On Thu, 7 May 2020 09:29:35 +0100
Will Deacon <will@xxxxxxxxxx> wrote:
Hi Will,
> Hi Luke,
>
> Thanks for the patches.
>
> On Wed, May 06, 2020 at 06:05:01PM -0700, Luke Nelson wrote:
> > This patch fixes two issues present in the current function for encoding
> > arm64 logical immediates when using the 32-bit variants of instructions.
> >
> > First, the code does not correctly reject an all-ones 32-bit immediate
> > and returns an undefined instruction encoding, which can crash the kernel.
> > The fix is to add a check for this case.
> >
> > Second, the code incorrectly rejects some 32-bit immediates that are
> > actually encodable as logical immediates. The root cause is that the code
> > uses a default mask of 64-bit all-ones, even for 32-bit immediates. This
> > causes an issue later on when the mask is used to fill the top bits of
> > the immediate with ones, shown here:
> >
> > /*
> > * Pattern: 0..01..10..01..1
> > *
> > * Fill the unused top bits with ones, and check if
> > * the result is a valid immediate (all ones with a
> > * contiguous ranges of zeroes).
> > */
> > imm |= ~mask;
> > if (!range_of_ones(~imm))
> > return AARCH64_BREAK_FAULT;
> >
> > To see the problem, consider an immediate of the form 0..01..10..01..1,
> > where the upper 32 bits are zero, such as 0x80000001. The code checks
> > if ~(imm | ~mask) contains a range of ones: the incorrect mask yields
> > 1..10..01..10..0, which fails the check; the correct mask yields
> > 0..01..10..0, which succeeds.
> >
> > The fix is to use a 32-bit all-ones default mask for 32-bit immediates.
> >
> > Currently, the only user of this function is in
> > arch/arm64/kvm/va_layout.c, which uses 64-bit immediates and won't
> > trigger these bugs.
>
> Ah, so this isn't a fix or a bpf patch ;)
>
> I can queue it via arm64 for 5.8, along with the bpf patches since there
> are some other small changes pending in the arm64 bpf backend for BTI.
>
> > We tested the new code against llvm-mc with all 1,302 encodable 32-bit
> > logical immediates and all 5,334 encodable 64-bit logical immediates.
> >
> > Fixes: ef3935eeebff ("arm64: insn: Add encoder for bitwise operations using literals")
> > Co-developed-by: Xi Wang <xi.wang@xxxxxxxxx>
> > Signed-off-by: Xi Wang <xi.wang@xxxxxxxxx>
> > Signed-off-by: Luke Nelson <luke.r.nels@xxxxxxxxx>
> > ---
> > arch/arm64/kernel/insn.c | 6 ++++--
> > 1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
> > index 4a9e773a177f..42fad79546bb 100644
> > --- a/arch/arm64/kernel/insn.c
> > +++ b/arch/arm64/kernel/insn.c
> > @@ -1535,7 +1535,7 @@ static u32 aarch64_encode_immediate(u64 imm,
> > u32 insn)
> > {
> > unsigned int immr, imms, n, ones, ror, esz, tmp;
> > - u64 mask = ~0UL;
> > + u64 mask;
> >
> > /* Can't encode full zeroes or full ones */
> > if (!imm || !~imm)
>
> It's a bit grotty spreading the checks out now. How about we tweak things
> slightly along the lines of:
>
>
> diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
> index 4a9e773a177f..60ec788eaf33 100644
> --- a/arch/arm64/kernel/insn.c
> +++ b/arch/arm64/kernel/insn.c
> @@ -1535,16 +1535,10 @@ static u32 aarch64_encode_immediate(u64 imm,
> u32 insn)
> {
> unsigned int immr, imms, n, ones, ror, esz, tmp;
> - u64 mask = ~0UL;
> -
> - /* Can't encode full zeroes or full ones */
> - if (!imm || !~imm)
> - return AARCH64_BREAK_FAULT;
> + u64 mask;
>
> switch (variant) {
> case AARCH64_INSN_VARIANT_32BIT:
> - if (upper_32_bits(imm))
> - return AARCH64_BREAK_FAULT;
> esz = 32;
> break;
> case AARCH64_INSN_VARIANT_64BIT:
> @@ -1556,6 +1550,12 @@ static u32 aarch64_encode_immediate(u64 imm,
> return AARCH64_BREAK_FAULT;
> }
>
> + mask = GENMASK(esz - 1, 0);
> +
> + /* Can't encode full zeroes or full ones */
... nor a value wider than the mask.
> + if (imm & ~mask || !imm || imm == mask)
> + return AARCH64_BREAK_FAULT;
> +
> /*
> * Inverse of Replicate(). Try to spot a repeating pattern
> * with a pow2 stride.
>
>
> What do you think?
I'd be pretty happy with that.
Reviewed-by: Marc Zyngier <maz@xxxxxxxxxx>
Thanks,
M.
--
Jazz is not dead. It just smells funny...
