Workaround for CVE-2017-5715 for Cortex A9, A15 and A17

A per-cpu vbar is installed that implements the workaround by
invalidating the branch target buffer (BTB) directly in the case of A9
and A17 and indirectly by invalidating the icache in the case of A15.

For Cortex A57 and A72 there is currently no workaround implemented
when EL3 is in AArch32 mode so report it as missing.

For other vulnerable CPUs (e.g. Cortex A73 and Cortex A75), there are
no changes since there is currently no upstream AArch32 EL3 support
for these CPUs.

Change-Id: Ib42c6ef0b3c9ff2878a9e53839de497ff736258f
Signed-off-by: Dimitris Papastamos <[email protected]>

diff --git a/include/lib/cpus/aarch32/cortex_a15.h b/include/lib/cpus/aarch32/cortex_a15.h
index 905c139dab826b5e6f76923c32ac6315c909efea..0f01a4336740d2d0510614dafe945ee6aeddf5e6 100644 (file)
--- a/include/lib/cpus/aarch32/cortex_a15.h
+++ b/include/lib/cpus/aarch32/cortex_a15.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2018, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -15,6 +15,7 @@
 /*******************************************************************************
  * CPU Auxiliary Control register specific definitions.
  ******************************************************************************/
+#define CORTEX_A15_ACTLR_INV_BTB_BIT   (1 << 0)
 #define CORTEX_A15_ACTLR_SMP_BIT       (1 << 6)
 
 #endif /* __CORTEX_A15_H__ */

diff --git a/lib/cpus/aarch32/cortex_a15.S b/lib/cpus/aarch32/cortex_a15.S
index 0d5a1165820075354186a1d25283c23465ac2010..b6c61ab7f57a4d7a5d94f6d0a8640bb8b3587d5b 100644 (file)
--- a/lib/cpus/aarch32/cortex_a15.S
+++ b/lib/cpus/aarch32/cortex_a15.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2018, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -41,7 +41,46 @@ func cortex_a15_enable_smp
        bx      lr
 endfunc cortex_a15_enable_smp
 
+func check_errata_cve_2017_5715
+#if WORKAROUND_CVE_2017_5715
+       mov     r0, #ERRATA_APPLIES
+#else
+       mov     r0, #ERRATA_MISSING
+#endif
+       bx      lr
+endfunc check_errata_cve_2017_5715
+
+#if REPORT_ERRATA
+/*
+ * Errata printing function for Cortex A15. Must follow AAPCS.
+ */
+func cortex_a15_errata_report
+       push    {r12, lr}
+
+       bl      cpu_get_rev_var
+       mov     r4, r0
+
+       /*
+        * Report all errata. The revision-variant information is passed to
+        * checking functions of each errata.
+        */
+       report_errata WORKAROUND_CVE_2017_5715, cortex_a15, cve_2017_5715
+
+       pop     {r12, lr}
+       bx      lr
+endfunc cortex_a15_errata_report
+#endif
+
 func cortex_a15_reset_func
+#if IMAGE_BL32 && WORKAROUND_CVE_2017_5715
+       ldcopr  r0, ACTLR
+       orr     r0, #CORTEX_A15_ACTLR_INV_BTB_BIT
+       stcopr  r0, ACTLR
+       ldr     r0, =workaround_icache_inv_runtime_exceptions
+       stcopr  r0, VBAR
+       stcopr  r0, MVBAR
+       /* isb will be applied in the course of the reset func */
+#endif
        b       cortex_a15_enable_smp
 endfunc cortex_a15_reset_func
 

diff --git a/lib/cpus/aarch32/cortex_a17.S b/lib/cpus/aarch32/cortex_a17.S
index 316d4f053c2526dc815cf5fe709d4b9c7aaf8250..b84c1267198f9bdeb152df3bf6b1b37667cec0e3 100644 (file)
--- a/lib/cpus/aarch32/cortex_a17.S
+++ b/lib/cpus/aarch32/cortex_a17.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2017-2018, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -35,7 +35,43 @@ func cortex_a17_enable_smp
        bx      lr
 endfunc cortex_a17_enable_smp
 
+func check_errata_cve_2017_5715
+#if WORKAROUND_CVE_2017_5715
+       mov     r0, #ERRATA_APPLIES
+#else
+       mov     r0, #ERRATA_MISSING
+#endif
+       bx      lr
+endfunc check_errata_cve_2017_5715
+
+#if REPORT_ERRATA
+/*
+ * Errata printing function for Cortex A17. Must follow AAPCS.
+ */
+func cortex_a17_errata_report
+       push    {r12, lr}
+
+       bl      cpu_get_rev_var
+       mov     r4, r0
+
+       /*
+        * Report all errata. The revision-variant information is passed to
+        * checking functions of each errata.
+        */
+       report_errata WORKAROUND_CVE_2017_5715, cortex_a17, cve_2017_5715
+
+       pop     {r12, lr}
+       bx      lr
+endfunc cortex_a17_errata_report
+#endif
+
 func cortex_a17_reset_func
+#if IMAGE_BL32 && WORKAROUND_CVE_2017_5715
+       ldr     r0, =workaround_bpiall_runtime_exceptions
+       stcopr  r0, VBAR
+       stcopr  r0, MVBAR
+       /* isb will be applied in the course of the reset func */
+#endif
        b       cortex_a17_enable_smp
 endfunc cortex_a17_reset_func
 

