Re: [RFC] <sys/tagged-address.h>: An API for tagged address

["H.J. Lu" <hjl.tools@gmail.com>]

On Mon, Feb 22, 2021 at 12:28 AM Szabolcs Nagy <szabolcs.nagy@arm.com> wrote:
>
> The 02/18/2021 14:32, H.J. Lu wrote:
> >
> > We are working to enable LAM in glibc and GCC (HWASAN).
> >
> > 0. LAM is disabled when the process starts.
> > 1. Define GNU property markers for LAM compatibility.
> > 2. Update ld.so to support LAM.
> > 3. Make libc.so LAM compatible (memmove).
>
> if pointers to the same object always have the same tag,
> then memmove should work without changes i think.

string/memmove.c has

  /* This test makes the forward copying code be used whenever possible.
     Reduces the working set.  */
  if (dstp - srcp >= len) /* *Unsigned* compare!  */

This doesn't work when pointers have tags.

char *
inhibit_loop_to_libcall
simple_memmove (char *dst, const char *src, size_t n)
{
  char *ret = dst;
  if (src < dst)
    {
      dst += n;
      src += n;
      while (n--)
*--dst = *--src;
    }
  else
    while (n--)
      *dst++ = *src++;
  return ret;
}

has the same issue.

> if such pointers can have different tags then all pointer
> comparisions are problematic, not just memmove.

We haven't found other pointer usages in glibc which are
incompatible with tags.

> > 4. Provide an API to enable LAM.
> >
> > We noticed a few issues:
> >
> > 1. HWASAN should use the glibc API to enable tagged address
> > since glibc must track the tagged address mask.
>
> how does that mask work?
> is it possible to set it to different values or just on/off?

It is a bit mask of uintptr_t.  The default is (uintptr_t) -1.

#ifdef __GNUC__
/* A mask for constant address BITS used in address translation.  */
# define TAGGED_ADDRESS_MASK(BITS) \
  (__extension__ \
    ({ \
       _Static_assert (TAGGED_ADDRESS_VALID_BITS (BITS), \
       "Tagged address bits must be valid"); \
       (((uintptr_t) 1) << (BITS)) - 1; \
     }))
#endif

> > 2. set_tagged_address_mask shouldn't be allowed after
> > pthread_create is called.
>
> such api breaks software composability.
> i don't have a good solution (other than libc doing an early
> decision on its own).

How does it work with HWASAN?

> > 3. After set_tagged_address_mask is called, can it be called
> > again to change tagged address mask.
>
> after tagged pointers escape it is unlikely that changing
> settings works.
>


-- 
H.J.