Merge "feat(cpufeat): enable USE_SPINLOCK_CAS to FEAT_STATE_CHECKED" into integration

feat(cpufeat): enable USE_SPINLOCK_CAS to FEAT_STATE_CHECKED

The FEAT_LSE enablement predates the FEAT_STATE framework and has never
been converted. Since the introduction of USE_SPINLOCK_CAS we've

feat(cpufeat): enable USE_SPINLOCK_CAS to FEAT_STATE_CHECKED

The FEAT_LSE enablement predates the FEAT_STATE framework and has never
been converted. Since the introduction of USE_SPINLOCK_CAS we've gained
lots of quality of life features that allow for better feature
enablement. This patch converts USE_SPINLOCK_CAS to tri-state and adds
it to FEATURE_DETECTION to align with all other features.

Instead of introducing the assembly checking for tri-state, this patch
translates all locking routines to C inline assembly and uses the
standard C helpers. The main benefit is that this gives greater
visibility to the compiler about what the functions are doing and lets
it optimise better. Namely, it is able to allocate registers itself and
inline the functions when LTO is enabled.

An unsuccessful attempt was made to use the instructions directly and
have even flow control in C. This, however, made code very complicated
and less efficient in the tight loops of the spinlock.

The last use of ARM_ARCH_AT_LEAST goes away with this change and so this
macro is removed. It has now been fully superseded by the FEAT_STATE
framework.

This change exposes a limitation - RME_GPT_BITLOCK_BLOCK requires
USE_SPINLOCK_CAS. This patch does not address this in any way but makes
the relationship explicit.

Change-Id: I580081549aceded2dca3e0f4564ee7510a7e56ae
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(measured-boot): enable dynamic hash provisioning

Introduce dynamic hash provisioning for Measured Boot by removing the
previous static hash-selection path and allowing platforms to supply
algor

feat(measured-boot): enable dynamic hash provisioning

Introduce dynamic hash provisioning for Measured Boot by removing the
previous static hash-selection path and allowing platforms to supply
algorithm metadata at runtime. Add mboot_find_event_log_metadata() as a
common helper for resolving image metadata. Update the Event Log build
logic to use MAX_DIGEST_SIZE and MAX_HASH_COUNT, deprecate legacy
MBOOT_EL_HASH_ALG, and warn when it is used. Adjust MbedTLS
configuration to enable hash algorithms automatically when Measured Boot
is enabled.

Change-Id: I704e1a5005f6caad3d51d868bacc53699b6dd64f
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(cpufeat): add support for FEAT_UINJ

FEAT_UINJ allows higher ELs to inject Undefined Instruction exceptions
into lower ELs by setting SPSR_ELx.UINJ, which updates PSTATE.UINJ on
exception return

feat(cpufeat): add support for FEAT_UINJ

FEAT_UINJ allows higher ELs to inject Undefined Instruction exceptions
into lower ELs by setting SPSR_ELx.UINJ, which updates PSTATE.UINJ on
exception return. When PSTATE.UINJ is set, instruction execution at the
lower EL raises an Undefined Instruction exception (EC=0b000000).

This patch introduces support for FEAT_UINJ by updating the
inject_undef64() to use hardware undef injection if supported.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I48ad56a58eaab7859d508cfa8dfe81130b873b6b

show more ...

Merge changes I6e44c7f1,Id4320cbf,Ibb05dd47,Icec70861 into integration

* changes:
fix(morello): don't define get_mem_client_mode() when it won't be used
fix(rdn2): don't use V1 as a label
fix(

Merge changes I6e44c7f1,Id4320cbf,Ibb05dd47,Icec70861 into integration

* changes:
fix(morello): don't define get_mem_client_mode() when it won't be used
fix(rdn2): don't use V1 as a label
fix(tspd): don't forward declare tsp_vectors_t
fix(cpufeat): drop feature_panic() as unused

show more ...

feat(cpufeat): add support for FEAT_IDTE3

This patch adds support for FEAT_IDTE3, which introduces support
for handling the trapping of Group 3 and Group 5 (only GMID_EL1)
registers to EL3 (unless t

feat(cpufeat): add support for FEAT_IDTE3

This patch adds support for FEAT_IDTE3, which introduces support
for handling the trapping of Group 3 and Group 5 (only GMID_EL1)
registers to EL3 (unless trapped to EL2). IDTE3 allows EL3 to
modify the view of ID registers for lower ELs, and this capability
is used to disable fields of ID registers tied to disabled features.

The ID registers are initially read as-is and stored in context.
Then, based on the feature enablement status for each world, if a
particular feature is disabled, its corresponding field in the
cached ID register is set to Res0. When lower ELs attempt to read
an ID register, the cached ID register value is returned. This
allows EL3 to prevent lower ELs from accessing feature-specific
system registers that are disabled in EL3, even though the hardware
implements them.

