linux-kernel - Re: [PATCH] arm64: mm: disable PAN during caches_clean_inval_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15b92eff2767926aa345e159964e342e3b7192ca.camel@lenze.com>
Date: Mon, 8 Jan 2024 16:37:37 +0000
From: "Brandt, Oliver - Lenze" <oliver.brandt@...ze.com>
To: "mark.rutland@....com" <mark.rutland@....com>
CC: "linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "will@...nel.org" <will@...nel.org>,
	"catalin.marinas@....com" <catalin.marinas@....com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] arm64: mm: disable PAN during caches_clean_inval_user_pou

Hi Mark,

> 
> Hi Oliver,
> 
> On Mon, Jan 08, 2024 at 01:00:39PM +0000, Brandt, Oliver - Lenze wrote:
> > Using the cacheflush() syscall from an 32-bit user-space fails when
> > ARM64_PAN is used. We 'll get an endless loop:
> > 
> >       1. executing "dc cvau, x2" results in raising an abort
> >       2. abort handler does not fix the reason for the abort and
> >          returns to 1.
> > 
> > Disabling PAN for the time of the cache maintenance fixes this.
> 
> Hmm... the ARM ARM says PSTATE.PAN is not supposed to affect DC CVAU.
> 
> Looking at the latest ARM ARM (ARM DDI 0487J.a), R_PMTWB states:
> 
> > The PSTATE.PAN bit has no effect on all of the following:
> > 
> > o Instruction fetches.
> > o Data cache instructions, except DC ZVA.
> > o If FEAT_PAN2 is not implemented, then address translation instructions.
> > o If FEAT_PAN2 is implemented, then the address translation instructions
> >   other than AT S1E1RP and AT S1E1WP.
> 
> So IIUC, DC CVAU shouldn't be affected by PAN.

Ups... Sorry, didn't noticed this.

> This could be a CPU bug; which CPU are you seeing this with?

I've stumbled about this while using Intel's simulator "Simics" with a
model of the upcoming "Agilex5 socfpga". The "Agilex5" is a SoC
containing two Cortex A76 and two Cortex A55.

We are expecting the real silicon in a couple of weeks. Seems to be a
good idea to check the silicon first. Sorry to bother you with this.

Many thanks for the quick reply!

> 
> Mark.

Oliver

> 
> > Fixes: 338d4f49d6f7 ("arm64: kernel: Add support for Privileged Access Never")
> > Cc: stable@...r.kernel.org
> > Signed-off-by: Oliver Brandt <oliver.brandt@...ze.com>
> > ---
> >  arch/arm64/mm/cache.S | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
> > index 503567c864fde..333c4c2baa568 100644
> > --- a/arch/arm64/mm/cache.S
> > +++ b/arch/arm64/mm/cache.S
> > @@ -70,10 +70,12 @@ SYM_FUNC_ALIAS(__pi_caches_clean_inval_pou, caches_clean_inval_pou)
> >   */
> >  SYM_FUNC_START(caches_clean_inval_user_pou)
> >       uaccess_ttbr0_enable x2, x3, x4
> > +     ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
> > 
> >       caches_clean_inval_pou_macro 2f
> >       mov     x0, xzr
> >  1:
> > +     ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
> >       uaccess_ttbr0_disable x1, x2
> >       ret
> >  2:
> > --
> > 2.43.0