linux-kernel - Re: [PATCH v2] ARM: Add a memory clobber to the fmrx instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMj1kXH=f4tS2wwgG2a8fz2eUZzATU_Hi4n82MmrOu8Aexux0A@mail.gmail.com>
Date: Thu, 11 Apr 2024 09:02:15 +0200
From: Ard Biesheuvel <ardb@...nel.org>
To: Nathan Chancellor <nathan@...nel.org>
Cc: zhuqiuer <zhuqiuer1@...wei.com>, justinstitt@...gle.com, 
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org, 
	linux@...linux.org.uk, llvm@...ts.linux.dev, morbo@...gle.com, 
	ndesaulniers@...gle.com
Subject: Re: [PATCH v2] ARM: Add a memory clobber to the fmrx instruction

On Wed, 10 Apr 2024 at 17:35, Nathan Chancellor <nathan@...nel.org> wrote:
>
> On Wed, Apr 10, 2024 at 02:31:11PM +0200, Ard Biesheuvel wrote:
> > On Wed, 10 Apr 2024 at 04:41, zhuqiuer <zhuqiuer1@...wei.com> wrote:
> > >
> > > The instruction fmrx is used throughout the kernel,
> > > where it is sometimes expected to be skipped
> > > by incrementing the program counter, such as in vfpmodule.c:vfp_init().
> > > Therefore, the instruction should not be reordered when it is not intended.
> > > Adding a barrier() instruction before and after this call cannot prevent
> > > reordering by the compiler, as the fmrx instruction is constrained
> > > by '=r', meaning it works on the general register but not on memory.
> > > To ensure the order of the instruction after compiling,
> > > adding a memory clobber is necessary.
> > >
> > > Below is the code snippet disassembled from the method:
> > > vfpmodule.c:vfp_init(), compiled by LLVM.
> > >
> > > Before the patching:
> > > xxxxx:   xxxxx    bl  c010c688 <register_undef_hook>
> > > xxxxx:   xxxxx    mov r0, r4
> > > xxxxx:   xxxxx    bl  c010c6e4 <unregister_undef_hook>
> > > ...
> > > xxxxx:   xxxxx    bl  c0791c8c <printk>
> > > xxxxx:   xxxxx    movw    r5, #23132  ; 0x5a5c
> > > xxxxx:   xxxxx    vmrs    r4, fpsid  <- this is the fmrx instruction
> > >
> > > After the patching:
> > > xxxxx:   xxxxx    bl  c010c688 <register_undef_hook>
> > > xxxxx:   xxxxx    mov r0, r4
> > > xxxxx:   xxxxx    vmrs    r5, fpsid  <- this is the fmrx instruction
> > > xxxxx:   xxxxx    bl  c010c6e4 <unregister_undef_hook>
> > >
> > > Signed-off-by: zhuqiuer <zhuqiuer1@...wei.com>
> >
> > This also fixes the issue I observed so
> >
> > Reviewed-by: Ard Biesheuvel <ardb@...nel.org>
>
> Reviewed-by: Nathan Chancellor <nathan@...nel.org>
>
> This can probably go in Russell's patch tracker?

Yes.

> Your patch had
>
> Cc: stable@...r.kernel.org
>
> in it, should this one as well?
>

Yes.


> > > ---
> > >  arch/arm/vfp/vfpinstr.h | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/arch/arm/vfp/vfpinstr.h b/arch/arm/vfp/vfpinstr.h
> > > index 3c7938fd40aa..ae2c9b9b7701 100644
> > > --- a/arch/arm/vfp/vfpinstr.h
> > > +++ b/arch/arm/vfp/vfpinstr.h
> > > @@ -68,14 +68,14 @@
> > >         u32 __v;                        \
> > >         asm(".fpu       vfpv2\n"        \
> > >             "vmrs       %0, " #_vfp_    \
> > > -           : "=r" (__v) : : "cc");     \
> > > +           : "=r" (__v) : : "memory", "cc");   \
> > >         __v;                            \
> > >   })
> > >
> > >  #define fmxr(_vfp_,_var_)              \
> > >         asm(".fpu       vfpv2\n"        \
> > >             "vmsr       " #_vfp_ ", %0" \
> > > -          : : "r" (_var_) : "cc")
> > > +          : : "r" (_var_) : "memory", "cc")
> > >
> > >  #else
> > >
> > > --
> > > 2.12.3
> > >