From abc2c3ab9792992fa5f24af260eb8a1e7c52b39d Mon Sep 17 00:00:00 2001
From: Peter Collingbourne <pcc@google.com>
Date: Mon, 2 Nov 2020 13:35:28 -0800
Subject: [PATCH] Change the android_mallopt(M_SET_HEAP_TAGGING_LEVEL) API.

- Make it apply to every thread, and thus remove the restriction
  that it must be called while the program is single threaded.
- Make it change TCF0 itself (on all threads), instead of requiring
  callers to do it themselves, which can be error prone.

And update all of the call sites.

Change the implementation of
android_mallopt(M_DISABLE_MEMORY_MITIGATIONS) to call
android_mallopt(M_SET_HEAP_TAGGING_LEVEL) internally. This avoids
crashes during startup that were observed when the two mallopts
updated TCF0 unaware of each other.

I wouldn't expect there to be any out-of-tree callers at this point,
but it's worth noting that the new interface is backwards compatible
with the old one because it strictly expands the set of situations in
which the API can be used (i.e. situations where there are multiple
threads running or where TCF0 hadn't been updated beforehand).

Bug: 135772972
Change-Id: I7746707898ff31ef2e0af01c4f55ba90b72bef51
---
 core/jni/com_android_internal_os_Zygote.cpp | 33 +--------------------
 1 file changed, 1 insertion(+), 32 deletions(-)

diff --git a/core/jni/com_android_internal_os_Zygote.cpp b/core/jni/com_android_internal_os_Zygote.cpp
index 70c2afb74c721..6381cf59380aa 100644
--- a/core/jni/com_android_internal_os_Zygote.cpp
+++ b/core/jni/com_android_internal_os_Zygote.cpp
@@ -78,7 +78,6 @@
 #include <android-base/unique_fd.h>
 #include <bionic/malloc.h>
 #include <bionic/mte.h>
-#include <bionic/mte_kernel.h>
 #include <cutils/fs.h>
 #include <cutils/memory.h>
 #include <cutils/multiuser.h>
@@ -1676,28 +1675,6 @@ static void BindMountStorageDirs(JNIEnv* env, jobjectArray pkg_data_info_list,
   }
 }
 
-#ifdef ANDROID_EXPERIMENTAL_MTE
-static void SetTagCheckingLevel(int level) {
-#ifdef __aarch64__
-  if (!(getauxval(AT_HWCAP2) & HWCAP2_MTE)) {
-    return;
-  }
-
-  int tagged_addr_ctrl = prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0);
-  if (tagged_addr_ctrl < 0) {
-    ALOGE("prctl(PR_GET_TAGGED_ADDR_CTRL) failed: %s", strerror(errno));
-    return;
-  }
-
-  tagged_addr_ctrl = (tagged_addr_ctrl & ~PR_MTE_TCF_MASK) | level;
-  if (prctl(PR_SET_TAGGED_ADDR_CTRL, tagged_addr_ctrl, 0, 0, 0) < 0) {
-    ALOGE("prctl(PR_SET_TAGGED_ADDR_CTRL, %d) failed: %s", tagged_addr_ctrl,
-          strerror(errno));
-  }
-#endif
-}
-#endif
-
 // Utility routine to specialize a zygote child process.
 static void SpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray gids,
                              jint runtime_flags, jobjectArray rlimits,
@@ -1833,22 +1810,14 @@ static void SpecializeCommon(JNIEnv* env, uid_t uid, gid_t gid, jintArray gids,
       heap_tagging_level = M_HEAP_TAGGING_LEVEL_TBI;
       break;
     case RuntimeFlags::MEMORY_TAG_LEVEL_ASYNC:
-#ifdef ANDROID_EXPERIMENTAL_MTE
-      SetTagCheckingLevel(PR_MTE_TCF_ASYNC);
-#endif
       heap_tagging_level = M_HEAP_TAGGING_LEVEL_ASYNC;
       break;
     case RuntimeFlags::MEMORY_TAG_LEVEL_SYNC:
-#ifdef ANDROID_EXPERIMENTAL_MTE
-      SetTagCheckingLevel(PR_MTE_TCF_SYNC);
-#endif
       heap_tagging_level = M_HEAP_TAGGING_LEVEL_SYNC;
       break;
     default:
-#ifdef ANDROID_EXPERIMENTAL_MTE
-      SetTagCheckingLevel(PR_MTE_TCF_NONE);
-#endif
       heap_tagging_level = M_HEAP_TAGGING_LEVEL_NONE;
+      break;
   }
   android_mallopt(M_SET_HEAP_TAGGING_LEVEL, &heap_tagging_level, sizeof(heap_tagging_level));
   // Now that we've used the flag, clear it so that we don't pass unknown flags to the ART runtime.