1/* 2 * Copyright (c) 2021-2026, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7#include <arch.h> 8#include <asm_macros.S> 9#include <common/bl_common.h> 10#include <cortex_x3.h> 11#include "wa_cve_2022_23960_bhb_vector.S" 12 13#include <cpu_macros.S> 14#include <wa_cve_2025_0647_cpprctx.h> 15 16#include <plat_macros.S> 17 18/* Hardware handled coherency */ 19#if HW_ASSISTED_COHERENCY == 0 20#error "Cortex-X3 must be compiled with HW_ASSISTED_COHERENCY enabled" 21#endif 22 23/* 64-bit only core */ 24#if CTX_INCLUDE_AARCH32_REGS == 1 25#error "Cortex-X3 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0" 26#endif 27 28.global check_erratum_cortex_x3_3701769 29 30#if WORKAROUND_CVE_2022_23960 31 wa_cve_2022_23960_bhb_vector_table CORTEX_X3_BHB_LOOP_COUNT, cortex_x3 32#endif /* WORKAROUND_CVE_2022_23960 */ 33 34cpu_reset_prologue cortex_x3 35 36workaround_reset_start cortex_x3, ERRATUM(2266875), ERRATA_X3_2266875 37 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(22) 38workaround_reset_end cortex_x3, ERRATUM(2266875) 39 40check_erratum_ls cortex_x3, ERRATUM(2266875), CPU_REV(1, 0) 41 42workaround_reset_start cortex_x3, ERRATUM(2302506), ERRATA_X3_2302506 43 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(0) 44workaround_reset_end cortex_x3, ERRATUM(2302506) 45 46check_erratum_ls cortex_x3, ERRATUM(2302506), CPU_REV(1, 1) 47 48.global erratum_cortex_x3_2313909_wa 49workaround_runtime_start cortex_x3, ERRATUM(2313909), ERRATA_X3_2313909 50 /* Set/unset bit 36 in ACTLR2_EL1. The first call will set it, applying 51 * the workaround. Second call clears it to undo it. */ 52 sysreg_bit_toggle CORTEX_X3_CPUACTLR2_EL1, CORTEX_X3_CPUACTLR2_EL1_BIT_36 53workaround_runtime_end cortex_x3, ERRATUM(2313909), NO_ISB 54 55check_erratum_ls cortex_x3, ERRATUM(2313909), CPU_REV(1, 0) 56 57workaround_reset_start cortex_x3, ERRATUM(2372204), ERRATA_X3_2372204 58 /* Set bit 40 in CPUACTLR2_EL1 */ 59 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(40) 60workaround_reset_end cortex_x3, ERRATUM(2372204) 61 62check_erratum_ls cortex_x3, ERRATUM(2372204), CPU_REV(1, 0) 63 64workaround_reset_start cortex_x3, ERRATUM(2615812), ERRATA_X3_2615812 65 /* Disable retention control for WFI and WFE. */ 66 mrs x0, CORTEX_X3_CPUPWRCTLR_EL1 67 bfi x0, xzr, #CORTEX_X3_CPUPWRCTLR_EL1_WFI_RET_CTRL_BITS_SHIFT, #3 68 bfi x0, xzr, #CORTEX_X3_CPUPWRCTLR_EL1_WFE_RET_CTRL_BITS_SHIFT, #3 69 msr CORTEX_X3_CPUPWRCTLR_EL1, x0 70workaround_reset_end cortex_x3, ERRATUM(2615812) 71 72check_erratum_ls cortex_x3, ERRATUM(2615812), CPU_REV(1, 1) 73 74workaround_reset_start cortex_x3, ERRATUM(2641945), ERRATA_X3_2641945 75 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 76workaround_reset_end cortex_x3, ERRATUM(2641945) 77 78check_erratum_ls cortex_x3, ERRATUM(2641945), CPU_REV(1, 0) 79 80workaround_reset_start cortex_x3, ERRATUM(2742421), ERRATA_X3_2742421 81 /* Set CPUACTLR5_EL1[56:55] to 2'b01 */ 82 sysreg_lazy_start CORTEX_X3_CPUACTLR5_EL1 83 sysreg_lazy_set CORTEX_X3_CPUACTLR5_EL1_BIT_55 84 sysreg_lazy_clear CORTEX_X3_CPUACTLR5_EL1_BIT_56 85 sysreg_lazy_commit CORTEX_X3_CPUACTLR5_EL1 86workaround_reset_end cortex_x3, ERRATUM(2742421) 87 88check_erratum_ls cortex_x3, ERRATUM(2742421), CPU_REV(1, 1) 89 90workaround_runtime_start cortex_x3, ERRATUM(2743088), ERRATA_X3_2743088 91 /* dsb before isb of power down sequence */ 92 dsb sy 93workaround_runtime_end cortex_x3, ERRATUM(2743088), NO_ISB 94 95check_erratum_ls cortex_x3, ERRATUM(2743088), CPU_REV(1, 1) 96 97workaround_reset_start cortex_x3, ERRATUM(2779509), ERRATA_X3_2779509 98 /* Set CPUACTLR3_EL1 bit 47 */ 99 sysreg_bit_set CORTEX_X3_CPUACTLR3_EL1, CORTEX_X3_CPUACTLR3_EL1_BIT_47 100workaround_reset_end cortex_x3, ERRATUM(2779509) 101 102check_erratum_ls cortex_x3, ERRATUM(2779509), CPU_REV(1, 1) 103 104workaround_reset_start cortex_x3, ERRATUM(3213672), ERRATA_X3_3213672 105 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(36) 106workaround_reset_end cortex_x3, ERRATUM(3213672) 107 108check_erratum_ls cortex_x3, ERRATUM(3213672), CPU_REV(1, 2) 109 110workaround_reset_start cortex_x3, ERRATUM(3692984), ERRATA_X3_3692984 111 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 112workaround_reset_end cortex_x3, ERRATUM(3692984) 113 114check_erratum_ls cortex_x3, ERRATUM(3692984), CPU_REV(1, 2) 115 116add_erratum_entry cortex_x3, ERRATUM(3701769), ERRATA_X3_3701769 117 118check_erratum_ls cortex_x3, ERRATUM(3701769), CPU_REV(1, 2) 119 120workaround_reset_start cortex_x3, ERRATUM(3827463), ERRATA_X3_3827463 121 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(1) 122workaround_reset_end cortex_x3, ERRATUM(3827463) 123 124check_erratum_ls cortex_x3, ERRATUM(3827463), CPU_REV(1, 1) 125 126workaround_reset_start cortex_x3, ERRATUM(3888125), ERRATA_X3_3888125 127 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(22) 128workaround_reset_end cortex_x3, ERRATUM(3888125) 129 130check_erratum_ls cortex_x3, ERRATUM(3888125), CPU_REV(1, 2) 131 132workaround_reset_start cortex_x3, ERRATUM(4302966), ERRATA_X3_4302966 133 sysreg_bit_set CORTEX_X3_CPUACTLR5_EL1, BIT(50) 134workaround_reset_end cortex_x3, ERRATUM(4302966) 135 136check_erratum_ls cortex_x3, ERRATUM(4302966), CPU_REV(1, 2) 137 138workaround_reset_start cortex_x3, CVE(2022, 23960), WORKAROUND_CVE_2022_23960 139#if IMAGE_BL31 140 override_vector_table wa_cve_vbar_cortex_x3 141#endif /* IMAGE_BL31 */ 142workaround_reset_end cortex_x3, CVE(2022, 23960) 143 144check_erratum_ls cortex_x3, CVE(2022, 23960), CPU_REV(1, 0) 145 146/* Disable hardware page aggregation. Enables mitigation for `CVE-2024-5660` */ 147workaround_reset_start cortex_x3, CVE(2024, 5660), WORKAROUND_CVE_2024_5660 148 sysreg_bit_set CORTEX_X3_CPUECTLR_EL1, BIT(46) 149workaround_reset_end cortex_x3, CVE(2024, 5660) 150 151check_erratum_ls cortex_x3, CVE(2024, 5660), CPU_REV(1, 2) 152 153 /* -------------------------------------------------------------- 154 * CVE-2024-7881 is mitigated for Cortex-X3 using erratum 3692984 155 * workaround by disabling the affected prefetcher setting 156 * CPUACTLR6_EL1[41]. 157 * -------------------------------------------------------------- 158 */ 159workaround_reset_start cortex_x3, CVE(2024, 7881), WORKAROUND_CVE_2024_7881 160 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 161workaround_reset_end cortex_x3, CVE(2024, 7881) 162 163check_erratum_ls cortex_x3, CVE(2024, 7881), CPU_REV(1, 2) 164 165 /* 166 * Instruction patch sequence to trap 'cpp rctx' instructions to EL3. 167 * Enables mitigation for CVE-2025-0647. 168 */ 169workaround_reset_start cortex_x3, CVE(2025, 647), WORKAROUND_CVE_2025_0647 170#if IMAGE_BL31 171 mov x0, #WA_PATCH_SLOT(3) 172 bl wa_cve_2025_0647_instruction_patch 173#endif /* IMAGE_BL31 */ 174workaround_reset_end cortex_x3, CVE(2025, 647) 175 176check_erratum_chosen cortex_x3, CVE(2025, 647), WORKAROUND_CVE_2025_0647 177 178#if WORKAROUND_CVE_2025_0647 179func cortex_x3_impl_defined_el3_handler 180 mov x0, #WA_LS_RCG_EN 181 182 /* See if this call came from trap handler. */ 183 cmp x1, #EC_IMP_DEF_EL3 184 bne wa_cve_2025_0647_do_cpp_wa 185 orr x0, x0, #WA_IS_TRAP_HANDLER 186 b wa_cve_2025_0647_do_cpp_wa 187endfunc cortex_x3_impl_defined_el3_handler 188#endif 189 190cpu_reset_func_start cortex_x3 191 /* Disable speculative loads */ 192 msr SSBS, xzr 193 enable_mpmm 194cpu_reset_func_end cortex_x3 195 196 /* ---------------------------------------------------- 197 * HW will do the cache maintenance while powering down 198 * ---------------------------------------------------- 199 */ 200func cortex_x3_core_pwr_dwn 201 apply_erratum cortex_x3, ERRATUM(2313909), ERRATA_X3_2313909 202 /* --------------------------------------------------- 203 * Enable CPU power down bit in power control register 204 * --------------------------------------------------- 205 */ 206 sysreg_bit_set CORTEX_X3_CPUPWRCTLR_EL1, CORTEX_X3_CPUPWRCTLR_EL1_CORE_PWRDN_BIT 207 apply_erratum cortex_x3, ERRATUM(2743088), ERRATA_X3_2743088, NO_GET_CPU_REV 208 isb 209 ret 210endfunc cortex_x3_core_pwr_dwn 211 212 /* --------------------------------------------- 213 * This function provides Cortex-X3- 214 * specific register information for crash 215 * reporting. It needs to return with x6 216 * pointing to a list of register names in ascii 217 * and x8 - x15 having values of registers to be 218 * reported. 219 * --------------------------------------------- 220 */ 221.section .rodata.cortex_x3_regs, "aS" 222cortex_x3_regs: /* The ascii list of register names to be reported */ 223 .asciz "cpuectlr_el1", "" 224 225func cortex_x3_cpu_reg_dump 226 adr x6, cortex_x3_regs 227 mrs x8, CORTEX_X3_CPUECTLR_EL1 228 ret 229endfunc cortex_x3_cpu_reg_dump 230 231#if WORKAROUND_CVE_2025_0647 && IMAGE_BL31 232declare_cpu_ops_eh cortex_x3, CORTEX_X3_MIDR, \ 233 cortex_x3_reset_func, \ 234 cortex_x3_impl_defined_el3_handler, \ 235 cortex_x3_core_pwr_dwn 236#else 237declare_cpu_ops cortex_x3, CORTEX_X3_MIDR, \ 238 cortex_x3_reset_func, \ 239 cortex_x3_core_pwr_dwn 240#endif 241