[PATCH v3 4/4] ARM: Implement PAN for LPAE by TTBR0 page table walks disablement

[Ard Biesheuvel]

On Wed, 15 May 2024 at 10:48, Russell King (Oracle)
<linux at armlinux.org.uk> wrote:
>
> On Wed, May 15, 2024 at 10:36:48AM +0200, Ard Biesheuvel wrote:
> > On Tue, 14 May 2024 at 22:34, Florian Fainelli <f.fainelli at gmail.com> wrote:
> > >
> > > On 5/14/24 13:33, Linus Walleij wrote:
> > > > On Tue, May 14, 2024 at 8:26 PM Florian Fainelli <f.fainelli at gmail.com> wrote:
> > > >> On 5/14/24 10:03, Russell King (Oracle) wrote:
> > > >
> > > >>> I would imagine that the problem is cpu_set_ttbcr(). Please try adding
> > > >>> a "memory" clobber to the asm() instruction in there.
> > > >>>
> > > >>
> > > >> I can confirm that with CONFIG_CC_OPTIMIZE_FOR_SIZE=y and the hunk below:
> > > >>
> > > >> diff --git a/arch/arm/include/asm/proc-fns.h
> > > >> b/arch/arm/include/asm/proc-fns.h
> > > >> index 9b3105a2a5e0..1087bd2af433 100644
> > > >> --- a/arch/arm/include/asm/proc-fns.h
> > > >> +++ b/arch/arm/include/asm/proc-fns.h
> > > >> @@ -187,7 +187,7 @@ static inline unsigned int cpu_get_ttbcr(void)
> > > >>
> > > >>    static inline void cpu_set_ttbcr(unsigned int ttbcr)
> > > >>    {
> > > >> -       asm("mcr p15, 0, %0, c2, c0, 2" : : "r" (ttbcr));
> > > >> +       asm("mcr p15, 0, %0, c2, c0, 2" : : "r" (ttbcr) : "memory");
> > > >>    }
> > > >>
> > > >>    #else  /*!CONFIG_MMU */
> > > >>
> > > >> my Raspberry Pi 4B in AArch32 mode boots and runs user-space properly.
> > > >>
> > > >> Thanks a lot Russell!
> > > >
> > > > Second that, very nicely pinpointed Russell!
> > > >
> > > > Florian, do you want to send a patch or should I?
> > >
> > > I was wondering if Russell was able to fold this directly into patch #2
> > > where cpu_set_ttbr() is added, so as to not break functionality across
> > > bisection.
> >
> > Sadly, I can still reproduce this with the above fix.
> >
> > I included TTBCR in the DEBUG_USER output, and (as expected), it has
> > A1, EPD0 and T0SZ set to the 'uaccess disabled' values.
> >
> > Using __always_inline on uaccess_save_and_enable() and
> > uaccess_restore() (as the CONFIG_CPU_SW_DOMAIN_PAN does) seems to work
> > around it. The "memory" clobber seems unnecessary in my case, but it
> > is needed for correctness in any case.
> >
> > It is unclear to me why placing these helpers out of line should make
> > any difference, and I am not convinced it is a problem in the code
> > (IIRC we've had other issues with -Os in the past)
>
> Time to start comparing compilers / compiler versions?
>

I guess.

I'll try to dig a bit deeper this afternoon - AIUI, there is never a
valid reason to return to user space with uaccess disabled, right? So
we should be able to catch that case using a BUG() or similar, and
crash in the kernel rather than in user space when this occurs. That
should make it a bit easier to deal with in the debugger etc.