Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 1 | /* |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 2 | * Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved. |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 3 | * |
dp-arm | fa3cf0b | 2017-05-03 09:38:09 +0100 | [diff] [blame] | 4 | * SPDX-License-Identifier: BSD-3-Clause |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 5 | */ |
| 6 | |
| 7 | #include <arch.h> |
| 8 | #include <asm_macros.S> |
| 9 | #include <assert_macros.S> |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 10 | #include <context.h> |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 11 | #include <denver.h> |
| 12 | #include <cpu_macros.S> |
| 13 | #include <plat_macros.S> |
| 14 | |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 15 | /* ------------------------------------------------- |
| 16 | * CVE-2017-5715 mitigation |
| 17 | * |
| 18 | * Flush the indirect branch predictor and RSB on |
| 19 | * entry to EL3 by issuing a newly added instruction |
| 20 | * for Denver CPUs. |
| 21 | * |
| 22 | * To achieve this without performing any branch |
| 23 | * instruction, a per-cpu vbar is installed which |
| 24 | * executes the workaround and then branches off to |
| 25 | * the corresponding vector entry in the main vector |
| 26 | * table. |
| 27 | * ------------------------------------------------- |
| 28 | */ |
| 29 | .globl workaround_bpflush_runtime_exceptions |
| 30 | |
| 31 | vector_base workaround_bpflush_runtime_exceptions |
| 32 | |
| 33 | .macro apply_workaround |
| 34 | stp x0, x1, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X0] |
| 35 | |
| 36 | /* ------------------------------------------------- |
| 37 | * A new write-only system register where a write of |
| 38 | * 1 to bit 0 will cause the indirect branch predictor |
| 39 | * and RSB to be flushed. |
| 40 | * |
| 41 | * A write of 0 to bit 0 will be ignored. A write of |
| 42 | * 1 to any other bit will cause an MCA. |
| 43 | * ------------------------------------------------- |
| 44 | */ |
| 45 | mov x0, #1 |
| 46 | msr s3_0_c15_c0_6, x0 |
| 47 | isb |
| 48 | |
| 49 | ldp x0, x1, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X0] |
| 50 | .endm |
| 51 | |
| 52 | /* --------------------------------------------------------------------- |
| 53 | * Current EL with SP_EL0 : 0x0 - 0x200 |
| 54 | * --------------------------------------------------------------------- |
| 55 | */ |
| 56 | vector_entry workaround_bpflush_sync_exception_sp_el0 |
| 57 | b sync_exception_sp_el0 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 58 | end_vector_entry workaround_bpflush_sync_exception_sp_el0 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 59 | |
| 60 | vector_entry workaround_bpflush_irq_sp_el0 |
| 61 | b irq_sp_el0 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 62 | end_vector_entry workaround_bpflush_irq_sp_el0 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 63 | |
| 64 | vector_entry workaround_bpflush_fiq_sp_el0 |
| 65 | b fiq_sp_el0 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 66 | end_vector_entry workaround_bpflush_fiq_sp_el0 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 67 | |
| 68 | vector_entry workaround_bpflush_serror_sp_el0 |
| 69 | b serror_sp_el0 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 70 | end_vector_entry workaround_bpflush_serror_sp_el0 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 71 | |
| 72 | /* --------------------------------------------------------------------- |
| 73 | * Current EL with SP_ELx: 0x200 - 0x400 |
| 74 | * --------------------------------------------------------------------- |
| 75 | */ |
| 76 | vector_entry workaround_bpflush_sync_exception_sp_elx |
| 77 | b sync_exception_sp_elx |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 78 | end_vector_entry workaround_bpflush_sync_exception_sp_elx |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 79 | |
| 80 | vector_entry workaround_bpflush_irq_sp_elx |
| 81 | b irq_sp_elx |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 82 | end_vector_entry workaround_bpflush_irq_sp_elx |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 83 | |
| 84 | vector_entry workaround_bpflush_fiq_sp_elx |
| 85 | b fiq_sp_elx |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 86 | end_vector_entry workaround_bpflush_fiq_sp_elx |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 87 | |
| 88 | vector_entry workaround_bpflush_serror_sp_elx |
| 89 | b serror_sp_elx |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 90 | end_vector_entry workaround_bpflush_serror_sp_elx |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 91 | |
| 92 | /* --------------------------------------------------------------------- |
| 93 | * Lower EL using AArch64 : 0x400 - 0x600 |
| 94 | * --------------------------------------------------------------------- |
| 95 | */ |
| 96 | vector_entry workaround_bpflush_sync_exception_aarch64 |
| 97 | apply_workaround |
| 98 | b sync_exception_aarch64 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 99 | end_vector_entry workaround_bpflush_sync_exception_aarch64 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 100 | |
| 101 | vector_entry workaround_bpflush_irq_aarch64 |
| 102 | apply_workaround |
| 103 | b irq_aarch64 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 104 | end_vector_entry workaround_bpflush_irq_aarch64 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 105 | |
| 106 | vector_entry workaround_bpflush_fiq_aarch64 |
| 107 | apply_workaround |
| 108 | b fiq_aarch64 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 109 | end_vector_entry workaround_bpflush_fiq_aarch64 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 110 | |
| 111 | vector_entry workaround_bpflush_serror_aarch64 |
| 112 | apply_workaround |
| 113 | b serror_aarch64 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 114 | end_vector_entry workaround_bpflush_serror_aarch64 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 115 | |
| 116 | /* --------------------------------------------------------------------- |
| 117 | * Lower EL using AArch32 : 0x600 - 0x800 |
| 118 | * --------------------------------------------------------------------- |
| 119 | */ |
| 120 | vector_entry workaround_bpflush_sync_exception_aarch32 |
| 121 | apply_workaround |
| 122 | b sync_exception_aarch32 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 123 | end_vector_entry workaround_bpflush_sync_exception_aarch32 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 124 | |
| 125 | vector_entry workaround_bpflush_irq_aarch32 |
| 126 | apply_workaround |
| 127 | b irq_aarch32 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 128 | end_vector_entry workaround_bpflush_irq_aarch32 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 129 | |
| 130 | vector_entry workaround_bpflush_fiq_aarch32 |
| 131 | apply_workaround |
| 132 | b fiq_aarch32 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 133 | end_vector_entry workaround_bpflush_fiq_aarch32 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 134 | |
| 135 | vector_entry workaround_bpflush_serror_aarch32 |
| 136 | apply_workaround |
| 137 | b serror_aarch32 |
Roberto Vargas | 95f30ab | 2018-04-17 11:31:43 +0100 | [diff] [blame] | 138 | end_vector_entry workaround_bpflush_serror_aarch32 |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 139 | |
Varun Wadekar | d43583c | 2016-02-22 11:09:41 -0800 | [diff] [blame] | 140 | .global denver_disable_dco |
| 141 | |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 142 | /* --------------------------------------------- |
| 143 | * Disable debug interfaces |
| 144 | * --------------------------------------------- |
| 145 | */ |
| 146 | func denver_disable_ext_debug |
| 147 | mov x0, #1 |
| 148 | msr osdlr_el1, x0 |
| 149 | isb |
| 150 | dsb sy |
| 151 | ret |
| 152 | endfunc denver_disable_ext_debug |
| 153 | |
| 154 | /* ---------------------------------------------------- |
| 155 | * Enable dynamic code optimizer (DCO) |
| 156 | * ---------------------------------------------------- |
| 157 | */ |
| 158 | func denver_enable_dco |
Varun Wadekar | 007a206 | 2018-02-27 18:30:31 -0800 | [diff] [blame^] | 159 | mov x3, x30 |
| 160 | bl plat_my_core_pos |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 161 | mov x1, #1 |
| 162 | lsl x1, x1, x0 |
| 163 | msr s3_0_c15_c0_2, x1 |
Varun Wadekar | 007a206 | 2018-02-27 18:30:31 -0800 | [diff] [blame^] | 164 | mov x30, x3 |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 165 | ret |
| 166 | endfunc denver_enable_dco |
| 167 | |
| 168 | /* ---------------------------------------------------- |
| 169 | * Disable dynamic code optimizer (DCO) |
| 170 | * ---------------------------------------------------- |
| 171 | */ |
| 172 | func denver_disable_dco |
| 173 | |
Varun Wadekar | 007a206 | 2018-02-27 18:30:31 -0800 | [diff] [blame^] | 174 | mov x3, x30 |
| 175 | |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 176 | /* turn off background work */ |
Varun Wadekar | 007a206 | 2018-02-27 18:30:31 -0800 | [diff] [blame^] | 177 | bl plat_my_core_pos |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 178 | mov x1, #1 |
| 179 | lsl x1, x1, x0 |
| 180 | lsl x2, x1, #16 |
| 181 | msr s3_0_c15_c0_2, x2 |
| 182 | isb |
| 183 | |
| 184 | /* wait till the background work turns off */ |
| 185 | 1: mrs x2, s3_0_c15_c0_2 |
| 186 | lsr x2, x2, #32 |
| 187 | and w2, w2, 0xFFFF |
| 188 | and x2, x2, x1 |
| 189 | cbnz x2, 1b |
| 190 | |
Varun Wadekar | 007a206 | 2018-02-27 18:30:31 -0800 | [diff] [blame^] | 191 | mov x30, x3 |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 192 | ret |
| 193 | endfunc denver_disable_dco |
| 194 | |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 195 | func check_errata_cve_2017_5715 |
| 196 | mov x0, #ERRATA_MISSING |
| 197 | #if WORKAROUND_CVE_2017_5715 |
| 198 | /* |
| 199 | * Check if the CPU supports the special instruction |
| 200 | * required to flush the indirect branch predictor and |
| 201 | * RSB. Support for this operation can be determined by |
| 202 | * comparing bits 19:16 of ID_AFR0_EL1 with 0b0001. |
| 203 | */ |
| 204 | mrs x1, id_afr0_el1 |
| 205 | mov x2, #0x10000 |
| 206 | and x1, x1, x2 |
| 207 | cbz x1, 1f |
| 208 | mov x0, #ERRATA_APPLIES |
| 209 | 1: |
| 210 | #endif |
| 211 | ret |
| 212 | endfunc check_errata_cve_2017_5715 |
| 213 | |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 214 | /* ------------------------------------------------- |
| 215 | * The CPU Ops reset function for Denver. |
| 216 | * ------------------------------------------------- |
| 217 | */ |
| 218 | func denver_reset_func |
| 219 | |
| 220 | mov x19, x30 |
| 221 | |
Varun Wadekar | e34bd09 | 2018-01-10 17:03:22 -0800 | [diff] [blame] | 222 | #if IMAGE_BL31 && WORKAROUND_CVE_2017_5715 |
| 223 | /* |
| 224 | * Check if the CPU supports the special instruction |
| 225 | * required to flush the indirect branch predictor and |
| 226 | * RSB. Support for this operation can be determined by |
| 227 | * comparing bits 19:16 of ID_AFR0_EL1 with 0b0001. |
| 228 | */ |
| 229 | mrs x0, id_afr0_el1 |
| 230 | mov x1, #0x10000 |
| 231 | and x0, x0, x1 |
| 232 | cmp x0, #0 |
| 233 | adr x1, workaround_bpflush_runtime_exceptions |
| 234 | mrs x2, vbar_el3 |
| 235 | csel x0, x1, x2, ne |
| 236 | msr vbar_el3, x0 |
| 237 | #endif |
| 238 | |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 239 | /* ---------------------------------------------------- |
| 240 | * Enable dynamic code optimizer (DCO) |
| 241 | * ---------------------------------------------------- |
| 242 | */ |
| 243 | bl denver_enable_dco |
| 244 | |
| 245 | ret x19 |
| 246 | endfunc denver_reset_func |
| 247 | |
| 248 | /* ---------------------------------------------------- |
| 249 | * The CPU Ops core power down function for Denver. |
| 250 | * ---------------------------------------------------- |
| 251 | */ |
| 252 | func denver_core_pwr_dwn |
| 253 | |
| 254 | mov x19, x30 |
| 255 | |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 256 | /* --------------------------------------------- |
| 257 | * Force the debug interfaces to be quiescent |
| 258 | * --------------------------------------------- |
| 259 | */ |
| 260 | bl denver_disable_ext_debug |
| 261 | |
| 262 | ret x19 |
| 263 | endfunc denver_core_pwr_dwn |
| 264 | |
| 265 | /* ------------------------------------------------------- |
| 266 | * The CPU Ops cluster power down function for Denver. |
| 267 | * ------------------------------------------------------- |
| 268 | */ |
| 269 | func denver_cluster_pwr_dwn |
| 270 | ret |
| 271 | endfunc denver_cluster_pwr_dwn |
| 272 | |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 273 | #if REPORT_ERRATA |
| 274 | /* |
| 275 | * Errata printing function for Denver. Must follow AAPCS. |
| 276 | */ |
| 277 | func denver_errata_report |
| 278 | stp x8, x30, [sp, #-16]! |
| 279 | |
| 280 | bl cpu_get_rev_var |
| 281 | mov x8, x0 |
| 282 | |
| 283 | /* |
| 284 | * Report all errata. The revision-variant information is passed to |
| 285 | * checking functions of each errata. |
| 286 | */ |
| 287 | report_errata WORKAROUND_CVE_2017_5715, denver, cve_2017_5715 |
| 288 | |
| 289 | ldp x8, x30, [sp], #16 |
| 290 | ret |
| 291 | endfunc denver_errata_report |
| 292 | #endif |
| 293 | |
Varun Wadekar | 28463b9 | 2015-07-14 17:11:20 +0530 | [diff] [blame] | 294 | /* --------------------------------------------- |
| 295 | * This function provides Denver specific |
| 296 | * register information for crash reporting. |
| 297 | * It needs to return with x6 pointing to |
| 298 | * a list of register names in ascii and |
| 299 | * x8 - x15 having values of registers to be |
| 300 | * reported. |
| 301 | * --------------------------------------------- |
| 302 | */ |
| 303 | .section .rodata.denver_regs, "aS" |
| 304 | denver_regs: /* The ascii list of register names to be reported */ |
| 305 | .asciz "actlr_el1", "" |
| 306 | |
| 307 | func denver_cpu_reg_dump |
| 308 | adr x6, denver_regs |
| 309 | mrs x8, ACTLR_EL1 |
| 310 | ret |
| 311 | endfunc denver_cpu_reg_dump |
| 312 | |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 313 | declare_cpu_ops_wa denver, DENVER_MIDR_PN0, \ |
Varun Wadekar | 3c337a6 | 2015-09-03 17:15:06 +0530 | [diff] [blame] | 314 | denver_reset_func, \ |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 315 | check_errata_cve_2017_5715, \ |
| 316 | CPU_NO_EXTRA2_FUNC, \ |
Varun Wadekar | 3c337a6 | 2015-09-03 17:15:06 +0530 | [diff] [blame] | 317 | denver_core_pwr_dwn, \ |
| 318 | denver_cluster_pwr_dwn |
| 319 | |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 320 | declare_cpu_ops_wa denver, DENVER_MIDR_PN1, \ |
Varun Wadekar | 3c337a6 | 2015-09-03 17:15:06 +0530 | [diff] [blame] | 321 | denver_reset_func, \ |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 322 | check_errata_cve_2017_5715, \ |
| 323 | CPU_NO_EXTRA2_FUNC, \ |
Varun Wadekar | 3c337a6 | 2015-09-03 17:15:06 +0530 | [diff] [blame] | 324 | denver_core_pwr_dwn, \ |
| 325 | denver_cluster_pwr_dwn |
| 326 | |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 327 | declare_cpu_ops_wa denver, DENVER_MIDR_PN2, \ |
Varun Wadekar | 3c337a6 | 2015-09-03 17:15:06 +0530 | [diff] [blame] | 328 | denver_reset_func, \ |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 329 | check_errata_cve_2017_5715, \ |
| 330 | CPU_NO_EXTRA2_FUNC, \ |
Varun Wadekar | 3c337a6 | 2015-09-03 17:15:06 +0530 | [diff] [blame] | 331 | denver_core_pwr_dwn, \ |
| 332 | denver_cluster_pwr_dwn |
| 333 | |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 334 | declare_cpu_ops_wa denver, DENVER_MIDR_PN3, \ |
Varun Wadekar | 3c337a6 | 2015-09-03 17:15:06 +0530 | [diff] [blame] | 335 | denver_reset_func, \ |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 336 | check_errata_cve_2017_5715, \ |
| 337 | CPU_NO_EXTRA2_FUNC, \ |
Varun Wadekar | 3c337a6 | 2015-09-03 17:15:06 +0530 | [diff] [blame] | 338 | denver_core_pwr_dwn, \ |
| 339 | denver_cluster_pwr_dwn |
| 340 | |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 341 | declare_cpu_ops_wa denver, DENVER_MIDR_PN4, \ |
Jeenu Viswambharan | ee5eb80 | 2016-11-18 12:58:28 +0000 | [diff] [blame] | 342 | denver_reset_func, \ |
Varun Wadekar | bc242fa | 2018-07-06 13:39:52 -0700 | [diff] [blame] | 343 | check_errata_cve_2017_5715, \ |
| 344 | CPU_NO_EXTRA2_FUNC, \ |
Jeenu Viswambharan | ee5eb80 | 2016-11-18 12:58:28 +0000 | [diff] [blame] | 345 | denver_core_pwr_dwn, \ |
| 346 | denver_cluster_pwr_dwn |