Add workaround for errata 1073348 for Cortex-A76

Concurrent instruction TLB miss and mispredicted return instruction
might fetch wrong instruction stream. Set bit 6 of CPUACTLR_EL1 to
prevent this.

Change-Id: I2da4f30cd2df3f5e885dd3c4825c557492d1ac58
Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>

docs/cpu-specific-build-macros.rst

@@ -147,6 +147,9 @@ For Cortex-A75, the following errata build flags are defined :
 
 For Cortex-A76, the following errata build flags are defined :
 
+-  ``ERRATA_A76_1073348``: This applies errata 1073348 workaround to Cortex-A76
+   CPU. This needs to be enabled only for revision <= r1p0 of the CPU.
+
 -  ``ERRATA_A76_1130799``: This applies errata 1130799 workaround to Cortex-A76
    CPU. This needs to be enabled only for revision <= r2p0 of the CPU.
 

include/lib/cpus/aarch64/cortex_a76.h

@@ -23,6 +23,10 @@
 /*******************************************************************************
  * CPU Auxiliary Control register specific definitions.
  ******************************************************************************/
+#define CORTEX_A76_CPUACTLR_EL1		S3_0_C15_C1_0
+
+#define CORTEX_A76_CPUACTLR_EL1_DISABLE_STATIC_PREDICTION	(ULL(1) << 6)
+
 #define CORTEX_A76_CPUACTLR2_EL1	S3_0_C15_C1_1
 
 #define CORTEX_A76_CPUACTLR2_EL1_DISABLE_LOAD_PASS_STORE	(ULL(1) << 16)

lib/cpus/aarch64/cortex_a76.S

@@ -189,6 +189,34 @@ vector_entry cortex_a76_serror_aarch32
 	b	serror_aarch32
 end_vector_entry cortex_a76_serror_aarch32
 
+	/* --------------------------------------------------
+	 * Errata Workaround for Cortex A76 Errata #1073348.
+	 * This applies only to revision <= r1p0 of Cortex A76.
+	 * Inputs:
+	 * x0: variant[4:7] and revision[0:3] of current cpu.
+	 * Shall clobber: x0-x17
+	 * --------------------------------------------------
+	 */
+func errata_a76_1073348_wa
+	/*
+	 * Compare x0 against revision r1p0
+	 */
+	mov	x17, x30
+	bl	check_errata_1073348
+	cbz	x0, 1f
+	mrs	x1, CORTEX_A76_CPUACTLR_EL1
+	orr	x1, x1 ,#CORTEX_A76_CPUACTLR_EL1_DISABLE_STATIC_PREDICTION
+	msr	CORTEX_A76_CPUACTLR_EL1, x1
+	isb
+1:
+	ret	x17
+	endfunc errata_a76_1073348_wa
+
+func check_errata_1073348
+	mov	x1, #0x10
+	b	cpu_rev_var_ls
+endfunc check_errata_1073348
+
 	/* --------------------------------------------------
 	 * Errata Workaround for Cortex A76 Errata #1130799.
 	 * This applies only to revision <= r2p0 of Cortex A76.
@@ -272,6 +300,11 @@ func cortex_a76_reset_func
 	bl	cpu_get_rev_var
 	mov	x18, x0
 
+#if ERRATA_A76_1073348
+	mov	x0, x18
+	bl	errata_a76_1073348_wa
+#endif
+
 #if ERRATA_A76_1130799
 	mov	x0, x18
 	bl	errata_a76_1130799_wa
@@ -344,6 +377,7 @@ func cortex_a76_errata_report
 	 * Report all errata. The revision-variant information is passed to
 	 * checking functions of each errata.
 	 */
+	report_errata ERRATA_A76_1073348, cortex_a76, 1073348
 	report_errata ERRATA_A76_1130799, cortex_a76, 1130799
 	report_errata ERRATA_A76_1220197, cortex_a76, 1220197
 	report_errata WORKAROUND_CVE_2018_3639, cortex_a76, cve_2018_3639

lib/cpus/cpu-ops.mk

@@ -131,6 +131,10 @@ ERRATA_A75_764081	?=0
 # only to revision <= r0p0 of the Cortex A75 cpu.
 ERRATA_A75_790748	?=0
 
+# Flag to apply erratum 1073348 workaround during reset. This erratum applies
+# only to revision <= r1p0 of the Cortex A76 cpu.
+ERRATA_A76_1073348	?=0
+
 # Flag to apply erratum 1130799 workaround during reset. This erratum applies
 # only to revision <= r2p0 of the Cortex A76 cpu.
 ERRATA_A76_1130799	?=0
@@ -220,6 +224,10 @@ $(eval $(call add_define,ERRATA_A75_764081))
 $(eval $(call assert_boolean,ERRATA_A75_790748))
 $(eval $(call add_define,ERRATA_A75_790748))
 
+# Process ERRATA_A76_1073348 flag
+$(eval $(call assert_boolean,ERRATA_A76_1073348))
+$(eval $(call add_define,ERRATA_A76_1073348))
+
 # Process ERRATA_A76_1130799 flag
 $(eval $(call assert_boolean,ERRATA_A76_1130799))
 $(eval $(call add_define,ERRATA_A76_1130799))