diff --git a/lib/cpus/aarch32/cortex_a57.S b/lib/cpus/aarch32/cortex_a57.S
index 64a6d6745170a88f23fc9cfce2c516b896c3010d..f446bfffaa5459fbefcc45dc8beb70607ea57c54 100644 (file)
--- a/lib/cpus/aarch32/cortex_a57.S
+++ b/lib/cpus/aarch32/cortex_a57.S
@@ -332,6 +332,11 @@ func check_errata_859972
        b       cpu_rev_var_ls
 endfunc check_errata_859972
 
+func check_errata_cve_2017_5715
+       mov     r0, #ERRATA_MISSING
+       bx      lr
+endfunc check_errata_cve_2017_5715
+
        /* -------------------------------------------------
         * The CPU Ops reset function for Cortex-A57.
         * Shall clobber: r0-r6
@@ -519,6 +524,7 @@ func cortex_a57_errata_report
        report_errata ERRATA_A57_829520, cortex_a57, 829520
        report_errata ERRATA_A57_833471, cortex_a57, 833471
        report_errata ERRATA_A57_859972, cortex_a57, 859972
+       report_errata WORKAROUND_CVE_2017_5715, cortex_a57, cve_2017_5715
 
        pop     {r12, lr}
        bx      lr

diff --git a/lib/cpus/aarch32/cortex_a72.S b/lib/cpus/aarch32/cortex_a72.S
index 75505206430b49759dc1e63790c4234502f516d1..878e6b19ec24194d147e65d2ead62c5c90adb4bb 100644 (file)
--- a/lib/cpus/aarch32/cortex_a72.S
+++ b/lib/cpus/aarch32/cortex_a72.S
@@ -87,6 +87,10 @@ func check_errata_859971
        b               cpu_rev_var_ls
 endfunc check_errata_859971
 
+func check_errata_cve_2017_5715
+       mov     r0, #ERRATA_MISSING
+       bx      lr
+endfunc check_errata_cve_2017_5715
 
        /* -------------------------------------------------
         * The CPU Ops reset function for Cortex-A72.
@@ -236,6 +240,7 @@ func cortex_a72_errata_report
         * checking functions of each errata.
         */
        report_errata ERRATA_A72_859971, cortex_a72, 859971
+       report_errata WORKAROUND_CVE_2017_5715, cortex_a72, cve_2017_5715
 
        pop     {r12, lr}
        bx      lr

diff --git a/lib/cpus/aarch32/cortex_a9.S b/lib/cpus/aarch32/cortex_a9.S
index 4f30f84a941b91edb39a9835a187d62c8f30b0e9..1fb10b2054dceb3e3911cf2c5572c3bc43e30793 100644 (file)
--- a/lib/cpus/aarch32/cortex_a9.S
+++ b/lib/cpus/aarch32/cortex_a9.S
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016, ARM Limited and Contributors. All rights reserved.
+ * Copyright (c) 2016-2018, ARM Limited and Contributors. All rights reserved.
  *
  * SPDX-License-Identifier: BSD-3-Clause
  */
@@ -35,7 +35,43 @@ func cortex_a9_enable_smp
        bx      lr
 endfunc cortex_a9_enable_smp
 
+func check_errata_cve_2017_5715
+#if WORKAROUND_CVE_2017_5715
+       mov     r0, #ERRATA_APPLIES
+#else
+       mov     r0, #ERRATA_MISSING
+#endif
+       bx      lr
+endfunc check_errata_cve_2017_5715
+
+#if REPORT_ERRATA
+/*
+ * Errata printing function for Cortex A9. Must follow AAPCS.
+ */
+func cortex_a9_errata_report
+       push    {r12, lr}
+
+       bl      cpu_get_rev_var
+       mov     r4, r0
+
+       /*
+        * Report all errata. The revision-variant information is passed to
+        * checking functions of each errata.
+        */
+       report_errata WORKAROUND_CVE_2017_5715, cortex_a9, cve_2017_5715
+
+       pop     {r12, lr}
+       bx      lr
+endfunc cortex_a9_errata_report
+#endif
+
 func cortex_a9_reset_func
+#if IMAGE_BL32 && WORKAROUND_CVE_2017_5715
+       ldr     r0, =workaround_bpiall_runtime_exceptions
+       stcopr  r0, VBAR
+       stcopr  r0, MVBAR
+       /* isb will be applied in the course of the reset func */
+#endif
        b       cortex_a9_enable_smp
 endfunc cortex_a9_reset_func