[PATCH v3 0/4] support FEAT_MTE_STORE_ONLY feature

[PATCH v3 0/4] support FEAT_MTE_STORE_ONLY feature

[Yeoreum Yun]

ARMv8.5 based processors introduce the Memory Tagging Extension (MTE) feature.
MTE is built on top of the ARMv8.0 virtual address tagging TBI
(Top Byte Ignore) feature and allows software to access a 4-bit
allocation tag for each 16-byte granule in the physical address space.
A logical tag is derived from bits 59-56 of the virtual
address used for the memory access. A CPU with MTE enabled will compare
the logical tag against the allocation tag and potentially raise an
tag check fault on mismatch, subject to system registers configuration.

Since ARMv8.9, FEAT_MTE_STORE_ONLY can be used to restrict raise of tag
check fault on store operation only.
For this, application can use PR_MTE_STORE_ONLY flag
when it sets the MTE setting with prctl().

This feature omits tag check for fetch/read operation.
So it might be used not only debugging purpose but also be used
by application requiring strong memory safty in normal env.

Since v1:
  - add doc to elf_hwcaps.rst
  - add MTE_STORE_ONLY hwcap test

Since v2:
  - Rebase to 6.15.-rc1

NOTE:
  This patches based on https://lore.kernel.org/all/20250410074721.947380-1-yeoreum.yun@arm.com/

Yeoreum Yun (4):
  arm64/feature: add MTE_STORE_ONLY feature
  prtcl: introduce PR_MTE_STORE_ONLY
  arm64/kernel: support store-only mte tag check
  tools/kselftest: add MTE_STORE_ONLY feature hwcap test

 Documentation/arch/arm64/elf_hwcaps.rst   |  3 +++
 arch/arm64/include/asm/hwcap.h            |  1 +
 arch/arm64/include/asm/processor.h        |  2 ++
 arch/arm64/include/uapi/asm/hwcap.h       |  1 +
 arch/arm64/kernel/cpufeature.c            |  9 +++++++++
 arch/arm64/kernel/cpuinfo.c               |  1 +
 arch/arm64/kernel/mte.c                   | 11 ++++++++++-
 arch/arm64/kernel/process.c               |  6 +++++-
 arch/arm64/tools/cpucaps                  |  1 +
 include/uapi/linux/prctl.h                |  2 ++
 tools/testing/selftests/arm64/abi/hwcap.c |  6 ++++++
 11 files changed, 41 insertions(+), 2 deletions(-)

--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}

[PATCH v3 1/4] arm64/feature: add MTE_STORE_ONLY feature

[Yeoreum Yun]

add MTE_STORE_ONLY feature and HWCAP.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
---
 Documentation/arch/arm64/elf_hwcaps.rst | 3 +++
 arch/arm64/include/asm/hwcap.h          | 1 +
 arch/arm64/include/uapi/asm/hwcap.h     | 1 +
 arch/arm64/kernel/cpufeature.c          | 9 +++++++++
 arch/arm64/kernel/cpuinfo.c             | 1 +
 arch/arm64/tools/cpucaps                | 1 +
 6 files changed, 16 insertions(+)

diff --git a/Documentation/arch/arm64/elf_hwcaps.rst b/Documentation/arch/arm64/elf_hwcaps.rst
index 358f5af035ff..f58ada4d6cb2 100644
--- a/Documentation/arch/arm64/elf_hwcaps.rst
+++ b/Documentation/arch/arm64/elf_hwcaps.rst
@@ -438,6 +438,9 @@ HWCAP2_POE
 HWCAP3_MTE_FAR
     Functionality implied by ID_AA64PFR2_EL1.MTEFAR == 0b0001.
 
