Re: [PATCH 2/4] arm64: tlb: Add tlbi workaround for FUJITSU-MONAKA Erratum E#030001

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kvm: arm64: Nested virtualization bypasses FUJITSU-MONAKA E#030001 erratum workaround
--

commit a8becb6b6a9a519a1569cd1fb836fdfcaee436c2
Author: Tomohiro Misono <misono.tomohiro@fujitsu.com>

arm64: tlb: Add tlbi workaround for FUJITSU-MONAKA Erratum E#030001

This commit adds a workaround for FUJITSU-MONAKA erratum E#030001 where
range-based TLBI operations may fail to invalidate 512MB mappings. It
issues additional non-range TLBI instructions for the affected VA or IPA
ranges.

> diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
> index 14a78ac0f8009..0487daec16528 100644
> --- a/arch/arm64/include/asm/tlbflush.h
> +++ b/arch/arm64/include/asm/tlbflush.h
[ ... ]
> @@ -518,6 +549,8 @@ static __always_inline void __flush_tlb_range_op(tlbi_op lop, tlbi_op rop,
>  		__tlbi_level_asid(lop, addr, level, asid);
>  		addr += stride;
>  	}
> +
> +	fujitsu_erratum_wa(lop, start, end, asid);
>  }

[Severity: High]
Does KVM's nested virtualization bypass this erratum workaround?

Looking at arch/arm64/kvm/hyp/vhe/tlb.c, __kvm_tlbi_s1e2() directly invokes
native range-based TLBI instructions on behalf of a nested guest:

arch/arm64/kvm/hyp/vhe/tlb.c:__kvm_tlbi_s1e2() {
	...
	case OP_TLBI_RVAE2:
	case OP_TLBI_RVAE2IS:
	case OP_TLBI_RVAE2OS:
	case OP_TLBI_RVAE1:
	case OP_TLBI_RVAE1IS:
	case OP_TLBI_RVAE1OS:
	...
		__tlbi(rvae1is, va);
		break;
	...
}

Because the nested guest hypervisor traps into this KVM emulation which
executes raw instructions without decoding the range or applying
fujitsu_erratum_wa(), it appears the workaround is skipped here. Could this
leave stale TLB entries in the guest hypervisor's translation regime if an
untrusted nested guest targets an affected 512MB mapping?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002-monaka-fix-for-upstream-v1-0-4aec0b0cbe34@fujitsu.com?part=2