fix(brbe): allow RME builds with BRBE

It used to be the case that a FEAT_RME build could not be built with
FEAT_BRBE support. BRBE doesn't have a 3-world aware disable and
MDCR_EL3 was not context switched to allow for disabling in Realm world.

As of commit 123002f9171384d976d95935b7f566740d69cc68 MDCR_EL3 is
context switched. Since the flag for BRBE support is
ENABLE_BRBE_FOR_NS, move brbe_enable() to only happen for NS world. The
other worlds will see BRBE disabled and branch recording prohibited.
This allows for a build with both RME and BRBE.

Note that EL2 BRBE registers are not context switched. Further work is
needed if non-NS support is required.

Change-Id: I82f0f08399dcd080902477dc9636bc4541685f89
Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com>
diff --git a/lib/el3_runtime/aarch64/context_mgmt.c b/lib/el3_runtime/aarch64/context_mgmt.c
index 6210356..cc45b85 100644
--- a/lib/el3_runtime/aarch64/context_mgmt.c
+++ b/lib/el3_runtime/aarch64/context_mgmt.c
@@ -760,13 +760,6 @@
 		 */
 		trf_enable(ctx);
 	}
-
-	if (is_feat_brbe_supported()) {
-		/*
-		 * Enable FEAT_BRBE for Non-Secure and prohibit for Secure state.
-		 */
-		brbe_enable(ctx);
-	}
 #endif /* IMAGE_BL31 */
 }
 
@@ -792,6 +785,10 @@
 		debugv8p9_extended_bp_wp_enable(ctx);
 	}
 
+	if (is_feat_brbe_supported()) {
+		brbe_enable(ctx);
+	}
+
 	pmuv3_enable(ctx);
 #endif /* IMAGE_BL31 */
 }
diff --git a/lib/extensions/brbe/brbe.c b/lib/extensions/brbe/brbe.c
index dde0266..fef6647 100644
--- a/lib/extensions/brbe/brbe.c
+++ b/lib/extensions/brbe/brbe.c
@@ -16,11 +16,13 @@
 
 	/*
 	 * MDCR_EL3.SBRBE = 0b01
-	 *
 	 * Allows BRBE usage in non-secure world and prohibited in
 	 * secure world.
+	 *
+	 * MDCR_EL3.{E3BREW, E3BREC} = 0b00
+	 * Branch recording at EL3 is disabled
 	 */
-	mdcr_el3_val &= ~(MDCR_SBRBE_MASK << MDCR_SBRBE_SHIFT);
+	mdcr_el3_val &= ~((MDCR_SBRBE_MASK << MDCR_SBRBE_SHIFT) | MDCR_E3BREW | MDCR_E3BREC);
 	mdcr_el3_val |= (0x1UL << MDCR_SBRBE_SHIFT);
 	write_ctx_reg(state, CTX_MDCR_EL3, mdcr_el3_val);
 }