feat(psci): optimise clock init on a pabandon

When a powerdown abandon happens, all state will be preserved. As such,
there is no need to re-initialise the timer counter when unwinding.

Change-Id:

feat(psci): optimise clock init on a pabandon

When a powerdown abandon happens, all state will be preserved. As such,
there is no need to re-initialise the timer counter when unwinding.

Change-Id: I64185792a118fd04ca036abbb9be8f670d0d8328
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this i

feat(psci): check that CPUs handled a pabandon

Up to now PSCI assumed that if a pabandon happened then the CPU driver
will have handled it. This patch adds a simple protocol to make sure
that this is indeed the case. The chosen method is with a return value
that is highly unlikely on cores that are unaware of pabandon (x0 will
be primed with 1 and if used should be overwritten with the value of
CPUPWRCTLR_EL1 which should have its last bit set to power off and its
top bits RES0; the ACK value is chosen to be the exact opposite). An
alternative method would have been to add a field in cpu_ops, however
that would have required more major refactoring across many cpus and
would have taken up more memory on older platforms, so it was not
chosen.

Change-Id: I5826c0e4802e104d295c4ecbd80b5f676d2cd871
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

T

feat(psci): make pabandon support generic

Support for aborted powerdowns does not require much dedicated code.
Rather, it is largely a matter of orchestrating things to happen in the
right order.

The only exception to this are older secure world dispatchers, which
assume that a CPU_SUSPEND call will be terminal and therefore can
clobber context. This was patched over in common code and hidden behind
a flag. This patch moves this to the dispatchers themselves.

Dispatchers that don't register svc_suspend{_finish} are unaffected.
Those that do must save the NS context before clobbering it and
restoring in only in case of a pabandon. Due to this operation being
non-trivial, this patch makes the assumption that these dispatchers will
only be present on hardware that does not support pabandon and therefore
does not add any contexting for them. In case this assumption ever
changes, asserts are added that should alert us of this change.

Change-Id: I94a907515b782b4d2136c0d274246cfe1d567c0e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): unify coherency exit between AArch64 and AArch32

The procedure is fairly simple: if we have hardware assisted coherency,
call into the cpu driver and let it do its thing. If we don't

refactor(psci): unify coherency exit between AArch64 and AArch32

The procedure is fairly simple: if we have hardware assisted coherency,
call into the cpu driver and let it do its thing. If we don't, then we
must turn data caches off, handle the confusion that causes with the
stack, and call into the cpu driver which will flush the caches that
need flushing.

On AArch32 the above happens in common code. On AArch64, however, the
turning off of the caches happens in the cpu driver. Since we're dealing
with the stack, we must exercise control over it and implement this in
assembly. But as the two implementations are nominally different (in the
ordering of operations), the part that is in assembly is quite large as
jumping back to C to handle the difference might involve the stack.

Presumably, the AArch difference was introduced in order to cater for a
possible implementation where turning off the caches requires an IMP DEF
sequence. Well, Arm no longer makes cores without hardware assisted
coherency, so this eventually is not possible.

So take this part out of the cpu driver and put it into common code,
just like in AArch32. With this, there is no longer a need call
prepare_cpu_pwr_dwn() in a different order either - we can delay it a
bit to happen after the stack management. So the two AArch-s flows
become identical. We can convert prepare_cpu_pwr_dwn() to C and leave
psci_do_pwrdown_cache_maintenance() only to exercise control over stack.

Change-Id: Ie4759ebe20bb74b60533c6a47dbc2b101875900f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called f

refactor(psci): absorb psci_power_down_wfi() into common code

The AArch64 and AArch32 variants are not that different so there is no
need for them to be in assembly. They should also not be called from
non-PSCI code as PSCI is smart enough to handle this after platform
hooks. So absorb the functions into common code.

This allows for a tiny bit of optimisation: there will be no branch
(that can be missed or non-cached) to a non-inlineable function. Then in
the terminal case we can call wfi() directly with the application of the
erratum before the loop. And finally in the wakeup case, we don't have
to explicitly clear the errata as that will happen automatically on the
second call of prepare_cpu_pwr_dwn().

The A510 erratum requires a tsb csync before the dsb+wfi combo to turn
the core off. We can do this a little bit earlier in the cpu hook and
relieve common code from the responsibility. EL3 is always a prohibited
region so the buffer will stay empty.

Change-Id: I5f950df3fb7b0736df4ce25a21f78b29896de215
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(platforms): remove usage of psci_power_down_wfi

The callers in PSCI will now call wfi() after calling the
pwr_domain_pwr_down() platform hook (previously they were mutually
exclusive). As s

refactor(platforms): remove usage of psci_power_down_wfi

The callers in PSCI will now call wfi() after calling the
pwr_domain_pwr_down() platform hook (previously they were mutually
exclusive). As such, there is no need for platforms to do this
themselves. In fact, it is strongly advisable for platforms not to do
this themselves so that the PSCI can apply any relevant errata
mitigations.

Change-Id: Ic9702edef7503996be24d984e29dfcc13bc3fcba
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cm): disable SPE/TRBE correctly

SPE and TRBE are unusual features. They have multi-bit enables whose
function is not immediately apparent and disabling them is not
straightforward.

While attemp

fix(cm): disable SPE/TRBE correctly

SPE and TRBE are unusual features. They have multi-bit enables whose
function is not immediately apparent and disabling them is not
straightforward.

While attempting to figure this out, the disables were made a mess of.
Patch fc7dca72b began changing the owning security state of SPE and
TRBE. This was first used in patch 79c0c7fac0 with calls to
spe_disable() and trbe_disbale(). However, patch 13f4a2525 reverted the
security state ownership, making the spe_disable() and trbe_disable()
redundant and their comments incorrect - the DoS protection is achieved
by the psb/tsb barriers on context switch, introduces separately in
f80887337 and 73d98e375.

Those patches got the behaviour full circle to what it was in fc7dca72b
so the disables can be fully removed for clarity.

However, the original method for disabling these features is not fully
correct - letting the "disabled" state be all zeroes made the features
seem enabled for secure world but they would trap. That is not a problem
while secure world doesn't use them, but could lead to some confusing
debugging in the future. NS and Realm worlds were not affected. This
patch fully establishes the pattern for SPE and TRBE's enablement,
documents it, and implements it such.

The description comments in the features boil down to 2 rules. There is
a third rule possible:
3. To enable TRBE/SPE for world X with a dirty buffer:
* world X owns the buffer
* trapping enabled
This is not listed as it would not work correctly with
SMCCC_ARCH_FEATURE_AVAILABILITY which relies on trapping to be disabled
to report correctly. If that is ever implemented, the SMCCC
implementation should be considered too.

Change-Id: I5588a3d5fc074c2445470954d8c3b172bec77d43
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "refactor(cm): unify RMM context" into integration

feat(mt8189): add support display driver

After a suspend/resume cycle, the display's register state reverts to
its default state. Therefore, display must set the register state
to normal, allowing t

feat(mt8189): add support display driver

After a suspend/resume cycle, the display's register state reverts to
its default state. Therefore, display must set the register state
to normal, allowing the GCE and CPU to have the authority to configure
this register.

Signed-off-by: xiandong.wang <xiandong.wang@mediatek.com>
Change-Id: I124eb0eae17d7ab263c23374b70c3b6155dc7c3a

show more ...

Merge "docs(security): security advisory for CVE-2024-7881" into integration

Merge "refactor(mediatek): move mtcmos driver to common" into integration

Merge "fix(cpus): check minor revision before applying runtime errata" into integration

refactor(cm): unify RMM context

setup_realm_context() is the de facto place to put any code that relates
to the RMM's context. It is frequently updated and contains the vast
majority of code. manage

refactor(cm): unify RMM context

setup_realm_context() is the de facto place to put any code that relates
to the RMM's context. It is frequently updated and contains the vast
majority of code. manage_extensions_realm() on the other hand is out of
date and obscure.

So absorb manage_extensions_realm() and rmm_el2_context_init() into
setup_realm_context().

We can also combine the write to sctlr_el2 for all worlds as they should
all observe the RES1 values.

Finally, the SPSR_EL2.PAN comment in the realm copy is updated.

Change-Id: I21dccad0c13301e3249db6f6e292beb5d853563e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cpus): check minor revision before applying runtime errata

Patch db9ee83432 removed cpu_rev checking for runtime errata
within cpu functions with the argument that if we're in the cpu file,
we'v

fix(cpus): check minor revision before applying runtime errata

Patch db9ee83432 removed cpu_rev checking for runtime errata
within cpu functions with the argument that if we're in the cpu file,
we've already check the MIDR and matched against the CPU. However, that
also removes the revision check which being in the cpu file does not
guarantee. Reintroduce the MIDR checking so that the revision check
happens and errata can be skipped if they don't apply.

Change-Id: I46b2ba8b524a073e02b4b5de641ae97795bc176b
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "feat(smccc): clear scr_el3.nse in smccc_arch_feature_availability" into integration

Merge "feat(libc): add __2snprintf alias for armclang-specific name mangling" into integration

feat(spm): update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface

Update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface
correspondant to FF-A v1.3 memory management protocol's
FFA_MEM_PERM_GET interfac

feat(spm): update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface

Update MM_SP_MEMORY_ATTRIBUTES_GET_AARCH64 interface
correspondant to FF-A v1.3 memory management protocol's
FFA_MEM_PERM_GET interface [0].

This adds one input/output parameter with page_count
to set search range and get the range having same permssion from
base_va.

This change is backward compatible.

Links: https://developer.arm.com/documentation/den0140/latest/
Change-Id: Ib1b19dd433ad018f0c39af3a9ac8dda41358fb02
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

show more ...

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page

feat(el3-spmc): update FFA_MEM_PERM_GET interface

Update FFA_MEM_PERM_GET interface
according to FF-A v1.3 memory management protocol modification [0].
This adds one input/output parameter with page_count
to set search range and get the range having the same
permission from base_va.

This change is backward compatible with former FF-A v1.2 interface.

Links: https://developer.arm.com/documentation/den0140/latest/
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Change-Id: I5c9679c9da1126b1df65f22a803776029ab52b12

show more ...

docs(security): security advisory for CVE-2024-7881

Add CVE-2024-7881 security advisory document.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Ide976bc8754dc94d23e76001a

docs(security): security advisory for CVE-2024-7881

Add CVE-2024-7881 security advisory document.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Ide976bc8754dc94d23e76001aaecf52556e7039a

show more ...

feat(libc): add __2snprintf alias for armclang-specific name mangling

The Arm Compiler (armclang) toolchain replaces standard library calls
like `snprintf` with renamed versions such as `__2snprintf

feat(libc): add __2snprintf alias for armclang-specific name mangling

The Arm Compiler (armclang) toolchain replaces standard library calls
like `snprintf` with renamed versions such as `__2snprintf` in
generated object files and binaries. This name mangling is part of
armclang’s internal handling of standard functions and can lead to
undefined reference errors if these symbols are not defined.

To resolve this, this patch introduces a new assembly stub for
`__2snprintf` in AArch64-specific implementation.
This stub is a minimal alias that branch directly to the
underlying `snprintf` implementation. This mirrors the existing
solution for `__0printf`, `__1printf`, and `__2printf` aliases that
redirect to `printf`.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Id64d490fc3ff19ae619af03279f30338e8aa8bba

show more ...

feat(smccc): clear scr_el3.nse in smccc_arch_feature_availability

Clear the SCR_EL3.NSE bit from the bitmask used in
SMCCC_ARCH_FEATURE_AVAILABILITY for RME.

This bit is set when FEAT_RME=1, and if

feat(smccc): clear scr_el3.nse in smccc_arch_feature_availability

Clear the SCR_EL3.NSE bit from the bitmask used in
SMCCC_ARCH_FEATURE_AVAILABILITY for RME.

This bit is set when FEAT_RME=1, and if not excluded, it leads to
an assertion failure due to unexpected bits being detected.

Change-Id: I399f63adc4814c4404705985b0816783e4626dda
Signed-off-by: Sona Mathew <SonaRebecca.Mathew@arm.com>

show more ...

Merge "fix(el3-spmc): fixed x8-x17 register handling for FFA 1.2" into integration

refactor(mediatek): move mtcmos driver to common

Move mtcmos driver to common.

Signed-off-by: irving-ch-lin <irving-ch.lin@mediatek.com>
Change-Id: Id7e0b4ca7596d75ee94bd8d8a855d1bb60f66bdc

feat(stm32mp25-fdts): enable rng nodes for ST boards

Enable RNG peripheral in device trees for ST boards STM32MP257F-DK and
STM32MP257F-EV1.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed

feat(stm32mp25-fdts): enable rng nodes for ST boards

Enable RNG peripheral in device trees for ST boards STM32MP257F-DK and
STM32MP257F-EV1.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Maxime Méré <maxime.mere@foss.st.com>
Change-Id: Ib220a866e75d3383f43596c7bcfdcad590c541a4

show more ...

feat(stm32mp2): prepare DDR secure area encryption

The RISAF4 defines the DDR secure areas with specific security setup
(encryption). Its master key needs to be written before any activation.
This i

feat(stm32mp2): prepare DDR secure area encryption

The RISAF4 defines the DDR secure areas with specific security setup
(encryption). Its master key needs to be written before any activation.
This is done only if SoC supports encryption.

Change-Id: I38e6af65cadf9678a75be1b861ee0c5beea5bcb9
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>

show more ...