1/* 2 * Copyright (c) 2021-2026, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7#include <arch.h> 8#include <asm_macros.S> 9#include <common/bl_common.h> 10#include <cortex_x3.h> 11#include "wa_cve_2022_23960_bhb_vector.S" 12 13#include <cpu_macros.S> 14#include <wa_cve_2025_0647_cpprctx.h> 15 16#include <plat_macros.S> 17 18/* Hardware handled coherency */ 19#if HW_ASSISTED_COHERENCY == 0 20#error "Cortex-X3 must be compiled with HW_ASSISTED_COHERENCY enabled" 21#endif 22 23/* 64-bit only core */ 24#if CTX_INCLUDE_AARCH32_REGS == 1 25#error "Cortex-X3 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0" 26#endif 27 28.global check_erratum_cortex_x3_3701769 29 30#if WORKAROUND_CVE_2022_23960 31 wa_cve_2022_23960_bhb_vector_table CORTEX_X3_BHB_LOOP_COUNT, cortex_x3 32#endif /* WORKAROUND_CVE_2022_23960 */ 33 34cpu_reset_prologue cortex_x3 35 36workaround_reset_start cortex_x3, ERRATUM(2266875), ERRATA_X3_2266875 37 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(22) 38workaround_reset_end cortex_x3, ERRATUM(2266875) 39 40check_erratum_ls cortex_x3, ERRATUM(2266875), CPU_REV(1, 0) 41 42workaround_reset_start cortex_x3, ERRATUM(2302506), ERRATA_X3_2302506 43 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(0) 44workaround_reset_end cortex_x3, ERRATUM(2302506) 45 46check_erratum_ls cortex_x3, ERRATUM(2302506), CPU_REV(1, 1) 47 48.global erratum_cortex_x3_2313909_wa 49workaround_runtime_start cortex_x3, ERRATUM(2313909), ERRATA_X3_2313909 50 /* Set/unset bit 36 in ACTLR2_EL1. The first call will set it, applying 51 * the workaround. Second call clears it to undo it. */ 52 sysreg_bit_toggle CORTEX_X3_CPUACTLR2_EL1, CORTEX_X3_CPUACTLR2_EL1_BIT_36 53workaround_runtime_end cortex_x3, ERRATUM(2313909), NO_ISB 54 55check_erratum_ls cortex_x3, ERRATUM(2313909), CPU_REV(1, 0) 56 57workaround_reset_start cortex_x3, ERRATUM(2372204), ERRATA_X3_2372204 58 /* Set bit 40 in CPUACTLR2_EL1 */ 59 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(40) 60workaround_reset_end cortex_x3, ERRATUM(2372204) 61 62check_erratum_ls cortex_x3, ERRATUM(2372204), CPU_REV(1, 0) 63 64workaround_reset_start cortex_x3, ERRATUM(2615812), ERRATA_X3_2615812 65 /* Disable retention control for WFI and WFE. */ 66 mrs x0, CORTEX_X3_CPUPWRCTLR_EL1 67 bfi x0, xzr, #CORTEX_X3_CPUPWRCTLR_EL1_WFI_RET_CTRL_BITS_SHIFT, #3 68 bfi x0, xzr, #CORTEX_X3_CPUPWRCTLR_EL1_WFE_RET_CTRL_BITS_SHIFT, #3 69 msr CORTEX_X3_CPUPWRCTLR_EL1, x0 70workaround_reset_end cortex_x3, ERRATUM(2615812) 71 72check_erratum_ls cortex_x3, ERRATUM(2615812), CPU_REV(1, 1) 73 74workaround_reset_start cortex_x3, ERRATUM(2641945), ERRATA_X3_2641945 75 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 76workaround_reset_end cortex_x3, ERRATUM(2641945) 77 78check_erratum_ls cortex_x3, ERRATUM(2641945), CPU_REV(1, 0) 79 80workaround_reset_start cortex_x3, ERRATUM(2742421), ERRATA_X3_2742421 81 /* Set CPUACTLR5_EL1[56:55] to 2'b01 */ 82 sysreg_bit_set CORTEX_X3_CPUACTLR5_EL1, CORTEX_X3_CPUACTLR5_EL1_BIT_55 83 sysreg_bit_clear CORTEX_X3_CPUACTLR5_EL1, CORTEX_X3_CPUACTLR5_EL1_BIT_56 84workaround_reset_end cortex_x3, ERRATUM(2742421) 85 86check_erratum_ls cortex_x3, ERRATUM(2742421), CPU_REV(1, 1) 87 88workaround_runtime_start cortex_x3, ERRATUM(2743088), ERRATA_X3_2743088 89 /* dsb before isb of power down sequence */ 90 dsb sy 91workaround_runtime_end cortex_x3, ERRATUM(2743088), NO_ISB 92 93check_erratum_ls cortex_x3, ERRATUM(2743088), CPU_REV(1, 1) 94 95workaround_reset_start cortex_x3, ERRATUM(2779509), ERRATA_X3_2779509 96 /* Set CPUACTLR3_EL1 bit 47 */ 97 sysreg_bit_set CORTEX_X3_CPUACTLR3_EL1, CORTEX_X3_CPUACTLR3_EL1_BIT_47 98workaround_reset_end cortex_x3, ERRATUM(2779509) 99 100check_erratum_ls cortex_x3, ERRATUM(2779509), CPU_REV(1, 1) 101 102workaround_reset_start cortex_x3, ERRATUM(3213672), ERRATA_X3_3213672 103 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(36) 104workaround_reset_end cortex_x3, ERRATUM(3213672) 105 106check_erratum_ls cortex_x3, ERRATUM(3213672), CPU_REV(1, 2) 107 108workaround_reset_start cortex_x3, ERRATUM(3692984), ERRATA_X3_3692984 109 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 110workaround_reset_end cortex_x3, ERRATUM(3692984) 111 112check_erratum_ls cortex_x3, ERRATUM(3692984), CPU_REV(1, 2) 113 114add_erratum_entry cortex_x3, ERRATUM(3701769), ERRATA_X3_3701769 115 116check_erratum_ls cortex_x3, ERRATUM(3701769), CPU_REV(1, 2) 117 118workaround_reset_start cortex_x3, ERRATUM(3827463), ERRATA_X3_3827463 119 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(1) 120workaround_reset_end cortex_x3, ERRATUM(3827463) 121 122check_erratum_ls cortex_x3, ERRATUM(3827463), CPU_REV(1, 1) 123 124workaround_reset_start cortex_x3, ERRATUM(3888125), ERRATA_X3_3888125 125 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(22) 126workaround_reset_end cortex_x3, ERRATUM(3888125) 127 128check_erratum_ls cortex_x3, ERRATUM(3888125), CPU_REV(1, 2) 129 130workaround_reset_start cortex_x3, ERRATUM(4302966), ERRATA_X3_4302966 131 sysreg_bit_set CORTEX_X3_CPUACTLR5_EL1, BIT(50) 132workaround_reset_end cortex_x3, ERRATUM(4302966) 133 134check_erratum_ls cortex_x3, ERRATUM(4302966), CPU_REV(1, 2) 135 136workaround_reset_start cortex_x3, CVE(2022, 23960), WORKAROUND_CVE_2022_23960 137#if IMAGE_BL31 138 override_vector_table wa_cve_vbar_cortex_x3 139#endif /* IMAGE_BL31 */ 140workaround_reset_end cortex_x3, CVE(2022, 23960) 141 142check_erratum_ls cortex_x3, CVE(2022, 23960), CPU_REV(1, 0) 143 144/* Disable hardware page aggregation. Enables mitigation for `CVE-2024-5660` */ 145workaround_reset_start cortex_x3, CVE(2024, 5660), WORKAROUND_CVE_2024_5660 146 sysreg_bit_set CORTEX_X3_CPUECTLR_EL1, BIT(46) 147workaround_reset_end cortex_x3, CVE(2024, 5660) 148 149check_erratum_ls cortex_x3, CVE(2024, 5660), CPU_REV(1, 2) 150 151 /* -------------------------------------------------------------- 152 * CVE-2024-7881 is mitigated for Cortex-X3 using erratum 3692984 153 * workaround by disabling the affected prefetcher setting 154 * CPUACTLR6_EL1[41]. 155 * -------------------------------------------------------------- 156 */ 157workaround_reset_start cortex_x3, CVE(2024, 7881), WORKAROUND_CVE_2024_7881 158 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 159workaround_reset_end cortex_x3, CVE(2024, 7881) 160 161check_erratum_ls cortex_x3, CVE(2024, 7881), CPU_REV(1, 2) 162 163 /* 164 * Instruction patch sequence to trap 'cpp rctx' instructions to EL3. 165 * Enables mitigation for CVE-2025-0647. 166 */ 167workaround_reset_start cortex_x3, CVE(2025, 647), WORKAROUND_CVE_2025_0647 168 mov x0, #WA_PATCH_SLOT(3) 169 bl wa_cve_2025_0647_instruction_patch 170workaround_reset_end cortex_x3, CVE(2025, 647) 171 172check_erratum_chosen cortex_x3, CVE(2025, 647), WORKAROUND_CVE_2025_0647 173 174#if WORKAROUND_CVE_2025_0647 175func cortex_x3_impl_defined_el3_handler 176 mov x0, #WA_LS_RCG_EN 177 178 /* See if this call came from trap handler. */ 179 cmp x1, #EC_IMP_DEF_EL3 180 bne wa_cve_2025_0647_do_cpp_wa 181 orr x0, x0, #WA_IS_TRAP_HANDLER 182 b wa_cve_2025_0647_do_cpp_wa 183endfunc cortex_x3_impl_defined_el3_handler 184#endif 185 186cpu_reset_func_start cortex_x3 187 /* Disable speculative loads */ 188 msr SSBS, xzr 189 enable_mpmm 190cpu_reset_func_end cortex_x3 191 192 /* ---------------------------------------------------- 193 * HW will do the cache maintenance while powering down 194 * ---------------------------------------------------- 195 */ 196func cortex_x3_core_pwr_dwn 197 apply_erratum cortex_x3, ERRATUM(2313909), ERRATA_X3_2313909 198 /* --------------------------------------------------- 199 * Enable CPU power down bit in power control register 200 * --------------------------------------------------- 201 */ 202 sysreg_bit_set CORTEX_X3_CPUPWRCTLR_EL1, CORTEX_X3_CPUPWRCTLR_EL1_CORE_PWRDN_BIT 203 apply_erratum cortex_x3, ERRATUM(2743088), ERRATA_X3_2743088, NO_GET_CPU_REV 204 isb 205 ret 206endfunc cortex_x3_core_pwr_dwn 207 208 /* --------------------------------------------- 209 * This function provides Cortex-X3- 210 * specific register information for crash 211 * reporting. It needs to return with x6 212 * pointing to a list of register names in ascii 213 * and x8 - x15 having values of registers to be 214 * reported. 215 * --------------------------------------------- 216 */ 217.section .rodata.cortex_x3_regs, "aS" 218cortex_x3_regs: /* The ascii list of register names to be reported */ 219 .asciz "cpuectlr_el1", "" 220 221func cortex_x3_cpu_reg_dump 222 adr x6, cortex_x3_regs 223 mrs x8, CORTEX_X3_CPUECTLR_EL1 224 ret 225endfunc cortex_x3_cpu_reg_dump 226 227#if WORKAROUND_CVE_2025_0647 228declare_cpu_ops_eh cortex_x3, CORTEX_X3_MIDR, \ 229 cortex_x3_reset_func, \ 230 cortex_x3_impl_defined_el3_handler, \ 231 cortex_x3_core_pwr_dwn 232#else 233declare_cpu_ops cortex_x3, CORTEX_X3_MIDR, \ 234 cortex_x3_reset_func, \ 235 cortex_x3_core_pwr_dwn 236#endif 237