Linux-ARM-Kernel Archive on lore.kernel.org
 help / color / Atom feed
From: Catalin Marinas <catalin.marinas@arm.com>
To: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: linux-arch@vger.kernel.org, linux-doc@vger.kernel.org,
	Szabolcs Nagy <szabolcs.nagy@arm.com>,
	Andrey Konovalov <andreyknvl@google.com>,
	Will Deacon <will.deacon@arm.com>,
	linux-kernel@vger.kernel.org, linux-mm@kvack.org,
	Alexander Viro <viro@zeniv.linux.org.uk>,
	linux-kselftest@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH v4 1/2] arm64: Define Documentation/arm64/tagged-address-abi.txt
Date: Wed, 12 Jun 2019 16:35:39 +0100
Message-ID: <20190612153538.GL28951@C02TF0J2HF1T.local> (raw)
In-Reply-To: <20190612142111.28161-2-vincenzo.frascino@arm.com>

Hi Vincenzo,

Some minor comments below but it looks fine to me overall. Cc'ing
Szabolcs as well since I'd like a view from the libc people.

On Wed, Jun 12, 2019 at 03:21:10PM +0100, Vincenzo Frascino wrote:
> diff --git a/Documentation/arm64/tagged-address-abi.txt b/Documentation/arm64/tagged-address-abi.txt
> new file mode 100644
> index 000000000000..96e149e2c55c
> --- /dev/null
> +++ b/Documentation/arm64/tagged-address-abi.txt
> @@ -0,0 +1,111 @@
> +ARM64 TAGGED ADDRESS ABI
> +========================
> +
> +This document describes the usage and semantics of the Tagged Address
> +ABI on arm64.
> +
> +1. Introduction
> +---------------
> +
> +On arm64 the TCR_EL1.TBI0 bit has been always enabled on the arm64 kernel,
> +hence the userspace (EL0) is allowed to set a non-zero value in the top

I'd be clearer here: "userspace (EL0) is allowed to perform a user
memory access through a 64-bit pointer with a non-zero top byte" (or
something along the lines). Otherwise setting a non-zero top byte is
allowed on any architecture, dereferencing it is a problem.

> +byte but the resulting pointers are not allowed at the user-kernel syscall
> +ABI boundary.
> +
> +This document describes a relaxation of the ABI with which it is possible

"relaxation of the ABI that makes it possible to..."

> +to pass tagged tagged pointers to the syscalls, when these pointers are in
> +memory ranges obtained as described in paragraph 2.

"section 2" is better. There are a lot more paragraphs.

> +
> +Since it is not desirable to relax the ABI to allow tagged user addresses
> +into the kernel indiscriminately, arm64 provides a new sysctl interface
> +(/proc/sys/abi/tagged_addr) that is used to prevent the applications from
> +enabling the relaxed ABI and a new prctl() interface that can be used to
> +enable or disable the relaxed ABI.
> +
> +The sysctl is meant also for testing purposes in order to provide a simple
> +way for the userspace to verify the return error checking of the prctl()
> +command without having to reconfigure the kernel.
> +
> +The ABI properties are inherited by threads of the same application and
> +fork()'ed children but cleared when a new process is spawn (execve()).

"spawned".

I guess you could drop these three paragraphs here and mention the
inheritance properties when introducing the prctl() below. You can also
mention the global sysctl switch after the prctl() was introduced.

> +
> +2. ARM64 Tagged Address ABI
> +---------------------------
> +
> +From the kernel syscall interface prospective, we define, for the purposes
> +of this document, a "valid tagged pointer" as a pointer that either it has

"either has" (no 'it') sounds slightly better but I'm not a native
English speaker either.

> +a zero value set in the top byte or it has a non-zero value, it is in memory
> +ranges privately owned by a userspace process and it is obtained in one of
> +the following ways:
> +  - mmap() done by the process itself, where either:
> +    * flags = MAP_PRIVATE | MAP_ANONYMOUS
> +    * flags = MAP_PRIVATE and the file descriptor refers to a regular
> +      file or "/dev/zero"
> +  - a mapping below sbrk(0) done by the process itself
> +  - any memory mapped by the kernel in the process's address space during
> +    creation and following the restrictions presented above (i.e. data, bss,
> +    stack).
> +
> +The ARM64 Tagged Address ABI is an opt-in feature, and an application can
> +control it using the following prctl()s:
> +  - PR_SET_TAGGED_ADDR_CTRL: can be used to enable the Tagged Address ABI.

enable or disable (not sure we need the latter but it doesn't heart).

I'd add the arg2 description here as well.

> +  - PR_GET_TAGGED_ADDR_CTRL: can be used to check the status of the Tagged
> +                             Address ABI.
> +
> +As a consequence of invoking PR_SET_TAGGED_ADDR_CTRL prctl() by an applications,
> +the ABI guarantees the following behaviours:
> +
> +  - Every current or newly introduced syscall can accept any valid tagged
> +    pointers.
> +
> +  - If a non valid tagged pointer is passed to a syscall then the behaviour
> +    is undefined.
> +
> +  - Every valid tagged pointer is expected to work as an untagged one.
> +
> +  - The kernel preserves any valid tagged pointers and returns them to the
> +    userspace unchanged in all the cases except the ones documented in the
> +    "Preserving tags" paragraph of tagged-pointers.txt.

I'd think we need to qualify the context here in which the kernel
preserves the tagged pointers. Did you mean on the syscall return?

> +
> +A definition of the meaning of tagged pointers on arm64 can be found in:
> +Documentation/arm64/tagged-pointers.txt.
> +
> +3. ARM64 Tagged Address ABI Exceptions
> +--------------------------------------
> +
> +The behaviours described in paragraph 2, with particular reference to the

"section 2"

> +acceptance by the syscalls of any valid tagged pointer are not applicable
> +to the following cases:
> +  - mmap() addr parameter.
> +  - mremap() new_address parameter.
> +  - prctl_set_mm() struct prctl_map fields.
> +  - prctl_set_mm_map() struct prctl_map fields.
> +
> +4. Example of correct usage
> +---------------------------
> +
> +void main(void)
> +{
> +	static int tbi_enabled = 0;
> +	unsigned long tag = 0;
> +
> +	char *ptr = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE,
> +			 MAP_ANONYMOUS, -1, 0);
> +
> +	if (prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE,
> +		  0, 0, 0) == 0)
> +		tbi_enabled = 1;
> +
> +	if (!ptr)
> +		return -1;
> +
> +	if (tbi_enabled)
> +		tag = rand() & 0xff;
> +
> +	ptr = (char *)((unsigned long)ptr | (tag << TAG_SHIFT));
> +
> +	*ptr = 'a';
> +
> +	...
> +}
> +
> -- 
> 2.21.0

-- 
Catalin

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  reply index

Thread overview: 78+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-06-12 11:43 [PATCH v17 00/15] arm64: untag user pointers passed to the kernel Andrey Konovalov
2019-06-12 11:43 ` [PATCH v17 01/15] arm64: untag user pointers in access_ok and __uaccess_mask_ptr Andrey Konovalov
2019-06-12 14:26   ` Vincenzo Frascino
2019-06-12 11:43 ` [PATCH v17 02/15] lib, arm64: untag user pointers in strn*_user Andrey Konovalov
2019-06-12 14:28   ` Vincenzo Frascino
2019-06-12 11:43 ` [PATCH v17 03/15] arm64: Introduce prctl() options to control the tagged user addresses ABI Andrey Konovalov
2019-06-12 14:30   ` Vincenzo Frascino
2019-06-12 14:55   ` Catalin Marinas
2019-06-13 11:02   ` Dave Martin
2019-06-13 15:26     ` Catalin Marinas
2019-06-14  5:13       ` Kees Cook
2019-06-18  9:18         ` Dave Martin
2019-06-13 11:16   ` Dave Martin
2019-06-13 15:35     ` Catalin Marinas
2019-06-13 15:45       ` Vincenzo Frascino
2019-06-13 15:57         ` Catalin Marinas
2019-06-13 16:15           ` Vincenzo Frascino
2019-06-17 13:56   ` Catalin Marinas
2019-06-17 16:56     ` Szabolcs Nagy
2019-06-17 16:57     ` Evgenii Stepanov
2019-06-17 17:18       ` Catalin Marinas
2019-06-17 21:59         ` Evgenii Stepanov
2019-06-19 14:45   ` Andrey Konovalov
2019-06-19 15:29     ` Catalin Marinas
2019-06-12 11:43 ` [PATCH v17 04/15] mm, arm64: untag user pointers passed to memory syscalls Andrey Konovalov
2019-06-12 14:31   ` Vincenzo Frascino
2019-06-19 15:55   ` Khalid Aziz
2019-06-19 16:46     ` Khalid Aziz
2019-06-24 14:22       ` Andrey Konovalov
2019-06-12 11:43 ` [PATCH v17 05/15] mm, arm64: untag user pointers in mm/gup.c Andrey Konovalov
2019-06-12 14:33   ` Vincenzo Frascino
2019-06-19 16:41   ` Khalid Aziz
2019-06-12 11:43 ` [PATCH v17 06/15] mm, arm64: untag user pointers in get_vaddr_frames Andrey Konovalov
2019-06-12 14:34   ` Vincenzo Frascino
2019-06-19 16:48   ` Khalid Aziz
2019-06-12 11:43 ` [PATCH v17 07/15] fs, arm64: untag user pointers in copy_mount_options Andrey Konovalov
2019-06-12 14:35   ` Vincenzo Frascino
2019-06-19 20:01   ` Khalid Aziz
2019-06-12 11:43 ` [PATCH v17 08/15] userfaultfd, arm64: untag user pointers Andrey Konovalov
2019-06-12 14:40   ` Vincenzo Frascino
2019-06-12 11:43 ` [PATCH v17 09/15] drm/amdgpu, " Andrey Konovalov
2019-06-12 11:43 ` [PATCH v17 10/15] drm/radeon, arm64: untag user pointers in radeon_gem_userptr_ioctl Andrey Konovalov
2019-06-12 11:43 ` [PATCH v17 11/15] IB/mlx4, arm64: untag user pointers in mlx4_get_umem_mr Andrey Konovalov
2019-06-12 11:43 ` [PATCH v17 12/15] media/v4l2-core, arm64: untag user pointers in videobuf_dma_contig_user_get Andrey Konovalov
2019-06-19 20:05   ` Khalid Aziz
2019-06-12 11:43 ` [PATCH v17 13/15] tee/shm, arm64: untag user pointers in tee_shm_register Andrey Konovalov
2019-06-12 11:43 ` [PATCH v17 14/15] vfio/type1, arm64: untag user pointers in vaddr_get_pfn Andrey Konovalov
2019-06-12 14:41   ` Vincenzo Frascino
2019-06-12 15:58   ` Auger Eric
2019-06-12 11:43 ` [PATCH v17 15/15] selftests, arm64: add a selftest for passing tagged pointers to kernel Andrey Konovalov
2019-06-12 12:30   ` Szabolcs Nagy
2019-06-12 15:00     ` Catalin Marinas
2019-06-19 14:42       ` Andrey Konovalov
2019-06-12 14:21 ` [PATCH v4 0/2] arm64 relaxed ABI Vincenzo Frascino
2019-06-12 14:21   ` [PATCH v4 1/2] arm64: Define Documentation/arm64/tagged-address-abi.txt Vincenzo Frascino
2019-06-12 15:35     ` Catalin Marinas [this message]
2019-06-13 10:15       ` Vincenzo Frascino
2019-06-13 11:37         ` Dave Martin
2019-06-13 12:28           ` Catalin Marinas
2019-06-13 13:23             ` Dave Martin
2019-06-13 15:39               ` Catalin Marinas
2019-06-12 16:30     ` Szabolcs Nagy
2019-06-13  9:20       ` Catalin Marinas
2019-06-13 10:14         ` Szabolcs Nagy
2019-06-13 11:16           ` Vincenzo Frascino
2019-06-13 12:28             ` Szabolcs Nagy
2019-06-13 14:03               ` Vincenzo Frascino
2019-06-13 15:32                 ` Szabolcs Nagy
2019-06-13 15:35                   ` Vincenzo Frascino
2019-06-12 14:21   ` [PATCH v4 2/2] arm64: Relax Documentation/arm64/tagged-pointers.txt Vincenzo Frascino
2019-06-12 15:56     ` Catalin Marinas
2019-06-12 16:37     ` Szabolcs Nagy
2019-06-13 15:51 ` [PATCH v5 0/2] arm64 relaxed ABI Vincenzo Frascino
2019-06-13 15:51   ` [PATCH v5 1/2] arm64: Define Documentation/arm64/tagged-address-abi.txt Vincenzo Frascino
2019-06-18 11:02     ` Szabolcs Nagy
2019-06-18 13:13     ` Kevin Brodsky
2019-06-21 15:16       ` Catalin Marinas
2019-06-13 15:51   ` [PATCH v5 2/2] arm64: Relax Documentation/arm64/tagged-pointers.txt Vincenzo Frascino

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190612153538.GL28951@C02TF0J2HF1T.local \
    --to=catalin.marinas@arm.com \
    --cc=andreyknvl@google.com \
    --cc=linux-arch@vger.kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=szabolcs.nagy@arm.com \
    --cc=vincenzo.frascino@arm.com \
    --cc=viro@zeniv.linux.org.uk \
    --cc=will.deacon@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-ARM-Kernel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-arm-kernel/0 linux-arm-kernel/git/0.git
	git clone --mirror https://lore.kernel.org/linux-arm-kernel/1 linux-arm-kernel/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-arm-kernel linux-arm-kernel/ https://lore.kernel.org/linux-arm-kernel \
		linux-arm-kernel@lists.infradead.org infradead-linux-arm-kernel@archiver.kernel.org
	public-inbox-index linux-arm-kernel


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.infradead.lists.linux-arm-kernel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox