fix(context-mgmt): enable SCXTNUM access

Enable SCXTNUM_ELx access for lower ELs in non-secure state.
Make realm context setup take this build flag into account but enable it
by default when RME is

fix(context-mgmt): enable SCXTNUM access

Enable SCXTNUM_ELx access for lower ELs in non-secure state.
Make realm context setup take this build flag into account but enable it
by default when RME is used.

Signed-off-by: Maksims Svecovs <maksims.svecovs@arm.com>
Change-Id: Ieb0186b2fdffad464bb9316fc3973772c9c28cd0

show more ...

fix(mpam): run-time checks for mpam save/restore routines

With "ENABLE_MPAM_FOR_LOWER_ELS" and "CTX_INCLUDE_EL2_REGS" build
options enabled, MPAM EL2 registers would be saved/restored as part of
con

fix(mpam): run-time checks for mpam save/restore routines

With "ENABLE_MPAM_FOR_LOWER_ELS" and "CTX_INCLUDE_EL2_REGS" build
options enabled, MPAM EL2 registers would be saved/restored as part of
context management. Context save/restore routines as of now would
proceed to access all of MPAM EL2 registers without any runtime checks.
MPAM specification states that MPAMHCR_EL2 should only be accessed if
MPAMIDR_EL1.HAS_HCR is "1". Likewise, MPAMIDR_EL1.VPMR_MAX has to be
probed to obtain the maximum supported MPAMVPM<x>_EL2 before accessing
corresponding MPAMVPM<x>_EL2 registers. Since runtime checks are not
being made, an exception would be raised if the platform under test
doesn't support one of the registers. On Neoverse reference design
platforms, an exception is being raised while MPAMVPM2_EL2 or above are
accessed. Neoverse reference design platforms support only registers
till MPAMVPM1_EL2 at this point.

To resolve this, add sufficient runtime checks in MPAM EL2 context
save/restore routines. As part of the new save/restore routines,
MPAMIDR_EL1.HAS_HCR and MPAMIDR_EL1.VPMR_MAX are probed for the right
set of registers to be saved and restored.

CC: Davidson Kumaresan <davidson.kumaresan@arm.com>
Signed-off-by: Rohit Mathew <rohit.mathew@arm.com>
Change-Id: I2e3affd23091023b287b2bd5057a4a549037b611

show more ...

Merge changes from topic "feat_state_rework" into integration

* changes:
feat(fvp): enable FEAT_HCX by default
refactor(context-mgmt): move FEAT_HCX save/restore into C
refactor(cpufeat): conv

Merge changes from topic "feat_state_rework" into integration

* changes:
feat(fvp): enable FEAT_HCX by default
refactor(context-mgmt): move FEAT_HCX save/restore into C
refactor(cpufeat): convert FEAT_HCX to new scheme
feat(fvp): enable FEAT_FGT by default
refactor(context-mgmt): move FEAT_FGT save/restore code into C
refactor(amu): convert FEAT_AMUv1 to new scheme
refactor(cpufeat): decouple FGT feature detection and build flags
refactor(cpufeat): check FEAT_FGT in a new way
refactor(cpufeat): move helpers into .c file, rename FEAT_STATE_
feat(aarch64): make ID system register reads non-volatile

show more ...

refactor(context-mgmt): move FEAT_HCX save/restore into C

At the moment we save and restore the HCRX_EL2 register in assembly, and
just depend on the build time flags.
To allow runtime checking, and

refactor(context-mgmt): move FEAT_HCX save/restore into C

At the moment we save and restore the HCRX_EL2 register in assembly, and
just depend on the build time flags.
To allow runtime checking, and to avoid too much code in assembly, move
that over to C, and use the new combined build/runtime feature check.

This also allows to drop the assert, since this should now be covered by
the different FEAT_STATE_x options.

Change-Id: I3e20b9ba17121d423cd08edc20bbf4e7ae7c0178
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

refactor(context-mgmt): move FEAT_FGT save/restore code into C

At the moment we do the EL2 context save/restore sequence in assembly,
where it is just guarded by #ifdef statement for the build time

refactor(context-mgmt): move FEAT_FGT save/restore code into C

At the moment we do the EL2 context save/restore sequence in assembly,
where it is just guarded by #ifdef statement for the build time flags.
This does not cover the FEAT_STATE_CHECK case, where we need to check
for the runtime availability of a feature.

To simplify this extension, and to avoid writing too much code in
assembly, move that sequence into C: it is called from C context
anyways.

This protects the C code with the new version of the is_xxx_present()
check, which combines both build time and runtime check, as necessary,
and allows the compiler to optimise the calls aways, if we don't need
them.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Change-Id: I7c91bec60efcc00a43429dc0381f7e1c203be780

show more ...

refactor(cpufeat): decouple FGT feature detection and build flags

Split the feature check for FEAT_FGT into two parts:
- A boolean function that just evaluates whether the feature is usable.
This

refactor(cpufeat): decouple FGT feature detection and build flags

Split the feature check for FEAT_FGT into two parts:
- A boolean function that just evaluates whether the feature is usable.
This takes build time flags into account, and only evaluates the CPU
feature ID registers when the flexible FEAT_STATE_CHECK method is
used.
- A "raw" function that returns the unfiltered CPU feature ID register.

Change the callers where needed, to give them the version they actually
want.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Change-Id: I9a041132d280451f5d9f653a62904f603b2a916d

show more ...

fix(mpam): remove unwanted param for "endfunc" macro

"endfunc" macro is used to mark the end of a function. It takes the
function label as an argument. For el2_sysregs_context_save_mpam
function, "e

fix(mpam): remove unwanted param for "endfunc" macro

"endfunc" macro is used to mark the end of a function. It takes the
function label as an argument. For el2_sysregs_context_save_mpam
function, "endfunc" has been called with an assumed typo, "func", along
with the function label. Remove this unwanted param to fix the endfunc
call.

Signed-off-by: Rohit Mathew <rohit.mathew@arm.com>
Change-Id: I05f958a285f936df579f01500b6fd7cb2b7753a8

show more ...

fix(el3_runtime): allow SErrors when executing in EL3

SCR_EL3.EA is set to 1 in BL31 initialization and is cleared before
entering to lower ELs(except for RAS FFH case "HANDLE_EA_EL3_FIRST_NS").
The

fix(el3_runtime): allow SErrors when executing in EL3

SCR_EL3.EA is set to 1 in BL31 initialization and is cleared before
entering to lower ELs(except for RAS FFH case "HANDLE_EA_EL3_FIRST_NS").
The cleared value persist even during run time when execution comes
back to EL3.

When SCR_EL3.EA is 0 and execution state is EL3, Async EAs(delivered
as SErrors) are implicitly masked and hence any Async EA by EL3 will
remain pending and will trap at the exception level EA is targeted
to and unmasked when entering lower EL.
This causes unexpected EA at lower EL. This is a very rare
to get SError in EL3 until unless there is any programming error.

This patch sets SCR_EL3.EA to 1 when entering EL3 from lower EL.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ibb593369edb034f670fd85ee79adc9829b900a83

show more ...

fix(el3_runtime): restore SPSR/ELR/SCR after esb

SCR_EL3 register is restored before esb issued and it is assumed
that EAs are unmasked at that point, which is wrong, as the SCR_EL3
value at that ti

fix(el3_runtime): restore SPSR/ELR/SCR after esb

SCR_EL3 register is restored before esb issued and it is assumed
that EAs are unmasked at that point, which is wrong, as the SCR_EL3
value at that time is restored from the context of the world where
it is returning to.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Id1c7150a70b5f589b0dc7c50c359b4d23ee9f256

show more ...

Merge "fix(pmu): add sensible default for MDCR_EL2" into integration

fix(pmu): add sensible default for MDCR_EL2

When TF-A is set to save and restore EL2 registers it initially zeroes
all of them so that it does not leak any information. However,
MDCR_EL2.HPMN of 0 i

fix(pmu): add sensible default for MDCR_EL2

When TF-A is set to save and restore EL2 registers it initially zeroes
all of them so that it does not leak any information. However,
MDCR_EL2.HPMN of 0 is poorly defined when FEAT_HPMN0 is not implemented.
Set it to its hardware reset value so that lower ELs don't inherit a
wrong value.

Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
Change-Id: I8055005ef9b6eaafefa13b62a0b41289079fdd23

show more ...

fix(ras): restrict RAS support for NS world

Current RAS framework in TF-A only supports handling errors originating
from NS world but the HANDLE_EA_EL3_FIRST flag configures it for all
lower Els. To

fix(ras): restrict RAS support for NS world

Current RAS framework in TF-A only supports handling errors originating
from NS world but the HANDLE_EA_EL3_FIRST flag configures it for all
lower Els. To make the current design of RAS explicit, rename this macro
to HANDLE_EA_EL3_FIRST_NS and set EA bit in scr_el3 only when
switching to NS world.

Note: I am unaware of any platform which traps errors originating in
Secure world to EL3, if there is any such platform then it need to
be explicitly implemented in TF-A

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: If58eb201d8fa792c16325c85c26056e9b409b750

show more ...

Merge "build(changelog): add new scope for Performance Monitor Extensions" into integration

build(changelog): add new scope for Performance Monitor Extensions

This patch adds a news scope for FEAT_PMUV3, alongside
updating the existing comments related to the saving of
PMCR_EL0 register ro

build(changelog): add new scope for Performance Monitor Extensions

This patch adds a news scope for FEAT_PMUV3, alongside
updating the existing comments related to the saving of
PMCR_EL0 register routine for better understanding.

Change-Id: Ib150244ce94cfcbbe5d12fdae56327c3d72bda0b
Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>

show more ...

fix(ras): trap "RAS error record" accesses only for NS

RAS_TRAP_LOWER_EL_ERR_ACCESS was used to prevent access to RAS error
record registers (RAS ERR* & RAS ERX*) from lower EL's in any security
sta

fix(ras): trap "RAS error record" accesses only for NS

RAS_TRAP_LOWER_EL_ERR_ACCESS was used to prevent access to RAS error
record registers (RAS ERR* & RAS ERX*) from lower EL's in any security
state. To give more fine grain control per world basis re-purpose this
macro to RAS_TRAP_NS_ERR_REC_ACCESS, which will enable the trap only
if Error record registers are accessed from NS.
This will also help in future scenarios when RAS handling(in Firmware
first handling paradigm)can be offloaded to a secure partition.

This is first patch in series to refactor RAS framework in TF-A.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ifa7f60bc8c82c9960adf029001bc36c443016d5d

show more ...

refactor(libc): clean up dependencies in libc

- Removing platform dependencies from libc modules.
- Replacing panicking with actual error handling.
- Debug macros are included indirectly from assert

refactor(libc): clean up dependencies in libc

- Removing platform dependencies from libc modules.
- Replacing panicking with actual error handling.
- Debug macros are included indirectly from assert.h. Removing
"platform_def.h" from assert.h and adding "common/debug.h"
where the macros are used.
- Removing hack for fixing PLAT_LOG_LEVEL_ASSERT to 40.
Instead removing assert with expression, as this
does not provide additional information.

Signed-off-by: Claus Pedersen <claustbp@google.com>
Change-Id: Icc201ea7b63c1277e423c1cfd13fd6816c2bc568

show more ...

fix(context mgmt): remove explicit ICC_SRE_EL2 register read

ICC_SRE_EL2 has only 4 bits, while others are RES0. The library programs
all four of them already, so there is no need to read the previo

fix(context mgmt): remove explicit ICC_SRE_EL2 register read

ICC_SRE_EL2 has only 4 bits, while others are RES0. The library programs
all four of them already, so there is no need to read the previous
settings from the actual register.

This patch removes the explicit register read as a result.

Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Change-Id: Iff0cb3b0d6fd85e5ae891068e440d855973a1c5e

show more ...

feat(rng-trap): add EL3 support for FEAT_RNG_TRAP

FEAT_RNG_TRAP introduces support for EL3 trapping of reads of the
RNDR and RNDRRS registers, which is enabled by setting the
SCR_EL3.TRNDR bit. This

feat(rng-trap): add EL3 support for FEAT_RNG_TRAP

FEAT_RNG_TRAP introduces support for EL3 trapping of reads of the
RNDR and RNDRRS registers, which is enabled by setting the
SCR_EL3.TRNDR bit. This patch adds a new build flag
ENABLE_FEAT_RNG_TRAP that enables the feature.
This feature is supported only in AArch64 state from Armv8.5 onwards.

Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: Ia9f17aef3444d3822bf03809036a1f668c9f2d89

show more ...

refactor(context mgmt): refactor EL2 context save and restore functions

This patch splits the el2_sysregs_context_save/restore functions
into multiple functions based on features. This will allow us

refactor(context mgmt): refactor EL2 context save and restore functions

This patch splits the el2_sysregs_context_save/restore functions
into multiple functions based on features. This will allow us to
selectively save and restore EL2 context registers based on
features enabled for a particular configuration.

For now feature build flags are used to decide which registers
to save and restore. The long term plan is to dynamically check
for features that are enabled and then save/restore registers
accordingly. Splitting el2_sysregs_context_save/restore functions
into smaller assembly functions makes that task easier. For more
information please take a look at:
https://trustedfirmware-a.readthedocs.io/en/latest/design_documents/context_mgmt_rework.html

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I1819a9de8b70fa35c8f45568908025f790c4808c

show more ...

refactor(context mgmt): refactor initialization of EL1 context registers

When SPMC is present at S-EL2, EL1 context registers don't need to be
initialized for Secure state. This patch makes sure tha

refactor(context mgmt): refactor initialization of EL1 context registers

When SPMC is present at S-EL2, EL1 context registers don't need to be
initialized for Secure state. This patch makes sure that EL1 context
registers are initialized only for Non-secure state, and when SPMC is
not present at S-EL2

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I4a60b258c31ce5f6472a243e2687159cc495259b

show more ...

Merge "fix(amu): limit virtual offset register access to NS world" into integration

Merge "fix(cm): add barrier before el3 ns exit" into integration

fix(cm): add barrier before el3 ns exit

In cm_prepare_el3_exit_ns, SCR_EL3.NS bit change (to non-secure) is not
committed before the EL2 restoration sequence happens.
At ICC_SRE_EL2 write in cm_el2_

fix(cm): add barrier before el3 ns exit

In cm_prepare_el3_exit_ns, SCR_EL3.NS bit change (to non-secure) is not
committed before the EL2 restoration sequence happens.
At ICC_SRE_EL2 write in cm_el2_sysregs_context_restore, NS is still 0
from CPU perspective (with EEL2=0) which is an invalid condition and
triggers a fault. By adding ISB, SCR_EL3 gets synced with NS=1/EEL2=0
before ICC_SRE_EL2 write.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Ie72a6152aa7729e66b3344c1b7b0749f54cafb6f

show more ...

feat(brbe): add BRBE support for NS world

This patch enables access to the branch record buffer control registers
in non-secure EL2 and EL1 using the new build option ENABLE_BRBE_FOR_NS.
It is disab

feat(brbe): add BRBE support for NS world

This patch enables access to the branch record buffer control registers
in non-secure EL2 and EL1 using the new build option ENABLE_BRBE_FOR_NS.
It is disabled for all secure world, and cannot be used with ENABLE_RME.

This option is disabled by default, however, the FVP platform makefile
enables it for FVP builds.

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I576a49d446a8a73286ea6417c16bd0b8de71fca0

show more ...

fix(amu): limit virtual offset register access to NS world

Previously the SCR_EL3.AMVOFFEN bit was set for all contexts, this
behavior is incorrect as it allows secure world to access the virtual
of

fix(amu): limit virtual offset register access to NS world

Previously the SCR_EL3.AMVOFFEN bit was set for all contexts, this
behavior is incorrect as it allows secure world to access the virtual
offset registers when it should not be able to. This patch only sets
AMVOFFEN for non-secure world.

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I2c61fe0a8a0092df089f1cb2c0d8a45c8c8ad0d3

show more ...