Merge changes I716e0539,I6c327584,I38509b94,I5ff3c402,I44591e4b, ... into integrationHEADmaster

* changes:
  feat(st): enable some warning flags
  feat(build): enable -Wundef for C files if W >= 1
  refactor(zlib): move zlib to a lib
  refactor(compiler-rt): move compiler_rt to a lib
  feat(build): introduce BL_FLAGS
  fix(st-usb): staticize dwc3_dev_init
  fix(st): staticize verify_signature
  fix(stm32mp1): manage all flags for PKA algos
  refactor(st-clock): remove STM32MP_M33_TDCID flag
  fix(xlat): check definition of PLAT_XLAT_TABLES_DYNAMIC flag
  fix(el3-runtime): add some missing prototypes
  fix(scmi): remove scmi_msg_get_voltage_handler
  fix(io): correct SIZE_MAX management
  fix(libc): define __BSD_VISIBLE to 0
  fix(build): move FIRME_SUPPORT flags to Makefile

34 files changed, 80 insertions, 60 deletions

diff --git a/Makefile b/Makefile
index 0e6209618..67defe4d1 100644
--- a/Makefile
+++ b/Makefile
@@ -169,8 +169,6 @@ endif
 ################################################################################
 # Common sources and include directories
 ################################################################################
-include lib/compiler-rt/compiler-rt.mk
-
 # Allow overriding the timestamp, for example for reproducible builds, or to
 # synchronize timestamps across multiple projects.
 # This must be set to a C string (including quotes where applicable).
@@ -191,8 +189,7 @@ BL_COMMON_SOURCES	+=	common/bl_common.c			\
 				plat/common/plat_bl_common.c		\
 				plat/common/plat_log_common.c		\
 				plat/common/${ARCH}/plat_common.c	\
-				plat/common/${ARCH}/platform_helpers.S	\
-				${COMPILER_RT_SRCS}
+				plat/common/${ARCH}/platform_helpers.S
 
 ifeq ($($(ARCH)-cc-id),arm-clang)
 	BL_COMMON_SOURCES	+=	lib/${ARCH}/armclang_printf.S
@@ -668,6 +665,8 @@ $(call assert_booleans,\
 	TEST_IO_SHORT_READ_FI \
 	SDEI_SUPPORT \
 	SMC_PCI_SUPPORT \
+	FIRME_SUPPORT \
+	FIRME_SUPPORT_IDE_KM \
 ))
 
 # Numeric_Flags
@@ -960,6 +959,8 @@ $(call add_defines,\
 	SDEI_SUPPORT \
 	USE_GIC_DRIVER \
 	SMC_PCI_SUPPORT \
+	FIRME_SUPPORT \
+	FIRME_SUPPORT_IDE_KM \
 ))
 
 ifeq (${PLATFORM_REPORT_CTX_MEM_USE}, 1)
@@ -1013,6 +1014,12 @@ endif #(SPD)
 include ${MAKE_HELPERS_DIRECTORY}cflags.mk
 
 ################################################################################
+# Include compiler-rt. It is built with MAKE_LIB so it must be included after
+# some macros are defined, especially BUILD_PLAT
+################################################################################
+include lib/compiler-rt/compiler-rt.mk
+
+################################################################################
 # Build targets
 ################################################################################
 
diff --git a/bl31/bl31.mk b/bl31/bl31.mk
index 781f3025e..f8dded08d 100644
--- a/bl31/bl31.mk
+++ b/bl31/bl31.mk
@@ -250,8 +250,6 @@ $(call assert_booleans,\
 	CRASH_REPORTING \
 	DSU_PDL2_SUPPORT \
 	EL3_EXCEPTION_HANDLING \
-	FIRME_SUPPORT \
-	FIRME_SUPPORT_IDE_KM \
 	USE_DSU_DRIVER \
 ))
 
@@ -267,6 +265,4 @@ $(call add_defines,\
 	DSU_PDL2_SUPPORT \
 	EL3_EXCEPTION_HANDLING \
 	USE_DSU_DRIVER \
-	FIRME_SUPPORT \
-	FIRME_SUPPORT_IDE_KM \
 ))
diff --git a/drivers/io/io_block.c b/drivers/io/io_block.c
index ea7512272..db8eaba9a 100644
--- a/drivers/io/io_block.c
+++ b/drivers/io/io_block.c
@@ -196,9 +196,12 @@ static int block_len(io_entity_t *entity, size_t *length)
 	assert(length != NULL);
 
 	cur = (block_dev_state_t *)entity->info;
+
+#ifndef __aarch64__
 	if (cur->size > (unsigned long long)SIZE_MAX) {
 		return -EINVAL;
 	}
+#endif
 
 	*length = (size_t)cur->size;
 	return 0;
diff --git a/drivers/io/io_fip.c b/drivers/io/io_fip.c
index f06e98a2f..c70d435c1 100644
--- a/drivers/io/io_fip.c
+++ b/drivers/io/io_fip.c
@@ -405,11 +405,15 @@ static int fip_file_open(io_dev_info_t *dev_info, const uintptr_t spec,
 		if ((size == 0U) ||
 		    (offset >= fip_size64) ||
 		    (size > fip_size64) ||
-		    (offset + size < offset) ||
 		    (offset + size > fip_size64) ||
+#ifdef __aarch64__
+		    check_u64_overflow(offset, size)
+#else
 		    (offset > (uint64_t)SIZE_MAX) ||
 		    (size > (uint64_t)SIZE_MAX) ||
-		    (offset + size > (uint64_t)SIZE_MAX)) {
+		    (offset + size > (uint64_t)SIZE_MAX)
+#endif
+		   ) {
 			ERROR("FIP entry bounds invalid\n");
 			result = -EINVAL;
 			goto fip_file_open_close;
diff --git a/drivers/io/io_mtd.c b/drivers/io/io_mtd.c
index abf0d3498..73418fe92 100644
--- a/drivers/io/io_mtd.c
+++ b/drivers/io/io_mtd.c
@@ -211,9 +211,12 @@ static int mtd_len(io_entity_t *entity, size_t *length)
 	assert(length != NULL);
 
 	cur = (mtd_dev_state_t *)entity->info;
+
+#ifndef __aarch64__
 	if (cur->size > (unsigned long long)SIZE_MAX) {
 		return -EINVAL;
 	}
+#endif
 
 	*length = (size_t)cur->size;
 	return 0;
diff --git a/drivers/scmi-msg/entry.c b/drivers/scmi-msg/entry.c
index 5ac68e1e6..14db61c54 100644
--- a/drivers/scmi-msg/entry.c
+++ b/drivers/scmi-msg/entry.c
@@ -14,7 +14,6 @@
 #pragma weak scmi_msg_get_clock_handler
 #pragma weak scmi_msg_get_rstd_handler
 #pragma weak scmi_msg_get_pd_handler
-#pragma weak scmi_msg_get_voltage_handler
 #pragma weak scmi_msg_get_sensor_handler
 
 scmi_msg_handler_t scmi_msg_get_clock_handler(struct scmi_msg *msg __unused)
@@ -32,11 +31,6 @@ scmi_msg_handler_t scmi_msg_get_pd_handler(struct scmi_msg *msg __unused)
 	return NULL;
 }
 
-scmi_msg_handler_t scmi_msg_get_voltage_handler(struct scmi_msg *msg __unused)
-{
-	return NULL;
-}
-
 scmi_msg_handler_t scmi_msg_get_sensor_handler(struct scmi_msg *msg __unused)
 {
 	return NULL;
diff --git a/drivers/st/clk/clk-stm32mp2.c b/drivers/st/clk/clk-stm32mp2.c
index f34739ae9..a91389b21 100644
--- a/drivers/st/clk/clk-stm32mp2.c
+++ b/drivers/st/clk/clk-stm32mp2.c
@@ -711,7 +711,6 @@ static const char *clk_stm32_get_oscillator_name(enum stm32_osc id)
 	return NULL;
 }
 
-#if !STM32MP_M33_TDCID
 static void clk_oscillator_set_bypass(struct stm32_clk_priv *priv, int id,
 				      bool digbyp, bool bypass)
 {
@@ -801,7 +800,6 @@ static int clk_oscillator_wait_ready_on(struct stm32_clk_priv *priv, int id)
 {
 	return clk_oscillator_wait_ready(priv, id, true);
 }
-#endif /* !STM32MP_M33_TDCID */
 #endif /* IMAGE_BL2 */
 
