The MTE selftests assume that they can skip (expected) MTE faults by advancing the PC by 4 in mte_default_handler(), but this is not generally safe, as the faults are triggered from arbitrary library functions (e.g. memset() and memcpy()). For instance, memset() could be implemented as simple as:
mov x3, x0 // copy pointer add x4, x0, x2 // calculate end loop: strb w1, [x3], #1 // faulting access cmp x3, x4 b.ne loop ret which leads to an infinite loop since X3 could not be updated. Or, it could be having advanced implementation (FEAT_MOPS): mov x3, x0 // copy pointer setp [x3]!, x2!, x1 // prologue setm [x3]!, x2!, x1 // main sete [x3]!, x2!, x1 // epilogue ret with faulting access at prologue advancing PC to main could lead to infinite loop due to main could be triggering unaligned access fault which kernel fixing up by advancing PC back to prologue. Instead of relying on arbitrary implementations of library functions introduce helpers to perform the faulting accesses, where those faults can safely be handled. Signed-off-by: Vladimir Murzin <[email protected]> --- .../selftests/arm64/mte/mte_common_util.h | 4 ++ .../testing/selftests/arm64/mte/mte_helper.S | 44 +++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/tools/testing/selftests/arm64/mte/mte_common_util.h b/tools/testing/selftests/arm64/mte/mte_common_util.h index 250d671329a5..547ec5659f78 100644 --- a/tools/testing/selftests/arm64/mte/mte_common_util.h +++ b/tools/testing/selftests/arm64/mte/mte_common_util.h @@ -64,6 +64,10 @@ void mte_restore_setup(void); int mte_switch_mode(int mte_option, unsigned long incl_mask, bool stonly); void mte_initialize_current_context(int mode, uintptr_t ptr, ssize_t range); +/* Safe memory access functions */ +void *memset_safe(void *s, int c, size_t n); +void *memcpy_safe(void *dest, const void *src, size_t n); + /* Common utility functions */ int create_temp_file(void); diff --git a/tools/testing/selftests/arm64/mte/mte_helper.S b/tools/testing/selftests/arm64/mte/mte_helper.S index a55dbbc56ed1..eb62abfa1eb4 100644 --- a/tools/testing/selftests/arm64/mte/mte_helper.S +++ b/tools/testing/selftests/arm64/mte/mte_helper.S @@ -128,3 +128,47 @@ ENTRY(mte_get_pstate_tco) ubfx x0, x0, #MT_PSTATE_TCO_SHIFT, #1 ret ENDPROC(mte_get_pstate_tco) + +/* + * memset_safe: Fill memory with a constant byte + * Input: + * x0 - destination pointer + * x1 - constant byte + * x2 - number of bytes to fill + * Return: + * x0 - original destination pointer + */ +ENTRY(memset_safe) + cbz x2, 2f + add x4, x2, x0 + mov x3, x0 +1: + strb w1, [x3] + add x3, x3, #0x1 + cmp x3, x4 + b.ne 1b +2: + ret +ENDPROC(memset_safe) + +/* + * memcpy_safe: Copy memory area + * Input: + * x0 - destination pointer + * x1 - source pointer + * x2 - number of bytes to copy + * Return: + * x0 - destination pointer + */ +ENTRY(memcpy_safe) + cbz x2, 2f + mov x3, #0x0 +1: + ldrb w4, [x1, x3] + strb w4, [x0, x3] + add x3, x3, #0x1 + cmp x3, x2 + b.ne 1b +2: + ret +ENDPROC(memcpy_safe) -- 2.34.1
