From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35D09C433ED for ; Fri, 9 Apr 2021 16:20:43 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id D073261026 for ; Fri, 9 Apr 2021 16:20:42 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D073261026 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References:Message-ID: Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=PTtUH0BK4Fnsu5zljRvVHn/T222otM4Egn/YuHFvbDk=; b=XRdoTCjKrcrrz4lcLsITXmM8B NtDcKkuwRfV3SU6AFaR15n4iqExjV8SJ/8DBhcMdSgNqVrGcMOz+KJb814KOHjWIK2tBJN1jpCyAn iqPCb3yYNbEP2UXGvvsWTrF0ToKnWxuNFrNNBj5JbmScqZrbpZShx4DMT5c6HeltAAFdKHGXE4Fmk /TbYK5mnS45CYNwGhriVQD2v7G62qiRRzKTaKewFBMrUzgiDhAUY24kBaN1oVOpMcUoKvEkim3Hq+ HdUQQyWxMeFvY55g5K77j/dcq+XHI5bHO7VUDZey8O+5rTo/4bVYyZk//KDcKWO76PswdXgKZDNE8 MH+0aYEGQ==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lUtqX-0014vi-Qw; Fri, 09 Apr 2021 16:19:02 +0000 Received: from bombadil.infradead.org ([2607:7c80:54:e::133]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lUtqV-0014vK-Kf for linux-arm-kernel@desiato.infradead.org; Fri, 09 Apr 2021 16:18:59 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20210309; h=In-Reply-To:Content-Type:MIME-Version :References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=2Dakwvs7oaLgjhwvbtkHqY5nuuHVmWTJnPVmrClHE2g=; b=JRnN4HkoGGZwONq9NT8h8xGVAo kGGK91y20WET8McHponImmoR1Jx55Pu53S1VAPXEP3YstuLPLMKK8pjtlRTj2FCtAjxxZ5/Xx8Z1G ibJrd7PtFe/+lKvrY6nBiSkg8oHyCxuVw9em/1nn5Q6ZRoFl20PZUHDcantXZEY/3ckcV49pmG7Gn mGAk8zTE2PIduJ20PeAfQCT6cs/DnyAK9sDF4zMuSdSQcJmTuRlVbMao6AHaZUGJ1ZNvWsF0WttZX L1dREEVJTSSRIZuZ7Html4x6byTyIgQqbeGk61/8JtmGbMVGq3+uZ+AkmbF3Wd32B1wQ0M1aUqFL+ clARfdVw==; Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lUtqS-004e7n-Iu for linux-arm-kernel@lists.infradead.org; Fri, 09 Apr 2021 16:18:58 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 1E12B1FB; Fri, 9 Apr 2021 09:18:53 -0700 (PDT) Received: from C02TD0UTHF1T.local (unknown [10.57.28.223]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id B8FD23F73D; Fri, 9 Apr 2021 09:18:51 -0700 (PDT) Date: Fri, 9 Apr 2021 17:18:45 +0100 From: Mark Rutland To: Vincenzo Frascino Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, Catalin Marinas , Will Deacon , stable@vger.kernel.org Subject: Re: [PATCH v3] arm64: mte: Move MTE TCF0 check in entry-common Message-ID: <20210409161030.GA60611@C02TD0UTHF1T.local> References: <20210409132419.29965-1-vincenzo.frascino@arm.com> <20210409143247.GA58461@C02TD0UTHF1T.local> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20210409143247.GA58461@C02TD0UTHF1T.local> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210409_091856_749681_73400EE3 X-CRM114-Status: GOOD ( 36.08 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Fri, Apr 09, 2021 at 03:32:47PM +0100, Mark Rutland wrote: > Hi Vincenzo, > > On Fri, Apr 09, 2021 at 02:24:19PM +0100, Vincenzo Frascino wrote: > > The check_mte_async_tcf macro sets the TIF flag non-atomically. This can > > race with another CPU doing a set_tsk_thread_flag() and all the other flags > > can be lost in the process. > > > > Move the tcf0 check to enter_from_user_mode() and clear tcf0 in > > exit_to_user_mode() to address the problem. > > > > Note: Moving the check in entry-common allows to use set_thread_flag() > > which