fix(cpus): workaround for C1-Ultra erratum 3651221

C1-Ultra erratum 3651221 is a Cat B erratum that applies
to revision r0p0, and is fixed in r1p0.

The erratum can be avoided by disabling the affec

fix(cpus): workaround for C1-Ultra erratum 3651221

C1-Ultra erratum 3651221 is a Cat B erratum that applies
to revision r0p0, and is fixed in r1p0.

The erratum can be avoided by disabling the affected prefetcher
by setting CPUACTLR6_EL1[41] to 1.

SDEN documentation:
https://developer.arm.com/documentation/111077/8-0

Change-Id: I0498a81a62bbea666b503cdd5a6dbcae7eab0dce
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

fix(cpus): workaround for C1-Ultra erratum 3502731

C1-Ultra erratum 3502731 is a Cat B erratum that applies
to revision r0p0, and it is fixed in r1p0.

The erratum can be avoided by setting CPUACTLR

fix(cpus): workaround for C1-Ultra erratum 3502731

C1-Ultra erratum 3502731 is a Cat B erratum that applies
to revision r0p0, and it is fixed in r1p0.

The erratum can be avoided by setting CPUACTLR4[23] to 1,
which will disable Memory Renaming optimization.
The performance impact of setting this chicken bit is about
0.82% in GB6.

SDEN documentation:
https://developer.arm.com/documentation/111077/8-0

Change-Id: Iaf832b66aeed937edbb1e9be29de41b0f2b5d70c
Signed-off-by: Xialin Liu <xialin.liu@arm.com>

show more ...

Merge "fix(cpus): register ARCH_WORKAROUND_3 for Neoverse V2" into integration

fix(cpus): register ARCH_WORKAROUND_3 for Neoverse V2

Neoverse V2 never registered ARCH_WORKAROUND_3 in the errata
framework, causing SMCCC_ARCH_WORKAROUND_3 discovery to always return 1.

The SMCCC

fix(cpus): register ARCH_WORKAROUND_3 for Neoverse V2

Neoverse V2 never registered ARCH_WORKAROUND_3 in the errata
framework, causing SMCCC_ARCH_WORKAROUND_3 discovery to always return 1.

The SMCCC specification language prior to 1.6 G EAC1 was ambiguous
regarding the meaning of return value 1, leading to inconsistent
interpretations by callers. This ambiguity has since been resolved in
1.6 G EAC1 release, which clarifies that a return value of 1 does *not*
mean the core is unaffected and that callers must independently
determine the erratum status.

While TF-A has always followed this interpretation, some consumers may
still treat a return value of 1 as “not affected”, potentially leading
to security issues if the OS does not apply its own workaround.

Firmware originally returned 1 on V2 to avoid unnecessary WA3 SMC calls
on every syscall return, since this would negatively impact performance.
For Cortex-A57/72/73/75, SMCCC_ARCH_WORKAROUND_3 returns 0, while for
many newer cores (A76, A78, X2, A715, Neoverse V1/V2) the return value
is 1 because a local OS mitigation is available and calling into
firmware is not required.

Because this interface was expected to age out, we do not want to change
the status quo for other CPUs. This patch confines the fix to Neoverse
V2 only by adding the missing ARCH_WORKAROUND_3 registration, allowing
affected V2 revisions to return 0 as intended.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I8c08c26e0b7c268772d75d36d759564a7d67cd76

show more ...

feat(corstone-1000): add Cortex-A320 support

Introduce `CORSTONE1000_CORTEX_A320` to enable Cortex-A320 on
Corstone-1000 while keeping Cortex-A35 as the default. When the
define is enabled, the buil

feat(corstone-1000): add Cortex-A320 support

Introduce `CORSTONE1000_CORTEX_A320` to enable Cortex-A320 on
Corstone-1000 while keeping Cortex-A35 as the default. When the
define is enabled, the build switches from `cortex_a35.S` to
`cortex_a320.S`, maintaining compatibility with existing A35-based
designs.

Also add Normal-World mappings for the Ethos-U85 NPU and its SRAM
on Cortex-A320 platforms so U-Boot and other non-secure software
can safely access these regions:

* **Ethos-U85 registers**: base `0x1A050000`, size `0x00004000` (16 KB),
attrs `MT_DEVICE | MT_RW | MT_NS`
* **Non-secure SRAM**: base `0x02400000`, size `0x00400000` (4 MB),
attrs `MT_MEMORY | MT_RW | MT_NS`

Enable GICv3 with GIC-600 when building for Cortex-A320 (retain
GICv2/GIC-400 for Cortex-A35):

* Update `plat_my_core_pos()` and `plat_arm_calc_core_pos()` to use
the Cortex-A320 MPIDR_EL1 affinity layout.
* Add an A320-specific core-position routine in assembly guarded by
`CORSTONE1000_CORTEX_A320`.
* Switch to the GICv3 driver with GIC-600 extensions: update GIC base
addresses, use GICv3 APIs, and set `USE_GIC_DRIVER=3`,
`GICV3_SUPPORT_GIC600=1`, `GIC_ENABLE_V4_EXTN=1`.

These changes prepare the platform for Cortex-A320 integration and
ensure correct GIC configuration and secondary-core bring-up, while
preserving A35 behavior.

Change-Id: Ief03dd528e67918e160d5b42ad1344b0ba3440f8
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Michael Safwat <michael.safwat@arm.com>

show more ...

Merge "fix(psci): gate suspend end_pwrlvl override in OS_INIT mode at runtime" into integration

Merge "fix(rse): remove host ROTPK support and test" into integration

fix(rse): remove host ROTPK support and test

Remove support for the retrieving a host ROTPK from the RSE, as the RSE
no longer has host ROTPKs provisioned by default. Also remove the TC
test which v

fix(rse): remove host ROTPK support and test

Remove support for the retrieving a host ROTPK from the RSE, as the RSE
no longer has host ROTPKs provisioned by default. Also remove the TC
test which verified this feature.

BREAKING CHANGE: platforms can no longer retrieve the host ROTPK from
the RSE as these are no longer provisioned.

Change-Id: I2c852855e53c36e77f639f17f4c181290d95ccff
Signed-off-by: Jackson Cooper-Driver <jackson.cooper-driver@arm.com>

show more ...

feat(versal2): support alternate core as primary (non-cpu0)

Primary core was hardcoded to CPU0, causing a panic when another
core booted first.
Update logic to allow any booting core to become the p

feat(versal2): support alternate core as primary (non-cpu0)

Primary core was hardcoded to CPU0, causing a panic when another
core booted first.
Update logic to allow any booting core to become the primary and
gate secondary core startup inline to existing implementation for
secondary cores.

Change-Id: I6a5d76f23d4d4c4139d95bbaf55edf1244f2dbfe
Signed-off-by: Maheedhar Bollapalli <maheedharsai.bollapalli@amd.com>

show more ...

Merge changes I9375fad3,Ie072f9fe into integration

* changes:
refactor(fvp): use SZ_* defs fr event log
fix(rme): increase worst-case event size

Merge "fix(fvp): fully remove FVP_Foundation" into integration

fix(fvp): fully remove FVP_Foundation

It was removed with patch 4f6c9397b61824b320f7b16b6267d9928dc88998 but
some bits remain. Remove them.

Change-Id: Ia40d97ca81983006e470b061d913d238cf73b6f9
Sign

fix(fvp): fully remove FVP_Foundation

It was removed with patch 4f6c9397b61824b320f7b16b6267d9928dc88998 but
some bits remain. Remove them.

Change-Id: Ia40d97ca81983006e470b061d913d238cf73b6f9
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "feat(cpufeat): enable USE_SPINLOCK_CAS to FEAT_STATE_CHECKED" into integration

refactor(fvp): use SZ_* defs fr event log

Switch `PLAT_ARM_EVENT_LOG_MAX_SIZE` to SZ_* helpers for readability.

Change-Id: I9375fad3232afb9c3dc58204cc915d9c7fb2957f
Signed-off-by: Harrison Mutai <h

refactor(fvp): use SZ_* defs fr event log

Switch `PLAT_ARM_EVENT_LOG_MAX_SIZE` to SZ_* helpers for readability.

Change-Id: I9375fad3232afb9c3dc58204cc915d9c7fb2957f
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(rme): increase worst-case event size

Increase the worst-case event log size for RME. It's now possible for
each event to hold up to `LIBEVLOG_MAX_HASH_COUNT` digests. Increase the
worst-case siz

fix(rme): increase worst-case event size

Increase the worst-case event log size for RME. It's now possible for
each event to hold up to `LIBEVLOG_MAX_HASH_COUNT` digests. Increase the
worst-case size to account for this.

Change-Id: Ie072f9fe1ea5617c030556fae4c8c893cfefc4e0
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

Merge "feat(rmmd): extend RMI function ID range validation" into integration

feat(rmmd): extend RMI function ID range validation

Add support for the extended RMI function number range (RMI_FNUM1)in
the is_rmi_fid() macro. The macro now validates FIDs in both:
- Original rang

feat(rmmd): extend RMI function ID range validation

Add support for the extended RMI function number range (RMI_FNUM1)in
the is_rmi_fid() macro. The macro now validates FIDs in both:
- Original range: 0x150 - 0x18F (RMI_FNUM_MIN_VALUE to RMI_FNUM_MAX_VALUE)
- Extended range: 0x1D0 - 0x2CF (RMI_FNUM1_MIN_VALUE to RMI_FNUM1_MAX_VALUE)

This change ensures proper identification and handling of RMI calls
across the full function ID space as defined by the RMM specification.

