1/* 2 * Copyright (c) 2023-2026, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7#include <arch.h> 8#include <asm_macros.S> 9#include <c1_ultra.h> 10#include <common/bl_common.h> 11#include <cpu_macros.S> 12#include <wa_cve_2025_0647_cpprctx.h> 13 14#include <plat_macros.S> 15 16/* Hardware handled coherency */ 17#if HW_ASSISTED_COHERENCY == 0 18#error "Arm C1-Ultra must be compiled with HW_ASSISTED_COHERENCY enabled" 19#endif 20 21/* 64-bit only core */ 22#if CTX_INCLUDE_AARCH32_REGS == 1 23#error "Arm C1-Ultra supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0" 24#endif 25 26cpu_reset_prologue c1_ultra 27 28workaround_runtime_start c1_ultra, ERRATUM(3324333), ERRATA_C1ULTRA_3324333 29 speculation_barrier 30workaround_runtime_end c1_ultra, ERRATUM(3324333) 31 32check_erratum_ls c1_ultra, ERRATUM(3324333), CPU_REV(0, 0) 33 34workaround_reset_start c1_ultra, ERRATUM(3502731), ERRATA_C1ULTRA_3502731 35 sysreg_bit_set C1_ULTRA_IMP_CPUACTLR4_EL1, BIT(23) 36workaround_reset_end c1_ultra, ERRATUM(3502731) 37 38check_erratum_ls c1_ultra, ERRATUM(3502731), CPU_REV(0, 0) 39 40.global check_erratum_c1_ultra_3658374 41add_erratum_entry c1_ultra, ERRATUM(3658374), ERRATA_C1ULTRA_3658374 42check_erratum_ls c1_ultra, ERRATUM(3658374), CPU_REV(1, 0) 43 44workaround_reset_start c1_ultra, ERRATUM(3684152), ERRATA_C1ULTRA_3684152 45 sysreg_bitfield_insert C1_ULTRA_IMP_CPUACTLR_EL1, C1_ULTRA_IMP_CPUACTLR_EL1_LOAD_BIT, \ 46 C1_ULTRA_IMP_CPUACTLR_EL1_LOAD_SHIFT, C1_ULTRA_IMP_CPUACTLR_EL1_LOAD_WIDTH 47workaround_reset_end c1_ultra, ERRATUM(3684152) 48 49check_erratum_ls c1_ultra, ERRATUM(3684152), CPU_REV(0, 0) 50 51workaround_reset_start c1_ultra, ERRATUM(3705939), ERRATA_C1ULTRA_3705939 52 sysreg_bit_set C1_ULTRA_IMP_CPUACTLR_EL1, BIT(48) 53workaround_reset_end c1_ultra, ERRATUM(3705939) 54 55check_erratum_ls c1_ultra, ERRATUM(3705939), CPU_REV(1, 0) 56 57workaround_reset_start c1_ultra, ERRATUM(3815514), ERRATA_C1ULTRA_3815514 58 sysreg_bit_set C1_ULTRA_IMP_CPUACTLR5_EL1, BIT(13) 59workaround_reset_end c1_ultra, ERRATUM(3815514) 60 61check_erratum_ls c1_ultra, ERRATUM(3815514), CPU_REV(1, 0) 62 63workaround_reset_start c1_ultra, ERRATUM(3865171), ERRATA_C1ULTRA_3865171 64 sysreg_bit_set C1_ULTRA_IMP_CPUACTLR2_EL1, BIT(22) 65workaround_reset_end c1_ultra, ERRATUM(3865171) 66 67check_erratum_ls c1_ultra, ERRATUM(3865171), CPU_REV(1, 0) 68 69workaround_reset_start c1_ultra, ERRATUM(3926381), ERRATA_C1ULTRA_3926381 70 /* Convert WFx to NOP */ 71 ldr x0,=0x0 72 msr C1_ULTRA_IMP_CPUPSELR_EL3, x0 73 ldr x0,=0xD503205f 74 msr C1_ULTRA_IMP_CPUPOR_EL3, x0 75 ldr x0,=0xFFFFFFDF 76 msr C1_ULTRA_IMP_CPUPMR_EL3, x0 77 ldr x0,=0x1000002043ff 78 msr C1_ULTRA_IMP_CPUPCR_EL3, x0 79 /* Convert WFxT to NOP */ 80 ldr x0,=0x1 81 msr C1_ULTRA_IMP_CPUPSELR_EL3, x0 82 ldr x0,=0xD5031000 83 msr C1_ULTRA_IMP_CPUPOR_EL3, x0 84 ldr x0,=0xFFFFFFC0 85 msr C1_ULTRA_IMP_CPUPMR_EL3, x0 86 ldr x0,=0x1000002043ff 87 msr C1_ULTRA_IMP_CPUPCR_EL3, x0 88 isb 89workaround_reset_end c1_ultra, ERRATUM(3926381) 90 91check_erratum_range c1_ultra, ERRATUM(3926381), CPU_REV(1, 0), CPU_REV(1, 0) 92 93workaround_reset_start c1_ultra, ERRATUM(4102704), ERRATA_C1ULTRA_4102704 94 sysreg_bit_set C1_ULTRA_IMP_CPUACTLR4_EL1, BIT(23) 95workaround_reset_end c1_ultra, ERRATUM(4102704) 96 97check_erratum_ls c1_ultra, ERRATUM(4102704), CPU_REV(1, 0) 98 99 /* ------------------------------------------------------------- 100 * CVE-2024-7881 is mitigated for C1-Ultra using erratum 3651221 101 * workaround by disabling the affected prefetcher setting 102 * CPUACTLR6_EL1[41]. 103 * ------------------------------------------------------------- 104 */ 105workaround_reset_start c1_ultra, CVE(2024, 7881), WORKAROUND_CVE_2024_7881 106 sysreg_bit_set C1_ULTRA_IMP_CPUACTLR6_EL1, BIT(41) 107workaround_reset_end c1_ultra, CVE(2024, 7881) 108 109check_erratum_ls c1_ultra, CVE(2024, 7881), CPU_REV(0, 0) 110 111 /* 112 * Instruction patch sequence to trap 'cpp rctx' instructions to EL3. 113 * Enables mitigation for CVE-2025-0647. 114 */ 115workaround_reset_start c1_ultra, CVE(2025, 647), WORKAROUND_CVE_2025_0647 116#if IMAGE_BL31 117 mov x0, #WA_PATCH_SLOT(3) 118 bl wa_cve_2025_0647_instruction_patch 119#endif /* IMAGE_BL31 */ 120workaround_reset_end c1_ultra, CVE(2025, 647) 121 122check_erratum_chosen c1_ultra, CVE(2025, 647), WORKAROUND_CVE_2025_0647 123 124#if WORKAROUND_CVE_2025_0647 125func c1_ultra_impl_defined_el3_handler 126 mov x0, #WA_LS_RCG_EN 127 128 /* See if this call came from trap handler. */ 129 cmp x1, #EC_IMP_DEF_EL3 130 bne wa_cve_2025_0647_do_cpp_wa 131 orr x0, x0, #WA_IS_TRAP_HANDLER 132 b wa_cve_2025_0647_do_cpp_wa 133endfunc c1_ultra_impl_defined_el3_handler 134#endif 135 136cpu_reset_func_start c1_ultra 137 /* ---------------------------------------------------- 138 * Disable speculative loads 139 * ---------------------------------------------------- 140 */ 141 msr SSBS, xzr 142 apply_erratum c1_ultra, ERRATUM(3324333), ERRATA_C1ULTRA_3324333 143 /* model bug: not cleared on reset */ 144 sysreg_bit_clear C1_ULTRA_IMP_CPUPWRCTLR_EL1, \ 145 C1_ULTRA_IMP_CPUPWRCTLR_EL1_CORE_PWRDN_EN_BIT 146 enable_mpmm 147cpu_reset_func_end c1_ultra 148 149func c1_ultra_core_pwr_dwn 150 /* 151 * When software running at lower ELs requests power down without first 152 * disabling SME, the CME connected to it will reject its power down 153 * request. Skip setting the PWRDN_EN bit, downgrading the powerdown 154 * request to a simple WFI wait, to get a minimal amount of power saving 155 * rather than an instant pabandon. 156 */ 157 mrs x0, SVCR 158 cbnz x0, c1_ultra_skip_pwr_dwn 159 160 /* --------------------------------------------------- 161 * Flip CPU power down bit in power control register. 162 * It will be set on powerdown and cleared on wakeup 163 * --------------------------------------------------- 164 */ 165 sysreg_bit_toggle C1_ULTRA_IMP_CPUPWRCTLR_EL1, \ 166 C1_ULTRA_IMP_CPUPWRCTLR_EL1_CORE_PWRDN_EN_BIT 167 isb 168c1_ultra_skip_pwr_dwn: 169 signal_pabandon_handled 170 ret 171endfunc c1_ultra_core_pwr_dwn 172 173.section .rodata.c1_ultra_regs, "aS" 174c1_ultra_regs: /* The ASCII list of register names to be reported */ 175 .asciz "cpuectlr_el1", "" 176 177func c1_ultra_cpu_reg_dump 178 adr x6, c1_ultra_regs 179 mrs x8, C1_ULTRA_IMP_CPUECTLR_EL1 180 ret 181endfunc c1_ultra_cpu_reg_dump 182 183#if WORKAROUND_CVE_2025_0647 && IMAGE_BL31 184declare_cpu_ops_eh c1_ultra, C1_ULTRA_MIDR, \ 185 c1_ultra_reset_func, \ 186 c1_ultra_impl_defined_el3_handler, \ 187 c1_ultra_core_pwr_dwn 188#else 189declare_cpu_ops c1_ultra, C1_ULTRA_MIDR, \ 190 c1_ultra_reset_func, \ 191 c1_ultra_core_pwr_dwn 192#endif 193