Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-04-30 07:39:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

aarch32: stop speculative execution past exception returns

Browse source 
aarch32 CPUs speculatively execute instructions following a
ERET as if it was not a jump instruction. This could lead to
cache-based side channel vulnerabilities. The software fix is
to place barrier instructions following ERET.

The counterpart patch for aarch64 is merged:
https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/commit/?id=f461fe346b728d0e88142fd7b8f2816415af18bc

Change-Id: I2aa3105bee0b92238f389830b3a3b8650f33af3d
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>
This commit is contained in:
Madhukar Pappireddy 2020-02-26 12:37:05 -06:00
parent 2403813779
commit 6bc243825f
4 changed files with 17 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
bl1/aarch32/bl1_exceptions.S
View file

@ -80,7 +80,7 @@ debug_loop:
add r8, r8, #ENTRY_POINT_INFO_ARGS_OFFSET add r8, r8, #ENTRY_POINT_INFO_ARGS_OFFSET
ldm r8, {r0, r1, r2, r3} ldm r8, {r0, r1, r2, r3}
eret exception_return
endfunc bl1_aarch32_smc_handler endfunc bl1_aarch32_smc_handler
/* ----------------------------------------------------- /* -----------------------------------------------------

2
bl2/aarch32/bl2_el3_entrypoint.S
View file

@ -87,5 +87,5 @@ func bl2_run_next_image
add r8, r8, #ENTRY_POINT_INFO_ARGS_OFFSET add r8, r8, #ENTRY_POINT_INFO_ARGS_OFFSET
ldm r8, {r0, r1, r2, r3} ldm r8, {r0, r1, r2, r3}
eret exception_return
endfunc bl2_run_next_image endfunc bl2_run_next_image

15
include/arch/aarch32/asm_macros.S
View file

@ -95,11 +95,24 @@
#if ARM_ARCH_MAJOR == 7 && !defined(ARMV7_SUPPORTS_VIRTUALIZATION) #if ARM_ARCH_MAJOR == 7 && !defined(ARMV7_SUPPORTS_VIRTUALIZATION)
/* /*
* Macro for mitigating against speculative execution.
* ARMv7 cores without Virtualization extension do not support the * ARMv7 cores without Virtualization extension do not support the
* eret instruction. * eret instruction.
*/ */
.macro eret .macro exception_return
movs pc, lr movs pc, lr
dsb nsh
isb
.endm
#else
/*
* Macro for mitigating against speculative execution beyond ERET.
*/
.macro exception_return
eret
dsb nsh
isb
.endm .endm
#endif #endif

2
include/arch/aarch32/smccc_macros.S
View file

@ -235,7 +235,7 @@
/* Restore the rest of the general purpose registers */ /* Restore the rest of the general purpose registers */
ldm r0, {r0-r12} ldm r0, {r0-r12}
eret exception_return
.endm .endm
#endif /* SMCCC_MACROS_S */ #endif /* SMCCC_MACROS_S */