arm64: untag user pointers passed to the kernel

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

strncpy_from_user and strnlen_user accept user addresses as arguments, and do not go through the same path as copy_from_user and others, so here we need to handle the case of tagged user addresses separately.

Untag user pointers passed to these functions.

Note, that this patch only temporarily untags the pointers to perform validity checks, but then uses them as is to perform user memory accesses.

Signed-off-by Andrey Konovalov <andreyknvl at google.com>

---
  lib/strncpy_from_user.c | 3 ++-
  lib/strnlen_user.c      | 3 ++-
  2 files changed, 4 insertions(+), 2 deletions(-)

lib/strncpy_from_user.c +2 -1

index 58eacd41526c..6209bb9507c7 100644
@@ -6,6 +6,7 @@
  #include <linux/uaccess.h>
  #include <linux/kernel.h>
  #include <linux/errno.h>
+#include <linux/mm.h>
 
  #include <asm/byteorder.h>
  #include <asm/word-at-a-time.h>

@@ -107,7 +108,7 @@ long strncpy_from_user(char *dst, const char __user *src, long count)
  		return 0;
 
  	max_addr = user_addr_max();
-	src_addr = (unsigned long)src;
+	src_addr = (unsigned long)untagged_addr(src);
  	if (likely(src_addr < max_addr)) {
  		unsigned long max = max_addr - src_addr;
  		long retval;

lib/strnlen_user.c +2 -1

index 1c1a1b0e38a5..8ca3d2ac32ec 100644
@@ -2,6 +2,7 @@
  #include <linux/kernel.h>
  #include <linux/export.h>
  #include <linux/uaccess.h>
+#include <linux/mm.h>
 
  #include <asm/word-at-a-time.h>
 

@@ -109,7 +110,7 @@ long strnlen_user(const char __user *str, long count)
  		return 0;
 
  	max_addr = user_addr_max();
-	src_addr = (unsigned long)str;
+	src_addr = (unsigned long)untagged_addr(str);
  	if (likely(src_addr < max_addr)) {
  		unsigned long max = max_addr - src_addr;
  		long retval;

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

strncpy_from_user and strnlen_user accept user addresses as arguments, and do not go through the same path as copy_from_user and others, so here we need to handle the case of tagged user addresses separately.

Untag user pointers passed to these functions.

Note, that this patch only temporarily untags the pointers to perform validity checks, but then uses them as is to perform user memory accesses.

Signed-off-by Andrey Konovalov <[email protected]>

---
  lib/strncpy_from_user.c | 3 ++-
  lib/strnlen_user.c      | 3 ++-
  2 files changed, 4 insertions(+), 2 deletions(-)

lib/strncpy_from_user.c +2 -1

index 58eacd41526c..6209bb9507c7 100644
@@ -6,6 +6,7 @@
  #include <linux/uaccess.h>
  #include <linux/kernel.h>
  #include <linux/errno.h>
+#include <linux/mm.h>
 
  #include <asm/byteorder.h>
  #include <asm/word-at-a-time.h>

@@ -107,7 +108,7 @@ long strncpy_from_user(char *dst, const char __user *src, long count)
  		return 0;
 
  	max_addr = user_addr_max();
-	src_addr = (unsigned long)src;
+	src_addr = (unsigned long)untagged_addr(src);
  	if (likely(src_addr < max_addr)) {
  		unsigned long max = max_addr - src_addr;
  		long retval;

lib/strnlen_user.c +2 -1

index 1c1a1b0e38a5..8ca3d2ac32ec 100644
@@ -2,6 +2,7 @@
  #include <linux/kernel.h>
  #include <linux/export.h>
  #include <linux/uaccess.h>
+#include <linux/mm.h>
 
  #include <asm/word-at-a-time.h>
 

@@ -109,7 +110,7 @@ long strnlen_user(const char __user *str, long count)
  		return 0;
 
  	max_addr = user_addr_max();
-	src_addr = (unsigned long)str;
+	src_addr = (unsigned long)untagged_addr(str);
  	if (likely(src_addr < max_addr)) {
  		unsigned long max = max_addr - src_addr;
  		long retval;

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

tcp_zerocopy_receive() uses provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in this function.

Signed-off-by Andrey Konovalov <andreyknvl at google.com>

---
 net/ipv4/tcp.c | 2 ++
 1 file changed, 2 insertions(+)

net/ipv4/tcp.c +0 -0

index 6baa6dc1b13b..89db3b4fc753 100644

net/ipv4/tcp.c +0 -0

 		return -EINVAL;
 

Quoted 22 lines · Andrey Konovalov

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

tcp_zerocopy_receive() uses provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in this function.

Signed-off-by Andrey Konovalov <[email protected]>

---
 net/ipv4/tcp.c | 2 ++
 1 file changed, 2 insertions(+)

net/ipv4/tcp.c +0 -0

index 6baa6dc1b13b..89db3b4fc753 100644
@@ -1758,6 +1758,8 @@ static int tcp_zerocopy_receive(struct sock *sk,
      int inq;
      int ret;
 

net/ipv4/tcp.c static int tcp_zerocopy_receive(struct sock *sk, · line 1763

Quoted 3 lines

net/ipv4/tcp.c +2 -0

+     address = untagged_addr(address);
+
      if (address & (PAGE_SIZE - 1) || address != zc->address)

The second test will fail, if the top bits are changed in address but not in zc->address

Quoted 4 lines

net/ipv4/tcp.c +0 -0

              return -EINVAL;
 

Quoted 26 lines · Eric Dumazet

Quoted 22 lines · Andrey Konovalov

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

tcp_zerocopy_receive() uses provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in this function.

Signed-off-by Andrey Konovalov <[email protected]>

---
 net/ipv4/tcp.c | 2 ++
 1 file changed, 2 insertions(+)

net/ipv4/tcp.c +0 -0

index 6baa6dc1b13b..89db3b4fc753 100644
@@ -1758,6 +1758,8 @@ static int tcp_zerocopy_receive(struct sock *sk,
      int inq;
      int ret;
 

Quoted 5 lines

net/ipv4/tcp.c static int tcp_zerocopy_receive(struct sock *sk, · line 1763

Quoted 3 lines

net/ipv4/tcp.c +2 -0

+     address = untagged_addr(address);
+
      if (address & (PAGE_SIZE - 1) || address != zc->address)

The second test will fail, if the top bits are changed in address but not in zc->address

Will fix in v12, thanks Eric!

Quoted 6 lines

Quoted 5 lines

net/ipv4/tcp.c +0 -0

              return -EINVAL;
 

Looking at the code, what's the point of this address != zc->address check? Should I just remove it?

Quoted 4 lines · Andrey Konovalov

Looking at the code, what's the point of this address != zc->address check? Should I just remove it?

No you must not remove it.

The test detects if a u64 ->unsigned long conversion might have truncated bits.

Quite surprisingly some people still use 32bit kernels.

The ABI is 64bit only, because we did not want to have yet another compat layer.

struct tcp_zerocopy_receive {
__u64 address; /* in: address of mapping */ __u32 length; /* in/out: number of bytes to map/mapped */ __u32 recv_skip_hint; /* out: amount of bytes to skip */
};

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

tcp_zerocopy_receive() uses provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in this function.

Signed-off-by Andrey Konovalov <[email protected]>

---
 net/ipv4/tcp.c | 2 ++
 1 file changed, 2 insertions(+)

net/ipv4/tcp.c +0 -0

index 6baa6dc1b13b..89db3b4fc753 100644

net/ipv4/tcp.c +0 -0

 		return -EINVAL;
 

Hi Andrey,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v5.0 next-20190306]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url: https://github.com/0day-ci/linux/commits/Andrey-Konovalov/uaccess-add-untagged_addr-definition-for-other-arches/20190317-015913
config: x86_64-randconfig-x012-201911 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:

        # save the attached .config to linux build tree
        make ARCH=x86_64

All errors (new ones prefixed by >>):

kernel/sys.c: In function 'prctl_set_mm_map':

Quoted 1 line

Quoted 1 line

kernel/sys.c:1996:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')

     prctl_map->start_code = untagged_addr(prctl_map.start_code);
              ^~
   kernel/sys.c:1997:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->end_code = untagged_addr(prctl_map.end_code);
              ^~
   kernel/sys.c:1998:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->start_data = untagged_addr(prctl_map.start_data);
              ^~
   kernel/sys.c:1999:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->end_data = untagged_addr(prctl_map.end_data);
              ^~
   kernel/sys.c:2000:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->start_brk = untagged_addr(prctl_map.start_brk);
              ^~
   kernel/sys.c:2001:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->brk  = untagged_addr(prctl_map.brk);
              ^~
   kernel/sys.c:2002:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->start_stack = untagged_addr(prctl_map.start_stack);
              ^~
   kernel/sys.c:2003:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->arg_start = untagged_addr(prctl_map.arg_start);
              ^~
   kernel/sys.c:2004:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->arg_end = untagged_addr(prctl_map.arg_end);
              ^~
   kernel/sys.c:2005:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->env_start = untagged_addr(prctl_map.env_start);
              ^~
   kernel/sys.c:2006:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->env_end = untagged_addr(prctl_map.env_end);
              ^~

vim +1996 kernel/sys.c

1974

  1975  #ifdef CONFIG_CHECKPOINT_RESTORE
  1976  static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data_size)
  1977  {
  1978          struct prctl_mm_map prctl_map = { .exe_fd = (u32)-1, };
  1979          unsigned long user_auxv[AT_VECTOR_SIZE];
  1980          struct mm_struct *mm = current->mm;
  1981          int error;

1982
1983 BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
1984 BUILD_BUG_ON(sizeof(struct prctl_mm_map) > 256);
1985
1986 if (opt == PR_SET_MM_MAP_SIZE)
1987 return put_user((unsigned int)sizeof(prctl_map),
1988 (unsigned int __user *)addr);
1989
1990 if (data_size != sizeof(prctl_map))
1991 return -EINVAL;
1992
1993 if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
1994 return -EFAULT;
1995

Quoted 1 line

1996 prctl_map->start_code = untagged_addr(prctl_map.start_code);

  1997          prctl_map->end_code     = untagged_addr(prctl_map.end_code);
  1998          prctl_map->start_data   = untagged_addr(prctl_map.start_data);
  1999          prctl_map->end_data     = untagged_addr(prctl_map.end_data);
  2000          prctl_map->start_brk    = untagged_addr(prctl_map.start_brk);
  2001          prctl_map->brk          = untagged_addr(prctl_map.brk);
  2002          prctl_map->start_stack  = untagged_addr(prctl_map.start_stack);
  2003          prctl_map->arg_start    = untagged_addr(prctl_map.arg_start);
  2004          prctl_map->arg_end      = untagged_addr(prctl_map.arg_end);
  2005          prctl_map->env_start    = untagged_addr(prctl_map.env_start);
  2006          prctl_map->env_end      = untagged_addr(prctl_map.env_end);
  2007
  2008          error = validate_prctl_map(&prctl_map);
  2009          if (error)
  2010                  return error;
  2011
  2012          if (prctl_map.auxv_size) {
  2013                  memset(user_auxv, 0, sizeof(user_auxv));
  2014                  if (copy_from_user(user_auxv,
  2015                                     (const void __user *)prctl_map.auxv,
  2016                                     prctl_map.auxv_size))
  2017                          return -EFAULT;
  2018
  2019                  /* Last entry must be AT_NULL as specification requires */
  2020                  user_auxv[AT_VECTOR_SIZE - 2] = AT_NULL;
  2021                  user_auxv[AT_VECTOR_SIZE - 1] = AT_NULL;
  2022          }
  2023
  2024          if (prctl_map.exe_fd != (u32)-1) {
  2025                  error = prctl_set_mm_exe_file(mm, prctl_map.exe_fd);
  2026                  if (error)
  2027                          return error;
  2028          }
  2029
  2030          /*
  2031           * arg_lock protects concurent updates but we still need mmap_sem for
  2032           * read to exclude races with sys_brk.
  2033           */
  2034          down_read(&mm->mmap_sem);
  2035
  2036          /*
  2037           * We don't validate if these members are pointing to
  2038           * real present VMAs because application may have correspond
  2039           * VMAs already unmapped and kernel uses these members for statistics
  2040           * output in procfs mostly, except
  2041           *
  2042           *  - @start_brk/@brk which are used in do_brk but kernel lookups
  2043           *    for VMAs when updating these memvers so anything wrong written
  2044           *    here cause kernel to swear at userspace program but won't lead
  2045           *    to any problem in kernel itself
  2046           */
  2047
  2048          spin_lock(&mm->arg_lock);
  2049          mm->start_code  = prctl_map.start_code;
  2050          mm->end_code    = prctl_map.end_code;
  2051          mm->start_data  = prctl_map.start_data;
  2052          mm->end_data    = prctl_map.end_data;
  2053          mm->start_brk   = prctl_map.start_brk;
  2054          mm->brk         = prctl_map.brk;
  2055          mm->start_stack = prctl_map.start_stack;
  2056          mm->arg_start   = prctl_map.arg_start;
  2057          mm->arg_end     = prctl_map.arg_end;
  2058          mm->env_start   = prctl_map.env_start;
  2059          mm->env_end     = prctl_map.env_end;
  2060          spin_unlock(&mm->arg_lock);
  2061
  2062          /*
  2063           * Note this update of @saved_auxv is lockless thus
  2064           * if someone reads this member in procfs while we're
  2065           * updating -- it may get partly updated results. It's
  2066           * known and acceptable trade off: we leave it as is to
  2067           * not introduce additional locks here making the kernel
  2068           * more complex.
  2069           */

2070 if (prctl_map.auxv_size)
2071 memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv));
2072
2073 up_read(&mm->mmap_sem);
2074 return 0;
2075 }
2076 #endif /* CONFIG_CHECKPOINT_RESTORE */
2077

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

prctl_set_mm() and prctl_set_mm_map() use provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in these functions.

Signed-off-by Andrey Konovalov <andreyknvl at google.com>

---
  kernel/sys.c | 14 ++++++++++++++
  1 file changed, 14 insertions(+)

kernel/sys.c +1 -0

index 12df0e5434b8..8e56d87cc6db 100644
@@ -1993,6 +1993,18 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data
  	if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
  		return -EFAULT;
 
+	prctl_map->start_code	= untagged_addr(prctl_map.start_code);

kernel/sys.c +1 -0

+
  #ifdef CONFIG_CHECKPOINT_RESTORE
  	if (opt == PR_SET_MM_MAP || opt == PR_SET_MM_MAP_SIZE)
  		return prctl_set_mm_map(opt, (const void __user *)addr, arg4);

Quoted 22 lines · Andrey Konovalov

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

prctl_set_mm() and prctl_set_mm_map() use provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in these functions.

Signed-off-by Andrey Konovalov <[email protected]>

---
  kernel/sys.c | 14 ++++++++++++++
  1 file changed, 14 insertions(+)

kernel/sys.c +0 -0

index 12df0e5434b8..8e56d87cc6db 100644
@@ -1993,6 +1993,18 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data
      if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
              return -EFAULT;
 

kernel/sys.c static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data · line 2006

Quoted 11 lines

kernel/sys.c +11 -0

+     prctl_map->start_code   = untagged_addr(prctl_map.start_code);
+     prctl_map->end_code     = untagged_addr(prctl_map.end_code);
+     prctl_map->start_data   = untagged_addr(prctl_map.start_data);
+     prctl_map->end_data     = untagged_addr(prctl_map.end_data);
+     prctl_map->start_brk    = untagged_addr(prctl_map.start_brk);
+     prctl_map->brk          = untagged_addr(prctl_map.brk);
+     prctl_map->start_stack  = untagged_addr(prctl_map.start_stack);
+     prctl_map->arg_start    = untagged_addr(prctl_map.arg_start);
+     prctl_map->arg_end      = untagged_addr(prctl_map.arg_end);
+     prctl_map->env_start    = untagged_addr(prctl_map.env_start);
+     prctl_map->env_end      = untagged_addr(prctl_map.env_end);

As the buildbot suggests, those -> should be . instead :) You might want to check your local build with CONFIG_CHECKPOINT_RESTORE=y.

Quoted 9 lines

kernel/sys.c +1 -0

+
      error = validate_prctl_map(&prctl_map);
      if (error)
              return error;

@@ -2106,6 +2118,8 @@ static int prctl_set_mm(int opt, unsigned long addr,
                            opt != PR_SET_MM_MAP_SIZE)))
              return -EINVAL;
 

kernel/sys.c static int prctl_set_mm(int opt, unsigned long addr, · line 2121

Quoted 1 line

kernel/sys.c +1 -0

+     addr = untagged_addr(addr);

This is a bit too coarse, addr is indeed used for find_vma() later on, but it is also used to access memory, by prctl_set_mm_mmap() and prctl_set_auxv().

Kevin

Quoted 4 lines

kernel/sys.c +1 -0

+
  #ifdef CONFIG_CHECKPOINT_RESTORE
      if (opt == PR_SET_MM_MAP || opt == PR_SET_MM_MAP_SIZE)
              return prctl_set_mm_map(opt, (const void __user *)addr, arg4);

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

prctl_set_mm() and prctl_set_mm_map() use provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in these functions.

Signed-off-by Andrey Konovalov <[email protected]>

---
  kernel/sys.c | 14 ++++++++++++++
  1 file changed, 14 insertions(+)

kernel/sys.c +1 -0

index 12df0e5434b8..8e56d87cc6db 100644
@@ -1993,6 +1993,18 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data
  	if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
  		return -EFAULT;
 
+	prctl_map->start_code	= untagged_addr(prctl_map.start_code);

kernel/sys.c +1 -0

+
  #ifdef CONFIG_CHECKPOINT_RESTORE
  	if (opt == PR_SET_MM_MAP || opt == PR_SET_MM_MAP_SIZE)
  		return prctl_set_mm_map(opt, (const void __user *)addr, arg4);

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

seq_print_user_ip() uses provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in this function.

Signed-off-by Andrey Konovalov <[email protected]>

---
 kernel/trace/trace_output.c |  5 +++--
 p                           | 45 +++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 p

kernel/trace/trace_output.c +3 -2

index 54373d93e251..6376bee93c84 100644
@@ -370,6 +370,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
 {
 	struct file *file = NULL;
 	unsigned long vmstart = 0;
+	unsigned long untagged_ip = untagged_addr(ip);
 	int ret = 1;
 
 	if (s->full)

@@ -379,7 +380,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
 		const struct vm_area_struct *vma;
 
 		down_read(&mm->mmap_sem);
-		vma = find_vma(mm, ip);
+		vma = find_vma(mm, untagged_ip);
 		if (vma) {
 			file = vma->vm_file;
 			vmstart = vma->vm_start;

@@ -388,7 +389,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
 			ret = trace_seq_path(s, &file->f_path);
 			if (ret)
 				trace_seq_printf(s, "[+0x%lx]",
-						 ip - vmstart);
+						 untagged_ip - vmstart);
 		}
 		up_read(&mm->mmap_sem);
 	}

p new file +3 -0

new file mode 100644
index 000000000000..9d6fa5386e55
@@ -0,0 +1,45 @@
+commit 1fa6fadf644859e8a6a8ecce258444b49be8c7ee
+Author: Andrey Konovalov <[email protected]>
+Date:   Mon Mar 4 17:20:32 2019 +0100

p new file +32 -0

+
+diff --git a/mm/kasan/init.c b/mm/kasan/init.c
+index 45a1b5e38e1e..fcaa1ca03175 100644
+--- a/mm/kasan/init.c
++++ b/mm/kasan/init.c
+@@ -42,7 +42,7 @@ static inline bool kasan_p4d_table(pgd_t pgd)
+ #else
+ static inline bool kasan_p4d_table(pgd_t pgd)
+ {
+-	return 0;
++	return false;
+ }
+ #endif
+ #if CONFIG_PGTABLE_LEVELS > 3
+@@ -54,7 +54,7 @@ static inline bool kasan_pud_table(p4d_t p4d)
+ #else
+ static inline bool kasan_pud_table(p4d_t p4d)
+ {
+-	return 0;
++	return false;
+ }
+ #endif
+ #if CONFIG_PGTABLE_LEVELS > 2
+@@ -66,7 +66,7 @@ static inline bool kasan_pmd_table(pud_t pud)
+ #else
+ static inline bool kasan_pmd_table(pud_t pud)
+ {
+-	return 0;
++	return false;
+ }
+ #endif
+ pte_t kasan_early_shadow_pte[PTRS_PER_PTE] __page_aligned_bss;

Quoted 59 lines · On Fri, 15 Mar 2019 20:51:34 +0100 Andrey Konovalov <[email protected]>…

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

seq_print_user_ip() uses provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in this function.

Signed-off-by Andrey Konovalov <[email protected]>

---
 kernel/trace/trace_output.c |  5 +++--
 p                           | 45 +++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 p

kernel/trace/trace_output.c +3 -2

index 54373d93e251..6376bee93c84 100644
@@ -370,6 +370,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
 {
      struct file *file = NULL;
      unsigned long vmstart = 0;
+     unsigned long untagged_ip = untagged_addr(ip);
      int ret = 1;
 
      if (s->full)

@@ -379,7 +380,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
              const struct vm_area_struct *vma;
 
              down_read(&mm->mmap_sem);
-             vma = find_vma(mm, ip);
+             vma = find_vma(mm, untagged_ip);
              if (vma) {
                      file = vma->vm_file;
                      vmstart = vma->vm_start;

@@ -388,7 +389,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
                      ret = trace_seq_path(s, &file->f_path);
                      if (ret)
                              trace_seq_printf(s, "[+0x%lx]",
-                                              ip - vmstart);
+                                              untagged_ip - vmstart);
              }
              up_read(&mm->mmap_sem);
      }

p new file +7 -0

new file mode 100644
index 000000000000..9d6fa5386e55
@@ -0,0 +1,45 @@
+commit 1fa6fadf644859e8a6a8ecce258444b49be8c7ee
+Author: Andrey Konovalov <[email protected]>
+Date:   Mon Mar 4 17:20:32 2019 +0100
+
+    kasan: fix coccinelle warnings in kasan_p*_table
+
+    kasan_p4d_table, kasan_pmd_table and kasan_pud_table are declared as

p

Quoted 6 lines

p new file +6 -0

+    returning bool, but return 0 instead of false, which produces a coccinelle
+    warning. Fix it.
+
+    Fixes: 0207df4fa1a8 ("kernel/memremap, kasan: make ZONE_DEVICE with work with KASAN")
+    Reported-by: kbuild test robot <[email protected]>
+    Signed-off-by: Andrey Konovalov <[email protected]>

Did you mean to append this commit to this patch?

-- Steve

Quoted 32 lines

p new file +32 -0

+
+diff --git a/mm/kasan/init.c b/mm/kasan/init.c
+index 45a1b5e38e1e..fcaa1ca03175 100644
+--- a/mm/kasan/init.c
++++ b/mm/kasan/init.c
+@@ -42,7 +42,7 @@ static inline bool kasan_p4d_table(pgd_t pgd)
+ #else
+ static inline bool kasan_p4d_table(pgd_t pgd)
+ {
+-    return 0;
++    return false;
+ }
+ #endif
+ #if CONFIG_PGTABLE_LEVELS > 3
+@@ -54,7 +54,7 @@ static inline bool kasan_pud_table(p4d_t p4d)
+ #else
+ static inline bool kasan_pud_table(p4d_t p4d)
+ {
+-    return 0;
++    return false;
+ }
+ #endif
+ #if CONFIG_PGTABLE_LEVELS > 2
+@@ -66,7 +66,7 @@ static inline bool kasan_pmd_table(pud_t pud)
+ #else
+ static inline bool kasan_pmd_table(pud_t pud)
+ {
+-    return 0;
++    return false;
+ }
+ #endif
+ pte_t kasan_early_shadow_pte[PTRS_PER_PTE] __page_aligned_bss;

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

Document the ABI changes in Documentation/arm64/tagged-pointers.txt.

Signed-off-by Andrey Konovalov <andreyknvl at google.com>

---
  Documentation/arm64/tagged-pointers.txt | 18 ++++++++----------
  1 file changed, 8 insertions(+), 10 deletions(-)

Documentation/arm64/tagged-pointers.txt +7 -5

index a25a99e82bb1..07fdddeacad0 100644
@@ -17,13 +17,15 @@ this byte for application use.
  Passing tagged addresses to the kernel
  --------------------------------------
 
-All interpretation of userspace memory addresses by the kernel assumes
-an address tag of 0x00.
+The kernel supports tags in pointer arguments (including pointers in
+structures) of syscalls, however such pointers must point to memory ranges
+obtained by anonymous mmap() or brk().
 
-This includes, but is not limited to, addresses found in:
+The kernel supports tags in user fault addresses. However the fault_address
+field in the sigcontext struct will contain an untagged address.
 
- - pointer arguments to system calls, including pointers in structures
-   passed to system calls,
+All other interpretations of userspace memory addresses by the kernel
+assume an address tag of 0x00, in particular:
 
   - the stack pointer (sp), e.g. when interpreting it to deliver a
     signal,

Documentation/arm64/tagged-pointers.txt +0 -0

  Programs maintaining a frame pointer and frame records that use non-zero
  address tags may suffer impaired or inaccurate debug and profiling

Quoted 38 lines · Andrey Konovalov

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

Document the ABI changes in Documentation/arm64/tagged-pointers.txt.

Signed-off-by Andrey Konovalov <[email protected]>

---
  Documentation/arm64/tagged-pointers.txt | 18 ++++++++----------
  1 file changed, 8 insertions(+), 10 deletions(-)

Documentation/arm64/tagged-pointers.txt +7 -5

index a25a99e82bb1..07fdddeacad0 100644
@@ -17,13 +17,15 @@ this byte for application use.
  Passing tagged addresses to the kernel
  --------------------------------------
 
-All interpretation of userspace memory addresses by the kernel assumes
-an address tag of 0x00.
+The kernel supports tags in pointer arguments (including pointers in
+structures) of syscalls, however such pointers must point to memory ranges
+obtained by anonymous mmap() or brk().
 
-This includes, but is not limited to, addresses found in:
+The kernel supports tags in user fault addresses. However the fault_address
+field in the sigcontext struct will contain an untagged address.
 
- - pointer arguments to system calls, including pointers in structures
-   passed to system calls,
+All other interpretations of userspace memory addresses by the kernel
+assume an address tag of 0x00, in particular:
 
   - the stack pointer (sp), e.g. when interpreting it to deliver a
     signal,

@@ -33,11 +35,7 @@ This includes, but is not limited to, addresses found in:
 

Documentation/arm64/tagged-pointers.txt This includes, but is not limited to, addresses found in: · line 38

Quoted 8 lines

Documentation/arm64/tagged-pointers.txt +1 -5

  Using non-zero address tags in any of these locations may result in an
  error code being returned, a (fatal) signal being raised, or other modes
-of failure.
-
-For these reasons, passing non-zero address tags to the kernel via
-system calls is forbidden, and using a non-zero address tag for sp is
-strongly discouraged.
+of failure. Using a non-zero address tag for sp is strongly discouraged.

I don't understand why we should keep such a limitation. For MTE, tagging SP is something we are definitely considering. This does bother userspace software in some rare cases, but I'm not sure in what way it bothers the kernel.

Kevin

Quoted 3 lines

Documentation/arm64/tagged-pointers.txt +0 -0

  Programs maintaining a frame pointer and frame records that use non-zero
  address tags may suffer impaired or inaccurate debug and profiling

This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

Document the ABI changes in Documentation/arm64/tagged-pointers.txt.

Signed-off-by Andrey Konovalov <[email protected]>

---
  Documentation/arm64/tagged-pointers.txt | 18 ++++++++----------
  1 file changed, 8 insertions(+), 10 deletions(-)

Documentation/arm64/tagged-pointers.txt +7 -5

index a25a99e82bb1..07fdddeacad0 100644
@@ -17,13 +17,15 @@ this byte for application use.
  Passing tagged addresses to the kernel
  --------------------------------------
 
-All interpretation of userspace memory addresses by the kernel assumes
-an address tag of 0x00.
+The kernel supports tags in pointer arguments (including pointers in
+structures) of syscalls, however such pointers must point to memory ranges
+obtained by anonymous mmap() or brk().
 
-This includes, but is not limited to, addresses found in:
+The kernel supports tags in user fault addresses. However the fault_address
+field in the sigcontext struct will contain an untagged address.
 
- - pointer arguments to system calls, including pointers in structures
-   passed to system calls,
+All other interpretations of userspace memory addresses by the kernel
+assume an address tag of 0x00, in particular:
 
   - the stack pointer (sp), e.g. when interpreting it to deliver a
     signal,

Documentation/arm64/tagged-pointers.txt +0 -0

  Programs maintaining a frame pointer and frame records that use non-zero
  address tags may suffer impaired or inaccurate debug and profiling

On arm64 the TCR_EL1.TBI0 bit has been always enabled hence the userspace (EL0) is allowed to set a non-zero value in the top byte but the resulting pointers are not allowed at the user-kernel syscall ABI boundary.

With the relaxed ABI proposed through this document, it is now possible to pass tagged pointers to the syscalls, when these pointers are in memory ranges obtained by an anonymous (MAP_ANONYMOUS) mmap() or brk().

This change in the ABI requires a mechanism to inform the userspace that such an option is available.

Specify and document the way in which AT_FLAGS can be used to advertise this feature to the userspace.

Cc Catalin Marinas <[email protected]>

Cc Will Deacon <[email protected]>

CC Andrey Konovalov <[email protected]>

Signed-off-by Vincenzo Frascino <[email protected]>

Squash with "arm64: Define Documentation/arm64/elf_at_flags.txt"

---
 Documentation/arm64/elf_at_flags.txt | 133 +++++++++++++++++++++++++++
 1 file changed, 133 insertions(+)
 create mode 100644 Documentation/arm64/elf_at_flags.txt

Documentation/arm64/elf_at_flags.txt new file +116 -0

new file mode 100644
index 000000000000..9b3494207c14
@@ -0,0 +1,133 @@
+ARM64 ELF AT_FLAGS
+==================
+
+This document describes the usage and semantics of AT_FLAGS on arm64.
+
+1. Introduction
+---------------
+
+AT_FLAGS is part of the Auxiliary Vector, contains the flags and it
+is set to zero by the kernel on arm64 unless one or more of the
+features detailed in paragraph 2 are present.
+
+The auxiliary vector can be accessed by the userspace using the
+getauxval() API provided by the C library.
+getauxval() returns an unsigned long and when a flag is present in
+the AT_FLAGS, the corresponding bit in the returned value is set to 1.
+
+The AT_FLAGS with a "defined semantics" on arm64 are exposed to the
+userspace via user API (uapi/asm/atflags.h).
+The AT_FLAGS bits with "undefined semantics" are set to zero by default.
+This means that the AT_FLAGS bits to which this document does not assign
+an explicit meaning are to be intended reserved for future use.
+The kernel will populate all such bits with zero until meanings are
+assigned to them. If and when meanings are assigned, it is guaranteed
+that they will not impact the functional operation of existing userspace
+software. Userspace software should ignore any AT_FLAGS bit whose meaning
+is not defined when the software is written.
+
+The userspace software can test for features by acquiring the AT_FLAGS
+entry of the auxiliary vector, and testing whether a relevant flag
+is set.
+
+Example of a userspace test function:
+
+bool feature_x_is_present(void)
+{
+       unsigned long at_flags = getauxval(AT_FLAGS);
+       if (at_flags & FEATURE_X)
+               return true;
+
+       return false;
+}
+
+Where the software relies on a feature advertised by AT_FLAGS, it
+must check that the feature is present before attempting to
+use it.
+
+2. Features exposed via AT_FLAGS
+--------------------------------
+
+bit[0]: ARM64_AT_FLAGS_SYSCALL_TBI
+
+    On arm64 the TCR_EL1.TBI0 bit has been always enabled on the arm64
+    kernel, hence the userspace (EL0) is allowed to set a non-zero value
+    in the top byte but the resulting pointers are not allowed at the
+    user-kernel syscall ABI boundary.
+    When bit[0] is set to 1 the kernel is advertising to the userspace
+    that a relaxed ABI is supported hence this type of pointers are now
+    allowed to be passed to the syscalls, when these pointers are in
+    memory ranges privately owned by a process and obtained by the
+    process in accordance with the definition of "valid tagged pointer"
+    in paragraph 3.
+    In these cases the tag is preserved as the pointer goes through the
+    kernel. Only when the kernel needs to check if a pointer is coming
+    from userspace an untag operation is required.
+
+3. ARM64_AT_FLAGS_SYSCALL_TBI
+-----------------------------
+
+From the kernel syscall interface prospective, we define, for the purposes
+of this document, a "valid tagged pointer" as a pointer that either it has
+a zero value set in the top byte or it has a non-zero value, it is in memory
+ranges privately owned by a userspace process and it is obtained in one of
+the following ways:
+  - mmap() done by the process itself, where either:
+    * flags = MAP_PRIVATE | MAP_ANONYMOUS
+    * flags = MAP_PRIVATE and the file descriptor refers to a regular
+      file or "/dev/zero"
+  - a mapping below sbrk(0) done by the process itself
+  - any memory mapped by the kernel in the process's address space during
+    creation and following the restrictions presented above (i.e. data, bss,
+    stack).
+
+When the ARM64_AT_FLAGS_SYSCALL_TBI flag is set by the kernel, the following
+behaviours are guaranteed by the ABI:
+
+  - Every current or newly introduced syscall can accept any valid tagged
+    pointers.
+
+  - If a non valid tagged pointer is passed to a syscall then the behaviour
+    is undefined.
+
+  - Every valid tagged pointer is expected to work as an untagged one.
+
+  - The kernel preserves any valid tagged pointers and returns them to the
+    userspace unchanged in all the cases except the ones documented in the
+    "Preserving tags" paragraph of tagged-pointers.txt.
+
+A definition of the meaning of tagged pointers on arm64 can be found in:
+Documentation/arm64/tagged-pointers.txt.
+
+Example of correct usage (pseudo-code) for a userspace application:
+
+bool arm64_syscall_tbi_is_present(void)
+{
+       unsigned long at_flags = getauxval(AT_FLAGS);
+       if (at_flags & ARM64_AT_FLAGS_SYSCALL_TBI)
+                       return true;
+
+       return false;
+}
+
+void main(void)
+{
+       char *addr = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE,
+                         MAP_ANONYMOUS, -1, 0);

Documentation/arm64/elf_at_flags.txt new file +7 -1

+
+       /* Write to a file */
+       write(fd, addr, sizeof(addr));
+
+       close(fd);
+}
+
--

2.21.0

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Quoted 19 lines · Vincenzo Frascino

Documentation/arm64/elf_at_flags.txt new file +19 -0

+Example of correct usage (pseudo-code) for a userspace application:
+
+bool arm64_syscall_tbi_is_present(void)
+{
+       unsigned long at_flags = getauxval(AT_FLAGS);
+       if (at_flags & ARM64_AT_FLAGS_SYSCALL_TBI)
+                       return true;
+
+       return false;
+}
+
+void main(void)
+{
+       char *addr = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE,
+                         MAP_ANONYMOUS, -1, 0);
+
+       int fd = open("test.txt", O_WRONLY);
+
+       /* Check if the relaxed ABI is supported */

Documentation/arm64/elf_at_flags.txt line 126

Quoted 6 lines

Documentation/arm64/elf_at_flags.txt new file +6 -0

+       if (arm64_syscall_tbi_is_present()) {
+               /* Add a tag to the pointer */
+               addr = tag_pointer(addr);
+       }
+
+       strcpy("Hello World\n", addr);

Nit: s/strcpy("Hello World\n", addr)/strcpy(addr, "Hello World\n")

Documentation/arm64/elf_at_flags.txt line 129

Quoted 3 lines

Documentation/arm64/elf_at_flags.txt new file +3 -0

+
+       /* Write to a file */
+       write(fd, addr, sizeof(addr));

On arm64 the TCR_EL1.TBI0 bit has been always enabled hence the userspace (EL0) is allowed to set a non-zero value in the top byte but the resulting pointers are not allowed at the user-kernel syscall ABI boundary.

With the relaxed ABI proposed through this document, it is now possible to pass tagged pointers to the syscalls, when these pointers are in memory ranges obtained by an anonymous (MAP_ANONYMOUS) mmap() or brk().

This change in the ABI requires a mechanism to inform the userspace that such an option is available.

Specify and document the way in which AT_FLAGS can be used to advertise this feature to the userspace.

Cc Catalin Marinas <[email protected]>

Cc Will Deacon <[email protected]>

CC Andrey Konovalov <[email protected]>

Signed-off-by Vincenzo Frascino <[email protected]>

Squash with "arm64: Define Documentation/arm64/elf_at_flags.txt"

---
  Documentation/arm64/elf_at_flags.txt | 133 +++++++++++++++++++++++++++
  1 file changed, 133 insertions(+)

create mode 100644 Documentation/arm64/elf_at_flags.txt

Documentation/arm64/elf_at_flags.txt new file +55 -0

new file mode 100644
index 000000000000..9b3494207c14
@@ -0,0 +1,133 @@
+ARM64 ELF AT_FLAGS
+==================
+
+This document describes the usage and semantics of AT_FLAGS on arm64.
+
+1. Introduction
+---------------
+
+AT_FLAGS is part of the Auxiliary Vector, contains the flags and it
+is set to zero by the kernel on arm64 unless one or more of the
+features detailed in paragraph 2 are present.
+
+The auxiliary vector can be accessed by the userspace using the
+getauxval() API provided by the C library.
+getauxval() returns an unsigned long and when a flag is present in
+the AT_FLAGS, the corresponding bit in the returned value is set to 1.
+
+The AT_FLAGS with a "defined semantics" on arm64 are exposed to the
+userspace via user API (uapi/asm/atflags.h).
+The AT_FLAGS bits with "undefined semantics" are set to zero by default.
+This means that the AT_FLAGS bits to which this document does not assign
+an explicit meaning are to be intended reserved for future use.
+The kernel will populate all such bits with zero until meanings are
+assigned to them. If and when meanings are assigned, it is guaranteed
+that they will not impact the functional operation of existing userspace
+software. Userspace software should ignore any AT_FLAGS bit whose meaning
+is not defined when the software is written.
+
+The userspace software can test for features by acquiring the AT_FLAGS
+entry of the auxiliary vector, and testing whether a relevant flag
+is set.
+
+Example of a userspace test function:
+
+bool feature_x_is_present(void)
+{
+	unsigned long at_flags = getauxval(AT_FLAGS);
+	if (at_flags & FEATURE_X)
+		return true;
+
+	return false;
+}
+
+Where the software relies on a feature advertised by AT_FLAGS, it
+must check that the feature is present before attempting to
+use it.
+
+2. Features exposed via AT_FLAGS
+--------------------------------
+
+bit[0]: ARM64_AT_FLAGS_SYSCALL_TBI
+
+    On arm64 the TCR_EL1.TBI0 bit has been always enabled on the arm64
+    kernel, hence the userspace (EL0) is allowed to set a non-zero value
+    in the top byte but the resulting pointers are not allowed at the

Documentation/arm64/elf_at_flags.txt new file +4 -0

+
+3. ARM64_AT_FLAGS_SYSCALL_TBI
+-----------------------------
+

Documentation/arm64/elf_at_flags.txt new file +51 -0

+
+When the ARM64_AT_FLAGS_SYSCALL_TBI flag is set by the kernel, the following
+behaviours are guaranteed by the ABI:
+
+  - Every current or newly introduced syscall can accept any valid tagged
+    pointers.
+
+  - If a non valid tagged pointer is passed to a syscall then the behaviour
+    is undefined.
+
+  - Every valid tagged pointer is expected to work as an untagged one.
+
+  - The kernel preserves any valid tagged pointers and returns them to the
+    userspace unchanged in all the cases except the ones documented in the
+    "Preserving tags" paragraph of tagged-pointers.txt.
+
+A definition of the meaning of tagged pointers on arm64 can be found in:
+Documentation/arm64/tagged-pointers.txt.
+
+Example of correct usage (pseudo-code) for a userspace application:
+
+bool arm64_syscall_tbi_is_present(void)
+{
+	unsigned long at_flags = getauxval(AT_FLAGS);
+	if (at_flags & ARM64_AT_FLAGS_SYSCALL_TBI)
+			return true;
+
+	return false;
+}
+
+void main(void)
+{
+	char *addr = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE,
+			  MAP_ANONYMOUS, -1, 0);
+
+	int fd = open("test.txt", O_WRONLY);
+
+	/* Check if the relaxed ABI is supported */
+	if (arm64_syscall_tbi_is_present()) {
+		/* Add a tag to the pointer */
+		addr = tag_pointer(addr);
+	}
+
+	strcpy("Hello World\n", addr);
+
+	/* Write to a file */
+	write(fd, addr, sizeof(addr));
+
+	close(fd);
+}
+

Quoted 16 lines · Vincenzo Frascino

+2. Features exposed via AT_FLAGS
+--------------------------------

Documentation/arm64/elf_at_flags.txt new file +14 -0

+
+bit[0]: ARM64_AT_FLAGS_SYSCALL_TBI
+
+    On arm64 the TCR_EL1.TBI0 bit has been always enabled on the arm64
+    kernel, hence the userspace (EL0) is allowed to set a non-zero value
+    in the top byte but the resulting pointers are not allowed at the
+    user-kernel syscall ABI boundary.
+    When bit[0] is set to 1 the kernel is advertising to the userspace
+    that a relaxed ABI is supported hence this type of pointers are now
+    allowed to be passed to the syscalls, when these pointers are in
+    memory ranges privately owned by a process and obtained by the
+    process in accordance with the definition of "valid tagged pointer"
+    in paragraph 3.
+    In these cases the tag is preserved as the pointer goes through the

Documentation/arm64/elf_at_flags.txt line 65

Quoted 2 lines

Documentation/arm64/elf_at_flags.txt new file +2 -0

+    kernel. Only when the kernel needs to check if a pointer is coming
+    from userspace an untag operation is required.

I would leave this last sentence out, because:
1. It is an implementation detail that doesn't impact this user ABI.
2. It is not entirely accurate: untagging the pointer may be needed for various kinds of address lookup (like finding the corresponding VMA), at which point the kernel usually already knows it is a userspace pointer.

Quoted 8 lines

+3. ARM64_AT_FLAGS_SYSCALL_TBI
+-----------------------------

Documentation/arm64/elf_at_flags.txt new file +6 -0

+
+From the kernel syscall interface prospective, we define, for the purposes
+of this document, a "valid tagged pointer" as a pointer that either it has
+a zero value set in the top byte or it has a non-zero value, it is in memory
+ranges privately owned by a userspace process and it is obtained in one of
+the following ways:

Documentation/arm64/elf_at_flags.txt line 79

Quoted 5 lines

Documentation/arm64/elf_at_flags.txt new file +5 -0

+  - mmap() done by the process itself, where either:
+    * flags = MAP_PRIVATE | MAP_ANONYMOUS
+    * flags = MAP_PRIVATE and the file descriptor refers to a regular
+      file or "/dev/zero"
+  - a mapping below sbrk(0) done by the process itself

I don't think that's very clear, this doesn't say how the mapping is obtained. Maybe "a mapping obtained by the process using brk() or sbrk()"?

Documentation/arm64/elf_at_flags.txt line 82

Quoted 3 lines

Documentation/arm64/elf_at_flags.txt new file +3 -0

+  - any memory mapped by the kernel in the process's address space during
+    creation and following the restrictions presented above (i.e. data, bss,
+    stack).

With the rules above, the code section is included as well. Replacing "i.e." with "e.g." would avoid having to list every single section (which is probably not a good idea anyway).

Quoted 16 lines · Kevin Brodsky

Quoted 15 lines · Vincenzo Frascino

+2. Features exposed via AT_FLAGS
+--------------------------------

Documentation/arm64/elf_at_flags.txt new file +13 -0

+
+bit[0]: ARM64_AT_FLAGS_SYSCALL_TBI
+
+    On arm64 the TCR_EL1.TBI0 bit has been always enabled on the arm64
+    kernel, hence the userspace (EL0) is allowed to set a non-zero value
+    in the top byte but the resulting pointers are not allowed at the
+    user-kernel syscall ABI boundary.
+    When bit[0] is set to 1 the kernel is advertising to the userspace
+    that a relaxed ABI is supported hence this type of pointers are now
+    allowed to be passed to the syscalls, when these pointers are in
+    memory ranges privately owned by a process and obtained by the
+    process in accordance with the definition of "valid tagged pointer"
+    in paragraph 3.

Quoted 8 lines

Documentation/arm64/elf_at_flags.txt line 65

Quoted 3 lines

Documentation/arm64/elf_at_flags.txt new file +3 -0

+    In these cases the tag is preserved as the pointer goes through the
+    kernel. Only when the kernel needs to check if a pointer is coming
+    from userspace an untag operation is required.

I would leave this last sentence out, because:
1. It is an implementation detail that doesn't impact this user ABI.
2. It is not entirely accurate: untagging the pointer may be needed for various kinds of address lookup (like finding the corresponding VMA), at which point the kernel usually already knows it is a userspace pointer.

I fully agree, the above paragraph should not be part of the user ABI document.

Quoted 7 lines

Quoted 7 lines

+3. ARM64_AT_FLAGS_SYSCALL_TBI
+-----------------------------

Documentation/arm64/elf_at_flags.txt new file +5 -0

+
+From the kernel syscall interface prospective, we define, for the purposes
+of this document, a "valid tagged pointer" as a pointer that either it has
+a zero value set in the top byte or it has a non-zero value, it is in memory
+ranges privately owned by a userspace process and it is obtained in one of

Quoted 8 lines

Documentation/arm64/elf_at_flags.txt line 79

Quoted 6 lines

Documentation/arm64/elf_at_flags.txt new file +6 -0

+the following ways:
+  - mmap() done by the process itself, where either:
+    * flags = MAP_PRIVATE | MAP_ANONYMOUS
+    * flags = MAP_PRIVATE and the file descriptor refers to a regular
+      file or "/dev/zero"
+  - a mapping below sbrk(0) done by the process itself

I don't think that's very clear, this doesn't say how the mapping is obtained. Maybe "a mapping obtained by the process using brk() or sbrk()"?

I think what we mean here is anything in the "[heap]" section as per /proc/*/maps (in the kernel this would be start_brk to brk).

Quoted 6 lines

Documentation/arm64/elf_at_flags.txt line 82

Quoted 3 lines

Documentation/arm64/elf_at_flags.txt new file +3 -0

+  - any memory mapped by the kernel in the process's address space during
+    creation and following the restrictions presented above (i.e. data, bss,
+    stack).

With the rules above, the code section is included as well. Replacing "i.e." with "e.g." would avoid having to list every single section (which is probably not a good idea anyway).

We could mention [stack] explicitly as that's documented in the Documentation/filesystems/proc.txt and it's likely considered ABI already.

The code section is MAP_PRIVATE, and can be done by the dynamic loader (user process), so it falls under the mmap() rules listed above. I guess we could simply drop "done by the process itself" here and allow MAP_PRIVATE|MAP_ANONYMOUS or MAP_PRIVATE of regular file. This would cover the [heap] and [stack] and we won't have to debate the brk() case at all.

We probably mention somewhere (or we should in the tagged pointers doc) that we don't support tagged PC.