Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ec89ab50 authored by Steve Capper's avatar Steve Capper Committed by Catalin Marinas
Browse files

arm64: Fix TTBR + PAN + 52-bit PA logic in cpu_do_switch_mm 



In cpu_do_switch_mm(.) with ARM64_SW_TTBR0_PAN=y we apply phys_to_ttbr
to a value that already has an ASID inserted into the upper bits. For
52-bit PA configurations this then can give us TTBR0_EL1 registers that
cause translation table walks to attempt to access non-zero PA[51:48]
spuriously. Ultimately leading to a Synchronous External Abort on level
1 translation.

This patch re-arranges the logic in cpu_do_switch_mm(.) such that
phys_to_ttbr is called before the ASID is inserted into the TTBR0 value.

Fixes: 6b88a32c ("arm64: kpti: Fix the interaction between ASID switching and software PAN")
Acked-by: default avatarSuzuki K Poulose <suzuki.poulose@arm.com>
Tested-by: default avatarKristina Martsenko <kristina.martsenko@arm.com>
Reviewed-by: default avatarKristina Martsenko <kristina.martsenko@arm.com>
Signed-off-by: default avatarSteve Capper <steve.capper@arm.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent 0ba2e29c

arch/arm64/mm/proc.S

+3 −3
Original line number Diff line number Diff line
@@ -153,14 +153,14 @@ ENDPROC(cpu_do_resume) 
ENTRY(cpu_do_switch_mm)

	mrs	x2, ttbr1_el1

	mmid	x1, x1				// get mm->context.id

	phys_to_ttbr x0, x3

#ifdef CONFIG_ARM64_SW_TTBR0_PAN

	bfi	x0, x1, #48, #16		// set the ASID field in TTBR0

	bfi	x3, x1, #48, #16		// set the ASID field in TTBR0

#endif

	bfi	x2, x1, #48, #16		// set the ASID

	msr	ttbr1_el1, x2			// in TTBR1 (since TCR.A1 is set)

	isb

	phys_to_ttbr x0, x2

	msr	ttbr0_el1, x2			// now update TTBR0

	msr	ttbr0_el1, x3			// now update TTBR0

	isb

	b	post_ttbr_update_workaround	// Back to C code...

ENDPROC(cpu_do_switch_mm)