From 48e1d350a0021a9a2f7e34041f28273dee9eb885 Mon Sep 17 00:00:00 2001 From: Jeenu Viswambharan Date: Thu, 15 Nov 2018 11:38:03 +0000 Subject: AArch64: Use SSBS for CVE_2018_3639 mitigation The Armv8.5 extensions introduces PSTATE.SSBS (Speculation Store Bypass Safe) bit to mitigate against Variant 4 vulnerabilities. Although an Armv8.5 feature, this can be implemented by CPUs implementing earlier version of the architecture. With this patch, when both PSTATE.SSBS is implemented and DYNAMIC_WORKAROUND_CVE_2018_3639 is active, querying for SMCCC_ARCH_WORKAROUND_2 via. SMCCC_ARCH_FEATURES call would return 1 to indicate that mitigation on the PE is either permanently enabled or not required. When SSBS is implemented, SCTLR_EL3.DSSBS is initialized to 0 at reset of every BL stage. This means that EL3 always executes with mitigation applied. For Cortex A76, if the PE implements SSBS, the existing mitigation (by using a different vector table, and tweaking CPU ACTLR2) is not used. Change-Id: Ib0386c5714184144d4747951751c2fc6ba4242b6 Signed-off-by: Jeenu Viswambharan --- include/common/aarch32/el3_common_macros.S | 6 +++++- include/common/aarch64/el3_common_macros.S | 5 ++++- 2 files changed, 9 insertions(+), 2 deletions(-) (limited to 'include/common') diff --git a/include/common/aarch32/el3_common_macros.S b/include/common/aarch32/el3_common_macros.S index 9b18ba38..24384232 100644 --- a/include/common/aarch32/el3_common_macros.S +++ b/include/common/aarch32/el3_common_macros.S @@ -177,9 +177,13 @@ * * SCTLR.V: Set to zero to select the normal exception vectors * with base address held in VBAR. + * + * SCTLR.DSSBS: Set to zero to disable speculation store bypass + * safe behaviour upon exception entry to EL3. * ------------------------------------------------------------- */ - ldr r0, =(SCTLR_RESET_VAL & ~(SCTLR_TE_BIT | SCTLR_EE_BIT | SCTLR_V_BIT)) + ldr r0, =(SCTLR_RESET_VAL & ~(SCTLR_TE_BIT | SCTLR_EE_BIT | \ + SCTLR_V_BIT | SCTLR_DSSBS_BIT)) stcopr r0, SCTLR isb .endif /* _init_sctlr */ diff --git a/include/common/aarch64/el3_common_macros.S b/include/common/aarch64/el3_common_macros.S index adfb54e6..008daca9 100644 --- a/include/common/aarch64/el3_common_macros.S +++ b/include/common/aarch64/el3_common_macros.S @@ -194,10 +194,13 @@ * SCTLR_EL3.SA: Set to zero to disable Stack Alignment check. * * SCTLR_EL3.A: Set to zero to disable Alignment fault checking. + * + * SCTLR.DSSBS: Set to zero to disable speculation store bypass + * safe behaviour upon exception entry to EL3. * ------------------------------------------------------------- */ mov_imm x0, (SCTLR_RESET_VAL & ~(SCTLR_EE_BIT | SCTLR_WXN_BIT \ - | SCTLR_SA_BIT | SCTLR_A_BIT)) + | SCTLR_SA_BIT | SCTLR_A_BIT | SCTLR_DSSBS_BIT)) msr sctlr_el3, x0 isb .endif /* _init_sctlr */ -- cgit v1.2.3