Commit Graph

371 Commits

Author SHA1 Message Date
John Powell
ff879c5280 fix(cpus): workaround for Cortex-X2 erratum 1916945
Cortex-X2 erratum 1916945 is a Cat B erratum that applies to
revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[8]. This has a small
performance impact (<0.5%).

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: If810b1d0a07c43b3e1aa70d2ec88c1dcfa6f735f
Signed-off-by: John Powell <john.powell@arm.com>
2025-07-30 12:31:48 -05:00
John Powell
ce64ea6ecb fix(cpus): workaround for Cortex-X2 erratum 1901946
Cortex-X2 erratum 1901946 is a Cat B erratum that applies to
revision r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[15]. This has a small
performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest

Change-Id: I5a65db60f06982191994db49815419c4d72506cf
Signed-off-by: John Powell <john.powell@arm.com>
2025-07-30 12:30:02 -05:00
Arvind Ram Prakash
42920aa743 fix(cpus): workaround for Cortex-X3 erratum 3213672
Cortex-X3 erratum 3213672 is a Cat B erratum that applies to
r0p0, r1p0, r1p1 and r1p2. It is still open.

This erratum can be worked around by setting CPUACTLR_EL1[36]
before enabling icache.

SDEN Documentation:
https://developer.arm.com/documentation/SDEN-2055130/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Ia1c03217f4e1816b4e8754a090cf5bc17546be40
2025-07-16 09:39:38 -05:00
Arvind Ram Prakash
6a464ee775 fix(cpus): workaround for Cortex-X3 erratum 3827463
Cortex-X3 erratum 3827463 is a Cat B erratum that applies to
r0p0, r1p0 and r1p1. It is fixed in r1p2.

This erratum can be avoided by setting CPUACTLR_EL1[1]
prior to enabling MMU. This bit will disable a branch predictor
power savings feature. Disabling this power feature
results in negligible power movement and no performance impact.

SDEN Documentation:
https://developer.arm.com/documentation/SDEN-2055130/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I1d4a2b9641400d8b9061f7cb32a8312c3995613e
2025-07-16 09:39:38 -05:00
Arvind Ram Prakash
f828efe258 fix(cpus): workaround for Cortex-X3 erratum 3692984
Cortex-X3 erratum 3692984 is a Cat B erratum that applies to
r0p0, r1p0, r1p1 and r1p2 and is still open.

The erratum can be avoided by disabling the
affected prefetcher setting CPUACTLR6_EL1[41].

SDEN Documentation:
https://developer.arm.com/documentation/SDEN-2055130/latest/

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I054b47d33fd1ff7bde3ae12e8ee3d99e9203965f
2025-07-16 09:39:33 -05:00
Bipin Ravi
f9274127f5 Merge "fix(cpus): workaround for Cortex-A710 erratum 1927200" into integration 2025-06-26 20:26:18 +00:00
Govindraj Raja
4c3bd4a404 Merge "docs(interrupt): corrected func name in interrupt-framework-design" into integration 2025-06-23 16:15:01 +00:00
lianghong.liu
66dec05e67 docs(interrupt): corrected func name in interrupt-framework-design
This change corrected the function name of determining the type of interrupt.

Change-Id: I88f2464eb16cebc05549267fea5380d0b83feb66
Signed-off-by: lianghong.liu <lianghong01.liu@horizon.auto>
2025-06-22 08:01:39 +00:00
Arvind Ram Prakash
d52ff2b3a9 feat(dsu): support power control and autonomous powerdown config
This patch allows platforms to enable certain DSU settings
to ensure memory retention and control over
cache power requests. We also move the driver out of css
into drivers/arm. Platforms can configure the
CLUSTERPWRCTLR and CLUSTERPWRDN registers [1] to improve
power efficiency.

These registers enable finer-grained control of
DSU power state transitions, including
powerdown and retention.

IMP_CLUSTERPWRCTLR_EL1 provides:
- Functional retention: Allows configuration of the
  duration of inactivity before the DSU uses
  CLUSTERPACTIVE to request functional retention.

- Cache power request: These bits are output on
  CLUSTERPACTIVE[19:16] to indicate to the power controller
  which cache portions must remain powered.

IMP_CLUSTERPWRDN_EL1 includes:
- Powerdown: Triggers full cluster powerdown, including
  control logic.

- Memory retention: Requests memory retention mode,
  keeping L3 RAM contents while powering off
  the rest of the DSU.

The DSU-120 TRM [2] provides the full field definitions,
which are used as references in the `dsu_driver_data` structure.

References:
[1]: https://developer.arm.com/documentation/100453/latest/
[2]: https://developer.arm.com/documentation/102547/0201/?lang=en

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I2eba808b8f2a27797782a333c65dd092b03208fe
2025-06-20 12:22:19 -05:00
Lauren Wehrmeister
7554f1df4c Merge changes I1fae91a5,I54793492,I703f0e6e into integration
* changes:
  fix(cpus): workaround for Cortex-A710 erratum 1917258
  fix(cpus): workaround for Cortex-A710 erratum 1916945
  fix(cpus): workaround for Cortex-A710 erratum 1901946
2025-06-17 20:59:59 +00:00
John Powell
cb2702c4b7 fix(cpus): workaround for Cortex-A710 erratum 1927200
Cortex-A710 erratum 1927200 is a Cat B erratum that applies
to revisions r0p0 and r1p0 and is fixed in r2p0.

The fix is to insert DMB ST before acquire atomic instructions
without release semantics via instruction patching.

SDEN documentation:
https://developer.arm.com/documentation/SDEN1775101

Change-Id: I53c4aa17c1c2dc85b68f17d58f93bb1ee6b3d488
Signed-off-by: John Powell <john.powell@arm.com>
2025-06-16 23:41:48 -05:00
Arvind Ram Prakash
efc945f1a8 feat(errata): implement workaround for DSU-120 erratum 2900952
DSU Erratum 2900952 is a Cat B erratum that applies to some
DSU-120 implementations of revision r2p0 and is fixed in r2p1.
This erratum is fixed in certain implementations of r2p0 which can be
determined by reading the IMP_CLUSTERREVIDR_EL1[1] register field
where a set bit indicates that the erratum is fixed in this part.

The workaround is to set the CLUSTERACTLR_EL1 bits [21:20] to 0x3
which ignores CBusy from the system interconnect and
setting CLUSTERACTLR_EL1 bit [8] to 1 to assert CBusy from DSU to
all the cores when DSU is busy.

SDEN: https://developer.arm.com/documentation/SDEN-2453103/1200/?lang=en

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I87aa440ab5c35121aff703032f5cf7a62d0b0bb4
2025-06-11 10:02:14 -05:00
John Powell
d91c417716 fix(cpus): workaround for Cortex-A710 erratum 1917258
Cortex-A710 erratum 1917258 is a Cat B erratum that applies
to revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[43]. This has no
performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN1775101

Change-Id: I1fae91a5e3a8ecea255f0f0a481bfd6196a7db51
Signed-off-by: John Powell <john.powell@arm.com>
2025-06-09 14:32:39 -05:00
John Powell
df067c0a60 fix(cpus): workaround for Cortex-A710 erratum 1916945
Cortex-A710 erratum 1916945 is a Cat B erratum that applies
to revisions r0p0 and r1p0 and is fixed in r2p0.

The workaround is to set CPUECTLR_EL1[8]. This has a slight
performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN1775101

Change-Id: I54793492c527928d7f266165a31b8613de838e69
Signed-off-by: John Powell <john.powell@arm.com>
2025-06-09 13:48:38 -05:00
John Powell
4467348b63 fix(cpus): workaround for Cortex-A710 erratum 1901946
Cortex-A710 erratum 1901946 is a Cat B erratum that applies
to revision r1p0 and is fixed in r2p0.

The workaround is to set CPUACTLR4_EL1[15]. This has a slight
performance impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN1775101

Change-Id: I703f0e6ee122e44a9bc284d90f1465039e3b40e4
Signed-off-by: John Powell <john.powell@arm.com>
2025-06-09 13:45:39 -05:00
Boyan Karatotev
53644fa822 fix(libc): make sure __init functions are garbage collected
RECLAIM_INIT_CODE is useful to remove code that is only necessary during
boot. However, these functions are generally called once and as such
prime candidates for inlining. When building with LTO, the compiler is
pretty good at inlining every single one, making this option pointless.

So tell the compiler to not inline these functions. This ensures they
are kept separate and they can be garbage collected later. This is
expected to cost a little bit of speed due to the extra branching.

Change-Id: Ie83a9ec8db03cb42139742fc6d728d12ce8549d3
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
2025-04-09 09:39:10 +01:00
Govindraj Raja
ac9f4b4da6 fix(cpus): remove errata setting PF_MODE to conservative
The erratum titled “Disabling of data prefetcher with outstanding
prefetch TLB miss might cause a deadlock” should not be handled within
TF-A. The current workaround attempts to follow option 2 but
misapplies it. Specifically, it statically sets PF_MODE to
conservative, which is not the recommended approach. According to the
erratum documentation, PF_MODE should be configured in conservative
mode only when we disable data prefetcher however this is not done
in TF-A and thus the workaround is not needed in TF-A.

The static setting of PF_MODE in TF-A does not correctly address the
erratum and may introduce unnecessary performance degradation on
platforms that adopt it without fully understanding its implications.

To prevent incorrect or unintended use, the current implementation of
this erratum workaround should be removed from TF-A and not adopted by
platforms.

List of Impacted CPU's with Errata Numbers and reference to SDEN -

Cortex-A78  - 2132060 - https://developer.arm.com/documentation/SDEN1401784/latest
Cortex-A78C - 2132064 - https://developer.arm.com/documentation/SDEN-2004089/latest
Cortex-A710 - 2058056 - https://developer.arm.com/documentation/SDEN-1775101/latest
Cortex-X2   - 2058056 - https://developer.arm.com/documentation/SDEN-1775100/latest
Cortex-X3   - 2070301 - https://developer.arm.com/documentation/SDEN2055130/latest
Neoverse-N2 - 2138953 - https://developer.arm.com/documentation/SDEN-1982442/latest
Neoverse-V1 - 2108267 - https://developer.arm.com/documentation/SDEN-1401781/latest
Neoverse-V2 - 2331132 - https://developer.arm.com/documentation/SDEN-2332927/latest

Change-Id: Icf4048508ae070b2df073cc46c63be058b2779df
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-03-31 01:00:27 +01:00
John Powell
f2bd352820 fix(errata): workaround for Cortex-A510 erratum 2971420
Cortex-A510 erratum 2971420 applies to revisions r0p1, r0p2, r0p3,
r1p0, r1p1, r1p2 and r1p3, and is still open.

Under some conditions, data might be corrupted if Trace Buffer
Extension (TRBE) is enabled. The workaround is to disable trace
collection via TRBE by programming MDCR_EL3.NSTB[1] to the opposite
value of SCR_EL3.NS on a security state switch. Since we only enable
TRBE for non-secure world, the workaround is to disable TRBE by
setting the NSTB field to 00 so accesses are trapped to EL3 and
secure state owns the buffer.

SDEN: https://developer.arm.com/documentation/SDEN-1873361/latest/

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: Ia77051f6b64c726a8c50596c78f220d323ab7d97
2025-03-17 19:04:54 +01:00
John Powell
fcf2ab71ac fix(cpus): workaround for Cortex-A715 erratum 2804830
Cortex-A715 erratum 2804830 applies to r0p0, r1p0, r1p1 and r1p2,
and is fixed in r1p3.

Under some conditions, writes of a 64B-aligned, 64B granule of
memory might cause data corruption without this workaround. See SDEN
for details.

Since this workaround disables write streaming, it is expected to
have a significant performance impact for code that is heavily
reliant on write streaming, such as memcpy or memset.

SDEN: https://developer.arm.com/documentation/SDEN-2148827/latest/

Change-Id: Ia12f6c7de7c92f6ea4aec3057b228b828d48724c
Signed-off-by: John Powell <john.powell@arm.com>
2025-03-17 18:17:48 +01:00
Boyan Karatotev
89dba82dfa perf(cpus): make reset errata do fewer branches
Errata application is painful for performance. For a start, it's done
when the core has just come out of reset, which means branch predictors
and caches will be empty so a branch to a workaround function must be
fetched from memory and that round trip is very slow. Then it also runs
with the I-cache off, which means that the loop to iterate over the
workarounds must also be fetched from memory on each iteration.

We can remove both branches. First, we can simply apply every erratum
directly instead of defining a workaround function and jumping to it.
Currently, no errata that need to be applied at both reset and runtime,
with the same workaround function, exist. If the need arose in future,
this should be achievable with a reset + runtime wrapper combo.

Then, we can construct a function that applies each erratum linearly
instead of looping over the list. If this function is part of the reset
function, then the only "far" branches at reset will be for the checker
functions. Importantly, this mitigates the slowdown even when an erratum
is disabled.

The result is ~50% speedup on N1SDP and ~20% on AArch64 Juno on wakeup
from PSCI calls that end in powerdown. This is roughly back to the
baseline of v2.9, before the errata framework regressed on performance
(or a little better). It is important to note that there are other
slowdowns since then that remain unknown.

Change-Id: Ie4d5288a331b11fd648e5c4a0b652b74160b07b9
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
2025-02-24 09:36:11 +00:00
Boyan Karatotev
0d020822ae perf(cpus): inline the reset function
Similar to the cpu_rev_var and cpu_ger_rev_var functions, inline the
call_reset_handler handler. This way we skip the costly branch at no
extra cost as this is the only place where this is called.

While we're at it, drop the options for CPU_NO_RESET_FUNC. The only cpus
that need that are virtual cpus which can spare the tiny bit of
performance lost. The rest are real cores which can save on the check
for zero.

Now is a good time to put the assert for a missing cpu in the
get_cpu_ops_ptr function so that it's a bit better encapsulated.

Change-Id: Ia7c3dcd13b75e5d7c8bafad4698994ea65f42406
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
2025-02-24 09:36:10 +00:00
Govindraj Raja
845213ed0d fix(cpus): fix a typo in errata doc
Commit@af5ae9a73f67dc8c9ed493846d031b052b0f22a0
Adding a Cortex-A720-AE erratum 3699562 has a typo in CPU name
for the errata, it is for Cortex-A720-AE but had incorrectly
mentioned as Cortex-A715_AE.

Change-Id: I2332a3fcaf56a7aaab5a04e3d40428cc746d2d46
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-19 09:37:35 -06:00
Govindraj Raja
29bda258d5 fix(cpus): workaround for Cortex-X925 erratum 2963999
Cortex-X925 erratum 2963999 that applies to r0p0 and is fixed in
r0p1.

In EL3, reads of MPIDR_EL1 and MIDR_EL1 might incorrectly virtualize
which register to return when reading the value of
MPIDR_EL1/VMPIDR_EL2 and MIDR_EL1/VPIDR_EL2, respectively.

The workaround is to do an ISB prior to an MRS read to either
MPIDR_EL1 and MIDR_EL1.

SDEN documentation:
https://developer.arm.com/documentation/109180/latest/

Change-Id: I447fd359ea32e1d274e1245886e1de57d14f082c
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-12 09:25:06 -06:00
Govindraj Raja
5f32fd2145 fix(cpus): workaround for Neoverse-V3 erratum 2970647
Neoverse V3 erratum 2970647 that applies to r0p0 and is fixed in r0p1.

In EL3, reads of MPIDR_EL1 and MIDR_EL1 might incorrectly virtualize
which register to return when reading the value of
MPIDR_EL1/VMPIDR_EL2 and MIDR_EL1/VPIDR_EL2, respectively.

The workaround is to do an ISB prior to an MRS read to either
MPIDR_EL1 and MIDR_EL1.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2891958/latest/

Change-Id: Iedf7d799451f0be58a5da1f93f7f5b6940f2bb35
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-12 09:25:06 -06:00
Govindraj Raja
09c1edb84b fix(cpus): workaround for Cortex-X4 erratum 2957258
Cortex-X4 erratum 2957258 that applies to r0p0, r0p1 and is fixed in
r0p2.

In EL3, reads of MPIDR_EL1 and MIDR_EL1 might incorrectly virtualize
which register to return when reading the value of
MPIDR_EL1/VMPIDR_EL2 and MIDR_EL1/VPIDR_EL2, respectively.

The workaround is to do an ISB prior to an MRS read to either
MPIDR_EL1 and MIDR_EL1.

SDEN documentation:
https://developer.arm.com/documentation/109148/latest/

Change-Id: I2d8e7f4ce19ca2e1d87527c31e7778d81aff0279
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-12 09:25:06 -06:00
Manish V Badarkhe
243fba1f18 Merge "docs(console): updated console docs" into integration 2025-02-12 15:33:26 +01:00
Salman Nabi
31edc20dc4 docs(console): updated console docs
Add documentation for the console framework on how to go about
instantiating a new console and how to use these consoles in TF-A.
This includes BOOT, RUNTIME and CRASH consoles.

Change-Id: I746d38f69f1b035d2e85d2589646e7fd67cb9cc3
Signed-off-by: Salman Nabi <salman.nabi@arm.com>
2025-02-12 10:18:57 +00:00
Manish Pandey
fcb80d7d14 Merge changes I765a7fa0,Ic33f0b6d,I8d1a88c7,I381f96be,I698fa849, ... into integration
* changes:
  fix(cpus): clear CPUPWRCTLR_EL1.CORE_PWRDN_EN_BIT on reset
  chore(docs): drop the "wfi" from `pwr_domain_pwr_down_wfi`
  chore(psci): drop skip_wfi variable
  feat(arm): convert arm platforms to expect a wakeup
  fix(cpus): avoid SME related loss of context on powerdown
  feat(psci): allow cores to wake up from powerdown
  refactor: panic after calling psci_power_down_wfi()
  refactor(cpus): undo errata mitigations
  feat(cpus): add sysreg_bit_toggle
2025-02-11 16:52:18 +01:00
Govindraj Raja
e25fc9df25 fix(cpus): workaround for Neoverse-V3 erratum 3701767
Neoverse-V3 erratum 3701767 that applies to r0p0, r0p1, r0p2 is
still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2891958/latest/

Change-Id: I5be0de881f408a9e82a07b8459d79490e9065f94
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:51 -06:00
Govindraj Raja
fded839285 fix(cpus): workaround for Neoverse-N3 erratum 3699563
Neoverse-N3 erratum 3699563 that applies to r0p0 is still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-3050973/latest/

Change-Id: I77aaf8ae0afff3adde9a85f4a1a13ac9d1daf0af
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:50 -06:00
Govindraj Raja
adea6e52a7 fix(cpus): workaround for Neoverse-N2 erratum 3701773
Neoverse-N2 erratum 3701773 that applies to r0p0, r0p1, r0p2 and r0p3
is still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1982442/latest/

Change-Id: If95bd67363228c8083724b31f630636fb27f3b61
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:50 -06:00
Govindraj Raja
511148ef50 fix(cpus): workaround for Cortex-X925 erratum 3701747
Cortex-X925 erratum 3701747 that applies to r0p0, r0p1 and is still
Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/109180/latest/

Change-Id: I080296666f89276b3260686c2bdb8de63fc174c1
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:50 -06:00
Govindraj Raja
38401c5388 fix(cpus): workaround for Cortex-X4 erratum 3701758
Cortex-X4 erratum 3701758 that applies to r0p0, r0p1, r0p2 and r0p3
is still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/109148/latest/

Change-Id: I4ee941d1e7653de7a12d69f538ca05f7f9f9961d
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:50 -06:00
Govindraj Raja
77feb745e4 fix(cpus): workaround for Cortex-X3 erratum 3701769
Cortex-X3 erratum 3701769 that applies to r0p0, r1p0, r1p1 and r1p2
is still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2055130/latest/

Change-Id: Ifd722e1bb8616ada2ad158297a7ca80b19a3370b
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:50 -06:00
Govindraj Raja
ae6c7c97d4 fix(cpus): workaround for Cortex-X2 erratum 3701772
Cortex-X2 erratum 3701772 that applies to r0p0, r1p0, r2p0, r2p1
is still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775100/latest/

Change-Id: I2ffc5e7d7467f1bcff8b895fea52a1daa7d14495
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:50 -06:00
Govindraj Raja
d732300b86 fix(cpus): workaround for Cortex-A725 erratum 3699564
Cortex-A725 erratum 3699564 that applies to r0p0, r0p1 and is
fixed in r0p2.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2832921/latest

Change-Id: Ifad1f6c3f5b74060273f897eb5e4b79dd9f088f7
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:50 -06:00
Govindraj Raja
af5ae9a73f fix(cpus): workaround for Cortex-A720-AE erratum 3699562
Cortex-A720-AE erratum 3699562 that applies to r0p0 and is still
Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-3090091/latest/

Change-Id: Ib830470747822cac916750c01684a65cb5efc15b
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:50 -06:00
Govindraj Raja
050c4a38a3 fix(cpus): workaround for Cortex-A720 erratum 3699561
Cortex-A720 erratum 3699561 that applies to all revisions <= r0p2
and is still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2439421/latest/

Change-Id: I7ea3aaf3e7bf6b4f3648f6872e505a41247b14ba
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 13:57:26 -06:00
Govindraj Raja
26437afde1 fix(cpus): workaround for Cortex-A715 erratum 3699560
Cortex-A715 erratum 3699560 that applies to all revisions <= r1p3
and is still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2148827/latest/

Change-Id: I183aa921b4b6f715d64eb6b70809de2566017d31
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 10:14:33 -06:00
Govindraj Raja
463b5b4a46 fix(cpus): workaround for Cortex-A710 erratum 3701772
Cortex-A710 erratum 3701772 that applies to all revisions <= r2p1
and is still Open.

The workaround is for EL3 software that performs context save/restore
on a change of Security state to use a value of SCR_EL3.NS when
accessing ICH_VMCR_EL2 that reflects the Security state that owns the
data being saved or restored.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-1775101/latest/

Change-Id: I997c9cfaa75321f22b4f690c4d3f234c0b51c670
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
2025-02-03 10:14:33 -06:00
Boyan Karatotev
2b5e00d4ea feat(psci): allow cores to wake up from powerdown
The simplistic view of a core's powerdown sequence is that power is
atomically cut upon calling `wfi`. However, it turns out that it has
lots to do - it has to talk to the interconnect to exit coherency, clean
caches, check for RAS errors, etc. These take significant amounts of
time and are certainly not atomic. As such there is a significant window
of opportunity for external events to happen. Many of these steps are
not destructive to context, so theoretically, the core can just "give
up" half way (or roll certain actions back) and carry on running. The
point in this sequence after which roll back is not possible is called
the point of no return.

One of these actions is the checking for RAS errors. It is possible for
one to happen during this lengthy sequence, or at least remain
undiscovered until that point. If the core were to continue powerdown
when that happens, there would be no (easy) way to inform anyone about
it. Rejecting the powerdown and letting software handle the error is the
best way to implement this.

Arm cores since at least the a510 have included this exact feature. So
far it hasn't been deemed necessary to account for it in firmware due to
the low likelihood of this happening. However, events like GIC wakeup
requests are much more probable. Older cores will powerdown and
immediately power back up when this happens. Travis and Gelas include a
feature similar to the RAS case above, called powerdown abandon. The
idea is that this will improve the latency to service the interrupt by
saving on work which the core and software need to do.

So far firmware has relied on the `wfi` being the point of no return and
if it doesn't explicitly detect a pending interrupt quite early on, it
will embark onto a sequence that it expects to end with shutdown. To
accommodate for it not being a point of no return, we must undo all of
the system management we did, just like in the warm boot entrypoint.

To achieve that, the pwr_domain_pwr_down_wfi hook must not be terminal.
Most recent platforms do some platform management and finish on the
standard `wfi`, followed by a panic or an endless loop as this is
expected to not return. To make this generic, any platform that wishes
to support wakeups must instead let common code call
`psci_power_down_wfi()` right after. Besides wakeups, this lets common
code handle powerdown errata better as well.

Then, the CPU_OFF case is simple - PSCI does not allow it to return. So
the best that can be done is to attempt the `wfi` a few times (the
choice of 32 is arbitrary) in the hope that the wakeup is transient. If
it isn't, the only choice is to panic, as the system is likely to be in
a bad state, eg. interrupts weren't routed away. The same applies for
SYSTEM_OFF, SYSTEM_RESET, and SYSTEM_RESET2. There the panic won't
matter as the system is going offline one way or another. The RAS case
will be considered in a separate patch.

Now, the CPU_SUSPEND case is more involved. First, to powerdown it must
wipe its context as it is not written on warm boot. But it cannot be
overwritten in case of a wakeup. To avoid the catch 22, save a copy that
will only be used if powerdown fails. That is about 500 bytes on the
stack so it hopefully doesn't tip anyone over any limits. In future that
can be avoided by having a core manage its own context.

Second, when the core wakes up, it must undo anything it did to prepare
for poweroff, which for the cores we care about, is writing
CPUPWRCTLR_EL1.CORE_PWRDN_EN. The least intrusive for the cpu library
way of doing this is to simply call the power off hook again and have
the hook toggle the bit. If in the future there need to be more complex
sequences, their direction can be advised on the value of this bit.

Third, do the actual "resume". Most of the logic is already there for
the retention suspend, so that only needs a small touch up to apply to
the powerdown case as well. The missing bit is the powerdown specific
state management. Luckily, the warmboot entrypoint does exactly that
already too, so steal that and we're done.

All of this is hidden behind a FEAT_PABANDON flag since it has a large
memory and runtime cost that we don't want to burden non pabandon cores
with.

Finally, do some function renaming to better reflect their purpose and
make names a little bit more consistent.

Change-Id: I2405b59300c2e24ce02e266f91b7c51474c1145f
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
2025-02-03 14:29:47 +00:00
Arvind Ram Prakash
2372179484 fix(security): enable WORKAROUND_CVE_2024_7881 build option
This patch enables build option needed to include
support for CVE_2024_7881 [1] migitation.

[1]: https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-7881

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: Id77f82a4dfaa4422729f7e3f2429f47cc90d9782
2025-01-30 16:45:35 -06:00
Ryan Everett
4639f8909b docs(arm): update docs to reflect rotpk key changes
The hashing algorithm for the rotpk is now HASH_ALG,
not always sha-256. The public development keys are
no longer in the repository and are now generated at
run-time, updates the documentation to reflect this.

Change-Id: Ic336f7aca858e9b6a1af6d6e6dc5f4aa428da179
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-12-30 12:32:22 +01:00
Sona Mathew
af65cbb954 fix(cpus): workaround for CVE-2024-5660 for Cortex-X4
Implements mitigation for CVE-2024-5660 that affects Cortex-X4
revisions r0p0, r0p1, r0p2.
The workaround is to disable the hardware page aggregation at
EL3 by setting CPUECTLR_EL1[46] = 1'b1.

Public Documentation:
https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-5660

Change-Id: I378cb4978919cced03e7febc2ad431c572eac72d
Signed-off-by: Sona Mathew <sonarebecca.mathew@arm.com>
2024-12-17 10:24:33 -06:00
Arvind Ram Prakash
cc46166144 fix(cpus): workaround for Cortex-X4 erratum 2923985
Cortex-X4 erratum 2923935 is a Cat B erratum that applies
to all revisions <= r0p1 and is fixed in r0p2.

The workaround is to set CPUACTLR4_EL1[11:10] to 0b11.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2432808/latest

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I9207802ad479919a7f77c1271019fa2479e076ee
2024-12-11 16:09:20 -06:00
Ryan Everett
8edd6c6f45 docs(auth): extrapolate on the functions within a CM
Add descriptions for the various parameters for each
function.
Add more description to the example implementation.

Change-Id: I4b7a1ff38914d061e499c1b67e762a484688ee05
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-12-09 14:00:33 +00:00
Ryan Everett
db7eb68817 fix(cpus): workaround for Cortex-X4 erratum 3076789
Cortex-X4 erratum 3076789 is a Cat B erratum that is present
in revisions r0p0, r0p1 and is fixed in r0p2.

The workaround is to set chicken bits CPUACTLR3_EL1[14:13]=0b11
and CPUACTLR_EL1[52] = 1.
Expected performance degradation is < 0.5%, but isolated
benchmark components might see higher impact.

SDEN documentation:
https://developer.arm.com/documentation/SDEN2432808/latest

Change-Id: Ib100bfab91efdb6330fdcdac127bcc5732d59196
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-09-30 13:49:13 +01:00
Arvind Ram Prakash
609d08a86d fix(cpus): workaround for Cortex-X4 erratum 2897503
Cortex-X4 erratum 2897503 is a Cat B erratum that applies
to all revisions <= r0p1 and is fixed in r0p2.

The workaround is to set CPUACTLR4_EL1[8] to 1.

SDEN documentation:
https://developer.arm.com/documentation/SDEN-2432808/latest

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I3178a890b6f1307b310e817af75f8fdfb8668cc9
2024-09-24 23:16:12 +02:00
Arvind Ram Prakash
b1bde25ed9 fix(cpus): workaround for Cortex-A720 erratum 2792132
Cortex-A720 erratum 2792132 is a Cat B erratum that is present
in revision r0p0, r0p1 and is fixed in r0p2.

The workaround is to set bit[26] of the CPUACTLR2_EL1 to 1.

SDEN documentation:
https://developer.arm.com/documentation/SDEN2439421/latest

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I8d11fe65a2ab5f79244cc3395d0645f77256304c
2024-08-19 15:19:08 -05:00
Arvind Ram Prakash
4a97ff5111 feat(cpus): workaround for Cortex-A520(2938996) and Cortex-X4(2726228)
This patch implements errata functions for two errata, both of them
disable TRBE as a workaround. This patch doesn't have functions
that disable TRBE but only implemented helper functions that are
used to detect cores affected by Errata 2938996(Cortex-A520) & 2726228(Cortex-X4)

Cortex-X4 SDEN documentation:
    https://developer.arm.com/documentation/SDEN2432808/latest

Cortex-A520 SDEN Documentation:
    https://developer.arm.com/documentation/SDEN-2444153/latest

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I8f886a1c21698f546a0996c719cc27dc0a23633a
2024-08-17 09:37:55 +01:00