1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
|
/*
* Copyright (c) 2020-2026, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*
* TRM: https://developer.arm.com/documentation/102099/latest
* SDEN: https://developer.arm.com/documentation/SDEN-1982442/latest
*/
#include <arch.h>
#include <asm_macros.S>
#include <cpu_macros.S>
#include <dsu_macros.S>
#include <neoverse_n2.h>
#include "wa_cve_2022_23960_bhb_vector.S"
#include <wa_cve_2025_0647_cpprctx.h>
/* Hardware handled coherency */
#if HW_ASSISTED_COHERENCY == 0
#error "Neoverse N2 must be compiled with HW_ASSISTED_COHERENCY enabled"
#endif
/* 64-bit only core */
#if CTX_INCLUDE_AARCH32_REGS == 1
#error "Neoverse-N2 supports only AArch64. Compile with CTX_INCLUDE_AARCH32_REGS=0"
#endif
.global check_erratum_neoverse_n2_3701773
#if WORKAROUND_CVE_2022_23960
wa_cve_2022_23960_bhb_vector_table NEOVERSE_N2_BHB_LOOP_COUNT, neoverse_n2
#endif /* WORKAROUND_CVE_2022_23960 */
cpu_reset_prologue neoverse_n2
workaround_reset_start neoverse_n2, ERRATUM(2002655), ERRATA_N2_2002655
/* Apply instruction patching sequence */
ldr x0,=0x6
msr S3_6_c15_c8_0,x0
ldr x0,=0xF3A08002
msr S3_6_c15_c8_2,x0
ldr x0,=0xFFF0F7FE
msr S3_6_c15_c8_3,x0
ldr x0,=0x40000001003ff
msr S3_6_c15_c8_1,x0
ldr x0,=0x7
msr S3_6_c15_c8_0,x0
ldr x0,=0xBF200000
msr S3_6_c15_c8_2,x0
ldr x0,=0xFFEF0000
msr S3_6_c15_c8_3,x0
ldr x0,=0x40000001003f3
msr S3_6_c15_c8_1,x0
workaround_reset_end neoverse_n2, ERRATUM(2002655)
check_erratum_ls neoverse_n2, ERRATUM(2002655), CPU_REV(0, 0)
workaround_runtime_start neoverse_n2, ERRATUM(2009478), ERRATA_N2_2009478
/* Stash ERRSELR_EL1 in x2 */
mrs x2, ERRSELR_EL1
/* Select error record 0 and clear ED bit */
msr ERRSELR_EL1, xzr
mrs x1, ERXCTLR_EL1
bfi x1, xzr, #ERXCTLR_ED_SHIFT, #1
msr ERXCTLR_EL1, x1
/* Restore ERRSELR_EL1 from x2 */
msr ERRSELR_EL1, x2
workaround_runtime_end neoverse_n2, ERRATUM(2009478), NO_ISB
check_erratum_ls neoverse_n2, ERRATUM(2009478), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2025414), ERRATA_N2_2025414
sysreg_bit_set NEOVERSE_N2_CPUECTLR_EL1, NEOVERSE_N2_CPUECTLR_EL1_PFSTIDIS_BIT
workaround_reset_end neoverse_n2, ERRATUM(2025414)
check_erratum_ls neoverse_n2, ERRATUM(2025414), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2067956), ERRATA_N2_2067956
sysreg_bit_set NEOVERSE_N2_CPUACTLR_EL1, NEOVERSE_N2_CPUACTLR_EL1_BIT_46
workaround_reset_end neoverse_n2, ERRATUM(2067956)
check_erratum_ls neoverse_n2, ERRATUM(2067956), CPU_REV(0, 0)
workaround_runtime_start neoverse_n2, ERRATUM(2138953), ERRATA_N2_2138953
sysreg_bit_set NEOVERSE_N2_CPUACTLR2_EL1, BIT(29)
workaround_runtime_end neoverse_n2, ERRATUM(2138953)
check_erratum_ls neoverse_n2, ERRATUM(2138953), CPU_REV(0, 3)
workaround_reset_start neoverse_n2, ERRATUM(2138956), ERRATA_N2_2138956
/* Apply instruction patching sequence */
ldr x0,=0x3
msr S3_6_c15_c8_0,x0
ldr x0,=0xF3A08002
msr S3_6_c15_c8_2,x0
ldr x0,=0xFFF0F7FE
msr S3_6_c15_c8_3,x0
ldr x0,=0x10002001003FF
msr S3_6_c15_c8_1,x0
ldr x0,=0x4
msr S3_6_c15_c8_0,x0
ldr x0,=0xBF200000
msr S3_6_c15_c8_2,x0
ldr x0,=0xFFEF0000
msr S3_6_c15_c8_3,x0
ldr x0,=0x10002001003F3
msr S3_6_c15_c8_1,x0
workaround_reset_end neoverse_n2, ERRATUM(2138956)
check_erratum_ls neoverse_n2, ERRATUM(2138956), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2138958), ERRATA_N2_2138958
/* Apply instruction patching sequence */
sysreg_bit_set NEOVERSE_N2_CPUACTLR5_EL1, NEOVERSE_N2_CPUACTLR5_EL1_BIT_13
workaround_reset_end neoverse_n2, ERRATUM(2138958)
check_erratum_ls neoverse_n2, ERRATUM(2138958), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2189731), ERRATA_N2_2189731
sysreg_bit_set NEOVERSE_N2_CPUACTLR5_EL1, NEOVERSE_N2_CPUACTLR5_EL1_BIT_44
workaround_reset_end neoverse_n2, ERRATUM(2189731)
check_erratum_ls neoverse_n2, ERRATUM(2189731), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2242400), ERRATA_N2_2242400
/* Apply instruction patching sequence */
sysreg_bit_set NEOVERSE_N2_CPUACTLR5_EL1, NEOVERSE_N2_CPUACTLR5_EL1_BIT_17
ldr x0, =0x2
msr S3_6_c15_c8_0, x0
ldr x0, =0x10F600E000
msr S3_6_c15_c8_2, x0
ldr x0, =0x10FF80E000
msr S3_6_c15_c8_3, x0
ldr x0, =0x80000000003FF
msr S3_6_c15_c8_1, x0
workaround_reset_end neoverse_n2, ERRATUM(2242400)
check_erratum_ls neoverse_n2, ERRATUM(2242400), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2242415), ERRATA_N2_2242415
sysreg_bit_set NEOVERSE_N2_CPUACTLR_EL1, NEOVERSE_N2_CPUACTLR_EL1_BIT_22
workaround_reset_end neoverse_n2, ERRATUM(2242415)
check_erratum_ls neoverse_n2, ERRATUM(2242415), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2280757), ERRATA_N2_2280757
/* Apply instruction patching sequence */
sysreg_bit_set NEOVERSE_N2_CPUACTLR_EL1, NEOVERSE_N2_CPUACTLR_EL1_BIT_22
workaround_reset_end neoverse_n2, ERRATUM(2280757)
check_erratum_ls neoverse_n2, ERRATUM(2280757), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2313941), ERRATA_DSU_2313941
errata_dsu_2313941_wa_impl
workaround_reset_end neoverse_n2, ERRATUM(2313941)
check_erratum_custom_start neoverse_n2, ERRATUM(2313941)
branch_if_scu_not_present 2f /* label 1 is used in the macro */
check_errata_dsu_2313941_impl
2:
ret
check_erratum_custom_end neoverse_n2, ERRATUM(2313941)
.global erratum_neoverse_n2_2326639_wa
workaround_runtime_start neoverse_n2, ERRATUM(2326639), ERRATA_N2_2326639
/* Set/unset bit 36 in ACTLR2_EL1. The first call will set it, applying
* the workaround. Second call clears it to undo it. */
sysreg_bit_toggle NEOVERSE_N2_CPUACTLR2_EL1, NEOVERSE_N2_CPUACTLR2_EL1_BIT_36
workaround_runtime_end neoverse_n2, ERRATUM(2326639)
check_erratum_ls neoverse_n2, ERRATUM(2326639), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2340933), ERRATA_N2_2340933
/* Set bit 61 in CPUACTLR5_EL1 */
sysreg_bit_set NEOVERSE_N2_CPUACTLR5_EL1, BIT(61)
workaround_reset_end neoverse_n2, ERRATUM(2340933)
check_erratum_ls neoverse_n2, ERRATUM(2340933), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2346952), ERRATA_N2_2346952
/* Set TXREQ to STATIC and full L2 TQ size */
mrs x1, NEOVERSE_N2_CPUECTLR2_EL1
mov x0, #CPUECTLR2_EL1_TXREQ_STATIC_FULL
bfi x1, x0, #CPUECTLR2_EL1_TXREQ_LSB, #CPUECTLR2_EL1_TXREQ_WIDTH
msr NEOVERSE_N2_CPUECTLR2_EL1, x1
workaround_reset_end neoverse_n2, ERRATUM(2346952)
check_erratum_ls neoverse_n2, ERRATUM(2346952), CPU_REV(0, 2)
workaround_reset_start neoverse_n2, ERRATUM(2376738), ERRATA_N2_2376738
/* Set CPUACTLR2_EL1[0] to 1 to force PLDW/PFRM
* ST to behave like PLD/PFRM LD and not cause
* invalidations to other PE caches.
*/
sysreg_bit_set NEOVERSE_N2_CPUACTLR2_EL1, NEOVERSE_N2_CPUACTLR2_EL1_BIT_0
workaround_reset_end neoverse_n2, ERRATUM(2376738)
check_erratum_ls neoverse_n2, ERRATUM(2376738), CPU_REV(0, 3)
workaround_reset_start neoverse_n2, ERRATUM(2388450), ERRATA_N2_2388450
/*Set bit 40 in ACTLR2_EL1 */
sysreg_bit_set NEOVERSE_N2_CPUACTLR2_EL1, NEOVERSE_N2_CPUACTLR2_EL1_BIT_40
workaround_reset_end neoverse_n2, ERRATUM(2388450)
check_erratum_ls neoverse_n2, ERRATUM(2388450), CPU_REV(0, 0)
workaround_reset_start neoverse_n2, ERRATUM(2743014), ERRATA_N2_2743014
/* Set CPUACTLR5_EL1[56:55] to 2'b01 */
sysreg_lazy_start NEOVERSE_N2_CPUACTLR5_EL1
sysreg_lazy_set NEOVERSE_N2_CPUACTLR5_EL1_BIT_55
sysreg_lazy_clear NEOVERSE_N2_CPUACTLR5_EL1_BIT_56
sysreg_lazy_commit NEOVERSE_N2_CPUACTLR5_EL1
workaround_reset_end neoverse_n2, ERRATUM(2743014)
check_erratum_ls neoverse_n2, ERRATUM(2743014), CPU_REV(0, 2)
workaround_runtime_start neoverse_n2, ERRATUM(2743089), ERRATA_N2_2743089
/* dsb before isb of power down sequence */
dsb sy
workaround_runtime_end neoverse_n2, ERRATUM(2743089)
check_erratum_ls neoverse_n2, ERRATUM(2743089), CPU_REV(0, 2)
workaround_reset_start neoverse_n2, ERRATUM(2779511), ERRATA_N2_2779511
/* Set bit 47 in ACTLR3_EL1 */
sysreg_bit_set NEOVERSE_N2_CPUACTLR3_EL1, NEOVERSE_N2_CPUACTLR3_EL1_BIT_47
workaround_reset_end neoverse_n2, ERRATUM(2779511)
check_erratum_ls neoverse_n2, ERRATUM(2779511), CPU_REV(0, 2)
workaround_runtime_start neoverse_n2, ERRATUM(3324339), ERRATA_N2_3324339
speculation_barrier
workaround_runtime_end neoverse_n2, ERRATUM(3324339)
check_erratum_ls neoverse_n2, ERRATUM(3324339), CPU_REV(0, 3)
add_erratum_entry neoverse_n2, ERRATUM(3701773), ERRATA_N2_3701773
check_erratum_ls neoverse_n2, ERRATUM(3701773), CPU_REV(0, 3)
workaround_reset_start neoverse_n2, ERRATUM(3888123), ERRATA_N2_3888123
sysreg_bit_set NEOVERSE_N2_CPUACTLR2_EL1, BIT(22)
workaround_reset_end neoverse_n2, ERRATUM(3888123)
check_erratum_ls neoverse_n2, ERRATUM(3888123), CPU_REV(0, 3)
workaround_reset_start neoverse_n2, ERRATUM(4302970), ERRATA_N2_4302970
sysreg_bit_set NEOVERSE_N2_CPUACTLR5_EL1, BIT(50)
workaround_reset_end neoverse_n2, ERRATUM(4302970)
check_erratum_ls neoverse_n2, ERRATUM(4302970), CPU_REV(0, 3)
workaround_reset_start neoverse_n2, CVE(2022,23960), WORKAROUND_CVE_2022_23960
#ifdef IMAGE_BL31
/*
* The Neoverse-N2 generic vectors are overridden to apply errata
* mitigation on exception entry from lower ELs.
*/
override_vector_table wa_cve_vbar_neoverse_n2
#endif /* IMAGE_BL31 */
workaround_reset_end neoverse_n2, CVE(2022,23960)
check_erratum_chosen neoverse_n2, CVE(2022, 23960), WORKAROUND_CVE_2022_23960
/* Disable hardware page aggregation. Enables mitigation for `CVE-2024-5660` */
workaround_reset_start neoverse_n2, CVE(2024, 5660), WORKAROUND_CVE_2024_5660
sysreg_bit_set NEOVERSE_N2_CPUECTLR_EL1, BIT(46)
workaround_reset_end neoverse_n2, CVE(2024, 5660)
check_erratum_ls neoverse_n2, CVE(2024, 5660), CPU_REV(0, 3)
/*
* Instruction patch sequence to trap 'cpp rctx' instructions to EL3.
* Enables mitigation for CVE-2025-0647.
*/
workaround_reset_start neoverse_n2, CVE(2025, 647), WORKAROUND_CVE_2025_0647
#ifdef IMAGE_BL31
mov x0, #(WA_USE_T32_OPCODE | WA_PATCH_SLOT(0))
bl wa_cve_2025_0647_instruction_patch
#endif /* IMAGE_BL31 */
workaround_reset_end neoverse_n2, CVE(2025, 647)
check_erratum_chosen neoverse_n2, CVE(2025, 647), WORKAROUND_CVE_2025_0647
#if WORKAROUND_CVE_2025_0647
func neoverse_n2_impl_defined_el3_handler
mov x0, #WA_LS_RCG_EN
/* See if this call came from trap handler. */
cmp x1, #EC_IMP_DEF_EL3
bne wa_cve_2025_0647_do_cpp_wa
orr x0, x0, #WA_IS_TRAP_HANDLER
b wa_cve_2025_0647_do_cpp_wa
endfunc neoverse_n2_impl_defined_el3_handler
#endif
add_erratum_entry neoverse_n2, CVE(2025, 10263), WORKAROUND_CVE_2025_10263
check_erratum_chosen neoverse_n2, CVE(2025, 10263), WORKAROUND_CVE_2025_10263
/* -------------------------------------------
* The CPU Ops reset function for Neoverse N2.
* -------------------------------------------
*/
cpu_reset_func_start neoverse_n2
/* Check if the PE implements SSBS */
mrs x0, id_aa64pfr1_el1
tst x0, #MASK(ID_AA64PFR1_EL1_SSBS)
b.eq 1f
/* Disable speculative loads */
msr SSBS, xzr
apply_erratum neoverse_n2, ERRATUM(3324339), ERRATA_N2_3324339
1:
/* Force all cacheable atomic instructions to be near */
sysreg_bit_set NEOVERSE_N2_CPUACTLR2_EL1, NEOVERSE_N2_CPUACTLR2_EL1_BIT_2
#if ENABLE_FEAT_AMU
/* Make sure accesses from EL0/EL1 and EL2 are not trapped to EL3 */
sysreg_bit_clear cptr_el3, TAM_BIT
/* Make sure accesses from EL0/EL1 are not trapped to EL2 */
sysreg_bit_clear cptr_el2, TAM_BIT
/* No need to enable the counters as this would be done at el3 exit */
#endif
#if NEOVERSE_Nx_EXTERNAL_LLC
/* Some systems may have External LLC, core needs to be made aware */
sysreg_bit_set NEOVERSE_N2_CPUECTLR_EL1, NEOVERSE_N2_CPUECTLR_EL1_EXTLLC_BIT
#endif
#if NEOVERSE_N2_PREFETCHER_DISABLE
/* Disable region prefetcher for L2 cache perf measurement */
apply_erratum neoverse_n2, ERRATUM(2138953), ERRATA_N2_2138953
sysreg_bit_set NEOVERSE_N2_CPUECTLR_EL1, NEOVERSE_N2_CPUECTLR_EL1_PFDIS_BIT
#endif
cpu_reset_func_end neoverse_n2
func neoverse_n2_core_pwr_dwn
apply_erratum neoverse_n2, ERRATUM(2009478), ERRATA_N2_2009478
apply_erratum neoverse_n2, ERRATUM(2326639), ERRATA_N2_2326639, NO_GET_CPU_REV
/* ---------------------------------------------------
* Enable CPU power down bit in power control register
* No need to do cache maintenance here.
* ---------------------------------------------------
*/
sysreg_bit_set NEOVERSE_N2_CPUPWRCTLR_EL1, NEOVERSE_N2_CORE_PWRDN_EN_BIT
apply_erratum neoverse_n2, ERRATUM(2743089), ERRATA_N2_2743089, NO_GET_CPU_REV
isb
ret
endfunc neoverse_n2_core_pwr_dwn
/* ---------------------------------------------
* This function provides Neoverse N2 specific
* register information for crash reporting.
* It needs to return with x6 pointing to
* a list of register names in ASCII and
* x8 - x15 having values of registers to be
* reported.
* ---------------------------------------------
*/
.section .rodata.neoverse_n2_regs, "aS"
neoverse_n2_regs: /* The ASCII list of register names to be reported */
.asciz "cpupwrctlr_el1", ""
func neoverse_n2_cpu_reg_dump
adr x6, neoverse_n2_regs
mrs x8, NEOVERSE_N2_CPUPWRCTLR_EL1
ret
endfunc neoverse_n2_cpu_reg_dump
#if WORKAROUND_CVE_2025_0647 && defined(IMAGE_BL31)
declare_cpu_ops_eh neoverse_n2, NEOVERSE_N2_MIDR, \
neoverse_n2_reset_func, \
neoverse_n2_impl_defined_el3_handler, \
neoverse_n2_core_pwr_dwn
#else
declare_cpu_ops neoverse_n2, NEOVERSE_N2_MIDR, \
neoverse_n2_reset_func, \
neoverse_n2_core_pwr_dwn
#endif
|
