1/* 2 * Copyright (c) 2021-2026, Arm Limited. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7#include <arch.h> 8#include <asm_macros.S> 9#include <common/bl_common.h> 10#include <cortex_x3.h> 11#include "wa_cve_2022_23960_bhb_vector.S" 12 13#include <cpu_macros.S> 14#include <wa_cve_2025_0647_cpprctx.h> 15 16#include <plat_macros.S> 17 18/* Hardware handled coherency */ 19#if HW_ASSISTED_COHERENCY == 0 20#error "Cortex-X3 must be compiled with HW_ASSISTED_COHERENCY enabled" 21#endif 22 23/* 64-bit only core */ 24#if CTX_INCLUDE_AARCH32_REGS == 1 25#error "Cortex-X3 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0" 26#endif 27 28.global check_erratum_cortex_x3_3701769 29 30#if WORKAROUND_CVE_2022_23960 31 wa_cve_2022_23960_bhb_vector_table CORTEX_X3_BHB_LOOP_COUNT, cortex_x3 32#endif /* WORKAROUND_CVE_2022_23960 */ 33 34cpu_reset_prologue cortex_x3 35 36workaround_reset_start cortex_x3, ERRATUM(2266875), ERRATA_X3_2266875 37 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(22) 38workaround_reset_end cortex_x3, ERRATUM(2266875) 39 40check_erratum_ls cortex_x3, ERRATUM(2266875), CPU_REV(1, 0) 41 42workaround_reset_start cortex_x3, ERRATUM(2302506), ERRATA_X3_2302506 43 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(0) 44workaround_reset_end cortex_x3, ERRATUM(2302506) 45 46check_erratum_ls cortex_x3, ERRATUM(2302506), CPU_REV(1, 1) 47 48.global erratum_cortex_x3_2313909_wa 49workaround_runtime_start cortex_x3, ERRATUM(2313909), ERRATA_X3_2313909 50 /* Set/unset bit 36 in ACTLR2_EL1. The first call will set it, applying 51 * the workaround. Second call clears it to undo it. */ 52 sysreg_bit_toggle CORTEX_X3_CPUACTLR2_EL1, CORTEX_X3_CPUACTLR2_EL1_BIT_36 53workaround_runtime_end cortex_x3, ERRATUM(2313909), NO_ISB 54 55check_erratum_ls cortex_x3, ERRATUM(2313909), CPU_REV(1, 0) 56 57workaround_reset_start cortex_x3, ERRATUM(2372204), ERRATA_X3_2372204 58 /* Set bit 40 in CPUACTLR2_EL1 */ 59 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(40) 60workaround_reset_end cortex_x3, ERRATUM(2372204) 61 62check_erratum_ls cortex_x3, ERRATUM(2372204), CPU_REV(1, 0) 63 64workaround_reset_start cortex_x3, ERRATUM(2615812), ERRATA_X3_2615812 65 /* Disable retention control for WFI and WFE. */ 66 mrs x0, CORTEX_X3_CPUPWRCTLR_EL1 67 bfi x0, xzr, #CORTEX_X3_CPUPWRCTLR_EL1_WFI_RET_CTRL_BITS_SHIFT, #3 68 bfi x0, xzr, #CORTEX_X3_CPUPWRCTLR_EL1_WFE_RET_CTRL_BITS_SHIFT, #3 69 msr CORTEX_X3_CPUPWRCTLR_EL1, x0 70workaround_reset_end cortex_x3, ERRATUM(2615812) 71 72check_erratum_ls cortex_x3, ERRATUM(2615812), CPU_REV(1, 1) 73 74workaround_reset_start cortex_x3, ERRATUM(2641945), ERRATA_X3_2641945 75 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 76workaround_reset_end cortex_x3, ERRATUM(2641945) 77 78check_erratum_ls cortex_x3, ERRATUM(2641945), CPU_REV(1, 0) 79 80workaround_reset_start cortex_x3, ERRATUM(2742421), ERRATA_X3_2742421 81 /* Set CPUACTLR5_EL1[56:55] to 2'b01 */ 82 sysreg_bit_set