linux-kernel - Re: [PATCH] tools: arm64: add registers read/write tool for arm64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <86cyjt4ahn.wl-maz@kernel.org>
Date: Mon, 21 Oct 2024 18:44:04 +0100
From: Marc Zyngier <maz@...nel.org>
To: Rex Nie <rex.nie@...uarmicro.com>
Cc: mcoquelin.stm32@...il.com,
	alexandre.torgue@...s.st.com,
	linux-kernel@...r.kernel.org,
	linux-stm32@...md-mailman.stormreply.com,
	linux-arm-kernel@...ts.infradead.org,
	angus.chen@...uarmicro.com
Subject: Re: [PATCH] tools: arm64: add registers read/write tool for arm64

On Mon, 21 Oct 2024 16:01:12 +0100,
Rex Nie <rex.nie@...uarmicro.com> wrote:
> 
> The reg_ctrl kernel module can read/write most aarch64 system registers,
> including EL0/1/2/3, which is very useful when hardware debuger (such
> as ArmDS5/trace32) is unusable.
> 
> The primary implementation of the reg_ctrl module is as follows:
> 1. when the core can directly access the target register, it uses
>    the MRS/MSR instructions to read/write register.
> 2. Otherwise, it performs an SMC call to switch to EL3, where the
>    register read/write is completed and then return to kernel mode.
>    I implement an OEM Service in ATF to access register at EL3,
>    using one SMC function ID for reading and another for writing registers.
> 
> test steps on my platform with 16x Arm Neoverse N2:
> 1. insmod reg_ctrl.ko
> 2. cd /sys/kernel/reg_ctrl/system/
> 3. view the directory tree on DUT.
> [root@...alhost system]# tree
> .
> ├── control
> │   └── VNCR_EL2
> ├── id
> │   ├── CCSIDR_EL1
> │   ├── CLIDR_EL1
> │   ├── CSSELR_EL1
> │   ├── CTR_EL0
> │   ├── DCZID_EL0
> │   ├── ID_AA64AFR0_EL1
> │   ├── ID_AA64AFR1_EL1
> │   ├── ID_AA64DFR0_EL1
> │   ├── ID_AA64DFR1_EL1
> │   ├── ID_AA64ISAR0_EL1
> │   ├── ID_AA64ISAR1_EL1
> │   ├── ID_AA64MMFR0_EL1
> │   ├── ID_AA64MMFR1_EL1
> │   ├── ID_AA64PFR0_EL1
> │   └── ID_AA64PFR1_EL1
> ├── implementation_defined
> │   ├── IMP_CPUACTLR_EL3
> │   ├── IMP_CPUECTLR_EL1
> │   ├── IMP_CPUPPMCR2_EL3
> │   ├── IMP_CPUPPMCR4_EL3
> │   ├── IMP_CPUPPMCR5_EL3
> │   ├── IMP_CPUPPMCR6_EL3
> │   └── IMP_CPUPPMCR_EL3
> └── reset
>     └── RMR_EL3
> 
> 4. read EL1 register on core 0:
> [root@...alhost system]# taskset -c 0 cat id/ID_AA64PFR0_EL1
> 0x1201111123111112
> 
> 5. read EL3 register on core 1:
> [root@...alhost system]# taskset -c 1 cat implementation_defined/IMP_CPUPPMCR4_EL3
> 0x2000315a10000045
> 
> 6. set bit 1 of IMP_CPUPPMCR4_EL3 regiter on core 1:
> [root@...alhost system]# taskset -c 1 echo 0x2000315a10000047 > implementation_defined/IMP_CPUPPMCR4_EL3
> 
> 7. check if bit 1 is set:
> [root@...alhost system]# taskset -c 1 cat implementation_defined/IMP_CPUPPMCR4_EL3
> 0x2000315a10000047
> 
> Signed-off-by: Rex Nie <rex.nie@...uarmicro.com>

This sort of thing has been NAKed in the past (see [1]), because it is
terribly unsafe. I'm afraid the kernel is not a validation tool, and
while I understand that this can be useful in extremely narrow cases,
it has no place in the upstream kernel.

Thanks,

	M.

[1] https://lore.kernel.org/all/20201130174833.41315-1-rongwei.wang@linux.alibaba.com/

-- 
Without deviation from the norm, progress is not possible.