[RFC PATCH 3/3] arm64: errata: Disable FWB on parts with non-ARM interconnects

[Marc Zyngier]

On Thu, 16 Feb 2023 18:22:01 +0000,
James Morse <james.morse at arm.com> wrote:
> 
> Force Write Back (FWB) allows the hypervisor to force non-cacheable
> accesses made by a guest to be cacheable. This saves the hypervisor
> from doing cache maintenance on all pages the guest can access, to
> ensure the guest doesn't see stale (and possibly sensitive) data when
> making a non-cacheable access.
> 
> When stage1 translation is disabled, the SCTRL_E1.I bit controls the
> attributes used for instruction fetch, one of the options results in a
> non-cacheable access. A whole host of CPUs missed the FWB override
> in this case, meaning a KVM guest could fetch stale/junk data instead of
> instructions.
> 
> The workaround is to always do the cache maintenance. These parts don't
> have fine-grained-traps, so it isn't feasible to detect the guest
> disabling the MMU. Instead, disable FWB on the host.
> 
> While the CPUs are affected, this erratum doesn't occur on parts using
> Arm's CMN interconnects. Use the Errata Management API to discover whether
> this CPU is affected.
> 
> Because guest execution is compromised, the workaround is enabled by
> default. If the Errata Management API isn't implemented by firmware, the
> workaround will be enabled. If a target platform is not affected, and it
> isn't possible to add support for the Errata Management API, the erratum
> can be disabled in Kconfig.

I'm feeling a bit sick...

My main concern is hardly anyone implements this errata management
API, if at all. We should:

- give people an option to disable this from the command-line if they
  know they are on an unaffected system

- have some form of DT property that indicates the HW isn't affected

Thoughts?

	M.

-- 
Without deviation from the norm, progress is not possible.