Change-Id: Ie65999ffeacc94057389e056761e57586f804b63
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

show more ...

feat(cpufeat): enable USE_SPINLOCK_CAS to FEAT_STATE_CHECKED

The FEAT_LSE enablement predates the FEAT_STATE framework and has never
been converted. Since the introduction of USE_SPINLOCK_CAS we've

feat(cpufeat): enable USE_SPINLOCK_CAS to FEAT_STATE_CHECKED

The FEAT_LSE enablement predates the FEAT_STATE framework and has never
been converted. Since the introduction of USE_SPINLOCK_CAS we've gained
lots of quality of life features that allow for better feature
enablement. This patch converts USE_SPINLOCK_CAS to tri-state and adds
it to FEATURE_DETECTION to align with all other features.

Instead of introducing the assembly checking for tri-state, this patch
translates all locking routines to C inline assembly and uses the
standard C helpers. The main benefit is that this gives greater
visibility to the compiler about what the functions are doing and lets
it optimise better. Namely, it is able to allocate registers itself and
inline the functions when LTO is enabled.

An unsuccessful attempt was made to use the instructions directly and
have even flow control in C. This, however, made code very complicated
and less efficient in the tight loops of the spinlock.

The last use of ARM_ARCH_AT_LEAST goes away with this change and so this
macro is removed. It has now been fully superseded by the FEAT_STATE
framework.

This change exposes a limitation - RME_GPT_BITLOCK_BLOCK requires
USE_SPINLOCK_CAS. This patch does not address this in any way but makes
the relationship explicit.

Change-Id: I580081549aceded2dca3e0f4564ee7510a7e56ae
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes from topic "hm/evlog" into integration

* changes:
refactor(drtm): use crypto-agile measured boot
refactor(imx): use crypto-agile measured boot
refactor(qemu): use crypto-agile me

Merge changes from topic "hm/evlog" into integration

* changes:
refactor(drtm): use crypto-agile measured boot
refactor(imx): use crypto-agile measured boot
refactor(qemu): use crypto-agile measured boot
refactor(juno): use crypto-agile measured boot
refactor(rpi3): use crypto-agile measured boot
refactor(fvp): use crypto-agile measured boot
feat(measured-boot): enable dynamic hash provisioning
feat: add TPM/TCG hashing helper to crypto module
chore: bump event log library

show more ...

Merge changes I4d50d138,Ie16b2e40,I574893fa into integration

* changes:
refactor(tpm): remove TPM code from TF-A
feat(tpm): changes to support TPM lib
feat: add libtpm submodule

Merge "fix(cpufeat): always provide pauth context helper" into integration

refactor(drtm): use crypto-agile measured boot

Update the DRTM boot flow to use the crypto-agile API. Replace the
previous single-algorithm hash configuration with dynamic algorithm
selection. Align

refactor(drtm): use crypto-agile measured boot

Update the DRTM boot flow to use the crypto-agile API. Replace the
previous single-algorithm hash configuration with dynamic algorithm
selection. Align image measurement and event log header generation with
the new hashing model and update platform glue code accordingly.

Change-Id: I22930440476895c23dbd4e04502757d2f6726e33
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

refactor(imx): use crypto-agile measured boot

Update the i.MX measured boot flow to use the crypto-agile API. Replace
the previous single-algorithm hash configuration with dynamic algorithm
selectio

refactor(imx): use crypto-agile measured boot

Update the i.MX measured boot flow to use the crypto-agile API. Replace
the previous single-algorithm hash configuration with dynamic algorithm
selection. Align image measurement and event log header generation with
the new hashing model and update platform glue code accordingly.

Change-Id: Ia60b5c927c1d7e4262562fb1eee2e4602b832e78
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

refactor(qemu): use crypto-agile measured boot

Update the QEMU measured boot flow to use the crypto-agile API. Replace
the previous single-algorithm hash configuration with dynamic algorithm
selecti

refactor(qemu): use crypto-agile measured boot

Update the QEMU measured boot flow to use the crypto-agile API. Replace
the previous single-algorithm hash configuration with dynamic algorithm
selection. Align image measurement and event log header generation with
the new hashing model and update platform glue code accordingly.

Change-Id: Iab276b88ce85675374aa2c104cbd0aa907be2acb
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

refactor(juno): use crypto-agile measured boot

Update the Juno measured boot flow to use the crypto-agile API. Replace
the previous single-algorithm hash configuration with dynamic algorithm
selecti

refactor(juno): use crypto-agile measured boot

Update the Juno measured boot flow to use the crypto-agile API. Replace
the previous single-algorithm hash configuration with dynamic algorithm
selection. Align image measurement and event log header generation with
the new hashing model and update platform glue code accordingly.

Change-Id: I9bca6c9f2a6f3507cea5ced7c2ab83ee5a4c1a91
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...