fix(security): workaround for C1-Pro/CME CVE-2026-0995

This SME erratum in C1-Pro means memory accesses from the CME unit can
remain outstanding after another CPU issues TLBI+DSB. This means SME
can access memory after it has been re-allocated, potentially
overwriting the new owner's data. With pKVM, this could allow the host
access to guest memory if the SME accesses survived the page being
donated to HYP and allocated to the guest.

The workaround is for all affected CPUs to issue DSB locally whenever
another CPU does TLB maintenance. The local DSB completes all
outstanding accesses.

Linux and pKVM share a security state in the GIC, meaning pKVM would
be exposed to interrupt blackouts caused by linux. It is difficult
for the non secure world to avoid races when an SGI is sent to a CPU
that is about go offline and can no longer take the interrupt.
(this would violate the PSCI rules for CPU_OFF calls).

Implement the workaround in EL3 using an SMC in the 'CPU vendor' space.
The workaround uses atomic_inc_return on a global counter to order
parallel callers. This gives each caller a deadline.
Secure SGI are sent to the affected C1 Pro CPUs causing them to run
the workaround, and update their local counter from the global counter.
The CPU that issued the SMC then waits for each SGI'd CPU to update
to at least the deadline from its call.

An SGI being sent can race with an SMC to PSCI CPU_OFF. To avoid
this SGI preventing the CPU from enterring WFI to power off, the
workaround is run pre-emptively and the SGI is masked at the GIC
redistributor.

This mitigation is coordinated with corresponding Operating System
updates for CVE-2026-0995. Both EL3 (TF-A) and the OS must include
their respective fixes to ensure complete mitigation. For example,
the Linux kernel implements a complementary workaround that must
be deployed alongside this TF-A update.

Linux commit:
https://lore.kernel.org/all/20260302165801.3014607-1-catalin.marinas@arm.com/

Ref: https://developer.arm.com/documentation/111823/latest/

Change-Id: Ie969354ad0693fe172d921953b87cfbf4a39ea8e
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Manish Pandey <manish.pandey2@arm.com>
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/services/cpu/cpu_svc.c b/services/cpu/cpu_svc.c
index 733cadd67..66acbbb72 100644
--- a/services/cpu/cpu_svc.c
+++ b/services/cpu/cpu_svc.c
@@ -6,6 +6,7 @@
 
 #include <stdint.h>
 
+#include <c1_pro.h>
 #include <common/debug.h>
 #include <common/runtime_svc.h>
 #include <services/cpu_svc.h>
@@ -18,6 +19,12 @@ DEFINE_SVC_UUID2(cpu_svc_uid,
 
 static int cpu_svc_setup(void)
 {
+#if WORKAROUND_CVE_2026_0995
+	if (c1_pro_cve_2026_0995_init()) {
+		return 1;
+	}
+#endif /* WORKAROUND_CVE_2026_0995 */
+
 	return 0;
 }
 
@@ -42,6 +49,17 @@ static uintptr_t cpu_svc_handler(unsigned int smc_fid,
 	case CPU_SVC_VERSION:
 		SMC_RET2(handle, CPU_SVC_VERSION_MAJOR, CPU_SVC_VERSION_MINOR);
 		break;
+
+#if WORKAROUND_CVE_2026_0995
+	case C1_PRO_CPU_SMC_HANDLER_32:
+		if (c1_pro_cve_2026_0995_applies()) {
+			return c1_pro_cve_2026_0995_smc_handler(x1, handle);
+		}
+
+		SMC_RET1(handle, SMC_DENIED);
+		break;
+#endif /* WORKAROUND_CVE_2026_0995 */
+
 	default:
 		WARN("Unimplemented CPU Service call: 0x%x\n", smc_fid);
 		SMC_RET1(handle, SMC_UNK);