Re: [PATCH v8 4/5] arm64: Define Documentation/arm64/tagged-address-abi.rst
From: Will Deacon <will@kernel.org>
Date: 2019-08-19 16:25:57
Also in:
linux-arch, linux-doc, linux-mm
On Thu, Aug 15, 2019 at 04:44:02PM +0100, Catalin Marinas wrote:
quoted hunk ↗ jump to hunk
From: Vincenzo Frascino <vincenzo.frascino@arm.com> On AArch64 the TCR_EL1.TBI0 bit is set by default, allowing userspace (EL0) to perform memory accesses through 64-bit pointers with a non-zero top byte. Introduce the document describing the relaxation of the syscall ABI that allows userspace to pass certain tagged pointers to kernel syscalls. Cc: Will Deacon <redacted> Cc: Andrey Konovalov <redacted> Cc: Szabolcs Nagy <redacted> Cc: Kevin Brodsky <redacted> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Co-developed-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> --- Documentation/arm64/tagged-address-abi.rst | 155 +++++++++++++++++++++ 1 file changed, 155 insertions(+) create mode 100644 Documentation/arm64/tagged-address-abi.rstdiff --git a/Documentation/arm64/tagged-address-abi.rst b/Documentation/arm64/tagged-address-abi.rst new file mode 100644 index 000000000000..8808337775d6 --- /dev/null +++ b/Documentation/arm64/tagged-address-abi.rst@@ -0,0 +1,155 @@ +========================== +AArch64 TAGGED ADDRESS ABI +========================== + +Authors: Vincenzo Frascino <vincenzo.frascino@arm.com> + Catalin Marinas <catalin.marinas@arm.com> + +Date: 15 August 2019 + +This document describes the usage and semantics of the Tagged Address +ABI on AArch64 Linux. + +1. Introduction +--------------- + +On AArch64 the TCR_EL1.TBI0 bit is set by default, allowing userspace +(EL0) to perform memory accesses through 64-bit pointers with a non-zero +top byte. This document describes the relaxation of the syscall ABI that +allows userspace to pass certain tagged pointers to kernel syscalls. + +2. AArch64 Tagged Address ABI +----------------------------- + +From the kernel syscall interface perspective and for the purposes of +this document, a "valid tagged pointer" is a pointer with a potentially +non-zero top-byte that references an address in the user process address +space obtained in one of the following ways: + +- mmap() done by the process itself (or its parent), where either: + + - flags have the **MAP_ANONYMOUS** bit set + - the file descriptor refers to a regular file (including those + returned by memfd_create()) or **/dev/zero**
nit: but the markup is pretty inconsistent throughout. Why is /dev/zero bold, but not memfd_create()? I think they would both be better off in typewriter font, if that's a thing in rst.
+- brk() system call done by the process itself (i.e. the heap area + between the initial location of the program break at process creation + and its current location). + +- any memory mapped by the kernel in the address space of the process + during creation and with the same restrictions as for mmap() above + (e.g. data, bss, stack). + +The AArch64 Tagged Address ABI has two stages of relaxation depending +how the user addresses are used by the kernel: + +1. User addresses not accessed by the kernel but used for address space + management (e.g. mmap(), mprotect(), madvise()). The use of valid + tagged pointers in this context is always allowed. + +2. User addresses accessed by the kernel (e.g. write()). This ABI + relaxation is disabled by default and the application thread needs to + explicitly enable it via **prctl()** as follows: + + - **PR_SET_TAGGED_ADDR_CTRL**: enable or disable the AArch64 Tagged + Address ABI for the calling thread. + + The (unsigned int) arg2 argument is a bit mask describing the + control mode used: + + - **PR_TAGGED_ADDR_ENABLE**: enable AArch64 Tagged Address ABI. + Default status is disabled. + + Arguments arg3, arg4, and arg5 must be 0. + + - **PR_GET_TAGGED_ADDR_CTRL**: get the status of the AArch64 Tagged + Address ABI for the calling thread. + + Arguments arg2, arg3, arg4, and arg5 must be 0. + + The ABI properties described above are thread-scoped, inherited on + clone() and fork() and cleared on exec(). + + Calling prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) + returns -EINVAL if the AArch64 Tagged Address ABI is globally disabled + by sysctl abi.tagged_addr_disabled=1. The default sysctl + abi.tagged_addr_disabled configuration is 0. + +When the AArch64 Tagged Address ABI is enabled for a thread, the +following behaviours are guaranteed: + +- All syscalls except the cases mentioned in section 3 can accept any + valid tagged pointer. + +- The syscall behaviour is undefined for invalid tagged pointers: it may + result in an error code being returned, a (fatal) signal being raised, + or other modes of failure. + +- A valid tagged pointer has the same semantics as the corresponding + untagged pointer.
nit, but I'd reword this last bullet slightly to say:
- The syscall behaviour for a valid tagged pointer is the same as for
the corresponding untagged pointer.
Since that flows better wrt the previous bullet and is explicit about
syscall behaviour, rather than overall semantics.
+ +A definition of the meaning of tagged pointers on AArch64 can be found +in Documentation/arm64/tagged-pointers.rst. + +3. AArch64 Tagged Address ABI Exceptions +----------------------------------------- + +The following system call parameters must be untagged regardless of the +ABI relaxation: + +- prctl() other than arguments pointing to user structures to be + accessed by the kernel. + +- ioctl() other than arguments pointing to user structures to be + accessed by the kernel.
I agree with Kevin that we should tighten this up. How about:
- ... other than pointers to user data either passed directly or
indirectly as arguments to be accessed by the kernel.
?
Will
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel