linux-kernel - [RFC PATCH] KVM: arm64: Workaround for Ampere AC03_CPU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri,  5 Jan 2024 13:32:51 -0800
From: Ilkka Koskinen <ilkka@...amperecomputing.com>
To: Marc Zyngier <maz@...nel.org>,
	Oliver Upton <oliver.upton@...ux.dev>,
	James Morse <james.morse@....com>,
	Suzuki K Poulose <suzuki.poulose@....com>,
	Zenghui Yu <yuzenghui@...wei.com>,
	Catalin Marinas <catalin.marinas@....com>,
	Will Deacon <will@...nel.org>,
	Gavin Shan <gshan@...hat.com>,
	Mark Rutland <mark.rutland@....com>,
	Raghavendra Rao Ananta <rananta@...gle.com>
Cc: Ilkka Koskinen <ilkka@...amperecomputing.com>,
	D Scott Phillips <scott@...amperecomputing.com>,
	linux-arm-kernel@...ts.infradead.org,
	kvmarm@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: [RFC PATCH] KVM: arm64: Workaround for Ampere AC03_CPU_36 (exception taken to an incorrect EL)

Due to erratum AC03_CPU_36 on AmpereOne, if an Asynchronous Exception
(interrupts or SErrors) occurs to EL2, while EL2 software is modifying
system register bits that control EL2 exception behavior, the processor
may take an exception to an incorrect Exception Level.

The affected system registers are HCR_EL2 and SCTLR_EL2, which contain
control bits for routing and enabling of EL2 exceptions.

The issue is triggered when HGE.TGE bit is cleared while having
AMO/IMO/FMO bits cleared too. To avoid the exception getting taken
at a wrong Exception Level, we set AMO/IMO/FMO.

Suggested-by: D Scott Phillips <scott@...amperecomputing.com>
Signed-off-by: Ilkka Koskinen <ilkka@...amperecomputing.com>
---
 arch/arm64/kvm/hyp/vhe/tlb.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/kvm/hyp/vhe/tlb.c b/arch/arm64/kvm/hyp/vhe/tlb.c
index b32e2940df7d..c72fdd2e4549 100644
--- a/arch/arm64/kvm/hyp/vhe/tlb.c
+++ b/arch/arm64/kvm/hyp/vhe/tlb.c
@@ -61,9 +61,15 @@ static void __tlb_switch_to_guest(struct kvm_s2_mmu *mmu,
 	 * has an ISB in order to deal with this.
 	 */
 	__load_stage2(mmu, mmu->arch);
-	val = read_sysreg(hcr_el2);
-	val &= ~HCR_TGE;
-	write_sysreg(val, hcr_el2);
+
+	/*
+	 * With {E2H,TGE} == {1,0}, IMO == 1 is required so that IRQs are not
+	 * all masked. This also works around AmpereOne erratum AC03_CPU_36
+	 * which can incorrectly route an IRQ to EL1 when HCR_EL2.{E2H,TGE} is
+	 * written from {1,1} to {1,0} with interrupts unmasked.
+	 */
+	sysreg_clear_set(hcr_el2, HCR_TGE, HCR_AMO | HCR_IMO | HCR_FMO);
+
 	isb();
 }
 
-- 
2.43.0