From: Szabolcs Nagy <Szabolcs.Nagy@arm.com>
To: Catalin Marinas <Catalin.Marinas@arm.com>
Cc: Mark Rutland <Mark.Rutland@arm.com>,
Kate Stewart <kstewart@linuxfoundation.org>,
"open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
Will Deacon <Will.Deacon@arm.com>,
Linux Memory Management List <linux-mm@kvack.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@vger.kernel.org>,
Chintan Pandya <cpandya@codeaurora.org>,
Vincenzo Frascino <Vincenzo.Frascino@arm.com>,
Shuah Khan <shuah@kernel.org>, Ingo Molnar <mingo@kernel.org>,
linux-arch <linux-arch@vger.kernel.org>,
Jacob Bramley <Jacob.Bramley@arm.com>,
Linux ARM <linux-arm-kernel@lists.infradead.org>,
Ramana Radhakrishnan <Ramana.Radhakrishnan@arm.com>,
Dave P Martin <Dave.Martin@arm.com>,
Evgenii Stepanov <eugenis@google.com>,
Kees Cook <keescook@chromium.org>,
Ruben Ayrapetyan <Ruben.Ayrapetyan@arm.com>,
Andrey Konovalov <andreyknvl@google.com>,
Kevin Brodsky <Kevin.Brodsky@arm.com>,
Alexander Viro <viro@zeniv.linux.org.uk>, nd <nd@arm.com>,
Dmitry Vyukov <dvyukov@google.com>,
Kostya Serebryany <kcc@google.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
LKML <linux-kernel@vger.kernel.org>,
Luc Van Oostenryck <luc.vanoostenryck@gmail.com>,
Lee Smith <Lee.Smith@arm.com>,
Andrew Morton <akpm@linux-foundation.org>,
Robin Murphy <Robin.Murphy@arm.com>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Subject: Re: [RFC][PATCH 0/3] arm64 relaxed ABI
Date: Mon, 25 Feb 2019 18:02:50 +0000 [thread overview]
Message-ID: <7afa18b8-f135-036d-943c-b6216e7da481@arm.com> (raw)
In-Reply-To: <20190225165720.GA79300@arrakis.emea.arm.com>
On 25/02/2019 16:57, Catalin Marinas wrote:
> On Tue, Feb 19, 2019 at 06:38:31PM +0000, Szabolcs Nagy wrote:
>> i think these rules work for the cases i care about, a more
>> tricky question is when/how to check for the new syscall abi
>> and when/how the TCR_EL1.TBI0 setting may be turned off.
>
> I don't think turning TBI0 off is critical (it's handy for PAC with
> 52-bit VA but then it's short-lived if you want more security features
> like MTE).
yes, i made a mistake assuming TBI0 off is
required for (or at least compatible with) MTE.
if TBI0 needs to be on for MTE then some of my
analysis is wrong, and i expect TBI0 to be on
in the foreseeable future.
>> consider the following cases (tb == top byte):
>>
>> binary 1: user tb = any, syscall tb = 0
>> tbi is on, "legacy binary"
>>
>> binary 2: user tb = any, syscall tb = any
>> tbi is on, "new binary using tb"
>> for backward compat it needs to check for new syscall abi.
>>
>> binary 3: user tb = 0, syscall tb = 0
>> tbi can be off, "new binary",
>> binary is marked to indicate unused tb,
>> kernel may turn tbi off: additional pac bits.
>>
>> binary 4: user tb = mte, syscall tb = mte
>> like binary 3, but with mte, "new binary using mte"
so this should be "like binary 2, but with mte".
>> does it have to check for new syscall abi?
>> or MTE HWCAP would imply it?
>> (is it possible to use mte without new syscall abi?)
>
> I think MTE HWCAP should imply it.
>
>> in userspace we want most binaries to be like binary 3 and 4
>> eventually, i.e. marked as not-relying-on-tbi, if a dso is
>> loaded that is unmarked (legacy or new tb user), then either
>> the load fails (e.g. if mte is already used? or can we turn
>> mte off at runtime?) or tbi has to be enabled (prctl? does
>> this work with pac? or multi-threads?).
>
> We could enable it via prctl. That's the plan for MTE as well (in
> addition maybe to some ELF flag).
>
>> as for checking the new syscall abi: i don't see much semantic
>> difference between AT_HWCAP and AT_FLAGS (either way, the user
>> has to check a feature flag before using the feature of the
>> underlying system and it does not matter much if it's a syscall
>> abi feature or cpu feature), but i don't see anything wrong
>> with AT_FLAGS if the kernel prefers that.
>
> The AT_FLAGS is aimed at capturing binary 2 case above, i.e. the
> relaxation of the syscall ABI to accept tb = any. The MTE support will
> have its own AT_HWCAP, likely in addition to AT_FLAGS. Arguably,
> AT_FLAGS is either redundant here if MTE implies it (and no harm in
> keeping it around) or the meaning is different: a tb != 0 may be checked
> by the kernel against the allocation tag (i.e. get_user() could fail,
> the tag is not entirely ignored).
>
>> the discussion here was mostly about binary 2,
>
> That's because passing tb != 0 into the syscall ABI is the main blocker
> here that needs clearing out before merging the MTE support. There is,
> of course, a variation of binary 1 for MTE:
>
> binary 5: user tb = mte, syscall tb = 0
>
> but this requires a lot of C lib changes to support properly.
yes, i don't think we want to do that.
but it's ok to have both syscall tbi AT_FLAGS and MTE HWCAP.
>> but for
>> me the open question is if we can make binary 3/4 work.
>> (which requires some elf binary marking, that is recognised
>> by the kernel and dynamic loader, and efficient handling of
>> the TBI0 bit, ..if it's not possible, then i don't see how
>> mte will be deployed).
>
> If we ignore binary 3, we can keep TBI0 = 1 permanently, whether we have
> MTE or not.
>
>> and i guess on the kernel side the open question is if the
>> rules 1/2/3/4 can be made to work in corner cases e.g. when
>> pointers embedded into structs are passed down in ioctl.
>
> We've been trying to track these down since last summer and we came to
> the conclusion that it should be (mostly) fine for the non-weird memory
> described above.
i think an interesting case is when userspace passes
a pointer to the kernel and later gets it back,
which is why i proposed rule 4 (kernel has to keep
the tag then).
but i wonder what's the right thing to do for sp
(user can malloc thread/sigalt/makecontext stack
which will be mte tagged in practice with mte on)
does tagged sp work? should userspace untag the
stack memory before setting it up as a stack?
(but then user pointers to that allocation may get
broken..)
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2019-02-25 18:03 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-10 12:50 [PATCH v9 0/8] arm64: untag user pointers passed to the kernel Andrey Konovalov
2018-12-10 12:50 ` [PATCH v9 1/8] arm64: add type casts to untagged_addr macro Andrey Konovalov
2018-12-10 12:50 ` [PATCH v9 2/8] uaccess: add untagged_addr definition for other arches Andrey Konovalov
2018-12-10 12:51 ` [PATCH v9 3/8] arm64: untag user addresses in access_ok and __uaccess_mask_ptr Andrey Konovalov
2018-12-10 12:51 ` [PATCH v9 4/8] mm, arm64: untag user addresses in mm/gup.c Andrey Konovalov
2018-12-10 12:51 ` [PATCH v9 5/8] lib, arm64: untag addrs passed to strncpy_from_user and strnlen_user Andrey Konovalov
2018-12-10 12:51 ` [PATCH v9 6/8] fs, arm64: untag user address in copy_mount_options Andrey Konovalov
2018-12-10 12:51 ` [PATCH v9 7/8] arm64: update Documentation/arm64/tagged-pointers.txt Andrey Konovalov
2018-12-10 12:51 ` [PATCH v9 8/8] selftests, arm64: add a selftest for passing tagged pointers to kernel Andrey Konovalov
2018-12-10 14:30 ` [RFC][PATCH 0/3] arm64 relaxed ABI Vincenzo Frascino
2018-12-10 14:30 ` [RFC][PATCH 1/3] elf: Make AT_FLAGS arch configurable Vincenzo Frascino
2018-12-10 14:30 ` [RFC][PATCH 2/3] arm64: Define Documentation/arm64/elf_at_flags.txt Vincenzo Frascino
2018-12-12 17:34 ` Dave Martin
2019-01-09 13:05 ` Vincenzo Frascino
2018-12-10 14:30 ` [RFC][PATCH 3/3] arm64: elf: Advertise relaxed ABI Vincenzo Frascino
2018-12-12 14:23 ` [RFC][PATCH 0/3] arm64 " Andrey Konovalov
2018-12-12 15:02 ` Catalin Marinas
2018-12-18 15:03 ` Andrey Konovalov
2018-12-18 17:59 ` Catalin Marinas
2018-12-19 12:52 ` Dave Martin
2019-02-11 17:28 ` Kevin Brodsky
2019-02-11 20:32 ` Evgenii Stepanov
2019-02-12 18:02 ` Catalin Marinas
2019-02-13 14:58 ` Dave Martin
2019-02-13 16:42 ` Kevin Brodsky
2019-02-13 17:43 ` Dave Martin
2019-02-13 21:41 ` Evgenii Stepanov
2019-02-14 11:22 ` Kevin Brodsky
2019-02-19 18:38 ` Szabolcs Nagy
2019-02-25 16:57 ` Catalin Marinas
2019-02-25 18:02 ` Szabolcs Nagy [this message]
2019-02-26 17:30 ` Kevin Brodsky
2018-12-12 17:01 ` [PATCH v9 0/8] arm64: untag user pointers passed to the kernel Dave Martin
2018-12-18 17:17 ` Andrey Konovalov
2019-02-11 11:35 ` Catalin Marinas
2019-02-11 17:02 ` Dave Martin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7afa18b8-f135-036d-943c-b6216e7da481@arm.com \
--to=szabolcs.nagy@arm.com \
--cc=Catalin.Marinas@arm.com \
--cc=Dave.Martin@arm.com \
--cc=Jacob.Bramley@arm.com \
--cc=Kevin.Brodsky@arm.com \
--cc=Lee.Smith@arm.com \
--cc=Mark.Rutland@arm.com \
--cc=Ramana.Radhakrishnan@arm.com \
--cc=Robin.Murphy@arm.com \
--cc=Ruben.Ayrapetyan@arm.com \
--cc=Vincenzo.Frascino@arm.com \
--cc=Will.Deacon@arm.com \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@google.com \
--cc=cpandya@codeaurora.org \
--cc=dvyukov@google.com \
--cc=eugenis@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=kcc@google.com \
--cc=keescook@chromium.org \
--cc=kirill.shutemov@linux.intel.com \
--cc=kstewart@linuxfoundation.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luc.vanoostenryck@gmail.com \
--cc=mingo@kernel.org \
--cc=nd@arm.com \
--cc=shuah@kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).