• Catalin Marinas's avatar
    arm64: kpti: Fix the interaction between ASID switching and software PAN · 6b88a32c
    Catalin Marinas authored
    With ARM64_SW_TTBR0_PAN enabled, the exception entry code checks the
    active ASID to decide whether user access was enabled (non-zero ASID)
    when the exception was taken. On return from exception, if user access
    was previously disabled, it re-instates TTBR0_EL1 from the per-thread
    saved value (updated in switch_mm() or efi_set_pgd()).
    
    Commit 7655abb9 ("arm64: mm: Move ASID from TTBR0 to TTBR1") makes a
    TTBR0_EL1 + ASID switching non-atomic. Subsequently, commit 27a921e7
    ("arm64: mm: Fix and re-enable ARM64_SW_TTBR0_PAN") changes the
    __uaccess_ttbr0_disable() function and asm macro to first write the
    reserved TTBR0_EL1 followed by the ASID=0 update in TTBR1_EL1. If an
    exception occurs between these two, the exception return code will
    re-instate a valid TTBR0_EL1. Similar scenario can happen in
    cpu_switch_mm() between setting the reserved TTBR0_EL1 and the ASID
    update in cpu_do_switch_mm().
    
    This patch reverts the entry.S check for ASID == 0 to TTBR0_EL1 and
    disables the interrupts around the TTBR0_EL1 and ASID switching code in
    __uaccess_ttbr0_disable(). It also ensures that, when returning from the
    EFI runtime services, efi_set_pgd() doesn't leave a non-zero ASID in
    TTBR1_EL1 by using uaccess_ttbr0_{enable,disable}.
    
    The accesses to current_thread_info()->ttbr0 are updated to use
    READ_ONCE/WRITE_ONCE.
    
    As a safety measure, __uaccess_ttbr0_enable() always masks out any
    existing non-zero ASID TTBR1_EL1 before writing in the new ASID.
    
    Fixes: 27a921e7 ("arm64: mm: Fix and re-enable ARM64_SW_TTBR0_PAN")
    Acked-by: default avatarWill Deacon <will.deacon@arm.com>
    Reported-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Tested-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Reviewed-by: default avatarJames Morse <james.morse@arm.com>
    Tested-by: default avatarJames Morse <james.morse@arm.com>
    Co-developed-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
    6b88a32c
hypercall.S 3.58 KB