[PATCH] ArmVirtPkg/PrePei: when starting in EL2 configure HCR to not trap on PAC

["Evgeny Iakovlev" <eiakovlev@linux.microsoft.com>]

When FEAT_PAuth is impelemented HCR_EL2.APK and HCR_EL2.API bits control
whether PAC-related instructions and register accesses should be trapped
by the EL2 hypervisor. Note that bit value 0b1 means do NOT trap. When
FEAT_PAuth is not implemented or if EL2 is disabled, those bits are
ignored and system behaves as if their value was 0b1.

When starting in EL2 on ArmVirtPkg get our of the way of a potential
hypervisor by setting APK and API bits.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Evgeny Iakovlev <eiakovlev@linux.microsoft.com>
---
 ArmPkg/Include/Chipset/AArch64.h           | 2 ++
 ArmPlatformPkg/PrePeiCore/AArch64/Helper.S | 5 +++++
 ArmVirtPkg/PrePi/AArch64/ArchPrePi.c       | 3 ++-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/ArmPkg/Include/Chipset/AArch64.h b/ArmPkg/Include/Chipset/AArch64.h
index bfd2859f51..da8737236d 100644
--- a/ArmPkg/Include/Chipset/AArch64.h
+++ b/ArmPkg/Include/Chipset/AArch64.h
@@ -57,6 +57,8 @@
 #define ARM_HCR_AMO  BIT5
 #define ARM_HCR_TSC  BIT19
 #define ARM_HCR_TGE  BIT27
+#define ARM_HCR_APK  BIT40
+#define ARM_HCR_API  BIT41
 
 // Exception Syndrome Register
 #define AARCH64_ESR_EC(Ecr)   ((0x3F << 26) & (Ecr))
diff --git a/ArmPlatformPkg/PrePeiCore/AArch64/Helper.S b/ArmPlatformPkg/PrePeiCore/AArch64/Helper.S
index 2a604b719b..0f413c5655 100644
--- a/ArmPlatformPkg/PrePeiCore/AArch64/Helper.S
+++ b/ArmPlatformPkg/PrePeiCore/AArch64/Helper.S
@@ -26,6 +26,11 @@ ASM_FUNC(SetupExceptionLevel2)
    orr     x0, x0, #(1 << 3)      // Enable EL2 FIQ
    orr     x0, x0, #(1 << 4)      // Enable EL2 IRQ
    orr     x0, x0, #(1 << 5)      // Enable EL2 SError and Abort
+
+   // Get out of the way of a poitential EL2 hypervisor by NOT trapping PAC registers and instructions
+   orr     x0, x0, #(1 << 40)     // HCR_EL2.APK
+   orr     x0, x0, #(1 << 41)     // HCR_EL2.API
+
    msr     hcr_el2, x0            // Write back our settings
 
    msr     cptr_el2, xzr          // Disable copro traps to EL2
diff --git a/ArmVirtPkg/PrePi/AArch64/ArchPrePi.c b/ArmVirtPkg/PrePi/AArch64/ArchPrePi.c
index 9cab88ca08..29da9d4050 100644
--- a/ArmVirtPkg/PrePi/AArch64/ArchPrePi.c
+++ b/ArmVirtPkg/PrePi/AArch64/ArchPrePi.c
@@ -22,6 +22,7 @@ ArchInitialize (
 
   if (ArmReadCurrentEL () == AARCH64_EL2) {
     // Trap General Exceptions. All exceptions that would be routed to EL1 are routed to EL2
-    ArmWriteHcr (ARM_HCR_TGE);
+    // Also get out of the way of a potential EL2 hypervisor and do NOT trap PAC registers or instructions.
+    ArmWriteHcr (ARM_HCR_TGE | ARM_HCR_APK | ARM_HCR_API);
   }
 }
-- 
2.34.1