fix(cpus): workaround platforms non-arm interconnect

The workarounds for these below mentioned errata are not implemented
in EL3, but the flags can be enabled/disabled at a platform level
based on a

fix(cpus): workaround platforms non-arm interconnect

The workarounds for these below mentioned errata are not implemented
in EL3, but the flags can be enabled/disabled at a platform level
based on arm/non-arm interconnect IP. The ABI helps assist the Kernel
in the process of mitigation for the following errata:

Cortex-A715: erratum 2701951
Neoverse V2: erratum 2719103
Cortex-A710: erratum 2701952
Cortex-X2: erratum 2701952
Neoverse N2: erratum 2728475
Neoverse V1: erratum 2701953
Cortex-A78: erratum 2712571
Cortex-A78AE: erratum 2712574
Cortex-A78C: erratum 2712575

EL3 provides an appropriate return value via errata ABI when the
kernel makes an SMC call using the EM_CPU_ERRATUM_FEATURES FID with the
appropriate erratum ID.

Change-Id: I35bd69d812dba37410dd8bc2bbde20d4955b0850
Signed-off-by: Sona Mathew <SonaRebecca.Mathew@arm.com>

show more ...

refactor(errata_abi): factor in non-arm interconnect

Workaround to help enable the kernel to query errata status using the
errata abi feature for platforms with a non-arm interconnect.

Change-Id: I

refactor(errata_abi): factor in non-arm interconnect

Workaround to help enable the kernel to query errata status using the
errata abi feature for platforms with a non-arm interconnect.

Change-Id: I47b03eaee5a0a763056ae71883fa30dfacb9b3f7
Signed-off-by: Sona Mathew <SonaRebecca.Mathew@arm.com>

show more ...

feat(errata_abi): errata management firmware interface

This patch adds the errata management firmware interface for lower ELs
to discover details about CPU erratum. Based on the CPU erratum
identifi

feat(errata_abi): errata management firmware interface

This patch adds the errata management firmware interface for lower ELs
to discover details about CPU erratum. Based on the CPU erratum
identifier the interface enables the OS to find the mitigation of an
erratum in EL3.

The ABI can only be present in a system that is compliant with SMCCCv1.1
or higher. This implements v1.0 of the errata ABI spec.

For details on all possible return values, refer the design
documentation below:

ABI design documentation:
https://developer.arm.com/documentation/den0100/1-0?lang=en

Signed-off-by: Sona Mathew <SonaRebecca.Mathew@arm.com>
Change-Id: I70f0e2569cf92e6e02ad82e3e77874546232b89a

show more ...

docs: update release and code freeze dates

Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>
Change-Id: If782bd337d10213cb74503f4ea54ed304d6e4c34

fix(pmu): unconditionally save PMCR_EL0

Reading back a RES0 bit does not necessarily mean it will be read as 0.
The Arm ARM explicitly warns against doing this. The PMU initialisation
code tries to

fix(pmu): unconditionally save PMCR_EL0

Reading back a RES0 bit does not necessarily mean it will be read as 0.
The Arm ARM explicitly warns against doing this. The PMU initialisation
code tries to set such bits to 1 (in MDCR_EL3) regardless of whether
they are in use or are RES0, checking their value could be wrong and
PMCR_EL0 might not end up being saved.

Save PMCR_EL0 unconditionally to prevent this. Remove the security state
change as the outgoing state is not relevant to what the root world
context should look like.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: Id43667d37b0e2da3ded0beaf23fa0d4f9013f470

show more ...

fix(gicv3): restore scr_el3 after changing it

EL3's context is poorly defined as it is and polluting it further is not
a good idea. Put it back as it was before the function call.

Signed-off-by: Bo

fix(gicv3): restore scr_el3 after changing it

EL3's context is poorly defined as it is and polluting it further is not
a good idea. Put it back as it was before the function call.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I9d13c9517962b501246989fd2126d08410191784

show more ...

refactor(cm): make SVE and SME build dependencies logical

Currently, enabling SME forces SVE off. However, the SME enablement
requires SVE to be enabled, which is reflected in code. This is the
oppo

refactor(cm): make SVE and SME build dependencies logical

Currently, enabling SME forces SVE off. However, the SME enablement
requires SVE to be enabled, which is reflected in code. This is the
opposite of what the build flags require.

Further, the few platforms that enable SME also explicitly enable SVE.
Their platform.mk runs after the defaults.mk file so this override never
materializes. As a result, the override is only present on the
commandline.

Change it to something sensible where if SME is on then code can rely on
SVE being on too. Do this with a check in the Makefile as it is the more
widely used pattern. This maintains all valid use cases but subtly
changes corner cases no one uses at the moment to require a slightly
different combination of flags.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: If7ca3972ebc3c321e554533d7bc81af49c2472be

show more ...

Merge changes from topic "mp/group0_support" into integration

* changes:
feat(tc): allow secure watchdog timer to trigger periodically
feat(sbsa): helper api for refreshing watchdog timer

feat(fvp): introduce PLATFORM_TEST_RAS_FFH config

While doing RAS related tests there were few patches related with
fault injection and handling were applied through CI hooks.
These patches were inv

feat(fvp): introduce PLATFORM_TEST_RAS_FFH config

While doing RAS related tests there were few patches related with
fault injection and handling were applied through CI hooks.
These patches were invisible as they were applied and removed after the
build is done.

This patch introduces build macro PLATFORM_TEST_RAS_FFH and moves the
patches applied through CI under this.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Iddba52f3ebf21f575a473e50c607a944391156b9

show more ...

feat(tc): allow secure watchdog timer to trigger periodically

This patch does the following:
1. Configures SBSA secure watchdog timer as Group0 interrupt for
TC platform while keeping it as G

feat(tc): allow secure watchdog timer to trigger periodically

This patch does the following:
1. Configures SBSA secure watchdog timer as Group0 interrupt for
TC platform while keeping it as Group1 secure interrupt for
other CSS based SoCs.
2. Programs the watchdog timer to trigger periodically
3. Provides a Group0 interrupt handler for TC platform port to
deactivate the EL3 interrupt due to expiry of secure watchdog
timer and refresh it explicitly.

Change-Id: I3847d6eb7347c6ea0e527b97b096119ca1e6701b
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

feat(sbsa): helper api for refreshing watchdog timer

This patch adds a helper API to explicitly refresh SBSA secure watchdog
timer. Please refer section A.3 of the following spec:

https://developer

feat(sbsa): helper api for refreshing watchdog timer

This patch adds a helper API to explicitly refresh SBSA secure watchdog
timer. Please refer section A.3 of the following spec:

https://developer.arm.com/documentation/den0029/latest/

Change-Id: I2d0943792aea0092bee1e51d74b908348587e66b
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

show more ...

Merge "feat(fvp): define ns memory in the SPMC manifest" into integration

Merge changes from topic "allwinner_t507" into integration

* changes:
feat(allwinner): add support for Allwinner T507 SoC
feat(allwinner): add function to detect H616 die variant
feat(allwinne

Merge changes from topic "allwinner_t507" into integration

* changes:
feat(allwinner): add support for Allwinner T507 SoC
feat(allwinner): add function to detect H616 die variant
feat(allwinner): add extra CPU control registers
refactor(allwinner): consolidate sunxi_cfg.h files

show more ...

Merge "fix(tc): only suspend booting after running plat tests" into integration

fix(tc): only suspend booting after running plat tests

1. When doing a normal boot, tc_bl31_common_platform_setup() should
simply configure the platform and return.

2. When we are running the platf

fix(tc): only suspend booting after running plat tests

1. When doing a normal boot, tc_bl31_common_platform_setup() should
simply configure the platform and return.

2. When we are running the platform tests instead,
tc_bl31_common_platform_setup() should run the tests then suspend
booting (and thus never return).

We were incorreclty suspending the boot in case 1 as well. Put that
code under a preprocessor condition (PLATFORM_TEST_NV_COUNTERS or
PLATFORM_TEST_TFM_TESTSUITE) to fix this.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I7d20800e3bcd85261e2cdad325586d184e12a3e3

show more ...

build!: check boolean flags are not empty

For numeric flags, there is a check for the value to be set. Do the same
for boolean flags. This avoids issues where a flag is defined but
without a value,

build!: check boolean flags are not empty

For numeric flags, there is a check for the value to be set. Do the same
for boolean flags. This avoids issues where a flag is defined but
without a value, leading to potential unexpected behaviors.

Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: Ib00da2784339471058887e93434d96ccba2aebb2

show more ...

Merge changes from topic "mp/group0_support" into integration

* changes:
docs(spm): support for handling Group0 interrupts
feat(spmd): introduce platform handler for Group0 interrupt
feat(spmd

Merge changes from topic "mp/group0_support" into integration

* changes:
docs(spm): support for handling Group0 interrupts
feat(spmd): introduce platform handler for Group0 interrupt
feat(spmd): add support for FFA_EL3_INTR_HANDLE_32 ABI
feat(spmd): register handler for group0 interrupt from NWd

show more ...

fix(psci): do not panic on illegal MPIDR

Commit 66327414fb1e ("fix(psci): potential array overflow with cpu on")
changed an assert in the PSCI library's psci_cpu_on_start() function to
a runtime err

fix(psci): do not panic on illegal MPIDR

Commit 66327414fb1e ("fix(psci): potential array overflow with cpu on")
changed an assert in the PSCI library's psci_cpu_on_start() function to
a runtime error message, followed by a panic. This does not seem right
for two reasons:
- We must not panic() triggered by conditions influenced by lower EL
callers. If non-secure world provides illegal arguments to a PSCI
call, we can easily detect this and return -PSCI_E_INVALID_PARAMS, as
the PSCI spec demands. In fact this is done already, which brings us
to the next reason:
- psci_cpu_on_start() is effectively a function private to the PSCI
library: its prototype is in psci_private.h. It's just not static
because it lives in a different code file from the main PSCI code.
We check for illegal MPID values already in psci_cpu_on(), and return
an error value to the caller, as we should. This function is the ONLY
caller of psci_cpu_on_start(), so there is no way we get an illegal
target_cpu argument into this function. An assert() is thus the proper
way to check for this.

