From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72E03C63777 for ; Thu, 3 Dec 2020 10:26:38 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id AF39121D1A for ; Thu, 3 Dec 2020 10:26:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AF39121D1A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 27B086B005D; Thu, 3 Dec 2020 05:26:37 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 22A5B6B0068; Thu, 3 Dec 2020 05:26:37 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 119A46B006C; Thu, 3 Dec 2020 05:26:37 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0024.hostedemail.com [216.40.44.24]) by kanga.kvack.org (Postfix) with ESMTP id F09246B005D for ; Thu, 3 Dec 2020 05:26:36 -0500 (EST) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id BC1DD1EE6 for ; Thu, 3 Dec 2020 10:26:36 +0000 (UTC) X-FDA: 77551591992.26.net56_37141c6273bb Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin26.hostedemail.com (Postfix) with ESMTP id 9D9DB1804B661 for ; Thu, 3 Dec 2020 10:26:36 +0000 (UTC) X-HE-Tag: net56_37141c6273bb X-Filterd-Recvd-Size: 4936 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf43.hostedemail.com (Postfix) with ESMTP for ; Thu, 3 Dec 2020 10:26:36 +0000 (UTC) Date: Thu, 3 Dec 2020 10:26:29 +0000 From: Catalin Marinas To: Andrey Konovalov Cc: Andrew Morton , Will Deacon , Vincenzo Frascino , Dmitry Vyukov , Andrey Ryabinin , Alexander Potapenko , Marco Elver , Evgenii Stepanov , Branislav Rankov , Kevin Brodsky , kasan-dev@googlegroups.com, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Mark Rutland Subject: Re: [PATCH mm v11 27/42] arm64: mte: Add in-kernel tag fault handler Message-ID: <20201203102628.GB2224@gaia> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Nov 23, 2020 at 09:07:51PM +0100, Andrey Konovalov wrote: > diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h > index 385a189f7d39..d841a560fae7 100644 > --- a/arch/arm64/include/asm/uaccess.h > +++ b/arch/arm64/include/asm/uaccess.h > @@ -200,13 +200,36 @@ do { \ > CONFIG_ARM64_PAN)); \ > } while (0) > > +/* > + * The Tag Check Flag (TCF) mode for MTE is per EL, hence TCF0 > + * affects EL0 and TCF affects EL1 irrespective of which TTBR is > + * used. > + * The kernel accesses TTBR0 usually with LDTR/STTR instructions > + * when UAO is available, so these would act as EL0 accesses using > + * TCF0. > + * However futex.h code uses exclusives which would be executed as > + * EL1, this can potentially cause a tag check fault even if the > + * user disables TCF0. > + * > + * To address the problem we set the PSTATE.TCO bit in uaccess_enable() > + * and reset it in uaccess_disable(). > + * > + * The Tag check override (TCO) bit disables temporarily the tag checking > + * preventing the issue. > + */ > static inline void uaccess_disable(void) > { > + asm volatile(ALTERNATIVE("nop", SET_PSTATE_TCO(0), > + ARM64_MTE, CONFIG_KASAN_HW_TAGS)); > + > __uaccess_disable(ARM64_HAS_PAN); > } > > static inline void uaccess_enable(void) > { > + asm volatile(ALTERNATIVE("nop", SET_PSTATE_TCO(1), > + ARM64_MTE, CONFIG_KASAN_HW_TAGS)); > + > __uaccess_enable(ARM64_HAS_PAN); > } I think that's insufficient if CONFIG_ARM64_PAN is disabled. In the !PAN case, the get/put_user() accessors use standard LDR/STR instructions which would follow the TCF rather than TCF0 mode checking. However, they don't use the above uaccess_disable/enable() functions. The current user space support is affected as well but luckily we just skip tag checking on the uaccess routines if !PAN since the kernel TCF is 0. With the in-kernel MTE, TCF may be more strict than TCF0. My suggestion is to simply make CONFIG_ARM64_MTE depend on (or select) PAN. Architecturally this should work since PAN is required for ARMv8.1, so present with any MTE implementation. This patch is on top of -next, though it has a Fixes tag in 5.10: --------------------------8<--------------------------- >From ecc819804c1fb1ad498d7ced07e01e3b3e055a3f Mon Sep 17 00:00:00 2001 From: Catalin Marinas Date: Thu, 3 Dec 2020 10:15:39 +0000 Subject: [PATCH] arm64: mte: Ensure CONFIG_ARM64_PAN is enabled with MTE The uaccess routines like get/put_user() rely on the user TCF0 mode setting for tag checking. However, if CONFIG_ARM64_PAN is disabled, these routines would use the standard LDR/STR instructions and therefore the kernel TCF mode. In 5.10, the kernel TCF==0, so no tag checking, but this will change with the in-kernel MTE support. Make ARM64_MTE depend on ARM64_PAN. Fixes: 89b94df9dfb1 ("arm64: mte: Kconfig entry") Signed-off-by: Catalin Marinas --- arch/arm64/Kconfig | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 844d62df776c..f9eed3a5917e 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1673,6 +1673,8 @@ config ARM64_MTE default y depends on ARM64_AS_HAS_MTE && ARM64_TAGGED_ADDR_ABI depends on AS_HAS_ARMV8_5 + # Required for tag checking in the uaccess routines + depends on ARM64_PAN select ARCH_USES_HIGH_VMA_FLAGS help Memory Tagging (part of the ARMv8.5 Extensions) provides