[PATCH v16 6/6] arm64: expose FAR_EL1 tag bits in siginfo

[Eric W. Biederman]

Peter Collingbourne <pcc at google.com> writes:

> On Mon, Nov 16, 2020 at 1:55 PM Eric W. Biederman <ebiederm at xmission.com> wrote:
>>
>> Catalin Marinas <catalin.marinas at arm.com> writes:
>>
>> > On Thu, Nov 12, 2020 at 06:53:36PM -0800, Peter Collingbourne wrote:
>> >> diff --git a/Documentation/arm64/tagged-pointers.rst b/Documentation/arm64/tagged-pointers.rst
>> >> index eab4323609b9..19d284b70384 100644
>> >> --- a/Documentation/arm64/tagged-pointers.rst
>> >> +++ b/Documentation/arm64/tagged-pointers.rst
>> >> @@ -53,12 +53,25 @@ visibility.
>> >>  Preserving tags
>> >>  ---------------
>> >>
>> >> -Non-zero tags are not preserved when delivering signals. This means that
>> >> -signal handlers in applications making use of tags cannot rely on the
>> >> -tag information for user virtual addresses being maintained for fields
>> >> -inside siginfo_t. One exception to this rule is for signals raised in
>> >> -response to watchpoint debug exceptions, where the tag information will
>> >> -be preserved.
>> >> +When delivering signals, non-zero tags are not preserved in
>> >> +siginfo.si_addr unless the flag SA_EXPOSE_TAGBITS was set in
>> >> +sigaction.sa_flags when the signal handler was installed. This means
>> >> +that signal handlers in applications making use of tags cannot rely
>> >> +on the tag information for user virtual addresses being maintained
>> >> +in these fields unless the flag was set.
>> >> +
>> >> +Due to architecture limitations, bits 63:60 of the fault address
>> >> +are not preserved in response to synchronous tag check faults
>> >> +(SEGV_MTESERR) even if SA_EXPOSE_TAGBITS was set. Applications should
>> >> +treat the values of these bits as undefined in order to accommodate
>> >> +future architecture revisions which may preserve the bits.
>> >
>> > If future architecture versions will preserve these bits, most likely
>> > we'll add a new HWCAP bit so that the user knows what's going on. But
>> > the user shouldn't rely on them being 0, just in case.
>> >
>> >> +For signals raised in response to watchpoint debug exceptions, the
>> >> +tag information will be preserved regardless of the SA_EXPOSE_TAGBITS
>> >> +flag setting.
>> >> +
>> >> +Non-zero tags are never preserved in sigcontext.fault_address
>> >> +regardless of the SA_EXPOSE_TAGBITS flag setting.
>> >
>> > We could've done it the other way around (fault_address tagged, si_addr
>> > untagged) but that would be specific to arm64, so I think we should
>> > solve it for other architectures that implement (or plan to) tagging.
>> > The fault_address in the arm64 sigcontext was an oversight, we should
>> > have removed it but when we realised it was already ABI.
>> >
>> > Anyway, I'm fine with the arm64 changes here:
>> >
>> > Reviewed-by: Catalin Marinas <catalin.marinas at arm.com>
>> >
>> > With Eric's ack, I'm happy to take the series through the arm64 tree,
>> > otherwise Eric's tree is fine as well.
>>
>> In general I am fine with the last two patches.
>>
>> I want to understand where the value for SA_UNSUPPORTED comes from, and
>
> I hope I explained it well enough in [1]. If documenting the
> arch-specific bits that way looks good to you let me know and I will
> update patch 3.

Bah.  I missed your reply.

Please send me an incremental patch against:

 https://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git signal-for-v5.11

As I have already applied your first 4 patches and have them in
linux-next.

>> while I have good answers I am still digesting the question of if
>> SA_EXPOSE_TAGBITS should be implemented in the arch specific header or
>> in a generic header.  I quite agree it should have a generic
>> definition/implementation.  I just don't know if it makes sense to make
>> the value available to userspace if the architecture does not have
>> tagbits.  Mostly my concern is about bit consumption as we only have
>> 30ish sigaction bits.
>
> As mentioned in [2] I would favor making the bits generic as that
> would simplify the client code. And I would personally not be too
> concerned about consuming bits here. Our historical rate of adding new
> bits is very low (as far as I know these are the first new bits to be
> added in about 20 years!) And once we are at the point where we are
> close to running out of bits it would be a good time to consider a new
> sigaction API anyway that addresses some of the historical warts of
> the existing one, and at that point we should be able to come up with
> a way to add more bits.

It is a good point that this areay hasn't seen much action in ages.  So
there is not too much need to be concerned.

In general portable code will need to do "#ifdef SA_EXPOSE_TAGBITS"
somewhere.  But certainly it should be at least as generic as
SA_RESTORER.  With the same meaning everywhere it is defined.
And certainly it makes sense for the implementation to live
in the generic signal code for to ensure all architectures implement
it with the same semantics.

I am going to sleep on this one and then see if I see any real concerns.

This is bike-shedding I know, and you have done a very nice job gettin
this far.  So I don't expect I will come up with any compelling reasons
to change after sleeping on it, but I am going to sleep on it.


> [1] https://lore.kernel.org/linux-arm-kernel/CAMn1gO52j4fSEn5S2GdrtyCq+iiaMK16DkKiyj=Go91Jy+xR-w@mail.gmail.com/
> [2] https://lore.kernel.org/linux-arm-kernel/CAMn1gO6n7NrM8A+vkMt=ixvbSzUJbrr2s6Ko3WENPoT-84J15w@mail.gmail.com/

Eric