Re: [RFC PATCH 3/3] arm64: errata: Disable FWB on parts with non-ARM interconnects

From: Marc Zyngier <maz@kernel.org>
To: James Morse <james.morse@arm.com>
Cc: linux-arm-kernel@lists.infradead.org,
	Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will@kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	Lorenzo Pieralisi <lpieralisi@kernel.org>,
	Sudeep Holla <sudeep.holla@arm.com>,
	Oliver Upton <oliver.upton@linux.dev>
Subject: Re: [RFC PATCH 3/3] arm64: errata: Disable FWB on parts with non-ARM interconnects
Date: Thu, 16 Feb 2023 18:46:47 +0000	[thread overview]
Message-ID: <86mt5dxxbc.wl-maz@kernel.org> (raw)
In-Reply-To: <20230216182201.1705406-4-james.morse@arm.com>

On Thu, 16 Feb 2023 18:22:01 +0000,
James Morse <james.morse@arm.com> wrote:
> 
> Force Write Back (FWB) allows the hypervisor to force non-cacheable
> accesses made by a guest to be cacheable. This saves the hypervisor
> from doing cache maintenance on all pages the guest can access, to
> ensure the guest doesn't see stale (and possibly sensitive) data when
> making a non-cacheable access.
> 
> When stage1 translation is disabled, the SCTRL_E1.I bit controls the
> attributes used for instruction fetch, one of the options results in a
> non-cacheable access. A whole host of CPUs missed the FWB override
> in this case, meaning a KVM guest could fetch stale/junk data instead of
> instructions.
> 
> The workaround is to always do the cache maintenance. These parts don't
> have fine-grained-traps, so it isn't feasible to detect the guest
> disabling the MMU. Instead, disable FWB on the host.
> 
> While the CPUs are affected, this erratum doesn't occur on parts using
> Arm's CMN interconnects. Use the Errata Management API to discover whether
> this CPU is affected.
> 
> Because guest execution is compromised, the workaround is enabled by
> default. If the Errata Management API isn't implemented by firmware, the
> workaround will be enabled. If a target platform is not affected, and it
> isn't possible to add support for the Errata Management API, the erratum
> can be disabled in Kconfig.

I'm feeling a bit sick...

My main concern is hardly anyone implements this errata management
API, if at all. We should:

- give people an option to disable this from the command-line if they
  know they are on an unaffected system

- have some form of DT property that indicates the HW isn't affected

Thoughts?

	M.

-- 
Without deviation from the norm, progress is not possible.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel