lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 8 Jan 2024 15:54:58 +0000
From: Mark Rutland <mark.rutland@....com>
To: "Brandt, Oliver - Lenze" <oliver.brandt@...ze.com>
Cc: "linux-arm-kernel@...ts.infradead.org" <linux-arm-kernel@...ts.infradead.org>,
	"will@...nel.org" <will@...nel.org>,
	"catalin.marinas@....com" <catalin.marinas@....com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] arm64: mm: disable PAN during caches_clean_inval_user_pou

Hi Oliver,

On Mon, Jan 08, 2024 at 01:00:39PM +0000, Brandt, Oliver - Lenze wrote:
> Using the cacheflush() syscall from an 32-bit user-space fails when
> ARM64_PAN is used. We 'll get an endless loop:
> 
> 	1. executing "dc cvau, x2" results in raising an abort
> 	2. abort handler does not fix the reason for the abort and
> 	   returns to 1.
> 
> Disabling PAN for the time of the cache maintenance fixes this.

Hmm... the ARM ARM says PSTATE.PAN is not supposed to affect DC CVAU.

Looking at the latest ARM ARM (ARM DDI 0487J.a), R_PMTWB states:

| The PSTATE.PAN bit has no effect on all of the following:
|
| o Instruction fetches.
| o Data cache instructions, except DC ZVA.
| o If FEAT_PAN2 is not implemented, then address translation instructions.
| o If FEAT_PAN2 is implemented, then the address translation instructions
|   other than AT S1E1RP and AT S1E1WP.

So IIUC, DC CVAU shouldn't be affected by PAN.

This could be a CPU bug; which CPU are you seeing this with?

Mark.

> Fixes: 338d4f49d6f7 ("arm64: kernel: Add support for Privileged Access Never")
> Cc: stable@...r.kernel.org
> Signed-off-by: Oliver Brandt <oliver.brandt@...ze.com>
> ---
>  arch/arm64/mm/cache.S | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
> index 503567c864fde..333c4c2baa568 100644
> --- a/arch/arm64/mm/cache.S
> +++ b/arch/arm64/mm/cache.S
> @@ -70,10 +70,12 @@ SYM_FUNC_ALIAS(__pi_caches_clean_inval_pou, caches_clean_inval_pou)
>   */
>  SYM_FUNC_START(caches_clean_inval_user_pou)
>  	uaccess_ttbr0_enable x2, x3, x4
> +	ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
>  
>  	caches_clean_inval_pou_macro 2f
>  	mov	x0, xzr
>  1:
> +	ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
>  	uaccess_ttbr0_disable x1, x2
>  	ret
>  2:
> -- 
> 2.43.0

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