Re: [PATCH RFC v10 07/22] arm64: Initialize POR_EL1 register on cpu_resume()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] arm64: unconfirmed ordering of SYS_POR_EL1 and REG_TCR2_EL1 in
  _cpu_resume()
--

commit 5fdafa429ecfc231981525c4af268a477f615016
Author: Yeoreum Yun <yeoreum.yun@arm.com>

arm64: Initialize POR_EL1 register on cpu_resume()

This commit initializes POR_EL1 to POR_EL1_INIT in _cpu_resume() before
calling cpu_do_resume() since POR_EL1 resets to an unknown value across
cpu_suspend().

> diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
> index f093cdf71be11..e0a6ad85cd242 100644
> --- a/arch/arm64/kernel/sleep.S
> +++ b/arch/arm64/kernel/sleep.S
[ ... ]
> @@ -134,6 +135,17 @@ SYM_FUNC_START(_cpu_resume)
>  	/* load sp from context */
>  	ldr	x2, [x0, #CPU_CTX_SP]
>  	mov	sp, x2
> +
> +#ifdef CONFIG_ARM64_POE
> +alternative_if_not ARM64_HAS_S1POE
> +	b	.Lskip_por_set
> +alternative_else_nop_endif
> +	mov_q	x2, POR_EL1_INIT
> +	msr_s	SYS_POR_EL1, x2
> +	/* isb can be skipped since cpu_do_resume() will do it. */

[Severity: Low]
Can the indirect effect of writing REG_TCR2_EL1 in cpu_do_resume() take
effect before this unsynchronized write to SYS_POR_EL1 when no isb
separates the two system register writes?

This rests on an ARM architecture detail that the review could not confirm
from the kernel source.  The MMU is already enabled when _cpu_resume()
runs, and cpu_do_resume() restores REG_TCR2_EL1 (with TCR2_EL1_POE set
once commit "arm64: Enable kpkeys" enables stage-1 POE at EL1) and
performs further instruction fetches and memory loads before the final
isb:

arch/arm64/mm/proc.S:cpu_do_resume() {
    ...
alternative_if ARM64_HAS_TCR2
	ldr	x2, [x0, #104]
	msr	REG_TCR2_EL1, x2
alternative_else_nop_endif
alternative_if ARM64_SME
	ldr	x2, [x0, #112]
	msr_s	SYS_TPIDR2_EL0, x2
alternative_else_nop_endif
    ...
	ptrauth_keys_install_kernel_nosync x14, x1, x2, x3
	isb
	ret
}

If the architecture permits enabling stage-1 permission overlay in
REG_TCR2_EL1 to take effect on those intervening fetches or loads before
the write to SYS_POR_EL1 takes effect, the CPU could evaluate kernel
permission overlays against the unknown reset value of POR_EL1 and trigger
a fatal EL1 permission fault during resume.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-kpkeys-v10-0-aa6c4d9603bc@arm.com?part=7