LF-3161-1 arm: imx: Fix speculative instruction prefetch issue

Default ARM32 MMU setting in u-boot sets XN bit to entire 4GB space no matter which DCACHE option is used, and set domain permission to manager. This causes MMU ignores the access check and XN bit, so speculative instruction can fetch from entire space. This patch sets the DDR, ROM, OCRAM without XN bit, and set domain to client to enable the XN and access check. So speculative instruction fetch can only happens on these 3 regions to avoid prefetch from peripherals and invalid regions. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> (cherry picked from commit 25d70768c460bad91aa65f367203af41122399cd)

LF-3161-1 arm: imx: Fix speculative instruction prefetch issue
Default ARM32 MMU setting in u-boot sets XN bit to entire 4GB space no matter which DCACHE option is used, and set domain permission to manager. This causes MMU ignores the access check and XN bit, so speculative instruction can fetch from entire space. This patch sets the DDR, ROM, OCRAM without XN bit, and set domain to client to enable the XN and access check. So speculative instruction fetch can only happens on these 3 regions to avoid prefetch from peripherals and invalid regions. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> (cherry picked from commit 25d70768c460bad91aa65f367203af41122399cd)
Ye Li
1 parent 44069d2ae9
Showing 1 changed file with 42 additions and 2 deletions Side-by-side Diff
arch/arm/mach-imx/cache.c
@@ -10,6 +10,8 @@
 #include <asm/io.h>
 #include <asm/mach-imx/sys_proto.h>
  
+DECLARE_GLOBAL_DATA_PTR;
+
 static void enable_ca7_smp(void)
 {
 	u32 val;
  
  
@@ -39,12 +41,16 @@
 }
  
 #if !CONFIG_IS_ENABLED(SYS_DCACHE_OFF)
+
+#define ARMV7_DOMAIN_CLIENT	1
+#define ARMV7_DOMAIN_MASK	(0x3 << 0)
+
 void enable_caches(void)
 {
 #if defined(CONFIG_SYS_ARM_CACHE_WRITETHROUGH)
-	enum dcache_option option = DCACHE_WRITETHROUGH;
+	enum dcache_option option = DCACHE_WRITETHROUGH & ~TTB_SECT_XN_MASK;
 #else
-	enum dcache_option option = DCACHE_WRITEBACK;
+	enum dcache_option option = DCACHE_WRITEBACK & ~TTB_SECT_XN_MASK;
 #endif
 	/* Avoid random hang when download by usb */
 	invalidate_dcache_all();
@@ -63,6 +69,40 @@
 					IRAM_SIZE,
 					option);
 }
+
+void dram_bank_mmu_setup(int bank)
+{
+	bd_t *bd = gd->bd;
+	int	i;
+
+	debug("%s: bank: %d\n", __func__, bank);
+	for (i = bd->bi_dram[bank].start >> MMU_SECTION_SHIFT;
+	     i < (bd->bi_dram[bank].start >> MMU_SECTION_SHIFT) +
+		 (bd->bi_dram[bank].size >> MMU_SECTION_SHIFT);
+	     i++) {
+#if defined(CONFIG_SYS_ARM_CACHE_WRITETHROUGH)
+		set_section_dcache(i, DCACHE_WRITETHROUGH & ~TTB_SECT_XN_MASK);
+#elif defined(CONFIG_SYS_ARM_CACHE_WRITEALLOC)
+		set_section_dcache(i, DCACHE_WRITEALLOC & ~TTB_SECT_XN_MASK);
+#else
+		set_section_dcache(i, DCACHE_WRITEBACK & ~TTB_SECT_XN_MASK);
+#endif
+	}
+}
+
+void arm_init_domains(void)
+{
+	u32 reg;
+
+	reg = get_dacr();
+	/*
+	* Set domain to client to do access and XN check
+	*/
+	reg &= ~ARMV7_DOMAIN_MASK;
+	reg |= ARMV7_DOMAIN_CLIENT;
+	set_dacr(reg);
+}
+
 #else
 void enable_caches(void)
 {
...	...	@@ -10,6 +10,8 @@
10	10	#include <asm/io.h>
11	11	#include <asm/mach-imx/sys_proto.h>
12	12
	13	+DECLARE_GLOBAL_DATA_PTR;
	14	+
13	15	static void enable_ca7_smp(void)
14	16	{
15	17	u32 val;
16	18
17	19
...	...	@@ -39,12 +41,16 @@
39	41	}
40	42
41	43	#if !CONFIG_IS_ENABLED(SYS_DCACHE_OFF)
	44	+
	45	+#define ARMV7_DOMAIN_CLIENT 1
	46	+#define ARMV7_DOMAIN_MASK (0x3 << 0)
	47	+
42	48	void enable_caches(void)
43	49	{
44	50	#if defined(CONFIG_SYS_ARM_CACHE_WRITETHROUGH)
45		- enum dcache_option option = DCACHE_WRITETHROUGH;
	51	+ enum dcache_option option = DCACHE_WRITETHROUGH & ~TTB_SECT_XN_MASK;
46	52	#else
47		- enum dcache_option option = DCACHE_WRITEBACK;
	53	+ enum dcache_option option = DCACHE_WRITEBACK & ~TTB_SECT_XN_MASK;
48	54	#endif
49	55	/* Avoid random hang when download by usb */
50	56	invalidate_dcache_all();
...	...	@@ -63,6 +69,40 @@
63	69	IRAM_SIZE,
64	70	option);
65	71	}
	72	+
	73	+void dram_bank_mmu_setup(int bank)
	74	+{
	75	+ bd_t *bd = gd->bd;
	76	+ int i;
	77	+
	78	+ debug("%s: bank: %d\n", __func__, bank);
	79	+ for (i = bd->bi_dram[bank].start >> MMU_SECTION_SHIFT;
	80	+ i < (bd->bi_dram[bank].start >> MMU_SECTION_SHIFT) +
	81	+ (bd->bi_dram[bank].size >> MMU_SECTION_SHIFT);
	82	+ i++) {
	83	+#if defined(CONFIG_SYS_ARM_CACHE_WRITETHROUGH)
	84	+ set_section_dcache(i, DCACHE_WRITETHROUGH & ~TTB_SECT_XN_MASK);
	85	+#elif defined(CONFIG_SYS_ARM_CACHE_WRITEALLOC)
	86	+ set_section_dcache(i, DCACHE_WRITEALLOC & ~TTB_SECT_XN_MASK);
	87	+#else
	88	+ set_section_dcache(i, DCACHE_WRITEBACK & ~TTB_SECT_XN_MASK);
	89	+#endif
	90	+ }
	91	+}
	92	+
	93	+void arm_init_domains(void)
	94	+{
	95	+ u32 reg;
	96	+
	97	+ reg = get_dacr();
	98	+ /*
	99	+ * Set domain to client to do access and XN check
	100	+ */
	101	+ reg &= ~ARMV7_DOMAIN_MASK;
	102	+ reg \|= ARMV7_DOMAIN_CLIENT;
	103	+ set_dacr(reg);
	104	+}
	105	+
66	106	#else
67	107	void enable_caches(void)
68	108	{