fix(optee): initialize the structure

This corrects the MISRA violation C2012-9.1:
Initialize the structure with memset to ensures the structure
contains predictable zero values before being passed t

fix(optee): initialize the structure

This corrects the MISRA violation C2012-9.1:
Initialize the structure with memset to ensures the structure
contains predictable zero values before being passed to functions,
preventing potential undefined behavior from uninitialized
automatic storage.

Change-Id: Ib89b45b8aeefa211afacc77f948a5888815f9e68
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement. Enclosed statement body

fix(optee): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement. Enclosed statement body within the curly
braces.

Change-Id: Ic8523f1d6ffa367c1ea3753de367a9c88008b55d
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): add parenthesis for macro expressions

This corrects MISRA violation C2012‑20.7:
macro parameters used within expressions
were not enclosed in parentheses, risking
incorrect operator prec

fix(optee): add parenthesis for macro expressions

This corrects MISRA violation C2012‑20.7:
macro parameters used within expressions
were not enclosed in parentheses, risking
incorrect operator precedence after expansion.

The fix wraps all macro parameters in expressions
with parentheses to ensure intended evaluation
order and compliance with the rule.

Change-Id: Iaf5626afab2d8d8d945caf96798e0a8b33b32e53
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): move function to conditional block

This corrects the MISRA violation C2012-8.4:
A compatible declaration shall be visible when an object or
function with external linkage is defined.

Mo

fix(optee): move function to conditional block

This corrects the MISRA violation C2012-8.4:
A compatible declaration shall be visible when an object or
function with external linkage is defined.

Moving the function definition to match its usage scope.
The function is only called within a conditional compilation
block, so it should be defined within the same conditional scope.

Change-Id: I51071c9bb18591a3017e9ae4a2de1d7fca37de16
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): add boolean type for expressions

This corrects MISRA violation C2012‑14.4:
conditional or loop constructs were using non‑Boolean
expressions directly instead of comparisons or Boolean ty

fix(optee): add boolean type for expressions

This corrects MISRA violation C2012‑14.4:
conditional or loop constructs were using non‑Boolean
expressions directly instead of comparisons or Boolean types.

The fix replaces them with explicit Boolean tests enforcing
that all controlling expressions have essentially Boolean type
and improving code clarity and type safety.

Change-Id: I150a8a674e8abf9c5409cc3d557af0e288ba1668
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): evaluate condition for boolean

This corrects the MISRA violation C2012-11.9:
The macro NULL shall be the only permitted form of integer
null pointer constant.

The condition is compared

fix(optee): evaluate condition for boolean

This corrects the MISRA violation C2012-11.9:
The macro NULL shall be the only permitted form of integer
null pointer constant.

The condition is compared with NULL to get boolean result.

Change-Id: Ib386b5a3c3a7febbbcb5da7546e72ea6269744dc
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(optee): typecast operands to match data type

This corrects the MISRA violation C2012-10.1:

Operands of different essential types were used in
bitwise, arithmetic, or logical operations, violati

fix(optee): typecast operands to match data type

This corrects the MISRA violation C2012-10.1:

Operands of different essential types were used in
bitwise, arithmetic, or logical operations, violating
type uniformity.

The fix suffixes integer literals with 'U' to specify
them as unsigned constants, ensuring operands in
bitwise, arithmetic, or logical operations have
consistent unsigned types. This approach avoids implicit
type promotions and maintains type safety by properly
declaring the intended type of literals.

Change-Id: Iead89348f107772175bbf7768554258b0095a922
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

fix(el3-runtime): resolve essential-type mismatch

This resolves MISRA C:2012 Rule 10.7 violation
where a composite expression involved operands of differing
essential types, causing unintended impli

fix(el3-runtime): resolve essential-type mismatch

This resolves MISRA C:2012 Rule 10.7 violation
where a composite expression involved operands of differing
essential types, causing unintended implicit conversions.

The fix ensures all operands in the expression have matching
essential types by introducing explicit casts,
preventing unsafe or inconsistent arithmetic operations.

Change-Id: If01dfe78e7a5cffc8b0efa6ac969b262e236852b
Signed-off-by: Taticharla Venkata Sai <venkatasai.taticharla@amd.com>

show more ...

