Re: [PATCH v2 01/10] efi/zboot: arm64: Add missing barrier after cache maintenance

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [Medium] efi/zboot: arm64: missing dsb(ish) in efi_cache_sync_image()
  when IDC is set
- [Low] efi/zboot: arm64: missing Fixes trailer for
  efi_cache_sync_image() barrier fix
--

commit e6570e5cb733b9a306b82caaabc5d43037fdb9b0
Author: Ard Biesheuvel <ardb@kernel.org>

> efi/zboot: arm64: Add missing barrier after cache maintenance
>
> Prevent the I-cache from fetching stale data by issuing a barrier after
> the data cache maintenance completes but before performing the I-cache
> maintenance.
>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

[Severity: Low]
Should this bug fix include a Fixes tag for the commit that introduced
efi_cache_sync_image()?

  Fixes: d9ffe524a538 ("efi/arm64: libstub: Split off kernel image relocation for builtin stub")

> diff --git a/drivers/firmware/efi/libstub/arm64.c b/drivers/firmware/efi/libstub/arm64.c
> index e57cd3de0a00f..62fc8e53c8a04 100644
> --- a/drivers/firmware/efi/libstub/arm64.c
> +++ b/drivers/firmware/efi/libstub/arm64.c
> @@ -107,6 +107,8 @@ void efi_cache_sync_image(unsigned long image_base,
>  			base += lsize;
>  			size -= lsize;
>  		} while (size >= lsize);
> +
> +		dsb(ish);
>  	}
>  
>  	asm("ic ialluis");

[Severity: Medium]
Should dsb(ish) be placed outside the !(ctr & BIT(CTR_EL0_IDC_SHIFT))
block, immediately before asm("ic ialluis")?

When CTR_EL0.IDC is set, explicit data cache clean instructions are not
needed, but a DSB is still required to ensure the prior stores from
decompressing the kernel image have completed before "ic ialluis"
invalidates the instruction cache (matching caches_clean_inval_pou_macro
in arch/arm64/mm/cache.S).  Otherwise the I-cache invalidation can
complete before those stores drain, allowing stale instructions to be
fetched.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110121731.2728824-12-ardb+git@google.com?part=1