From bb9549babc17631f7c7b944ad3213c5a8d173bdd Mon Sep 17 00:00:00 2001
From: Jan Dabros <jsd@semihalf.com>
Date: Mon, 2 Dec 2019 13:30:03 +0100
Subject: [PATCH] aarch64: Fix stack pointer maintenance on EA handling path

EA handlers for exceptions taken from lower ELs at the end invokes
el3_exit function. However there was a bug with sp maintenance which
resulted in el3_exit setting runtime stack to context. This in turn
caused memory corruption on consecutive EL3 entries.

Signed-off-by: Jan Dabros <jsd@semihalf.com>
Change-Id: I0424245c27c369c864506f4baa719968890ce659
---
 bl31/aarch64/ea_delegate.S        | 13 +++++++++----
 lib/el3_runtime/aarch64/context.S |  8 ++++++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/bl31/aarch64/ea_delegate.S b/bl31/aarch64/ea_delegate.S
index 3cc4d56a3..1d28d5e0f 100644
--- a/bl31/aarch64/ea_delegate.S
+++ b/bl31/aarch64/ea_delegate.S
@@ -102,9 +102,11 @@ func enter_lower_el_sync_ea
 	/* Setup exception class and syndrome arguments for platform handler */
 	mov	x0, #ERROR_EA_SYNC
 	mrs	x1, esr_el3
-	adr	x30, el3_exit
-	b	delegate_sync_ea
+	bl	delegate_sync_ea
 
+	/* el3_exit assumes SP_EL0 on entry */
+	msr	spsel, #MODE_SP_EL0
+	b	el3_exit
 2:
 	ldp	x0, x1, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X0]
 	ldp	x2, x3, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X2]
@@ -146,8 +148,11 @@ func enter_lower_el_async_ea
 	/* Setup exception class and syndrome arguments for platform handler */
 	mov	x0, #ERROR_EA_ASYNC
 	mrs	x1, esr_el3
-	adr	x30, el3_exit
-	b	delegate_async_ea
+	bl	delegate_async_ea
+
+	/* el3_exit assumes SP_EL0 on entry */
+	msr	spsel, #MODE_SP_EL0
+	b	el3_exit
 endfunc enter_lower_el_async_ea
 
 
diff --git a/lib/el3_runtime/aarch64/context.S b/lib/el3_runtime/aarch64/context.S
index 110142520..1bbd61005 100644
--- a/lib/el3_runtime/aarch64/context.S
+++ b/lib/el3_runtime/aarch64/context.S
@@ -6,6 +6,7 @@
 
 #include <arch.h>
 #include <asm_macros.S>
+#include <assert_macros.S>
 #include <context.h>
 
 	.global	el1_sysregs_context_save
@@ -477,6 +478,13 @@ endfunc restore_gp_pmcr_pauth_regs
  * ------------------------------------------------------------------
  */
 func el3_exit
+#if ENABLE_ASSERTIONS
+	/* el3_exit assumes SP_EL0 on entry */
+	mrs	x17, spsel
+	cmp	x17, #MODE_SP_EL0
+	ASM_ASSERT(eq)
+#endif
+
 	/* ----------------------------------------------------------
 	 * Save the current SP_EL0 i.e. the EL3 runtime stack which
 	 * will be used for handling the next SMC.