+HWCAP3_MTE_STORE_ONLY
+    Functionality implied by ID_AA64PFR2_EL1.MTESTOREONLY == 0b0001.
+
 4. Unused AT_HWCAP bits
 -----------------------
 
diff --git a/arch/arm64/include/asm/hwcap.h b/arch/arm64/include/asm/hwcap.h
index 28dd1ac29ecc..13f94c8ddfc0 100644
--- a/arch/arm64/include/asm/hwcap.h
+++ b/arch/arm64/include/asm/hwcap.h
@@ -177,6 +177,7 @@
 
 #define __khwcap3_feature(x)		(const_ilog2(HWCAP3_ ## x) + 128)
 #define KERNEL_HWCAP_MTE_FAR		__khwcap3_feature(MTE_FAR)
+#define KERNEL_HWCAP_MTE_STORE_ONLY	__khwcap3_feature(MTE_STORE_ONLY)
 
 /*
  * This yields a mask that user programs can use to figure out what
diff --git a/arch/arm64/include/uapi/asm/hwcap.h b/arch/arm64/include/uapi/asm/hwcap.h
index 7d22527a7975..72c78468b806 100644
--- a/arch/arm64/include/uapi/asm/hwcap.h
+++ b/arch/arm64/include/uapi/asm/hwcap.h
@@ -144,5 +144,6 @@
  * HWCAP3 flags - for AT_HWCAP3
  */
 #define HWCAP3_MTE_FAR		(1UL << 0)
+#define HWCAP3_MTE_STORE_ONLY		(1UL << 1)
 
 #endif /* _UAPI__ASM_HWCAP_H */
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 183b4b7e3074..a2f25a8bed96 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -313,6 +313,7 @@ static const struct arm64_ftr_bits ftr_id_aa64pfr1[] = {
 static const struct arm64_ftr_bits ftr_id_aa64pfr2[] = {
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64PFR2_EL1_FPMR_SHIFT, 4, 0),
 	ARM64_FTR_BITS(FTR_VISIBLE, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR2_EL1_MTEFAR_SHIFT, 4, ID_AA64PFR2_EL1_MTEFAR_NI),
+	ARM64_FTR_BITS(FTR_VISIBLE, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR2_EL1_MTESTOREONLY_SHIFT, 4, ID_AA64PFR2_EL1_MTESTOREONLY_NI),
 	ARM64_FTR_END,
 };
 
@@ -2869,6 +2870,13 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
 		.matches = has_cpuid_feature,
 		ARM64_CPUID_FIELDS(ID_AA64PFR2_EL1, MTEFAR, IMP)
 	},
+	{
+		.desc = "Store Only MTE Tag Check",
+		.capability = ARM64_MTE_STORE_ONLY,
+		.type = ARM64_CPUCAP_SYSTEM_FEATURE,
+		.matches = has_cpuid_feature,
+		ARM64_CPUID_FIELDS(ID_AA64PFR2_EL1, MTESTOREONLY, IMP)
+	},
 #endif /* CONFIG_ARM64_MTE */
 	{
 		.desc = "RCpc load-acquire (LDAPR)",
@@ -3200,6 +3208,7 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
 	HWCAP_CAP(ID_AA64PFR1_EL1, MTE, MTE2, CAP_HWCAP, KERNEL_HWCAP_MTE),
 	HWCAP_CAP(ID_AA64PFR1_EL1, MTE, MTE3, CAP_HWCAP, KERNEL_HWCAP_MTE3),
 	HWCAP_CAP(ID_AA64PFR2_EL1, MTEFAR, IMP, CAP_HWCAP, KERNEL_HWCAP_MTE_FAR),
+	HWCAP_CAP(ID_AA64PFR2_EL1, MTESTOREONLY, IMP, CAP_HWCAP , KERNEL_HWCAP_MTE_STORE_ONLY),
 #endif /* CONFIG_ARM64_MTE */
 	HWCAP_CAP(ID_AA64MMFR0_EL1, ECV, IMP, CAP_HWCAP, KERNEL_HWCAP_ECV),
 	HWCAP_CAP(ID_AA64MMFR1_EL1, AFP, IMP, CAP_HWCAP, KERNEL_HWCAP_AFP),
diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index e2b13454e38a..40f85ec01fe4 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -161,6 +161,7 @@ static const char *const hwcap_str[] = {
 	[KERNEL_HWCAP_SME_STMOP]	= "smestmop",
 	[KERNEL_HWCAP_SME_SMOP4]	= "smesmop4",
 	[KERNEL_HWCAP_MTE_FAR]		= "mte_far",
+	[KERNEL_HWCAP_MTE_STORE_ONLY]	= "mte_store_only",
 };
 
 #ifdef CONFIG_COMPAT
diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps
index ef62ea04ba37..282a1dbb8bc9 100644
--- a/arch/arm64/tools/cpucaps
+++ b/arch/arm64/tools/cpucaps
@@ -68,6 +68,7 @@ MPAM_HCR
 MTE
 MTE_ASYMM
 MTE_FAR
+MTE_STORE_ONLY
 SME
 SME_FA64
 SME2
-- 
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}

