Re: [PATCH] arm64/efi: Do not call EFI runtime services preemptibly under SW PAN

[Will Deacon <will@kernel.org>]

On Wed, Aug 05, 2026 at 05:01:44PM -0700, gus bourg wrote:
> From: Gus Bourg <gus@bourg.net>
> 
> When PAN is emulated by switching TTBR0_EL1, arch_efi_call_virt_setup()
> installs the EFI mm into TTBR0_EL1 via uaccess_ttbr0_enable(), and only a
> return from exception ever puts it back: check_and_switch_context() skips
> the register write by design ("Defer TTBR0_EL1 setting for user threads to
> uaccess_enable() when emulating PAN"), and __switch_to() does not touch it
> either. switch_mm() updates only thread_info->ttbr0.
> 
> Since commit a5baf582f4c0 ("arm64/efi: Call EFI runtime services without
> disabling preemption") the runtime call is preemptible, so the EFI worker
> can now be scheduled out inside that window. An involuntary preemption is
> harmless, because __swpan_entry_el1()/__swpan_exit_el1() save and restore
> the state around the exception. A voluntary reschedule is not: it performs
> no return from exception, so the worker resumes with another task's
> TTBR0_EL1 - or reserved_pg_dir - and the next efi_mm access takes a level 0
> translation fault.
> 
> There is such a preemption point in arch_efi_call_virt_setup() itself,
> immediately after the TTBR0 install: __efi_fpsimd_begin() ->
> kernel_neon_begin() -> put_cpu_fpsimd_context() -> local_bh_enable() ->
> preempt_check_resched().

Hmm, can we move the ttbr0 toggling until after __efi_fpsimd_begin() so
that this preemption point doesn't interfere?

Will