Merge "fix(gpt): use DC CIGDPAPA when MTE2 is implemented" into integration

feat(cpufeat): added few helper functions

Following utility functions/bit definitions done
- Write a helper function to return the presence of following features
- FEAT_UAO
- FEAT_EBEP

feat(cpufeat): added few helper functions

Following utility functions/bit definitions done
- Write a helper function to return the presence of following features
- FEAT_UAO
- FEAT_EBEP
- FEAT_SEBEP
- FEAT_SSBS
- FEAT_NMI
- FEAT_PAN
- Add definition of some missing bits of SPSR.
- Add GCSCR_EL1 register encoding and accessor function.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ifcead0dd8e3b32096e4ab810dde5d582a889785a

show more ...

refactor(context-mgmt): move EL1 save/restore routines into C

Similar to the refactoring process followed for EL2 system registers,
moving the save and restore routines of EL1 system registers into

refactor(context-mgmt): move EL1 save/restore routines into C

Similar to the refactoring process followed for EL2 system registers,
moving the save and restore routines of EL1 system registers into C
file, thereby reducing assembly code.

Change-Id: Ib59fbbe2eef2aa815effe854cf962fc4ac62a2ae
Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>

show more ...

fix(gpt): use DC CIGDPAPA when MTE2 is implemented

Use cache clean and invalidate of data and allocation tags by PA to PoPA
maintenance instruction (dc cigdpapa) in the GPT library upon changing
the

fix(gpt): use DC CIGDPAPA when MTE2 is implemented

Use cache clean and invalidate of data and allocation tags by PA to PoPA
maintenance instruction (dc cigdpapa) in the GPT library upon changing
the PAS for a memory region. This is required to flush allocation tags
when MTE2 (and above) is implemented.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: I4b70afb297f693b1d446839607922c47111ce063

show more ...

feat(mte): add mte2 feat

Add support for feat mte2. tfsr_el2 is available only with mte2,
however currently its context_save/restore is done with mte rather than
mte2, so introduce 'is_feat_mte2_sup

feat(mte): add mte2 feat

Add support for feat mte2. tfsr_el2 is available only with mte2,
however currently its context_save/restore is done with mte rather than
mte2, so introduce 'is_feat_mte2_supported' to check mte2.

Change-Id: I108d9989a8f5b4d1d2f3b9865a914056fa566cf2
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

feat(spmd): initialize SCR_EL3.EEL2 bit at RESET

SCR_EL3.EEL2 bit enabled denotes that the system has S-EL2 present and
enabled, Ideally this bit is constant throughout the lifetime and
should not b

feat(spmd): initialize SCR_EL3.EEL2 bit at RESET

SCR_EL3.EEL2 bit enabled denotes that the system has S-EL2 present and
enabled, Ideally this bit is constant throughout the lifetime and
should not be modified. Currently this bit is initialized in the context
mgmt code where each world copy of the SCR_EL3 register has this bit set
to 1, but for the time duration between the RESET and the first exit to
a lower EL this bit is zero.

Modifying SCR_EL3.EEL2 along with EA bit at RESET does also helps in
mitigating against ERRATA_V2_3099206.

For details on Neoverse V2 errata 3099206, refer the SDEN document
given below.
https://developer.arm.com/documentation/SDEN-2332927/latest

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: If8b2bdbb19bc65391a33dd34cc9824a0203ae4b1

show more ...

feat(cpufeat): add feature detection for FEAT_CSV2_3

This feature provides support to context save the
SCXTNUM_ELx register. FEAT_CSV2_3 implies the implementation
of FEAT_CSV2_2. FEAT_CSV2_3 is sup

feat(cpufeat): add feature detection for FEAT_CSV2_3

This feature provides support to context save the
SCXTNUM_ELx register. FEAT_CSV2_3 implies the implementation
of FEAT_CSV2_2. FEAT_CSV2_3 is supported in AArch64 state only
and is an optional feature in Arm v8.0 implementations.

