[PATCH 0/5] arm64: Get rid of CnP

[PATCH 0/5] arm64: Get rid of CnP

[Marc Zyngier]

FEAT_TTCNP (née ARMv8.2-TTCNP, "Translation table Common not private
translations", commonly known as CnP) was an attempt at allowing the
sharing of TLBs in a SMT implementation. This was an interesting idea,
but it never really went anywhere:

- There is only one implementation from ARM (Cortex-A65) that could
  (conditional) be capable of using it, but this thing has never been
  seen in the wild (shout if you have one!)

- There is one implementation from NVIDIA (Carmel) that has a
  messed-up TLB invalidation "feature" that prevents the use of CnP

- The only other SMT implementation (Cavium-TX2) predates CnP, so it
  doesn't implement it

- All the modern CPUs (which are not SMT) advertise CnP (it is
  mandatory from ARMv8.2), but of course don't implement anything

- And then we all discovered what Side Channel attacks were...

CnP also makes reasoning about TLBs harder, as it blurs the idea that
a CPU only has private TLBs. Now another CPU (thread) can hit in your
TLBs in weird ways, and sequencing the enabling of CnP requires some
fragile coordination.

So farewell, CnP. It is very unlikely we'll miss you.

This series removes most traces of CnP, only keeping some basic
definitions for documentation purpose. It doesn't amount to much code,
but it feels like we're better off without it.

Marc Zyngier (5):
  arm64: Remove CnP detection
  arm64: Drop NVIDIA Carmel CnP workaround
  arm64: Drop support for CnP
  KVM: arm64: Remove CnP usage
  arm64: Remove CONFIG_ARM64_CNP

 Documentation/arm64/silicon-errata.rst |  2 --
 arch/arm64/Kconfig                     | 24 ------------------
 arch/arm64/include/asm/cpufeature.h    |  6 -----
 arch/arm64/include/asm/kvm_mmu.h       |  3 +--
 arch/arm64/include/asm/mmu_context.h   | 14 +----------
 arch/arm64/kernel/cpu_errata.c         |  8 ------
 arch/arm64/kernel/cpufeature.c         | 34 --------------------------
 arch/arm64/kernel/mte.c                | 12 ---------
 arch/arm64/kernel/suspend.c            |  4 ---
 arch/arm64/kvm/hyp/nvhe/hyp-init.S     |  6 -----
 arch/arm64/mm/context.c                |  7 ------
 arch/arm64/tools/cpucaps               |  2 --
 12 files changed, 2 insertions(+), 120 deletions(-)

-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH 1/5] arm64: Remove CnP detection

[Marc Zyngier]

In order to get rid of CnP one bit at a time without messing up
the build nor the runtime behaviour of the kernel, let's start
by dropping the feature detection.

Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/kernel/cpufeature.c | 27 ---------------------------
 1 file changed, 27 deletions(-)

diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 7d7128c65161..ca4e7e1fc9fa 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1594,23 +1594,6 @@ static bool has_cache_dic(const struct arm64_cpu_capabilities *entry,
 	return ctr & BIT(CTR_EL0_DIC_SHIFT);
 }
 
-static bool __maybe_unused
-has_useable_cnp(const struct arm64_cpu_capabilities *entry, int scope)
-{
-	/*
-	 * Kdump isn't guaranteed to power-off all secondary CPUs, CNP
-	 * may share TLB entries with a CPU stuck in the crashed
-	 * kernel.
-	 */
-	if (is_kdump_kernel())
-		return false;
-
-	if (cpus_have_const_cap(ARM64_WORKAROUND_NVIDIA_CARMEL_CNP))
-		return false;
-
-	return has_cpuid_feature(entry, scope);
-}
-
 /*
  * This check is triggered during the early boot before the cpufeature
  * is initialised. Checking the status on the local CPU allows the boot
@@ -2446,16 +2429,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
 		.matches = has_cpuid_feature,
 		ARM64_CPUID_FIELDS(ID_AA64PFR1_EL1, SSBS, IMP)
 	},
-#ifdef CONFIG_ARM64_CNP
-	{
-		.desc = "Common not Private translations",
-		.capability = ARM64_HAS_CNP,
-		.type = ARM64_CPUCAP_SYSTEM_FEATURE,
-		.matches = has_useable_cnp,
-		.cpu_enable = cpu_enable_cnp,
-		ARM64_CPUID_FIELDS(ID_AA64MMFR2_EL1, CnP, IMP)
-	},
-#endif
 	{
 		.desc = "Speculation barrier (SB)",
 		.capability = ARM64_HAS_SB,
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH 2/5] arm64: Drop NVIDIA Carmel CnP workaround

[Marc Zyngier]

Carmel has a pretty wacky view of CnP, meaning that it was never
enabled on this platform. I will miss the hilarious understatement
of the Kconfig entry, but these things are better forgotten.

Remove the whole Carmel workaround.

Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 Documentation/arm64/silicon-errata.rst |  2 --
 arch/arm64/Kconfig                     | 10 ----------
 arch/arm64/kernel/cpu_errata.c         |  8 --------
 arch/arm64/tools/cpucaps               |  1 -
 4 files changed, 21 deletions(-)

diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst
index 9e311bc43e05..bb0d3f530cdb 100644
--- a/Documentation/arm64/silicon-errata.rst
+++ b/Documentation/arm64/silicon-errata.rst
@@ -170,8 +170,6 @@ stable kernels.
 | Marvell        | ARM-MMU-500     | #582743         | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+
-| NVIDIA         | Carmel Core     | N/A             | NVIDIA_CARMEL_CNP_ERRATUM   |
-+----------------+-----------------+-----------------+-----------------------------+
 | NVIDIA         | T241 GICv3/4.x  | T241-FABRIC-4   | N/A                         |
 +----------------+-----------------+-----------------+-----------------------------+
 +----------------+-----------------+-----------------+-----------------------------+
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b1201d25a8a4..41125ff8ae69 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1160,16 +1160,6 @@ config QCOM_FALKOR_ERRATUM_E1041
 
 	  If unsure, say Y.
 
-config NVIDIA_CARMEL_CNP_ERRATUM
-	bool "NVIDIA Carmel CNP: CNP on Carmel semantically different than ARM cores"
-	default y
-	help
-	  If CNP is enabled on Carmel cores, non-sharable TLBIs on a core will not
-	  invalidate shared TLB entries installed by a different core, as it would
-	  on standard ARM cores.
-
-	  If unsure, say Y.
-
 config ROCKCHIP_ERRATUM_3588001
 	bool "Rockchip 3588001: GIC600 can not support shareability attributes"
 	default y
diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 307faa2b4395..785eeb403db9 100644
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -625,14 +625,6 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 				  1, 0),
 	},
 #endif
-#ifdef CONFIG_NVIDIA_CARMEL_CNP_ERRATUM
-	{
-		/* NVIDIA Carmel */
-		.desc = "NVIDIA Carmel CNP erratum",
-		.capability = ARM64_WORKAROUND_NVIDIA_CARMEL_CNP,
-		ERRATA_MIDR_ALL_VERSIONS(MIDR_NVIDIA_CARMEL),
-	},
-#endif
 #ifdef CONFIG_ARM64_WORKAROUND_TRBE_OVERWRITE_FILL_MODE
 	{
 		/*
diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps
index 40ba95472594..a94808ba819c 100644
--- a/arch/arm64/tools/cpucaps
+++ b/arch/arm64/tools/cpucaps
@@ -87,7 +87,6 @@ WORKAROUND_CAVIUM_TX2_219_PRFM
 WORKAROUND_CAVIUM_TX2_219_TVM
 WORKAROUND_CLEAN_CACHE
 WORKAROUND_DEVICE_LOAD_ACQUIRE
-WORKAROUND_NVIDIA_CARMEL_CNP
 WORKAROUND_QCOM_FALKOR_E1003
 WORKAROUND_REPEAT_TLBI
 WORKAROUND_SPECULATIVE_AT
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH 3/5] arm64: Drop support for CnP

[Marc Zyngier]

Using CnP in the core architecture code was always fragile (such
as the interactions with MTE), and removing this stuff feels like
a good cleanup.

Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/include/asm/mmu_context.h | 14 +-------------
 arch/arm64/kernel/cpufeature.c       |  7 -------
 arch/arm64/kernel/mte.c              | 12 ------------
 arch/arm64/kernel/suspend.c          |  4 ----
 arch/arm64/mm/context.c              |  7 -------
 5 files changed, 1 insertion(+), 43 deletions(-)

diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 56911691bef0..2d3953d65387 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -139,7 +139,7 @@ static inline void cpu_install_ttbr0(phys_addr_t ttbr0, unsigned long t0sz)
 	local_flush_tlb_all();
 	__cpu_set_tcr_t0sz(t0sz);
 
-	/* avoid cpu_switch_mm() and its SW-PAN and CNP interactions */
+	/* avoid cpu_switch_mm() and its SW-PAN interactions */
 	write_sysreg(ttbr0, ttbr0_el1);
 	isb();
 }
@@ -158,18 +158,6 @@ static inline void cpu_replace_ttbr1(pgd_t *pgdp, pgd_t *idmap)
 	/* phys_to_ttbr() zeros lower 2 bits of ttbr with 52-bit PA */
 	phys_addr_t ttbr1 = phys_to_ttbr(virt_to_phys(pgdp));
 
-	if (system_supports_cnp() && !WARN_ON(pgdp != lm_alias(swapper_pg_dir))) {
-		/*
-		 * cpu_replace_ttbr1() is used when there's a boot CPU
-		 * up (i.e. cpufeature framework is not up yet) and
-		 * latter only when we enable CNP via cpufeature's
-		 * enable() callback.
-		 * Also we rely on the cpu_hwcap bit being set before
-		 * calling the enable() function.
-		 */
-		ttbr1 |= TTBR_CNP_BIT;
-	}
-
 	replace_phys = (void *)__pa_symbol(idmap_cpu_replace_ttbr1);
 
 	__cpu_install_idmap(idmap);
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index ca4e7e1fc9fa..8f86dca5ee75 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -171,8 +171,6 @@ void dump_cpu_features(void)
 		.width = 0,				\
 	}
 
-static void cpu_enable_cnp(struct arm64_cpu_capabilities const *cap);
-
 static bool __system_matches_cap(unsigned int n);
 
 /*
@@ -3312,11 +3310,6 @@ static int __init init_32bit_el0_mask(void)
 }
 subsys_initcall_sync(init_32bit_el0_mask);
 
-static void __maybe_unused cpu_enable_cnp(struct arm64_cpu_capabilities const *cap)
-{
-	cpu_replace_ttbr1(lm_alias(swapper_pg_dir), idmap_pg_dir);
-}
-
 /*
  * We emulate only the following system register space.
  * Op0 = 0x3, CRn = 0x0, Op1 = 0x0, CRm = [0, 2 - 7]
diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
index 7e89968bd282..e51ee92c58df 100644
--- a/arch/arm64/kernel/mte.c
+++ b/arch/arm64/kernel/mte.c
@@ -290,18 +290,6 @@ void mte_cpu_setup(void)
 {
 	u64 rgsr;
 
-	/*
-	 * CnP must be enabled only after the MAIR_EL1 register has been set
-	 * up. Inconsistent MAIR_EL1 between CPUs sharing the same TLB may
-	 * lead to the wrong memory type being used for a brief window during
-	 * CPU power-up.
-	 *
-	 * CnP is not a boot feature so MTE gets enabled before CnP, but let's
-	 * make sure that is the case.
-	 */
-	BUG_ON(read_sysreg(ttbr0_el1) & TTBR_CNP_BIT);
-	BUG_ON(read_sysreg(ttbr1_el1) & TTBR_CNP_BIT);
-
 	/* Normal Tagged memory type at the corresponding MAIR index */
 	sysreg_clear_set(mair_el1,
 			 MAIR_ATTRIDX(MAIR_ATTR_MASK, MT_NORMAL_TAGGED),
diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
index 0fbdf5fe64d8..af92e2d1d55f 100644
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -53,10 +53,6 @@ void notrace __cpu_suspend_exit(void)
 	 */
 	cpu_uninstall_idmap();
 
