1/* 2 * Copyright (c) 2017-2020, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7#include <arch.h> 8#include <asm_macros.S> 9#include <common/bl_common.h> 10#include <context.h> 11#include <cortex_a76.h> 12#include <cpu_macros.S> 13#include <plat_macros.S> 14#include <services/arm_arch_svc.h> 15 16/* Hardware handled coherency */ 17#if HW_ASSISTED_COHERENCY == 0 18#error "Cortex-A76 must be compiled with HW_ASSISTED_COHERENCY enabled" 19#endif 20 21/* 64-bit only core */ 22#if CTX_INCLUDE_AARCH32_REGS == 1 23#error "Cortex-A76 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0" 24#endif 25 26#define ESR_EL3_A64_SMC0 0x5e000000 27#define ESR_EL3_A32_SMC0 0x4e000000 28 29#if DYNAMIC_WORKAROUND_CVE_2018_3639 30 /* 31 * This macro applies the mitigation for CVE-2018-3639. 32 * It implements a fast path where `SMCCC_ARCH_WORKAROUND_2` 33 * SMC calls from a lower EL running in AArch32 or AArch64 34 * will go through the fast and return early. 35 * 36 * The macro saves x2-x3 to the context. In the fast path 37 * x0-x3 registers do not need to be restored as the calling 38 * context will have saved them. 39 */ 40 .macro apply_cve_2018_3639_wa _is_sync_exception _esr_el3_val 41 stp x2, x3, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X2] 42 43 .if \_is_sync_exception 44 /* 45 * Ensure SMC is coming from A64/A32 state on #0 46 * with W0 = SMCCC_ARCH_WORKAROUND_2 47 * 48 * This sequence evaluates as: 49 * (W0==SMCCC_ARCH_WORKAROUND_2) ? (ESR_EL3==SMC#0) : (NE) 50 * allowing use of a single branch operation 51 */ 52 orr w2, wzr, #SMCCC_ARCH_WORKAROUND_2 53 cmp x0, x2 54 mrs x3, esr_el3 55 mov_imm w2, \_esr_el3_val 56 ccmp w2, w3, #0, eq 57 /* 58 * Static predictor will predict a fall-through, optimizing 59 * the `SMCCC_ARCH_WORKAROUND_2` fast path. 60 */ 61 bne 1f 62 63 /* 64 * The sequence below implements the `SMCCC_ARCH_WORKAROUND_2` 65 * fast path. 66 */ 67 cmp x1, xzr /* enable/disable check */ 68 69 /* 70 * When the calling context wants mitigation disabled, 71 * we program the mitigation disable function in the 72 * CPU context, which gets invoked on subsequent exits from 73 * EL3 via the `el3_exit` function. Otherwise NULL is 74 * programmed in the CPU context, which results in caller's 75 * inheriting the EL3 mitigation state (enabled) on subsequent 76 * `el3_exit`. 77 */ 78 mov x0, xzr 79 adr x1, cortex_a76_disable_wa_cve_2018_3639 80 csel x1, x1, x0, eq 81 str x1, [sp, #CTX_CVE_2018_3639_OFFSET + CTX_CVE_2018_3639_DISABLE] 82 83 mrs x2, CORTEX_A76_CPUACTLR2_EL1 84 orr x1, x2, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE 85 bic x3, x2, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE 86 csel x3, x3, x1, eq 87 msr CORTEX_A76_CPUACTLR2_EL1, x3 88 exception_return /* exception_return contains ISB */ 89 .endif 901: 91 /* 92 * Always enable v4 mitigation during EL3 execution. This is not 93 * required for the fast path above because it does not perform any 94 * memory loads. 95 */ 96 mrs x2, CORTEX_A76_CPUACTLR2_EL1 97 orr x2, x2, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE 98 msr CORTEX_A76_CPUACTLR2_EL1, x2 99 isb 100 101 /* 102 * The caller may have passed arguments to EL3 via x2-x3. 