This patch adds feature detection for v8.9 feature FEAT_CSV2_3,
adds macros for ID_AA64PFR0_EL1.CSV2 bits [59:56] for detecting
FEAT_CSV2_3 and macro for ENABLE_FEAT_CSV2_3.

Change-Id: Ida9f31e832b5f11bd89eebd6cc9f10ddad755c14
Signed-off-by: Sona Mathew <sonarebecca.mathew@arm.com>

show more ...

refactor(mte): deprecate CTX_INCLUDE_MTE_REGS

Currently CTX_INCLUDE_MTE_REGS is used for dual purpose,
to enable allocation tags register and to context save and restore
them and also to check if mt

refactor(mte): deprecate CTX_INCLUDE_MTE_REGS

Currently CTX_INCLUDE_MTE_REGS is used for dual purpose,
to enable allocation tags register and to context save and restore
them and also to check if mte feature is available.

To make it more meaningful, remove CTX_INCLUDE_MTE_REGS
and introduce FEAT_MTE. This would enable allocation tags register
when FEAT_MTE is enabled and also supported from platform.

Also arch features can be conditionally enabled disabled based on
arch version from `make_helpers/arch_features.mk`

Change-Id: Ibdd2d43874634ad7ddff93c7edad6044ae1631ed
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

fix(el3-runtime): restrict lower el EA handlers in FFH mode

This patch does following changes to restrict handling of lower EL
EA's only if FFH mode is enabled.

- Compile ea_delegate.S only if FFH

fix(el3-runtime): restrict lower el EA handlers in FFH mode

This patch does following changes to restrict handling of lower EL
EA's only if FFH mode is enabled.

- Compile ea_delegate.S only if FFH mode is enabled.
- For Sync exception from lower ELs if the EC is not SMC or SYS reg
trap it was assumed that it is an EA, which is not correct. Move
the known Sync exceptions (EL3 Impdef) out of sync EA handler.
- Report unhandled exceptions if there are SError from lower EL in
KFH mode, as this is unexpected.
- Move code out of ea_delegate.S which are used for KFH mode.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I577089677d0ec8cde7c20952172bee955573d2ed

show more ...

fix(ras): restrict ENABLE_FEAT_RAS to have only two states

As part of migrating RAS extension to feature detection mechanism, the
macro ENABLE_FEAT_RAS was allowed to have dynamic detection (FEAT_ST

fix(ras): restrict ENABLE_FEAT_RAS to have only two states

As part of migrating RAS extension to feature detection mechanism, the
macro ENABLE_FEAT_RAS was allowed to have dynamic detection (FEAT_STATE
2). Considering this feature does impact execution of EL3 and we need
to know at compile time about the presence of this feature. Do not use
dynamic detection part of feature detection mechanism.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I23858f641f81fbd81b6b17504eb4a2cc65c1a752

show more ...

feat(ras): use FEAT_IESB for error synchronization

For synchronization of errors at exception boundries TF-A uses "esb"
instruction with FEAT_RAS or "dsb" and "isb" otherwise. The problem
with esb i

feat(ras): use FEAT_IESB for error synchronization

For synchronization of errors at exception boundries TF-A uses "esb"
instruction with FEAT_RAS or "dsb" and "isb" otherwise. The problem
with esb instruction is, along with synching errors it might also
consume the error, which is not ideal in all scenarios. On the other
hand we can't use dsb always as its in the hot path.

To solve above mentioned problem the best way is to use FEAT_IESB
feature which provides controls to insert an implicit Error
synchronization event at exception entry and exception return.

Assumption in TF-A is, if RAS Extension is present then FEAT_IESB will
also be present and enabled.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ie5861eec5da4028a116406bb4d1fea7dac232456

show more ...

feat(el3-runtime): modify vector entry paths

Vector entries in EL3 from lower ELs, first check for any pending
async EAs from lower EL before handling the original exception.
This happens when there

feat(el3-runtime): modify vector entry paths

Vector entries in EL3 from lower ELs, first check for any pending
async EAs from lower EL before handling the original exception.
This happens when there is an error (EA) in the system which is not
yet signaled to PE while executing at lower EL. During entry into EL3
the errors (EA) are synchronized causing async EA to pend at EL3.

On detecting the pending EA (via ISR_EL1.A) EL3 either reflects it back
to lower EL (KFH) or handles it in EL3 (FFH) based on EA routing model.

In case of Firmware First handling mode (FFH), EL3 handles the pended
EA first before returing back to handle the original exception.

While in case of Kernel First handling mode (KFH), EL3 will return back
to lower EL without handling the original exception. On returing to
lower EL, EA will be pended. In KFH mode there is a risk of back and
forth between EL3 and lower EL if the EA is masked at lower EL or
priority of EA is lower than that of original exception. This is a
limitation in current architecture but can be solved in future if EL3
gets a capability to inject virtual SError.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I3a2a31de7cf454d9d690b1ef769432a5b24f6c11

show more ...

Merge "feat(cpufeat): add memory retention bit define for CLUSTERPWRDN" into integration

refactor(cm): move EL3 registers to global context

Currently, EL3 context registers are duplicated per-world per-cpu.
Some registers have the same value across all CPUs, so this patch
moves these re

refactor(cm): move EL3 registers to global context

Currently, EL3 context registers are duplicated per-world per-cpu.
Some registers have the same value across all CPUs, so this patch
moves these registers out into a per-world context to reduce
memory usage.

Change-Id: I91294e3d5f4af21a58c23599af2bdbd2a747c54a
Signed-off-by: Elizabeth Ho <elizabeth.ho@arm.com>
Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>

show more ...

fix(mpam): refine MPAM initialization and enablement process

Restricts MPAM to only NS world and enables trap to EL3 for access of
MPAM registers from lower ELs of Secure and Realm world.

This patc

fix(mpam): refine MPAM initialization and enablement process

Restricts MPAM to only NS world and enables trap to EL3 for access of
MPAM registers from lower ELs of Secure and Realm world.

This patch removes MPAM enablement from global context and adds it to
EL3 State context which enables/disables MPAM during world switches.
Renamed ENABLE_MPAM_FOR_LOWER_ELS to ENABLE_FEAT_MPAM and
removed mpam_init_el3() as RESET behaviour is trapping.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I131f9dba5df236a71959b2d425ee11af7f3c38c4

show more ...

refactor(console): disable getc() by default

The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A

refactor(console): disable getc() by default

The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A. It is dangerous to keep that feature enabled if not
strictly necessary, especially in production firmware builds.

Thus, we need a way to disable this feature. Moreover, when it is
disabled, all related code should be eliminated from the firmware
binaries, such that no remnant/dead getc() code remains in memory,
which could otherwise be used as a gadget as part of a bigger security
attack.

This patch disables getc() feature by default. For legitimate getc()
use cases [1], it can be explicitly enabled by building TF-A with
ENABLE_CONSOLE_GETC=1.

The following changes are introduced when getc() is disabled:

- The multi-console framework no longer provides the console_getc()
function.

- If the console driver selected by the platform attempts to register
a getc() callback into the multi-console framework then TF-A will
now fail to build.

If registered through the assembly function finish_console_register():
- On AArch64, you'll get:
Error: undefined symbol CONSOLE_T_GETC used as an immediate value.
- On AArch32, you'll get:
Error: internal_relocation (type: OFFSET_IMM) not fixed up

If registered through the C function console_register(), this requires
populating a struct console with a getc field, which will trigger:
error: 'console_t' {aka 'struct console'} has no member named 'getc'

- All console drivers which previously registered a getc() callback
have been modified to do so only when ENABLE_CONSOLE_GETC=1.

[1] Example of such use cases would be:
- Firmware recovery: retrieving a golden BL2 image over the console in
order to repair a broken firmware on a bricked board.
- Factory CLI tool: Drive some soak tests through the console.

