1/* 2 * Copyright (c) 2024-2026, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7#include <arch.h> 8#include <asm_macros.S> 9#include <c1_premium.h> 10#include <common/bl_common.h> 11#include <cpu_macros.S> 12#include <wa_cve_2025_0647_cpprctx.h> 13 14#include <plat_macros.S> 15 16/* Hardware handled coherency */ 17#if HW_ASSISTED_COHERENCY == 0 18#error "Arm C1-Premium must be compiled with HW_ASSISTED_COHERENCY enabled" 19#endif 20 21/* 64-bit only core */ 22#if CTX_INCLUDE_AARCH32_REGS == 1 23#error "Arm C1-Premium supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0" 24#endif 25 26#if ERRATA_SME_POWER_DOWN == 0 27#error "Arm C1-Premium needs ERRATA_SME_POWER_DOWN=1 to powerdown correctly" 28#endif 29 30cpu_reset_prologue c1_premium 31 32workaround_runtime_start c1_premium, ERRATUM(3324333), ERRATA_C1PREMIUM_3324333 33 speculation_barrier 34workaround_runtime_end c1_premium, ERRATUM(3324333) 35 36check_erratum_ls c1_premium, ERRATUM(3324333), CPU_REV(0, 0) 37 38workaround_reset_start c1_premium, ERRATUM(3502731), ERRATA_C1PREMIUM_3502731 39 sysreg_bit_set C1_PREMIUM_IMP_CPUACTLR4_EL1, BIT(23) 40workaround_reset_end c1_premium, ERRATUM(3502731) 41 42check_erratum_ls c1_premium, ERRATUM(3502731), CPU_REV(0, 0) 43 44workaround_reset_start c1_premium, ERRATUM(3684152), ERRATA_C1PREMIUM_3684152 45 sysreg_bitfield_insert C1_PREMIUM_IMP_CPUACTLR_EL1, C1_PREMIUM_IMP_CPUACTLR_EL1_LOAD_BIT, \ 46 C1_PREMIUM_IMP_CPUACTLR_EL1_LOAD_SHIFT, C1_PREMIUM_IMP_CPUACTLR_EL1_LOAD_WIDTH 47workaround_reset_end c1_premium, ERRATUM(3684152) 48 49check_erratum_ls c1_premium, ERRATUM(3684152), CPU_REV(0, 0) 50 51workaround_reset_start c1_premium, ERRATUM(3705939), ERRATA_C1PREMIUM_3705939 52 sysreg_bit_set C1_PREMIUM_IMP_CPUACTLR_EL1, BIT(48) 53workaround_reset_end c1_premium, ERRATUM(3705939) 54 55check_erratum_ls c1_premium, ERRATUM(3705939), CPU_REV(1, 0) 56 57workaround_reset_start c1_premium, ERRATUM(3815514), ERRATA_C1PREMIUM_3815514 58 sysreg_bit_set C1_PREMIUM_IMP_CPUACTLR5_EL1, BIT(13) 59workaround_reset_end c1_premium, ERRATUM(3815514) 60 61check_erratum_ls c1_premium, ERRATUM(3815514), CPU_REV(1, 0) 62 63workaround_reset_start c1_premium, ERRATUM(3865171), ERRATA_C1PREMIUM_3865171 64 sysreg_bit_set C1_PREMIUM_IMP_CPUACTLR2_EL1, BIT(22) 65workaround_reset_end c1_premium, ERRATUM(3865171) 66 67check_erratum_ls c1_premium, ERRATUM(3865171), CPU_REV(1, 0) 68 69workaround_reset_start c1_premium, ERRATUM(3926381), ERRATA_C1PREMIUM_3926381 70 /* Convert WFx to NOP */ 71 ldr x0,=0x0 72 msr C1_PREMIUM_IMP_CPUPSELR_EL3, x0 73 ldr x0,=0xD503205f 74 msr C1_PREMIUM_IMP_CPUPOR_EL3, x0 75 ldr x0,=0xFFFFFFDF 76 msr C1_PREMIUM_IMP_CPUPMR_EL3, x0 77 ldr x0,=0x1000002043ff 78 msr C1_PREMIUM_IMP_CPUPCR_EL3, x0 79 80 /* Convert WFxT to NOP */ 81 ldr x0,=0x1 82 msr C1_PREMIUM_IMP_CPUPSELR_EL3, x0 83 ldr x0,=0xD5031000 84 msr C1_PREMIUM_IMP_CPUPOR_EL3, x0 85 ldr x0,=0xFFFFFFC0 86 msr C1_PREMIUM_IMP_CPUPMR_EL3, x0 87 ldr x0,=0x1000002043ff 88 msr C1_PREMIUM_IMP_CPUPCR_EL3, x0 89 isb 