA violation C2012-9.1:
Initialize the structure with memset to ensures the structure
contains predictable zero values before being passed to functions,
preventing potential undefined behavior from uninitialized
automatic storage.

Change-Id: Ib89b45b8aeefa211afacc77f948a5888815f9e68
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement. Enclosed statement body

fix(optee): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement. Enclosed statement body within the curly
braces.

Change-Id: Ic8523f1d6ffa367c1ea3753de367a9c88008b55d
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): add parenthesis for macro expressions

This corrects MISRA violation C2012‑20.7:
macro parameters used within expressions
were not enclosed in parentheses, risking
incorrect operator prec

fix(optee): add parenthesis for macro expressions

This corrects MISRA violation C2012‑20.7:
macro parameters used within expressions
were not enclosed in parentheses, risking
incorrect operator precedence after expansion.

The fix wraps all macro parameters in expressions
with parentheses to ensure intended evaluation
order and compliance with the rule.

Change-Id: Iaf5626afab2d8d8d945caf96798e0a8b33b32e53
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): move function to conditional block

This corrects the MISRA violation C2012-8.4:
A compatible declaration shall be visible when an object or
function with external linkage is defined.

Mo

fix(optee): move function to conditional block

This corrects the MISRA violation C2012-8.4:
A compatible declaration shall be visible when an object or
function with external linkage is defined.

Moving the function definition to match its usage scope.
The function is only called within a conditional compilation
block, so it should be defined within the same conditional scope.

Change-Id: I51071c9bb18591a3017e9ae4a2de1d7fca37de16
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): add boolean type for expressions

This corrects MISRA violation C2012‑14.4:
conditional or loop constructs were using non‑Boolean
expressions directly instead of comparisons or Boolean ty

fix(optee): add boolean type for expressions

This corrects MISRA violation C2012‑14.4:
conditional or loop constructs were using non‑Boolean
expressions directly instead of comparisons or Boolean types.

The fix replaces them with explicit Boolean tests enforcing
that all controlling expressions have essentially Boolean type
and improving code clarity and type safety.

Change-Id: I150a8a674e8abf9c5409cc3d557af0e288ba1668
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): evaluate condition for boolean

This corrects the MISRA violation C2012-11.9:
The macro NULL shall be the only permitted form of integer
null pointer constant.

The condition is compared

fix(optee): evaluate condition for boolean

This corrects the MISRA violation C2012-11.9:
The macro NULL shall be the only permitted form of integer
null pointer constant.

The condition is compared with NULL to get boolean result.

Change-Id: Ib386b5a3c3a7febbbcb5da7546e72ea6269744dc
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): typecast operands to match data type

This corrects the MISRA violation C2012-10.1:

Operands of different essential types were used in
bitwise, arithmetic, or logical operations, violati

fix(optee): typecast operands to match data type

This corrects the MISRA violation C2012-10.1:

Operands of different essential types were used in
bitwise, arithmetic, or logical operations, violating
type uniformity.

The fix suffixes integer literals with 'U' to specify
them as unsigned constants, ensuring operands in
bitwise, arithmetic, or logical operations have
consistent unsigned types. This approach avoids implicit
type promotions and maintains type safety by properly
declaring the intended type of literals.

Change-Id: Iead89348f107772175bbf7768554258b0095a922
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(el3-runtime): resolve essential-type mismatch

This resolves MISRA C:2012 Rule 10.7 violation
where a composite expression involved operands of differing
essential types, causing unintended impli

fix(el3-runtime): resolve essential-type mismatch

This resolves MISRA C:2012 Rule 10.7 violation
where a composite expression involved operands of differing
essential types, causing unintended implicit conversions.

The fix ensures all operands in the expression have matching
essential types by introducing explicit casts,
preventing unsafe or inconsistent arithmetic operations.

Change-Id: If01dfe78e7a5cffc8b0efa6ac969b262e236852b
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(spmd): remove a racy assert in g0 int. handler

handle_interrupt_exception calls plat_ic_get_pending_interrupt_type to
perform a first triage and route to the corresponding interrupt handler
base

fix(spmd): remove a racy assert in g0 int. handler

handle_interrupt_exception calls plat_ic_get_pending_interrupt_type to
perform a first triage and route to the corresponding interrupt handler
based on the interrupt type.
A registered handler must not assume that the HPPI hasn't changed from
the top level handler until reaching to it. The first thing a handler
must do is attempting to acknowledge the interrupt and process it if
it's a valid INTID. Meanwhile, it may have happened the interrupt has
been acknowledged by another PE, or another high priority interrupt got
asserted, or any other valid reason for the HPPI to change.
The reasoning is the same for an interrupt delegated by lower EL through
the FFA_EL3_INTR_HANDLE interface. For a G0 interrupt triggered while
secure world runs, the first triage is done by lower EL e.g. S-EL2 and
routes it to EL3 for handling. Once there, the HPPI might have changed
so the same rules as above apply.

Remove the assert from SPMD g0 interrupt handlers that is reading again
the HPPI which may unwillingly trigger in a racy situation.

Change-Id: I35f30ec3c0358953301e2b99949a6b758dabf36c
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

show more ...

Merge "feat(spm-mm): fix wrong range of SPM_MM" into integration

fix(build): use assignment instead of memcpy to avoid a GCC 11 bug

GCC11 has a bug where it may produce an incorrect warning "writing 1 or
more bytes into a region of size 0 overflows the destinatio

fix(build): use assignment instead of memcpy to avoid a GCC 11 bug

GCC11 has a bug where it may produce an incorrect warning "writing 1 or
more bytes into a region of size 0 overflows the destination" when using
memcpy and memset [0]. Since we use -Werror, this warning is fatal and
prevents building certain configurations with GCC11. Enabling LTO makes
the problem worse as the compiler has more visibility to do a wider
analysis.

This patch fixes this by using syntactic assignment rather than library
functions in the places that most often cause problems. GCC11 is able to
correctly analyse those scenarios and does not emit a warning. There is
a slight upside to this in that it may be able to produce more optimal
code.

[0]: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106199

Change-Id: I897e6360b8619ba1d4587d3abf84ffdd31f17273
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(drtm): use crypto-agile measured boot

Update the DRTM boot flow to use the crypto-agile API. Replace the
previous single-algorithm hash configuration with dynamic algorithm
selection. Align

refactor(drtm): use crypto-agile measured boot

Update the DRTM boot flow to use the crypto-agile API. Replace the
previous single-algorithm hash configuration with dynamic algorithm
selection. Align image measurement and event log header generation with
the new hashing model and update platform glue code accordingly.

Change-Id: I22930440476895c23dbd4e04502757d2f6726e33
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge changes I6e44c7f1,Id4320cbf,Ibb05dd47,Icec70861 into integration

* changes:
fix(morello): don't define get_mem_client_mode() when it won't be used
fix(rdn2): don't use V1 as a label
fix(

Merge changes I6e44c7f1,Id4320cbf,Ibb05dd47,Icec70861 into integration

* changes:
fix(morello): don't define get_mem_client_mode() when it won't be used
fix(rdn2): don't use V1 as a label
fix(tspd): don't forward declare tsp_vectors_t
fix(cpufeat): drop feature_panic() as unused

show more ...

feat(spm-mm): fix wrong range of SPM_MM

According to SMCCC specification [1],
Table 6-4: Reserved Standard Secure Service Call range,

fid 0x40-0x4f are reserved for Management Mode,
fid 0x50-0x5f a

feat(spm-mm): fix wrong range of SPM_MM

According to SMCCC specification [1],
Table 6-4: Reserved Standard Secure Service Call range,

fid 0x40-0x4f are reserved for Management Mode,
fid 0x50-0x5f are reserved for TRNG interface and
fid 0x60-0x7f are not reserved yet for Standard Secure Service Calls
and current SPM_MM's implementation uses the 0x40-0x4f and 0x60-0x7f fids.

However, the is_spm_mm_fid() is checking TRNG range too
so it returns false positive and
TRNG request couldn't be handled properly.

To resolve this, remove the TRNG range check in is_spm_mm_fid().

Link: https://developer.arm.com/documentation/den0028/latest/ [1]
Change-Id: Ide41cf3451412676f604e31f3d88aeb2e601c5f2
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...