• Will Deacon's avatar
    arm64: efi: don't restore TTBR0 if active_mm points at init_mm · 130c93fd
    Will Deacon authored
    init_mm isn't a normal mm: it has swapper_pg_dir as its pgd (which
    contains kernel mappings) and is used as the active_mm for the idle
    thread.
    
    When restoring the pgd after an EFI call, we write current->active_mm
    into TTBR0. If the current task is actually the idle thread (e.g. when
    initialising the EFI RTC before entering userspace), then the TLB can
    erroneously populate itself with junk global entries as a result of
    speculative table walks.
    
    When we do eventually return to userspace, the task can end up hitting
    these junk mappings leading to lockups, corruption or crashes.
    
    This patch fixes the problem in the same way as the CPU suspend code by
    ensuring that we never switch to the init_mm in efi_set_pgd and instead
    point TTBR0 at the zero page. A check is also added to cpu_switch_mm to
    BUG if we get passed swapper_pg_dir.
    Reviewed-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Fixes: f3cdfd23 ("arm64/efi: move SetVirtualAddressMap() to UEFI stub")
    Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
    Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
    130c93fd
proc-fns.h 1.72 KB