CORTEX_X3_CPUACTLR5_EL1, CORTEX_X3_CPUACTLR5_EL1_BIT_55 83 sysreg_bit_clear CORTEX_X3_CPUACTLR5_EL1, CORTEX_X3_CPUACTLR5_EL1_BIT_56 84workaround_reset_end cortex_x3, ERRATUM(2742421) 85 86check_erratum_ls cortex_x3, ERRATUM(2742421), CPU_REV(1, 1) 87 88workaround_runtime_start cortex_x3, ERRATUM(2743088), ERRATA_X3_2743088 89 /* dsb before isb of power down sequence */ 90 dsb sy 91workaround_runtime_end cortex_x3, ERRATUM(2743088), NO_ISB 92 93check_erratum_ls cortex_x3, ERRATUM(2743088), CPU_REV(1, 1) 94 95workaround_reset_start cortex_x3, ERRATUM(2779509), ERRATA_X3_2779509 96 /* Set CPUACTLR3_EL1 bit 47 */ 97 sysreg_bit_set CORTEX_X3_CPUACTLR3_EL1, CORTEX_X3_CPUACTLR3_EL1_BIT_47 98workaround_reset_end cortex_x3, ERRATUM(2779509) 99 100check_erratum_ls cortex_x3, ERRATUM(2779509), CPU_REV(1, 1) 101 102workaround_reset_start cortex_x3, ERRATUM(3213672), ERRATA_X3_3213672 103 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(36) 104workaround_reset_end cortex_x3, ERRATUM(3213672) 105 106check_erratum_ls cortex_x3, ERRATUM(3213672), CPU_REV(1, 2) 107 108workaround_reset_start cortex_x3, ERRATUM(3692984), ERRATA_X3_3692984 109 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 110workaround_reset_end cortex_x3, ERRATUM(3692984) 111 112check_erratum_ls cortex_x3, ERRATUM(3692984), CPU_REV(1, 2) 113 114add_erratum_entry cortex_x3, ERRATUM(3701769), ERRATA_X3_3701769 115 116check_erratum_ls cortex_x3, ERRATUM(3701769), CPU_REV(1, 2) 117 118workaround_reset_start cortex_x3, ERRATUM(3827463), ERRATA_X3_3827463 119 sysreg_bit_set CORTEX_X3_CPUACTLR_EL1, BIT(1) 120workaround_reset_end cortex_x3, ERRATUM(3827463) 121 122check_erratum_ls cortex_x3, ERRATUM(3827463), CPU_REV(1, 1) 123 124workaround_reset_start cortex_x3, ERRATUM(3888125), ERRATA_X3_3888125 125 sysreg_bit_set CORTEX_X3_CPUACTLR2_EL1, BIT(22) 126workaround_reset_end cortex_x3, ERRATUM(3888125) 127 128check_erratum_ls cortex_x3, ERRATUM(3888125), CPU_REV(1, 2) 129 130workaround_reset_start cortex_x3, ERRATUM(4302966), ERRATA_X3_4302966 131 sysreg_bit_set CORTEX_X3_CPUACTLR5_EL1, BIT(50) 132workaround_reset_end cortex_x3, ERRATUM(4302966) 133 134check_erratum_ls cortex_x3, ERRATUM(4302966), CPU_REV(1, 2) 135 136workaround_reset_start cortex_x3, CVE(2022, 23960), WORKAROUND_CVE_2022_23960 137#if IMAGE_BL31 138 override_vector_table wa_cve_vbar_cortex_x3 139#endif /* IMAGE_BL31 */ 140workaround_reset_end cortex_x3, CVE(2022, 23960) 141 142check_erratum_ls cortex_x3, CVE(2022, 23960), CPU_REV(1, 0) 143 144/* Disable hardware page aggregation. Enables mitigation for `CVE-2024-5660` */ 145workaround_reset_start cortex_x3, CVE(2024, 5660), WORKAROUND_CVE_2024_5660 146 sysreg_bit_set CORTEX_X3_CPUECTLR_EL1, BIT(46) 147workaround_reset_end cortex_x3, CVE(2024, 5660) 148 149check_erratum_ls cortex_x3, CVE(2024, 5660), CPU_REV(1, 2) 150 151 /* -------------------------------------------------------------- 152 * CVE-2024-7881 is mitigated for Cortex-X3 using erratum 3692984 153 * workaround by disabling the affected prefetcher setting 154 * CPUACTLR6_EL1[41]. 155 * -------------------------------------------------------------- 156 */ 157workaround_reset_start cortex_x3, CVE(2024, 7881), WORKAROUND_CVE_2024_7881 158 sysreg_bit_set CORTEX_X3_CPUACTLR6_EL1, BIT(41) 159workaround_reset_end cortex_x3, CVE(2024, 7881) 160 161check_erratum_ls cortex_x3, CVE(2024, 7881), CPU_REV(1, 2) 162 163 /* 164 * Instruction patch sequence to trap 'cpp rctx' instructions to EL3. 165 * Enables mitigation for CVE-2025-0647. 166 */ 167workaround_reset_start cortex_x3, CVE(2025, 647), WORKAROUND_CVE_2025_0647 168#if IMAGE_BL31 169 mov x0, #WA_PATCH_SLOT(3) 170 bl wa_cve_2025_0647_instruction_patch 171#endif /* IMAGE_BL31 */ 172workaround_reset_end cortex_x3, CVE(2025, 647) 173 174check_erratum_chosen cortex_x3, CVE(2025, 647), WORKAROUND_CVE_2025_0647 175 176#if WORKAROUND_CVE_2025_0647 177func cortex_x3_impl_defined_el3_handler 178 mov x0, #WA_LS_RCG_EN 179 180 /* See if this call came from trap handler. */ 181 cmp x1, #EC_IMP_DEF_EL3 182 bne wa_cve_2025_0647_do_cpp_wa 183 orr x0, x0, #WA_IS_TRAP_HANDLER 184 b wa_cve_2025_0647_do_cpp_wa 185endfunc cortex_x3_impl_defined_el3_handler 186#endif 187 188cpu_reset_func_start cortex_x3 189 /* Disable speculative loads */ 190 msr SSBS, xzr 191 enable_mpmm 192cpu_reset_func_end cortex_x3 193 194 /* ---------------------------------------------------- 195 * HW will do the cache maintenance while powering down 196 * ---------------------------------------------------- 197 */ 198func cortex_x3_core_pwr_dwn 199 apply_erratum cortex_x3, ERRATUM(2313909), ERRATA_X3_2313909 200 /* --------------------------------------------------- 201 * Enable CPU power down bit in power control register 202 * --------------------------------------------------- 203 */ 204 sysreg_bit_set CORTEX_X3_CPUPWRCTLR_EL1, CORTEX_X3_CPUPWRCTLR_EL1_CORE_PWRDN_BIT 205 apply_erratum cortex_x3, ERRATUM(2743088), ERRATA_X3_2743088, NO_GET_CPU_REV 206 isb 207 ret 208endfunc cortex_x3_core_pwr_dwn 209 210 /* --------------------------------------------- 211 * This function provides Cortex-X3- 212 * specific register information for crash 213 * reporting. It needs to return with x6 214 * pointing to a list of register names in ascii 215 * and x8 - x15 having values of registers to be 216 * reported. 217 * --------------------------------------------- 218 */ 219.section .rodata.cortex_x3_regs, "aS" 220cortex_x3_regs: /* The ascii list of register names to be reported */ 221 .asciz "cpuectlr_el1", "" 222 223func cortex_x3_cpu_reg_dump 224 adr x6, cortex_x3_regs 225 mrs x8, CORTEX_X3_CPUECTLR_EL1 226 ret 227endfunc cortex_x3_cpu_reg_dump 228 229#if WORKAROUND_CVE_2025_0647 && IMAGE_BL31 230declare_cpu_ops_eh cortex_x3, CORTEX_X3_MIDR, \ 231 cortex_x3_reset_func, \ 232 cortex_x3_impl_defined_el3_handler, \ 233 cortex_x3_core_pwr_dwn 234#else 235declare_cpu_ops cortex_x3, CORTEX_X3_MIDR, \ 236 cortex_x3_reset_func, \ 237 cortex_x3_core_pwr_dwn 238#endif 239