Re: [PATCH v16 6/6] arm64: expose FAR_EL1 tag bits in siginfo

Peter Collingbourne [off-list ref] writes:

On Mon, Nov 16, 2020 at 1:55 PM Eric W. Biederman [off-list ref] wrote:

quoted

Catalin Marinas [off-list ref] writes:

quoted

On Thu, Nov 12, 2020 at 06:53:36PM -0800, Peter Collingbourne wrote:

quoted

diff --git a/Documentation/arm64/tagged-pointers.rst b/Documentation/arm64/tagged-pointers.rst
index eab4323609b9..19d284b70384 100644
--- a/Documentation/arm64/tagged-pointers.rst
+++ b/Documentation/arm64/tagged-pointers.rst

@@ -53,12 +53,25 @@ visibility.
 Preserving tags
 ---------------

-Non-zero tags are not preserved when delivering signals. This means that
-signal handlers in applications making use of tags cannot rely on the
-tag information for user virtual addresses being maintained for fields
-inside siginfo_t. One exception to this rule is for signals raised in
-response to watchpoint debug exceptions, where the tag information will
-be preserved.
+When delivering signals, non-zero tags are not preserved in
+siginfo.si_addr unless the flag SA_EXPOSE_TAGBITS was set in
+sigaction.sa_flags when the signal handler was installed. This means
+that signal handlers in applications making use of tags cannot rely
+on the tag information for user virtual addresses being maintained
+in these fields unless the flag was set.
+
+Due to architecture limitations, bits 63:60 of the fault address
+are not preserved in response to synchronous tag check faults
+(SEGV_MTESERR) even if SA_EXPOSE_TAGBITS was set. Applications should
+treat the values of these bits as undefined in order to accommodate
+future architecture revisions which may preserve the bits.

If future architecture versions will preserve these bits, most likely
we'll add a new HWCAP bit so that the user knows what's going on. But
the user shouldn't rely on them being 0, just in case.

quoted

+For signals raised in response to watchpoint debug exceptions, the
+tag information will be preserved regardless of the SA_EXPOSE_TAGBITS
+flag setting.
+
+Non-zero tags are never preserved in sigcontext.fault_address
+regardless of the SA_EXPOSE_TAGBITS flag setting.

We could've done it the other way around (fault_address tagged, si_addr
untagged) but that would be specific to arm64, so I think we should
solve it for other architectures that implement (or plan to) tagging.
The fault_address in the arm64 sigcontext was an oversight, we should
have removed it but when we realised it was already ABI.

Anyway, I'm fine with the arm64 changes here:

Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>

With Eric's ack, I'm happy to take the series through the arm64 tree,
otherwise Eric's tree is fine as well.

In general I am fine with the last two patches.

I want to understand where the value for SA_UNSUPPORTED comes from, and

I hope I explained it well enough in [1]. If documenting the
arch-specific bits that way looks good to you let me know and I will
update patch 3.

Bah.  I missed your reply.

Please send me an incremental patch against:

 https://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git signal-for-v5.11

As I have already applied your first 4 patches and have them in
linux-next.

quoted

while I have good answers I am still digesting the question of if
SA_EXPOSE_TAGBITS should be implemented in the arch specific header or
in a generic header.  I quite agree it should have a generic
definition/implementation.  I just don't know if it makes sense to make
the value available to userspace if the architecture does not have
tagbits.  Mostly my concern is about bit consumption as we only have
30ish sigaction bits.

As mentioned in [2] I would favor making the bits generic as that
would simplify the client code. And I would personally not be too
concerned about consuming bits here. Our historical rate of adding new
bits is very low (as far as I know these are the first new bits to be
added in about 20 years!) And once we are at the point where we are
close to running out of bits it would be a good time to consider a new
sigaction API anyway that addresses some of the historical warts of
the existing one, and at that point we should be able to come up with
a way to add more bits.

It is a good point that this areay hasn't seen much action in ages.  So
there is not too much need to be concerned.

In general portable code will need to do "#ifdef SA_EXPOSE_TAGBITS"
somewhere.  But certainly it should be at least as generic as
SA_RESTORER.  With the same meaning everywhere it is defined.
And certainly it makes sense for the implementation to live
in the generic signal code for to ensure all architectures implement
it with the same semantics.

I am going to sleep on this one and then see if I see any real concerns.

This is bike-shedding I know, and you have done a very nice job gettin
this far.  So I don't expect I will come up with any compelling reasons
to change after sleeping on it, but I am going to sleep on it.

[1] https://lore.kernel.org/linux-arm-kernel/CAMn1gO52j4fSEn5S2GdrtyCq+iiaMK16DkKiyj=Go91Jy+xR-w@mail.gmail.com/ (local)
[2] https://lore.kernel.org/linux-arm-kernel/CAMn1gO6n7NrM8A+vkMt=ixvbSzUJbrr2s6Ko3WENPoT-84J15w@mail.gmail.com/ (local)

Eric