Merge "fix(el3-runtime): actually check for the EA bit on exception entry" into integration

fix(el3-runtime): actually check for the EA bit on exception entry

The C conversion patch - 14320bce3 - had a typo in it that it would
bitwise or SCR_EL3 with the EA bit effectively making the check

fix(el3-runtime): actually check for the EA bit on exception entry

The C conversion patch - 14320bce3 - had a typo in it that it would
bitwise or SCR_EL3 with the EA bit effectively making the check always
true. Correct it to a bitwise and to actually check the bit.

Change-Id: I9897cd6d816f5d86024a05bd58585d5fb2ab2e1d
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "feat(st): allow the use of clang as linker" into integration

Merge changes from topic "st_clang_linker" into integration

* changes:
refactor(st): simplify rule to build .stm32 file
fix(st): use KEEP for .dtb_image and .bl2_image sections

Merge "fix(spmd): remove a racy assert in g0 int. handler" into integration

fix(cpufeat): prevent FEAT_AMU counters 2 and 3 from counting across worlds

FEAT_AMU has 4 architected counters. The lower 2, CPU_CYCLES and
CNT_CYCLES, are not considered to be side channels due to

fix(cpufeat): prevent FEAT_AMU counters 2 and 3 from counting across worlds

FEAT_AMU has 4 architected counters. The lower 2, CPU_CYCLES and
CNT_CYCLES, are not considered to be side channels due to their low
resolution and general availability of the data elsewhere. As such, they
are used for critical performance tuning and are expected to never be
turned off or context switched when switching worlds.

The upper 2 counters, INST_RETIRED and STALL_BACKEND_MEM, are different.
The data they provide is non-critical and expose new information that
could be used as a timing side channel, especially of Secure world. This
patch adds context switching of these two counters to prevent any such
side channel.

This is not done for group 1 auxiliary counters as those are IMP DEF and
are inaccessible by default unless overriden by the platform (with
AMU_RESTRICT_COUNTERS).

Change-Id: Ib4b946abb810e36736cabb9b84cd837308b4e761
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(psci): make CMOs target the whole psci_cpu_data_t

psci_cpu_data_t is tiny - on AArch64 it's 12 bytes. Cache maintenance
operations (CMOs) operate on cache lines which are much bigger - usua

refactor(psci): make CMOs target the whole psci_cpu_data_t

psci_cpu_data_t is tiny - on AArch64 it's 12 bytes. Cache maintenance
operations (CMOs) operate on cache lines which are much bigger - usually
64 bytes long. As such, issuing a cache clean for a member in the middle
of psci_cpu_data_t won't necessarily have the expected effect. The
member will be cleaned, sure, but so will the rest of the cache line
along with it. If the struct happens to straddle cache lines this will
lead to the next 52 bytes, most of which not belonging to
psci_cpu_data_t, being cleaned as well and the start of psci_cpu_data_t
not being cleaned at all.

This is not a problem because of the per-cpu (and cpu_data before it)
section - it is cache size aligned and all data within a single section
belongs to the same core so overdoing cache cleans won't have strange
side effects.

Regardless, this patch clarifies CMOs around psci_cpu_data_t by always
targeting the whole structure. To make sure there is never a situation
where it straddles cache lines and this causes weird side effect, its
alignment is set to the size of the structure to make sure it is always
on the same cache line.

Change-Id: I5d82ee6bb2ce0ed3c6a7e4abb7aa890f5e3bd0af
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

perf(cpus): reduce the footprint of errata reporting

Since the advent of spin_trylock() it's possible to combine the spinlock
with the errata_reported field. If the spinlock is only acquired with a

perf(cpus): reduce the footprint of errata reporting

Since the advent of spin_trylock() it's possible to combine the spinlock
with the errata_reported field. If the spinlock is only acquired with a
non-blocking call then a successful call means reporting should be done
and an unsuccessful one means that reporting would have been done by
whoever acquired it. This relies on the lock never being released which
this patch does. The effect is a smaller memory footprint and a smaller
runtime.

Change-Id: I215a84bd2c91e33703349c41fc59f654f7764b2f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

refactor(cpus): make errata reporting more generic

Only the backing store differs between the cpu_ops_ptr argument so
hoist that up and make things easier to follow.

Change-Id: I83710d8475a4a55046c

refactor(cpus): make errata reporting more generic

Only the backing store differs between the cpu_ops_ptr argument so
hoist that up and make things easier to follow.

Change-Id: I83710d8475a4a55046cf2eb6d16cd27b8ef0f3c3
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "feat(sptool): align SP uuids to byte words" into integration

fix(cpufeat): disable FEAT_AMU counters on context restore

The FEAT_AMU counters observe UNPREDICTABLE behaviour if written to
while counting so they must be disabled first. Further, the save happen

fix(cpufeat): disable FEAT_AMU counters on context restore

The FEAT_AMU counters observe UNPREDICTABLE behaviour if written to
while counting so they must be disabled first. Further, the save happens
on the PE's powerdown path and the restore happens on the wakeup path so
any disable will likely get lost on wakeup.

So add a disable from to the restore path. The restore path will usually
have the AMU reset and as such all counters disabled. There is a chance
though that the AMU might not have reset with the PE (which is IMPDEF)
or a pabandon might have happened so also add a check to skip disabling
the counters if they already are.

Even though reading AMU counters while they are enabled is perfectly
permissible, keep the disable so that the snapshot of saved values is
coherent. Otherwise, over many saves and restores, the values of the
later read counters could get out of sync with the ones read earlier.

Change-Id: Iefe6de44f09d8659a6118d5fea40abf82c44be16
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(per-cpu): migrate AArch32 amu_ctx to per-cpu framework

Brings it in line with AArch64.

Change-Id: I9333ea9cf07679735da169dae0fe90a8856d9801
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.

feat(per-cpu): migrate AArch32 amu_ctx to per-cpu framework

Brings it in line with AArch64.

Change-Id: I9333ea9cf07679735da169dae0fe90a8856d9801
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "fix(build): use ARM_ARCH_FEATURE instead of -march directly" into integration

Merge changes I1a57de22,If97ea5fd into integration

* changes:
feat(locks): make spin_trylock with exclusives spin until it knows the state of the lock
fix(locks): restore spin_trylock's ability

Merge changes I1a57de22,If97ea5fd into integration

* changes:
feat(locks): make spin_trylock with exclusives spin until it knows the state of the lock
fix(locks): restore spin_trylock's ability to acquire a lock

show more ...

Merge "fix(rcar3): prevent boot CPU hot unplug" into integration

fix(spmd): remove a racy assert in g0 int. handler

handle_interrupt_exception calls plat_ic_get_pending_interrupt_type to
perform a first triage and route to the corresponding interrupt handler
base

fix(spmd): remove a racy assert in g0 int. handler

handle_interrupt_exception calls plat_ic_get_pending_interrupt_type to
perform a first triage and route to the corresponding interrupt handler
based on the interrupt type.
A registered handler must not assume that the HPPI hasn't changed from
the top level handler until reaching to it. The first thing a handler
must do is attempting to acknowledge the interrupt and process it if
it's a valid INTID. Meanwhile, it may have happened the interrupt has
been acknowledged by another PE, or another high priority interrupt got
asserted, or any other valid reason for the HPPI to change.
The reasoning is the same for an interrupt delegated by lower EL through
the FFA_EL3_INTR_HANDLE interface. For a G0 interrupt triggered while
secure world runs, the first triage is done by lower EL e.g. S-EL2 and
routes it to EL3 for handling. Once there, the HPPI might have changed
so the same rules as above apply.

Remove the assert from SPMD g0 interrupt handlers that is reading again
the HPPI which may unwillingly trigger in a racy situation.

Change-Id: I35f30ec3c0358953301e2b99949a6b758dabf36c
Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

show more ...

feat(sptool): align SP uuids to byte words

The FF-A manifest UUIDs are parsed in a function to generate the
fragment for the tb fconf dts file.

The UUID must have exactly 4 little endian words so t

feat(sptool): align SP uuids to byte words

The FF-A manifest UUIDs are parsed in a function to generate the
fragment for the tb fconf dts file.

The UUID must have exactly 4 little endian words so that the the regex
in the get_uuid function can convert into canonical format. This patch
adds an assertion to catch any malformed UUID.

Moreover, the bytes.fromhex() helper expects even number of bytes.
It is possible that the hex string representing the little endian
word could have odd number of characters. For example, 0x29a has 3
characters.

This patch improves the get_uuid function to inserts 0s to the left of
the parsed value (translating `29a` to `029a`), to make sure the
bytes.fromhex can create an array of 4 integers.

Signed-off-by: J-Alves <joao.alves@arm.com>
Co-authored-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
Change-Id: I5693d03ef79f6a69b817b25f625185a98f73d885

show more ...