Skip to content

Backport subject : Userspace pointer masking and tagged address ABI#336

Open
fangyu0809 wants to merge 10 commits into
RVCK-Project:rvck-6.6from
fangyu0809:rvck-6.6
Open

Backport subject : Userspace pointer masking and tagged address ABI#336
fangyu0809 wants to merge 10 commits into
RVCK-Project:rvck-6.6from
fangyu0809:rvck-6.6

Conversation

@fangyu0809

Copy link
Copy Markdown

自测试:
1, pointer_masking self test:
Testing available PMLEN values
ok 1 PMLEN=0 PR_GET_TAGGED_ADDR_CTRL
ok 2 PMLEN=0 constraint
ok 3 PMLEN=0 validity
ok 4 PMLEN=1 PR_GET_TAGGED_ADDR_CTRL
ok 5 PMLEN=1 constraint
ok 6 PMLEN=1 validity
ok 7 PMLEN=2 PR_GET_TAGGED_ADDR_CTRL
ok 8 PMLEN=2 constraint
ok 9 PMLEN=2 validity
...
Testing tagged address ABI
ok 59 PMLEN=0 tagged address ABI
ok 60 PMLEN=7 tagged address ABI
ok 61 PMLEN=16 tagged address ABI
Totals: pass:61 fail:0 xfail:0 xpass:0 skip:0 error:0

2,kvm-get-reg-list smnpm
smnpm: PASS
3,kvm-get-reg-list ssnpm
ssnpm: PASS

issue: #335

SiFiveHolland and others added 10 commits July 16, 2026 10:55
mainline inclusion
from Linux 6.13-rc1
commit 29eedc7
category: feature
bugzilla: RVCK-Project#335

--------------------------------

Pointer masking is controlled via a two-bit PMM field, which appears in
various CSRs depending on which extensions are implemented. Smmpm adds
the field to mseccfg; Smnpm adds the field to menvcfg; Ssnpm adds the
field to senvcfg. If the H extension is implemented, Ssnpm also defines
henvcfg.PMM and hstatus.HUPMM.

Reviewed-by: Charlie Jenkins <charlie@rivosinc.com>
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.13-rc1
commit 09d6775
category: feature
bugzilla: RVCK-Project#335

--------------------------------

RISC-V supports pointer masking with a variable number of tag bits
(which is called "PMLEN" in the specification) and which is configured
at the next higher privilege level.

Wire up the PR_SET_TAGGED_ADDR_CTRL and PR_GET_TAGGED_ADDR_CTRL prctls
so userspace can request a lower bound on the number of tag bits and
determine the actual number of tag bits. As with arm64's
PR_TAGGED_ADDR_ENABLE, the pointer masking configuration is
thread-scoped, inherited on clone() and fork() and cleared on execve().

Reviewed-by: Charlie Jenkins <charlie@rivosinc.com>
Tested-by: Charlie Jenkins <charlie@rivosinc.com>
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.13-rc1
commit 2e17430
category: feature
bugzilla: RVCK-Project#335

--------------------------------

When pointer masking is enabled for userspace, the kernel can accept
tagged pointers as arguments to some system calls. Allow this by
untagging the pointers in access_ok() and the uaccess routines. The
uaccess routines must peform untagging in software because U-mode and
S-mode have entirely separate pointer masking configurations. In fact,
hardware may not even implement pointer masking for S-mode.

Since the number of tag bits is variable, untagged_addr_remote() needs
to know what PMLEN to use for the remote mm. Therefore, the pointer
masking mode must be the same for all threads sharing an mm. Enforce
this with a lock flag in the mm context, as x86 does for LAM. The flag
gets reset in init_new_context() during fork(), as the new mm is no
longer multithreaded.

Reviewed-by: Charlie Jenkins <charlie@rivosinc.com>
Tested-by: Charlie Jenkins <charlie@rivosinc.com>
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.13-rc1
commit 7884448
category: feature
bugzilla: RVCK-Project#335

--------------------------------

This allows a tracer to control the ABI of the tracee, as on arm64.

Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.13-rc1
commit 7470b5a
category: feature
bugzilla: RVCK-Project#335

--------------------------------

This test covers the behavior of the PR_SET_TAGGED_ADDR_CTRL and
PR_GET_TAGGED_ADDR_CTRL prctl() operations, their effects on the
userspace ABI, and their effects on the system call ABI.

Reviewed-by: Charlie Jenkins <charlie@rivosinc.com>
Tested-by: Charlie Jenkins <charlie@rivosinc.com>
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.13-rc1
commit 036a140
category: feature
bugzilla: RVCK-Project#335

--------------------------------

Add testing for the pointer masking extensions exposed to KVM guests.

Reviewed-by: Anup Patel <anup@brainfault.org>
Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.9-rc1
commit 9dc3041
category: feature
bugzilla: RVCK-Project#335

--------------------------------

There is some code that detects compat mode into a task by checking the
flag directly, and other code that check using the helper is_compat_task().

Since the helper already exists, use it instead of checking the flags
directly.

Signed-off-by: Leonardo Bras <leobras@redhat.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.9-rc1
commit 4c0b5a4
category: feature
bugzilla: RVCK-Project#335

--------------------------------

Currently several places will test for CONFIG_COMPAT before testing
is_compat_task(), probably in order to avoid a run-time test into the task
structure.

Since is_compat_task() is an inlined function, it would be helpful to add a
compile-time test of CONFIG_COMPAT, making sure it always returns zero when
the option is not enabled during the kernel build.

With this, the compiler is able to understand in build-time that
is_compat_task() will always return 0, and optimize-out some of the extra
code introduced by the option.

This will also allow removing a lot #ifdefs that were introduced, and make
the code more clean.

Signed-off-by: Leonardo Bras <leobras@redhat.com>
Reviewed-by: Guo Ren <guoren@kernel.org>
Reviewed-by: Andy Chiu <andy.chiu@sifive.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.9-rc1
commit 5917ea1
category: feature
bugzilla: RVCK-Project#335

--------------------------------

task_user_regset_view() makes use of a function very similar to
is_compat_task(), but pointing to a any thread.

In arm64 asm/compat.h there is a function very similar to that:
is_compat_thread(struct thread_info *thread)

Copy this function to riscv asm/compat.h and make use of it into
task_user_regset_view().

Also, introduce a compile-time test for CONFIG_COMPAT and simplify the
function code by removing the #ifdef.

Signed-off-by: Leonardo Bras <leobras@redhat.com>
Reviewed-by: Guo Ren <guoren@kernel.org>
Reviewed-by: Andy Chiu <andy.chiu@sifive.com>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
mainline inclusion
from Linux 6.9-rc1
commit 2a8986f
category: feature
bugzilla: RVCK-Project#335

--------------------------------

In order to have all task compat bit access directly in compat.h, introduce
set_compat_task() to set/reset those when needed.

Also, since it's only used on an if/else scenario, simplify the macro using
it.

Signed-off-by: Leonardo Bras <leobras@redhat.com>
Reviewed-by: Guo Ren <guoren@kernel.org>
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
@github-actions

github-actions Bot commented Jul 17, 2026

Copy link
Copy Markdown

开始测试 log: https://github.com/RVCK-Project/rvck/actions/runs/29570976688

参数解析结果
args value
repository RVCK-Project/rvck
head ref pull/336/head
base ref rvck-6.6
LAVA repo RVCK-Project/lavaci
LAVA hardware ['qemu']
LAVA Testcase path lava-testcases/common-test/ltp/ltp.yaml
need run job kunit-test,kernel-build,check-patch,lava-trigger

测试完成

详细结果:
check result
kunit-test success
kernel-build success
check-patch success
lava-trigger-qemu success
lava-trigger-sg2042 skipped
lava-trigger-k1 skipped
lava-trigger-lpi4a skipped

Kunit Test Result

[09:47:57] Testing complete. Ran 482 tests: passed: 465, skipped: 17

Kernel Build Result

Check Patch Result

Total Errors 0
Total Warnings 19

LAVA Check (qemu)

args value
testcase_repo RVCK-Project/lavaci
lava_template lava-job-template/qemu/qemu-ltp.yaml
testcase_path lava-testcases/common-test/ltp/ltp.yaml
kernel_download_url http://10.30.190.110/openEuler-RISC-V/RVCK/OERV-RVCI/RVCK-Project/rvck/336_29570976688_1/Image
initramfs_download_url http://10.30.190.110/openEuler-RISC-V/RVCK/OERV-RVCI/RVCK-Project/rvck/336_29570976688_1/initramfs.img
rootfs_download_url https://fast-mirror.isrc.ac.cn/openeuler-sig-riscv/openEuler-RISC-V/RVCK/openEuler24.03-LTS-SP1/openeuler-rootfs.img.zst
testcase_ref main
testitem_name RVCK-Project_rvck_pull_request_target_336__common-test_qemu

result: Lava check done!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants