From: Ard Biesheuvel <ardb@kernel.org>
efi_set_pgd() will no longer be called when invoking EFI runtime
services via the efi_rts_wq work queue, but the uaccess en/disable are
still needed when using PAN emulation using TTBR0 switching. So move
these into the callers.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/include/asm/efi.h | 3 ---
arch/arm64/kernel/efi.c | 3 +++
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
index decf87777f57..abe9176a3a23 100644
--- a/arch/arm64/include/asm/efi.h
+++ b/arch/arm64/include/asm/efi.h
@@ -132,15 +132,12 @@ static inline void efi_set_pgd(struct mm_struct *mm)
* exception when invoking the EFI run-time services.
*/
update_saved_ttbr0(current, mm);
- uaccess_ttbr0_enable();
- post_ttbr_update_workaround();
} else {
/*
* Defer the switch to the current thread's TTBR0_EL1
* until uaccess_enable(). Restore the current
* thread's saved ttbr0 corresponding to its active_mm
*/
- uaccess_ttbr0_disable();
update_saved_ttbr0(current, current->active_mm);
}
}
diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
index d01ae156bb63..5d188c6c44d7 100644
--- a/arch/arm64/kernel/efi.c
+++ b/arch/arm64/kernel/efi.c
@@ -177,6 +177,8 @@ bool arch_efi_call_virt_setup(void)
return false;
efi_virtmap_load();
+ uaccess_ttbr0_enable();
+ post_ttbr_update_workaround();
__efi_fpsimd_begin();
return true;
}
@@ -185,6 +187,7 @@ void arch_efi_call_virt_teardown(void)
{
__efi_fpsimd_end();
efi_virtmap_unload();
+ uaccess_ttbr0_disable();
up(&efi_rt_lock);
}
--
2.49.0.1101.gccaa498523-googOn Wed, May 14, 2025 at 07:43:46PM +0200, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@kernel.org>
>
> efi_set_pgd() will no longer be called when invoking EFI runtime
> services via the efi_rts_wq work queue, but the uaccess en/disable are
> still needed when using PAN emulation using TTBR0 switching. So move
> these into the callers.
>
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
> arch/arm64/include/asm/efi.h | 3 ---
> arch/arm64/kernel/efi.c | 3 +++
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
> index decf87777f57..abe9176a3a23 100644
> --- a/arch/arm64/include/asm/efi.h
> +++ b/arch/arm64/include/asm/efi.h
> @@ -132,15 +132,12 @@ static inline void efi_set_pgd(struct mm_struct *mm)
> * exception when invoking the EFI run-time services.
> */
> update_saved_ttbr0(current, mm);
> - uaccess_ttbr0_enable();
> - post_ttbr_update_workaround();
> } else {
> /*
> * Defer the switch to the current thread's TTBR0_EL1
> * until uaccess_enable(). Restore the current
> * thread's saved ttbr0 corresponding to its active_mm
> */
> - uaccess_ttbr0_disable();
> update_saved_ttbr0(current, current->active_mm);
> }
> }
> diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
> index d01ae156bb63..5d188c6c44d7 100644
> --- a/arch/arm64/kernel/efi.c
> +++ b/arch/arm64/kernel/efi.c
> @@ -177,6 +177,8 @@ bool arch_efi_call_virt_setup(void)
> return false;
>
> efi_virtmap_load();
> + uaccess_ttbr0_enable();
> + post_ttbr_update_workaround();
> __efi_fpsimd_begin();
> return true;
> }
> @@ -185,6 +187,7 @@ void arch_efi_call_virt_teardown(void)
> {
> __efi_fpsimd_end();
> efi_virtmap_unload();
> + uaccess_ttbr0_disable();
Moving this after updating the saved TTBR0 isn't great for SWPAN, as it
means that if we take an exception (e.g. an IRQ) before calling
uaccess_ttbr0_disable() then I think we'll end up running with the user
page-table installed briefly in TTBR0 which SWPAN is supposed to prevent
outside of genuine uaccess sections.
Will
On Fri, 11 Jul 2025 at 23:42, Will Deacon <will@kernel.org> wrote:
>
> On Wed, May 14, 2025 at 07:43:46PM +0200, Ard Biesheuvel wrote:
> > From: Ard Biesheuvel <ardb@kernel.org>
> >
> > efi_set_pgd() will no longer be called when invoking EFI runtime
> > services via the efi_rts_wq work queue, but the uaccess en/disable are
> > still needed when using PAN emulation using TTBR0 switching. So move
> > these into the callers.
> >
> > Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> > ---
> > arch/arm64/include/asm/efi.h | 3 ---
> > arch/arm64/kernel/efi.c | 3 +++
> > 2 files changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/arch/arm64/include/asm/efi.h b/arch/arm64/include/asm/efi.h
> > index decf87777f57..abe9176a3a23 100644
> > --- a/arch/arm64/include/asm/efi.h
> > +++ b/arch/arm64/include/asm/efi.h
> > @@ -132,15 +132,12 @@ static inline void efi_set_pgd(struct mm_struct *mm)
> > * exception when invoking the EFI run-time services.
> > */
> > update_saved_ttbr0(current, mm);
> > - uaccess_ttbr0_enable();
> > - post_ttbr_update_workaround();
> > } else {
> > /*
> > * Defer the switch to the current thread's TTBR0_EL1
> > * until uaccess_enable(). Restore the current
> > * thread's saved ttbr0 corresponding to its active_mm
> > */
> > - uaccess_ttbr0_disable();
> > update_saved_ttbr0(current, current->active_mm);
> > }
> > }
> > diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
> > index d01ae156bb63..5d188c6c44d7 100644
> > --- a/arch/arm64/kernel/efi.c
> > +++ b/arch/arm64/kernel/efi.c
> > @@ -177,6 +177,8 @@ bool arch_efi_call_virt_setup(void)
> > return false;
> >
> > efi_virtmap_load();
> > + uaccess_ttbr0_enable();
> > + post_ttbr_update_workaround();
> > __efi_fpsimd_begin();
> > return true;
> > }
> > @@ -185,6 +187,7 @@ void arch_efi_call_virt_teardown(void)
> > {
> > __efi_fpsimd_end();
> > efi_virtmap_unload();
> > + uaccess_ttbr0_disable();
>
> Moving this after updating the saved TTBR0 isn't great for SWPAN, as it
> means that if we take an exception (e.g. an IRQ) before calling
> uaccess_ttbr0_disable() then I think we'll end up running with the user
> page-table installed briefly in TTBR0 which SWPAN is supposed to prevent
> outside of genuine uaccess sections.
>
OK, I'll respin this to take that into account.
© 2016 - 2026 Red Hat, Inc.