103 * Restore these registers from the context before jumping to the 104 * main runtime vector table entry. 105 */ 106 ldp x2, x3, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X2] 107 .endm 108 109vector_base cortex_a76_wa_cve_2018_3639_a76_vbar 110 111 /* --------------------------------------------------------------------- 112 * Current EL with SP_EL0 : 0x0 - 0x200 113 * --------------------------------------------------------------------- 114 */ 115vector_entry cortex_a76_sync_exception_sp_el0 116 b sync_exception_sp_el0 117end_vector_entry cortex_a76_sync_exception_sp_el0 118 119vector_entry cortex_a76_irq_sp_el0 120 b irq_sp_el0 121end_vector_entry cortex_a76_irq_sp_el0 122 123vector_entry cortex_a76_fiq_sp_el0 124 b fiq_sp_el0 125end_vector_entry cortex_a76_fiq_sp_el0 126 127vector_entry cortex_a76_serror_sp_el0 128 b serror_sp_el0 129end_vector_entry cortex_a76_serror_sp_el0 130 131 /* --------------------------------------------------------------------- 132 * Current EL with SP_ELx: 0x200 - 0x400 133 * --------------------------------------------------------------------- 134 */ 135vector_entry cortex_a76_sync_exception_sp_elx 136 b sync_exception_sp_elx 137end_vector_entry cortex_a76_sync_exception_sp_elx 138 139vector_entry cortex_a76_irq_sp_elx 140 b irq_sp_elx 141end_vector_entry cortex_a76_irq_sp_elx 142 143vector_entry cortex_a76_fiq_sp_elx 144 b fiq_sp_elx 145end_vector_entry cortex_a76_fiq_sp_elx 146 147vector_entry cortex_a76_serror_sp_elx 148 b serror_sp_elx 149end_vector_entry cortex_a76_serror_sp_elx 150 151 /* --------------------------------------------------------------------- 152 * Lower EL using AArch64 : 0x400 - 0x600 153 * --------------------------------------------------------------------- 154 */ 155vector_entry cortex_a76_sync_exception_aarch64 156 apply_cve_2018_3639_wa _is_sync_exception=1 _esr_el3_val=ESR_EL3_A64_SMC0 157 b sync_exception_aarch64 158end_vector_entry cortex_a76_sync_exception_aarch64 159 160vector_entry cortex_a76_irq_aarch64 161 apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A64_SMC0 162 b irq_aarch64 163end_vector_entry cortex_a76_irq_aarch64 164 165vector_entry cortex_a76_fiq_aarch64 166 apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A64_SMC0 167 b fiq_aarch64 168end_vector_entry cortex_a76_fiq_aarch64 169 170vector_entry cortex_a76_serror_aarch64 171 apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A64_SMC0 172 b serror_aarch64 173end_vector_entry cortex_a76_serror_aarch64 174 175 /* --------------------------------------------------------------------- 176 * Lower EL using AArch32 : 0x600 - 0x800 177 * --------------------------------------------------------------------- 178 */ 179vector_entry cortex_a76_sync_exception_aarch32 180 apply_cve_2018_3639_wa _is_sync_exception=1 _esr_el3_val=ESR_EL3_A32_SMC0 181 b sync_exception_aarch32 182end_vector_entry cortex_a76_sync_exception_aarch32 183 184vector_entry cortex_a76_irq_aarch32 185 apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A32_SMC0 186 b irq_aarch32 187end_vector_entry cortex_a76_irq_aarch32 188 189vector_entry cortex_a76_fiq_aarch32 190 apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A32_SMC0 191 b fiq_aarch32 192end_vector_entry cortex_a76_fiq_aarch32 193 194vector_entry cortex_a76_serror_aarch32 195 apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A32_SMC0 196 b serror_aarch32 197end_vector_entry cortex_a76_serror_aarch32 198#endif /* DYNAMIC_WORKAROUND_CVE_2018_3639 */ 199 200 /* -------------------------------------------------- 201 * Errata Workaround for Cortex A76 Errata #1073348. 202 * This applies only to revision <= r1p0 of Cortex A76. 203 * Inputs: 204 * x0: variant[4:7] and revision[0:3] of current cpu. 205 * Shall clobber: x0-x17 206 * -------------------------------------------------- 207 */ 208func errata_a76_1073348_wa 209 /* 210 * Compare x0 against revision r1p0 211 */ 212 mov x17, x30 213 bl check_errata_1073348 214 cbz x0, 1f 215 mrs x1, CORTEX_A76_CPUACTLR_EL1 216 orr x1, x1 ,#CORTEX_A76_CPUACTLR_EL1_DISABLE_STATIC_PREDICTION 217 msr CORTEX_A76_CPUACTLR_EL1, x1 218 isb 2191: 220 ret x17 221endfunc errata_a76_1073348_wa 222 223func check_errata_1073348 224 mov x1, #0x10 225 b cpu_rev_var_ls 226endfunc check_errata_1073348 227 228 /* -------------------------------------------------- 229 * Errata Workaround for Cortex A76 Errata #1130799. 230 * This applies only to revision <= r2p0 of Cortex A76. 231 * Inputs: 232 * x0: variant[4:7] and revision[0:3] of current cpu. 233 * Shall clobber: x0-x17 234 * -------------------------------------------------- 235 */ 236func errata_a76_1130799_wa 237 /* 238 * Compare x0 against revision r2p0 239 */ 240 mov x17, x30 241 bl check_errata_1130799 242 cbz x0, 1f 243 mrs x1, CORTEX_A76_CPUACTLR2_EL1 244 orr x1, x1 ,#(1 << 59) 245 msr CORTEX_A76_CPUACTLR2_EL1, x1 246 isb 2471: 248 ret x17 249endfunc errata_a76_1130799_wa 250 251func check_errata_1130799 252 mov x1, #0x20 253 b cpu_rev_var_ls 254endfunc check_errata_1130799 255 256 /* -------------------------------------------------- 257 * Errata Workaround for Cortex A76 Errata #1220197. 258 * This applies only to revision <= r2p0 of Cortex A76. 259 * Inputs: 260 * x0: variant[4:7] and revision[0:3] of current cpu. 261 * Shall clobber: x0-x17 262 * -------------------------------------------------- 263 */ 264func errata_a76_1220197_wa 265/* 266 * Compare x0 against revision r2p0 267 */ 268 mov x17, x30 269 bl check_errata_1220197 270 cbz x0, 1f 271 mrs x1, CORTEX_A76_CPUECTLR_EL1 272 orr x1, x1, #CORTEX_A76_CPUECTLR_EL1_WS_THR_L2 273 msr CORTEX_A76_CPUECTLR_EL1, x1 274 isb 2751: 276 ret x17 277endfunc errata_a76_1220197_wa 278 279func check_errata_1220197 280 mov x1, #0x20 281 b cpu_rev_var_ls 282endfunc check_errata_1220197 283 284 /* -------------------------------------------------- 285 * Errata Workaround for Cortex A76 Errata #1257314. 286 * This applies only to revision <= r3p0 of Cortex A76. 287 * Inputs: 288 * x0: variant[4:7] and revision[0:3] of current cpu. 289 * Shall clobber: x0-x17 290 * -------------------------------------------------- 291 */ 292func errata_a76_1257314_wa 293 /* 294 * Compare x0 against revision r3p0 295 */ 296 mov x17, x30 297 bl check_errata_1257314 298 cbz x0, 1f 299 mrs x1, CORTEX_A76_CPUACTLR3_EL1 300 orr x1, x1, CORTEX_A76_CPUACTLR3_EL1_BIT_10 301 msr CORTEX_A76_CPUACTLR3_EL1, x1 302 isb 3031: 304 ret x17 305endfunc errata_a76_1257314_wa 306 307func check_errata_1257314 308 mov x1, #0x30 309 b cpu_rev_var_ls 310endfunc check_errata_1257314 311 312 /* -------------------------------------------------- 313 * Errata Workaround for Cortex A76 Errata #1262888. 314 * This applies only to revision <= r3p0 of Cortex A76. 315 * Inputs: 316 * x0: variant[4:7] and revision[0:3] of current cpu. 317 * Shall clobber: x0-x17 318 * -------------------------------------------------- 319 */ 320func errata_a76_1262888_wa 321 /* 322 * Compare x0 against revision r3p0 323 */ 324 mov x17, x30 325 bl check_errata_1262888 326 cbz x0, 1f 327 mrs x1, CORTEX_A76_CPUECTLR_EL1 328 orr x1, x1, CORTEX_A76_CPUECTLR_EL1_BIT_51 329 msr CORTEX_A76_CPUECTLR_EL1, x1 330 isb 3311: 332 ret x17 333endfunc errata_a76_1262888_wa 334 335func check_errata_1262888 336 mov x1, #0x30 337 b cpu_rev_var_ls 338endfunc check_errata_1262888 339 340 /* -------------------------------------------------- 341 * Errata Workaround for Cortex A76 Errata #1275112 342 * and Errata #1262606. 343 * This applies only to revision <= r3p0 of Cortex A76. 344 * Inputs: 345 * x0: variant[4:7] and revision[0:3] of current cpu. 346 * Shall clobber: x0-x17 347 * -------------------------------------------------- 348 */ 349func errata_a76_1275112_1262606_wa 350 /* 351 * Compare x0 against revision r3p0 352 */ 353 mov x17, x30 354 /* 355 * Since both errata #1275112 and #1262606 have the same check, we can 356 * invoke any one of them for the check here. 357 */ 358 bl check_errata_1275112 359 cbz x0, 1f 360 mrs x1, CORTEX_A76_CPUACTLR_EL1 361 orr x1, x1, CORTEX_A76_CPUACTLR_EL1_BIT_13 362 msr CORTEX_A76_CPUACTLR_EL1, x1 363 isb 3641: 365 ret x17 366endfunc errata_a76_1275112_1262606_wa 367 368func check_errata_1262606 369 mov x1, #0x30 370 b cpu_rev_var_ls 371endfunc check_errata_1262606 372 373func check_errata_1275112 374 mov x1, #0x30 375 b cpu_rev_var_ls 376endfunc check_errata_1275112 377 378 /* --------------------------------------------------- 379 * Errata Workaround for Cortex A76 Errata #1286807. 380 * This applies only to revision <= r3p0 of Cortex A76. 381 * Due to the nature of the errata it is applied unconditionally 382 * when built in, report it as applicable in this case 383 * --------------------------------------------------- 384 */ 385func check_errata_1286807 386#if ERRATA_A76_1286807 387 mov x0, #ERRATA_APPLIES 388 ret 389#else 390 mov x1, #0x30 391 b cpu_rev_var_ls 392#endif 393endfunc check_errata_1286807 394 395 /* -------------------------------------------------- 396 * Errata workaround for Cortex A76 Errata #1791580. 397 * This applies to revisions <= r4p0 of Cortex A76. 398 * Inputs: 399 * x0: variant[4:7] and revision[0:3] of current cpu. 400 * Shall clobber: x0-x17 401 * -------------------------------------------------- 402 */ 403func errata_a76_1791580_wa 404 /* Compare x0 against revision r4p0 */ 405 mov x17, x30 406 bl check_errata_1791580 407 cbz x0, 1f 408 mrs x1, CORTEX_A76_CPUACTLR2_EL1 409 orr x1, x1, CORTEX_A76_CPUACTLR2_EL1_BIT_2 410 msr CORTEX_A76_CPUACTLR2_EL1, x1 411 isb 4121: 413 ret x17 414endfunc errata_a76_1791580_wa 415 416func check_errata_1791580 417 /* Applies to everything <=r4p0. */ 418 mov x1, #0x40 419 b cpu_rev_var_ls 420endfunc check_errata_1791580 421 422 /* -------------------------------------------------- 423 * Errata Workaround for Cortex A76 Errata #1800710. 424 * This applies to revision <= r4p0 of Cortex A76. 425 * Inputs: 426 * x0: variant[4:7] and revision[0:3] of current cpu. 427 * Shall clobber: x0-x17 428 * -------------------------------------------------- 429 */ 430func errata_a76_1800710_wa 431 /* Compare x0 against revision <= r4p0 */ 432 mov x17, x30 433 bl check_errata_1800710 434 cbz x0, 1f 435 436 /* Disable allocation of splintered pages in the L2 TLB */ 437 mrs x1, CORTEX_A76_CPUECTLR_EL1 438 orr x1, x1, CORTEX_A76_CPUECTLR_EL1_BIT_53 439 msr CORTEX_A76_CPUECTLR_EL1, x1 440 isb 4411: 442 ret x17 443endfunc errata_a76_1800710_wa 444 445func check_errata_1800710 446 /* Applies to everything <= r4p0 */ 447 mov x1, #0x40 448 b cpu_rev_var_ls 449endfunc check_errata_1800710 450 451func check_errata_cve_2018_3639 452#if WORKAROUND_CVE_2018_3639 453 mov x0, #ERRATA_APPLIES 454#else 455 mov x0, #ERRATA_MISSING 456#endif 457 ret 458endfunc check_errata_cve_2018_3639 459 460func cortex_a76_disable_wa_cve_2018_3639 461 mrs x0, CORTEX_A76_CPUACTLR2_EL1 462 bic x0, x0, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE 463 msr CORTEX_A76_CPUACTLR2_EL1, x0 464 isb 465 ret 466endfunc cortex_a76_disable_wa_cve_2018_3639 467 468 /* ------------------------------------------------- 469 * The CPU Ops reset function for Cortex-A76. 470 * Shall clobber: x0-x19 471 * ------------------------------------------------- 472 */ 473func cortex_a76_reset_func 474 mov x19, x30 475 bl cpu_get_rev_var 476 mov x18, x0 477 478#if ERRATA_A76_1073348 479 mov x0, x18 480 bl errata_a76_1073348_wa 481#endif 482 483#if ERRATA_A76_1130799 484 mov x0, x18 485 bl errata_a76_1130799_wa 486#endif 487 488#if ERRATA_A76_1220197 489 mov x0, x18 490 bl errata_a76_1220197_wa 491#endif 492 493#if ERRATA_A76_1257314 494 mov x0, x18 495 bl errata_a76_1257314_wa 496#endif 497 498#if ERRATA_A76_1262606 || ERRATA_A76_1275112 499 mov x0, x18 500 bl errata_a76_1275112_1262606_wa 501#endif 502 503#if ERRATA_A76_1262888 504 mov x0, x18 505 bl errata_a76_1262888_wa 506#endif 507 508#if ERRATA_A76_1791580 509 mov x0, x18 510 bl errata_a76_1791580_wa 511#endif 512 513#if ERRATA_A76_1800710 514 mov x0, x18 515 bl errata_a76_1800710_wa 516#endif 517 518#if WORKAROUND_CVE_2018_3639 519 /* If the PE implements SSBS, we don't need the dynamic workaround */ 520 mrs x0, id_aa64pfr1_el1 521 lsr x0, x0, #ID_AA64PFR1_EL1_SSBS_SHIFT 522 and x0, x0, #ID_AA64PFR1_EL1_SSBS_MASK 523#if !DYNAMIC_WORKAROUND_CVE_2018_3639 && ENABLE_ASSERTIONS 524 cmp x0, 0 525 ASM_ASSERT(ne) 526#endif 527#if DYNAMIC_WORKAROUND_CVE_2018_3639 528 cbnz x0, 1f 529 mrs x0, CORTEX_A76_CPUACTLR2_EL1 530 orr x0, x0, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE 531 msr CORTEX_A76_CPUACTLR2_EL1, x0 532 isb 533 534#ifdef IMAGE_BL31 535 /* 536 * The Cortex-A76 generic vectors are overwritten to use the vectors 537 * defined above. This is required in order to apply mitigation 538 * against CVE-2018-3639 on exception entry from lower ELs. 539 */ 540 adr x0, cortex_a76_wa_cve_2018_3639_a76_vbar 541 msr vbar_el3, x0 542 isb 543#endif /* IMAGE_BL31 */ 544 5451: 546#endif /* DYNAMIC_WORKAROUND_CVE_2018_3639 */ 547#endif /* WORKAROUND_CVE_2018_3639 */ 548 549#if ERRATA_DSU_798953 550 bl errata_dsu_798953_wa 551#endif 552 553#if ERRATA_DSU_936184 554 bl errata_dsu_936184_wa 555#endif 556 557 ret x19 558endfunc cortex_a76_reset_func 559 560 /* --------------------------------------------- 561 * HW will do the cache maintenance while powering down 562 * --------------------------------------------- 563 */ 564func cortex_a76_core_pwr_dwn 565 /* --------------------------------------------- 566 * Enable CPU power down bit in power control register 567 * --------------------------------------------- 568 */ 569 mrs x0, CORTEX_A76_CPUPWRCTLR_EL1 570 orr x0, x0, #CORTEX_A76_CORE_PWRDN_EN_MASK 571 msr CORTEX_A76_CPUPWRCTLR_EL1, x0 572 isb 573 ret 574endfunc cortex_a76_core_pwr_dwn 575 576#if REPORT_ERRATA 577/* 578 * Errata printing function for Cortex A76. Must follow AAPCS. 579 */ 580func cortex_a76_errata_report 581 stp x8, x30, [sp, #-16]! 582 583 bl cpu_get_rev_var 584 mov x8, x0 585 586 /* 587 * Report all errata. The revision-variant information is passed to 588 * checking functions of each errata. 589 */ 590 report_errata ERRATA_A76_1073348, cortex_a76, 1073348 591 report_errata ERRATA_A76_1130799, cortex_a76, 1130799 592 report_errata ERRATA_A76_1220197, cortex_a76, 1220197 593 report_errata ERRATA_A76_1257314, cortex_a76, 1257314 594 report_errata ERRATA_A76_1262606, cortex_a76, 1262606 595 report_errata ERRATA_A76_1262888, cortex_a76, 1262888 596 report_errata ERRATA_A76_1275112, cortex_a76, 1275112 597 report_errata ERRATA_A76_1286807, cortex_a76, 1286807 598 report_errata ERRATA_A76_1791580, cortex_a76, 1791580 599 report_errata ERRATA_A76_1800710, cortex_a76, 1800710 600 report_errata WORKAROUND_CVE_2018_3639, cortex_a76, cve_2018_3639 601 report_errata ERRATA_DSU_798953, cortex_a76, dsu_798953 602 report_errata ERRATA_DSU_936184, cortex_a76, dsu_936184 603 604 ldp x8, x30, [sp], #16 605 ret 606endfunc cortex_a76_errata_report 607#endif 608 609 /* --------------------------------------------- 610 * This function provides cortex_a76 specific 611 * register information for crash reporting. 612 * It needs to return with x6 pointing to 613 * a list of register names in ascii and 614 * x8 - x15 having values of registers to be 615 * reported. 616 * --------------------------------------------- 617 */ 618.section .rodata.cortex_a76_regs, "aS" 619cortex_a76_regs: /* The ascii list of register names to be reported */ 620 .asciz "cpuectlr_el1", "" 621 622func cortex_a76_cpu_reg_dump 623 adr x6, cortex_a76_regs 624 mrs x8, CORTEX_A76_CPUECTLR_EL1 625 ret 626endfunc cortex_a76_cpu_reg_dump 627 628declare_cpu_ops_wa cortex_a76, CORTEX_A76_MIDR, \ 629 cortex_a76_reset_func, \ 630 CPU_NO_EXTRA1_FUNC, \ 631 cortex_a76_disable_wa_cve_2018_3639, \ 632 cortex_a76_core_pwr_dwn 633