From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9DCC97E792 for ; Tue, 11 Aug 2026 14:04:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786457077; cv=none; b=GFauihqmQG3d4Bbr0//3i02dG9pwr08TLzo18ZAT6FeGKLLP9D1KYqeLP5XqdueQZLmyV7Lg4TLXpI0wiGEJkaj1rjeJDPjsADhmHfNhtkGiLVuO+BxVnLFXh2po/gHuPwTlbNdIdLopzoWyq1Aqo/f+zA7f4SmkNXKvElpGo2Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786457077; c=relaxed/simple; bh=Se8UKt1nPbaXfQSUzvQ8foZr/h5YqpmZVnVmsJMJMF0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qIz7Sx54nsUO1xntvOhJNScNfVg4k2jE4M9ETXHscl/eqAvkeAJptvvzvTA3tfNbr3ONKhor0XZ4vInCodQZOXowIBAoUAxTu57+EDZeEWyqV8NhUf6Gyqr5hHDX/rIZ7M4Ut9qUbYQ5j7RJGRAZ4o6QUJ5jcYwkMtQUlhl2Vkg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XUAJw3fa; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XUAJw3fa" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1AD8F1F000E9; Tue, 11 Aug 2026 14:04:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786457076; bh=RNAw0xf7/NqwVQQ+kBhEeREeDXOOuB3wWqORL1f3CoI=; h=From:To:Cc:Subject:Date; b=XUAJw3faRxHmuC+VOEdalgcwHImfb1c/ee/R5FvsKMVzLgA6VYmXYLIpF567Ihzva 0dsaiMh2SmAPFKAnh4h9Jo7xr+NERqpQY925hZPPUZepAvvAjFTKxD/xUWZX85alyJ 0eywkovLqNJhVhBqao2JRbt3fFtXiYDfp6xRHo7xaZinsRVoOgsIHEl0Zqf0OSxs01 UfqGFZelnI2/5cgLBYeFJPrYqIaQWT0LShPfKZ3ZJsCKfPpWOdJTRUr4B5MnBD6SzX 3y7ZKi6mIePF6LwYEEPRgGbJSG/XdNPNHhd/7+/GAfuxffwy27Mg1LHJIiNcBeMFnZ 5Z5Zg2bWA+s0g== From: Will Deacon To: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org, Will Deacon , Ard Biesheuvel , Gus Bourg Subject: [PATCH] arm64/efi: Avoid voluntary preemption with efi_mm installed Date: Tue, 11 Aug 2026 15:04:29 +0100 Message-ID: <20260811140430.22832-1-will@kernel.org> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Gus reports a bad kernel memory access when using software PAN (CONFIG_ARM64_SW_TTBR0_PAN=y) on a machine with support for EFI runtime services: Unable to handle kernel access to user memory outside uaccess routines at virtual address 00000000f322ff30 Mem abort info: ESR = 0x0000000096000004 FSC = 0x04: level 0 translation fault Internal error: Oops: 0000000096000004 [#1] SMP Workqueue: efi_rts_wq efi_call_rts pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : efi_call_rts+0xd8/0x288 Call trace: efi_call_rts+0xd8/0x288 (P) process_one_work+0x178/0x4f8 worker_thread+0x194/0x328 This is because the fpsimd context management code called from __efi_fpsimd_begin() can preempt voluntarily, returning later to the EFI code with an incorrect value for TTBR0_EL1 thanks to the deferred mm switching used by the software PAN implementation. Since EFI runtime services cannot preempt voluntarily and because the fpsimd switching code does not rely on the TTBR0_EL1 mappings, simply reorder the fpsimd switch so that it occurs before we change the page-table. Cc: Ard Biesheuvel Reported-by: Gus Bourg Tested-by: Gus Bourg Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption") Link: https://lore.kernel.org/all/20260806000144.3388823-1-gus@bourg.net/ Signed-off-by: Will Deacon --- arch/arm64/kernel/efi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c index 30cd7f804398..0ec90fd1754e 100644 --- a/arch/arm64/kernel/efi.c +++ b/arch/arm64/kernel/efi.c @@ -184,6 +184,8 @@ void arch_efi_call_virt_setup(void) efi_virtmap_load(); } + __efi_fpsimd_begin(); + /* * Enable access to the valid TTBR0_EL1 and invoke the errata * workaround directly since there is no return from exception when @@ -191,8 +193,6 @@ void arch_efi_call_virt_setup(void) */ uaccess_ttbr0_enable(); post_ttbr_update_workaround(); - - __efi_fpsimd_begin(); } void arch_efi_call_virt_teardown(void) -- 2.55.0.679.g6767b8d81c-goog