Merge "feat(cpus): update cpu_check_csv2 check" into integration

feat(cpus): update cpu_check_csv2 check

Update the cpu_check_csv2 logic to allow ID_AA64PFR0_EL1.CSV2
values up to 3. With the introduction of FEAT_CSV2_3,
the architectural limit for CSV2 has been

feat(cpus): update cpu_check_csv2 check

Update the cpu_check_csv2 logic to allow ID_AA64PFR0_EL1.CSV2
values up to 3. With the introduction of FEAT_CSV2_3,
the architectural limit for CSV2 has been extended,
making values from 0 to 3 valid.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I8473047ed4ad759b7b506161a76774ac21555d31

show more ...

fix(xlat): change MT_DEVICE to map to nGnRnE

Previously, MT_DEVICE memory was mapped to nGnRE instead of nGnRnE. This
could cause issues if a platform with USE_COHERENT_MEM=1 mapped the
coherent mem

fix(xlat): change MT_DEVICE to map to nGnRnE

Previously, MT_DEVICE memory was mapped to nGnRE instead of nGnRnE. This
could cause issues if a platform with USE_COHERENT_MEM=1 mapped the
coherent memory region as MT_DEVICE. A core with stage 1 translation
enabled would access the region with the attributes nGnRE and a core
with stage 1 disabled would access the region with attributes nGnRnE.

This would result in accesses to a memory location with mismatched
memory attributes.

This commit changes MT_DEVICE to nGnRnE. This shouldn't introduce any
issues as nGnRnE has stronger ordering requirements.

Change-Id: Idf2e0bbea3ddb5e469a72a41f5fdb71c030d54b8
Signed-off-by: Andrei Stefanescu <andrei.stefanescu@nxp.com>

show more ...

fix(errata): keep leading zeros in CVE ID prints

The errata printing function would drop leading zeros on CVE
numbers so this updates the format string to make sure they are
printed. This is to conf

fix(errata): keep leading zeros in CVE ID prints

The errata printing function would drop leading zeros on CVE
numbers so this updates the format string to make sure they are
printed. This is to conform to the CVE naming convention where
ID numbers of less than 4 digits are prepended with 0s up to 4
digits.

This also updates a confusing comment indicating that leading
zeros could be used to work around a potential issue if CVE and
erratum IDs clash. Values with leading zeros will be interpreted
as octal numbers which is not desirable behavior so this should
not be recommended. Realistically, a CVE ID and erratum ID being
the same is *extremely* unlikely since CVE ID start over each
year and are 4-5 digits for Arm, and Errata IDs are 6-7 digits.

Change-Id: Idf2be50cea6828a3d30c6e58fda477ec1398bc7c
Signed-off-by: John Powell <john.powell@arm.com>

show more ...

Merge changes I0b0443d5,Ic454a87a into integration

* changes:
fix(gic): quote the correct flag on error
feat(lib): add a generic EXTRACT macro

feat(lib): add a generic EXTRACT macro

The EXTRACT macro is useful to extract a named field from a numeric
value, usually a register. It is functionally identical to the `ubfx`
instruction and uses

feat(lib): add a generic EXTRACT macro

The EXTRACT macro is useful to extract a named field from a numeric
value, usually a register. It is functionally identical to the `ubfx`
instruction and uses the same #defines (REG_FIELD_SHIFT and
REG_FIELD_WIDTH).

This is the same macro that we use in tftf. It works well there and is
quite useful for manipulating register fields concisely.

This macro replaces the EXTRACT_FIELD macro. Their function is
identical, however, EXTRACT allows for easier interoperation with the
`ubfx` instruction, makes code more similar to tftf, and is more
concise.

Change-Id: Ic454a87af5e5fac108c7b7cb6b6804ec65a8d0e8
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge changes I005586ef,I0d4d74bc into integration

* changes:
fix(cpufeat): replace "bti" mnemonic with hint instructions
fix(cpufeat): improve xpaci wrapper

fix(cpufeat): replace "bti" mnemonic with hint instructions

Older GNU binutils version require to specify at least "armv8.5-a" for
the ARM architecture revision to accept "bti" instructions in the
a

fix(cpufeat): replace "bti" mnemonic with hint instructions

Older GNU binutils version require to specify at least "armv8.5-a" for
the ARM architecture revision to accept "bti" instructions in the
assembly code. Binutils v2.35 have relaxed this, since "bti" is in the
hint space, so is ignored on older cores and does NOT require a BTI
enabled core to execute.

To not exclude those older binutils versions (as shipped with Ubuntu
20.04), use the "hint" encoding for the "bti" instructions, which are
accepted regardless of the minimum architecture revision. Hide this
encoding in a macro, to make the "bti" usage more readable in the
source code.

Change-Id: I005586efd8974a3f2c7202896c881bb5fed07eea
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

refactor(cpus): optimize CVE checking

This patch replaces the use of EXTRA functions
with using erratum entries check
to verify CVE mitigation application for some of
the SMCCC_ARCH_WORKAROUND_* cal

refactor(cpus): optimize CVE checking

This patch replaces the use of EXTRA functions
with using erratum entries check
to verify CVE mitigation application for some of
the SMCCC_ARCH_WORKAROUND_* calls.

Previously, EXTRA functions were individually implemented for
each SMCCC_ARCH_WORKAROUND_*, an approach that becomes unmanageable
with the increasing number of workarounds.
By looking up erratum entries for CVE check, the process is streamlined,
reducing overhead associated with creating and
maintaining EXTRA functions for each new workaround.

New Errata entries are created for SMC workarounds and
that is used to target cpus that are uniquely impacted
by SMC workarounds.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I873534e367a35c99461d0a616ff7bf856a0000af

show more ...

refactor(cpus): move errata check to common code

This patch centralizes some of the Errata ABI code
that could be used for checking if an Errata has been applied
to cpu library since the function is

refactor(cpus): move errata check to common code

This patch centralizes some of the Errata ABI code
that could be used for checking if an Errata has been applied
to cpu library since the function is mostly generic.

Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Change-Id: I2c6d4468f7125d4d99ccdebc5ea8f9e4390360cc

show more ...

Merge changes Id942c20c,Idd286bea,I8917a26e,Iec8c3477,If3c25dcd, ... into integration

* changes:
feat(cpufeat): enable FEAT_PAuth to FEAT_STATE_CHECKED
perf(cpufeat): centralise PAuth key saving

Merge changes Id942c20c,Idd286bea,I8917a26e,Iec8c3477,If3c25dcd, ... into integration

* changes:
feat(cpufeat): enable FEAT_PAuth to FEAT_STATE_CHECKED
perf(cpufeat): centralise PAuth key saving
refactor(cpufeat): convert FEAT_PAuth setup to C
refactor(cpufeat): prepare FEAT_PAuth for FEATURE_DETECTION
chore(cpufeat): remove PAuth presence checks
feat(cpufeat): enable FEAT_BTI to FEAT_STATE_CHECKED

show more ...

refactor(cpufeat): convert FEAT_PAuth setup to C

An oversimplified view of FEAT_PAuth is that it's a symmetric encryption
of the LR. PAC instructions execute as NOPs until explicitly turned on.
So i

refactor(cpufeat): convert FEAT_PAuth setup to C

An oversimplified view of FEAT_PAuth is that it's a symmetric encryption
of the LR. PAC instructions execute as NOPs until explicitly turned on.
So in a function that turns PAuth on, the signing would have executed as
a NOP and the authentication will encrypt the address, leading to a
failure. That's why enablement is in assembly - we have full control of
when pointer authentications happen.

However, assembly is hard to read, is opaque to the compiler for
optimisations, and we need to call into C anyway for the platform hook
to get the key. So convert it to C. We can instruct the compiler to not
generate branch protection for the enable function only and as long as
the caller doesn't do branch protection (and all callers are entrypoints
written in assembly) everything will work.

Change-Id: I8917a26e1293033c910e3058664e3ca9207359b7
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "feat(psci): remove cpu context init by index" into integration

feat(cpufeat): enable FEAT_BTI to FEAT_STATE_CHECKED

Introduce the is_feat_bti_{supported, present}() helpers and replace
checks for ENABLE_BTI with it. Also factor out the setting of
SCTLR_EL3.BT o

feat(cpufeat): enable FEAT_BTI to FEAT_STATE_CHECKED

Introduce the is_feat_bti_{supported, present}() helpers and replace
checks for ENABLE_BTI with it. Also factor out the setting of
SCTLR_EL3.BT out of the PAuth enablement and place it in the respective
entrypoints where we initialise SCTLR_EL3. This makes PAuth
self-contained and SCTLR_EL3 initialisation centralised.

Change-Id: I0c0657ff1e78a9652cd2cf1603478283dc01f17b
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

Merge "perf(libc): use builtin implementations where possible" into integration

feat(psci): remove cpu context init by index

Currently, the calling core (meaning the core which received the call to
CPU_ON or the powerdown path of CPU_SUSPEND on the same core) is in
charge of in

feat(psci): remove cpu context init by index

Currently, the calling core (meaning the core which received the call to
CPU_ON or the powerdown path of CPU_SUSPEND on the same core) is in
charge of initialising the context for the waking core (the warmboot
entrypoint for both). This is convenient because the calling core can
write the context while in coherency and the waking core will only need
the context after its entered coherency. This avoids any cache
maintenance and makes communication simple.

However, this has 3 main problems:
a) asymmetric feature support is problematic - the calling core has no
way of knowing the feature set of the waking core. If the two
diverge, the architectural feature discovery via ID registers breaks
down. We've thus far "fixed" this on a case by case basis which
doesn't scale and introduces redundancy.

b) powerdown abandon (pabandon) introduces a contradiction - the calling
core has to initialise the context for when the core wakes up, but
should the core not powerdown it needs its old context intact. The only
way to work around this is by keeping two copies of context which
incurs a runtime and memory overhead.

c) cm_prepare_el3_exit[_ns]() doesn't have access to the entrypoint but needs
it to make initialisation decisions. We can infer some of this from
registers that have already been written but this is awkwardly
limiting for what we can do. This also necessitates the split from
the context initialisation.

We can solve all three by a making a core be in full ownership of its
own context. The calling core then only writes entrypoint information
and nothing else. The waking core then initialises its own context as it
sees fit with full knowledge of the whole picture.

The only tricky bit is cache coherency - the waking core has to be able
to coherently observe its new entrypoint. Calling cores will write to
the shared region with coherent caches on. If we make sure to read the
context only after the waking core has entered coherency, then we can
avoid cache operations and let hardware handle everything.

We can skip the spsr check for FEAT_TCR2 as it doesn't make a
difference. We can also skip enabling it twice from generic code.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: I86e7fe8b698191fc3b469e5ced1fd010f8754b0e

show more ...

Merge changes from topic "lto-by-default" into integration

* changes:
fix(libc): make sure __init functions are garbage collected
fix(platforms): remove platform_core_pos_helper()

fix(xlat): remove xlat_mpu

The only platform to use this is fvp_r. As this platform is now gone, so
is the need for this library. Support for it never went out of
"experimental" so it does not appea

fix(xlat): remove xlat_mpu

The only platform to use this is fvp_r. As this platform is now gone, so
is the need for this library. Support for it never went out of
"experimental" so it does not appear to be finished.

Change-Id: I76499b92ca4368651330f17dc80803991158cc36
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(libc): make sure __init functions are garbage collected

RECLAIM_INIT_CODE is useful to remove code that is only necessary during
boot. However, these functions are generally called once and as s

fix(libc): make sure __init functions are garbage collected

RECLAIM_INIT_CODE is useful to remove code that is only necessary during
boot. However, these functions are generally called once and as such
prime candidates for inlining. When building with LTO, the compiler is
pretty good at inlining every single one, making this option pointless.

So tell the compiler to not inline these functions. This ensures they
are kept separate and they can be garbage collected later. This is
expected to cost a little bit of speed due to the extra branching.

Change-Id: Ie83a9ec8db03cb42139742fc6d728d12ce8549d3
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cpus): fix clang compilation issue

A potential problem with clang version < 17 can cause resolving nested
'cfi_startproc' to fail compilation.

So add a variant of check_errara/reset_macros that

fix(cpus): fix clang compilation issue

A potential problem with clang version < 17 can cause resolving nested
'cfi_startproc' to fail compilation.

So add a variant of check_errara/reset_macros that is compatible with
clang version < 17 to ignore `cfi_startproc` and `cfi_endproc`.

This wouldn't cause any performance issue and will not affect any
functional behaviour.