[PATCH v3 2/4] prtcl: introduce PR_MTE_STORE_ONLY

[Yeoreum Yun]

PR_MTE_STORE_ONLY is used to restrict the MTE tag check for store
opeartion only.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
---
 include/uapi/linux/prctl.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
index 15c18ef4eb11..83ac566251d8 100644
--- a/include/uapi/linux/prctl.h
+++ b/include/uapi/linux/prctl.h
@@ -244,6 +244,8 @@ struct prctl_mm_map {
 # define PR_MTE_TAG_MASK		(0xffffUL << PR_MTE_TAG_SHIFT)
 /* Unused; kept only for source compatibility */
 # define PR_MTE_TCF_SHIFT		1
+/* MTE tag check store only */
+# define PR_MTE_STORE_ONLY		(1UL << 19)
 /* RISC-V pointer masking tag length */
 # define PR_PMLEN_SHIFT			24
 # define PR_PMLEN_MASK			(0x7fUL << PR_PMLEN_SHIFT)
-- 
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}

[PATCH v3 3/4] arm64/kernel: support store-only mte tag check

[Yeoreum Yun]

Introduce new flag -- MTE_CTRL_STORE_ONLY used to set store-only tag check.
This flag isn't overrided by prefered tcf flag setting but set together
with prefered setting of way to report tag check fault.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
---
 arch/arm64/include/asm/processor.h |  2 ++
 arch/arm64/kernel/mte.c            | 11 ++++++++++-
 arch/arm64/kernel/process.c        |  6 +++++-
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 1bf1a3b16e88..61d62bfd5a7b 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -23,6 +23,8 @@
 #define MTE_CTRL_TCF_ASYNC		(1UL << 17)
 #define MTE_CTRL_TCF_ASYMM		(1UL << 18)
 
+#define MTE_CTRL_STORE_ONLY		(1UL << 19)
+
 #ifndef __ASSEMBLY__
 
 #include <linux/build_bug.h>
diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
index 2fbfd27ff5f2..e5e773844889 100644
--- a/arch/arm64/kernel/mte.c
+++ b/arch/arm64/kernel/mte.c
@@ -200,7 +200,7 @@ static void mte_update_sctlr_user(struct task_struct *task)
 	 * program requested values go with what was requested.
 	 */
 	resolved_mte_tcf = (mte_ctrl & pref) ? pref : mte_ctrl;
-	sctlr &= ~SCTLR_EL1_TCF0_MASK;
+	sctlr &= ~(SCTLR_EL1_TCF0_MASK | SCTLR_EL1_TCSO0_MASK);
 	/*
 	 * Pick an actual setting. The order in which we check for
 	 * set bits and map into register values determines our
@@ -212,6 +212,10 @@ static void mte_update_sctlr_user(struct task_struct *task)
 		sctlr |= SYS_FIELD_PREP_ENUM(SCTLR_EL1, TCF0, ASYNC);
 	else if (resolved_mte_tcf & MTE_CTRL_TCF_SYNC)
 		sctlr |= SYS_FIELD_PREP_ENUM(SCTLR_EL1, TCF0, SYNC);
+
+	if (mte_ctrl & MTE_CTRL_STORE_ONLY)
+		sctlr |= SYS_FIELD_PREP(SCTLR_EL1, TCSO0, 1);
+
 	task->thread.sctlr_user = sctlr;
 }
 
@@ -371,6 +375,9 @@ long set_mte_ctrl(struct task_struct *task, unsigned long arg)
 	    (arg & PR_MTE_TCF_SYNC))
 		mte_ctrl |= MTE_CTRL_TCF_ASYMM;
 
+	if (arg & PR_MTE_STORE_ONLY)
+		mte_ctrl |= MTE_CTRL_STORE_ONLY;
+
 	task->thread.mte_ctrl = mte_ctrl;
 	if (task == current) {
 		preempt_disable();
@@ -398,6 +405,8 @@ long get_mte_ctrl(struct task_struct *task)
 		ret |= PR_MTE_TCF_ASYNC;
 	if (mte_ctrl & MTE_CTRL_TCF_SYNC)
 		ret |= PR_MTE_TCF_SYNC;
+	if (mte_ctrl & MTE_CTRL_STORE_ONLY)
+		ret |= PR_MTE_STORE_ONLY;
 
 	return ret;
 }
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 42faebb7b712..cea4a23a15de 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -815,10 +815,14 @@ long set_tagged_addr_ctrl(struct task_struct *task, unsigned long arg)
 	if (is_compat_thread(ti))
 		return -EINVAL;
 
-	if (system_supports_mte())
+	if (system_supports_mte()) {
 		valid_mask |= PR_MTE_TCF_SYNC | PR_MTE_TCF_ASYNC \
 			| PR_MTE_TAG_MASK;
 
+		if (cpus_have_cap(ARM64_MTE_STORE_ONLY))
+			valid_mask |= PR_MTE_STORE_ONLY;
+	}
+
 	if (arg & ~valid_mask)
 		return -EINVAL;
 
-- 
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}

[PATCH v3 4/4] tools/kselftest: add MTE_STORE_ONLY feature hwcap test

[Yeoreum Yun]

add MTE_STORE_ONLY feature hwcap test.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
---
 tools/testing/selftests/arm64/abi/hwcap.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/testing/selftests/arm64/abi/hwcap.c b/tools/testing/selftests/arm64/abi/hwcap.c
index a539eeb0bfc0..32385f67498e 100644
--- a/tools/testing/selftests/arm64/abi/hwcap.c
+++ b/tools/testing/selftests/arm64/abi/hwcap.c
@@ -1104,6 +1104,12 @@ static const struct hwcap_data {
 		.hwcap_bit = HWCAP3_MTE_FAR,
 		.cpuinfo = "mte_far",
 	},
+	{
+		.name = "MTE_STOREONLY",
+		.at_hwcap = AT_HWCAP3,
+		.hwcap_bit = HWCAP3_MTE_STORE_ONLY,
+		.cpuinfo = "mte_store_only",
+	},
 };

 typedef void (*sighandler_fn)(int, siginfo_t *, void *);
--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}

Re: [PATCH v3 0/4] support FEAT_MTE_STORE_ONLY feature

[Yeoreum Yun]

Gentle ping in case of forgotten.

> ARMv8.5 based processors introduce the Memory Tagging Extension (MTE) feature.
> MTE is built on top of the ARMv8.0 virtual address tagging TBI
> (Top Byte Ignore) feature and allows software to access a 4-bit
> allocation tag for each 16-byte granule in the physical address space.
> A logical tag is derived from bits 59-56 of the virtual
> address used for the memory access. A CPU with MTE enabled will compare
> the logical tag against the allocation tag and potentially raise an
> tag check fault on mismatch, subject to system registers configuration.
>
> Since ARMv8.9, FEAT_MTE_STORE_ONLY can be used to restrict raise of tag
> check fault on store operation only.
> For this, application can use PR_MTE_STORE_ONLY flag
> when it sets the MTE setting with prctl().
>
> This feature omits tag check for fetch/read operation.
> So it might be used not only debugging purpose but also be used
> by application requiring strong memory safty in normal env.
>
> Since v1:
>   - add doc to elf_hwcaps.rst
>   - add MTE_STORE_ONLY hwcap test
>
> Since v2:
>   - Rebase to 6.15.-rc1
>
> NOTE:
>   This patches based on https://lore.kernel.org/all/20250410074721.947380-1-yeoreum.yun@arm.com/
>
> Yeoreum Yun (4):
>   arm64/feature: add MTE_STORE_ONLY feature
>   prtcl: introduce PR_MTE_STORE_ONLY
>   arm64/kernel: support store-only mte tag check
>   tools/kselftest: add MTE_STORE_ONLY feature hwcap test
>
>  Documentation/arch/arm64/elf_hwcaps.rst   |  3 +++
>  arch/arm64/include/asm/hwcap.h            |  1 +
>  arch/arm64/include/asm/processor.h        |  2 ++
>  arch/arm64/include/uapi/asm/hwcap.h       |  1 +
>  arch/arm64/kernel/cpufeature.c            |  9 +++++++++
>  arch/arm64/kernel/cpuinfo.c               |  1 +
>  arch/arm64/kernel/mte.c                   | 11 ++++++++++-
>  arch/arm64/kernel/process.c               |  6 +++++-
>  arch/arm64/tools/cpucaps                  |  1 +
>  include/uapi/linux/prctl.h                |  2 ++
>  tools/testing/selftests/arm64/abi/hwcap.c |  6 ++++++
>  11 files changed, 41 insertions(+), 2 deletions(-)
>
> --
> LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
>

--
Sincerely,
Yeoreum Yun

Re: [PATCH v3 0/4] support FEAT_MTE_STORE_ONLY feature

[David Hildenbrand]

On 24.04.25 15:50, Yeoreum Yun wrote:
> Gentle ping in case of forgotten.
> 

I think we need some input from arm experts. Anyone?

-- 
Cheers,

David / dhildenb

Re: [PATCH v3 2/4] prtcl: introduce PR_MTE_STORE_ONLY

[David Hildenbrand]

On 10.04.25 10:07, Yeoreum Yun wrote:
> PR_MTE_STORE_ONLY is used to restrict the MTE tag check for store
> opeartion only.
> 
> Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> ---
>   include/uapi/linux/prctl.h | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
> index 15c18ef4eb11..83ac566251d8 100644
> --- a/include/uapi/linux/prctl.h
> +++ b/include/uapi/linux/prctl.h
> @@ -244,6 +244,8 @@ struct prctl_mm_map {
>   # define PR_MTE_TAG_MASK		(0xffffUL << PR_MTE_TAG_SHIFT)
>   /* Unused; kept only for source compatibility */
>   # define PR_MTE_TCF_SHIFT		1
> +/* MTE tag check store only */
> +# define PR_MTE_STORE_ONLY		(1UL << 19)

That is the next available bit after PR_MTE_TAG_MASK, correct?

Would we want to leave some space to grow PR_MTE_TAG_MASK in the future 
(could that happen?)?

-- 
Cheers,

David / dhildenb

Re: [PATCH v3 2/4] prtcl: introduce PR_MTE_STORE_ONLY

[Yeo Reum Yun]

Hi David.

> > PR_MTE_STORE_ONLY is used to restrict the MTE tag check for store
> > opeartion only.
> >
> > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > ---
> >   include/uapi/linux/prctl.h | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
> > index 15c18ef4eb11..83ac566251d8 100644
> > --- a/include/uapi/linux/prctl.h
> > +++ b/include/uapi/linux/prctl.h
> > @@ -244,6 +244,8 @@ struct prctl_mm_map {
> >   # define PR_MTE_TAG_MASK            (0xffffUL << PR_MTE_TAG_SHIFT)
> >   /* Unused; kept only for source compatibility */
> >   # define PR_MTE_TCF_SHIFT           1
> > +/* MTE tag check store only */
> > +# define PR_MTE_STORE_ONLY           (1UL << 19)
>
> That is the next available bit after PR_MTE_TAG_MASK, correct?
>
> Would we want to leave some space to grow PR_MTE_TAG_MASK in the future
> (could that happen?)?

Yes it is. But I don't think it would grow up
since  GCR_EL1's exlude field size 16 bits where PR_MTE_TAG_MASK value is set
and the next bit is used by other purpose. 

thou, exclude field would be some bit filed in GCR_EL1
AFAIK there's no plan to add new exclude field to extend
and when new field is added for this, I think it would be better to add correspond
MASK for the new field.

Thanks.

---
Sincerely,
Yeoreum Yun

Re: [PATCH v3 1/4] arm64/feature: add MTE_STORE_ONLY feature

[Catalin Marinas]

(adding Peter C again, please keep him on cc for future versions; and
you can probably avoid others that don't have an interest in MTE ;))

On Thu, Apr 10, 2025 at 09:07:20AM +0100, Yeoreum Yun wrote:
> add MTE_STORE_ONLY feature and HWCAP.
> 
> Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>

Please briefly describe what the feature is in the commit log.

> diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
> index e2b13454e38a..40f85ec01fe4 100644
> --- a/arch/arm64/kernel/cpuinfo.c
> +++ b/arch/arm64/kernel/cpuinfo.c
> @@ -161,6 +161,7 @@ static const char *const hwcap_str[] = {
>  	[KERNEL_HWCAP_SME_STMOP]	= "smestmop",
>  	[KERNEL_HWCAP_SME_SMOP4]	= "smesmop4",
>  	[KERNEL_HWCAP_MTE_FAR]		= "mte_far",
> +	[KERNEL_HWCAP_MTE_STORE_ONLY]	= "mte_store_only",

Nit: "mtestoreonly"

-- 
Catalin

Re: [PATCH v3 2/4] prtcl: introduce PR_MTE_STORE_ONLY

[Catalin Marinas]

On Thu, Apr 24, 2025 at 10:34:57PM +0200, David Hildenbrand wrote:
> On 10.04.25 10:07, Yeoreum Yun wrote:
> > PR_MTE_STORE_ONLY is used to restrict the MTE tag check for store
> > opeartion only.
> > 
> > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > ---
> >   include/uapi/linux/prctl.h | 2 ++
> >   1 file changed, 2 insertions(+)
> > 
> > diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
> > index 15c18ef4eb11..83ac566251d8 100644
> > --- a/include/uapi/linux/prctl.h
> > +++ b/include/uapi/linux/prctl.h
> > @@ -244,6 +244,8 @@ struct prctl_mm_map {
> >   # define PR_MTE_TAG_MASK		(0xffffUL << PR_MTE_TAG_SHIFT)
> >   /* Unused; kept only for source compatibility */
> >   # define PR_MTE_TCF_SHIFT		1
> > +/* MTE tag check store only */
> > +# define PR_MTE_STORE_ONLY		(1UL << 19)
> 
> That is the next available bit after PR_MTE_TAG_MASK, correct?
> 
> Would we want to leave some space to grow PR_MTE_TAG_MASK in the future
> (could that happen?)?

The current mask covers 16 tags (bits 59:56 of a pointer) and given the
reluctance to have a tag storage of 4 bits per 16 bytes (3% of RAM), I
doubt we'd ever grow this.

However, you have a good point, we could indeed leave 32 bits for the
tag mask, just in case MTE gets so much traction that someone wants 8
bits per tag (and likely a bigger granule than 16 bytes). It doesn't
cost us anything to add additional bits from (PR_MTE_TAG_SHIFT + 32).

Thanks.

-- 
Catalin

Re: [PATCH v3 3/4] arm64/kernel: support store-only mte tag check

[Catalin Marinas]

On Thu, Apr 10, 2025 at 09:07:22AM +0100, Yeoreum Yun wrote:
> Introduce new flag -- MTE_CTRL_STORE_ONLY used to set store-only tag check.
> This flag isn't overrided by prefered tcf flag setting but set together

Nit: s/overrided/overridden/

> with prefered setting of way to report tag check fault.

The preferred mode set via sysfs is about whether we want synchronous or
asynchronous tag check faults for reads/writes (or asymmetric). The
store-only checking can be combined with sync/async, so they are
slightly complementary. The question is whether one wants some global
knob to turn on store-only in combination with sync/async. We could add
more strings for sysfs like "(a)sync+storeonly"

It would be good to hear Peter's opinion from an Android perspective.

-- 
Catalin

Re: [PATCH v3 4/4] tools/kselftest: add MTE_STORE_ONLY feature hwcap test

[Catalin Marinas]

On Thu, Apr 10, 2025 at 09:07:23AM +0100, Yeoreum Yun wrote:
> add MTE_STORE_ONLY feature hwcap test.
> 
> Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> Reviewed-by: Mark Brown <broonie@kernel.org>
> ---
>  tools/testing/selftests/arm64/abi/hwcap.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/tools/testing/selftests/arm64/abi/hwcap.c b/tools/testing/selftests/arm64/abi/hwcap.c
> index a539eeb0bfc0..32385f67498e 100644
> --- a/tools/testing/selftests/arm64/abi/hwcap.c
> +++ b/tools/testing/selftests/arm64/abi/hwcap.c
> @@ -1104,6 +1104,12 @@ static const struct hwcap_data {
>  		.hwcap_bit = HWCAP3_MTE_FAR,
>  		.cpuinfo = "mte_far",
>  	},
> +	{
> +		.name = "MTE_STOREONLY",
> +		.at_hwcap = AT_HWCAP3,
> +		.hwcap_bit = HWCAP3_MTE_STORE_ONLY,
> +		.cpuinfo = "mte_store_only",
> +	},
>  };

Please also add checks to tools/testing/selftests/arm64/mte/ to verify
that read tag check faults are ignored when this is enabled.

