| Dimitris Papastamos | 0a4cded | 2018-01-02 11:37:02 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved. |
| 3 | * |
| 4 | * SPDX-License-Identifier: BSD-3-Clause |
| 5 | */ |
| 6 | |
| 7 | #include <asm_macros.S> |
| 8 | |
| Dimitris Papastamos | 570c06a | 2018-04-06 15:29:34 +0100 | [diff] [blame] | 9 | .globl wa_cve_2017_5715_bpiall_vbar |
| Dimitris Papastamos | 0a4cded | 2018-01-02 11:37:02 +0000 | [diff] [blame] | 10 | |
| Dimitris Papastamos | 570c06a | 2018-04-06 15:29:34 +0100 | [diff] [blame] | 11 | vector_base wa_cve_2017_5715_bpiall_vbar |
| Dimitris Papastamos | 0a4cded | 2018-01-02 11:37:02 +0000 | [diff] [blame] | 12 | /* We encode the exception entry in the bottom 3 bits of SP */ |
| 13 | add sp, sp, #1 /* Reset: 0b111 */ |
| 14 | add sp, sp, #1 /* Undef: 0b110 */ |
| 15 | add sp, sp, #1 /* Syscall: 0b101 */ |
| 16 | add sp, sp, #1 /* Prefetch abort: 0b100 */ |
| 17 | add sp, sp, #1 /* Data abort: 0b011 */ |
| 18 | add sp, sp, #1 /* Reserved: 0b010 */ |
| 19 | add sp, sp, #1 /* IRQ: 0b001 */ |
| 20 | nop /* FIQ: 0b000 */ |
| 21 | |
| 22 | /* |
| 23 | * Invalidate the branch predictor, `r0` is a dummy register |
| 24 | * and is unused. |
| 25 | */ |
| 26 | stcopr r0, BPIALL |
| 27 | isb |
| 28 | |
| 29 | /* |
| 30 | * As we cannot use any temporary registers and cannot |
| 31 | * clobber SP, we can decode the exception entry using |
| 32 | * an unrolled binary search. |
| 33 | * |
| 34 | * Note, if this code is re-used by other secure payloads, |
| 35 | * the below exception entry vectors must be changed to |
| 36 | * the vectors specific to that secure payload. |
| 37 | */ |
| 38 | |
| 39 | tst sp, #4 |
| 40 | bne 1f |
| 41 | |
| 42 | tst sp, #2 |
| 43 | bne 3f |
| 44 | |
| 45 | /* Expected encoding: 0x1 and 0x0 */ |
| 46 | tst sp, #1 |
| 47 | /* Restore original value of SP by clearing the bottom 3 bits */ |
| 48 | bic sp, sp, #0x7 |
| 49 | bne plat_panic_handler /* IRQ */ |
| 50 | b sp_min_handle_fiq /* FIQ */ |
| 51 | |
| 52 | 1: |
| 53 | tst sp, #2 |
| 54 | bne 2f |
| 55 | |
| 56 | /* Expected encoding: 0x4 and 0x5 */ |
| 57 | tst sp, #1 |
| 58 | bic sp, sp, #0x7 |
| 59 | bne sp_min_handle_smc /* Syscall */ |
| 60 | b plat_panic_handler /* Prefetch abort */ |
| 61 | |
| 62 | 2: |
| 63 | /* Expected encoding: 0x7 and 0x6 */ |
| 64 | tst sp, #1 |
| 65 | bic sp, sp, #0x7 |
| 66 | bne sp_min_entrypoint /* Reset */ |
| 67 | b plat_panic_handler /* Undef */ |
| 68 | |
| 69 | 3: |
| 70 | /* Expected encoding: 0x2 and 0x3 */ |
| 71 | tst sp, #1 |
| 72 | bic sp, sp, #0x7 |
| 73 | bne plat_panic_handler /* Data abort */ |
| 74 | b plat_panic_handler /* Reserved */ |