From 56bb1d172ccee56e984559de69e8ebd8683d491b Mon Sep 17 00:00:00 2001 From: Arvind Ram Prakash Date: Fri, 6 Sep 2024 12:20:38 -0500 Subject: [PATCH] fix(security): add CVE-2024-7881 mitigation to Neoverse-V2 This patch mitigates CVE-2024-7881 [1] by setting CPUACTLR6_EL1[41] to 1 for Neoverse-V2 CPU. [1]: https://developer.arm.com/Arm%20Security%20Center/Arm%20CPU%20Vulnerability%20CVE-2024-7881 Signed-off-by: Arvind Ram Prakash Change-Id: I129814eb3494b287fd76a3f7dbc50f76553b2565 --- include/lib/cpus/aarch64/neoverse_v2.h | 7 ++++++- lib/cpus/aarch64/neoverse_v2.S | 13 ++++++++++++- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/include/lib/cpus/aarch64/neoverse_v2.h b/include/lib/cpus/aarch64/neoverse_v2.h index 1171e9523..427cafa86 100644 --- a/include/lib/cpus/aarch64/neoverse_v2.h +++ b/include/lib/cpus/aarch64/neoverse_v2.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2021-2023, Arm Limited. All rights reserved. + * Copyright (c) 2021-2025, Arm Limited. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -58,4 +58,9 @@ #define NEOVERSE_V2_CPUACTLR5_EL1_BIT_56 (ULL(1) << 56) #define NEOVERSE_V2_CPUACTLR5_EL1_BIT_55 (ULL(1) << 55) +/******************************************************************************* + * CPU Auxiliary control register 6 specific definitions + ******************************************************************************/ +#define NEOVERSE_V2_CPUACTLR6_EL1 S3_0_C15_C8_1 + #endif /* NEOVERSE_V2_H */ diff --git a/lib/cpus/aarch64/neoverse_v2.S b/lib/cpus/aarch64/neoverse_v2.S index f56a5e86d..56b512455 100644 --- a/lib/cpus/aarch64/neoverse_v2.S +++ b/lib/cpus/aarch64/neoverse_v2.S @@ -1,5 +1,5 @@ /* - * Copyright (c) 2021-2024, Arm Limited. All rights reserved. + * Copyright (c) 2021-2025, Arm Limited. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -97,6 +97,17 @@ check_erratum_chosen neoverse_v2, CVE(2022, 23960), WORKAROUND_CVE_2022_23960 wa_cve_2022_23960_bhb_vector_table NEOVERSE_V2_BHB_LOOP_COUNT, neoverse_v2 #endif /* WORKAROUND_CVE_2022_23960 */ +workaround_reset_start neoverse_v2, CVE(2024, 7881), WORKAROUND_CVE_2024_7881 + /* --------------------------------- + * Sets BIT41 of CPUACTLR6_EL1 which + * disables L1 Data cache prefetcher + * --------------------------------- + */ + sysreg_bit_set NEOVERSE_V2_CPUACTLR6_EL1, BIT(41) +workaround_reset_end neoverse_v2, CVE(2024, 7881) + +check_erratum_chosen neoverse_v2, CVE(2024, 7881), WORKAROUND_CVE_2024_7881 + /* ---------------------------------------------------- * HW will do the cache maintenance while powering down * ----------------------------------------------------