[v7,0/1] RFC: Add <sys/tagged-address.h>

  Changes in v7:

1. Move set_translated_address_mask to libc_nonshared.a.

Changes in v6:

1. Update and simplify the API by only exporting:

/* Set the mask for address bits used in address translation.  Return 0
   on success.  Return -1 on error.  */
extern int set_translated_address_mask (uintptr_t __mask);

/* Non-zero if constant address BITS is a valid tagged address bits.  */
#define TRANSLATED_ADDRESS_VALID_BITS(BITS)

/* A mask for constant address BITS used in address translation.  */
#define TRANSLATED_ADDRESS_MASK(BITS)

2. Properly use _Static_assert for C and static_assert for C++.

Changes in v5:

Add restrictions:

1. All bits between 0 and N - 1, where N is the number of tagged address
bits, are used in address translation.
2. All pointers participating in a pointer arithmetic operation should have
the same tag if they point to the same memory object so that pointer
equality operation can be performed on tagged pointers.

Changes in v4:

1. Document that the zero return value from get_tagged_address_bits
indicates that tag bits are not the highest bits in address.
2. Document that the zero value of TAGGED_ADDRESS_MASK indicates the
invalid address mask.
3. Add <bits/tagged-address-mask.h> to provide TAGGED_ADDRESS_MASK.
4. Add C++ support to TAGGED_ADDRESS_MASK.

Changes in v3:

1. set_tagged_address_mask can be only called once before main.
2. Add more tests.

---
By default, the number of the address bits used in address translation
is the number of address bits.  But it can be changed by ARM Top-byte
Ignore (TBI) or Intel Linear Address Masking (LAM).

<sys/tagged-address.h> provides an API for tagged address manipulation.

H.J. Lu (1):
  <sys/tagged-address.h>: An API for tagged address

 NEWS                                    |  2 +
 bits/tagged-address-mask.h              | 47 +++++++++++++++++++++
 bits/tagged-address-valid-bits.h        | 28 +++++++++++++
 csu/libc-start.c                        |  3 ++
 elf/dl-support.c                        |  5 +++
 include/sys/tagged-address.h            | 19 +++++++++
 manual/Makefile                         |  3 +-
 manual/ctype.texi                       |  2 +-
 manual/memory.texi                      |  2 +-
 manual/tagged-address.texi              | 48 +++++++++++++++++++++
 misc/Makefile                           | 48 ++++++++++++++++++---
 misc/set-translated-address-mask.c      | 49 ++++++++++++++++++++++
 misc/sys/tagged-address.h               | 33 +++++++++++++++
 misc/tagged-address.c                   | 50 ++++++++++++++++++++++
 misc/tst-tagged-address-1-static.c      |  1 +
 misc/tst-tagged-address-1.c             | 55 +++++++++++++++++++++++++
 misc/tst-tagged-address-2-static.c      |  1 +
 misc/tst-tagged-address-2.c             | 45 ++++++++++++++++++++
 misc/tst-tagged-address-3-static.c      |  1 +
 misc/tst-tagged-address-3.c             | 48 +++++++++++++++++++++
 misc/tst-tagged-address-4-static.c      |  1 +
 misc/tst-tagged-address-4.c             | 36 ++++++++++++++++
 misc/tst-tagged-address-5.c             | 25 +++++++++++
 misc/tst-tagged-address-6.c             | 34 +++++++++++++++
 misc/tst-tagged-address-7.c             | 41 ++++++++++++++++++
 misc/tst-tagged-address-mod-5.c         | 47 +++++++++++++++++++++
 misc/tst-tagged-address-mod-6.c         | 34 +++++++++++++++
 misc/tst-tagged-address-mod-7.c         | 35 ++++++++++++++++
 sysdeps/generic/inline-tagged-address.h | 43 +++++++++++++++++++
 sysdeps/generic/ldsodefs.h              |  4 ++
 30 files changed, 782 insertions(+), 8 deletions(-)
 create mode 100644 bits/tagged-address-mask.h
 create mode 100644 bits/tagged-address-valid-bits.h
 create mode 100644 include/sys/tagged-address.h
 create mode 100644 manual/tagged-address.texi
 create mode 100644 misc/set-translated-address-mask.c
 create mode 100644 misc/sys/tagged-address.h
 create mode 100644 misc/tagged-address.c
 create mode 100644 misc/tst-tagged-address-1-static.c
 create mode 100644 misc/tst-tagged-address-1.c
 create mode 100644 misc/tst-tagged-address-2-static.c
 create mode 100644 misc/tst-tagged-address-2.c
 create mode 100644 misc/tst-tagged-address-3-static.c
 create mode 100644 misc/tst-tagged-address-3.c
 create mode 100644 misc/tst-tagged-address-4-static.c
 create mode 100644 misc/tst-tagged-address-4.c
 create mode 100644 misc/tst-tagged-address-5.c
 create mode 100644 misc/tst-tagged-address-6.c
 create mode 100644 misc/tst-tagged-address-7.c
 create mode 100644 misc/tst-tagged-address-mod-5.c
 create mode 100644 misc/tst-tagged-address-mod-6.c
 create mode 100644 misc/tst-tagged-address-mod-7.c
 create mode 100644 sysdeps/generic/inline-tagged-address.h
  

