| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374 |
- /*
- * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved.
- *
- * SPDX-License-Identifier: BSD-3-Clause
- */
- #include <asm_macros.S>
- .globl wa_cve_2017_5715_bpiall_vbar
- vector_base wa_cve_2017_5715_bpiall_vbar
- /* We encode the exception entry in the bottom 3 bits of SP */
- add sp, sp, #1 /* Reset: 0b111 */
- add sp, sp, #1 /* Undef: 0b110 */
- add sp, sp, #1 /* Syscall: 0b101 */
- add sp, sp, #1 /* Prefetch abort: 0b100 */
- add sp, sp, #1 /* Data abort: 0b011 */
- add sp, sp, #1 /* Reserved: 0b010 */
- add sp, sp, #1 /* IRQ: 0b001 */
- nop /* FIQ: 0b000 */
- /*
- * Invalidate the branch predictor, `r0` is a dummy register
- * and is unused.
- */
- stcopr r0, BPIALL
- isb
- /*
- * As we cannot use any temporary registers and cannot
- * clobber SP, we can decode the exception entry using
- * an unrolled binary search.
- *
- * Note, if this code is re-used by other secure payloads,
- * the below exception entry vectors must be changed to
- * the vectors specific to that secure payload.
- */
- tst sp, #4
- bne 1f
- tst sp, #2
- bne 3f
- /* Expected encoding: 0x1 and 0x0 */
- tst sp, #1
- /* Restore original value of SP by clearing the bottom 3 bits */
- bic sp, sp, #0x7
- bne plat_panic_handler /* IRQ */
- b sp_min_handle_fiq /* FIQ */
- 1:
- tst sp, #2
- bne 2f
- /* Expected encoding: 0x4 and 0x5 */
- tst sp, #1
- bic sp, sp, #0x7
- bne sp_min_handle_smc /* Syscall */
- b plat_panic_handler /* Prefetch abort */
- 2:
- /* Expected encoding: 0x7 and 0x6 */
- tst sp, #1
- bic sp, sp, #0x7
- bne sp_min_entrypoint /* Reset */
- b plat_panic_handler /* Undef */
- 3:
- /* Expected encoding: 0x2 and 0x3 */
- tst sp, #1
- bic sp, sp, #0x7
- bne plat_panic_handler /* Data abort */
- b plat_panic_handler /* Reserved */
|
