385 lines
9.9 KiB
ArmAsm
385 lines
9.9 KiB
ArmAsm
|
/*
|
||
|
|
* Copyright (c) 2015-2018, ARM Limited and Contributors. All rights reserved.
|
||
|
|
*
|
||
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
||
|
|
*/
|
||
|
|
|
||
|
|
#include <arch.h>
|
||
|
|
#include <asm_macros.S>
|
||
|
|
#include <assert_macros.S>
|
||
|
|
#include <context.h>
|
||
|
|
#include <denver.h>
|
||
|
|
#include <cpu_macros.S>
|
||
|
|
#include <plat_macros.S>
|
||
|
|
|
||
|
|
/* -------------------------------------------------
|
||
|
|
* CVE-2017-5715 mitigation
|
||
|
|
*
|
||
|
|
* Flush the indirect branch predictor and RSB on
|
||
|
|
* entry to EL3 by issuing a newly added instruction
|
||
|
|
* for Denver CPUs.
|
||
|
|
*
|
||
|
|
* To achieve this without performing any branch
|
||
|
|
* instruction, a per-cpu vbar is installed which
|
||
|
|
* executes the workaround and then branches off to
|
||
|
|
* the corresponding vector entry in the main vector
|
||
|
|
* table.
|
||
|
|
* -------------------------------------------------
|
||
|
|
*/
|
||
|
|
.globl workaround_bpflush_runtime_exceptions
|
||
|
|
|
||
|
|
vector_base workaround_bpflush_runtime_exceptions
|
||
|
|
|
||
|
|
.macro apply_workaround
|
||
|
|
stp x0, x1, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X0]
|
||
|
|
|
||
|
|
/* -------------------------------------------------
|
||
|
|
* A new write-only system register where a write of
|
||
|
|
* 1 to bit 0 will cause the indirect branch predictor
|
||
|
|
* and RSB to be flushed.
|
||
|
|
*
|
||
|
|
* A write of 0 to bit 0 will be ignored. A write of
|
||
|
|
* 1 to any other bit will cause an MCA.
|
||
|
|
* -------------------------------------------------
|
||
|
|
*/
|
||
|
|
mov x0, #1
|
||
|
|
msr s3_0_c15_c0_6, x0
|
||
|
|
isb
|
||
|
|
|
||
|
|
ldp x0, x1, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X0]
|
||
|
|
.endm
|
||
|
|
|
||
|
|
/* ---------------------------------------------------------------------
|
||
|
|
* Current EL with SP_EL0 : 0x0 - 0x200
|
||
|
|
* ---------------------------------------------------------------------
|
||
|
|
*/
|
||
|
|
vector_entry workaround_bpflush_sync_exception_sp_el0
|
||
|
|
b sync_exception_sp_el0
|
||
|
|
end_vector_entry workaround_bpflush_sync_exception_sp_el0
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_irq_sp_el0
|
||
|
|
b irq_sp_el0
|
||
|
|
end_vector_entry workaround_bpflush_irq_sp_el0
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_fiq_sp_el0
|
||
|
|
b fiq_sp_el0
|
||
|
|
end_vector_entry workaround_bpflush_fiq_sp_el0
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_serror_sp_el0
|
||
|
|
b serror_sp_el0
|
||
|
|
end_vector_entry workaround_bpflush_serror_sp_el0
|
||
|
|
|
||
|
|
/* ---------------------------------------------------------------------
|
||
|
|
* Current EL with SP_ELx: 0x200 - 0x400
|
||
|
|
* ---------------------------------------------------------------------
|
||
|
|
*/
|
||
|
|
vector_entry workaround_bpflush_sync_exception_sp_elx
|
||
|
|
b sync_exception_sp_elx
|
||
|
|
end_vector_entry workaround_bpflush_sync_exception_sp_elx
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_irq_sp_elx
|
||
|
|
b irq_sp_elx
|
||
|
|
end_vector_entry workaround_bpflush_irq_sp_elx
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_fiq_sp_elx
|
||
|
|
b fiq_sp_elx
|
||
|
|
end_vector_entry workaround_bpflush_fiq_sp_elx
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_serror_sp_elx
|
||
|
|
b serror_sp_elx
|
||
|
|
end_vector_entry workaround_bpflush_serror_sp_elx
|
||
|
|
|
||
|
|
/* ---------------------------------------------------------------------
|
||
|
|
* Lower EL using AArch64 : 0x400 - 0x600
|
||
|
|
* ---------------------------------------------------------------------
|
||
|
|
*/
|
||
|
|
vector_entry workaround_bpflush_sync_exception_aarch64
|
||
|
|
apply_workaround
|
||
|
|
b sync_exception_aarch64
|
||
|
|
end_vector_entry workaround_bpflush_sync_exception_aarch64
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_irq_aarch64
|
||
|
|
apply_workaround
|
||
|
|
b irq_aarch64
|
||
|
|
end_vector_entry workaround_bpflush_irq_aarch64
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_fiq_aarch64
|
||
|
|
apply_workaround
|
||
|
|
b fiq_aarch64
|
||
|
|
end_vector_entry workaround_bpflush_fiq_aarch64
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_serror_aarch64
|
||
|
|
apply_workaround
|
||
|
|
b serror_aarch64
|
||
|
|
end_vector_entry workaround_bpflush_serror_aarch64
|
||
|
|
|
||
|
|
/* ---------------------------------------------------------------------
|
||
|
|
* Lower EL using AArch32 : 0x600 - 0x800
|
||
|
|
* ---------------------------------------------------------------------
|
||
|
|
*/
|
||
|
|
vector_entry workaround_bpflush_sync_exception_aarch32
|
||
|
|
apply_workaround
|
||
|
|
b sync_exception_aarch32
|
||
|
|
end_vector_entry workaround_bpflush_sync_exception_aarch32
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_irq_aarch32
|
||
|
|
apply_workaround
|
||
|
|
b irq_aarch32
|
||
|
|
end_vector_entry workaround_bpflush_irq_aarch32
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_fiq_aarch32
|
||
|
|
apply_workaround
|
||
|
|
b fiq_aarch32
|
||
|
|
end_vector_entry workaround_bpflush_fiq_aarch32
|
||
|
|
|
||
|
|
vector_entry workaround_bpflush_serror_aarch32
|
||
|
|
apply_workaround
|
||
|
|
b serror_aarch32
|
||
|
|
end_vector_entry workaround_bpflush_serror_aarch32
|
||
|
|
|
||
|
|
.global denver_disable_dco
|
||
|
|
|
||
|
|
/* ---------------------------------------------
|
||
|
|
* Disable debug interfaces
|
||
|
|
* ---------------------------------------------
|
||
|
|
*/
|
||
|
|
func denver_disable_ext_debug
|
||
|
|
mov x0, #1
|
||
|
|
msr osdlr_el1, x0
|
||
|
|
isb
|
||
|
|
dsb sy
|
||
|
|
ret
|
||
|
|
endfunc denver_disable_ext_debug
|
||
|
|
|
||
|
|
/* ----------------------------------------------------
|
||
|
|
* Enable dynamic code optimizer (DCO)
|
||
|
|
* ----------------------------------------------------
|
||
|
|
*/
|
||
|
|
func denver_enable_dco
|
||
|
|
mov x3, x30
|
||
|
|
bl plat_my_core_pos
|
||
|
|
mov x1, #1
|
||
|
|
lsl x1, x1, x0
|
||
|
|
msr s3_0_c15_c0_2, x1
|
||
|
|
mov x30, x3
|
||
|
|
ret
|
||
|
|
endfunc denver_enable_dco
|
||
|
|
|
||
|
|
/* ----------------------------------------------------
|
||
|
|
* Disable dynamic code optimizer (DCO)
|
||
|
|
* ----------------------------------------------------
|
||
|
|
*/
|
||
|
|
func denver_disable_dco
|
||
|
|
|
||
|
|
mov x3, x30
|
||
|
|
|
||
|
|
/* turn off background work */
|
||
|
|
bl plat_my_core_pos
|
||
|
|
mov x1, #1
|
||
|
|
lsl x1, x1, x0
|
||
|
|
lsl x2, x1, #16
|
||
|
|
msr s3_0_c15_c0_2, x2
|
||
|
|
isb
|
||
|
|
|
||
|
|
/* wait till the background work turns off */
|
||
|
|
1: mrs x2, s3_0_c15_c0_2
|
||
|
|
lsr x2, x2, #32
|
||
|
|
and w2, w2, 0xFFFF
|
||
|
|
and x2, x2, x1
|
||
|
|
cbnz x2, 1b
|
||
|
|
|
||
|
|
mov x30, x3
|
||
|
|
ret
|
||
|
|
endfunc denver_disable_dco
|
||
|
|
|
||
|
|
func check_errata_cve_2017_5715
|
||
|
|
mov x0, #ERRATA_MISSING
|
||
|
|
#if WORKAROUND_CVE_2017_5715
|
||
|
|
/*
|
||
|
|
* Check if the CPU supports the special instruction
|
||
|
|
* required to flush the indirect branch predictor and
|
||
|
|
* RSB. Support for this operation can be determined by
|
||
|
|
* comparing bits 19:16 of ID_AFR0_EL1 with 0b0001.
|
||
|
|
*/
|
||
|
|
mrs x1, id_afr0_el1
|
||
|
|
mov x2, #0x10000
|
||
|
|
and x1, x1, x2
|
||
|
|
cbz x1, 1f
|
||
|
|
mov x0, #ERRATA_APPLIES
|
||
|
|
1:
|
||
|
|
#endif
|
||
|
|
ret
|
||
|
|
endfunc check_errata_cve_2017_5715
|
||
|
|
|
||
|
|
func check_errata_cve_2018_3639
|
||
|
|
#if WORKAROUND_CVE_2018_3639
|
||
|
|
mov x0, #ERRATA_APPLIES
|
||
|
|
#else
|
||
|
|
mov x0, #ERRATA_MISSING
|
||
|
|
#endif
|
||
|
|
ret
|
||
|
|
endfunc check_errata_cve_2018_3639
|
||
|
|
|
||
|
|
/* -------------------------------------------------
|
||
|
|
* The CPU Ops reset function for Denver.
|
||
|
|
* -------------------------------------------------
|
||
|
|
*/
|
||
|
|
func denver_reset_func
|
||
|
|
|
||
|
|
mov x19, x30
|
||
|
|
|
||
|
|
#if IMAGE_BL31 && WORKAROUND_CVE_2017_5715
|
||
|
|
/*
|
||
|
|
* Check if the CPU supports the special instruction
|
||
|
|
* required to flush the indirect branch predictor and
|
||
|
|
* RSB. Support for this operation can be determined by
|
||
|
|
* comparing bits 19:16 of ID_AFR0_EL1 with 0b0001.
|
||
|
|
*/
|
||
|
|
mrs x0, id_afr0_el1
|
||
|
|
mov x1, #0x10000
|
||
|
|
and x0, x0, x1
|
||
|
|
cmp x0, #0
|
||
|
|
adr x1, workaround_bpflush_runtime_exceptions
|
||
|
|
mrs x2, vbar_el3
|
||
|
|
csel x0, x1, x2, ne
|
||
|
|
msr vbar_el3, x0
|
||
|
|
#endif
|
||
|
|
|
||
|
|
#if WORKAROUND_CVE_2018_3639
|
||
|
|
/*
|
||
|
|
* Denver CPUs with DENVER_MIDR_PN3 or earlier, use different
|
||
|
|
* bits in the ACTLR_EL3 register to disable speculative
|
||
|
|
* store buffer and memory disambiguation.
|
||
|
|
*/
|
||
|
|
mrs x0, midr_el1
|
||
|
|
mov_imm x1, DENVER_MIDR_PN4
|
||
|
|
cmp x0, x1
|
||
|
|
mrs x0, actlr_el3
|
||
|
|
mov x1, #(DENVER_CPU_DIS_MD_EL3 | DENVER_CPU_DIS_SSB_EL3)
|
||
|
|
mov x2, #(DENVER_PN4_CPU_DIS_MD_EL3 | DENVER_PN4_CPU_DIS_SSB_EL3)
|
||
|
|
csel x3, x1, x2, ne
|
||
|
|
orr x0, x0, x3
|
||
|
|
msr actlr_el3, x0
|
||
|
|
isb
|
||
|
|
dsb sy
|
||
|
|
#endif
|
||
|
|
|
||
|
|
/* ----------------------------------------------------
|
||
|
|
* Reset ACTLR.PMSTATE to C1 state
|
||
|
|
* ----------------------------------------------------
|
||
|
|
*/
|
||
|
|
mrs x0, actlr_el1
|
||
|
|
bic x0, x0, #DENVER_CPU_PMSTATE_MASK
|
||
|
|
orr x0, x0, #DENVER_CPU_PMSTATE_C1
|
||
|
|
msr actlr_el1, x0
|
||
|
|
|
||
|
|
/* ----------------------------------------------------
|
||
|
|
* Enable dynamic code optimizer (DCO)
|
||
|
|
* ----------------------------------------------------
|
||
|
|
*/
|
||
|
|
bl denver_enable_dco
|
||
|
|
|
||
|
|
ret x19
|
||
|
|
endfunc denver_reset_func
|
||
|
|
|
||
|
|
/* ----------------------------------------------------
|
||
|
|
* The CPU Ops core power down function for Denver.
|
||
|
|
* ----------------------------------------------------
|
||
|
|
*/
|
||
|
|
func denver_core_pwr_dwn
|
||
|
|
|
||
|
|
mov x19, x30
|
||
|
|
|
||
|
|
/* ---------------------------------------------
|
||
|
|
* Force the debug interfaces to be quiescent
|
||
|
|
* ---------------------------------------------
|
||
|
|
*/
|
||
|
|
bl denver_disable_ext_debug
|
||
|
|
|
||
|
|
ret x19
|
||
|
|
endfunc denver_core_pwr_dwn
|
||
|
|
|
||
|
|
/* -------------------------------------------------------
|
||
|
|
* The CPU Ops cluster power down function for Denver.
|
||
|
|
* -------------------------------------------------------
|
||
|
|
*/
|
||
|
|
func denver_cluster_pwr_dwn
|
||
|
|
ret
|
||
|
|
endfunc denver_cluster_pwr_dwn
|
||
|
|
|
||
|
|
#if REPORT_ERRATA
|
||
|
|
/*
|
||
|
|
* Errata printing function for Denver. Must follow AAPCS.
|
||
|
|
*/
|
||
|
|
func denver_errata_report
|
||
|
|
stp x8, x30, [sp, #-16]!
|
||
|
|
|
||
|
|
bl cpu_get_rev_var
|
||
|
|
mov x8, x0
|
||
|
|
|
||
|
|
/*
|
||
|
|
* Report all errata. The revision-variant information is passed to
|
||
|
|
* checking functions of each errata.
|
||
|
|
*/
|
||
|
|
report_errata WORKAROUND_CVE_2017_5715, denver, cve_2017_5715
|
||
|
|
report_errata WORKAROUND_CVE_2018_3639, denver, cve_2018_3639
|
||
|
|
|
||
|
|
ldp x8, x30, [sp], #16
|
||
|
|
ret
|
||
|
|
endfunc denver_errata_report
|
||
|
|
#endif
|
||
|
|
|
||
|
|
/* ---------------------------------------------
|
||
|
|
* This function provides Denver specific
|
||
|
|
* register information for crash reporting.
|
||
|
|
* It needs to return with x6 pointing to
|
||
|
|
* a list of register names in ascii and
|
||
|
|
* x8 - x15 having values of registers to be
|
||
|
|
* reported.
|
||
|
|
* ---------------------------------------------
|
||
|
|
*/
|
||
|
|
.section .rodata.denver_regs, "aS"
|
||
|
|
denver_regs: /* The ascii list of register names to be reported */
|
||
|
|
.asciz "actlr_el1", ""
|
||
|
|
|
||
|
|
func denver_cpu_reg_dump
|
||
|
|
adr x6, denver_regs
|
||
|
|
mrs x8, ACTLR_EL1
|
||
|
|
ret
|
||
|
|
endfunc denver_cpu_reg_dump
|
||
|
|
|
||
|
|
declare_cpu_ops_wa denver, DENVER_MIDR_PN0, \
|
||
|
|
denver_reset_func, \
|
||
|
|
check_errata_cve_2017_5715, \
|
||
|
|
CPU_NO_EXTRA2_FUNC, \
|
||
|
|
denver_core_pwr_dwn, \
|
||
|
|
denver_cluster_pwr_dwn
|
||
|
|
|
||
|
|
declare_cpu_ops_wa denver, DENVER_MIDR_PN1, \
|
||
|
|
denver_reset_func, \
|
||
|
|
check_errata_cve_2017_5715, \
|
||
|
|
CPU_NO_EXTRA2_FUNC, \
|
||
|
|
denver_core_pwr_dwn, \
|
||
|
|
denver_cluster_pwr_dwn
|
||
|
|
|
||
|
|
declare_cpu_ops_wa denver, DENVER_MIDR_PN2, \
|
||
|
|
denver_reset_func, \
|
||
|
|
check_errata_cve_2017_5715, \
|
||
|
|
CPU_NO_EXTRA2_FUNC, \
|
||
|
|
denver_core_pwr_dwn, \
|
||
|
|
denver_cluster_pwr_dwn
|
||
|
|
|
||
|
|
declare_cpu_ops_wa denver, DENVER_MIDR_PN3, \
|
||
|
|
denver_reset_func, \
|
||
|
|
check_errata_cve_2017_5715, \
|
||
|
|
CPU_NO_EXTRA2_FUNC, \
|
||
|
|
denver_core_pwr_dwn, \
|
||
|
|
denver_cluster_pwr_dwn
|
||
|
|
|
||
|
|
declare_cpu_ops_wa denver, DENVER_MIDR_PN4, \
|
||
|
|
denver_reset_func, \
|
||
|
|
check_errata_cve_2017_5715, \
|
||
|
|
CPU_NO_EXTRA2_FUNC, \
|
||
|
|
denver_core_pwr_dwn, \
|
||
|
|
denver_cluster_pwr_dwn
|