On Fri, 24 Sep 2021, H.J. Lu via Libc-alpha wrote:

> Changes in v7:
> 
> 1. Move set_translated_address_mask to libc_nonshared.a.

Code in *_nonshared.a or crt*.o should include the LGPL exception wording:

   In addition to the permissions in the GNU Lesser General Public
   License, the Free Software Foundation gives you unlimited
   permission to link the compiled version of this file with other
   programs, and to distribute those programs without any restriction
   coming from the use of this file. (The GNU Lesser General Public
   License restrictions do apply in other respects; for example, they
   cover modification of the file, and distribution when not linked
   into another program.)

   Note that people who make modified versions of this file are not
   obligated to grant this special exception for their modified
   versions; it is their choice whether to do so. The GNU Lesser
   General Public License gives permission to release a modified
   version without this exception; this exception also makes it
   possible to release a modified version which carries forward this
   exception.

(The point being that people linking with glibc should be able to meet 
their LGPL obligations by linking dynamically, without also needing to 
provide a way to relink with modified versions of the *_nonshared.a code.)

Presumably when we get DCO contributions to such files we also need to 
adjust the exception wording accordingly regarding who gives the above 
permission.
  

On Fri, Sep 24, 2021 at 11:08 AM Joseph Myers <joseph@codesourcery.com> wrote:
>
> On Fri, 24 Sep 2021, H.J. Lu via Libc-alpha wrote:
>
> > Changes in v7:
> >
> > 1. Move set_translated_address_mask to libc_nonshared.a.
>
> Code in *_nonshared.a or crt*.o should include the LGPL exception wording:
>
>    In addition to the permissions in the GNU Lesser General Public
>    License, the Free Software Foundation gives you unlimited
>    permission to link the compiled version of this file with other
>    programs, and to distribute those programs without any restriction
>    coming from the use of this file. (The GNU Lesser General Public
>    License restrictions do apply in other respects; for example, they
>    cover modification of the file, and distribution when not linked
>    into another program.)
>
>    Note that people who make modified versions of this file are not
>    obligated to grant this special exception for their modified
>    versions; it is their choice whether to do so. The GNU Lesser
>    General Public License gives permission to release a modified
>    version without this exception; this exception also makes it
>    possible to release a modified version which carries forward this
>    exception.
>
> (The point being that people linking with glibc should be able to meet
> their LGPL obligations by linking dynamically, without also needing to
> provide a way to relink with modified versions of the *_nonshared.a code.)
>
> Presumably when we get DCO contributions to such files we also need to
> adjust the exception wording accordingly regarding who gives the above
> permission.
>
> --
> Joseph S. Myers
> joseph@codesourcery.com

I added the following change to set-translated-address-mask.c:

@@ -6,6 +6,15 @@
    License as published by the Free Software Foundation; either
    version 2.1 of the License, or (at your option) any later version.

+   In addition to the permissions in the GNU Lesser General Public
+   License, the Free Software Foundation gives you unlimited
+   permission to link the compiled version of this file with other
+   programs, and to distribute those programs without any restriction
+   coming from the use of this file.  (The Lesser General Public
+   License restrictions do apply in other respects; for example, they
+   cover modification of the file, and distribution when not linked
+   into another program.)
+
    The GNU C Library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  

On Fri, 24 Sep 2021, H.J. Lu via Libc-alpha wrote:

> >    In addition to the permissions in the GNU Lesser General Public
> >    License, the Free Software Foundation gives you unlimited
> >    permission to link the compiled version of this file with other
> >    programs, and to distribute those programs without any restriction
> >    coming from the use of this file. (The GNU Lesser General Public
> >    License restrictions do apply in other respects; for example, they
> >    cover modification of the file, and distribution when not linked
> >    into another program.)
> >
> >    Note that people who make modified versions of this file are not
> >    obligated to grant this special exception for their modified
> >    versions; it is their choice whether to do so. The GNU Lesser
> >    General Public License gives permission to release a modified
> >    version without this exception; this exception also makes it
> >    possible to release a modified version which carries forward this
> >    exception.