-	/* Restore CnP bit in TTBR1_EL1 */
-	if (system_supports_cnp())
-		cpu_replace_ttbr1(lm_alias(swapper_pg_dir), idmap_pg_dir);
-
 	/*
 	 * PSTATE was not saved over suspend/resume, re-enable any detected
 	 * features that might not have been set correctly.
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index e1e0dca01839..3c65644ed770 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -218,9 +218,6 @@ void check_and_switch_context(struct mm_struct *mm)
 	unsigned int cpu;
 	u64 asid, old_active_asid;
 
-	if (system_supports_cnp())
-		cpu_set_reserved_ttbr0();
-
 	asid = atomic64_read(&mm->context.id);
 
 	/*
@@ -352,10 +349,6 @@ void cpu_do_switch_mm(phys_addr_t pgd_phys, struct mm_struct *mm)
 	unsigned long asid = ASID(mm);
 	unsigned long ttbr0 = phys_to_ttbr(pgd_phys);
 
-	/* Skip CNP for the reserved ASID */
-	if (system_supports_cnp() && asid)
-		ttbr0 |= TTBR_CNP_BIT;
-
 	/* SW PAN needs a copy of the ASID in TTBR0 for entry */
 	if (IS_ENABLED(CONFIG_ARM64_SW_TTBR0_PAN))
 		ttbr0 |= FIELD_PREP(TTBR_ASID_MASK, asid);
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH 4/5] KVM: arm64: Remove CnP usage

[Marc Zyngier]

KVM has two main uses of CnP: at stage-2 so that CnP could be honored
for adventurous guests, and at EL2 stage-1, for reasons that I can't
really explain.

Get rid of the whole thing.

Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/include/asm/kvm_mmu.h   | 3 +--
 arch/arm64/kvm/hyp/nvhe/hyp-init.S | 6 ------
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index 27e63c111f78..d81ec81709b5 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -281,12 +281,11 @@ static __always_inline u64 kvm_get_vttbr(struct kvm_s2_mmu *mmu)
 {
 	struct kvm_vmid *vmid = &mmu->vmid;
 	u64 vmid_field, baddr;
-	u64 cnp = system_supports_cnp() ? VTTBR_CNP_BIT : 0;
 
 	baddr = mmu->pgd_phys;
 	vmid_field = atomic64_read(&vmid->id) << VTTBR_VMID_SHIFT;
 	vmid_field &= VTTBR_VMID_MASK(kvm_arm_vmid_bits);
-	return kvm_phys_to_vttbr(baddr) | vmid_field | cnp;
+	return kvm_phys_to_vttbr(baddr) | vmid_field;
 }
 
 /*
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-init.S b/arch/arm64/kvm/hyp/nvhe/hyp-init.S
index a6d67c2bb5ae..ffb915a17360 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-init.S
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-init.S
@@ -103,9 +103,6 @@ SYM_CODE_START_LOCAL(___kvm_hyp_init)
 
 	ldr	x1, [x0, #NVHE_INIT_PGD_PA]
 	phys_to_ttbr x2, x1
-alternative_if ARM64_HAS_CNP
-	orr	x2, x2, #TTBR_CNP_BIT
-alternative_else_nop_endif
 	msr	ttbr0_el2, x2
 
 	/*
@@ -255,9 +252,6 @@ SYM_FUNC_START(__pkvm_init_switch_pgd)
 	/* Install the new pgtables */
 	ldr	x3, [x0, #NVHE_INIT_PGD_PA]
 	phys_to_ttbr x4, x3
-alternative_if ARM64_HAS_CNP
-	orr	x4, x4, #TTBR_CNP_BIT
-alternative_else_nop_endif
 	msr	ttbr0_el2, x4
 
 	/* Set the new stack pointer */
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

[PATCH 5/5] arm64: Remove CONFIG_ARM64_CNP

[Marc Zyngier]

Now that all the users of CnP are gone, let's perform a final
cleanup by removing the Kconfig entry, the CPU feature, and
the system_supports_cnp() helper.

The only traces left of CnP are ID register definitions, the feature
detection, and the bit definitions. All of which serve as documentation
and can be safely kept.

Signed-off-by: Marc Zyngier <maz@kernel.org>
---
 arch/arm64/Kconfig                  | 14 --------------
 arch/arm64/include/asm/cpufeature.h |  6 ------
 arch/arm64/tools/cpucaps            |  1 -
 3 files changed, 21 deletions(-)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 41125ff8ae69..02318ad49a6f 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1818,20 +1818,6 @@ config ARM64_RAS_EXTN
 	  and access the new registers if the system supports the extension.
 	  Platform RAS features may additionally depend on firmware support.
 
-config ARM64_CNP
-	bool "Enable support for Common Not Private (CNP) translations"
-	default y
-	depends on ARM64_PAN || !ARM64_SW_TTBR0_PAN
-	help
-	  Common Not Private (CNP) allows translation table entries to
-	  be shared between different PEs in the same inner shareable
-	  domain, so the hardware can use this fact to optimise the
-	  caching of such entries in the TLB.
-
-	  Selecting this option allows the CNP feature to be detected
-	  at runtime, and does not affect PEs that do not implement
-	  this feature.
-
 endmenu # "ARMv8.2 architectural features"
 
 menu "ARMv8.3 architectural features"
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 6bf013fb110d..172f3d01ef9b 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -786,12 +786,6 @@ static __always_inline bool system_supports_tpidr2(void)
 	return system_supports_sme();
 }
 
-static __always_inline bool system_supports_cnp(void)
-{
-	return IS_ENABLED(CONFIG_ARM64_CNP) &&
-		cpus_have_const_cap(ARM64_HAS_CNP);
-}
-
 static inline bool system_supports_address_auth(void)
 {
 	return IS_ENABLED(CONFIG_ARM64_PTR_AUTH) &&
diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps
index a94808ba819c..b5111f76bc72 100644
--- a/arch/arm64/tools/cpucaps
+++ b/arch/arm64/tools/cpucaps
@@ -16,7 +16,6 @@ HAS_AMU_EXTN
 HAS_ARMv8_4_TTL
 HAS_CACHE_DIC
 HAS_CACHE_IDC
-HAS_CNP
 HAS_CRC32
 HAS_DCPODP
 HAS_DCPOP
-- 
2.39.2


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH 0/5] arm64: Get rid of CnP

[Marc Zyngier]

On 2023-06-01 15:24, Marc Zyngier wrote:
> FEAT_TTCNP (née ARMv8.2-TTCNP, "Translation table Common not private
> translations", commonly known as CnP) was an attempt at allowing the
> sharing of TLBs in a SMT implementation. This was an interesting idea,
> but it never really went anywhere:

[...]

Ah, the joy of using another machine that doesn't have the alias
for the "new" kvmarm ML. Please make sure you fix it when (and if)
replying.

And apologies for the potential noise.

        M.
-- 
Jazz is not dead. It just smells funny...

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH 0/5] arm64: Get rid of CnP

[Vladimir Murzin]

Hi Marc,

On 6/1/23 15:24, Marc Zyngier wrote:
> FEAT_TTCNP (née ARMv8.2-TTCNP, "Translation table Common not private
> translations", commonly known as CnP) was an attempt at allowing the
> sharing of TLBs in a SMT implementation. This was an interesting idea,
> but it never really went anywhere:
> 
> - There is only one implementation from ARM (Cortex-A65) that could
>   (conditional) be capable of using it, but this thing has never been
>   seen in the wild (shout if you have one!)
> 
> - There is one implementation from NVIDIA (Carmel) that has a
>   messed-up TLB invalidation "feature" that prevents the use of CnP
> 
> - The only other SMT implementation (Cavium-TX2) predates CnP, so it
>   doesn't implement it
> 
> - All the modern CPUs (which are not SMT) advertise CnP (it is
>   mandatory from ARMv8.2), but of course don't implement anything
>

I was told that it will benefit performance on LITTLE cores, like 
Cortex-A510 and Cortex-A520, which have a shared TLB, so it is not
quite SMT specific.

Cheers
Vladimir


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel