Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ADR-026 — PAN capability: probe the ID field, do not invent the CPU

  • Status: Accepted (capability probe). Historical a57: pan: absent. Default smoke CPU since ADR-079: -cpu cortex-a76 → pan: present. PAN enable + EL1-vs-EL0 fault: ADR-080 (ADR-054 gate items 3–4).
  • Date: 2026-09-12

Context

Track A / A5 (issue #36) may take Privileged Access Never only if ID_AA64MMFR1_EL1.PAN != 0 on the probe CPU and an ADR says so. The documented QEMU line is -cpu cortex-a57 (ARMv8.0). PAN is typically unimplemented there. Silently switching -cpu (for example to max) to make the field non-zero is not an honest probe.

ADR-013 already named PAN as a closing isolation probe: an EL1 access to an EL0-accessible page must fault when PSTATE.PAN is set. That enable + fault mile is not this ADR.

Hypotheses

IDOptionNotes
H1 (chosen)Read ID_AA64MMFR1_EL1.PAN on the default -cpu. Print the field. Enable PSTATE.PAN only if the field is non-zero and a later cut proves the EL1-vs-EL0 fault. On cortex-a57 record pan: absent.CPU evidence without inventing hardware.
H2 (rejected)Change default -cpu to max (or another v8.1+ model) so PAN appears.Silent CPU switch. Forbidden by A5 and by this ADR.
H3 (rejected)Claim PAN / “EL0 isolated” from the ID-field print alone.File presence / a register read is not an access-fault probe.

Decision

  1. Probe the ID field. src/pan.rs reads ID_AA64MMFR1_EL1 bits [23:20] and prints pan: id=<n>. It does not execute MSR PAN. An unimplemented MSR PAN is UNDEF on ARMv8.0.
  2. Default CPU at accept time was cortex-a57. Superseded for the default probe by ADR-079 (-cpu cortex-a76). Do not silent-edit without an ADR.
  3. When n == 0 (expected). Serial pan: absent. Ledger: “PAN enable on virt cortex-a57” stays Planned, with this ID-field print as the CPU evidence. scripts/qemu-smoke.sh greps pan: id= / pan: absent and rejects pan: enabled / pan: probe missed.
  4. When n != 0. Serial pan: present. ADR-080 enables PSTATE.PAN and proves EL1-vs-EL0 fault. Smoke expects pan: present + pan: enabled + pan: el1-fault on -cpu cortex-a76.
  5. Still Planned. PAN enable + EL1-vs-EL0 access fault; lower-EL IRQ while standing; EL0 entry without TLBI VMALLE1; umbrella EL0 isolation. ADR-032 re-states that leftover: do not MSR PAN while the ID field is 0. ADR-025 is the identity .rodata cut, not this.
  6. NFR-10 text is revised in place (ID unchanged). Do not mint NFR-15+.

Honesty

Say “ID_AA64MMFR1_EL1.PAN is 0 on -cpu cortex-a57” only when the serial / tests pass. Do not say:

  • PAN is enabled
  • EL1 cannot access EL0 pages
  • “secure OS” / “hardened” / “EL0 isolated”
  • the probe used a different -cpu than the scripts

Consequences

  • src/pan.rs owns the ID-field probe. Isolation docs cite this ADR as Planned for the enable mile.
  • ADR-047 records: PAN enable is a non-goal on the default probe CPU; ID-field probe stays Verified.
  • A future CPU change needs its own ADR + sponsor and must not be a silent script edit.
  • Enable lock: ADR-054 (2026-09-14) locks PAN enable as non-goal on default cortex-a57 and documents the reopen gate (sponsor CPU + FEAT_PAN + enable+fault ADR).