andrius
/
arm-trusted-firmware
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
arm-trusted-firmware/lib/cpus/aarch64/cortex_a76.S

689 lines
18 KiB
ArmAsm
Raw Normal View History

Add support for Cortex-Ares and Cortex-A76 CPUs Both Cortex-Ares and Cortex-A76 CPUs use the ARM DynamIQ Shared Unit (DSU). The power-down and power-up sequences are therefore mostly managed in hardware, and required software operations are simple. Change-Id: I3a9447b5bdbdbc5ed845b20f6564d086516fa161 Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
2017-08-03 16:04:46 +01:00
/*
Prevent speculative execution past ERET Even though ERET always causes a jump to another address, aarch64 CPUs speculatively execute following instructions as if the ERET instruction was not a jump instruction. The speculative execution does not cross privilege-levels (to the jump target as one would expect), but it continues on the kernel privilege level as if the ERET instruction did not change the control flow - thus execution anything that is accidentally linked after the ERET instruction. Later, the results of this speculative execution are always architecturally discarded, however they can leak data using microarchitectural side channels. This speculative execution is very reliable (seems to be unconditional) and it manages to complete even relatively performance-heavy operations (e.g. multiple dependent fetches from uncached memory). This was fixed in Linux, FreeBSD, OpenBSD and Optee OS: https://github.com/torvalds/linux/commit/679db70801da9fda91d26caf13bf5b5ccc74e8e8 https://github.com/freebsd/freebsd/commit/29fb48ace4186a41c409fde52bcf4216e9e50b61 https://github.com/openbsd/src/commit/3a08873ece1cb28ace89fd65e8f3c1375cc98de2 https://github.com/OP-TEE/optee_os/commit/abfd092aa19f9c0251e3d5551e2d68a9ebcfec8a It is demonstrated in a SafeSide example: https://github.com/google/safeside/blob/master/demos/eret_hvc_smc_wrapper.cc https://github.com/google/safeside/blob/master/kernel_modules/kmod_eret_hvc_smc/eret_hvc_smc_module.c Signed-off-by: Anthony Steinhauser <asteinhauser@google.com> Change-Id: Iead39b0b9fb4b8d8b5609daaa8be81497ba63a0f
2020-01-07 23:44:06 +00:00
* Copyright (c) 2017-2020, ARM Limited and Contributors. All rights reserved.
Add support for Cortex-Ares and Cortex-A76 CPUs Both Cortex-Ares and Cortex-A76 CPUs use the ARM DynamIQ Shared Unit (DSU). The power-down and power-up sequences are therefore mostly managed in hardware, and required software operations are simple. Change-Id: I3a9447b5bdbdbc5ed845b20f6564d086516fa161 Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
2017-08-03 16:04:46 +01:00
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#include <arch.h>
#include <asm_macros.S>
Sanitise includes across codebase Enforce full include path for includes. Deprecate old paths. The following folders inside include/lib have been left unchanged: - include/lib/cpus/${ARCH} - include/lib/el3_runtime/${ARCH} The reason for this change is that having a global namespace for includes isn't a good idea. It defeats one of the advantages of having folders and it introduces problems that are sometimes subtle (because you may not know the header you are actually including if there are two of them). For example, this patch had to be created because two headers were called the same way: e0ea0928d5b7 ("Fix gpio includes of mt8173 platform to avoid collision."). More recently, this patch has had similar problems: 46f9b2c3a282 ("drivers: add tzc380 support"). This problem was introduced in commit 4ecca33988b9 ("Move include and source files to logical locations"). At that time, there weren't too many headers so it wasn't a real issue. However, time has shown that this creates problems. Platforms that want to preserve the way they include headers may add the removed paths to PLAT_INCLUDES, but this is discouraged. Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8f Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-14 00:18:21 +00:00
#include <common/bl_common.h>
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
#include <context.h>
Add support for Cortex-Ares and Cortex-A76 CPUs Both Cortex-Ares and Cortex-A76 CPUs use the ARM DynamIQ Shared Unit (DSU). The power-down and power-up sequences are therefore mostly managed in hardware, and required software operations are simple. Change-Id: I3a9447b5bdbdbc5ed845b20f6564d086516fa161 Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
2017-08-03 16:04:46 +01:00
#include <cortex_a76.h>
#include <cpu_macros.S>
#include <plat_macros.S>
Sanitise includes across codebase Enforce full include path for includes. Deprecate old paths. The following folders inside include/lib have been left unchanged: - include/lib/cpus/${ARCH} - include/lib/el3_runtime/${ARCH} The reason for this change is that having a global namespace for includes isn't a good idea. It defeats one of the advantages of having folders and it introduces problems that are sometimes subtle (because you may not know the header you are actually including if there are two of them). For example, this patch had to be created because two headers were called the same way: e0ea0928d5b7 ("Fix gpio includes of mt8173 platform to avoid collision."). More recently, this patch has had similar problems: 46f9b2c3a282 ("drivers: add tzc380 support"). This problem was introduced in commit 4ecca33988b9 ("Move include and source files to logical locations"). At that time, there weren't too many headers so it wasn't a real issue. However, time has shown that this creates problems. Platforms that want to preserve the way they include headers may add the removed paths to PLAT_INCLUDES, but this is discouraged. Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8f Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
2018-12-14 00:18:21 +00:00
#include <services/arm_arch_svc.h>
Add support for Cortex-Ares and Cortex-A76 CPUs Both Cortex-Ares and Cortex-A76 CPUs use the ARM DynamIQ Shared Unit (DSU). The power-down and power-up sequences are therefore mostly managed in hardware, and required software operations are simple. Change-Id: I3a9447b5bdbdbc5ed845b20f6564d086516fa161 Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
2017-08-03 16:04:46 +01:00
Add compile-time errors for HW_ASSISTED_COHERENCY flag This patch fixes this issue: https://github.com/ARM-software/tf-issues/issues/660 The introduced changes are the following: 1) Some cores implement cache coherency maintenance operation on the hardware level. For those cores, such as - but not only - the DynamIQ cores, it is mandatory that TF-A is compiled with the HW_ASSISTED_COHERENCY flag. If not, the core behaviour at runtime is unpredictable. To prevent this, compile time checks have been added and compilation errors are generated, if needed. 2) To enable this change for FVP, a logical separation has been done for the core libraries. A system cannot contain cores of both groups, i.e. cores that manage coherency on hardware and cores that don't do it. As such, depending on the HW_ASSISTED_COHERENCY flag, FVP includes the libraries only of the relevant cores. 3) The neoverse_e1.S file has been added to the FVP sources. Change-Id: I787d15819b2add4ec0d238249e04bf0497dc12f3 Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
2019-03-19 17:20:52 +00:00
/* Hardware handled coherency */
#if HW_ASSISTED_COHERENCY == 0
#error "Cortex-A76 must be compiled with HW_ASSISTED_COHERENCY enabled"
#endif
Apply compile-time check for AArch64-only cores Some cores support only AArch64 mode. In those cores, only a limited subset of the AArch32 system registers are implemented. Hence, if TF-A is supposed to run on AArch64-only cores, it must be compiled with CTX_INCLUDE_AARCH32_REGS=0. Currently, the default settings for compiling TF-A are with the AArch32 system registers included. So, if we compile TF-A the default way and attempt to run it on an AArch64-only core, we only get a runtime panic. Now a compile-time check has been added to ensure that this flag has the appropriate value when AArch64-only cores are included in the build. Change-Id: I298ec550037fafc9347baafb056926d149197d4c Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
2019-06-03 13:54:30 +01:00
/* 64-bit only core */
#if CTX_INCLUDE_AARCH32_REGS == 1
#error "Cortex-A76 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0"
#endif
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
#define ESR_EL3_A64_SMC0 0x5e000000
#define ESR_EL3_A32_SMC0 0x4e000000
Cortex-A76: Optimize CVE_2018_3639 workaround Switched from a static check to a runtime assert to make sure a workaround is implemented for CVE_2018_3639. This allows platforms that know they have the SSBS hardware workaround in the CPU to compile out code under DYNAMIC_WORKAROUND_CVE_2018_3639. The gain in memory size without the dynamic workaround is 4KB in bl31. Change-Id: I61bb7d87c59964b0c7faac5d6bc7fc5c4651cbf3 Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:33:02 +00:00
#if DYNAMIC_WORKAROUND_CVE_2018_3639
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
/*
* This macro applies the mitigation for CVE-2018-3639.
Cortex-A76: fix spelling Change-Id: I6adf7c14e8a974a7d40d51615b5e69eab1a7436f Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:31:33 +00:00
* It implements a fast path where `SMCCC_ARCH_WORKAROUND_2`
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
* SMC calls from a lower EL running in AArch32 or AArch64
* will go through the fast and return early.
*
Cortex-A76: fix spelling Change-Id: I6adf7c14e8a974a7d40d51615b5e69eab1a7436f Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:31:33 +00:00
* The macro saves x2-x3 to the context. In the fast path
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
* x0-x3 registers do not need to be restored as the calling
* context will have saved them.
*/
.macro apply_cve_2018_3639_wa _is_sync_exception _esr_el3_val
stp x2, x3, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X2]
.if \_is_sync_exception
/*
* Ensure SMC is coming from A64/A32 state on #0
* with W0 = SMCCC_ARCH_WORKAROUND_2
*
* This sequence evaluates as:
* (W0==SMCCC_ARCH_WORKAROUND_2) ? (ESR_EL3==SMC#0) : (NE)
* allowing use of a single branch operation
*/
orr w2, wzr, #SMCCC_ARCH_WORKAROUND_2
cmp x0, x2
mrs x3, esr_el3
mov_imm w2, \_esr_el3_val
ccmp w2, w3, #0, eq
/*
* Static predictor will predict a fall-through, optimizing
* the `SMCCC_ARCH_WORKAROUND_2` fast path.
*/
bne 1f
/*
* The sequence below implements the `SMCCC_ARCH_WORKAROUND_2`
* fast path.
*/
cmp x1, xzr /* enable/disable check */
/*
* When the calling context wants mitigation disabled,
* we program the mitigation disable function in the
* CPU context, which gets invoked on subsequent exits from
Cortex-A76: fix spelling Change-Id: I6adf7c14e8a974a7d40d51615b5e69eab1a7436f Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:31:33 +00:00
* EL3 via the `el3_exit` function. Otherwise NULL is
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
* programmed in the CPU context, which results in caller's
* inheriting the EL3 mitigation state (enabled) on subsequent
* `el3_exit`.
*/
mov x0, xzr
adr x1, cortex_a76_disable_wa_cve_2018_3639
csel x1, x1, x0, eq
str x1, [sp, #CTX_CVE_2018_3639_OFFSET + CTX_CVE_2018_3639_DISABLE]
mrs x2, CORTEX_A76_CPUACTLR2_EL1
orr x1, x2, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE
bic x3, x2, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE
csel x3, x3, x1, eq
msr CORTEX_A76_CPUACTLR2_EL1, x3
Prevent speculative execution past ERET Even though ERET always causes a jump to another address, aarch64 CPUs speculatively execute following instructions as if the ERET instruction was not a jump instruction. The speculative execution does not cross privilege-levels (to the jump target as one would expect), but it continues on the kernel privilege level as if the ERET instruction did not change the control flow - thus execution anything that is accidentally linked after the ERET instruction. Later, the results of this speculative execution are always architecturally discarded, however they can leak data using microarchitectural side channels. This speculative execution is very reliable (seems to be unconditional) and it manages to complete even relatively performance-heavy operations (e.g. multiple dependent fetches from uncached memory). This was fixed in Linux, FreeBSD, OpenBSD and Optee OS: https://github.com/torvalds/linux/commit/679db70801da9fda91d26caf13bf5b5ccc74e8e8 https://github.com/freebsd/freebsd/commit/29fb48ace4186a41c409fde52bcf4216e9e50b61 https://github.com/openbsd/src/commit/3a08873ece1cb28ace89fd65e8f3c1375cc98de2 https://github.com/OP-TEE/optee_os/commit/abfd092aa19f9c0251e3d5551e2d68a9ebcfec8a It is demonstrated in a SafeSide example: https://github.com/google/safeside/blob/master/demos/eret_hvc_smc_wrapper.cc https://github.com/google/safeside/blob/master/kernel_modules/kmod_eret_hvc_smc/eret_hvc_smc_module.c Signed-off-by: Anthony Steinhauser <asteinhauser@google.com> Change-Id: Iead39b0b9fb4b8d8b5609daaa8be81497ba63a0f
2020-01-07 23:44:06 +00:00
exception_return /* exception_return contains ISB */
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
.endif
1:
/*
Cortex-A76: fix spelling Change-Id: I6adf7c14e8a974a7d40d51615b5e69eab1a7436f Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:31:33 +00:00
* Always enable v4 mitigation during EL3 execution. This is not
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
* required for the fast path above because it does not perform any
* memory loads.
*/
mrs x2, CORTEX_A76_CPUACTLR2_EL1
orr x2, x2, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE
msr CORTEX_A76_CPUACTLR2_EL1, x2
isb
/*
* The caller may have passed arguments to EL3 via x2-x3.
* Restore these registers from the context before jumping to the
* main runtime vector table entry.
*/
ldp x2, x3, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X2]
.endm
vector_base cortex_a76_wa_cve_2018_3639_a76_vbar
/* ---------------------------------------------------------------------
* Current EL with SP_EL0 : 0x0 - 0x200
* ---------------------------------------------------------------------
*/
vector_entry cortex_a76_sync_exception_sp_el0
b sync_exception_sp_el0
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_sync_exception_sp_el0
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_irq_sp_el0
b irq_sp_el0
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_irq_sp_el0
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_fiq_sp_el0
b fiq_sp_el0
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_fiq_sp_el0
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_serror_sp_el0
b serror_sp_el0
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_serror_sp_el0
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
/* ---------------------------------------------------------------------
* Current EL with SP_ELx: 0x200 - 0x400
* ---------------------------------------------------------------------
*/
vector_entry cortex_a76_sync_exception_sp_elx
b sync_exception_sp_elx
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_sync_exception_sp_elx
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_irq_sp_elx
b irq_sp_elx
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_irq_sp_elx
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_fiq_sp_elx
b fiq_sp_elx
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_fiq_sp_elx
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_serror_sp_elx
b serror_sp_elx
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_serror_sp_elx
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
/* ---------------------------------------------------------------------
* Lower EL using AArch64 : 0x400 - 0x600
* ---------------------------------------------------------------------
*/
vector_entry cortex_a76_sync_exception_aarch64
apply_cve_2018_3639_wa _is_sync_exception=1 _esr_el3_val=ESR_EL3_A64_SMC0
b sync_exception_aarch64
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_sync_exception_aarch64
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_irq_aarch64
apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A64_SMC0
b irq_aarch64
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_irq_aarch64
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_fiq_aarch64
apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A64_SMC0
b fiq_aarch64
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_fiq_aarch64
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_serror_aarch64
apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A64_SMC0
b serror_aarch64
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_serror_aarch64
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
/* ---------------------------------------------------------------------
* Lower EL using AArch32 : 0x600 - 0x800
* ---------------------------------------------------------------------
*/
vector_entry cortex_a76_sync_exception_aarch32
apply_cve_2018_3639_wa _is_sync_exception=1 _esr_el3_val=ESR_EL3_A32_SMC0
b sync_exception_aarch32
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_sync_exception_aarch32
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_irq_aarch32
apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A32_SMC0
b irq_aarch32
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_irq_aarch32
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_fiq_aarch32
apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A32_SMC0
b fiq_aarch32
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_fiq_aarch32
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
vector_entry cortex_a76_serror_aarch32
apply_cve_2018_3639_wa _is_sync_exception=0 _esr_el3_val=ESR_EL3_A32_SMC0
b serror_aarch32
Add end_vector_entry assembler macro Check_vector_size checks if the size of the vector fits in the size reserved for it. This check creates problems in the Clang assembler. A new macro, end_vector_entry, is added and check_vector_size is deprecated. This new macro fills the current exception vector until the next exception vector. If the size of the current vector is bigger than 32 instructions then it gives an error. Change-Id: Ie8545cf1003a1e31656a1018dd6b4c28a4eaf671 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
2018-04-17 11:31:43 +01:00
end_vector_entry cortex_a76_serror_aarch32
Cortex-A76: Optimize CVE_2018_3639 workaround Switched from a static check to a runtime assert to make sure a workaround is implemented for CVE_2018_3639. This allows platforms that know they have the SSBS hardware workaround in the CPU to compile out code under DYNAMIC_WORKAROUND_CVE_2018_3639. The gain in memory size without the dynamic workaround is 4KB in bl31. Change-Id: I61bb7d87c59964b0c7faac5d6bc7fc5c4651cbf3 Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:33:02 +00:00
#endif /* DYNAMIC_WORKAROUND_CVE_2018_3639 */
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
Add workaround for errata 1073348 for Cortex-A76 Concurrent instruction TLB miss and mispredicted return instruction might fetch wrong instruction stream. Set bit 6 of CPUACTLR_EL1 to prevent this. Change-Id: I2da4f30cd2df3f5e885dd3c4825c557492d1ac58 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 15:17:44 +00:00
/* --------------------------------------------------
* Errata Workaround for Cortex A76 Errata #1073348.
