1/* 2 * Copyright (c) 2021-2026, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7#include <arch.h> 8#include <asm_macros.S> 9#include <common/bl_common.h> 10#include <cortex_x2.h> 11#include <cpu_macros.S> 12#include "wa_cve_2022_23960_bhb_vector.S" 13 14#include <dsu_macros.S> 15#include <wa_cve_2025_0647_cpprctx.h> 16 17#include <plat_macros.S> 18 19/* Hardware handled coherency */ 20#if HW_ASSISTED_COHERENCY == 0 21#error "Cortex X2 must be compiled with HW_ASSISTED_COHERENCY enabled" 22#endif 23 24/* 64-bit only core */ 25#if CTX_INCLUDE_AARCH32_REGS == 1 26#error "Cortex X2 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0" 27#endif 28 29.global check_erratum_cortex_x2_3701772 30 31#if WORKAROUND_CVE_2022_23960 32 wa_cve_2022_23960_bhb_vector_table CORTEX_X2_BHB_LOOP_COUNT, cortex_x2 33#endif /* WORKAROUND_CVE_2022_23960 */ 34 35cpu_reset_prologue cortex_x2 36 37workaround_reset_start cortex_x2, ERRATUM(1901946), ERRATA_X2_1901946 38 sysreg_bit_set CORTEX_X2_CPUACTLR4_EL1, BIT(15) 39workaround_reset_end cortex_x2, ERRATUM(1901946) 40 41check_erratum_range cortex_x2, ERRATUM(1901946), CPU_REV(1, 0), CPU_REV(1, 0) 42 43workaround_reset_start cortex_x2, ERRATUM(1916945), ERRATA_X2_1916945 44 sysreg_bit_set CORTEX_X2_CPUECTLR_EL1, BIT(8) 45workaround_reset_end cortex_x2, ERRATUM(1916945) 46 47check_erratum_ls cortex_x2, ERRATUM(1916945), CPU_REV(1, 0) 48 49workaround_reset_start cortex_x2, ERRATUM(1917258), ERRATA_X2_1917258 50 sysreg_bit_set CORTEX_X2_CPUACTLR4_EL1, BIT(43) 51workaround_reset_end cortex_x2, ERRATUM(1917258) 52 53check_erratum_ls cortex_x2, ERRATUM(1917258), CPU_REV(1, 0) 54 55workaround_reset_start cortex_x2, ERRATUM(1927200), ERRATA_X2_1927200 56 mov x0, #0 57 msr S3_6_C15_C8_0, x0 /* CPUPSELR_EL3 */ 58 ldr x0, =0x10E3900002 59 msr S3_6_C15_C8_2, x0 /* CPUPOR_EL3 */ 60 ldr x0, =0x10FFF00083 61 msr S3_6_C15_C8_3, x0 /* CPUPMR_EL3 */ 62 ldr x0, =0x2001003FF 63 msr S3_6_C15_C8_1, x0 /* CPUPCR_EL3 */ 64 65 mov x0, #1 66 msr S3_6_C15_C8_0, x0 /* CPUPSELR_EL3 */ 67 ldr x0, =0x10E3800082 68 msr S3_6_C15_C8_2, x0 /* CPUPOR_EL3 */ 69 ldr x0, =0x10FFF00083 70 msr S3_6_C15_C8_3, x0 /* CPUPMR_EL3 */ 71 ldr x0, =0x2001003FF 72 msr S3_6_C15_C8_1, x0 /* CPUPCR_EL3 */ 73 74 mov x0, #2 75 msr S3_6_C15_C8_0, x0 /* CPUPSELR_EL3 */ 76 ldr x0, =0x10E3800200 77 msr S3_6_C15_C8_2, x0 /* CPUPOR_EL3 */ 78 ldr x0, =0x10FFF003E0 79 msr S3_6_C15_C8_3, x0 /* CPUPMR_EL3 */ 80 ldr x0, =0x2001003FF 81 msr S3_6_C15_C8_1, x0 /* CPUPCR_EL3 */ 82workaround_reset_end cortex_x2, ERRATUM(1927200) 83 84check_erratum_ls cortex_x2, ERRATUM(1927200), CPU_REV(1, 0) 85 86workaround_reset_start cortex_x2, ERRATUM(1934260), ERRATA_X2_1934260 87 sysreg_bit_set CORTEX_X2_CPUECTLR_EL1, CORTEX_X2_CPUECTLR_EL1_WS_THR_DISABLE_ALL_BITS 88workaround_reset_end cortex_x2, ERRATUM(1934260) 89 90check_erratum_range cortex_x2, ERRATUM(1934260), CPU_REV(1, 0), CPU_REV(1, 0) 91 92workaround_reset_start cortex_x2, ERRATUM(2002765), ERRATA_X2_2002765 93 ldr x0, =0x6 94 msr S3_6_C15_C8_0, x0 /* CPUPSELR_EL3 */ 95 ldr x0, =0xF3A08002 96 msr S3_6_C15_C8_2, x0 /* CPUPOR_EL3 */ 97 ldr x0, =0xFFF0F7FE 98 msr S3_6_C15_C8_3, x0 /* CPUPMR_EL3 */ 99 ldr x0, =0x40000001003ff 100 msr S3_6_C15_C8_1, x0 /* CPUPCR_EL3 */ 101workaround_reset_end cortex_x2, ERRATUM(2002765) 102 103check_erratum_ls cortex_x2, ERRATUM(2002765), CPU_REV(2, 0) 104 105workaround_reset_start cortex_x2, ERRATUM(2017096), ERRATA_X2_2017096 106 sysreg_bit_set CORTEX_X2_CPUECTLR_EL1, CORTEX_X2_CPUECTLR_EL1_PFSTIDIS_BIT 107workaround_reset_end cortex_x2, ERRATUM(2017096) 108 109check_erratum_ls cortex_x2, ERRATUM(2017096), CPU_REV(2, 0) 110 111workaround_reset_start cortex_x2, ERRATUM(2081180), ERRATA_X2_2081180 112 /* Apply instruction patching sequence */ 113 ldr x0, =0x3 114 msr CORTEX_X2_IMP_CPUPSELR_EL3, x0 115 ldr x0, =0xF3A08002 116 msr CORTEX_X2_IMP_CPUPOR_EL3, x0 117 ldr x0, =0xFFF0F7FE 118 msr CORTEX_X2_IMP_CPUPMR_EL3, x0 119 ldr x0, =0x10002001003FF 120 msr CORTEX_X2_IMP_CPUPCR_EL3, x0 121 ldr x0, =0x4 122 msr CORTEX_X2_IMP_CPUPSELR_EL3, x0 123 ldr x0, =0xBF200000 124 msr CORTEX_X2_IMP_CPUPOR_EL3, x0 125 ldr x0, =0xFFEF0000 126 msr CORTEX_X2_IMP_CPUPMR_EL3, x0 127 ldr x0, =0x10002001003F3 128 msr CORTEX_X2_IMP_CPUPCR_EL3, x0 129workaround_reset_end cortex_x2, ERRATUM(2081180) 130 131check_erratum_ls cortex_x2, ERRATUM(2081180), CPU_REV(2, 0) 132 133workaround_reset_start cortex_x2, ERRATUM(2083908), ERRATA_X2_2083908 134 /* Apply the workaround by setting bit 13 in CPUACTLR5_EL1. */ 135 sysreg_bit_set CORTEX_X2_CPUACTLR5_EL1, BIT(13) 136workaround_reset_end cortex_x2, ERRATUM(2083908) 137 138check_erratum_range cortex_x2, ERRATUM(2083908), CPU_REV(2, 0), CPU_REV(2, 0) 139 140workaround_reset_start cortex_x2, ERRATUM(2136059), ERRATA_X2_2136059 141 sysreg_bit_set CORTEX_X2_CPUACTLR5_EL1, BIT(44) 142workaround_reset_end cortex_x2, ERRATUM(2136059) 143 144check_erratum_ls cortex_x2, ERRATUM(2136059), CPU_REV(2, 0) 145 146workaround_reset_start cortex_x2, ERRATUM(2147715), ERRATA_X2_2147715 147 /* Apply the workaround by setting bit 22 in CPUACTLR_EL1. */ 148 sysreg_bit_set CORTEX_X2_CPUACTLR_EL1, CORTEX_X2_CPUACTLR_EL1_BIT_22 149workaround_reset_end cortex_x2, ERRATUM(2147715) 150 151check_erratum_range cortex_x2, ERRATUM(2147715), CPU_REV(2, 0), CPU_REV(2, 0) 152 153workaround_reset_start cortex_x2, ERRATUM(2216384), ERRATA_X2_2216384 154 sysreg_bit_set CORTEX_X2_CPUACTLR5_EL1, CORTEX_X2_CPUACTLR5_EL1_BIT_17 155 156 /* Apply instruction patching sequence */ 157 ldr x0, =0x5 158 msr CORTEX_X2_IMP_CPUPSELR_EL3, x0 159 ldr x0, =0x10F600E000 160 msr CORTEX_X2_IMP_CPUPOR_EL3, x0 161 ldr x0, =0x10FF80E000 162 msr CORTEX_X2_IMP_CPUPMR_EL3, x0 163 ldr x0, =0x80000000003FF 164 msr CORTEX_X2_IMP_CPUPCR_EL3, x0 165workaround_reset_end cortex_x2, ERRATUM(2216384) 166 167check_erratum_ls cortex_x2, ERRATUM(2216384), CPU_REV(2, 0) 168 169workaround_reset_start cortex_x2, ERRATUM(2267065), ERRATA_X2_2267065 170 sysreg_bit_set CORTEX_X2_CPUACTLR_EL1, BIT(22) 171workaround_reset_end cortex_x2, ERRATUM(2267065) 172 173check_erratum_ls cortex_x2, ERRATUM(2267065), CPU_REV(2, 0) 174 175workaround_reset_start cortex_x2, ERRATUM(2282622), ERRATA_X2_2282622 176 /* Apply the workaround */ 177 sysreg_bit_set CORTEX_X2_CPUACTLR2_EL1, BIT(0) 178workaround_reset_end cortex_x2, ERRATUM(2282622) 179 180check_erratum_ls cortex_x2, ERRATUM(2282622), CPU_REV(2, 1) 181 182workaround_runtime_start cortex_x2, ERRATUM(2291219), ERRATA_X2_2291219 183 /* 184 * Set/unset bit 36 in ACTLR2_EL1. The first call will set it, applying 185 * the workaround. Second call clears it to undo it. 186 */ 187 sysreg_bit_toggle CORTEX_X2_CPUACTLR2_EL1, BIT(36) 188workaround_runtime_end cortex_x2, ERRATUM(2291219), NO_ISB 189 190check_erratum_ls cortex_x2, ERRATUM(2291219), CPU_REV(2, 0) 191 192workaround_reset_start cortex_x2, ERRATUM(2313941), ERRATA_DSU_2313941 193 errata_dsu_2313941_wa_impl 194workaround_reset_end cortex_x2, ERRATUM(2313941) 195 196check_erratum_custom_start cortex_x2, ERRATUM(2313941) 197 check_errata_dsu_2313941_impl 198 ret 199check_erratum_custom_end cortex_x2, ERRATUM(2313941) 200 201workaround_reset_start cortex_x2, ERRATUM(2371105), ERRATA_X2_2371105 202 /* Set bit 40 in CPUACTLR2_EL1 */ 203 sysreg_bit_set CORTEX_X2_CPUACTLR2_EL1, CORTEX_X2_CPUACTLR2_EL1_BIT_40 204workaround_reset_end cortex_x2, ERRATUM(2371105) 205 206check_erratum_ls cortex_x2, ERRATUM(2371105), CPU_REV(2, 0) 207 208workaround_reset_start cortex_x2, ERRATUM(2742423), ERRATA_X2_2742423 209 /* Set CPUACTLR5_EL1[56:55] to 2'b01 */ 210 sysreg_bit_set CORTEX_X2_CPUACTLR5_EL1, BIT(55) 211 sysreg_bit_clear CORTEX_X2_CPUACTLR5_EL1, BIT(56) 212workaround_reset_end cortex_x2, ERRATUM(2742423) 213 214check_erratum_ls cortex_x2, ERRATUM(2742423), CPU_REV(2, 1) 215 216workaround_runtime_start cortex_x2, ERRATUM(2768515), ERRATA_X2_2768515 217 /* dsb before isb of power down sequence */ 218 dsb sy 219workaround_runtime_end cortex_x2, ERRATUM(2768515) 220 221check_erratum_ls cortex_x2, ERRATUM(2768515), CPU_REV(2, 1) 222 223workaround_reset_start cortex_x2, ERRATUM(2778471), ERRATA_X2_2778471 224 sysreg_bit_set CORTEX_X2_CPUACTLR3_EL1, BIT(47) 225workaround_reset_end cortex_x2, ERRATUM(2778471) 226 227check_erratum_ls cortex_x2, ERRATUM(2778471), CPU_REV(2, 1) 228 229workaround_runtime_start cortex_x2, ERRATUM(3324338), ERRATA_X2_3324338 230 speculation_barrier 231workaround_runtime_end cortex_x2, ERRATUM(3324338) 232 233check_erratum_ls cortex_x2, ERRATUM(3324338), CPU_REV(2, 1) 234 235add_erratum_entry cortex_x2, ERRATUM(3701772), ERRATA_X2_3701772 236 237check_erratum_ls cortex_x2, ERRATUM(3701772), CPU_REV(2, 1) 238 239workaround_reset_start cortex_x2, ERRATUM(3888122), ERRATA_X2_3888122 240 sysreg_bit_set CORTEX_X2_CPUACTLR2_EL1, BIT(22) 241workaround_reset_end cortex_x2, ERRATUM(3888122) 242 243check_erratum_ls cortex_x2, ERRATUM(3888122), CPU_REV(2, 1) 244 245workaround_reset_start cortex_x2, ERRATUM(4302969), ERRATA_X2_4302969 246 sysreg_bit_set CORTEX_X2_CPUACTLR5_EL1, BIT(50) 247workaround_reset_end cortex_x2, ERRATUM(4302969) 248 249check_erratum_ls cortex_x2, ERRATUM(4302969), CPU_REV(2, 1) 250 251workaround_reset_start cortex_x2, CVE(2022, 23960), WORKAROUND_CVE_2022_23960 252#if IMAGE_BL31 253 /* 254 * The Cortex-X2 generic vectors are overridden to apply errata 255 * mitigation on exception entry from lower ELs. 256 */ 257 override_vector_table wa_cve_vbar_cortex_x2 258#endif /* IMAGE_BL31 */ 259workaround_reset_end cortex_x2, CVE(2022, 23960) 260 261check_erratum_chosen cortex_x2, CVE(2022, 23960), WORKAROUND_CVE_2022_23960 262 263/* Disable hardware page aggregation. Enables mitigation for `CVE-2024-5660` */ 264workaround_reset_start cortex_x2, CVE(2024, 5660), WORKAROUND_CVE_2024_5660 265 sysreg_bit_set CORTEX_X2_CPUECTLR_EL1, BIT(46) 266workaround_reset_end cortex_x2, CVE(2024, 5660) 267 268check_erratum_ls cortex_x2, CVE(2024, 5660), CPU_REV(2, 1) 269 270 /* 271 * Instruction patch sequence to trap 'cpp rctx' instructions to EL3. 272 * Enables mitigation for CVE-2025-0647. 273 */ 274workaround_reset_start cortex_x2, CVE(2025, 647), WORKAROUND_CVE_2025_0647 275 mov x0, #(WA_USE_T32_OPCODE | WA_PATCH_SLOT(0)) 276 bl wa_cve_2025_0647_instruction_patch 277workaround_reset_end cortex_x2, CVE(2025, 647) 278 279check_erratum_chosen cortex_x2, CVE(2025, 647), WORKAROUND_CVE_2025_0647 280 281#if WORKAROUND_CVE_2025_0647 282func cortex_x2_impl_defined_el3_handler 283 mov x0, #WA_LS_RCG_EN 284 285 /* See if this call came from trap handler. */ 286 cmp x1, #EC_IMP_DEF_EL3 287 bne wa_cve_2025_0647_do_cpp_wa 288 orr x0, x0, #WA_IS_TRAP_HANDLER 289 b wa_cve_2025_0647_do_cpp_wa 290endfunc cortex_x2_impl_defined_el3_handler 291#endif 292 293 /* ---------------------------------------------------- 294 * HW will do the cache maintenance while powering down 295 * ---------------------------------------------------- 296 */ 297func cortex_x2_core_pwr_dwn 298 apply_erratum cortex_x2, ERRATUM(2291219), ERRATA_X2_2291219, NO_GET_CPU_REV 299 300 /* --------------------------------------------------- 301 * Enable CPU power down bit in power control register 302 * --------------------------------------------------- 303 */ 304 sysreg_bit_set CORTEX_X2_CPUPWRCTLR_EL1, CORTEX_X2_CPUPWRCTLR_EL1_CORE_PWRDN_BIT 305 306 apply_erratum cortex_x2, ERRATUM(2768515), ERRATA_X2_2768515 307 isb 308 ret 309endfunc cortex_x2_core_pwr_dwn 310 311cpu_reset_func_start cortex_x2 312 /* Disable speculative loads */ 313 msr SSBS, xzr 314 apply_erratum cortex_x2, ERRATUM(3324338), ERRATA_X2_3324338 315 316 enable_mpmm 317cpu_reset_func_end cortex_x2 318 319 /* --------------------------------------------- 320 * This function provides Cortex X2 specific 321 * register information for crash reporting. 322 * It needs to return with x6 pointing to 323 * a list of register names in ascii and 324 * x8 - x15 having values of registers to be 325 * reported. 326 * --------------------------------------------- 327 */ 328.section .rodata.cortex_x2_regs, "aS" 329cortex_x2_regs: /* The ascii list of register names to be reported */ 330 .asciz "cpuectlr_el1", "" 331 332func cortex_x2_cpu_reg_dump 333 adr x6, cortex_x2_regs 334 mrs x8, CORTEX_X2_CPUECTLR_EL1 335 ret 336endfunc cortex_x2_cpu_reg_dump 337 338#if WORKAROUND_CVE_2025_0647 339declare_cpu_ops_eh cortex_x2, CORTEX_X2_MIDR, \ 340 cortex_x2_reset_func, \ 341 cortex_x2_impl_defined_el3_handler, \ 342 cortex_x2_core_pwr_dwn 343#else 344declare_cpu_ops cortex_x2, CORTEX_X2_MIDR, \ 345 cortex_x2_reset_func, \ 346 cortex_x2_core_pwr_dwn 347#endif 348