is safe. I've dug into this a bit more, and as set_thread_flag() calls some potentially-instrumented helpers I don't think this is safe after all (as e.g. those might cause an EL1 exception and clobber the ESR/FAR/etc before the EL0 exception handler reads it). Making that watertight is pretty hairy, as we either need to open-code set_thread_flag() or go rework a load of core code. If we can use STSET in the entry asm that'd be simpler, otherwise we'll need something more involved. Thanks, Mark. > > > > Fixes: 637ec831ea4f ("arm64: mte: Handle synchronous and asynchronous tag check faults") > > Cc: Catalin Marinas > > Cc: Will Deacon > > Cc: stable@vger.kernel.org > > Reported-by: Will Deacon > > Signed-off-by: Vincenzo Frascino > > --- > > arch/arm64/include/asm/mte.h | 9 +++++++++ > > arch/arm64/kernel/entry-common.c | 6 ++++++ > > arch/arm64/kernel/entry.S | 34 -------------------------------- > > arch/arm64/kernel/mte.c | 33 +++++++++++++++++++++++++++++-- > > 4 files changed, 46 insertions(+), 36 deletions(-) > > > > diff --git a/arch/arm64/include/asm/mte.h b/arch/arm64/include/asm/mte.h > > index 9b557a457f24..c7ab681a95c3 100644 > > --- a/arch/arm64/include/asm/mte.h > > +++ b/arch/arm64/include/asm/mte.h > > @@ -49,6 +49,9 @@ int mte_ptrace_copy_tags(struct task_struct *child, long request, > > > > void mte_assign_mem_tag_range(void *addr, size_t size); > > > > +void noinstr check_mte_async_tcf0(void); > > +void noinstr clear_mte_async_tcf0(void); > > Can we please put the implementations in the header so that they can be > inlined? Otherwise when the HW doesn't support MTE we'll always do a pointless > branch to the out-of-line implementation. > > With that, we can mark them __always_inline to avoid weirdness with an inline > noinstr function. > > Otherwise, this looks good to me. > > Thanks, > Mark. > > > + > > #else /* CONFIG_ARM64_MTE */ > > > > /* unused if !CONFIG_ARM64_MTE, silence the compiler */ > > @@ -83,6 +86,12 @@ static inline int mte_ptrace_copy_tags(struct task_struct *child, > > { > > return -EIO; > > } > > +static inline void check_mte_async_tcf0(void) > > +{ > > +} > > +static inline void clear_mte_async_tcf0(void) > > +{ > > +} > > > > static inline void mte_assign_mem_tag_range(void *addr, size_t size) > > { > > diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c > > index 9d3588450473..837d3624a1d5 100644 > > --- a/arch/arm64/kernel/entry-common.c > > +++ b/arch/arm64/kernel/entry-common.c > > @@ -289,10 +289,16 @@ asmlinkage void noinstr enter_from_user_mode(void) > > CT_WARN_ON(ct_state() != CONTEXT_USER); > > user_exit_irqoff(); > > trace_hardirqs_off_finish(); > > + > > + /* Check for asynchronous tag check faults in user space */ > > + check_mte_async_tcf0(); > > > > > } > > > > asmlinkage void noinstr exit_to_user_mode(void) > > { > > + /* Ignore asynchronous tag check faults in the uaccess routines */ > > + clear_mte_async_tcf0(); > > + > > trace_hardirqs_on_prepare(); > > lockdep_hardirqs_on_prepare(CALLER_ADDR0); > > user_enter_irqoff(); > > diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S > > index a31a0a713c85..fb57df0d453f 100644 > > --- a/arch/arm64/kernel/entry.S > > +++ b/arch/arm64/kernel/entry.S > > @@ -34,15 +34,11 @@ > > * user and kernel mode. > > */ > > .macro