linux-kernel - Re: [PATCH v2 2/2] arm64: mte: Set TCMA1 whenever MTE is present in the kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aXIOu2_ZvNXyl1SJ@arm.com>
Date: Thu, 22 Jan 2026 11:49:15 +0000
From: Catalin Marinas <catalin.marinas@....com>
To: Usama Anjum <usama.anjum@...s.arm.com>
Cc: Carl Worth <carl@...amperecomputing.com>, Will Deacon <will@...nel.org>,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
	Taehyun Noh <taehyun@...xas.edu>,
	Peter Collingbourne <pcc@...gle.com>
Subject: Re: [PATCH v2 2/2] arm64: mte: Set TCMA1 whenever MTE is present in
 the kernel

On Thu, Jan 22, 2026 at 10:23:01AM +0000, Usama Anjum wrote:
> On 15/01/2026 11:07 pm, Carl Worth wrote:
> > Set the TCMA1 bit so that access to TTBR1 addresses with 0xf in their
> > tag bits will be treated as tag unchecked.
> > 
> > This is important to avoid unwanted tag checking on some
> > systems. Specifically, SCTLR_EL1.TCF can be set to indicate that no
> > tag check faults are desired. But the architecture doesn't guarantee
> > that in this case the system won't still perform tag checks.
> > 
> > Use TCMA1 to ensure that undesired tag checks are not performed. This
> > bit was already set in the KASAN case. Adding it to the non-KASAN case
> > prevents tag checking since all TTBR1 address will have a value of 0xf
> > in their tag bits.
> > 
> > This patch has been measured on an Ampere system to improve the following:
> > 
> > * Eliminate over 98% of kernel-side tag checks during "perf bench
> >    futex hash", as measured with "perf stat".
> > 
> > * Eliminate all MTE overhead (was previously a 25% performance
> >    penalty) from the Phoronix pts/memcached benchmark (1:10 Set:Get
> >    ration with 96 cores).
> > 
> > Reported-by: Taehyun Noh <taehyun@...xas.edu>
> > Suggested-by: Catalin Marinas <catalin.marinas@....com>
> > Signed-off-by: Carl Worth <carl@...amperecomputing.com>
> 
> Fixes tag is required here so that the fix traverses to the stable kernels.
> I've not found the most appropriate commit:
> 
> 973b9e373306 ("arm64: mte: move register initialization to C")
> bfc62c598527 ("arm64: kasan: allow enabling in-kernel MTE")
> 
> In my opinion, bfc62c598527 should be in the fixes-by tag. At a minimum, the
> back porting should be done till 973b9e373306.

We can always submit it for stable backports even without a fixes tag.
It's more of a hardware implementation choice than actually fixing a
kernel bug. The previous behaviour was also correct.

-- 
Catalin