[PATCH v16 6/6] arm64: expose FAR_EL1 tag bits in siginfo

[Peter Collingbourne]

On Mon, Nov 16, 2020 at 1:55 PM Eric W. Biederman <ebiederm at xmission.com> wrote:
>
> Catalin Marinas <catalin.marinas at arm.com> writes:
>
> > On Thu, Nov 12, 2020 at 06:53:36PM -0800, Peter Collingbourne wrote:
> >> diff --git a/Documentation/arm64/tagged-pointers.rst b/Documentation/arm64/tagged-pointers.rst
> >> index eab4323609b9..19d284b70384 100644
> >> --- a/Documentation/arm64/tagged-pointers.rst
> >> +++ b/Documentation/arm64/tagged-pointers.rst
> >> @@ -53,12 +53,25 @@ visibility.
> >>  Preserving tags
> >>  ---------------
> >>
> >> -Non-zero tags are not preserved when delivering signals. This means that
> >> -signal handlers in applications making use of tags cannot rely on the
> >> -tag information for user virtual addresses being maintained for fields
> >> -inside siginfo_t. One exception to this rule is for signals raised in
> >> -response to watchpoint debug exceptions, where the tag information will
> >> -be preserved.
> >> +When delivering signals, non-zero tags are not preserved in
> >> +siginfo.si_addr unless the flag SA_EXPOSE_TAGBITS was set in
> >> +sigaction.sa_flags when the signal handler was installed. This means
> >> +that signal handlers in applications making use of tags cannot rely
> >> +on the tag information for user virtual addresses being maintained
> >> +in these fields unless the flag was set.
> >> +
> >> +Due to architecture limitations, bits 63:60 of the fault address
> >> +are not preserved in response to synchronous tag check faults
> >> +(SEGV_MTESERR) even if SA_EXPOSE_TAGBITS was set. Applications should
> >> +treat the values of these bits as undefined in order to accommodate
> >> +future architecture revisions which may preserve the bits.
> >
> > If future architecture versions will preserve these bits, most likely
> > we'll add a new HWCAP bit so that the user knows what's going on. But
> > the user shouldn't rely on them being 0, just in case.
> >
> >> +For signals raised in response to watchpoint debug exceptions, the
> >> +tag information will be preserved regardless of the SA_EXPOSE_TAGBITS
> >> +flag setting.
> >> +
> >> +Non-zero tags are never preserved in sigcontext.fault_address
> >> +regardless of the SA_EXPOSE_TAGBITS flag setting.
> >
> > We could've done it the other way around (fault_address tagged, si_addr
> > untagged) but that would be specific to arm64, so I think we should
> > solve it for other architectures that implement (or plan to) tagging.
> > The fault_address in the arm64 sigcontext was an oversight, we should
> > have removed it but when we realised it was already ABI.
> >
> > Anyway, I'm fine with the arm64 changes here:
> >
> > Reviewed-by: Catalin Marinas <catalin.marinas at arm.com>
> >
> > With Eric's ack, I'm happy to take the series through the arm64 tree,
> > otherwise Eric's tree is fine as well.
>
> In general I am fine with the last two patches.
>
> I want to understand where the value for SA_UNSUPPORTED comes from, and

I hope I explained it well enough in [1]. If documenting the
arch-specific bits that way looks good to you let me know and I will
update patch 3.

> while I have good answers I am still digesting the question of if
> SA_EXPOSE_TAGBITS should be implemented in the arch specific header or
> in a generic header.  I quite agree it should have a generic
> definition/implementation.  I just don't know if it makes sense to make
> the value available to userspace if the architecture does not have
> tagbits.  Mostly my concern is about bit consumption as we only have
> 30ish sigaction bits.

As mentioned in [2] I would favor making the bits generic as that
would simplify the client code. And I would personally not be too
concerned about consuming bits here. Our historical rate of adding new
bits is very low (as far as I know these are the first new bits to be
added in about 20 years!) And once we are at the point where we are
close to running out of bits it would be a good time to consider a new
sigaction API anyway that addresses some of the historical warts of
the existing one, and at that point we should be able to come up with
a way to add more bits.

Peter

[1] https://lore.kernel.org/linux-arm-kernel/CAMn1gO52j4fSEn5S2GdrtyCq+iiaMK16DkKiyj=Go91Jy+xR-w@mail.gmail.com/
[2] https://lore.kernel.org/linux-arm-kernel/CAMn1gO6n7NrM8A+vkMt=ixvbSzUJbrr2s6Ko3WENPoT-84J15w@mail.gmail.com/