Named address spaces on x86 GNU/Linux

Named address spaces on x86 GNU/Linux

[Florian Weimer via Libc-alpha]

The x86-64 architecture supports two instruction prefixes, SEGFS and
SEGGS that apply an additional offset to memory operands.  The offset
lives in a special register that is accessible to the kernel only
(historically).

On GNU/Linux, SEGFS is used to implement the thread pointer, to avoid
dedicating a general-purpose register to it.  At address zero with the
SEGFS prefix, the offset itself is stored so that userspace can read it
without having to call into the kernel.  So the SEGFS null pointer is a
valid address, and so are some bytes after it (depending on TCB layout,
some of which is specified by the ABI or is part of the de-facto ABI
used by GCC).

GCC 12 has started warning on __seg_fs null pointer arithmetic.  In
glibc, we use this construct:

  *(struct pthread *__seg_fs *) offsetof (struct pthread, header.self)

And this is now causing build failures due to -Werror.

It's been suggested that I should prove that these warnings are invalid
under the N1275 document referenced in the GCC manual.

However, I think N1275 is not actually implemented by GCC on x86-64.
The address spaces are treated as disjoint by the front end.  That is,
this

int *
f (int __seg_fs *q)
{
  return (int *) q;
}

results in

| warning: cast to generic address space pointer from disjoint __seg_fs
|   address space pointer

But I would argue that this is not correct under the N1275 rules because
the address spaces are overlapping in practice.  I assume the CPU wraps
around address arithmetic, which would make them completely equivalent.

The optimizers appear to treat the address spaces as overlapping, as
expected.  In this,

int
f(int *p, int __seg_fs *q)
{
  *p = 1;
  *q = 2;
  return *p;
}

the read in the return statement is not optimized away.

I have trouble deriving from N1275 if pointer casts are supposed to
apply offsets or perform some other sort of address translation to
produce a pointer to the same object.  The GCC implementation does not
do this, it preserves the representation.  With a shifted address space,
the rule for mapping null pointers to null pointers does not make sense
and is actually not helpful in the GNU/Linux case (because a copy of the
thread pointer is stored at address zero, as mentioned above).

I can't shake the impression that N1275 is about something else and not
the offsets that the x86-64 architecture can apply to addresses.

Thanks,
Florian

Re: Named address spaces on x86 GNU/Linux

[Joseph Myers]

On Thu, 29 Jul 2021, Florian Weimer via Gcc wrote:

> On GNU/Linux, SEGFS is used to implement the thread pointer, to avoid
> dedicating a general-purpose register to it.  At address zero with the
> SEGFS prefix, the offset itself is stored so that userspace can read it
> without having to call into the kernel.  So the SEGFS null pointer is a
> valid address, and so are some bytes after it (depending on TCB layout,
> some of which is specified by the ABI or is part of the de-facto ABI
> used by GCC).

That suggests that we need a target hook to describe null pointer 
properties for a given address space.  In an address space where null 
pointers are valid to dereference, there should be no diagnostics for 
arithmetic on / dereferencing them - and more generally, 
-fno-delete-null-pointer-checks should be in effect for pointers to such 
an address space (so I don't think this is just a warning issue, you can 
probably get wrong code from null pointer check deletion in such an 
address space).

-- 
Joseph S. Myers
joseph@codesourcery.com

Re: Named address spaces on x86 GNU/Linux

[Richard Biener via Libc-alpha]

On Thu, Jul 29, 2021 at 6:09 PM Joseph Myers <joseph@codesourcery.com> wrote:
>
> On Thu, 29 Jul 2021, Florian Weimer via Gcc wrote:
>
> > On GNU/Linux, SEGFS is used to implement the thread pointer, to avoid
> > dedicating a general-purpose register to it.  At address zero with the
> > SEGFS prefix, the offset itself is stored so that userspace can read it
> > without having to call into the kernel.  So the SEGFS null pointer is a
> > valid address, and so are some bytes after it (depending on TCB layout,
> > some of which is specified by the ABI or is part of the de-facto ABI
> > used by GCC).
>
> That suggests that we need a target hook to describe null pointer
> properties for a given address space.  In an address space where null
> pointers are valid to dereference, there should be no diagnostics for
> arithmetic on / dereferencing them - and more generally,
> -fno-delete-null-pointer-checks should be in effect for pointers to such
> an address space (so I don't think this is just a warning issue, you can
> probably get wrong code from null pointer check deletion in such an
> address space).

Thus flag_no_delete_null_pointer_checks checks should be replaced
with sth that takes the address-space as argument.  A good default
implementation would be to only have the default address space
covered by NULL pointer rules.

Richard.

> --
> Joseph S. Myers
> joseph@codesourcery.com

Re: Named address spaces on x86 GNU/Linux

[Segher Boessenkool]

On Thu, Jul 29, 2021 at 04:08:36PM +0000, Joseph Myers wrote:
> On Thu, 29 Jul 2021, Florian Weimer via Gcc wrote:
> > On GNU/Linux, SEGFS is used to implement the thread pointer, to avoid
> > dedicating a general-purpose register to it.  At address zero with the
> > SEGFS prefix, the offset itself is stored so that userspace can read it
> > without having to call into the kernel.  So the SEGFS null pointer is a
> > valid address, and so are some bytes after it (depending on TCB layout,
> > some of which is specified by the ABI or is part of the de-facto ABI
> > used by GCC).
> 
> That suggests that we need a target hook to describe null pointer 
> properties for a given address space.  In an address space where null 
> pointers are valid to dereference, there should be no diagnostics for 
> arithmetic on / dereferencing them - and more generally, 
> -fno-delete-null-pointer-checks should be in effect for pointers to such 
> an address space (so I don't think this is just a warning issue, you can 
> probably get wrong code from null pointer check deletion in such an 
> address space).

There already is TARGET_ADDR_SPACE_ZERO_ADDRESS_VALID?  So this just
isn't used everywhere it should?


Segher

Re: Named address spaces on x86 GNU/Linux

[Richard Biener via Libc-alpha]

On Sat, Jul 31, 2021 at 9:34 PM Segher Boessenkool
<segher@kernel.crashing.org> wrote:
>
> On Thu, Jul 29, 2021 at 04:08:36PM +0000, Joseph Myers wrote:
> > On Thu, 29 Jul 2021, Florian Weimer via Gcc wrote:
> > > On GNU/Linux, SEGFS is used to implement the thread pointer, to avoid
> > > dedicating a general-purpose register to it.  At address zero with the
> > > SEGFS prefix, the offset itself is stored so that userspace can read it
> > > without having to call into the kernel.  So the SEGFS null pointer is a
> > > valid address, and so are some bytes after it (depending on TCB layout,
> > > some of which is specified by the ABI or is part of the de-facto ABI
> > > used by GCC).
> >
> > That suggests that we need a target hook to describe null pointer
> > properties for a given address space.  In an address space where null
> > pointers are valid to dereference, there should be no diagnostics for
> > arithmetic on / dereferencing them - and more generally,
> > -fno-delete-null-pointer-checks should be in effect for pointers to such
> > an address space (so I don't think this is just a warning issue, you can
> > probably get wrong code from null pointer check deletion in such an
> > address space).
>
> There already is TARGET_ADDR_SPACE_ZERO_ADDRESS_VALID?  So this just
> isn't used everywhere it should?

Yeah, looks like so.

Richard.

>
> Segher