Commit 3060e9f0 authored by Shanker Donthineni's avatar Shanker Donthineni Committed by Catalin Marinas

arm64: Add software workaround for Falkor erratum 1041

The ARM architecture defines the memory locations that are permitted
to be accessed as the result of a speculative instruction fetch from
an exception level for which all stages of translation are disabled.
Specifically, the core is permitted to speculatively fetch from the
4KB region containing the current program counter 4K and next 4K.

When translation is changed from enabled to disabled for the running
exception level (SCTLR_ELn[M] changed from a value of 1 to 0), the
Falkor core may errantly speculatively access memory locations outside
of the 4KB region permitted by the architecture. The errant memory
access may lead to one of the following unexpected behaviors.

1) A System Error Interrupt (SEI) being raised by the Falkor core due
   to the errant memory access attempting to access a region of memory
   that is protected by a slave-side memory protection unit.
2) Unpredictable device behavior due to a speculative read from device
   memory. This behavior may only occur if the instruction cache is
   disabled prior to or coincident with translation being changed from
   enabled to disabled.

The conditions leading to this erratum will not occur when either of the
following occur:
 1) A higher exception level disables translation of a lower exception level
   (e.g. EL2 changing SCTLR_EL1[M] from a value of 1 to 0).
 2) An exception level disabling its stage-1 translation if its stage-2
    translation is enabled (e.g. EL1 changing SCTLR_EL1[M] from a value of 1
    to 0 when HCR_EL2[VM] has a value of 1).

To avoid the errant behavior, software must execute an ISB immediately
prior to executing the MSR that will change SCTLR_ELn[M] from 1 to 0.
Signed-off-by: default avatarShanker Donthineni <shankerd@codeaurora.org>
Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent 202fb4ef
...@@ -75,3 +75,4 @@ stable kernels. ...@@ -75,3 +75,4 @@ stable kernels.
| Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 |
| Qualcomm Tech. | Falkor v1 | E1009 | QCOM_FALKOR_ERRATUM_1009 | | Qualcomm Tech. | Falkor v1 | E1009 | QCOM_FALKOR_ERRATUM_1009 |
| Qualcomm Tech. | QDF2400 ITS | E0065 | QCOM_QDF2400_ERRATUM_0065 | | Qualcomm Tech. | QDF2400 ITS | E0065 | QCOM_QDF2400_ERRATUM_0065 |
| Qualcomm Tech. | Falkor v{1,2} | E1041 | QCOM_FALKOR_ERRATUM_1041 |
...@@ -550,7 +550,6 @@ config QCOM_QDF2400_ERRATUM_0065 ...@@ -550,7 +550,6 @@ config QCOM_QDF2400_ERRATUM_0065
If unsure, say Y. If unsure, say Y.
config SOCIONEXT_SYNQUACER_PREITS config SOCIONEXT_SYNQUACER_PREITS
bool "Socionext Synquacer: Workaround for GICv3 pre-ITS" bool "Socionext Synquacer: Workaround for GICv3 pre-ITS"
default y default y
...@@ -569,6 +568,17 @@ config HISILICON_ERRATUM_161600802 ...@@ -569,6 +568,17 @@ config HISILICON_ERRATUM_161600802
a 128kB offset to be applied to the target address in this commands. a 128kB offset to be applied to the target address in this commands.
If unsure, say Y. If unsure, say Y.
config QCOM_FALKOR_ERRATUM_E1041
bool "Falkor E1041: Speculative instruction fetches might cause errant memory access"
default y
help
Falkor CPU may speculatively fetch instructions from an improper
memory location when MMU translation is changed from SCTLR_ELn[M]=1
to SCTLR_ELn[M]=0. Prefix an ISB instruction to fix the problem.
If unsure, say Y.
endmenu endmenu
......
...@@ -523,4 +523,14 @@ alternative_endif ...@@ -523,4 +523,14 @@ alternative_endif
#endif #endif
.endm .endm
/**
* Errata workaround prior to disable MMU. Insert an ISB immediately prior
* to executing the MSR that will change SCTLR_ELn[M] from a value of 1 to 0.
*/
.macro pre_disable_mmu_workaround
#ifdef CONFIG_QCOM_FALKOR_ERRATUM_E1041
isb
#endif
.endm
#endif /* __ASM_ASSEMBLER_H */ #endif /* __ASM_ASSEMBLER_H */
...@@ -37,6 +37,7 @@ ENTRY(__cpu_soft_restart) ...@@ -37,6 +37,7 @@ ENTRY(__cpu_soft_restart)
mrs x12, sctlr_el1 mrs x12, sctlr_el1
ldr x13, =SCTLR_ELx_FLAGS ldr x13, =SCTLR_ELx_FLAGS
bic x12, x12, x13 bic x12, x12, x13
pre_disable_mmu_workaround
msr sctlr_el1, x12 msr sctlr_el1, x12
isb isb
......
...@@ -96,6 +96,7 @@ ENTRY(entry) ...@@ -96,6 +96,7 @@ ENTRY(entry)
mrs x0, sctlr_el2 mrs x0, sctlr_el2
bic x0, x0, #1 << 0 // clear SCTLR.M bic x0, x0, #1 << 0 // clear SCTLR.M
bic x0, x0, #1 << 2 // clear SCTLR.C bic x0, x0, #1 << 2 // clear SCTLR.C
pre_disable_mmu_workaround
msr sctlr_el2, x0 msr sctlr_el2, x0
isb isb
b 2f b 2f
...@@ -103,6 +104,7 @@ ENTRY(entry) ...@@ -103,6 +104,7 @@ ENTRY(entry)
mrs x0, sctlr_el1 mrs x0, sctlr_el1
bic x0, x0, #1 << 0 // clear SCTLR.M bic x0, x0, #1 << 0 // clear SCTLR.M
bic x0, x0, #1 << 2 // clear SCTLR.C bic x0, x0, #1 << 2 // clear SCTLR.C
pre_disable_mmu_workaround
msr sctlr_el1, x0 msr sctlr_el1, x0
isb isb
2: 2:
......
...@@ -849,6 +849,7 @@ __primary_switch: ...@@ -849,6 +849,7 @@ __primary_switch:
* to take into account by discarding the current kernel mapping and * to take into account by discarding the current kernel mapping and
* creating a new one. * creating a new one.
*/ */
pre_disable_mmu_workaround
msr sctlr_el1, x20 // disable the MMU msr sctlr_el1, x20 // disable the MMU
isb isb
bl __create_page_tables // recreate kernel mapping bl __create_page_tables // recreate kernel mapping
......
...@@ -45,6 +45,7 @@ ENTRY(arm64_relocate_new_kernel) ...@@ -45,6 +45,7 @@ ENTRY(arm64_relocate_new_kernel)
mrs x0, sctlr_el2 mrs x0, sctlr_el2
ldr x1, =SCTLR_ELx_FLAGS ldr x1, =SCTLR_ELx_FLAGS
bic x0, x0, x1 bic x0, x0, x1
pre_disable_mmu_workaround
msr sctlr_el2, x0 msr sctlr_el2, x0
isb isb
1: 1:
......
...@@ -153,6 +153,7 @@ reset: ...@@ -153,6 +153,7 @@ reset:
mrs x5, sctlr_el2 mrs x5, sctlr_el2
ldr x6, =SCTLR_ELx_FLAGS ldr x6, =SCTLR_ELx_FLAGS
bic x5, x5, x6 // Clear SCTL_M and etc bic x5, x5, x6 // Clear SCTL_M and etc
pre_disable_mmu_workaround
msr sctlr_el2, x5 msr sctlr_el2, x5
isb isb
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment