From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D685C4345F for ; Tue, 16 Apr 2024 09:53:36 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CEBA16B008C; Tue, 16 Apr 2024 05:53:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C74B26B008A; Tue, 16 Apr 2024 05:53:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AEDBA6B008C; Tue, 16 Apr 2024 05:53:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 8ADC96B0089 for ; Tue, 16 Apr 2024 05:53:35 -0400 (EDT) Received: from smtpin08.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 518F3A1E19 for ; Tue, 16 Apr 2024 09:53:35 +0000 (UTC) X-FDA: 82014932790.08.75C610B Received: from mail-yw1-f202.google.com (mail-yw1-f202.google.com [209.85.128.202]) by imf15.hostedemail.com (Postfix) with ESMTP id 821D2A0012 for ; Tue, 16 Apr 2024 09:53:33 +0000 (UTC) Authentication-Results: imf15.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=EMZz8R57; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf15.hostedemail.com: domain of 3nEoeZgkKCOEDOLFHUbKOJRRJOH.FRPOLQXa-PPNYDFN.RUJ@flex--aliceryhl.bounces.google.com designates 209.85.128.202 as permitted sender) smtp.mailfrom=3nEoeZgkKCOEDOLFHUbKOJRRJOH.FRPOLQXa-PPNYDFN.RUJ@flex--aliceryhl.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1713261213; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=g0aAJKt43O2yMsuhFwcdl7D4L5XLScuydd0VdOB1c5I=; b=5Hgzwg6w7SljnmK9U9QMZFNzaLr3oVcpYQJUzISt9/eJxhE2VMvQir8MFp9vYdLakwDHGg wFpMwJfWcqa2yUeUPfhC8KIj2YO48bmmFnEKMu+buRxcGD5WWFq/sJTprX2xouuD9Ruyol dm75RowoWe5nyro4tT+YxIMWqMgLaEw= ARC-Authentication-Results: i=1; imf15.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=EMZz8R57; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf15.hostedemail.com: domain of 3nEoeZgkKCOEDOLFHUbKOJRRJOH.FRPOLQXa-PPNYDFN.RUJ@flex--aliceryhl.bounces.google.com designates 209.85.128.202 as permitted sender) smtp.mailfrom=3nEoeZgkKCOEDOLFHUbKOJRRJOH.FRPOLQXa-PPNYDFN.RUJ@flex--aliceryhl.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1713261213; a=rsa-sha256; cv=none; b=FzPZnScHqfwNcwO2bn7mpr5Fcko+xbt+6X8TR+qr3Kfp+CR6Tr0GwQWOv0g1Nq+gkuEQGA B2rQqJjLv0f5f39nT21t1LLwGEzR6TGlUpa3zAwAF0T9UxrRBzMyByN5HPuMaQlK8GIRsD RtH6Hvx/gBFf9G9md2QGDnVWoIj0pTg= Received: by mail-yw1-f202.google.com with SMTP id 00721157ae682-61892d91207so54766847b3.3 for ; Tue, 16 Apr 2024 02:53:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1713261212; x=1713866012; darn=kvack.org; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=g0aAJKt43O2yMsuhFwcdl7D4L5XLScuydd0VdOB1c5I=; b=EMZz8R57RreWfzP0MMC4065ebgOCgWWmj8hj4/t8M6OhcKGR2NdbwHcli/F2FTmqly