[kernel-hardening] [PATCH 0/7] arm64: Privileged Access Never using TTBR0_EL1 switching

[Catalin Marinas]

On Sat, Aug 13, 2016 at 11:13:58AM +0200, Ard Biesheuvel wrote:
> On 12 August 2016 at 17:27, Catalin Marinas <catalin.marinas at arm.com> wrote:
> > This is the first (public) attempt at emulating PAN by disabling
> > TTBR0_EL1 accesses on arm64.
> 
> I take it using TCR_EL1.EPD0 is too expensive?

It would require full TLB invalidation on entering/exiting the kernel
and again for any user access. That's because the architecture allows
this bit to be cached in the TLB so without TLBI we wouldn't have any
guarantee that the actual PAN was toggled. I'm not sure it's even clear
whether a TLBI by ASID or a local one would suffice (likely OK for the
latter).

While I don't have numbers currently, it would be hard to test on the
multitude of partner ARMv8 implementations, especially since that's not
something people would expect to optimise the hardware for.

-- 
Catalin