The emulated ID register values are stored primarily in per-world
context, except for certain debug-related ID registers such as
ID_AA64DFR0_EL1 and ID_AA64DFR1_EL1, which are stored in the
cpu_data and are unique to each PE. This is done to support feature
asymmetry that is commonly seen in debug features.

FEAT_IDTE3 traps all Group 3 ID registers in the range
op0 == 3, op1 == 0, CRn == 0, CRm == {2–7}, op2 == {0–7} and the
Group 5 GMID_EL1 register. However, only a handful of ID registers
contain fields used to detect features enabled in EL3. Hence, we
only cache those ID registers, while the rest are transparently
returned as is to the lower EL.

This patch updates the CREATE_FEATURE_FUNCS macro to generate
update_feat_xyz_idreg_field() functions that disable ID register
fields on a per-feature basis. The enabled_worlds scope is used to
disable ID register fields for security states where the feature is
not enabled.

This EXPERIMENTAL feature is controlled by the ENABLE_FEAT_IDTE3
build flag and is currently disabled by default.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I5f998eeab81bb48c7595addc5595313a9ebb96d5

show more ...

feat(cpufeat): introduce FEAT_RME_GDI support

This patch adds a new build flag ENABLE_FEAT_RME_GDI to enable this
feature, along with defining various related register fields. At this
point, when en

feat(cpufeat): introduce FEAT_RME_GDI support

This patch adds a new build flag ENABLE_FEAT_RME_GDI to enable this
feature, along with defining various related register fields. At this
point, when enabled, this feature enables the SA and NSP GPI encodings
by setting the corresponding bits in GPCCR_EL3.

Change-Id: I54152fbb3d19b176264e5d16acbcc866725dc290
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Timothy Hayes <timothy.hayes@arm.com>

show more ...

feat(cpufeat): add support for FEAT_RME_GPC2

This change adds support for FEAT_RME_GPC2 and Non-Secure-Only (NSO)
Physical Address Space.

Previously, all non-secure (NS) memory was accessible to th

feat(cpufeat): add support for FEAT_RME_GPC2

This change adds support for FEAT_RME_GPC2 and Non-Secure-Only (NSO)
Physical Address Space.

Previously, all non-secure (NS) memory was accessible to the secure
world and realm world. With GPC2 and the NSO bit in the GPT, memory
can now be restricted to the non-secure world only. This is enabled
automatically on supported systems when ENABLE_RME is true.

Change-Id: I9b70c3a23c5ec7d83bd787d0fb3edd55934f1d05
Signed-off-by: John Powell <john.powell@arm.com>
Signed-off-by: Girish Pathak <girish.pathak@arm.com>

show more ...

fix(cpufeat): drop feature_panic() as unused

We've grown out of it and it's sitting unused. The compiler emits a
warning for the dead code and the build fails.

Change-Id: Icec70861936b7101e8aca0b67

fix(cpufeat): drop feature_panic() as unused

We've grown out of it and it's sitting unused. The compiler emits a
warning for the dead code and the build fails.

Change-Id: Icec70861936b7101e8aca0b67c71a2c81dd9c59c
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cpufeat): extend FEAT_EBEP handling to delegate PMU control to EL2

Currently, the FEAT_EBEP feature presence check is only used for UNDEF
injection into lower ELs. However, this feature also aff

fix(cpufeat): extend FEAT_EBEP handling to delegate PMU control to EL2

Currently, the FEAT_EBEP feature presence check is only used for UNDEF
injection into lower ELs. However, this feature also affects the access
behavior of MDCR_EL2. Specifically, if the PMEE bits in MDCR_EL3 are not
set to 0b01, then the MDCR_EL2.PMEE bits cannot be configured by EL2.

This patch extends the use of FEAT_EBEP to delegate PMU IRQ and
profiling exception control to EL2 by setting MDCR_EL3.PMEE = 0b01.This
ensures that lower ELs can manage PMU configuration.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ib7e1d5c72f017b8ffc2131fc57309dd9d811c973

show more ...

fix(security): add clrbhb support

TF-A mitigates spectre-bhb(CVE-2022-23960) issue with loop
workaround based on - https://developer.arm.com/documentation/110280/latest/

On platforms that support `

fix(security): add clrbhb support

TF-A mitigates spectre-bhb(CVE-2022-23960) issue with loop
workaround based on - https://developer.arm.com/documentation/110280/latest/

On platforms that support `clrbhb` instruction it is recommended to
use `clrbhb` instruction instead of the loop workaround.

Ref- https://developer.arm.com/documentation/102898/0108/

Change-Id: Ie6e56e96378503456a1617d5e5d51bc64c2e0f0b
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(common): error out if image load size is zero

Change the return value of function to error value when image size
check correctly passes (io_result == 0), but the image size is zero
(image_size =

fix(common): error out if image load size is zero

Change the return value of function to error value when image size
check correctly passes (io_result == 0), but the image size is zero
(image_size == 0). If such an edge case occurs, the function would
not load any data, but would return successful return code 0.

This edge case is already detected by the current conditional and a
warning is reported, but in this special case, return value 0 was
returned to the caller, which might have confused the caller into
thinking that a valid loading of data occurred, even if it did not.

Handle the edge case, and return error, to assure the caller can not
be confused.

Signed-off-by: Hideyuki Nitta <hideyuki.nitta.jf@hitachi.com>
Signed-off-by: Toshiyuki Ogasahara <toshiyuki.ogasahara.bo@hitachi.com>
Signed-off-by: Yoshifumi Hosoya <yoshifumi.hosoya.wj@renesas.com>
Signed-off-by: Dien Pham <dien.pham.ry@renesas.com>
Signed-off-by: Hieu Nguyen <hieu.nguyen.dn@renesas.com>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Change-Id: Id7e4b675540971b28f451e4590064b3fb1840fd6

show more ...

feat(cpufeat): enable FEAT_PFAR support

Implement support for FEAT_PFAR, which introduces the PFAR_ELx system
register, recording the faulting physical address for some aborts.
Those system register

feat(cpufeat): enable FEAT_PFAR support

Implement support for FEAT_PFAR, which introduces the PFAR_ELx system
register, recording the faulting physical address for some aborts.
Those system registers are trapped by the SCR_EL3.PFARen bit, so set the
bit for the non-secure world context to allow OSes to use the feature.

This is controlled by the ENABLE_FEAT_PFAR build flag, which follows the
usual semantics of 2 meaning the feature being runtime detected.
Let the default for this flag be 0, but set it to 2 for the FVP.

Change-Id: I5c9ae750417e75792f693732df3869e02b6e4319
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

Merge "feat(cpufeat): enable FEAT_AIE support" into integration

feat(build): pass cflags to the linker when LTO is enabled

Usually, both compiling and linking happen by calling the top level
gcc/clang binary. Also, both compilers quite specifically tell us to
pa

feat(build): pass cflags to the linker when LTO is enabled

Usually, both compiling and linking happen by calling the top level
gcc/clang binary. Also, both compilers quite specifically tell us to
pass the same flags to the compilation and linking stages when we enable
LTO. This is crucial for things like the undefined behaviour sanitiser.
Anecdotally, in working on this, there have been a fair few errors that
the compiler has only been able to catch due to warning flags being
passed to the linker and building with LTO.

This patch puts the contents of TF_CFLAGS into TF_LDFLAGS when LTO is
enabled. This is easier said than done, however, as we support building
with clang and linking with gcc (or vice versa), so CFLAGS that are
discovered for one will not work for the other. This patch works around
this by splitting all flags into a per-compiler variable. Then CFLAGS
and LDFLAGS get the contents of the correct one.

Some notable side effects: CPPFLAGS and TF_CFLAGS_$(ARCH) become empty
and are removed, although expanding them is kept as platforms set them.
Some flags become duplicate and are removed form TF_LDFLAGS (eg -O1).

The errata (--fix) flags are kept as-is but moved to cpu-ops.mk for
consistency. This is because they currently don't work with LTO and will
be addressed in a later patch.

Finally, ERROR_DEPRECATED's flags are also identical on all compilers so
don't maintain a difference.

Change-Id: I3630729ee5f474c09d4722cd0ede6845e1725d95
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): enable FEAT_AIE support

Implement support for FEAT_AIE, which introduces the AMAIR2_ELx and
MAIR2_ELx system registers, extending the memory attributes described
by {A}MAIR_ELx.
Those

feat(cpufeat): enable FEAT_AIE support

Implement support for FEAT_AIE, which introduces the AMAIR2_ELx and
MAIR2_ELx system registers, extending the memory attributes described
by {A}MAIR_ELx.
Those system registers are trapped by the SCR_EL3.AIEn bit, so set the
bit for the non-secure world context to allow OSes to use the feature.

This is controlled by the ENABLE_FEAT_AIE build flag, which follows the
usual semantics of 2 meaning the feature being runtime detected.
Let the default for this flag be 0, but set it to 2 for the FVP.

Change-Id: Iba2011719013a89f9cb3a4317bde18254f45cd25
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

feat(cpufeat): enable FEAT_CPA2 for EL3

FEAT_CPA2 enables checked pointer arithmetic, which in the event
of an arithmetic overflow in pointer generation will result in a
non-canonical pointer being

feat(cpufeat): enable FEAT_CPA2 for EL3

FEAT_CPA2 enables checked pointer arithmetic, which in the event
of an arithmetic overflow in pointer generation will result in a
non-canonical pointer being generated and subsequent address fault.

Note that FEAT_CPA is a trivial implementation that exists in
some hardware purely so it can run CPA2-enabled instructions
without crashing but they don't actually have checked arithmetic,
so FEAT_CPA is not explicitly enabled in TF-A.

Change-Id: I6d2ca7a7e4b986bb9e917aa8baf8091a271c168b
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support

Implement support for FEAT_MPAM_PE_BW_CTRL, allowing lower
Exception Levels to access MPAM_PE_BW_CTRL control registers
by disabling their traps to

feat(cpufeat): enable FEAT_MPAM_PE_BW_CTRL support

Implement support for FEAT_MPAM_PE_BW_CTRL, allowing lower
Exception Levels to access MPAM_PE_BW_CTRL control registers
by disabling their traps to EL3.

When INIT_UNUSED_NS_EL2=1, configure MPAMBW2_EL2 in EL3 so
that MPAM_PE_BW_CTRL accesses from EL0/EL1 do not trap to EL2.

At this stage, PE-side MPAM bandwidth controls remain disabled
in EL3.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I8e359b0eb912cff3bdda109b21727a627cac3a7e

show more ...

fix(common): initialize the variables

This corrects the MISRA violation C2012-9.1:
All variables are explicitly initialized with zero or default values
during declaration. This helps, even if a func

fix(common): initialize the variables

This corrects the MISRA violation C2012-9.1:
All variables are explicitly initialized with zero or default values
during declaration. This helps, even if a function fails, the
variables contain predictable values, preventing undefined behavior

Change-Id: I64ec8a1c3873eb7a2c40c123260f7bc27af2412f
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...

fix(common): rename exit label

This corrects the MISRA violation C2012-5.8:
Renaming the label eliminates the conflict with the exit() function.

Change-Id: Icef4e9b5a3741781ac836d72962b84183c4f6fd7

fix(common): rename exit label

This corrects the MISRA violation C2012-5.8:
Renaming the label eliminates the conflict with the exit() function.

Change-Id: Icef4e9b5a3741781ac836d72962b84183c4f6fd7
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...

fix(common): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement.Enclosed statement body

fix(common): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement.Enclosed statement body within the curly
braces.

Change-Id: I24a73929c589e67f9ef9ef6d756d5c451a8b9219
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...

fix(common): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement.Enclosed statement body

fix(common): add missing curly braces

This corrects the MISRA violation C2012-15.6:
The body of an iteration-statement or a selection-statement shall
be a compound-statement.Enclosed statement body within the curly
braces.

Change-Id: Ie25feca253ab95a4516e2f7ff6707cdace71d4c0
Signed-off-by: Saivardhan Thatikonda <saivardhan.thatikonda@amd.com>

show more ...

feat(common): add support for kernel DT handoff convention

TF-A currently supports multiple DT handoff conventions:

1. Firmware Handoff (FH): DT passed in x0, with x1–x3 carrying
additional data

feat(common): add support for kernel DT handoff convention

TF-A currently supports multiple DT handoff conventions:

1. Firmware Handoff (FH): DT passed in x0, with x1–x3 carrying
additional data.
2. Kernel-compatible handoff (ARM_LINUX_KERNEL_AS_BL33): DT passed in
x0, x1–x3 zeroed.
3. Legacy TF-A convention: DT passed in x1, with x0 used for MPIDR or
NT_FW_CONFIG.

After discussions with folks in EDK2 and U-Boot, it's clear that there
is no strict requirement for placing the DT in x1. Both projects support
x0 for Arm platforms. To standardize behavior and support firmware
handoff migration, this patch introduces USE_KERNEL_DT_CONVENTION as a
configurable build flag. When enabled, the DT will be passed in x0 for
BL33.

This aligns TF-A’s behavior with Linux boot expectations and simplifies
integration across bootloaders.

Change-Id: I6bd7154fe07cb2e16e25c058f7cf862f9ae007e7
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

fix(cpufeat): update FEAT_PAUTH's feat detect line to tri-state

Since patch 8d9f5f258, FEAT_PAUTH has supported the tri-state framework.
This part was missed, update it.

Change-Id: I3e086865df4d852

fix(cpufeat): update FEAT_PAUTH's feat detect line to tri-state

Since patch 8d9f5f258, FEAT_PAUTH has supported the tri-state framework.
This part was missed, update it.

Change-Id: I3e086865df4d852e9d31a04cd8150d9d8a4dd2b8
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

feat(cpufeat): do feature detection on secondary cores too

Feature detection currently only happens on the boot core, however, it
is possible to have asymmetry between cores. TF-A supports limited s

feat(cpufeat): do feature detection on secondary cores too

Feature detection currently only happens on the boot core, however, it
is possible to have asymmetry between cores. TF-A supports limited such
configurations so it should check secondary cores too.

Change-Id: Iee4955714685be9ae6a017af4a6c284e835ff299
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...