mirror of
https://github.com/ARM-software/arm-trusted-firmware.git
synced 2025-04-16 01:24:27 +00:00
f461fe346b
Even though ERET always causes a jump to another address, aarch64 CPUs speculatively execute following instructions as if the ERET instruction was not a jump instruction. The speculative execution does not cross privilege-levels (to the jump target as one would expect), but it continues on the kernel privilege level as if the ERET instruction did not change the control flow - thus execution anything that is accidentally linked after the ERET instruction. Later, the results of this speculative execution are always architecturally discarded, however they can leak data using microarchitectural side channels. This speculative execution is very reliable (seems to be unconditional) and it manages to complete even relatively performance-heavy operations (e.g. multiple dependent fetches from uncached memory). This was fixed in Linux, FreeBSD, OpenBSD and Optee OS:679db7080129fb48ace43a08873eceabfd092aa1It is demonstrated in a SafeSide example: https://github.com/google/safeside/blob/master/demos/eret_hvc_smc_wrapper.cc https://github.com/google/safeside/blob/master/kernel_modules/kmod_eret_hvc_smc/eret_hvc_smc_module.c Signed-off-by: Anthony Steinhauser <asteinhauser@google.com> Change-Id: Iead39b0b9fb4b8d8b5609daaa8be81497ba63a0f
99 lines
2.7 KiB
ArmAsm
99 lines
2.7 KiB
ArmAsm
/*
|
|
* Copyright (c) 2017-2020, ARM Limited and Contributors. All rights reserved.
|
|
*
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
|
*/
|
|
|
|
#include <arch.h>
|
|
#include <asm_macros.S>
|
|
#include <common/bl_common.h>
|
|
#include <el3_common_macros.S>
|
|
|
|
.globl bl2_entrypoint
|
|
.globl bl2_el3_run_image
|
|
.globl bl2_run_next_image
|
|
|
|
func bl2_entrypoint
|
|
/* Save arguments x0-x3 from previous Boot loader */
|
|
mov x20, x0
|
|
mov x21, x1
|
|
mov x22, x2
|
|
mov x23, x3
|
|
|
|
el3_entrypoint_common \
|
|
_init_sctlr=1 \
|
|
_warm_boot_mailbox=!PROGRAMMABLE_RESET_ADDRESS \
|
|
_secondary_cold_boot=!COLD_BOOT_SINGLE_CPU \
|
|
_init_memory=1 \
|
|
_init_c_runtime=1 \
|
|
_exception_vectors=bl2_el3_exceptions \
|
|
_pie_fixup_size=0
|
|
|
|
/* ---------------------------------------------
|
|
* Restore parameters of boot rom
|
|
* ---------------------------------------------
|
|
*/
|
|
mov x0, x20
|
|
mov x1, x21
|
|
mov x2, x22
|
|
mov x3, x23
|
|
|
|
/* ---------------------------------------------
|
|
* Perform BL2 setup
|
|
* ---------------------------------------------
|
|
*/
|
|
bl bl2_el3_setup
|
|
|
|
#if ENABLE_PAUTH
|
|
/* ---------------------------------------------
|
|
* Program APIAKey_EL1 and enable pointer authentication.
|
|
* ---------------------------------------------
|
|
*/
|
|
bl pauth_init_enable_el3
|
|
#endif /* ENABLE_PAUTH */
|
|
|
|
/* ---------------------------------------------
|
|
* Jump to main function.
|
|
* ---------------------------------------------
|
|
*/
|
|
bl bl2_main
|
|
|
|
/* ---------------------------------------------
|
|
* Should never reach this point.
|
|
* ---------------------------------------------
|
|
*/
|
|
no_ret plat_panic_handler
|
|
endfunc bl2_entrypoint
|
|
|
|
func bl2_run_next_image
|
|
mov x20,x0
|
|
/* ---------------------------------------------
|
|
* MMU needs to be disabled because both BL2 and BL31 execute
|
|
* in EL3, and therefore share the same address space.
|
|
* BL31 will initialize the address space according to its
|
|
* own requirement.
|
|
* ---------------------------------------------
|
|
*/
|
|
bl disable_mmu_icache_el3
|
|
tlbi alle3
|
|
bl bl2_el3_plat_prepare_exit
|
|
|
|
#if ENABLE_PAUTH
|
|
/* ---------------------------------------------
|
|
* Disable pointer authentication before jumping
|
|
* to next boot image.
|
|
* ---------------------------------------------
|
|
*/
|
|
bl pauth_disable_el3
|
|
#endif /* ENABLE_PAUTH */
|
|
|
|
ldp x0, x1, [x20, #ENTRY_POINT_INFO_PC_OFFSET]
|
|
msr elr_el3, x0
|
|
msr spsr_el3, x1
|
|
|
|
ldp x6, x7, [x20, #(ENTRY_POINT_INFO_ARGS_OFFSET + 0x30)]
|
|
ldp x4, x5, [x20, #(ENTRY_POINT_INFO_ARGS_OFFSET + 0x20)]
|
|
ldp x2, x3, [x20, #(ENTRY_POINT_INFO_ARGS_OFFSET + 0x10)]
|
|
ldp x0, x1, [x20, #(ENTRY_POINT_INFO_ARGS_OFFSET + 0x0)]
|
|
exception_return
|
|
endfunc bl2_run_next_image
|