user_exit_irqoff > > -#if defined(CONFIG_CONTEXT_TRACKING) || defined(CONFIG_TRACE_IRQFLAGS) > > bl enter_from_user_mode > > -#endif > > .endm > > > > .macro user_enter_irqoff > > -#if defined(CONFIG_CONTEXT_TRACKING) || defined(CONFIG_TRACE_IRQFLAGS) > > bl exit_to_user_mode > > -#endif > > .endm > > > > .macro clear_gp_regs > > @@ -147,32 +143,6 @@ alternative_cb_end > > .L__asm_ssbd_skip\@: > > .endm > > > > - /* Check for MTE asynchronous tag check faults */ > > - .macro check_mte_async_tcf, flgs, tmp > > -#ifdef CONFIG_ARM64_MTE > > -alternative_if_not ARM64_MTE > > - b 1f > > -alternative_else_nop_endif > > - mrs_s \tmp, SYS_TFSRE0_EL1 > > - tbz \tmp, #SYS_TFSR_EL1_TF0_SHIFT, 1f > > - /* Asynchronous TCF occurred for TTBR0 access, set the TI flag */ > > - orr \flgs, \flgs, #_TIF_MTE_ASYNC_FAULT > > - str \flgs, [tsk, #TSK_TI_FLAGS] > > - msr_s SYS_TFSRE0_EL1, xzr > > -1: > > -#endif > > - .endm > > - > > - /* Clear the MTE asynchronous tag check faults */ > > - .macro clear_mte_async_tcf > > -#ifdef CONFIG_ARM64_MTE > > -alternative_if ARM64_MTE > > - dsb ish > > - msr_s SYS_TFSRE0_EL1, xzr > > -alternative_else_nop_endif > > -#endif > > - .endm > > - > > .macro mte_set_gcr, tmp, tmp2 > > #ifdef CONFIG_ARM64_MTE > > /* > > @@ -243,8 +213,6 @@ alternative_else_nop_endif > > ldr x19, [tsk, #TSK_TI_FLAGS] > > disable_step_tsk x19, x20 > > > > - /* Check for asynchronous tag check faults in user space */ > > - check_mte_async_tcf x19, x22 > > apply_ssbd 1, x22, x23 > > > > ptrauth_keys_install_kernel tsk, x20, x22, x23 > > @@ -775,8 +743,6 @@ SYM_CODE_START_LOCAL(ret_to_user) > > cbnz x2, work_pending > > finish_ret_to_user: > > user_enter_irqoff > > - /* Ignore asynchronous tag check faults in the uaccess routines */ > > - clear_mte_async_tcf > > enable_step_tsk x19, x2 > > #ifdef CONFIG_GCC_PLUGIN_STACKLEAK > > bl stackleak_erase > > diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c > > index b3c70a612c7a..84a942c25870 100644 > > --- a/arch/arm64/kernel/mte.c > > +++ b/arch/arm64/kernel/mte.c > > @@ -166,14 +166,43 @@ static void set_gcr_el1_excl(u64 excl) > > */ > > } > > > > -void flush_mte_state(void) > > +void noinstr check_mte_async_tcf0(void) > > +{ > > + u64 tcf0; > > + > > + if (!system_supports_mte()) > > + return; > > + > > + /* > > + * dsb(ish) is not required before the register read > > + * because the TFSRE0_EL1 is automatically synchronized > > + * by the hardware on exception entry as SCTLR_EL1.ITFSB > > + * is set. > > + */ > > + tcf0 = read_sysreg_s(SYS_TFSRE0_EL1); > > + > > + if (tcf0 & SYS_TFSR_EL1_TF0) > > + set_thread_flag(TIF_MTE_ASYNC_FAULT); > > + > > + write_sysreg_s(0, SYS_TFSRE0_EL1); > > +} > > + > > +void noinstr clear_mte_async_tcf0(void) > > { > > if (!system_supports_mte()) > > return; > > > > - /* clear any pending asynchronous tag fault */ > > dsb(ish); > > write_sysreg_s(0, SYS_TFSRE0_EL1); > > +} > > + > > +void flush_mte_state(void) > > +{ > > + if (!system_supports_mte()) > > + return; > > + > > + /* clear any pending asynchronous tag fault */ > > + clear_mte_async_tcf0(); > > clear_thread_flag(TIF_MTE_ASYNC_FAULT); > > /* disable tag checking */ > > set_sctlr_el1_tcf0(SCTLR_EL1_TCF0_NONE); > > -- > > 2.30.2 > > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel