Re: [PATCH v3] arm64: errata: Add NXP iMX8QM workaround for A53 cache coherency issue

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Trapping EL0 cache maintenance instructions breaks AArch32 compat applications because compat trap handlers are not implemented.
- [High] Missing Context Synchronization Event (ISB) immediately after writing to the SCTLR_EL1 control-plane system register.
--

--- Patch [1]: [PATCH v3] arm64: errata: Add NXP iMX8QM workaround for A53 cache coherency issue ---
commit ea6ce757f778ea074d9d845a9b2aa0e396e921d8
Author: Peng Fan <peng.fan@nxp.com>
Subject: arm64: errata: Add NXP iMX8QM workaround for A53 cache coherency issue

This patch adds a workaround for the i.MX8QM cache coherency issue ERR050104.
It downgrades targeted TLBI operations to broadcast-all variants, upgrades
IC IVAU to IC IALLUIS for kernel and userspace, and disables KVM.

Link: https://lore.kernel.org/all/20230420112952.28340-1-iivanov@suse.de/
Link: https://www.nxp.com/docs/en/errata/IMX8_1N94W.pdf

> diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
> index 5db8f0619e4bc..4ba68c1f29b29 100644
> --- a/arch/arm64/kernel/cpu_errata.c
> +++ b/arch/arm64/kernel/cpu_errata.c

> [ ... ]

> @@ -200,6 +202,28 @@ cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused)
>  	sysreg_clear_set(sctlr_el1, SCTLR_EL1_UCI, 0);
>  }
>  
> +#ifdef CONFIG_NXP_IMX8QM_ERRATUM_ERR050104
> +static bool
> +is_imx8qm_soc(const struct arm64_cpu_capabilities *entry, int scope)
> +{
> +	WARN_ON(preemptible());
> +
> +	return of_machine_is_compatible("fsl,imx8qm");
> +}
> +
> +static void
> +cpu_enable_imx8qm_err050104(const struct arm64_cpu_capabilities *__unused)
> +{
> +	cpu_enable_cache_maint_trap(__unused);

[Severity: High]
This is a pre-existing issue, but does trapping EL0 cache maintenance
instructions break AArch32 compat applications here?

The cpu_enable_cache_maint_trap() function clears SCTLR_EL1.UCI, which
causes EL0 cache maintenance instructions to trap to EL1. While AArch64
instructions trap as ESR_ELx_EC_SYS64 and are handled by
user_cache_maint_handler(), AArch32 CP15 instructions trap as
ESR_ELx_EC_CP15_32.

Looking at cp15_32_hooks[] in arch/arm64/kernel/traps.c, it lacks definitions
to catch trapped AArch32 CP15 cache maintenance instructions. This means the
trap falls through to do_el0_undef() which injects SIGILL, crashing valid
AArch32 userspace applications on affected systems.

[Severity: High]
This is also a pre-existing issue in cpu_enable_cache_maint_trap(), but does
the call here extend an unsynchronized execution window?

cpu_enable_cache_maint_trap() updates SCTLR_EL1 but misses the required
context synchronization event (isb) immediately after the write:

cpu_enable_cache_maint_trap()
    sysreg_clear_set(sctlr_el1, SCTLR_EL1_UCI, 0);
    /* missing isb() */

When called from cpu_enable_imx8qm_err050104(), execution continues to
kvm_disable_mode() without a barrier.

The ARM64 subsystem guidelines state that every write to a control-plane
system register must be followed by an isb() as the very next instruction,
otherwise the CPU operates under a stale configuration for several cycles.

> +
> +	/*
> +	 * TLB maintenance cannot be guaranteed correct for guests, so
> +	 * disable KVM as if kvm-arm.mode=none was passed on the command line.
> +	 */
> +	kvm_disable_mode();
> +}
> +#endif

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803-imx8qm-cache-coherency-v3-1-c518d0da3d3b@nxp.com?part=1