Page MenuHomeFreeBSD

arm64: Disable PAC when booting on a Windows Dev Kit 2023
ClosedPublic

Authored by markj on Apr 21 2023, 3:08 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, May 23, 8:04 PM
Unknown Object (File)
Apr 30 2024, 11:28 PM
Unknown Object (File)
Apr 30 2024, 11:25 PM
Unknown Object (File)
Apr 30 2024, 11:05 PM
Unknown Object (File)
Apr 30 2024, 10:48 PM
Unknown Object (File)
Apr 30 2024, 8:17 PM
Unknown Object (File)
Apr 26 2024, 7:11 PM
Unknown Object (File)
Mar 14 2024, 2:32 PM
Subscribers

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Apr 21 2023, 3:08 PM

This looks like a reasonable step for now to me; we can refine or adjust affected CPU detection later on.

My understanding is pointer authentication works on the Cortex-A78C with the workaround in erratum 2478780, the issue is the firmware traps access to the needed registers.

I don't think there is a way for the firmware to tell us that pointer authentication is disabled so it might be better to check which device we are on from the various smbios environment variables & disable based on that.

My understanding is pointer authentication works on the Cortex-A78C with the workaround in erratum 2478780, the issue is the firmware traps access to the needed registers.

I don't think there is a way for the firmware to tell us that pointer authentication is disabled so it might be better to check which device we are on from the various smbios environment variables & disable based on that.

But there's also no way for us to know whether firmware has applied the workaround, so don't we have to always apply the workaround to be safe?

sys/arm64/arm64/ptrauth.c
78

But there's also no way for us to know whether firmware has applied the workaround, so don't we have to always apply the workaround to be safe?

We could (eventually) check the mfgr and firmware version here and return false if its in an allowlist

The issue we are seeing isn't due to the erratum, but because the firmware is setting at least one of the SCR_EL3.APK or HCR_EL2.APK fields so is trapping accesses to the special registers. As this is a firmware issue it's possible other firmware on different CPUs could be affected that this check would miss.

As Linux doesn't have a workaround for the issue they expect the firmware will have implemented the workaround, although we may be able to detect if it's missing by reading back sctlr_el1 and checking if it is corrupt.

Use smbios information to decide whether to disable PAC.

markj retitled this revision from arm64: Disable PAC when booting on a Cortex-A78C to arm64: Disable PAC when booting on a Windows Dev Kit 2023.Apr 21 2023, 8:23 PM
markj edited the summary of this revision. (Show Details)

LGTM for now. If a fixed firmware shows up we can check the version.

This revision is now accepted and ready to land.Apr 21 2023, 8:41 PM