Mostly revert the patch mentioned above, just extending the assert so
that it does also check for not exceeding the array boundaries.
To harden the code, add a check against PLATFORM_MAX_CORE_COUNT in
psci_validate_mpidr(), and return with the proper PSCI error code if
this number is exceeded.

This also fixes the sun50i_a64 build with DEBUG=1, which exceeded an
SRAM limit due to the error message.

Change-Id: I48fc58d96b0173da5b934750f4cadf7884ef5e42
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

fix(n1sdp): add platform-specific power domain functions

Commit 4d8c18196378824e388cf31ef991ba8fbbb09cbf added a redistributor
power off to resolve an error on N1SDP/Morello. Prior to this fix,
turn

fix(n1sdp): add platform-specific power domain functions

Commit 4d8c18196378824e388cf31ef991ba8fbbb09cbf added a redistributor
power off to resolve an error on N1SDP/Morello. Prior to this fix,
turning off both cores in a cluster would cause a hang when powering
back on either core. This change introduced issues on other platforms
with a different GIC implementation, and was reverted in commit
60719e4e0965aead49d927f12bf2a37bd2629012.

This commit uses the previous fix in platform-specific implementations
of power domain off/suspend functions.

Signed-off-by: Werner Lewis <werner.lewis@arm.com>
Change-Id: I52c463646c494fe931ff4ce47afb940a56978fcd

show more ...

fix(morello): add platform-specific power domain functions

Commit 4d8c18196378824e388cf31ef991ba8fbbb09cbf added a redistributor
power off to resolve an error on N1SDP/Morello. Prior to this fix,
tu

fix(morello): add platform-specific power domain functions

Commit 4d8c18196378824e388cf31ef991ba8fbbb09cbf added a redistributor
power off to resolve an error on N1SDP/Morello. Prior to this fix,
turning off both cores in a cluster would cause a hang when powering
back on either core. This change introduced issues on other platforms
with a different GIC implementation, and was reverted in commit
60719e4e0965aead49d927f12bf2a37bd2629012.

This commit uses the previous fix in platform-specific implementations
of power domain off/suspend functions.

Signed-off-by: Werner Lewis <werner.lewis@arm.com>
Change-Id: Ib7689a5e08ada3862406fa92019a6f0bcfb48d79

show more ...

fix(el3-spmc): correctly account for emad_offset

Use the address of emad 0 instead of the size of the MRD.

Change-Id: I31ec0001b4474e78caa9dfb468f63122a3708781
Signed-off-by: Demi Marie Obenour <de

fix(el3-spmc): correctly account for emad_offset

Use the address of emad 0 instead of the size of the MRD.

Change-Id: I31ec0001b4474e78caa9dfb468f63122a3708781
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

show more ...

refactor(el3-spmc): avoid unnecessarily revalidating offset

The offset has been validated on the first loop iteration. Subsequent
iterations can assume it is valid.

Change-Id: Ib06cd0240220b8aa42b

refactor(el3-spmc): avoid unnecessarily revalidating offset

The offset has been validated on the first loop iteration. Subsequent
iterations can assume it is valid.

Change-Id: Ib06cd0240220b8aa42bcd34c3c40b69d2d86aa72
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

show more ...

fix(el3-spmc): only call spmc_shm_check_obj() on complete objects

When called on incomplete objects, it might fail or access uninitialized
memory. This allows simplifying spmc_shm_check_obj().

Chan

fix(el3-spmc): only call spmc_shm_check_obj() on complete objects

When called on incomplete objects, it might fail or access uninitialized
memory. This allows simplifying spmc_shm_check_obj().

Change-Id: I7c11f15d4c8ebe8cd15e7d8c37a0d0f3daa83675
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

show more ...

refactor(spmc): assert on out-of-bounds emad access

This always indicates a bug.

Change-Id: Ie0d5d4c84d9fb615ba6cdf0e6d46eab778fc7e94
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

refactor(el3-spmc): spmc_shmem_obj_get_emad() will never fail

Earlier validation ensures spmc_shmem_obj_get_emad() will never fail, so
trip an assertion instead of returning NULL.

Change-Id: I285f3

refactor(el3-spmc): spmc_shmem_obj_get_emad() will never fail

Earlier validation ensures spmc_shmem_obj_get_emad() will never fail, so
trip an assertion instead of returning NULL.

Change-Id: I285f3b59150773b2404db5719753fdb240e9ed63
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

show more ...