cpus: denver: Implement static workaround for CVE-2018-3639

For Denver CPUs, this approach enables the mitigation during EL3
initialization, following every PE reset. No mechanism is provided to
disable the mitigation at runtime.

This approach permanently mitigates the EL3 software stack only. Other
software components are responsible to enable it for their exception
levels.

TF-A implements this approach for the Denver CPUs with DENVER_MIDR_PN3
and earlier:

*   By setting bit 11 (Disable speculative store buffering) of
    `ACTLR_EL3`

*   By setting bit 9 (Disable speculative memory disambiguation) of
    `ACTLR_EL3`

TF-A implements this approach for the Denver CPUs with DENVER_MIDR_PN4
and later:

*   By setting bit 18 (Disable speculative store buffering) of
    `ACTLR_EL3`

*   By setting bit 17 (Disable speculative memory disambiguation) of
    `ACTLR_EL3`

Change-Id: If1de96605ce3f7b0aff5fab2c828e5aecb687555
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

diff --git a/include/lib/cpus/aarch64/denver.h b/include/lib/cpus/aarch64/denver.h
index f145fbb590faccac6626556020030af46ca0d5e9..712a4a437f5109a89accc802cd9c23ee22491b08 100644 (file)
--- a/include/lib/cpus/aarch64/denver.h
+++ b/include/lib/cpus/aarch64/denver.h
@@ -20,6 +20,14 @@
 /* CPU state ids - implementation defined */
 #define DENVER_CPU_STATE_POWER_DOWN    U(0x3)
 
+/* Speculative store buffering */
+#define DENVER_CPU_DIS_SSB_EL3         (U(1) << 11)
+#define DENVER_PN4_CPU_DIS_SSB_EL3     (U(1) << 18)
+
+/* Speculative memory disambiguation */
+#define DENVER_CPU_DIS_MD_EL3          (U(1) << 9)
+#define DENVER_PN4_CPU_DIS_MD_EL3      (U(1) << 17)
+
 /* Core power management states */
 #define DENVER_CPU_PMSTATE_C1          U(0x1)
 #define DENVER_CPU_PMSTATE_C6          U(0x6)

diff --git a/lib/cpus/aarch64/denver.S b/lib/cpus/aarch64/denver.S
index c873f2e3ee67d440930d750d934754c70f007f12..c377b28b437ad00f059fce871e9ed83f020b7e24 100644 (file)
--- a/lib/cpus/aarch64/denver.S
+++ b/lib/cpus/aarch64/denver.S
@@ -211,6 +211,15 @@ func check_errata_cve_2017_5715
        ret
 endfunc check_errata_cve_2017_5715
 
+func check_errata_cve_2018_3639
+#if WORKAROUND_CVE_2018_3639
+       mov     x0, #ERRATA_APPLIES
+#else
+       mov     x0, #ERRATA_MISSING
+#endif
+       ret
+endfunc check_errata_cve_2018_3639
+
        /* -------------------------------------------------
         * The CPU Ops reset function for Denver.
         * -------------------------------------------------
@@ -236,6 +245,25 @@ func denver_reset_func
        msr     vbar_el3, x0
 #endif
 
+#if WORKAROUND_CVE_2018_3639
+       /*
+        * Denver CPUs with DENVER_MIDR_PN3 or earlier, use different
+        * bits in the ACTLR_EL3 register to disable speculative
+        * store buffer and memory disambiguation.
+        */
+       mrs     x0, midr_el1
+       mov_imm x1, DENVER_MIDR_PN4
+       cmp     x0, x1
+       mrs     x0, actlr_el3
+       mov     x1, #(DENVER_CPU_DIS_MD_EL3 | DENVER_CPU_DIS_SSB_EL3)
+       mov     x2, #(DENVER_PN4_CPU_DIS_MD_EL3 | DENVER_PN4_CPU_DIS_SSB_EL3)
+       csel    x3, x1, x2, ne
+       orr     x0, x0, x3
+       msr     actlr_el3, x0
+       isb
+       dsb     sy
+#endif
+
        /* ----------------------------------------------------
         * Reset ACTLR.PMSTATE to C1 state
         * ----------------------------------------------------
@@ -294,6 +322,7 @@ func denver_errata_report
         * checking functions of each errata.
         */
        report_errata WORKAROUND_CVE_2017_5715, denver, cve_2017_5715
+       report_errata WORKAROUND_CVE_2018_3639, denver, cve_2018_3639
 
        ldp     x8, x30, [sp], #16
        ret