software/arm-trusted-firmware.git/bl1, branch master

fix(bl): use #ifdef for aarch64 flags

2026-06-22T17:32:17+00:00

The __aarch64__ is only defined, without a value, it should be checked with #ifdef. This corrects -Wundef GCC warning. Change-Id: I5eaced1ed72b0c45388cc4c0a896936a66fffd2c Signed-off-by: Yann Gautier

fix(bl1): harden FWU copy/auth overflow checks

2026-04-13T12:00:33+00:00

Use full-size overflow checks so invalid image source/size values can’t wrap and slip past validation during copy/auth, preventing out-of-range memory access. Change-Id: Ie49793dd13e68f044c2ae78f33fcb1326d2853b4 Signed-off-by: Manish V Badarkhe

fix(cpus): unconstrain WORKAROUND_CVE_2025_0647

2026-04-10T14:10:14+00:00

Conditional flag enables are strongly discouraged in TF-A because they cause cyclic dependencies that we are not equipped to deal with. On a real platform, ARM_ARCH_{MAJOR, MINOR} should be set in platform.mk but WORKAROUND_CVE_2025_0647 gets its value before platform.mk is evaluated. Further, WORKAROUND_CVE_2025_0647 is only present on cores the feature set of which is known ahead of time. Using ARM_ARCH_{MAJOR, MINOR} is redundant and incorrect (as it sidesteps the feature detection mechanism). This patch solves both of these issues by making WORKAROUND_CVE_2025_0647 unconstrained by ARM_ARCH_{MAJOR, MINOR} and making it buildable on a v8.0 target. Running the workaround will only happen on affected cores which, by definition, all implement armv8.5 so doing any checks in unnecessary. Change-Id: Ia164077f09b552d42b558ada4f6036cabbd34f64 Signed-off-by: Boyan Karatotev

Merge "fix(bl1): clear loaded ID on pre-image load failure" into integration

2026-04-09T12:51:38+00:00

refactor(bl1): drop ENABLE_RME check

2026-03-03T10:15:40+00:00

Starting BL2 in EL3 is not tied to ENABLE_RME but to the boot flow. In an RME-enabled boot flow, BL2 runs at EL3 and boots BL31. Therefore, BL2_RUNS_AT_EL3 should be used to handle the transition to the next boot image. This change prepares the codebase for later patches that add feature detection support for RME. Signed-off-by: Arunachalam Ganapathy Change-Id: Ic19b73f1edf5b5ccbd530c662c91e1d38a01fa36

fix(bl1): clear loaded ID on pre-image load failure

2026-02-19T10:30:27+00:00

if bl1_plat_handle_pre_image_load() fails, remove the previously marked loaded ID before returning -EPERM to avoid stale BL1-FWU state. Change-Id: I6421fd764ec3d3e9ce896e4339921149fec118c6 Signed-off-by: Manish V Badarkhe

feat(crypto): enable the runtime instrumentation for crypto extension

2026-01-28T16:30:41+00:00

Add runtime instrumentation for the authentication process in BL1 and BL2, to measure the speedup of the authentication after enabling the crypto extension. Change-Id: Ieea927e7e8bd0d109525f28b06510acf0ab62e5c Signed-off-by: Xialin Liu

feat(crypto): enable access to SIMD crypto in BL1 and BL2

2026-01-28T16:30:38+00:00

Disable the floating point register traps in image auth and loading in BL1 and BL2 to allow the access to SIMD crypto extension during the booting process. Change-Id: I9c20715d54f5d2988aa706e91e1a657dcd06dfc2 Signed-off-by: Xialin Liu

fix(security): add workaround for CVE-2025-0647

2026-01-23T21:14:36+00:00

This workaround fixes an issue with the CPP RCTX instruction by issuing an instruction patch sequence to trap uses of the CPP RCTX instruction from EL0, EL1, and EL2 to EL3 and perform a workaround procedure using the implementation defined trap handler to ensure the correct behavior of the system. In addition, it includes an EL3 API to be used if EL3 firmware needs to use the CPP RCTX instruction. This saves the overhead of exception handling, and EL3 does not generically support trapping EL3->EL3, and adding support for that is not trivial due to the implications for context management. The issue affects the following CPUs: C1-Premium C1-Ultra Cortex-A710 Cortex-X2 Cortex-X3 Cortex-X4 Cortex-X925 Neoverse N2 Neoverse V2 Neoverse V3 Neoverse V3AE (handled same as V3 CPU in TF-A CPU-Lib) Arm Security Bulletin Document: https://developer.arm.com/documentation/111546 Change-Id: I5e7589afbeb69ebb79c01bec80e29f572aff3d89 Signed-off-by: John Powell Signed-off-by: Govindraj Raja

feat(el3-runtime): translate EL3 handled exceptions to C and always call prepare_el3_entry

2025-12-19T07:51:40+00:00

Exception handling in BL31 is tricky business and to satisfy the varying requirements of the different code paths it has thus far largely been written in assembly. However, assembly is extremely tedious to read and modify. Similar to context management, it is desirable to have as much as possible in C. C code is generally easier to follow and can enable the compiler to do more optimisations on surrounding code. Most exceptions that BL31 deals with are the synchronous exceptions and those are processed within BL31. They already get prepared for EL3 entry and after the initial dispatch end up in C. So the dispatch can also be converted in C. Interrupt exceptions are very similar so are converted too. Finally, asynchronous external aborts share some code with synchronous external aborts and may end up being processed deeper in BL31. So they can safely be prepared for EL3 entry too and converted to C so that they can share code properly. The IMP DEF exceptions are not part of this refactor as their speed may be important. There is currently little that uses them, but they can be converted to C too once their use expands and usage allows it. This refactor allows to expand the responsibilities of prepare_el3_entry(). Its role is already to prepare context for executing within EL3 but with this patch EL3 execution is synonymous with C runtime execution. So it's given the responsibility of saving spsr and elr as well as putting the runtime stack in. When a synchronous exception happens, the only possible paths are to enter the C EL3 runtime, exiting via el3_exit(), or to panic. In the EL3 runtime case, we always need prepare_el3_entry() and the runtime stack, whereas in the panic case, this doesn't matter as we will never return. So hoist the prepare_el3_entry() call and the changing of the stacks as early as possible and make the rest of the code agnostic of this. This patch also gets rid of smc_prohibited. It is an optimisation by skipping prepare_el3_entry() when a bad smc call happens. However, speed doesn't matter in this case as this is an erroneous case. Change-Id: I411af9d17ef4046a736b1f4f5f8fbc9c28e66106 Signed-off-by: Boyan Karatotev