Change-Id: I46147af2dd0accd5be14ddb26dea03bb2f87cba8
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

perf(libc): use builtin implementations where possible

When conditions are right, eg a small memcpy of a known size and
alignment, the compiler may know of a sequence that is optimal for the
given c

perf(libc): use builtin implementations where possible

When conditions are right, eg a small memcpy of a known size and
alignment, the compiler may know of a sequence that is optimal for the
given constraints and inline it. If the compiler doesn't find one, it
will emit a call to the generic function (in the libc) which will
implement this in the most generic and unconstrained manner. That
generic function is rarely the most optimal when constraints are known.

So give the compiler a chance to do this. Replace calls to libc
functions that have builtins to the builtin and keep the generic
implementation if it decides to emit a call anyway.

And example of this in action is usage of FEAT_MOPS. When the compiler
is aware of the feature (-march=armv8.8-a) then it will emit the 3 MOPS
instructions instead of calls to our memcpy() and memset()
implementations.

Change-Id: I9860cfada1d941b613ebd4da068e9992c387952e
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>

show more ...

fix(cpus): remove errata setting PF_MODE to conservative

The erratum titled “Disabling of data prefetcher with outstanding
prefetch TLB miss might cause a deadlock” should not be handled within
TF-A

fix(cpus): remove errata setting PF_MODE to conservative

The erratum titled “Disabling of data prefetcher with outstanding
prefetch TLB miss might cause a deadlock” should not be handled within
TF-A. The current workaround attempts to follow option 2 but
misapplies it. Specifically, it statically sets PF_MODE to
conservative, which is not the recommended approach. According to the
erratum documentation, PF_MODE should be configured in conservative
mode only when we disable data prefetcher however this is not done
in TF-A and thus the workaround is not needed in TF-A.

The static setting of PF_MODE in TF-A does not correctly address the
erratum and may introduce unnecessary performance degradation on
platforms that adopt it without fully understanding its implications.

To prevent incorrect or unintended use, the current implementation of
this erratum workaround should be removed from TF-A and not adopted by
platforms.

List of Impacted CPU's with Errata Numbers and reference to SDEN -

Cortex-A78 - 2132060 - https://developer.arm.com/documentation/SDEN1401784/latest
Cortex-A78C - 2132064 - https://developer.arm.com/documentation/SDEN-2004089/latest
Cortex-A710 - 2058056 - https://developer.arm.com/documentation/SDEN-1775101/latest
Cortex-X2 - 2058056 - https://developer.arm.com/documentation/SDEN-1775100/latest
Cortex-X3 - 2070301 - https://developer.arm.com/documentation/SDEN2055130/latest
Neoverse-N2 - 2138953 - https://developer.arm.com/documentation/SDEN-1982442/latest
Neoverse-V1 - 2108267 - https://developer.arm.com/documentation/SDEN-1401781/latest
Neoverse-V2 - 2331132 - https://developer.arm.com/documentation/SDEN-2332927/latest

Change-Id: Icf4048508ae070b2df073cc46c63be058b2779df
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

Merge changes from topic "hm/handoff-aarch32" into integration

* changes:
refactor(arm): simplify early platform setup functions
feat(bl32): enable r3 usage for boot args
feat(handoff): add li

Merge changes from topic "hm/handoff-aarch32" into integration

* changes:
refactor(arm): simplify early platform setup functions
feat(bl32): enable r3 usage for boot args
feat(handoff): add lib to sp-min sources
feat(handoff): add 32-bit variant of SRAM layout
feat(handoff): add 32-bit variant of ep info
fix(aarch32): avoid using r12 to store boot params
fix(arm): reinit secure and non-secure tls
refactor(handoff): downgrade error messages

show more ...

Merge "feat(lib): implement strnlen secure and strcpy secure function" into integration

feat(lib): implement strnlen secure and strcpy secure function

Implement safer version of 'strnlen' function
to handle NULL terminated strings with additional
bound checking and secure version of st

feat(lib): implement strnlen secure and strcpy secure function

Implement safer version of 'strnlen' function
to handle NULL terminated strings with additional
bound checking and secure version of string copy function
to support better security and avoid destination
buffer overflow.

Change-Id: I93916f003b192c1c6da6a4f78a627c8885db11d9
Signed-off-by: Jit Loon Lim <jit.loon.lim@altera.com>
Signed-off-by: Girisha Dengi <girisha.dengi@intel.com>

show more ...