[PATCH] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[PATCH] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Fredrik Strupe]

Use a full 32-bit mask to prevent accidental matchings of thumb32
instructions where the second half-word is equal to the thumb16 setend
encoding.

This fixes the same problem as the following patch:

     https://lkml.org/lkml/2020/3/16/341

but for setend emulation instead.

Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
---
  arch/arm64/kernel/armv8_deprecated.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 9d3442d62..8c06dfee0 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
  	},
  	{
  		/* Thumb mode */
-		.instr_mask	= 0x0000fff7,
+		.instr_mask	= 0xfffffff7,
  		.instr_val	= 0x0000b650,
  		.pstate_mask	= (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
  		.pstate_val	= (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
-- 
2.20.1

Re: [PATCH] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Catalin Marinas]

On Mon, Apr 06, 2020 at 04:16:05PM +0200, Fredrik Strupe wrote:
> Use a full 32-bit mask to prevent accidental matchings of thumb32
> instructions where the second half-word is equal to the thumb16 setend
> encoding.
> 
> This fixes the same problem as the following patch:
> 
>     https://lkml.org/lkml/2020/3/16/341

This link is not guaranteed to be stable and the commit should have the
full description rather than referring to another email.

> but for setend emulation instead.
> 
> Signed-off-by: Fredrik Strupe <fredrik@strupe.net>

It also needs Fixes: and Cc: stable tags.

> ---
>  arch/arm64/kernel/armv8_deprecated.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
> index 9d3442d62..8c06dfee0 100644
> --- a/arch/arm64/kernel/armv8_deprecated.c
> +++ b/arch/arm64/kernel/armv8_deprecated.c
> @@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
>  	},
>  	{
>  		/* Thumb mode */
> -		.instr_mask	= 0x0000fff7,
> +		.instr_mask	= 0xfffffff7,
>  		.instr_val	= 0x0000b650,

I can see how this could happen but it would be useful to provide a
concrete example in the commit log.

The instruction opcode built by call_undef_hook() first reads a u16 as a
T16 instruction and the above should be fine. However, if this looks
like a T32 opcode, it reads a subsequent u16 which becomes the lowest
half-word and the above mask/val may inadvertently match it.

The patch looks fine to me as long as you update the commit log.

Thanks.

-- 
Catalin

Re: [PATCH] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Suzuki K Poulose]

On 04/07/2020 10:27 AM, Catalin Marinas wrote:
> On Mon, Apr 06, 2020 at 04:16:05PM +0200, Fredrik Strupe wrote:
>> Use a full 32-bit mask to prevent accidental matchings of thumb32
>> instructions where the second half-word is equal to the thumb16 setend
>> encoding.
>>
>> This fixes the same problem as the following patch:
>>
>>      https://lkml.org/lkml/2020/3/16/341
> 
> This link is not guaranteed to be stable and the commit should have the
> full description rather than referring to another email.
> 
>> but for setend emulation instead.
>>
>> Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
> 
> It also needs Fixes: and Cc: stable tags.
> 
>> ---
>>   arch/arm64/kernel/armv8_deprecated.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
>> index 9d3442d62..8c06dfee0 100644
>> --- a/arch/arm64/kernel/armv8_deprecated.c
>> +++ b/arch/arm64/kernel/armv8_deprecated.c
>> @@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
>>   	},
>>   	{
>>   		/* Thumb mode */
>> -		.instr_mask	= 0x0000fff7,
>> +		.instr_mask	= 0xfffffff7,
>>   		.instr_val	= 0x0000b650,
> 
> I can see how this could happen but it would be useful to provide a
> concrete example in the commit log.
> 
> The instruction opcode built by call_undef_hook() first reads a u16 as a
> T16 instruction and the above should be fine. However, if this looks
> like a T32 opcode, it reads a subsequent u16 which becomes the lowest
> half-word and the above mask/val may inadvertently match it.
> 

We also do a check on the pstate_val, along with the instr_val to
confirm the mode. So this should be fine as it is ?

Suzuki

Re: [PATCH] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Fredrik Strupe]

On 07.04.2020 12:47, Suzuki K Poulose wrote:

> On 04/07/2020 10:27 AM, Catalin Marinas wrote:
>> On Mon, Apr 06, 2020 at 04:16:05PM +0200, Fredrik Strupe wrote:
>>> Use a full 32-bit mask to prevent accidental matchings of thumb32
>>> instructions where the second half-word is equal to the thumb16 setend
>>> encoding.
>>>
>>> This fixes the same problem as the following patch:
>>>
>>>      https://lkml.org/lkml/2020/3/16/341
>>
>> This link is not guaranteed to be stable and the commit should have the
>> full description rather than referring to another email.
>>
>>> but for setend emulation instead.
>>>
>>> Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
>>
>> It also needs Fixes: and Cc: stable tags.
>>
>>> ---
>>>   arch/arm64/kernel/armv8_deprecated.c | 2 +-
>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/arch/arm64/kernel/armv8_deprecated.c 
>>> b/arch/arm64/kernel/armv8_deprecated.c
>>> index 9d3442d62..8c06dfee0 100644
>>> --- a/arch/arm64/kernel/armv8_deprecated.c
>>> +++ b/arch/arm64/kernel/armv8_deprecated.c
>>> @@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
>>>       },
>>>       {
>>>           /* Thumb mode */
>>> -        .instr_mask    = 0x0000fff7,
>>> +        .instr_mask    = 0xfffffff7,
>>>           .instr_val    = 0x0000b650,
>>
>> I can see how this could happen but it would be useful to provide a
>> concrete example in the commit log.
>>
>> The instruction opcode built by call_undef_hook() first reads a u16 as a
>> T16 instruction and the above should be fine. However, if this looks
>> like a T32 opcode, it reads a subsequent u16 which becomes the lowest
>> half-word and the above mask/val may inadvertently match it.
>>
Thanks for the feedback. I have updated the patch with the requested 
changes.

>
> We also do a check on the pstate_val, along with the instr_val to
> confirm the mode. So this should be fine as it is ?
>
> Suzuki

pstate_val only indicates thumb execution, not whether the current 
instruction
is a T16 or T32 instruction.

Fredrik

--- For thumb instructions, call_undef_hook() in traps.c first reads a 
u16, and if the u16 indicates a T32 instruction (u16 >= 0xe800), a 
second u16 is read, which then makes up the the lower half-word of a T32 
instruction. For T16 instructions, the second u16 is not read, which 
makes the resulting u32 opcode always have the upper half set to 0. 
However, having the upper half of instr_mask in the undef_hook set to 0 
masks out the upper half of all thumb instructions - both T16 and T32. 
This results in trapped T32 instructions with the lower half-word equal 
to the T16 encoding of setend (b650) being matched, even though the 
upper half-word is not 0000 and thus indicates a T32 opcode. An example 
of such a T32 instruction is eaa0b650, which should raise a SIGILL since 
T32 instructions with an eaa prefix are unallocated as per Arm ARM, but 
instead works as a SETEND because the second half-word is set to b650. 
This patch fixes the issue by extending instr_mask to include the upper 
u32 half, which will still match T16 instructions where the upper half 
is 0, but not T32 instructions. Signed-off-by: Fredrik Strupe 
<fredrik@strupe.net> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: 
Will Deacon <will.deacon@arm.com> Fixes: 2d888f48e056 ("arm64: Emulate 
SETEND for AArch32 tasks") --- arch/arm64/kernel/armv8_deprecated.c | 2 
+- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git 
a/arch/arm64/kernel/armv8_deprecated.c 
b/arch/arm64/kernel/armv8_deprecated.c index 9d3442d62..8c06dfee0 100644 
--- a/arch/arm64/kernel/armv8_deprecated.c +++ 
b/arch/arm64/kernel/armv8_deprecated.c @@ -609,7 +609,7 @@ static struct 
undef_hook setend_hooks[] = { }, { /* Thumb mode */ - .instr_mask = 
0x0000fff7, + .instr_mask = 0xfffffff7, .instr_val = 0x0000b650, 
.pstate_mask = (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK), .pstate_val = 
(PSR_AA32_T_BIT | PSR_AA32_MODE_USR), -- 2.20.1

Re: [PATCH] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Fredrik Strupe]

On 07.04.2020 12:47, Suzuki K Poulose wrote:

> On 04/07/2020 10:27 AM, Catalin Marinas wrote:
>> On Mon, Apr 06, 2020 at 04:16:05PM +0200, Fredrik Strupe wrote:
>>> Use a full 32-bit mask to prevent accidental matchings of thumb32
>>> instructions where the second half-word is equal to the thumb16 setend
>>> encoding.
>>>
>>> This fixes the same problem as the following patch:
>>>
>>>      https://lkml.org/lkml/2020/3/16/341
>>
>> This link is not guaranteed to be stable and the commit should have the
>> full description rather than referring to another email.
>>
>>> but for setend emulation instead.
>>>
>>> Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
>>
>> It also needs Fixes: and Cc: stable tags.
>>
>>> ---
>>>   arch/arm64/kernel/armv8_deprecated.c | 2 +-
>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/arch/arm64/kernel/armv8_deprecated.c 
>>> b/arch/arm64/kernel/armv8_deprecated.c
>>> index 9d3442d62..8c06dfee0 100644
>>> --- a/arch/arm64/kernel/armv8_deprecated.c
>>> +++ b/arch/arm64/kernel/armv8_deprecated.c
>>> @@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
>>>       },
>>>       {
>>>           /* Thumb mode */
>>> -        .instr_mask    = 0x0000fff7,
>>> +        .instr_mask    = 0xfffffff7,
>>>           .instr_val    = 0x0000b650,
>>
>> I can see how this could happen but it would be useful to provide a
>> concrete example in the commit log.
>>
>> The instruction opcode built by call_undef_hook() first reads a u16 as a
>> T16 instruction and the above should be fine. However, if this looks
>> like a T32 opcode, it reads a subsequent u16 which becomes the lowest
>> half-word and the above mask/val may inadvertently match it.
>>
>
Thanks for the feedback. I have updated the patch with the requested 
changes.
> We also do a check on the pstate_val, along with the instr_val to
> confirm the mode. So this should be fine as it is ?
>
> Suzuki
pstate_val only indicates thumb execution, not whether the current 
instruction
is a T16 or T32 instruction.

(Sorry for duplicate, something went terribly wrong with the formatting 
of the
previous email.)

Fredrik

---
For thumb instructions, call_undef_hook() in traps.c first reads a u16,
and if the u16 indicates a T32 instruction (u16 >= 0xe800), a second
u16 is read, which then makes up the the lower half-word of a T32
instruction. For T16 instructions, the second u16 is not read,
which makes the resulting u32 opcode always have the upper half set to
0.

However, having the upper half of instr_mask in the undef_hook set to 0
masks out the upper half of all thumb instructions - both T16 and T32.
This results in trapped T32 instructions with the lower half-word equal
to the T16 encoding of setend (b650) being matched, even though the upper
half-word is not 0000 and thus indicates a T32 opcode.

An example of such a T32 instruction is eaa0b650, which should raise a
SIGILL since T32 instructions with an eaa prefix are unallocated as per
Arm ARM, but instead works as a SETEND because the second half-word is set
to b650.

This patch fixes the issue by extending instr_mask to include the
upper u32 half, which will still match T16 instructions where the upper
half is 0, but not T32 instructions.

Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Fixes: 2d888f48e056 ("arm64: Emulate SETEND for AArch32 tasks")
---
  arch/arm64/kernel/armv8_deprecated.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/armv8_deprecated.c 
b/arch/arm64/kernel/armv8_deprecated.c
index 9d3442d62..8c06dfee0 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
      },
      {
          /* Thumb mode */
-        .instr_mask    = 0x0000fff7,
+        .instr_mask    = 0xfffffff7,
          .instr_val    = 0x0000b650,
          .pstate_mask    = (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
          .pstate_val    = (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
-- 
2.20.1

Re: [PATCH] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Catalin Marinas]

On Tue, Apr 07, 2020 at 01:18:21PM +0200, Fredrik Strupe wrote:
> (Sorry for duplicate, something went terribly wrong with the formatting of
> the previous email.)

It's still wrong here with tabs converted to spaces. The patch doesn't
apply. Could you please send the patch separately as a v2? It looks fine
otherwise.

Thanks.

-- 
Catalin

Re: [PATCH] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Fredrik Strupe]

On 08.04.2020 11:01, Catalin Marinas wrote:
> On Tue, Apr 07, 2020 at 01:18:21PM +0200, Fredrik Strupe wrote:
>> (Sorry for duplicate, something went terribly wrong with the formatting of
>> the previous email.)
>
> It's still wrong here with tabs converted to spaces. The patch doesn't
> apply. Could you please send the patch separately as a v2? It looks fine
> otherwise.
>
> Thanks.
>

Alright, let's hope third time's the charm.

Fredrik

---
For thumb instructions, call_undef_hook() in traps.c first reads a u16,
and if the u16 indicates a T32 instruction (u16 >= 0xe800), a second
u16 is read, which then makes up the the lower half-word of a T32
instruction. For T16 instructions, the second u16 is not read,
which makes the resulting u32 opcode always have the upper half set to
0.

However, having the upper half of instr_mask in the undef_hook set to 0
masks out the upper half of all thumb instructions - both T16 and T32.
This results in trapped T32 instructions with the lower half-word equal
to the T16 encoding of setend (b650) being matched, even though the upper
half-word is not 0000 and thus indicates a T32 opcode.

An example of such a T32 instruction is eaa0b650, which should raise a
SIGILL since T32 instructions with an eaa prefix are unallocated as per
Arm ARM, but instead works as a SETEND because the second half-word is set
to b650.

This patch fixes the issue by extending instr_mask to include the
upper u32 half, which will still match T16 instructions where the upper
half is 0, but not T32 instructions.

Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Fixes: 2d888f48e056 ("arm64: Emulate SETEND for AArch32 tasks")
---
 arch/arm64/kernel/armv8_deprecated.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 9d3442d62..8c06dfee0 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
 	},
 	{
 		/* Thumb mode */
-		.instr_mask	= 0x0000fff7,
+		.instr_mask	= 0xfffffff7,
 		.instr_val	= 0x0000b650,
 		.pstate_mask	= (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
 		.pstate_val	= (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
-- 
2.20.1

[PATCH v2] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Fredrik Strupe]

For thumb instructions, call_undef_hook() in traps.c first reads a u16,
and if the u16 indicates a T32 instruction (u16 >= 0xe800), a second
u16 is read, which then makes up the the lower half-word of a T32
instruction. For T16 instructions, the second u16 is not read,
which makes the resulting u32 opcode always have the upper half set to
0.

However, having the upper half of instr_mask in the undef_hook set to 0
masks out the upper half of all thumb instructions - both T16 and T32.
This results in trapped T32 instructions with the lower half-word equal
to the T16 encoding of setend (b650) being matched, even though the upper
half-word is not 0000 and thus indicates a T32 opcode.

An example of such a T32 instruction is eaa0b650, which should raise a
SIGILL since T32 instructions with an eaa prefix are unallocated as per
Arm ARM, but instead works as a SETEND because the second half-word is set
to b650.

This patch fixes the issue by extending instr_mask to include the
upper u32 half, which will still match T16 instructions where the upper
half is 0, but not T32 instructions.

Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Fixes: 2d888f48e056 ("arm64: Emulate SETEND for AArch32 tasks")
---
 arch/arm64/kernel/armv8_deprecated.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 9d3442d62..8c06dfee0 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
 	},
 	{
 		/* Thumb mode */
-		.instr_mask	= 0x0000fff7,
+		.instr_mask	= 0xfffffff7,
 		.instr_val	= 0x0000b650,
 		.pstate_mask	= (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
 		.pstate_val	= (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
-- 
2.20.1

Re: [PATCH v2] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Suzuki K Poulose]

On 04/08/2020 12:29 PM, Fredrik Strupe wrote:
> For thumb instructions, call_undef_hook() in traps.c first reads a u16,
> and if the u16 indicates a T32 instruction (u16 >= 0xe800), a second
> u16 is read, which then makes up the the lower half-word of a T32
> instruction. For T16 instructions, the second u16 is not read,
> which makes the resulting u32 opcode always have the upper half set to
> 0.
> 
> However, having the upper half of instr_mask in the undef_hook set to 0
> masks out the upper half of all thumb instructions - both T16 and T32.
> This results in trapped T32 instructions with the lower half-word equal
> to the T16 encoding of setend (b650) being matched, even though the upper
> half-word is not 0000 and thus indicates a T32 opcode.
> 
> An example of such a T32 instruction is eaa0b650, which should raise a
> SIGILL since T32 instructions with an eaa prefix are unallocated as per
> Arm ARM, but instead works as a SETEND because the second half-word is set
> to b650.
> 
> This patch fixes the issue by extending instr_mask to include the
> upper u32 half, which will still match T16 instructions where the upper
> half is 0, but not T32 instructions.
> 
> Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Will Deacon <will.deacon@arm.com>
> Fixes: 2d888f48e056 ("arm64: Emulate SETEND for AArch32 tasks")
> ---
>   arch/arm64/kernel/armv8_deprecated.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
> index 9d3442d62..8c06dfee0 100644
> --- a/arch/arm64/kernel/armv8_deprecated.c
> +++ b/arch/arm64/kernel/armv8_deprecated.c
> @@ -609,7 +609,7 @@ static struct undef_hook setend_hooks[] = {
>   	},
>   	{
>   		/* Thumb mode */
> -		.instr_mask	= 0x0000fff7,
> +		.instr_mask	= 0xfffffff7,
>   		.instr_val	= 0x0000b650,
>   		.pstate_mask	= (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
>   		.pstate_val	= (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
> 

Reviewed-by : Suzuki K Poulose <suzuki.poulose@arm.com>

Re: [PATCH v2] arm64: armv8_deprecated: Fix undef_hook mask for thumb setend

[Catalin Marinas]

On Wed, Apr 08, 2020 at 01:29:41PM +0200, Fredrik Strupe wrote:
> For thumb instructions, call_undef_hook() in traps.c first reads a u16,
> and if the u16 indicates a T32 instruction (u16 >= 0xe800), a second
> u16 is read, which then makes up the the lower half-word of a T32
> instruction. For T16 instructions, the second u16 is not read,
> which makes the resulting u32 opcode always have the upper half set to
> 0.
> 
> However, having the upper half of instr_mask in the undef_hook set to 0
> masks out the upper half of all thumb instructions - both T16 and T32.
> This results in trapped T32 instructions with the lower half-word equal
> to the T16 encoding of setend (b650) being matched, even though the upper
> half-word is not 0000 and thus indicates a T32 opcode.
> 
> An example of such a T32 instruction is eaa0b650, which should raise a
> SIGILL since T32 instructions with an eaa prefix are unallocated as per
> Arm ARM, but instead works as a SETEND because the second half-word is set
> to b650.
> 
> This patch fixes the issue by extending instr_mask to include the
> upper u32 half, which will still match T16 instructions where the upper
> half is 0, but not T32 instructions.
> 
> Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Will Deacon <will.deacon@arm.com>
> Fixes: 2d888f48e056 ("arm64: Emulate SETEND for AArch32 tasks")

Queued for 5.7. Thanks.

-- 
Catalin