Discussed on TF-A mailing list here:
https://lists.trustedfirmware.org/archives/list/tf-a@lists.trustedfirmware.org/thread/YS7F6RCNTWBTEOBLAXIRTXWIOYINVRW7/

Change-Id: Icb412304cd23dbdd7662df7cf8992267b7975cc5
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Acked-by: Baruch Siach <baruch@tkos.co.il>

show more ...

refactor(cm): remove world differentiation for EL2 context restore

The EL2 context save/restore functions have an optimisation to not
bother with the EL2 context when SEL2 is not in use. However, th

refactor(cm): remove world differentiation for EL2 context restore

The EL2 context save/restore functions have an optimisation to not
bother with the EL2 context when SEL2 is not in use. However, this
decision is made on the current value of SCR_EL3.EEL2, which is not
the value for the selected security state, but rather, for the
security state that came before it. This relies on the EEL2 bit's
value to propagate identically to all worlds.

This has an unintended side effect that for the first entry into
secure world, the restoring of the context is fully skipped, because
SCR_EL3 is only initialized after the call to the restoring routine
which means the EEL2 bit is not initialized (except when FEAT_RME
is present). This is inconsistent with normal and realm worlds which
always get their EL2 registers zeroed.

Remove this optimization to remove all the complexity with managing
the EEL2 bit's value. Instead unconditionally save/restore all
registers. It is worth noting that there is no performance penalty
in the case where SEL2 is empty with this change. This is because
SEL2 will never be entered, and as such no secure save/restore will
happen anyway, while normal world remains unchanged.

Removing the value management of the EEL2 bit causes the
CTX_ICC_SRE_EL2 register to be inaccessible in Secure world for some
configurations.
Make the SCR_EL3.NS workaround in cm_prepare_el3_exit_ns() generic
on every access to the register.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I1f56d85814c5897b468e82d4bd4a08e3a90a7f8f

show more ...

refactor(cm): clean up SCR_EL3 and CPTR_EL3 initialization

As with MDCR_EL3, setting some bits of these registers is redundant at
reset since they do not matter for EL3 execution and the registers g

refactor(cm): clean up SCR_EL3 and CPTR_EL3 initialization

As with MDCR_EL3, setting some bits of these registers is redundant at
reset since they do not matter for EL3 execution and the registers get
context switched so they get overwritten anyway.

The SCR_EL3.{TWE, TWI, SMD, API, APK} bits only affect lower ELs so
their place is in context management. The API and APK bits are a bit
special as they would get implicitly unset for secure world when
CTX_INCLUDE_PAUTH_REGS is unset. This is now explicit with their normal
world values being always set as PAuth defaults to enabled. The same
sequence is also added to realm world too. The reasoning is the same as
for Secure world - PAuth will be enabled for NS, and unless explicitly
handled by firmware, it should not leak to realm.

The CPTR_EL3.{ESM, EZ, TAM} bits are set by the relevant
feat_enable()s in lib/extensions so they can be skipped too.

CPTR_EL3.TFP is special as it's needed for access to generic floating
point registers even when SVE is not present. So keep it but move to
context management.

This leaves CPTR_EL3.TCPAC which affects several extensions. This bit
was set centrally at reset, however the earliest need for it is in BL2.
So set it in cm_setup_context_common(). However, this CPTR_EL3 is only
restored for BL31 which is clearly not the case. So always restore it.

Finally, setting CPTR_EL3 to a fresh RESET_VAL for each security state
prevents any bits from leaking between them.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: Ie7095e967bd4a6d6ca6acf314c7086d89fec8900

show more ...

feat(cpufeat): add memory retention bit define for CLUSTERPWRDN

Bit1 in the CLUSTERPWRDN register is used to indicate on CLUSTERPACTIVE
that memory retention is required or not. It can be used for
L

feat(cpufeat): add memory retention bit define for CLUSTERPWRDN

Bit1 in the CLUSTERPWRDN register is used to indicate on CLUSTERPACTIVE
that memory retention is required or not. It can be used for
L3 cache memory retention support.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Change-Id: I1c53c90ae3dfbed3be7e5b2b79f2c3565db81012

show more ...

