[RFC PATCH 6/7] arm64/efi: Move uaccess en/disable out of efi_set_pgd()

[Ard Biesheuvel]

On Fri, 11 Jul 2025 at 23:42, Will Deacon <will at kernel.org> wrote:
>
> On Wed, May 14, 2025 at 07:43:46PM +0200, Ard Biesheuvel wrote:
> > From: Ard Biesheuvel <ardb at kernel.org>
> >
> > efi_set_pgd() will no longer be called when invoking EFI runtime
> > services via the efi_rts_wq work queue, but the uaccess en/disable are
> > still needed when using PAN emulation using TTBR0 switching. So move
> > these into the callers.
> >
> > Signed-off-by: Ard Biesheuvel <ardb at kernel.org>
> > ---
> >  arch/arm64/include/asm/efi.h | 3 ---
> >  arch/arm64/kernel/efi.c      | 3 +++
> >  2 files changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
> > index decf87777f57..abe9176a3a23 100644
> > --- a/arch/arm64/include/asm/efi.h
> > +++ b/arch/arm64/include/asm/efi.h
> > @@ -132,15 +132,12 @@ static inline void efi_set_pgd(struct mm_struct *mm)
> >                        * exception when invoking the EFI run-time services.
> >                        */
> >                       update_saved_ttbr0(current, mm);
> > -                     uaccess_ttbr0_enable();
> > -                     post_ttbr_update_workaround();
> >               } else {
> >                       /*
> >                        * Defer the switch to the current thread's TTBR0_EL1
> >                        * until uaccess_enable(). Restore the current
> >                        * thread's saved ttbr0 corresponding to its active_mm
> >                        */
> > -                     uaccess_ttbr0_disable();
> >                       update_saved_ttbr0(current, current->active_mm);
> >               }
> >       }
> > diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
> > index d01ae156bb63..5d188c6c44d7 100644
> > --- a/arch/arm64/kernel/efi.c
> > +++ b/arch/arm64/kernel/efi.c
> > @@ -177,6 +177,8 @@ bool arch_efi_call_virt_setup(void)
> >               return false;
> >
> >       efi_virtmap_load();
> > +     uaccess_ttbr0_enable();
> > +     post_ttbr_update_workaround();
> >       __efi_fpsimd_begin();
> >       return true;
> >  }
> > @@ -185,6 +187,7 @@ void arch_efi_call_virt_teardown(void)
> >  {
> >       __efi_fpsimd_end();
> >       efi_virtmap_unload();
> > +     uaccess_ttbr0_disable();
>
> Moving this after updating the saved TTBR0 isn't great for SWPAN, as it
> means that if we take an exception (e.g. an IRQ) before calling
> uaccess_ttbr0_disable() then I think we'll end up running with the user
> page-table installed briefly in TTBR0 which SWPAN is supposed to prevent
> outside of genuine uaccess sections.
>

OK, I'll respin this to take that into account.