-- 
Catalin

Re: [PATCH v3 2/4] prtcl: introduce PR_MTE_STORE_ONLY

[Peter Collingbourne]

On Fri, May 2, 2025 at 10:37 AM Catalin Marinas <catalin.marinas@arm.com> wrote:
>
> On Thu, Apr 24, 2025 at 10:34:57PM +0200, David Hildenbrand wrote:
> > On 10.04.25 10:07, Yeoreum Yun wrote:
> > > PR_MTE_STORE_ONLY is used to restrict the MTE tag check for store
> > > opeartion only.
> > >
> > > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > > ---
> > >   include/uapi/linux/prctl.h | 2 ++
> > >   1 file changed, 2 insertions(+)
> > >
> > > diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
> > > index 15c18ef4eb11..83ac566251d8 100644
> > > --- a/include/uapi/linux/prctl.h
> > > +++ b/include/uapi/linux/prctl.h
> > > @@ -244,6 +244,8 @@ struct prctl_mm_map {
> > >   # define PR_MTE_TAG_MASK          (0xffffUL << PR_MTE_TAG_SHIFT)
> > >   /* Unused; kept only for source compatibility */
> > >   # define PR_MTE_TCF_SHIFT         1
> > > +/* MTE tag check store only */
> > > +# define PR_MTE_STORE_ONLY         (1UL << 19)
> >
> > That is the next available bit after PR_MTE_TAG_MASK, correct?
> >
> > Would we want to leave some space to grow PR_MTE_TAG_MASK in the future
> > (could that happen?)?
>
> The current mask covers 16 tags (bits 59:56 of a pointer) and given the
> reluctance to have a tag storage of 4 bits per 16 bytes (3% of RAM), I
> doubt we'd ever grow this.
>
> However, you have a good point, we could indeed leave 32 bits for the
> tag mask, just in case MTE gets so much traction that someone wants 8
> bits per tag (and likely a bigger granule than 16 bytes). It doesn't
> cost us anything to add additional bits from (PR_MTE_TAG_SHIFT + 32).

If it's 8 bits per tag wouldn't the exclusion mask need to be 256
bits? I probably wouldn't try to anticipate this case since it would
likely require a different API anyway.

Peter

Re: [PATCH v3 2/4] prtcl: introduce PR_MTE_STORE_ONLY

[Catalin Marinas]

On Fri, May 02, 2025 at 11:03:02AM -0700, Peter Collingbourne wrote:
> On Fri, May 2, 2025 at 10:37 AM Catalin Marinas <catalin.marinas@arm.com> wrote:
> > On Thu, Apr 24, 2025 at 10:34:57PM +0200, David Hildenbrand wrote:
> > > On 10.04.25 10:07, Yeoreum Yun wrote:
> > > > PR_MTE_STORE_ONLY is used to restrict the MTE tag check for store
> > > > opeartion only.
> > > >
> > > > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > > > ---
> > > >   include/uapi/linux/prctl.h | 2 ++
> > > >   1 file changed, 2 insertions(+)
> > > >
> > > > diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
> > > > index 15c18ef4eb11..83ac566251d8 100644
> > > > --- a/include/uapi/linux/prctl.h
> > > > +++ b/include/uapi/linux/prctl.h
> > > > @@ -244,6 +244,8 @@ struct prctl_mm_map {
> > > >   # define PR_MTE_TAG_MASK          (0xffffUL << PR_MTE_TAG_SHIFT)
> > > >   /* Unused; kept only for source compatibility */
> > > >   # define PR_MTE_TCF_SHIFT         1
> > > > +/* MTE tag check store only */
> > > > +# define PR_MTE_STORE_ONLY         (1UL << 19)
> > >
> > > That is the next available bit after PR_MTE_TAG_MASK, correct?
> > >
> > > Would we want to leave some space to grow PR_MTE_TAG_MASK in the future
> > > (could that happen?)?
> >
> > The current mask covers 16 tags (bits 59:56 of a pointer) and given the
> > reluctance to have a tag storage of 4 bits per 16 bytes (3% of RAM), I
> > doubt we'd ever grow this.
> >
> > However, you have a good point, we could indeed leave 32 bits for the
> > tag mask, just in case MTE gets so much traction that someone wants 8
> > bits per tag (and likely a bigger granule than 16 bytes). It doesn't
> > cost us anything to add additional bits from (PR_MTE_TAG_SHIFT + 32).
> 
> If it's 8 bits per tag wouldn't the exclusion mask need to be 256
> bits? I probably wouldn't try to anticipate this case since it would
> likely require a different API anyway.