90workaround_reset_end c1_premium, ERRATUM(3926381) 91 92check_erratum_range c1_premium, ERRATUM(3926381), CPU_REV(1, 0), CPU_REV(1, 0) 93 94workaround_reset_start c1_premium, ERRATUM(4102704), ERRATA_C1PREMIUM_4102704 95 sysreg_bit_set C1_PREMIUM_IMP_CPUACTLR4_EL1, BIT(23) 96workaround_reset_end c1_premium, ERRATUM(4102704) 97 98check_erratum_ls c1_premium, ERRATUM(4102704), CPU_REV(1, 0) 99 100 /* --------------------------------------------------------------- 101 * CVE-2024-7881 is mitigated for C1-Premium using erratum 3651221 102 * workaround by disabling the affected prefetcher setting 103 * CPUACTLR6_EL1[41]. 104 * --------------------------------------------------------------- 105 */ 106workaround_reset_start c1_premium, CVE(2024, 7881), WORKAROUND_CVE_2024_7881 107 sysreg_bit_set C1_PREMIUM_CPUACTLR6_EL1, BIT(41) 108workaround_reset_end c1_premium, CVE(2024, 7881) 109 110check_erratum_ls c1_premium, CVE(2024, 7881), CPU_REV(0, 0) 111 112 /* 113 * Instruction patch sequence to trap 'cpp rctx' instructions to EL3. 114 * Enables mitigation for CVE-2025-0647. 115 */ 116workaround_reset_start c1_premium, CVE(2025, 647), WORKAROUND_CVE_2025_0647 117 mov x0, #WA_PATCH_SLOT(3) 118 bl wa_cve_2025_0647_instruction_patch 119workaround_reset_end c1_premium, CVE(2025, 647) 120 121check_erratum_chosen c1_premium, CVE(2025, 647), WORKAROUND_CVE_2025_0647 122 123#if WORKAROUND_CVE_2025_0647 124func c1_premium_impl_defined_el3_handler 125 mov x0, #WA_LS_RCG_EN 126 127 /* See if this call came from trap handler. */ 128 cmp x1, #EC_IMP_DEF_EL3 129 bne wa_cve_2025_0647_do_cpp_wa 130 orr x0, x0, #WA_IS_TRAP_HANDLER 131 b wa_cve_2025_0647_do_cpp_wa 132endfunc c1_premium_impl_defined_el3_handler 133#endif 134 135cpu_reset_func_start c1_premium 136 /* Disable speculative loads */ 137 msr SSBS, xzr 138 apply_erratum c1_premium, ERRATUM(3324333), ERRATA_C1PREMIUM_3324333 139 enable_mpmm 140cpu_reset_func_end c1_premium 141 142func c1_premium_core_pwr_dwn 143 /* --------------------------------------------------- 144 * Flip CPU power down bit in power control register. 145 * It will be set on powerdown and cleared on wakeup. 146 * --------------------------------------------------- 147 */ 148 sysreg_bit_toggle C1_PREMIUM_IMP_CPUPWRCTLR_EL1, \ 149 C1_PREMIUM_IMP_CPUPWRCTLR_EL1_CORE_PWRDN_EN_BIT 150 isb 151 signal_pabandon_handled 152 ret 153endfunc c1_premium_core_pwr_dwn 154 155.section .rodata.c1_premium_regs, "aS" 156c1_premium_regs: /* The ASCII list of register names to be reported */ 157 .asciz "cpuectlr_el1", "" 158 159func c1_premium_cpu_reg_dump 160 adr x6, c1_premium_regs 161 mrs x8, C1_PREMIUM_IMP_CPUECTLR_EL1 162 ret 163endfunc c1_premium_cpu_reg_dump 164 165#if WORKAROUND_CVE_2025_0647 166declare_cpu_ops_eh c1_premium, C1_PREMIUM_MIDR, \ 167 c1_premium_reset_func, \ 168 c1_premium_impl_defined_el3_handler, \ 169 c1_premium_core_pwr_dwn 170#else 171declare_cpu_ops c1_premium, C1_PREMIUM_MIDR, \ 172 c1_premium_reset_func, \ 173 c1_premium_core_pwr_dwn 174#endif 175 176