1*416b8613SJohn Powell /* 2*416b8613SJohn Powell * Copyright (c) 2026, Arm Limited and Contributors. All rights reserved. 3*416b8613SJohn Powell * 4*416b8613SJohn Powell * SPDX-License-Identifier: BSD-3-Clause 5*416b8613SJohn Powell */ 6*416b8613SJohn Powell 7*416b8613SJohn Powell #ifndef _WA_CVE_2025_0647_CPPRCTX_H_ 8*416b8613SJohn Powell #define _WA_CVE_2025_0647_CPPRCTX_H_ 9*416b8613SJohn Powell 10*416b8613SJohn Powell #ifndef __ASSEMBLER__ 11*416b8613SJohn Powell 12*416b8613SJohn Powell #include <stdint.h> 13*416b8613SJohn Powell 14*416b8613SJohn Powell /* 15*416b8613SJohn Powell * API to perform CPP RCTX instruction functionality in EL3 16*416b8613SJohn Powell * 17*416b8613SJohn Powell * Rather than trapping EL3 to EL3 if CPP RCTX is needed, it is simpler to just 18*416b8613SJohn Powell * have an API that performs the workaround steps. TF-A does not support nested 19*416b8613SJohn Powell * exceptions outside of specific circumstances, and enabling that generically 20*416b8613SJohn Powell * is not trivial, so this is a simpler and faster solution. 21*416b8613SJohn Powell * 22*416b8613SJohn Powell * The workaround is not reliant on the config register passed to the CPP RCTX 23*416b8613SJohn Powell * instruction, but the argument is included for compatibility in systems that 24*416b8613SJohn Powell * might have some cores that need the workaround and some that do not. If the 25*416b8613SJohn Powell * workaround is not needed, the argument will be used in a normal CPP RCTX call 26*416b8613SJohn Powell * rather than the workaround procedure. 27*416b8613SJohn Powell */ 28*416b8613SJohn Powell void wa_cve_2025_0647_execute_cpp_el3(uint64_t arg); 29*416b8613SJohn Powell 30*416b8613SJohn Powell #endif 31*416b8613SJohn Powell 32*416b8613SJohn Powell /* 33*416b8613SJohn Powell * System register definitions used in this workaround 34*416b8613SJohn Powell * 35*416b8613SJohn Powell * Some of these definitions exist in CPU-specific header files but for the 36*416b8613SJohn Powell * purposes of this workaround it is convenient to have them all here. Currently 37*416b8613SJohn Powell * all CPUs affected by this issue share these definitions, but if future CPUs 38*416b8613SJohn Powell * have different register mappings this will need to be updated to pull from 39*416b8613SJohn Powell * the CPU-specific headers instead. 40*416b8613SJohn Powell */ 41*416b8613SJohn Powell 42*416b8613SJohn Powell #define WA_CPUACTLR_EL1 S3_0_C15_C1_0 43*416b8613SJohn Powell #define WA_CPUACTLR2_EL1 S3_0_C15_C1_1 44*416b8613SJohn Powell #define WA_CPUECTLR_EL1 S3_0_C15_C1_4 45*416b8613SJohn Powell #define WA_CPUPSELR_EL3 S3_6_C15_C8_0 46*416b8613SJohn Powell #define WA_CPUPCR_EL3 S3_6_C15_C8_1 47*416b8613SJohn Powell #define WA_CPUPOR_EL3 S3_6_C15_C8_2 48*416b8613SJohn Powell #define WA_CPUPMR_EL3 S3_6_C15_C8_3 49*416b8613SJohn Powell 50*416b8613SJohn Powell /* Flags passed to workaround function in X0. */ 51*416b8613SJohn Powell #define WA_IS_TRAP_HANDLER_BIT (0) 52*416b8613SJohn Powell #define WA_IS_TRAP_HANDLER BIT(WA_IS_TRAP_HANDLER_BIT) 53*416b8613SJohn Powell #define WA_LS_RCG_EN_BIT (1) 54*416b8613SJohn Powell #define WA_LS_RCG_EN BIT(WA_LS_RCG_EN_BIT) 55*416b8613SJohn Powell 56*416b8613SJohn Powell /* Fields passed to init function in X0. */ 57*416b8613SJohn Powell #define WA_USE_T32_OPCODE_SHIFT (3) 58*416b8613SJohn Powell #define WA_USE_T32_OPCODE BIT(WA_USE_T32_OPCODE_SHIFT) 59*416b8613SJohn Powell #define WA_PATCH_SLOT_MASK (0x7) 60*416b8613SJohn Powell #define WA_PATCH_SLOT(x) (x & WA_PATCH_SLOT_MASK) 61*416b8613SJohn Powell 62*416b8613SJohn Powell #endif /* _WA_CVE_2025_0647_CPPRCTX_H_ */ 63