Yep, not sure what I was thinking. So all good with the original patch.

-- 
Catalin

Re: [PATCH v3 3/4] arm64/kernel: support store-only mte tag check

[Yeoreum Yun]

Hi Catalin,

> On Thu, Apr 10, 2025 at 09:07:22AM +0100, Yeoreum Yun wrote:
> > Introduce new flag -- MTE_CTRL_STORE_ONLY used to set store-only tag check.
> > This flag isn't overrided by prefered tcf flag setting but set together
>
> Nit: s/overrided/overridden/

Thanks!

>
> > with prefered setting of way to report tag check fault.
>
> The preferred mode set via sysfs is about whether we want synchronous or
> asynchronous tag check faults for reads/writes (or asymmetric). The
> store-only checking can be combined with sync/async, so they are
> slightly complementary. The question is whether one wants some global
> knob to turn on store-only in combination with sync/async. We could add
> more strings for sysfs like "(a)sync+storeonly"
>
> It would be good to hear Peter's opinion from an Android perspective.

Thanks to add, I'll wait for his comment for this :)

> --
> Catalin

--
Sincerely,
Yeoreum Yun

Re: [PATCH v3 1/4] arm64/feature: add MTE_STORE_ONLY feature

[Yeoreum Yun]

Hi Catalin,

> (adding Peter C again, please keep him on cc for future versions; and
> you can probably avoid others that don't have an interest in MTE ;))
>
> On Thu, Apr 10, 2025 at 09:07:20AM +0100, Yeoreum Yun wrote:
> > add MTE_STORE_ONLY feature and HWCAP.
> >
> > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
>
> Please briefly describe what the feature is in the commit log.

Okay. I'll add short brief.

> > diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
> > index e2b13454e38a..40f85ec01fe4 100644
> > --- a/arch/arm64/kernel/cpuinfo.c
> > +++ b/arch/arm64/kernel/cpuinfo.c
> > @@ -161,6 +161,7 @@ static const char *const hwcap_str[] = {
> >  	[KERNEL_HWCAP_SME_STMOP]	= "smestmop",
> >  	[KERNEL_HWCAP_SME_SMOP4]	= "smesmop4",
> >  	[KERNEL_HWCAP_MTE_FAR]		= "mte_far",
> > +	[KERNEL_HWCAP_MTE_STORE_ONLY]	= "mte_store_only",
>
> Nit: "mtestoreonly"

Thanks. I'll fix.
--
Sincerely,
Yeoreum Yun

Re: [PATCH v3 4/4] tools/kselftest: add MTE_STORE_ONLY feature hwcap test

[Yeoreum Yun]

Hi Catalin,

> On Thu, Apr 10, 2025 at 09:07:23AM +0100, Yeoreum Yun wrote:
> > add MTE_STORE_ONLY feature hwcap test.
> >
> > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > Reviewed-by: Mark Brown <broonie@kernel.org>
> > ---
> >  tools/testing/selftests/arm64/abi/hwcap.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/tools/testing/selftests/arm64/abi/hwcap.c b/tools/testing/selftests/arm64/abi/hwcap.c
> > index a539eeb0bfc0..32385f67498e 100644
> > --- a/tools/testing/selftests/arm64/abi/hwcap.c
> > +++ b/tools/testing/selftests/arm64/abi/hwcap.c
> > @@ -1104,6 +1104,12 @@ static const struct hwcap_data {
> >  		.hwcap_bit = HWCAP3_MTE_FAR,
> >  		.cpuinfo = "mte_far",
> >  	},
> > +	{
> > +		.name = "MTE_STOREONLY",
> > +		.at_hwcap = AT_HWCAP3,
> > +		.hwcap_bit = HWCAP3_MTE_STORE_ONLY,
> > +		.cpuinfo = "mte_store_only",
> > +	},
> >  };
>
> Please also add checks to tools/testing/selftests/arm64/mte/ to verify
> that read tag check faults are ignored when this is enabled.

Okay, I'll add related test cases in check_mmap_options and
check_user_mem.

--
Sincerely,
Yeoreum Yun