 static unsigned long clk_stm32_osc_recalc_rate(struct stm32_clk_priv *priv,
@@ -910,10 +908,8 @@ static void clk_stm32_osc_init(struct stm32_clk_priv *priv, int id)
 static struct stm32_clk_ops clk_stm32_osc_ops = {
 	.recalc_rate	= clk_stm32_osc_recalc_rate,
 	.is_enabled	= clk_stm32_osc_gate_is_enabled,
-#if !STM32MP_M33_TDCID
 	.enable		= clk_stm32_osc_gate_enable,
 	.disable	= clk_stm32_osc_gate_disable,
-#endif
 	.init		= clk_stm32_osc_init,
 };
 
diff --git a/drivers/st/usb_dwc3/usb_dwc3.c b/drivers/st/usb_dwc3/usb_dwc3.c
index d6f2bbcac..110e34bfa 100644
--- a/drivers/st/usb_dwc3/usb_dwc3.c
+++ b/drivers/st/usb_dwc3/usb_dwc3.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2025, STMicroelectronics - All Rights Reserved
+ * Copyright (c) 2015-2026, STMicroelectronics - All Rights Reserved
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -2173,7 +2173,7 @@ static enum usb_status dwc3_set_dev_speed(dwc3_handle_t *dwc3_handle, uint8_t sp
  *         the configuration information for the specified USBx peripheral.
  * @retval HAL status
  */
-enum usb_status dwc3_dev_init(dwc3_handle_t *dwc3_handle, uint8_t speed, uint8_t intr_dev)
+static enum usb_status dwc3_dev_init(dwc3_handle_t *dwc3_handle, uint8_t speed, uint8_t intr_dev)
 {
 	uint32_t reg;
 	uint8_t i;
diff --git a/include/common/runtime_svc.h b/include/common/runtime_svc.h
index 26e8d6f28..0547adf2c 100644
--- a/include/common/runtime_svc.h
+++ b/include/common/runtime_svc.h
@@ -7,6 +7,7 @@
 #ifndef RUNTIME_SVC_H
 #define RUNTIME_SVC_H
 
+#include <context.h>
 #include <common/bl_common.h>		/* to include exception types */
 #include <lib/cassert.h>
 #include <lib/utils_def.h>
@@ -125,6 +126,8 @@ static inline uint32_t get_unique_oen_from_smc_fid(uint32_t fid)
 /*******************************************************************************
  * Function & variable prototypes
  ******************************************************************************/
+void handler_interrupt_exception(cpu_context_t *ctx);
+void handler_sync_exception(cpu_context_t *ctx);
 void runtime_svc_init(void);
 uintptr_t handle_runtime_svc(uint32_t smc_fid, void *cookie, void *handle,
 						unsigned int flags);
diff --git a/include/lib/el3_runtime/context_el1.h b/include/lib/el3_runtime/context_el1.h
index f320d2c5f..3011f0c10 100644
--- a/include/lib/el3_runtime/context_el1.h
+++ b/include/lib/el3_runtime/context_el1.h
@@ -11,6 +11,8 @@
 
 #ifndef __ASSEMBLER__
 
+#include <stdint.h>
+
 /*******************************************************************************
  * EL1 Registers:
  * AArch64 EL1 system register context structure for preserving the
diff --git a/include/lib/extensions/sysreg128.h b/include/lib/extensions/sysreg128.h
index 8854856b6..433633323 100644
--- a/include/lib/extensions/sysreg128.h
+++ b/include/lib/extensions/sysreg128.h
@@ -9,9 +9,9 @@
 
 #ifndef __ASSEMBLER__
 
-#if ENABLE_FEAT_D128
 #include <stdint.h>
 
+#if ENABLE_FEAT_D128
 typedef uint128_t sysreg_t;
 
 #define PAR_EL1_D128	(((sysreg_t)(1ULL)) << (64))
diff --git a/include/lib/libc/cdefs.h b/include/lib/libc/cdefs.h
index ecedb264c..1c708b3cf 100644
--- a/include/lib/libc/cdefs.h
+++ b/include/lib/libc/cdefs.h
@@ -55,4 +55,6 @@
 #define __predict_true(exp)     (exp)
 #define __predict_false(exp)    (exp)
 
+#define __BSD_VISIBLE		0
+
 #endif /* CDEFS_H */
diff --git a/include/lib/xlat_tables/xlat_tables_v2.h b/include/lib/xlat_tables/xlat_tables_v2.h
index 88c23e15b..d2c3a8c95 100644
--- a/include/lib/xlat_tables/xlat_tables_v2.h
+++ b/include/lib/xlat_tables/xlat_tables_v2.h
@@ -298,7 +298,7 @@ void mmap_add_region_alloc_va_ctx(xlat_ctx_t *ctx, mmap_region_t *mm);
  */
 void mmap_add_alloc_va(mmap_region_t *mm);
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 /*
  * Add a dynamic region with defined base PA and base VA. This type of region
  * can be added and removed even after the translation tables are initialized.
diff --git a/include/lib/xlat_tables/xlat_tables_v2_helpers.h b/include/lib/xlat_tables/xlat_tables_v2_helpers.h
index 77277615f..8af1f9f70 100644
--- a/include/lib/xlat_tables/xlat_tables_v2_helpers.h
+++ b/include/lib/xlat_tables/xlat_tables_v2_helpers.h
@@ -78,7 +78,7 @@ struct xlat_ctx {
 	 * Keep track of how many regions are mapped in each table. The base
 	 * table can't be unmapped so it isn't needed to keep track of it.
 	 */
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 	int *tables_mapped_regions;
 #endif /* PLAT_XLAT_TABLES_DYNAMIC */
 
@@ -112,7 +112,7 @@ struct xlat_ctx {
 	int xlat_regime;
 };
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 #define XLAT_ALLOC_DYNMAP_STRUCT(_ctx_name, _xlat_tables_count)		\
 	static int _ctx_name##_mapped_regions[_xlat_tables_count];
 
diff --git a/lib/compiler-rt/compiler-rt.mk b/lib/compiler-rt/compiler-rt.mk
index 2b16504bf..0f9abde53 100644
--- a/lib/compiler-rt/compiler-rt.mk
+++ b/lib/compiler-rt/compiler-rt.mk
@@ -28,11 +28,11 @@
 # POSSIBILITY OF SUCH DAMAGE.
 #
 
-COMPILER_RT_SRCS	:=	lib/compiler-rt/builtins/popcountdi2.c		\
+LIBCOMPILER_RT_SRCS	:=	lib/compiler-rt/builtins/popcountdi2.c		\
 				lib/compiler-rt/builtins/popcountsi2.c
 
 ifeq (${ARCH},aarch32)
-COMPILER_RT_SRCS	+=	lib/compiler-rt/builtins/arm/aeabi_ldivmod.S	\
+LIBCOMPILER_RT_SRCS	+=	lib/compiler-rt/builtins/arm/aeabi_ldivmod.S	\
 				lib/compiler-rt/builtins/arm/aeabi_uldivmod.S	\
 				lib/compiler-rt/builtins/arm/aeabi_memcpy.S	\
 				lib/compiler-rt/builtins/arm/aeabi_memset.S	\
@@ -42,3 +42,5 @@ COMPILER_RT_SRCS	+=	lib/compiler-rt/builtins/arm/aeabi_ldivmod.S	\
 				lib/compiler-rt/builtins/lshrdi3.c		\
 				lib/compiler-rt/builtins/udivmoddi4.c
 endif
+
+$(eval $(call MAKE_LIB,compiler_rt))
diff --git a/lib/xlat_tables_v2/xlat_tables_context.c b/lib/xlat_tables_v2/xlat_tables_context.c
index a648dd97a..56166988b 100644
--- a/lib/xlat_tables_v2/xlat_tables_context.c
+++ b/lib/xlat_tables_v2/xlat_tables_context.c
@@ -60,7 +60,7 @@ void mmap_add_alloc_va(mmap_region_t *mm)
 	}
 }
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 
 int mmap_add_dynamic_region(unsigned long long base_pa, uintptr_t base_va,
 			    size_t size, unsigned int attr)
@@ -207,7 +207,7 @@ int xlat_make_tables_readonly(void)
  * region. Therefore, in this case we have to assume that the whole address
  * space size might be mapped.
  */
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 #define MAX_PHYS_ADDR	tf_xlat_ctx.pa_max_address
 #else
 #define MAX_PHYS_ADDR	tf_xlat_ctx.max_pa
diff --git a/lib/xlat_tables_v2/xlat_tables_core.c b/lib/xlat_tables_v2/xlat_tables_core.c
index 023b7c890..c36bfbdd2 100644
--- a/lib/xlat_tables_v2/xlat_tables_core.c
+++ b/lib/xlat_tables_v2/xlat_tables_core.c
@@ -30,7 +30,7 @@ static inline __attribute__((unused)) void xlat_clean_dcache_range(uintptr_t add
 	}
 }
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 
 /*
  * The following functions assume that they will be called using subtables only.
@@ -290,7 +290,7 @@ static inline unsigned int  xlat_tables_va_to_index(const uintptr_t table_base_v
 	return (unsigned int)((va - table_base_va) >> XLAT_ADDR_SHIFT(level));
 }
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 
 /*
  * From the given arguments, it decides which action to take when unmapping the
@@ -608,7 +608,7 @@ static uintptr_t xlat_tables_map_region(xlat_ctx_t *ctx, mmap_region_t *mm,
 	table_idx_va = xlat_tables_find_start_va(mm, table_base_va, level);
 	table_idx = xlat_tables_va_to_index(table_base_va, table_idx_va, level);
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 	if (level > ctx->base_level)
 		xlat_table_inc_regions_count(ctx, table_base);
 #endif
@@ -768,7 +768,7 @@ static int mmap_add_region_check(const xlat_ctx_t *ctx, const mmap_region_t *mm)
 		 */
 		if (fully_overlapped_va) {
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 			if (((mm->attr & MT_DYNAMIC) != 0U) ||
 			    ((mm_cursor->attr & MT_DYNAMIC) != 0U)) {
 				return -EPERM;
@@ -989,7 +989,7 @@ void mmap_add_ctx(xlat_ctx_t *ctx, const mmap_region_t *mm)
 	}
 }
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 
 int mmap_add_dynamic_region_ctx(xlat_ctx_t *ctx, mmap_region_t *mm)
 {
@@ -1248,7 +1248,7 @@ void __init init_xlat_tables_ctx(xlat_ctx_t *ctx)
 	/* All tables must be zeroed before mapping any region. */
 	zeromem(ctx->base_table, ctx->base_table_entries * sizeof(uint64_t));
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 	zeromem(ctx->tables_mapped_regions, ctx->tables_num * sizeof(uint32_t));
 #endif
 	for (int i = 0; i < ctx->tables_num; i++) {
diff --git a/lib/xlat_tables_v2/xlat_tables_private.h b/lib/xlat_tables_v2/xlat_tables_private.h
index 4bfe73b29..920e263b6 100644
--- a/lib/xlat_tables_v2/xlat_tables_private.h
+++ b/lib/xlat_tables_v2/xlat_tables_private.h
@@ -13,7 +13,7 @@
 
 #include <lib/xlat_tables/xlat_tables_defs.h>
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 /*
  * Private shifts and masks to access fields of an mmap attribute
  */
diff --git a/lib/xlat_tables_v2/xlat_tables_utils.c b/lib/xlat_tables_v2/xlat_tables_utils.c
index 582019071..8153297b5 100644
--- a/lib/xlat_tables_v2/xlat_tables_utils.c
+++ b/lib/xlat_tables_v2/xlat_tables_utils.c
@@ -270,7 +270,7 @@ void xlat_tables_print(xlat_ctx_t *ctx)
 	VERBOSE("  Entries @initial lookup level: %u\n",
 		ctx->base_table_entries);
 
-#if PLAT_XLAT_TABLES_DYNAMIC
+#if defined(PLAT_XLAT_TABLES_DYNAMIC) && PLAT_XLAT_TABLES_DYNAMIC
 	used_page_tables = 0;
 	for (int i = 0; i < ctx->tables_num; ++i) {
 		if (ctx->tables_mapped_regions[i] != 0)
diff --git a/lib/zlib/zlib.mk b/lib/zlib/zlib.mk
index a8937a776..9c0458fad 100644
--- a/lib/zlib/zlib.mk
+++ b/lib/zlib/zlib.mk
@@ -7,7 +7,7 @@
 ZLIB_PATH	:=	lib/zlib
 
 # Imported from zlib 1.2.11 (do not modify them)
-ZLIB_SOURCES	:=	$(addprefix $(ZLIB_PATH)/,	\
+LIBZLIB_SRCS	:=	$(addprefix $(ZLIB_PATH)/,	\
 					adler32.c	\
 					crc32.c		\
 					inffast.c	\
@@ -16,10 +16,10 @@ ZLIB_SOURCES	:=	$(addprefix $(ZLIB_PATH)/,	\
 					zutil.c)
 
 # Implemented for TF
-ZLIB_SOURCES	+=	$(addprefix $(ZLIB_PATH)/,	\
+LIBZLIB_SRCS	+=	$(addprefix $(ZLIB_PATH)/,	\
 					tf_gunzip.c)
 
 INCLUDES	+=	-Iinclude/lib/zlib
 
-# REVISIT: the following flags need not be given globally
-TF_CFLAGS	+=	-DZ_SOLO -DDEF_WBITS=31
+LIBZLIB_CFLAGS	:=	-DZ_SOLO -DDEF_WBITS=31
+$(eval $(call MAKE_LIB,zlib))
diff --git a/make_helpers/build_macros.mk b/make_helpers/build_macros.mk
index f52427ddd..033e7242e 100644
--- a/make_helpers/build_macros.mk
+++ b/make_helpers/build_macros.mk
@@ -407,7 +407,7 @@ $(eval BL_CFLAGS := $($(4)_CFLAGS))
 
 $(OBJ): $(2) $(filter-out %.d,$(MAKEFILE_LIST)) | $$$$(@D)/ $(BL_INCLUDE_DIRS:%=%/)
 	$$(s)echo "  CC      $$<"
-	$$(q)$($(ARCH)-cc) $$(LTO_CFLAGS) $$(TF_CFLAGS) $(BL_CPPFLAGS) $(BL_CFLAGS) $(call MAKE_DEP,$(DEP),$(OBJ)) -c $$< -o $$@
+	$$(q)$($(ARCH)-cc) $$(LTO_CFLAGS) $$(TF_CFLAGS) $(BL_CPPFLAGS) $(BL_CFLAGS)  $$(BL_FLAGS) $(call MAKE_DEP,$(DEP),$(OBJ)) -c $$< -o $$@
 
 -include $(DEP)
 
diff --git a/make_helpers/cflags.mk b/make_helpers/cflags.mk
index 3aacd4659..d00c8e17d 100644
--- a/make_helpers/cflags.mk
+++ b/make_helpers/cflags.mk
@@ -52,8 +52,6 @@ WARNING2 := $(WARNING1)
 WARNING2 += -Wold-style-definition
 WARNING2 += -Wmissing-prototypes
 WARNING2 += -Wmissing-format-attribute
-# TF-A aims to comply with this eventually. Effort too large at present
-WARNING2 += -Wundef
 # currently very involved and many platforms set this off
 WARNING2 += -Wunused-const-variable=2
 
@@ -69,6 +67,15 @@ WARNING3 += -Wpacked
 WARNING3 += -Wpointer-arith
 WARNING3 += -Wswitch-default
 
+# The -Wundef cannot be easily handled through warning flags.
+# This would bring warning for libs (compiler-rt, zlib).
+# Instead add it to BL_FLAGS that is only used by MAKE_C macro.
+# TODO: remove the W=1 check for -Wundef when all the related warnings
+# are corrected.
+ifeq ($(shell test $(W) -ge 1 && echo true),true)
+BL_FLAGS += -Wundef
+endif
+
 cflags-common	+=	$(WARNING$(W))
 ifneq (${E},0)
 	cflags-common	+= -Werror
diff --git a/plat/altera/soc/agilex3/platform.mk b/plat/altera/soc/agilex3/platform.mk
index a4b3c175e..2c977cee3 100644
--- a/plat/altera/soc/agilex3/platform.mk
+++ b/plat/altera/soc/agilex3/platform.mk
@@ -83,7 +83,6 @@ BL2_SOURCES		+=	\
 
 include lib/zlib/zlib.mk
 PLAT_INCLUDES	+=	-Ilib/zlib
-BL2_SOURCES	+=	$(ZLIB_SOURCES)
 
 BL31_SOURCES	+=	\
 		drivers/arm/cci/cci.c					\
diff --git a/plat/hisilicon/hikey/platform.mk b/plat/hisilicon/hikey/platform.mk
index 0b919e566..8d1ed2793 100644
--- a/plat/hisilicon/hikey/platform.mk
+++ b/plat/hisilicon/hikey/platform.mk
@@ -97,7 +97,6 @@ endif
 
 include lib/zlib/zlib.mk
 PLAT_INCLUDES		+=	-Ilib/zlib
-BL2_SOURCES		+=	$(ZLIB_SOURCES)
 
 HIKEY_GIC_SOURCES	:=	drivers/arm/gic/common/gic_common.c	\
 				drivers/arm/gic/v2/gicv2_main.c		\
diff --git a/plat/hisilicon/hikey960/platform.mk b/plat/hisilicon/hikey960/platform.mk
index 286a01d55..dcdade389 100644
--- a/plat/hisilicon/hikey960/platform.mk
+++ b/plat/hisilicon/hikey960/platform.mk
@@ -97,7 +97,6 @@ endif
 
 include lib/zlib/zlib.mk
 PLAT_INCLUDES		+=	-Ilib/zlib
-BL2_SOURCES		+=	$(ZLIB_SOURCES)
 
 BL31_SOURCES		+=	drivers/arm/cci/cci.c			\
 				drivers/arm/pl061/pl061_gpio.c		\
diff --git a/plat/intel/soc/agilex/platform.mk b/plat/intel/soc/agilex/platform.mk
index ff3f382cb..136be4a82 100644
--- a/plat/intel/soc/agilex/platform.mk
+++ b/plat/intel/soc/agilex/platform.mk
@@ -65,7 +65,6 @@ BL2_SOURCES     +=	\
 
 include lib/zlib/zlib.mk
 PLAT_INCLUDES	+=	-Ilib/zlib
-BL2_SOURCES	+=	$(ZLIB_SOURCES)
 
 BL31_SOURCES	+=	\
 		drivers/arm/cci/cci.c					\
diff --git a/plat/intel/soc/agilex5/platform.mk b/plat/intel/soc/agilex5/platform.mk
index 3a3f2167f..94d68ea09 100644
--- a/plat/intel/soc/agilex5/platform.mk
+++ b/plat/intel/soc/agilex5/platform.mk
@@ -83,7 +83,6 @@ BL2_SOURCES		+=	\
 
 include lib/zlib/zlib.mk
 PLAT_INCLUDES	+=	-Ilib/zlib
-BL2_SOURCES	+=	$(ZLIB_SOURCES)
 
 BL31_SOURCES	+=	\
 		drivers/arm/cci/cci.c					\
diff --git a/plat/intel/soc/stratix10/platform.mk b/plat/intel/soc/stratix10/platform.mk
index 6f459b1fb..d1bf35e98 100644
--- a/plat/intel/soc/stratix10/platform.mk
+++ b/plat/intel/soc/stratix10/platform.mk
@@ -61,7 +61,6 @@ BL2_SOURCES     +=	\
 
 include lib/zlib/zlib.mk
 PLAT_INCLUDES	+=	-Ilib/zlib
-BL2_SOURCES	+=	$(ZLIB_SOURCES)
 
 BL31_SOURCES	+=	\
 		drivers/arm/cci/cci.c					\
diff --git a/plat/renesas/rcar/platform.mk b/plat/renesas/rcar/platform.mk
index cbee73b3d..f068ea54d 100644
--- a/plat/renesas/rcar/platform.mk
+++ b/plat/renesas/rcar/platform.mk
@@ -366,8 +366,7 @@ BL2_SOURCES	+=	plat/renesas/rcar/bl2_plat_setup.c	\
 ifeq (${RCAR_GEN3_BL33_GZIP},1)
 include lib/zlib/zlib.mk
 
-BL2_SOURCES	+=	common/image_decompress.c               \
-			$(ZLIB_SOURCES)
+BL2_SOURCES	+=	common/image_decompress.c
 endif
 
 ifneq (${ENABLE_STACK_PROTECTOR},0)
diff --git a/plat/rockchip/rv1126b/platform.mk b/plat/rockchip/rv1126b/platform.mk
index 810852c08..ec8c1ea1b 100644
--- a/plat/rockchip/rv1126b/platform.mk
+++ b/plat/rockchip/rv1126b/platform.mk
@@ -70,7 +70,6 @@ BL31_SOURCES		+=	${RK_GIC_SOURCES}				\
 				drivers/scmi-msg/smt.c				\
 				lib/cpus/aarch64/cortex_a53.S			\
 				$(LIBFDT_SRCS)					\
-				$(ZLIB_SOURCES)					\
 				${RK_PLAT_COMMON}/aarch64/plat_helpers.S	\
 				${RK_PLAT_COMMON}/aarch64/platform_common.c	\
 				${RK_PLAT_COMMON}/bl31_plat_setup.c		\
diff --git a/plat/socionext/uniphier/platform.mk b/plat/socionext/uniphier/platform.mk
index 4c12f725d..bac768542 100644
--- a/plat/socionext/uniphier/platform.mk
+++ b/plat/socionext/uniphier/platform.mk
@@ -121,8 +121,7 @@ ifeq (${FIP_GZIP},1)
 
 include lib/zlib/zlib.mk
 
-BL2_SOURCES		+=	common/image_decompress.c		\
-				$(ZLIB_SOURCES)
+BL2_SOURCES		+=	common/image_decompress.c
 
 $(eval $(call add_define,UNIPHIER_DECOMPRESS_GZIP))
 
diff --git a/plat/st/common/common.mk b/plat/st/common/common.mk
index 454f35b10..9c4976d93 100644
--- a/plat/st/common/common.mk
+++ b/plat/st/common/common.mk
@@ -32,6 +32,11 @@ ifeq ($(findstring clang,$(notdir $(CC))),)
 TF_CFLAGS			+=	-Wformat-signedness
 endif
 
+# TODO: those flags should be removed from here when they are enabled in cflags.mk
+BL_FLAGS			+=	-Wundef
+BL_FLAGS			+=	-Wold-style-definition
+BL_FLAGS			+=	-Wmissing-prototypes
+
 # Boot devices
 STM32MP_EMMC			?=	0
 STM32MP_SDMMC			?=	0
@@ -198,7 +203,6 @@ PLAT_BL_COMMON_SOURCES		+=	drivers/clk/clk.c				\
 					plat/st/common/stm32mp_dt.c
 
 BL2_SOURCES			+=	${FCONF_SOURCES} ${FCONF_DYN_SOURCES}
-BL2_SOURCES			+=	$(ZLIB_SOURCES)
 
 BL2_SOURCES			+=	drivers/io/io_fip.c				\
 					plat/st/common/bl2_io_storage.c			\
diff --git a/plat/st/common/stm32mp_crypto_lib.c b/plat/st/common/stm32mp_crypto_lib.c
index 6c70b50f9..36945727a 100644
--- a/plat/st/common/stm32mp_crypto_lib.c
+++ b/plat/st/common/stm32mp_crypto_lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022-2024, STMicroelectronics - All Rights Reserved
+ * Copyright (c) 2022-2026, STMicroelectronics - All Rights Reserved
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -141,8 +141,8 @@ static int get_plain_pk_from_asn1(void *pk_ptr, unsigned int pk_len, void **plai
 }
 
 #if STM32MP_CRYPTO_ROM_LIB
-uint32_t verify_signature(uint8_t *hash_in, uint8_t *pubkey_in,
-			  uint8_t *signature, uint32_t ecc_algo)
+static uint32_t verify_signature(uint8_t *hash_in, uint8_t *pubkey_in,
+				 uint8_t *signature, uint32_t ecc_algo)
 {
 	int ret;
 
diff --git a/plat/st/stm32mp1/platform.mk b/plat/st/stm32mp1/platform.mk
index 1f2318738..2e13aabf1 100644
--- a/plat/st/stm32mp1/platform.mk
+++ b/plat/st/stm32mp1/platform.mk
@@ -88,6 +88,8 @@ endif
 endif
 
 PKA_USE_NIST_P256	?=	0
+PKA_USE_NIST_P521	?=	0
+PKA_USE_BRAINPOOL_P256R1 ?=	0
 PKA_USE_BRAINPOOL_P256T1 ?=	0
 
 # Disable Neon support: runtime may conflict with non-secure world
@@ -159,8 +161,10 @@ endif
 # Enable flags for C files
 $(call assert_booleans,\
 	$(sort \
+		PKA_USE_BRAINPOOL_P256R1 \
 		PKA_USE_BRAINPOOL_P256T1 \
 		PKA_USE_NIST_P256 \
+		PKA_USE_NIST_P521 \
 		STM32MP_CRYPTO_ROM_LIB \
 		STM32MP_DDR_32BIT_INTERFACE \
 		STM32MP_DDR_DUAL_AXI_PORT \
@@ -189,8 +193,10 @@ $(call assert_numerics,\
 $(call add_defines,\
 	$(sort \
 		DWL_BUFFER_BASE \
+		PKA_USE_BRAINPOOL_P256R1 \
 		PKA_USE_BRAINPOOL_P256T1 \
 		PKA_USE_NIST_P256 \
+		PKA_USE_NIST_P521 \
 		PLAT_PARTITION_MAX_ENTRIES \
 		PLAT_TBBR_IMG_DEF \
 		STM32_HASH_VER \