* This applies only to revision <= r1p0 of Cortex A76.
* Inputs:
* x0: variant[4:7] and revision[0:3] of current cpu.
* Shall clobber: x0-x17
* --------------------------------------------------
*/
func errata_a76_1073348_wa
/*
* Compare x0 against revision r1p0
*/
mov x17, x30
bl check_errata_1073348
cbz x0, 1f
mrs x1, CORTEX_A76_CPUACTLR_EL1
orr x1, x1 ,#CORTEX_A76_CPUACTLR_EL1_DISABLE_STATIC_PREDICTION
msr CORTEX_A76_CPUACTLR_EL1, x1
isb
1:
ret x17
Cortex-A76: workarounds for errata 1257314, 1262606, 1262888, 1275112 The workarounds for errata 1257314, 1262606, 1262888 and 1275112 are added to the Cortex-A76 cpu specific file. The workarounds are disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I70474927374cb67725f829d159ddde9ac4edc343 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-01 09:43:18 +01:00
endfunc errata_a76_1073348_wa
Add workaround for errata 1073348 for Cortex-A76 Concurrent instruction TLB miss and mispredicted return instruction might fetch wrong instruction stream. Set bit 6 of CPUACTLR_EL1 to prevent this. Change-Id: I2da4f30cd2df3f5e885dd3c4825c557492d1ac58 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 15:17:44 +00:00
func check_errata_1073348
mov x1, #0x10
b cpu_rev_var_ls
endfunc check_errata_1073348
Add workaround for errata 1130799 for Cortex-A76 TLBI VAAE1 or TLBI VAALE1 targeting a page within hardware page aggregated address translation data in the L2 TLB might cause corruption of address translation data. Set bit 59 of CPUACTLR2_EL1 to prevent this. Change-Id: I59f3edea54e87d264e0794f5ca2a8c68a636e586 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-21 17:35:07 +00:00
/* --------------------------------------------------
* Errata Workaround for Cortex A76 Errata #1130799.
* This applies only to revision <= r2p0 of Cortex A76.
* Inputs:
* x0: variant[4:7] and revision[0:3] of current cpu.
* Shall clobber: x0-x17
* --------------------------------------------------
*/
func errata_a76_1130799_wa
/*
* Compare x0 against revision r2p0
*/
mov x17, x30
bl check_errata_1130799
cbz x0, 1f
mrs x1, CORTEX_A76_CPUACTLR2_EL1
orr x1, x1 ,#(1 << 59)
msr CORTEX_A76_CPUACTLR2_EL1, x1
isb
1:
ret x17
endfunc errata_a76_1130799_wa
func check_errata_1130799
mov x1, #0x20
b cpu_rev_var_ls
endfunc check_errata_1130799
Add workaround for errata 1220197 for Cortex-A76 Streaming store under specific conditions might cause deadlock or data corruption. Set bit 25:24 of CPUECTLR_EL1, which disables write streaming to the L2 to prevent this. Change-Id: Ib5cabb997b35ada78b27e75787afd610ea606dcf Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 11:37:38 +00:00
/* --------------------------------------------------
* Errata Workaround for Cortex A76 Errata #1220197.
* This applies only to revision <= r2p0 of Cortex A76.
* Inputs:
* x0: variant[4:7] and revision[0:3] of current cpu.
* Shall clobber: x0-x17
* --------------------------------------------------
*/
func errata_a76_1220197_wa
/*
* Compare x0 against revision r2p0
*/
mov x17, x30
bl check_errata_1220197
cbz x0, 1f
mrs x1, CORTEX_A76_CPUECTLR_EL1
orr x1, x1, #CORTEX_A76_CPUECTLR_EL1_WS_THR_L2
msr CORTEX_A76_CPUECTLR_EL1, x1
isb
1:
ret x17
endfunc errata_a76_1220197_wa
func check_errata_1220197
mov x1, #0x20
b cpu_rev_var_ls
endfunc check_errata_1220197
Cortex-A76: workarounds for errata 1257314, 1262606, 1262888, 1275112 The workarounds for errata 1257314, 1262606, 1262888 and 1275112 are added to the Cortex-A76 cpu specific file. The workarounds are disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I70474927374cb67725f829d159ddde9ac4edc343 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-01 09:43:18 +01:00
/* --------------------------------------------------
* Errata Workaround for Cortex A76 Errata #1257314.
* This applies only to revision <= r3p0 of Cortex A76.
* Inputs:
* x0: variant[4:7] and revision[0:3] of current cpu.
* Shall clobber: x0-x17
* --------------------------------------------------
*/
func errata_a76_1257314_wa
/*
* Compare x0 against revision r3p0
*/
mov x17, x30
bl check_errata_1257314
cbz x0, 1f
mrs x1, CORTEX_A76_CPUACTLR3_EL1
orr x1, x1, CORTEX_A76_CPUACTLR3_EL1_BIT_10
msr CORTEX_A76_CPUACTLR3_EL1, x1
isb
1:
ret x17
endfunc errata_a76_1257314_wa
func check_errata_1257314
mov x1, #0x30
b cpu_rev_var_ls
endfunc check_errata_1257314
/* --------------------------------------------------
* Errata Workaround for Cortex A76 Errata #1262888.
* This applies only to revision <= r3p0 of Cortex A76.
* Inputs:
* x0: variant[4:7] and revision[0:3] of current cpu.
* Shall clobber: x0-x17
* --------------------------------------------------
*/
func errata_a76_1262888_wa
/*
* Compare x0 against revision r3p0
*/
mov x17, x30
bl check_errata_1262888
cbz x0, 1f
mrs x1, CORTEX_A76_CPUECTLR_EL1
orr x1, x1, CORTEX_A76_CPUECTLR_EL1_BIT_51
msr CORTEX_A76_CPUECTLR_EL1, x1
isb
1:
ret x17
endfunc errata_a76_1262888_wa
func check_errata_1262888
mov x1, #0x30
b cpu_rev_var_ls
endfunc check_errata_1262888
Workaround for cortex-A76 errata 1286807 The workaround for Cortex-A76 errata #1286807 is implemented in this patch. Change-Id: I6c15af962ac99ce223e009f6d299cefb41043bed Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-03 13:17:56 +01:00
/* ---------------------------------------------------
* Errata Workaround for Cortex A76 Errata #1286807.
* This applies only to revision <= r3p0 of Cortex A76.
* Due to the nature of the errata it is applied unconditionally
* when built in, report it as applicable in this case
* ---------------------------------------------------
*/
func check_errata_1286807
#if ERRATA_A76_1286807
mov x0, #ERRATA_APPLIES
ret
#else
mov x1, #0x30
b cpu_rev_var_ls
#endif
endfunc check_errata_1286807
Cortex-A76: workarounds for errata 1257314, 1262606, 1262888, 1275112 The workarounds for errata 1257314, 1262606, 1262888 and 1275112 are added to the Cortex-A76 cpu specific file. The workarounds are disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I70474927374cb67725f829d159ddde9ac4edc343 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-01 09:43:18 +01:00
Workaround for Cortex A76 erratum 1791580 Cortex A76 erratum 1791580 is a Cat B erratum present in earlier revisions of the Cortex A76. The workaround is to set a bit in the implementation defined CPUACTLR2 register, which forces atomic store operations to write-back memory to be performed in the L1 data cache. This errata is explained in this SDEN: https://static.docs.arm.com/sden885749/g/Arm_Cortex_A76_MP052_Software_Developer_Errata_Notice_v20.pdf Signed-off-by: John Powell <john.powell@arm.com> Change-Id: Iefd58159b3f2e2286138993317b98e57dc361925
2020-05-29 20:17:38 +01:00
/* --------------------------------------------------
* Errata workaround for Cortex A76 Errata #1791580.
* This applies to revisions <= r4p0 of Cortex A76.
* Inputs:
* x0: variant[4:7] and revision[0:3] of current cpu.
* Shall clobber: x0-x17
* --------------------------------------------------
*/
func errata_a76_1791580_wa
/* Compare x0 against revision r4p0 */
mov x17, x30
bl check_errata_1791580
cbz x0, 1f
mrs x1, CORTEX_A76_CPUACTLR2_EL1
orr x1, x1, CORTEX_A76_CPUACTLR2_EL1_BIT_2
msr CORTEX_A76_CPUACTLR2_EL1, x1
isb
1:
ret x17
endfunc errata_a76_1791580_wa
func check_errata_1791580
/* Applies to everything <=r4p0. */
mov x1, #0x40
b cpu_rev_var_ls
endfunc check_errata_1791580
Workaround for Cortex A76 erratum 1868343 Cortex A76 erratum 1868343 is a Cat B erratum, present in older revisions of the Cortex A76 processor core. The workaround is to set a bit in the CPUACTLR_EL1 system register, which delays instruction fetch after branch misprediction. This workaround will have a small impact on performance. This workaround is the same as workarounds for errata 1262606 and 1275112, so all 3 have been combined into one function call. SDEN can be found here: https://documentation-service.arm.com/static/5f2bed6d60a93e65927bc8e7 Signed-off-by: John Powell <john.powell@arm.com> Change-Id: I7f2f9965f495540a1f84bb7dcc28aff45d6cee5d
2020-09-29 23:19:09 +01:00
/* --------------------------------------------------
* Errata Workaround for Cortex A76 Errata #1262606,
* #1275112, and #1868343. #1262606 and #1275112
* apply to revisions <= r3p0 and #1868343 applies to
* revisions <= r4p0.
* Inputs:
* x0: variant[4:7] and revision[0:3] of current cpu.
* Shall clobber: x0-x17
* --------------------------------------------------
*/
func errata_a76_1262606_1275112_1868343_wa
mov x17, x30
/* Check for <= r3p0 cases and branch if check passes. */
#if ERRATA_A76_1262606 || ERRATA_A76_1275112
bl check_errata_1262606
cbnz x0, 1f
#endif
/* Check for <= r4p0 cases and branch if check fails. */
#if ERRATA_A76_1868343
bl check_errata_1868343
cbz x0, 2f
#endif
1:
mrs x1, CORTEX_A76_CPUACTLR_EL1
orr x1, x1, #CORTEX_A76_CPUACTLR_EL1_BIT_13
msr CORTEX_A76_CPUACTLR_EL1, x1
isb
2:
ret x17
endfunc errata_a76_1262606_1275112_1868343_wa
func check_errata_1262606
mov x1, #0x30
b cpu_rev_var_ls
endfunc check_errata_1262606
func check_errata_1275112
mov x1, #0x30
b cpu_rev_var_ls
endfunc check_errata_1275112
func check_errata_1868343
mov x1, #0x40
b cpu_rev_var_ls
endfunc check_errata_1868343
Workaround for Cortex A76 erratum 1946160 Cortex A76 erratum 1946160 is a Cat B erratum, present in some revisions of the A76 processor core. The workaround is to insert a DMB ST before acquire atomic instructions without release semantics. This issue is present in revisions r0p0 - r4p1 but this workaround only applies to revisions r3p0 - r4p1, there is no workaround for older versions. SDEN can be found here: https://documentation-service.arm.com/static/5fbb77d7d77dd807b9a80cc1 Signed-off-by: John Powell <john.powell@arm.com> Change-Id: Ief33779ee76a89ce2649812ae5214b86a139e327
2020-12-16 01:02:18 +00:00
/* --------------------------------------------------
* Errata Workaround for A76 Erratum 1946160.
* This applies to revisions r3p0 - r4p1 of A76.
* It also exists in r0p0 - r2p0 but there is no fix
* in those revisions.
* Inputs:
* x0: variant[4:7] and revision[0:3] of current cpu.
* Shall clobber: x0-x17
* --------------------------------------------------
*/
func errata_a76_1946160_wa
/* Compare x0 against revisions r3p0 - r4p1 */
mov x17, x30
bl check_errata_1946160
cbz x0, 1f
mov x0, #3
msr S3_6_C15_C8_0, x0
ldr x0, =0x10E3900002
msr S3_6_C15_C8_2, x0
ldr x0, =0x10FFF00083
msr S3_6_C15_C8_3, x0
ldr x0, =0x2001003FF
msr S3_6_C15_C8_1, x0
mov x0, #4
msr S3_6_C15_C8_0, x0
ldr x0, =0x10E3800082
msr S3_6_C15_C8_2, x0
ldr x0, =0x10FFF00083
msr S3_6_C15_C8_3, x0
ldr x0, =0x2001003FF
msr S3_6_C15_C8_1, x0
mov x0, #5
msr S3_6_C15_C8_0, x0
ldr x0, =0x10E3800200
msr S3_6_C15_C8_2, x0
ldr x0, =0x10FFF003E0
msr S3_6_C15_C8_3, x0
ldr x0, =0x2001003FF
msr S3_6_C15_C8_1, x0
isb
1:
ret x17
endfunc errata_a76_1946160_wa
func check_errata_1946160
/* Applies to revisions r3p0 - r4p1. */
mov x1, #0x30
mov x2, #0x41
b cpu_rev_var_range
endfunc check_errata_1946160
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
func check_errata_cve_2018_3639
#if WORKAROUND_CVE_2018_3639
mov x0, #ERRATA_APPLIES
#else
mov x0, #ERRATA_MISSING
#endif
ret
endfunc check_errata_cve_2018_3639
func cortex_a76_disable_wa_cve_2018_3639
mrs x0, CORTEX_A76_CPUACTLR2_EL1
bic x0, x0, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE
msr CORTEX_A76_CPUACTLR2_EL1, x0
isb
ret
endfunc cortex_a76_disable_wa_cve_2018_3639
lib/cpus: Report AT speculative erratum workaround Reported the status (applies, missing) of AT speculative workaround which is applicable for below CPUs. +---------+--------------+ | Errata | CPU | +=========+==============+ | 1165522 | Cortex-A76 | +---------+--------------+ | 1319367 | Cortex-A72 | +---------+--------------+ | 1319537 | Cortex-A57 | +---------+--------------+ | 1530923 | Cortex-A55 | +---------+--------------+ | 1530924 | Cortex-A53 | +---------+--------------+ Also, changes are done to enable common macro 'ERRATA_SPECULATIVE_AT' if AT speculative errata workaround is enabled for any of the above CPUs using 'ERRATA_*' CPU specific build macro. Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com> Change-Id: I3e6a5316a2564071f3920c3ce9ae9a29adbe435b
2020-08-03 18:43:14 +01:00
/* --------------------------------------------------------------
* Errata Workaround for Cortex A76 Errata #1165522.
* This applies only to revisions <= r3p0 of Cortex A76.
* Due to the nature of the errata it is applied unconditionally
* when built in, report it as applicable in this case
* --------------------------------------------------------------
*/
func check_errata_1165522
#if ERRATA_A76_1165522
mov x0, #ERRATA_APPLIES
ret
#else
mov x1, #0x30
b cpu_rev_var_ls
#endif
endfunc check_errata_1165522
Add workaround for errata 1130799 for Cortex-A76 TLBI VAAE1 or TLBI VAALE1 targeting a page within hardware page aggregated address translation data in the L2 TLB might cause corruption of address translation data. Set bit 59 of CPUACTLR2_EL1 to prevent this. Change-Id: I59f3edea54e87d264e0794f5ca2a8c68a636e586 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-21 17:35:07 +00:00
/* -------------------------------------------------
* The CPU Ops reset function for Cortex-A76.
* Shall clobber: x0-x19
* -------------------------------------------------
*/
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
func cortex_a76_reset_func
DSU erratum 936184 workaround If the system is in near idle conditions, this erratum could cause a deadlock or data corruption. This patch applies the workaround that prevents this. This DSU erratum affects only the DSUs that contain the ACP interface and it was fixed in r2p0. The workaround is applied only to the DSUs that are actually affected. Link to respective Arm documentation: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.epm138168/index.html Change-Id: I033213b3077685130fc1e3f4f79c4d15d7483ec9 Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
2018-07-23 09:11:59 +01:00
mov x19, x30
Add workaround for errata 1130799 for Cortex-A76 TLBI VAAE1 or TLBI VAALE1 targeting a page within hardware page aggregated address translation data in the L2 TLB might cause corruption of address translation data. Set bit 59 of CPUACTLR2_EL1 to prevent this. Change-Id: I59f3edea54e87d264e0794f5ca2a8c68a636e586 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-21 17:35:07 +00:00
bl cpu_get_rev_var
Add workaround for errata 1220197 for Cortex-A76 Streaming store under specific conditions might cause deadlock or data corruption. Set bit 25:24 of CPUECTLR_EL1, which disables write streaming to the L2 to prevent this. Change-Id: Ib5cabb997b35ada78b27e75787afd610ea606dcf Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 11:37:38 +00:00
mov x18, x0
Add workaround for errata 1130799 for Cortex-A76 TLBI VAAE1 or TLBI VAALE1 targeting a page within hardware page aggregated address translation data in the L2 TLB might cause corruption of address translation data. Set bit 59 of CPUACTLR2_EL1 to prevent this. Change-Id: I59f3edea54e87d264e0794f5ca2a8c68a636e586 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-21 17:35:07 +00:00
Add workaround for errata 1073348 for Cortex-A76 Concurrent instruction TLB miss and mispredicted return instruction might fetch wrong instruction stream. Set bit 6 of CPUACTLR_EL1 to prevent this. Change-Id: I2da4f30cd2df3f5e885dd3c4825c557492d1ac58 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 15:17:44 +00:00
#if ERRATA_A76_1073348
mov x0, x18
bl errata_a76_1073348_wa
#endif
Add workaround for errata 1130799 for Cortex-A76 TLBI VAAE1 or TLBI VAALE1 targeting a page within hardware page aggregated address translation data in the L2 TLB might cause corruption of address translation data. Set bit 59 of CPUACTLR2_EL1 to prevent this. Change-Id: I59f3edea54e87d264e0794f5ca2a8c68a636e586 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-21 17:35:07 +00:00
#if ERRATA_A76_1130799
Add workaround for errata 1220197 for Cortex-A76 Streaming store under specific conditions might cause deadlock or data corruption. Set bit 25:24 of CPUECTLR_EL1, which disables write streaming to the L2 to prevent this. Change-Id: Ib5cabb997b35ada78b27e75787afd610ea606dcf Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 11:37:38 +00:00
mov x0, x18
Add workaround for errata 1130799 for Cortex-A76 TLBI VAAE1 or TLBI VAALE1 targeting a page within hardware page aggregated address translation data in the L2 TLB might cause corruption of address translation data. Set bit 59 of CPUACTLR2_EL1 to prevent this. Change-Id: I59f3edea54e87d264e0794f5ca2a8c68a636e586 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-21 17:35:07 +00:00
bl errata_a76_1130799_wa
#endif
AArch64: Use SSBS for CVE_2018_3639 mitigation The Armv8.5 extensions introduces PSTATE.SSBS (Speculation Store Bypass Safe) bit to mitigate against Variant 4 vulnerabilities. Although an Armv8.5 feature, this can be implemented by CPUs implementing earlier version of the architecture. With this patch, when both PSTATE.SSBS is implemented and DYNAMIC_WORKAROUND_CVE_2018_3639 is active, querying for SMCCC_ARCH_WORKAROUND_2 via. SMCCC_ARCH_FEATURES call would return 1 to indicate that mitigation on the PE is either permanently enabled or not required. When SSBS is implemented, SCTLR_EL3.DSSBS is initialized to 0 at reset of every BL stage. This means that EL3 always executes with mitigation applied. For Cortex A76, if the PE implements SSBS, the existing mitigation (by using a different vector table, and tweaking CPU ACTLR2) is not used. Change-Id: Ib0386c5714184144d4747951751c2fc6ba4242b6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-11-15 11:38:03 +00:00
Add workaround for errata 1220197 for Cortex-A76 Streaming store under specific conditions might cause deadlock or data corruption. Set bit 25:24 of CPUECTLR_EL1, which disables write streaming to the L2 to prevent this. Change-Id: Ib5cabb997b35ada78b27e75787afd610ea606dcf Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 11:37:38 +00:00
#if ERRATA_A76_1220197
mov x0, x18
bl errata_a76_1220197_wa
#endif
Cortex-A76: workarounds for errata 1257314, 1262606, 1262888, 1275112 The workarounds for errata 1257314, 1262606, 1262888 and 1275112 are added to the Cortex-A76 cpu specific file. The workarounds are disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I70474927374cb67725f829d159ddde9ac4edc343 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-01 09:43:18 +01:00
#if ERRATA_A76_1257314
mov x0, x18
bl errata_a76_1257314_wa
#endif
Workaround for Cortex A76 erratum 1868343 Cortex A76 erratum 1868343 is a Cat B erratum, present in older revisions of the Cortex A76 processor core. The workaround is to set a bit in the CPUACTLR_EL1 system register, which delays instruction fetch after branch misprediction. This workaround will have a small impact on performance. This workaround is the same as workarounds for errata 1262606 and 1275112, so all 3 have been combined into one function call. SDEN can be found here: https://documentation-service.arm.com/static/5f2bed6d60a93e65927bc8e7 Signed-off-by: John Powell <john.powell@arm.com> Change-Id: I7f2f9965f495540a1f84bb7dcc28aff45d6cee5d
2020-09-29 23:19:09 +01:00
#if ERRATA_A76_1262606 || ERRATA_A76_1275112 || ERRATA_A76_1868343
Cortex-A76: workarounds for errata 1257314, 1262606, 1262888, 1275112 The workarounds for errata 1257314, 1262606, 1262888 and 1275112 are added to the Cortex-A76 cpu specific file. The workarounds are disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I70474927374cb67725f829d159ddde9ac4edc343 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-01 09:43:18 +01:00
mov x0, x18
Workaround for Cortex A76 erratum 1868343 Cortex A76 erratum 1868343 is a Cat B erratum, present in older revisions of the Cortex A76 processor core. The workaround is to set a bit in the CPUACTLR_EL1 system register, which delays instruction fetch after branch misprediction. This workaround will have a small impact on performance. This workaround is the same as workarounds for errata 1262606 and 1275112, so all 3 have been combined into one function call. SDEN can be found here: https://documentation-service.arm.com/static/5f2bed6d60a93e65927bc8e7 Signed-off-by: John Powell <john.powell@arm.com> Change-Id: I7f2f9965f495540a1f84bb7dcc28aff45d6cee5d
2020-09-29 23:19:09 +01:00
bl errata_a76_1262606_1275112_1868343_wa
Cortex-A76: workarounds for errata 1257314, 1262606, 1262888, 1275112 The workarounds for errata 1257314, 1262606, 1262888 and 1275112 are added to the Cortex-A76 cpu specific file. The workarounds are disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I70474927374cb67725f829d159ddde9ac4edc343 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-01 09:43:18 +01:00
#endif
#if ERRATA_A76_1262888
mov x0, x18
bl errata_a76_1262888_wa
#endif
Workaround for Cortex A76 erratum 1791580 Cortex A76 erratum 1791580 is a Cat B erratum present in earlier revisions of the Cortex A76. The workaround is to set a bit in the implementation defined CPUACTLR2 register, which forces atomic store operations to write-back memory to be performed in the L1 data cache. This errata is explained in this SDEN: https://static.docs.arm.com/sden885749/g/Arm_Cortex_A76_MP052_Software_Developer_Errata_Notice_v20.pdf Signed-off-by: John Powell <john.powell@arm.com> Change-Id: Iefd58159b3f2e2286138993317b98e57dc361925
2020-05-29 20:17:38 +01:00
#if ERRATA_A76_1791580
mov x0, x18
bl errata_a76_1791580_wa
#endif
Workaround for Cortex A76 erratum 1946160 Cortex A76 erratum 1946160 is a Cat B erratum, present in some revisions of the A76 processor core. The workaround is to insert a DMB ST before acquire atomic instructions without release semantics. This issue is present in revisions r0p0 - r4p1 but this workaround only applies to revisions r3p0 - r4p1, there is no workaround for older versions. SDEN can be found here: https://documentation-service.arm.com/static/5fbb77d7d77dd807b9a80cc1 Signed-off-by: John Powell <john.powell@arm.com> Change-Id: Ief33779ee76a89ce2649812ae5214b86a139e327
2020-12-16 01:02:18 +00:00
#if ERRATA_A76_1946160
mov x0, x18
bl errata_a76_1946160_wa
#endif
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
#if WORKAROUND_CVE_2018_3639
AArch64: Use SSBS for CVE_2018_3639 mitigation The Armv8.5 extensions introduces PSTATE.SSBS (Speculation Store Bypass Safe) bit to mitigate against Variant 4 vulnerabilities. Although an Armv8.5 feature, this can be implemented by CPUs implementing earlier version of the architecture. With this patch, when both PSTATE.SSBS is implemented and DYNAMIC_WORKAROUND_CVE_2018_3639 is active, querying for SMCCC_ARCH_WORKAROUND_2 via. SMCCC_ARCH_FEATURES call would return 1 to indicate that mitigation on the PE is either permanently enabled or not required. When SSBS is implemented, SCTLR_EL3.DSSBS is initialized to 0 at reset of every BL stage. This means that EL3 always executes with mitigation applied. For Cortex A76, if the PE implements SSBS, the existing mitigation (by using a different vector table, and tweaking CPU ACTLR2) is not used. Change-Id: Ib0386c5714184144d4747951751c2fc6ba4242b6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-11-15 11:38:03 +00:00
/* If the PE implements SSBS, we don't need the dynamic workaround */
mrs x0, id_aa64pfr1_el1
lsr x0, x0, #ID_AA64PFR1_EL1_SSBS_SHIFT
Cortex-A76: fix spelling Change-Id: I6adf7c14e8a974a7d40d51615b5e69eab1a7436f Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:31:33 +00:00
and x0, x0, #ID_AA64PFR1_EL1_SSBS_MASK
Cortex-A76: Optimize CVE_2018_3639 workaround Switched from a static check to a runtime assert to make sure a workaround is implemented for CVE_2018_3639. This allows platforms that know they have the SSBS hardware workaround in the CPU to compile out code under DYNAMIC_WORKAROUND_CVE_2018_3639. The gain in memory size without the dynamic workaround is 4KB in bl31. Change-Id: I61bb7d87c59964b0c7faac5d6bc7fc5c4651cbf3 Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:33:02 +00:00
#if !DYNAMIC_WORKAROUND_CVE_2018_3639 && ENABLE_ASSERTIONS
cmp x0, 0
ASM_ASSERT(ne)
#endif
#if DYNAMIC_WORKAROUND_CVE_2018_3639
AArch64: Use SSBS for CVE_2018_3639 mitigation The Armv8.5 extensions introduces PSTATE.SSBS (Speculation Store Bypass Safe) bit to mitigate against Variant 4 vulnerabilities. Although an Armv8.5 feature, this can be implemented by CPUs implementing earlier version of the architecture. With this patch, when both PSTATE.SSBS is implemented and DYNAMIC_WORKAROUND_CVE_2018_3639 is active, querying for SMCCC_ARCH_WORKAROUND_2 via. SMCCC_ARCH_FEATURES call would return 1 to indicate that mitigation on the PE is either permanently enabled or not required. When SSBS is implemented, SCTLR_EL3.DSSBS is initialized to 0 at reset of every BL stage. This means that EL3 always executes with mitigation applied. For Cortex A76, if the PE implements SSBS, the existing mitigation (by using a different vector table, and tweaking CPU ACTLR2) is not used. Change-Id: Ib0386c5714184144d4747951751c2fc6ba4242b6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-11-15 11:38:03 +00:00
cbnz x0, 1f
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
mrs x0, CORTEX_A76_CPUACTLR2_EL1
orr x0, x0, #CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE
msr CORTEX_A76_CPUACTLR2_EL1, x0
isb
AArch64: Use SSBS for CVE_2018_3639 mitigation The Armv8.5 extensions introduces PSTATE.SSBS (Speculation Store Bypass Safe) bit to mitigate against Variant 4 vulnerabilities. Although an Armv8.5 feature, this can be implemented by CPUs implementing earlier version of the architecture. With this patch, when both PSTATE.SSBS is implemented and DYNAMIC_WORKAROUND_CVE_2018_3639 is active, querying for SMCCC_ARCH_WORKAROUND_2 via. SMCCC_ARCH_FEATURES call would return 1 to indicate that mitigation on the PE is either permanently enabled or not required. When SSBS is implemented, SCTLR_EL3.DSSBS is initialized to 0 at reset of every BL stage. This means that EL3 always executes with mitigation applied. For Cortex A76, if the PE implements SSBS, the existing mitigation (by using a different vector table, and tweaking CPU ACTLR2) is not used. Change-Id: Ib0386c5714184144d4747951751c2fc6ba4242b6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-11-15 11:38:03 +00:00
#ifdef IMAGE_BL31
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
/*
* The Cortex-A76 generic vectors are overwritten to use the vectors
Cortex-A76: fix spelling Change-Id: I6adf7c14e8a974a7d40d51615b5e69eab1a7436f Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:31:33 +00:00
* defined above. This is required in order to apply mitigation
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
* against CVE-2018-3639 on exception entry from lower ELs.
*/
adr x0, cortex_a76_wa_cve_2018_3639_a76_vbar
msr vbar_el3, x0
isb
Cortex-A76: Optimize CVE_2018_3639 workaround Switched from a static check to a runtime assert to make sure a workaround is implemented for CVE_2018_3639. This allows platforms that know they have the SSBS hardware workaround in the CPU to compile out code under DYNAMIC_WORKAROUND_CVE_2018_3639. The gain in memory size without the dynamic workaround is 4KB in bl31. Change-Id: I61bb7d87c59964b0c7faac5d6bc7fc5c4651cbf3 Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:33:02 +00:00
#endif /* IMAGE_BL31 */
DSU erratum 936184 workaround If the system is in near idle conditions, this erratum could cause a deadlock or data corruption. This patch applies the workaround that prevents this. This DSU erratum affects only the DSUs that contain the ACP interface and it was fixed in r2p0. The workaround is applied only to the DSUs that are actually affected. Link to respective Arm documentation: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.epm138168/index.html Change-Id: I033213b3077685130fc1e3f4f79c4d15d7483ec9 Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
2018-07-23 09:11:59 +01:00
AArch64: Use SSBS for CVE_2018_3639 mitigation The Armv8.5 extensions introduces PSTATE.SSBS (Speculation Store Bypass Safe) bit to mitigate against Variant 4 vulnerabilities. Although an Armv8.5 feature, this can be implemented by CPUs implementing earlier version of the architecture. With this patch, when both PSTATE.SSBS is implemented and DYNAMIC_WORKAROUND_CVE_2018_3639 is active, querying for SMCCC_ARCH_WORKAROUND_2 via. SMCCC_ARCH_FEATURES call would return 1 to indicate that mitigation on the PE is either permanently enabled or not required. When SSBS is implemented, SCTLR_EL3.DSSBS is initialized to 0 at reset of every BL stage. This means that EL3 always executes with mitigation applied. For Cortex A76, if the PE implements SSBS, the existing mitigation (by using a different vector table, and tweaking CPU ACTLR2) is not used. Change-Id: Ib0386c5714184144d4747951751c2fc6ba4242b6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-11-15 11:38:03 +00:00
1:
Cortex-A76: Optimize CVE_2018_3639 workaround Switched from a static check to a runtime assert to make sure a workaround is implemented for CVE_2018_3639. This allows platforms that know they have the SSBS hardware workaround in the CPU to compile out code under DYNAMIC_WORKAROUND_CVE_2018_3639. The gain in memory size without the dynamic workaround is 4KB in bl31. Change-Id: I61bb7d87c59964b0c7faac5d6bc7fc5c4651cbf3 Signed-off-by: Ambroise Vincent <ambroise.vincent@arm.com>
2019-03-07 14:33:02 +00:00
#endif /* DYNAMIC_WORKAROUND_CVE_2018_3639 */
#endif /* WORKAROUND_CVE_2018_3639 */
AArch64: Use SSBS for CVE_2018_3639 mitigation The Armv8.5 extensions introduces PSTATE.SSBS (Speculation Store Bypass Safe) bit to mitigate against Variant 4 vulnerabilities. Although an Armv8.5 feature, this can be implemented by CPUs implementing earlier version of the architecture. With this patch, when both PSTATE.SSBS is implemented and DYNAMIC_WORKAROUND_CVE_2018_3639 is active, querying for SMCCC_ARCH_WORKAROUND_2 via. SMCCC_ARCH_FEATURES call would return 1 to indicate that mitigation on the PE is either permanently enabled or not required. When SSBS is implemented, SCTLR_EL3.DSSBS is initialized to 0 at reset of every BL stage. This means that EL3 always executes with mitigation applied. For Cortex A76, if the PE implements SSBS, the existing mitigation (by using a different vector table, and tweaking CPU ACTLR2) is not used. Change-Id: Ib0386c5714184144d4747951751c2fc6ba4242b6 Signed-off-by: Jeenu Viswambharan <jeenu.viswambharan@arm.com>
2018-11-15 11:38:03 +00:00
DSU: Implement workaround for errata 798953 Under certain near idle conditions, DSU may miss response transfers on the ACE master or Peripheral port, leading to deadlock. This workaround disables high-level clock gating of the DSU to prevent this. Change-Id: I820911d61570bacb38dd325b3519bc8d12caa14b Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-04-09 16:29:01 +01:00
#if ERRATA_DSU_798953
bl errata_dsu_798953_wa
#endif
DSU erratum 936184 workaround If the system is in near idle conditions, this erratum could cause a deadlock or data corruption. This patch applies the workaround that prevents this. This DSU erratum affects only the DSUs that contain the ACP interface and it was fixed in r2p0. The workaround is applied only to the DSUs that are actually affected. Link to respective Arm documentation: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.epm138168/index.html Change-Id: I033213b3077685130fc1e3f4f79c4d15d7483ec9 Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
2018-07-23 09:11:59 +01:00
#if ERRATA_DSU_936184
bl errata_dsu_936184_wa
#endif
DSU: Implement workaround for errata 798953 Under certain near idle conditions, DSU may miss response transfers on the ACE master or Peripheral port, leading to deadlock. This workaround disables high-level clock gating of the DSU to prevent this. Change-Id: I820911d61570bacb38dd325b3519bc8d12caa14b Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-04-09 16:29:01 +01:00
DSU erratum 936184 workaround If the system is in near idle conditions, this erratum could cause a deadlock or data corruption. This patch applies the workaround that prevents this. This DSU erratum affects only the DSUs that contain the ACP interface and it was fixed in r2p0. The workaround is applied only to the DSUs that are actually affected. Link to respective Arm documentation: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.epm138168/index.html Change-Id: I033213b3077685130fc1e3f4f79c4d15d7483ec9 Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
2018-07-23 09:11:59 +01:00
ret x19
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
endfunc cortex_a76_reset_func
Add support for Cortex-Ares and Cortex-A76 CPUs Both Cortex-Ares and Cortex-A76 CPUs use the ARM DynamIQ Shared Unit (DSU). The power-down and power-up sequences are therefore mostly managed in hardware, and required software operations are simple. Change-Id: I3a9447b5bdbdbc5ed845b20f6564d086516fa161 Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
2017-08-03 16:04:46 +01:00
/* ---------------------------------------------
* HW will do the cache maintenance while powering down
* ---------------------------------------------
*/
func cortex_a76_core_pwr_dwn
/* ---------------------------------------------
* Enable CPU power down bit in power control register
* ---------------------------------------------
*/
mrs x0, CORTEX_A76_CPUPWRCTLR_EL1
orr x0, x0, #CORTEX_A76_CORE_PWRDN_EN_MASK
msr CORTEX_A76_CPUPWRCTLR_EL1, x0
isb
ret
endfunc cortex_a76_core_pwr_dwn
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
#if REPORT_ERRATA
/*
DSU: Implement workaround for errata 798953 Under certain near idle conditions, DSU may miss response transfers on the ACE master or Peripheral port, leading to deadlock. This workaround disables high-level clock gating of the DSU to prevent this. Change-Id: I820911d61570bacb38dd325b3519bc8d12caa14b Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-04-09 16:29:01 +01:00
* Errata printing function for Cortex A76. Must follow AAPCS.
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
*/
func cortex_a76_errata_report
stp x8, x30, [sp, #-16]!
bl cpu_get_rev_var
mov x8, x0
/*
* Report all errata. The revision-variant information is passed to
* checking functions of each errata.
*/
Add workaround for errata 1073348 for Cortex-A76 Concurrent instruction TLB miss and mispredicted return instruction might fetch wrong instruction stream. Set bit 6 of CPUACTLR_EL1 to prevent this. Change-Id: I2da4f30cd2df3f5e885dd3c4825c557492d1ac58 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 15:17:44 +00:00
report_errata ERRATA_A76_1073348, cortex_a76, 1073348
Add workaround for errata 1130799 for Cortex-A76 TLBI VAAE1 or TLBI VAALE1 targeting a page within hardware page aggregated address translation data in the L2 TLB might cause corruption of address translation data. Set bit 59 of CPUACTLR2_EL1 to prevent this. Change-Id: I59f3edea54e87d264e0794f5ca2a8c68a636e586 Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-21 17:35:07 +00:00
report_errata ERRATA_A76_1130799, cortex_a76, 1130799
Add workaround for errata 1220197 for Cortex-A76 Streaming store under specific conditions might cause deadlock or data corruption. Set bit 25:24 of CPUECTLR_EL1, which disables write streaming to the L2 to prevent this. Change-Id: Ib5cabb997b35ada78b27e75787afd610ea606dcf Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-02-25 11:37:38 +00:00
report_errata ERRATA_A76_1220197, cortex_a76, 1220197
Cortex-A76: workarounds for errata 1257314, 1262606, 1262888, 1275112 The workarounds for errata 1257314, 1262606, 1262888 and 1275112 are added to the Cortex-A76 cpu specific file. The workarounds are disabled by default and have to be explicitly enabled by the platform integrator. Change-Id: I70474927374cb67725f829d159ddde9ac4edc343 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-01 09:43:18 +01:00
report_errata ERRATA_A76_1257314, cortex_a76, 1257314
report_errata ERRATA_A76_1262606, cortex_a76, 1262606
report_errata ERRATA_A76_1262888, cortex_a76, 1262888
report_errata ERRATA_A76_1275112, cortex_a76, 1275112
Workaround for cortex-A76 errata 1286807 The workaround for Cortex-A76 errata #1286807 is implemented in this patch. Change-Id: I6c15af962ac99ce223e009f6d299cefb41043bed Signed-off-by: Soby Mathew <soby.mathew@arm.com>
2019-05-03 13:17:56 +01:00
report_errata ERRATA_A76_1286807, cortex_a76, 1286807
Workaround for Cortex A76 erratum 1791580 Cortex A76 erratum 1791580 is a Cat B erratum present in earlier revisions of the Cortex A76. The workaround is to set a bit in the implementation defined CPUACTLR2 register, which forces atomic store operations to write-back memory to be performed in the L1 data cache. This errata is explained in this SDEN: https://static.docs.arm.com/sden885749/g/Arm_Cortex_A76_MP052_Software_Developer_Errata_Notice_v20.pdf Signed-off-by: John Powell <john.powell@arm.com> Change-Id: Iefd58159b3f2e2286138993317b98e57dc361925
2020-05-29 20:17:38 +01:00
report_errata ERRATA_A76_1791580, cortex_a76, 1791580
lib/cpus: Report AT speculative erratum workaround Reported the status (applies, missing) of AT speculative workaround which is applicable for below CPUs. +---------+--------------+ | Errata | CPU | +=========+==============+ | 1165522 | Cortex-A76 | +---------+--------------+ | 1319367 | Cortex-A72 | +---------+--------------+ | 1319537 | Cortex-A57 | +---------+--------------+ | 1530923 | Cortex-A55 | +---------+--------------+ | 1530924 | Cortex-A53 | +---------+--------------+ Also, changes are done to enable common macro 'ERRATA_SPECULATIVE_AT' if AT speculative errata workaround is enabled for any of the above CPUs using 'ERRATA_*' CPU specific build macro. Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com> Change-Id: I3e6a5316a2564071f3920c3ce9ae9a29adbe435b
2020-08-03 18:43:14 +01:00
report_errata ERRATA_A76_1165522, cortex_a76, 1165522
Workaround for Cortex A76 erratum 1868343 Cortex A76 erratum 1868343 is a Cat B erratum, present in older revisions of the Cortex A76 processor core. The workaround is to set a bit in the CPUACTLR_EL1 system register, which delays instruction fetch after branch misprediction. This workaround will have a small impact on performance. This workaround is the same as workarounds for errata 1262606 and 1275112, so all 3 have been combined into one function call. SDEN can be found here: https://documentation-service.arm.com/static/5f2bed6d60a93e65927bc8e7 Signed-off-by: John Powell <john.powell@arm.com> Change-Id: I7f2f9965f495540a1f84bb7dcc28aff45d6cee5d
2020-09-29 23:19:09 +01:00
report_errata ERRATA_A76_1868343, cortex_a76, 1868343
Workaround for Cortex A76 erratum 1946160 Cortex A76 erratum 1946160 is a Cat B erratum, present in some revisions of the A76 processor core. The workaround is to insert a DMB ST before acquire atomic instructions without release semantics. This issue is present in revisions r0p0 - r4p1 but this workaround only applies to revisions r3p0 - r4p1, there is no workaround for older versions. SDEN can be found here: https://documentation-service.arm.com/static/5fbb77d7d77dd807b9a80cc1 Signed-off-by: John Powell <john.powell@arm.com> Change-Id: Ief33779ee76a89ce2649812ae5214b86a139e327
2020-12-16 01:02:18 +00:00
report_errata ERRATA_A76_1946160, cortex_a76, 1946160
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
report_errata WORKAROUND_CVE_2018_3639, cortex_a76, cve_2018_3639
DSU: Implement workaround for errata 798953 Under certain near idle conditions, DSU may miss response transfers on the ACE master or Peripheral port, leading to deadlock. This workaround disables high-level clock gating of the DSU to prevent this. Change-Id: I820911d61570bacb38dd325b3519bc8d12caa14b Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
2019-04-09 16:29:01 +01:00
report_errata ERRATA_DSU_798953, cortex_a76, dsu_798953
DSU erratum 936184 workaround If the system is in near idle conditions, this erratum could cause a deadlock or data corruption. This patch applies the workaround that prevents this. This DSU erratum affects only the DSUs that contain the ACP interface and it was fixed in r2p0. The workaround is applied only to the DSUs that are actually affected. Link to respective Arm documentation: http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.epm138168/index.html Change-Id: I033213b3077685130fc1e3f4f79c4d15d7483ec9 Signed-off-by: John Tsichritzis <john.tsichritzis@arm.com>
2018-07-23 09:11:59 +01:00
report_errata ERRATA_DSU_936184, cortex_a76, dsu_936184
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
ldp x8, x30, [sp], #16
ret
endfunc cortex_a76_errata_report
#endif
Add support for Cortex-Ares and Cortex-A76 CPUs Both Cortex-Ares and Cortex-A76 CPUs use the ARM DynamIQ Shared Unit (DSU). The power-down and power-up sequences are therefore mostly managed in hardware, and required software operations are simple. Change-Id: I3a9447b5bdbdbc5ed845b20f6564d086516fa161 Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
2017-08-03 16:04:46 +01:00
/* ---------------------------------------------
* This function provides cortex_a76 specific
* register information for crash reporting.
* It needs to return with x6 pointing to
* a list of register names in ascii and
* x8 - x15 having values of registers to be
* reported.
* ---------------------------------------------
*/
.section .rodata.cortex_a76_regs, "aS"
cortex_a76_regs: /* The ascii list of register names to be reported */
.asciz "cpuectlr_el1", ""
func cortex_a76_cpu_reg_dump
adr x6, cortex_a76_regs
mrs x8, CORTEX_A76_CPUECTLR_EL1
ret
endfunc cortex_a76_cpu_reg_dump
Implement dynamic mitigation for CVE-2018-3639 on Cortex-A76 The Cortex-A76 implements SMCCC_ARCH_WORKAROUND_2 as defined in "Firmware interfaces for mitigating cache speculation vulnerabilities System Software on Arm Systems"[0]. Dynamic mitigation for CVE-2018-3639 is enabled/disabled by setting/clearning bit 16 (Disable load pass store) of `CPUACTLR2_EL1`. NOTE: The generic code that implements dynamic mitigation does not currently implement the expected semantics when dispatching an SDEI event to a lower EL. This will be fixed in a separate patch. [0] https://developer.arm.com/cache-speculation-vulnerability-firmware-specification Change-Id: I8fb2862b9ab24d55a0e9693e48e8be4df32afb5a Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>
2018-05-16 09:59:54 +01:00
declare_cpu_ops_wa cortex_a76, CORTEX_A76_MIDR, \
cortex_a76_reset_func, \
CPU_NO_EXTRA1_FUNC, \
cortex_a76_disable_wa_cve_2018_3639, \
Add support for Cortex-Ares and Cortex-A76 CPUs Both Cortex-Ares and Cortex-A76 CPUs use the ARM DynamIQ Shared Unit (DSU). The power-down and power-up sequences are therefore mostly managed in hardware, and required software operations are simple. Change-Id: I3a9447b5bdbdbc5ed845b20f6564d086516fa161 Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
2017-08-03 16:04:46 +01:00
cortex_a76_core_pwr_dwn