fix(ras): restrict RAS support for NS world

Current RAS framework in TF-A only supports handling errors originating
from NS world but the HANDLE_EA_EL3_FIRST flag configures it for all
lower Els. To

fix(ras): restrict RAS support for NS world

Current RAS framework in TF-A only supports handling errors originating
from NS world but the HANDLE_EA_EL3_FIRST flag configures it for all
lower Els. To make the current design of RAS explicit, rename this macro
to HANDLE_EA_EL3_FIRST_NS and set EA bit in scr_el3 only when
switching to NS world.

Note: I am unaware of any platform which traps errors originating in
Secure world to EL3, if there is any such platform then it need to
be explicitly implemented in TF-A

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: If58eb201d8fa792c16325c85c26056e9b409b750

show more ...

Merge "build(changelog): add new scope for Performance Monitor Extensions" into integration

build(changelog): add new scope for Performance Monitor Extensions

This patch adds a news scope for FEAT_PMUV3, alongside
updating the existing comments related to the saving of
PMCR_EL0 register ro

build(changelog): add new scope for Performance Monitor Extensions

This patch adds a news scope for FEAT_PMUV3, alongside
updating the existing comments related to the saving of
PMCR_EL0 register routine for better understanding.

Change-Id: Ib150244ce94cfcbbe5d12fdae56327c3d72bda0b
Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>

show more ...

fix(ras): trap "RAS error record" accesses only for NS

RAS_TRAP_LOWER_EL_ERR_ACCESS was used to prevent access to RAS error
record registers (RAS ERR* & RAS ERX*) from lower EL's in any security
sta

fix(ras): trap "RAS error record" accesses only for NS

RAS_TRAP_LOWER_EL_ERR_ACCESS was used to prevent access to RAS error
record registers (RAS ERR* & RAS ERX*) from lower EL's in any security
state. To give more fine grain control per world basis re-purpose this
macro to RAS_TRAP_NS_ERR_REC_ACCESS, which will enable the trap only
if Error record registers are accessed from NS.
This will also help in future scenarios when RAS handling(in Firmware
first handling paradigm)can be offloaded to a secure partition.

This is first patch in series to refactor RAS framework in TF-A.

Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Change-Id: Ifa7f60bc8c82c9960adf029001bc36c443016d5d

show more ...

refactor(libc): clean up dependencies in libc

- Removing platform dependencies from libc modules.
- Replacing panicking with actual error handling.
- Debug macros are included indirectly from assert

refactor(libc): clean up dependencies in libc

- Removing platform dependencies from libc modules.
- Replacing panicking with actual error handling.
- Debug macros are included indirectly from assert.h. Removing
"platform_def.h" from assert.h and adding "common/debug.h"
where the macros are used.
- Removing hack for fixing PLAT_LOG_LEVEL_ASSERT to 40.
Instead removing assert with expression, as this
does not provide additional information.

Signed-off-by: Claus Pedersen <claustbp@google.com>
Change-Id: Icc201ea7b63c1277e423c1cfd13fd6816c2bc568

show more ...

fix(context mgmt): remove explicit ICC_SRE_EL2 register read

ICC_SRE_EL2 has only 4 bits, while others are RES0. The library programs
all four of them already, so there is no need to read the previo

fix(context mgmt): remove explicit ICC_SRE_EL2 register read

ICC_SRE_EL2 has only 4 bits, while others are RES0. The library programs
all four of them already, so there is no need to read the previous
settings from the actual register.

This patch removes the explicit register read as a result.

Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Change-Id: Iff0cb3b0d6fd85e5ae891068e440d855973a1c5e

show more ...

feat(rng-trap): add EL3 support for FEAT_RNG_TRAP

FEAT_RNG_TRAP introduces support for EL3 trapping of reads of the
RNDR and RNDRRS registers, which is enabled by setting the
SCR_EL3.TRNDR bit. This

feat(rng-trap): add EL3 support for FEAT_RNG_TRAP

FEAT_RNG_TRAP introduces support for EL3 trapping of reads of the
RNDR and RNDRRS registers, which is enabled by setting the
SCR_EL3.TRNDR bit. This patch adds a new build flag
ENABLE_FEAT_RNG_TRAP that enables the feature.
This feature is supported only in AArch64 state from Armv8.5 onwards.

Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>
Change-Id: Ia9f17aef3444d3822bf03809036a1f668c9f2d89

show more ...

refactor(context mgmt): refactor EL2 context save and restore functions

This patch splits the el2_sysregs_context_save/restore functions
into multiple functions based on features. This will allow us

refactor(context mgmt): refactor EL2 context save and restore functions

This patch splits the el2_sysregs_context_save/restore functions
into multiple functions based on features. This will allow us to
selectively save and restore EL2 context registers based on
features enabled for a particular configuration.

For now feature build flags are used to decide which registers
to save and restore. The long term plan is to dynamically check
for features that are enabled and then save/restore registers
accordingly. Splitting el2_sysregs_context_save/restore functions
into smaller assembly functions makes that task easier. For more
information please take a look at:
https://trustedfirmware-a.readthedocs.io/en/latest/design_documents/context_mgmt_rework.html

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I1819a9de8b70fa35c8f45568908025f790c4808c

show more ...

refactor(context mgmt): refactor initialization of EL1 context registers

When SPMC is present at S-EL2, EL1 context registers don't need to be
initialized for Secure state. This patch makes sure tha

refactor(context mgmt): refactor initialization of EL1 context registers

When SPMC is present at S-EL2, EL1 context registers don't need to be
initialized for Secure state. This patch makes sure that EL1 context
registers are initialized only for Non-secure state, and when SPMC is
not present at S-EL2

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I4a60b258c31ce5f6472a243e2687159cc495259b

show more ...

Merge "fix(amu): limit virtual offset register access to NS world" into integration

Merge "fix(cm): add barrier before el3 ns exit" into integration

fix(cm): add barrier before el3 ns exit

In cm_prepare_el3_exit_ns, SCR_EL3.NS bit change (to non-secure) is not
committed before the EL2 restoration sequence happens.
At ICC_SRE_EL2 write in cm_el2_

fix(cm): add barrier before el3 ns exit

In cm_prepare_el3_exit_ns, SCR_EL3.NS bit change (to non-secure) is not
committed before the EL2 restoration sequence happens.
At ICC_SRE_EL2 write in cm_el2_sysregs_context_restore, NS is still 0
from CPU perspective (with EEL2=0) which is an invalid condition and
triggers a fault. By adding ISB, SCR_EL3 gets synced with NS=1/EEL2=0
before ICC_SRE_EL2 write.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
Change-Id: Ie72a6152aa7729e66b3344c1b7b0749f54cafb6f

show more ...

feat(brbe): add BRBE support for NS world

This patch enables access to the branch record buffer control registers
in non-secure EL2 and EL1 using the new build option ENABLE_BRBE_FOR_NS.
It is disab

feat(brbe): add BRBE support for NS world

This patch enables access to the branch record buffer control registers
in non-secure EL2 and EL1 using the new build option ENABLE_BRBE_FOR_NS.
It is disabled for all secure world, and cannot be used with ENABLE_RME.

This option is disabled by default, however, the FVP platform makefile
enables it for FVP builds.

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I576a49d446a8a73286ea6417c16bd0b8de71fca0

show more ...

fix(amu): limit virtual offset register access to NS world

Previously the SCR_EL3.AMVOFFEN bit was set for all contexts, this
behavior is incorrect as it allows secure world to access the virtual
of

fix(amu): limit virtual offset register access to NS world

Previously the SCR_EL3.AMVOFFEN bit was set for all contexts, this
behavior is incorrect as it allows secure world to access the virtual
offset registers when it should not be able to. This patch only sets
AMVOFFEN for non-secure world.

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: I2c61fe0a8a0092df089f1cb2c0d8a45c8c8ad0d3

show more ...

refactor(twed): improve TWED enablement in EL-3

The current implementation uses plat_arm API under generic code.
"plat_arm" API is a convention used with Arm common platform layer
and is reserved fo

refactor(twed): improve TWED enablement in EL-3

The current implementation uses plat_arm API under generic code.
"plat_arm" API is a convention used with Arm common platform layer
and is reserved for that purpose. In addition, the function has a
weak definition which is not encouraged in TF-A.

Henceforth, removing the weak API with a configurable macro "TWED_DELAY"
of numeric data type in generic code and simplifying the implementation.
By default "TWED_DELAY" is defined to zero, and the delay value need to
be explicitly set by the platforms during buildtime.

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: I25cd6f628e863dc40415ced3a82d0662fdf2d75a

show more ...

refactor(context mgmt): add cm_prepare_el3_exit_ns function

As part of the RFC:
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/13651,
this patch adds the 'cm_prepare_el3_exit_ns' fun

refactor(context mgmt): add cm_prepare_el3_exit_ns function

As part of the RFC:
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/13651,
this patch adds the 'cm_prepare_el3_exit_ns' function. The function is
a wrapper to 'cm_prepare_el3_exit' function for Non-secure state.

When EL2 sysregs context exists (CTX_INCLUDE_EL2_REGS is
enabled) EL1 and EL2 sysreg values are restored from the context
instead of directly updating the registers.

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I9b071030576bb05500d54090e2a03b3f125d1653

show more ...

refactor(context mgmt): refactor the cm_setup_context function

This patch splits the function 'cm_setup_context' into four
functions to make it more readable and easier to maintain.

The function is

refactor(context mgmt): refactor the cm_setup_context function

This patch splits the function 'cm_setup_context' into four
functions to make it more readable and easier to maintain.

The function is split into the following functions based on
the security state of the context.

- setup_context_common - performs common initializations
- setup_secure_context - performs Secure state specific
initializations
- setup_realm_context - performs Realm state specific
initializations
- setup_ns_context - performs Non-secure state specific
initializations

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: Ie14a1c2fc6586087e7aa36537cf9064c80802f8f

show more ...

refactor(context mgmt): remove registers accessible only from secure state from EL2 context

The following registers are only accessible from secure state,
therefore don't need to be saved/restored d

refactor(context mgmt): remove registers accessible only from secure state from EL2 context

The following registers are only accessible from secure state,
therefore don't need to be saved/restored during world switch.
- SDER32_EL2
- VSTCR_EL2
- VSTTBR_EL2

This patch removes these registers from EL2 context.

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Change-Id: I24d08aacb1b6def261c7b37d3e1265bb76adafdc

show more ...

refactor(el3-runtime): replace ARM_ARCH_AT_LEAST macro with FEAT flags

Replacing ARM_ARCH_AT_LEAST macro with feature specific build options
to prevent unconditional accesses to the registers during

refactor(el3-runtime): replace ARM_ARCH_AT_LEAST macro with FEAT flags

Replacing ARM_ARCH_AT_LEAST macro with feature specific build options
to prevent unconditional accesses to the registers during context save
and restore routines.

Registers are tightly coupled with features more than architecture
versions. Henceforth having a feature-specific build flag guarding the
respective registers, will restrict any undefined actions.

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: I809774df580530803c8a6e05a62d8d4de0910e02

show more ...

fix(el3-runtime): set unset pstate bits to default

During a transition to a higher EL some of the PSTATE bits are not set
by hardware, this means that their state may be leaked from lower ELs.
This

fix(el3-runtime): set unset pstate bits to default

During a transition to a higher EL some of the PSTATE bits are not set
by hardware, this means that their state may be leaked from lower ELs.
This patch sets those bits to a default value upon entry to EL3.

This patch was tested using a debugger to check the PSTATE values
are correctly set. As well as adding a test in the next patch to
ensure the PSTATE in lower ELs is still maintained after this change.

Change-Id: Ie546acbca7b9aa3c86bd68185edded91b2a64ae5
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

show more ...

refactor(el3-runtime): add prepare_el3_entry func

In the next patch we add an extra step of setting the PSTATE
registers to a known state on el3 entry. In this patch we create
the function prepare_e

refactor(el3-runtime): add prepare_el3_entry func

In the next patch we add an extra step of setting the PSTATE
registers to a known state on el3 entry. In this patch we create
the function prepare_el3_entry to wrap the steps needed for before
el3 entry. For now this is only save_gp_pmcr_pauth_regs.

Change-Id: Ie26dc8d89bfaec308769165d2649e84d41be196c
Signed-off-by: Daniel Boulby <daniel.boulby@arm.com>

show more ...

fix(amu): fault handling on EL2 context switch

The HAFGRTR_EL2 register is UNDEFINED unless the CPU supports both
FEAT_FGT and FEAT_AMUv1. FEAT_FGT is mandatory for v8.6-A and upwards,
but FEAT_AMUv

fix(amu): fault handling on EL2 context switch

The HAFGRTR_EL2 register is UNDEFINED unless the CPU supports both
FEAT_FGT and FEAT_AMUv1. FEAT_FGT is mandatory for v8.6-A and upwards,
but FEAT_AMUv1 is optional (from v8.4-A upwards), and as such any
8.6-A cores today without support for FEAT_AMUv1 will trigger an
undefined instruction exception on accessing this register.

Currently ARM_ARCH_AT_LEAST macro has been used to associate with an
architecture extension allowing to access HAFGRTR_EL2 register. This
condition should be replaced with macros specific to individual
features. This patch adds a new set of macros "ENABLE_FEAT_FGT,
ENABLE_FEAT_AMUv1, ENABLE_FEAT_ECV" under build options to provide
controlled access to the HAFGRTR_EL2 register.

Further to ensure that the the build options passed comply
with the given hardware implementation, a feature detection mechanism,
checking whether build options match with the architecture is required
at bootime. This will be implemented and pushed later in a separate
patch.

Signed-off-by: Jayanth Dodderi Chidanand <jayanthdodderi.chidanand@arm.com>
Change-Id: Ie390f4babe233b8b09455290277edbddecd33ead

show more ...

feat(sme): enable SME functionality

This patch adds two new compile time options to enable SME in TF-A:
ENABLE_SME_FOR_NS and ENABLE_SME_FOR_SWD for use in non-secure and
secure worlds respectively.

feat(sme): enable SME functionality

This patch adds two new compile time options to enable SME in TF-A:
ENABLE_SME_FOR_NS and ENABLE_SME_FOR_SWD for use in non-secure and
secure worlds respectively. Setting ENABLE_SME_FOR_NS=1 will enable
SME for non-secure worlds and trap SME, SVE, and FPU/SIMD instructions
in secure context. Setting ENABLE_SME_FOR_SWD=1 will disable these
traps, but support for SME context management does not yet exist in
SPM so building with SPD=spmd will fail.

The existing ENABLE_SVE_FOR_NS and ENABLE_SVE_FOR_SWD options cannot
be used with SME as it is a superset of SVE and will enable SVE and
FPU/SIMD along with SME.

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: Iaaac9d22fe37b4a92315207891da848a8fd0ed73

show more ...

feat(rme): add context management changes for FEAT_RME

This patch adds a new context for realm world and realm world
awareness in context management.

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm

feat(rme): add context management changes for FEAT_RME

This patch adds a new context for realm world and realm world
awareness in context management.

Signed-off-by: Zelalem Aweke <zelalem.aweke@arm.com>
Signed-off-by: Subhasish Ghosh <subhasish.ghosh@arm.com>
Change-Id: Ic17469393603e789d7adc025880346bc3d6233d7

show more ...

feat(hcx): add build option to enable FEAT_HCX

FEAT_HCX adds the extended hypervisor configuration register (HCRX_EL2)
and access to this register must be explicitly enabled through the
SCR_EL3.HXEn

feat(hcx): add build option to enable FEAT_HCX

FEAT_HCX adds the extended hypervisor configuration register (HCRX_EL2)
and access to this register must be explicitly enabled through the
SCR_EL3.HXEn bit. This patch adds a new build flag ENABLE_FEAT_HCX to
allow the register to be accessed from EL2.

Signed-off-by: John Powell <john.powell@arm.com>
Change-Id: Ibb36ad90622f1dc857adab4b0d4d7a89456a522b

show more ...