> I added the following change to set-translated-address-mask.c:
> 
> @@ -6,6 +6,15 @@
>     License as published by the Free Software Foundation; either
>     version 2.1 of the License, or (at your option) any later version.
> 
> +   In addition to the permissions in the GNU Lesser General Public
> +   License, the Free Software Foundation gives you unlimited
> +   permission to link the compiled version of this file with other
> +   programs, and to distribute those programs without any restriction
> +   coming from the use of this file.  (The Lesser General Public
> +   License restrictions do apply in other respects; for example, they
> +   cover modification of the file, and distribution when not linked
> +   into another program.)

It's supposed to be both paragraphs quoted above, not just one.
  

On Fri, Sep 24, 2021 at 11:53 AM Joseph Myers <joseph@codesourcery.com> wrote:
>
> On Fri, 24 Sep 2021, H.J. Lu via Libc-alpha wrote:
>
> > >    In addition to the permissions in the GNU Lesser General Public
> > >    License, the Free Software Foundation gives you unlimited
> > >    permission to link the compiled version of this file with other
> > >    programs, and to distribute those programs without any restriction
> > >    coming from the use of this file. (The GNU Lesser General Public
> > >    License restrictions do apply in other respects; for example, they
> > >    cover modification of the file, and distribution when not linked
> > >    into another program.)
> > >
> > >    Note that people who make modified versions of this file are not
> > >    obligated to grant this special exception for their modified
> > >    versions; it is their choice whether to do so. The GNU Lesser
> > >    General Public License gives permission to release a modified
> > >    version without this exception; this exception also makes it
> > >    possible to release a modified version which carries forward this
> > >    exception.
>
> > I added the following change to set-translated-address-mask.c:
> >
> > @@ -6,6 +6,15 @@
> >     License as published by the Free Software Foundation; either
> >     version 2.1 of the License, or (at your option) any later version.
> >
> > +   In addition to the permissions in the GNU Lesser General Public
> > +   License, the Free Software Foundation gives you unlimited
> > +   permission to link the compiled version of this file with other
> > +   programs, and to distribute those programs without any restriction
> > +   coming from the use of this file.  (The Lesser General Public
> > +   License restrictions do apply in other respects; for example, they
> > +   cover modification of the file, and distribution when not linked
> > +   into another program.)
>
> It's supposed to be both paragraphs quoted above, not just one.
>
> --
> Joseph S. Myers
> joseph@codesourcery.com

Here is the full text:

/* Copyright (C) 2021 Free Software Foundation, Inc.
   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.

   In addition to the permissions in the GNU Lesser General Public
   License, the Free Software Foundation gives you unlimited
   permission to link the compiled version of this file with other
   programs, and to distribute those programs without any restriction
   coming from the use of this file.  (The Lesser General Public
   License restrictions do apply in other respects; for example, they
   cover modification of the file, and distribution when not linked
   into another program.)

   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public
   License along with the GNU C Library; if not, see
   <https://www.gnu.org/licenses/>.  */

Does it look OK? If not, please attach the full text in your reply.

Thanks.
  

On Fri, 24 Sep 2021, H.J. Lu via Libc-alpha wrote:

> Here is the full text:
> 
> /* Copyright (C) 2021 Free Software Foundation, Inc.
>    This file is part of the GNU C Library.
> 
>    The GNU C Library is free software; you can redistribute it and/or
>    modify it under the terms of the GNU Lesser General Public
>    License as published by the Free Software Foundation; either
>    version 2.1 of the License, or (at your option) any later version.
> 
>    In addition to the permissions in the GNU Lesser General Public
>    License, the Free Software Foundation gives you unlimited
>    permission to link the compiled version of this file with other
>    programs, and to distribute those programs without any restriction
>    coming from the use of this file.  (The Lesser General Public
>    License restrictions do apply in other respects; for example, they
>    cover modification of the file, and distribution when not linked
>    into another program.)
> 
>    The GNU C Library is distributed in the hope that it will be useful,
>    but WITHOUT ANY WARRANTY; without even the implied warranty of
>    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
>    Lesser General Public License for more details.
> 
>    You should have received a copy of the GNU Lesser General Public
>    License along with the GNU C Library; if not, see
>    <https://www.gnu.org/licenses/>.  */
> 
> Does it look OK? If not, please attach the full text in your reply.

See stdlib/atexit.c, for example.  You're missing the "Note that people 
who make modified versions of this file" paragraph.
  

On Fri, Sep 24, 2021 at 12:35 PM Joseph Myers <joseph@codesourcery.com> wrote:
>
> On Fri, 24 Sep 2021, H.J. Lu via Libc-alpha wrote:
>
> > Here is the full text:
> >
> > /* Copyright (C) 2021 Free Software Foundation, Inc.
> >    This file is part of the GNU C Library.
> >
> >    The GNU C Library is free software; you can redistribute it and/or
> >    modify it under the terms of the GNU Lesser General Public
> >    License as published by the Free Software Foundation; either
> >    version 2.1 of the License, or (at your option) any later version.
> >
> >    In addition to the permissions in the GNU Lesser General Public
> >    License, the Free Software Foundation gives you unlimited
> >    permission to link the compiled version of this file with other
> >    programs, and to distribute those programs without any restriction
> >    coming from the use of this file.  (The Lesser General Public
> >    License restrictions do apply in other respects; for example, they
> >    cover modification of the file, and distribution when not linked
> >    into another program.)
> >
> >    The GNU C Library is distributed in the hope that it will be useful,
> >    but WITHOUT ANY WARRANTY; without even the implied warranty of
> >    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> >    Lesser General Public License for more details.
> >
> >    You should have received a copy of the GNU Lesser General Public
> >    License along with the GNU C Library; if not, see
> >    <https://www.gnu.org/licenses/>.  */
> >
> > Does it look OK? If not, please attach the full text in your reply.
>
> See stdlib/atexit.c, for example.  You're missing the "Note that people
> who make modified versions of this file" paragraph.
>

Here is the updated full text:

/* Copyright (C) 2021 Free Software Foundation, Inc.
   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.

   In addition to the permissions in the GNU Lesser General Public
   License, the Free Software Foundation gives you unlimited
   permission to link the compiled version of this file with other
   programs, and to distribute those programs without any restriction
   coming from the use of this file.  (The GNU Lesser General Public
   License restrictions do apply in other respects; for example, they
   cover modification of the file, and distribution when not linked
   into another program.)

   Note that people who make modified versions of this file are not
   obligated to grant this special exception for their modified
   versions; it is their choice whether to do so. The GNU Lesser
   General Public License gives permission to release a modified
   version without this exception; this exception also makes it
   possible to release a modified version which carries forward this
   exception.

   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public
   License along with the GNU C Library; if not, see
   <https://www.gnu.org/licenses/>.  */

Thanks.
  

* H. J. Lu:

> By default, the number of the address bits used in address translation
> is the number of address bits.  But it can be changed by ARM Top-byte
> Ignore (TBI) or Intel Linear Address Masking (LAM).
>
> <sys/tagged-address.h> provides an API for tagged address manipulation.

H.J.,

we had an off-list discussion regarding this, and I want to double-check
if my recollection of the conclusion is correct.

Basically, we said that we would try to enable HWSAN on x86-64 as well
(using Intel LAM) *without* glibc changes or a new ABI.  Once we have a
better understanding of how address tagging is used/could be used by
applications, we plan to define a general-purpose programming interface
for it.

Thanks,
Florian
  

On Mon, Nov 15, 2021 at 5:34 AM Florian Weimer <fweimer@redhat.com> wrote:
>
> * H. J. Lu:
>
> > By default, the number of the address bits used in address translation
> > is the number of address bits.  But it can be changed by ARM Top-byte
> > Ignore (TBI) or Intel Linear Address Masking (LAM).
> >
> > <sys/tagged-address.h> provides an API for tagged address manipulation.
>
> H.J.,
>
> we had an off-list discussion regarding this, and I want to double-check
> if my recollection of the conclusion is correct.
>
> Basically, we said that we would try to enable HWSAN on x86-64 as well
> (using Intel LAM) *without* glibc changes or a new ABI.  Once we have a
> better understanding of how address tagging is used/could be used by
> applications, we plan to define a general-purpose programming interface
> for it.

I withdrew this patch.

My current LAM patch is

https://gitlab.com/x86-glibc/glibc/-/commit/9d8fb211169fe677d3feca74aef5e87595f934ef

I will submit it after the LAM kernel interface is finalized.