Merge "feat(cpufeat): initialize HFG*_EL2 registers" into integration

fix(cpus): check for SME presence in Gelas

The original powerdown function for Gelas included SME disabling
instructions but did not check for the presence of SME before disabling.
This could lead t

fix(cpus): check for SME presence in Gelas

The original powerdown function for Gelas included SME disabling
instructions but did not check for the presence of SME before disabling.
This could lead to unexpected beaviors. This patch adds that check so
the feature is disabled only if it is present.

Change-Id: I582db53a6669317620e4f72a3eac87525897d3d0
Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>

show more ...

Merge "refactor(cm): move remaining EL2 save/restore into C" into integration

refactor(cm): move remaining EL2 save/restore into C

MTE and common system registers are the last remaining EL2 save/restores
in assembly. Convert them to C, like all the others.

Signed-off-by: Boy

refactor(cm): move remaining EL2 save/restore into C

MTE and common system registers are the last remaining EL2 save/restores
in assembly. Convert them to C, like all the others.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: If690f792e70b97fd4b4cd5f43847a71719b128f1

show more ...

refactor(cpufeat): introduce wrapper macro for read_feat_...() functions

At the moment we have some elaborate, but very schematic functions to
allow checking for CPU feature enablement. Adding some

refactor(cpufeat): introduce wrapper macro for read_feat_...() functions

At the moment we have some elaborate, but very schematic functions to
allow checking for CPU feature enablement. Adding some more becomes
tedious and is also error-prone.

Provide two wrapper macros that reduce most of the features to a
single line:
- CREATE_FEATURE_FUNCS(name, idreg, idfield, guard)
creates two functions read_<name>_id_field() and is_<name>_supported(),
that check the 4-bit CPU ID field starting at bit <idfield> in <idreg>
for being not 0, and compares it against the build time <guard> symbol.
For the usual feature (like PAN) this looks like:
CREATE_FEATURE_FUNCS(feat_pan, id_aa64mmfr1_el1,
ID_AA64MMFR1_EL1_PAN_SHIFT, ENABLE_FEAT_PAN)

- CREATE_FEATURE_FUNCS_VER(name, read_func, idvalue, guard)
creates one function to check for a certain CPU ID field *value*, so
when "!= 0" is not sufficient. It's meant to be used in addition to
the above macro, since that generates the CPU ID field accessor
function:
CREATE_FEATURE_FUNCS(feat_amu, id_aa64pfr0_el1, ID_AA64PFR0_AMU_SHIFT,
ENABLE_FEAT_AMU)
CREATE_FEATURE_FUNCS_VER(feat_amuv1p1, read_feat_amu_id_field,
ID_AA64PFR0_AMU_V1P1, ENABLE_FEAT_AMUv1p1)

Describe the existing feature accessor functions using those new macros,
to reduce the size of the file, improve readability and decrease the
possibility of (copy&paste) bugs.

Change-Id: Ib136a875b4857058ff561c4635ace344006f29bf
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

feat(cpufeat): initialize HFG*_EL2 registers

HFG*_EL2 registers control the fine-grained traps introduced by
FEAT_FGT. These traps come enabled by default so old systems unaware
of this feature can

feat(cpufeat): initialize HFG*_EL2 registers

HFG*_EL2 registers control the fine-grained traps introduced by
FEAT_FGT. These traps come enabled by default so old systems unaware
of this feature can be trapped to EL3, not being able to handle the
trap correctly. This patch disables all fine-grained traps by default
to prevent such unexpected behavior.

Change-Id: If2ae97accbeed2bea51ae03b5225ce762ecffb25
Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>

show more ...