arm64: Workaround for Cortex-A55 erratum 1530923

Cortex-A55 erratum 1530923 allows TLB entries to be allocated as a
result of a speculative AT instruction. This may happen in the middle of
a guest world switch while the relevant VMSA configuration is in an
inconsistent state, leading to erroneous content being allocated into
TLBs.

The same workaround as is used for Cortex-A76 erratum 1165522
(WORKAROUND_SPECULATIVE_AT_VHE) can be used here. Note that this
mandates the use of VHE on affected parts.

Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Steven Price <steven.price@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>

diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst
index 99b2545455ff9a6e66e3931bc4c8e847d0dbf12f..9120e59578dcaaf24e5633cd0c1a2ec37b1ea278 100644 (file)
--- a/Documentation/arm64/silicon-errata.rst
+++ b/Documentation/arm64/silicon-errata.rst
@@ -88,6 +88,8 @@ stable kernels.
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Cortex-A76      | #1463225        | ARM64_ERRATUM_1463225       |
 +----------------+-----------------+-----------------+-----------------------------+
+| ARM            | Cortex-A55      | #1530923        | ARM64_ERRATUM_1530923       |
++----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1188873,1418040| ARM64_ERRATUM_1418040       |
 +----------------+-----------------+-----------------+-----------------------------+
 | ARM            | Neoverse-N1     | #1349291        | N/A                         |

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index d102ebd56c79fbe4873fa3655b8aa1c5de499186..6c92c6dac45b934405bed988a2428e8159c87848 100644 (file)
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -530,6 +530,19 @@ config ARM64_ERRATUM_1165522
 
          If unsure, say Y.
 
+config ARM64_ERRATUM_1530923
+       bool "Cortex-A55: Speculative AT instruction using out-of-context translation regime could cause subsequent request to generate an incorrect translation"
+       default y
+       select ARM64_WORKAROUND_SPECULATIVE_AT_VHE
+       help
+         This option adds a workaround for ARM Cortex-A55 erratum 1530923.
+
+         Affected Cortex-A55 cores (r0p0, r0p1, r1p0, r2p0) could end-up with
+         corrupted TLBs by speculating an AT instruction during a guest
+         context switch.
+
+         If unsure, say Y.
+
 config ARM64_ERRATUM_1286807
        bool "Cortex-A76: Modification of the translation table for a virtual address might lead to read-after-read ordering violation"
        default y

diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index 167a161dd596947ff15126bb6b24086ab501c540..a3a6a2ba9a635efd7feec4542f4c0b281052521c 100644 (file)
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -91,8 +91,8 @@ static __always_inline void __hyp_text __load_guest_stage2(struct kvm *kvm)
        write_sysreg(kvm_get_vttbr(kvm), vttbr_el2);
 
        /*
-        * ARM erratum 1165522 requires the actual execution of the above
-        * before we can switch to the EL1/EL0 translation regime used by
+        * ARM errata 1165522 and 1530923 require the actual execution of the
+        * above before we can switch to the EL1/EL0 translation regime used by
         * the guest.
         */
        asm(ALTERNATIVE("nop", "isb", ARM64_WORKAROUND_SPECULATIVE_AT_VHE));

diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
index 0332fca5564a634b65b396f226d7fb3637ee42b7..0bd2867f324815525ab970f3f7b182d0dc2d3187 100644 (file)
--- a/arch/arm64/kernel/cpu_errata.c
+++ b/arch/arm64/kernel/cpu_errata.c
@@ -762,6 +762,10 @@ static const struct midr_range erratum_speculative_at_vhe_list[] = {
 #ifdef CONFIG_ARM64_ERRATUM_1165522
        /* Cortex A76 r0p0 to r2p0 */
        MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 2, 0),
+#endif
+#ifdef CONFIG_ARM64_ERRATUM_1530923
+       /* Cortex A55 r0p0 to r2p0 */
+       MIDR_RANGE(MIDR_CORTEX_A55, 0, 0, 2, 0),
 #endif
        {},
 };
@@ -895,7 +899,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 #endif
 #ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT_VHE
        {
-               .desc = "ARM erratum 1165522",
+               .desc = "ARM errata 1165522, 1530923",
                .capability = ARM64_WORKAROUND_SPECULATIVE_AT_VHE,
                ERRATA_MIDR_RANGE_LIST(erratum_speculative_at_vhe_list),
        },

diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index 0fc824bdf25848dd8c9fa08a8eed7c80b0347444..eae08ba82e958c91c995e5a8e8b52b491956da5f 100644 (file)
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -158,8 +158,8 @@ static void deactivate_traps_vhe(void)
        write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2);
 
        /*
-        * ARM erratum 1165522 requires the actual execution of the above
-        * before we can switch to the EL2/EL0 translation regime used by
+        * ARM errata 1165522 and 1530923 require the actual execution of the
+        * above before we can switch to the EL2/EL0 translation regime used by
         * the host.
         */
        asm(ALTERNATIVE("nop", "isb", ARM64_WORKAROUND_SPECULATIVE_AT_VHE));

diff --git a/arch/arm64/kvm/hyp/tlb.c b/arch/arm64/kvm/hyp/tlb.c
index ff4e73c9bafcca7eaecae8f20237daa4e2663a31..92f560e3e1aa134f00197019e75d0bf2c2ca0ee2 100644 (file)
--- a/arch/arm64/kvm/hyp/tlb.c
+++ b/arch/arm64/kvm/hyp/tlb.c
@@ -25,8 +25,8 @@ static void __hyp_text __tlb_switch_to_guest_vhe(struct kvm *kvm,
 
        if (cpus_have_const_cap(ARM64_WORKAROUND_SPECULATIVE_AT_VHE)) {
                /*
-                * For CPUs that are affected by ARM erratum 1165522, we
-                * cannot trust stage-1 to be in a correct state at that
+                * For CPUs that are affected by ARM errata 1165522 or 1530923,
+                * we cannot trust stage-1 to be in a correct state at that
                 * point. Since we do not want to force a full load of the
                 * vcpu state, we prevent the EL1 page-table walker to
                 * allocate new TLBs. This is done by setting the EPD bits