ofokAoDUz0SYS3miGblvSyr7SwWEpxixR5mm1I7/IUxk9/zc6ooqoXlhVKC//ijAB5Gr mwO/t4fXKTnREuZn8VHf+/j9ED2bcWQyGAgGyLFztah5khWjt1kY9ykK9WVjBtZwyoup YdbuYH4F/BXE5xpS/nI4/AD0b01pAEi6Yr1Eig5u/Qxzvuxisb7Op61/NFxoBFk8lr86 K87V/IiT8errP0wWpWKcmmbkDsvJHipz9X1rCIqWGOb5mNnpq4HT+BkTbXZ/fgDPbRKP XrMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713261212; x=1713866012; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=g0aAJKt43O2yMsuhFwcdl7D4L5XLScuydd0VdOB1c5I=; b=kh/jUVDSoO4QTTdbTZwgkVEexwVUV9whw7EWrenOdztGseMOrGduBbdDs3kbL1XADM Dh+/iTNrxAyPYUqew48f8+KKEPloiI952GWM73JYEn0QTdZs3Zi33AweiKl2bmzC483Q Wa1Rt41TCqnkaVO/wb7ofK0GDDYYZQQGofhbKnwR+wEatOI71av3utSQ/FKs/hE3FQqQ yyma30efSu7WQH+uEYFmEaUESebk3h8ZvJhVXUCuJNiAAxDoJUAHIg/P5q9zxiAtrWsF c23BDrF+bUQAhq6d7qafbmx3DQFrSmNXGv7AKyqYsITKjWuo2yap/fzjH01zXYgX96Si QVnw== X-Forwarded-Encrypted: i=1; AJvYcCUgXtSRTTY/ObxjUe6rHy88uXuAHpCvf0R5lj+Rir46GNjUhHWa7+DbQinAqDPcfqhDosXGBUbWPWjcQsvk1JqmDrw= X-Gm-Message-State: AOJu0Yy4CfgH8EWyUC+8d5dH4/3aTrYcpRqTdvokoCqzT2pbmtSWYJgU 1NqcsAUR7OoRrypnXhWpeqO4F43stHdV720zQr0r/6V0dUnjx+AJw9EIo00QJ86e+r59TpKsw/E yWXO+IGpKy53ihA== X-Google-Smtp-Source: AGHT+IHM936jZicui9CRp5azu04c56T/Uxhpa7e4PHfoxPMGDIPiy9FGgXUa2AlZ+SNM7EZIFmDxAxMSYI8T7Hg= X-Received: from aliceryhl2.c.googlers.com ([fda3:e722:ac3:cc00:68:949d:c0a8:572]) (user=aliceryhl job=sendgmr) by 2002:a05:6902:f84:b0:dc2:550b:a4f4 with SMTP id ft4-20020a0569020f8400b00dc2550ba4f4mr3952714ybb.1.1713261212591; Tue, 16 Apr 2024 02:53:32 -0700 (PDT) Date: Tue, 16 Apr 2024 09:53:30 +0000 In-Reply-To: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.44.0.683.g7961c838ac-goog Message-ID: <20240416095330.1108574-1-aliceryhl@google.com> Subject: Re: [PATCH v5 3/4] rust: uaccess: add typed accessors for userspace pointers From: Alice Ryhl To: tmgross@umich.edu Cc: a.hindborg@samsung.com, akpm@linux-foundation.org, alex.gaynor@gmail.com, aliceryhl@google.com, arnd@arndb.de, arve@android.com, benno.lossin@proton.me, bjorn3_gh@protonmail.com, boqun.feng@gmail.com, brauner@kernel.org, cmllamas@google.com, gary@garyguo.net, gregkh@linuxfoundation.org, joel@joelfernandes.org, keescook@chromium.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, maco@android.com, ojeda@kernel.org, rust-for-linux@vger.kernel.org, surenb@google.com, tkjos@android.com, viro@zeniv.linux.org.uk, wedsonaf@gmail.com, willy@infradead.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Queue-Id: 821D2A0012 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: 3zzh989cyrpethjusam47e7h7ox9fdp1 X-HE-Tag: 1713261213-357034 X-HE-Meta: U2FsdGVkX1/hfxe6hSPGAu8wMHa5Q3JlsjZGNtMErPDFWWH6oUgIFujU0ve61lxobTmK7UWCDgmX2nc1q39N0SEJRVQNOwmSuMot8GrQGgUpa5gC5zQYcwZccb8aJMNuT/7XKNEhO68GmZjWYmgaiqdijjwDcARMujy04+1lRYk4xer8jHB1cc4XDJFEumcnTjUnXcoqXew78abVdvbTVKOjjjzxqB552jWzc+4xrLdfkvPdOxAq8/v5W7yX6Y8AFx3WSTWD86Jft7Ye1sfvOK0TJhxZ+tVFlKXC7TYDAE7FpEZ/sPewP/czZheu/N6WNAIdbeN9LgoaP+UIo3i/mSwpOs+GWY6hzRo3sTtDjQ6k2UDpRtQNJCKFAYE639OJ2XBqAo8RzCiQTMop9fHnKfnS5/yE6JH1UzwDseY3106I4ZmZd4AM9v1rMemdfX2ecfWwvKBvhs/gMRNVsIbGbzv6rE6OAN+9DXOqCWhlQcAWr/fJ2jVkxrZrqxwfjrGncz6HTL3+ETCrpogGYhxBx5AUwFuSA6xohLR6GIf6m7QLi9/e0CDcDOz169QHVSDnp5y3Cv83YRXm3Wi/+IO85i6GLa0cNDZaRYq1N1fF0GGwYRJDbJDhbahx6Tr6izzkymXQLQm27sjl8V+vQin2slbFfl4Q8CE1BjZ0uoMY1FoEYt/Ju27FbZH8H8fG0KQcsk2tzF4aW1IcJG3sxwX3ZBXgBvFy875bxn8hLhsnRowNqXwqEMamt888wc46eRVmRrRU9YuyShxXpR4aAhs78gAXwwWxvI1twIwNu+O60oRaxZXfF3NfxWabU8Z4AqX2KZVYncy19OuFqh6WAv5VqXhA8OzDg2/GLfSahog+kSuseVD3kZlKM1zWQfFJHTGhtCCrrMhbQNarUCYvkJuLy3zJZ2DstNEb0hQotPl7DveDTl5VaTSf2Y7CU75LhTAv12aHUrYhQBMUUdm6Dx6 eyrbGmzx LgmHP0N2B0LeELMP6qYu3tmyY4iYG2zhg8ZRVgbUmNV1uF/W/5RRDqtHSVsIA7lzcWnZRXAlYrckZhbSf5muD1jHPDmr/lyBS35umBp1R9fSEoKO+7vpb3pSPSO8T8dJSR6f0NhqnY/mFPiiWzf0MP7gn9Q18zN+F0n42O3DCmtjPsx4qnhjDrVEmPVnKyVRl+eGRy2W2IsUMlxy2J/jqvJ0iYcol6iqI8aspMDGFt5sQsgulDDmms+FyH3ZkjlWtZGOLrP6PW0T930cweLI5Beyq4SCd8W/EtMFWUlvYySBSdtxZu1gidFwK/uMul/JvugX5CNgvNSDMc2dO4xEjpAZpS7g7ERdJco29Jg2lVRNlX1GyQdguef+oQkt+eDYk3tgOItiV77KQG4OeHl37mXDFrDxBT4qxMyjfZ5vOfXRLL4biMheYSqT8RSmo94wmIdaVXoZe7nAbde+IFutQYVzhnlRiGKc4jRBiOQQsdP+aMjLog/1TkVTe7mASs72pOwhARsd8Rv+9d+tla/u8gb2nMUZuGzeR357Fz9wfPKeRVwawqlEH+5mPt0Z8Sbe39zElLx/Z9THb46jxh8FSCM6AIL2i4p0KiwtT1Ejy4kGJYYQGlTP5O/Pbymynh0x7aPqqHOOVxrUYuOzhh2LtATODYQV1kE53JoyN3mJLHsbfradSD+VUpHNdZwdLE+7jvG2+/omEKAWQ9CCVxp87kQKp0oKVeu3v2uf/0N2ezunccAh2VpymatAMgA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Trevor Gross writes: > On Mon, Apr 15, 2024 at 3:15=E2=80=AFAM Alice Ryhl = wrote: >> >> Add safe methods for reading and writing Rust values to and from >> userspace pointers. >> >> The C methods for copying to/from userspace use a function called >> `check_object_size` to verify that the kernel pointer is not dangling. >> However, this check is skipped when the length is a compile-time >> constant, with the assumption that such cases trivially have a correct >> kernel pointer. >> >> In this patch, we apply the same optimization to the typed accessors. >> For both methods, the size of the operation is known at compile time to >> be size_of of the type being read or written. Since the C side doesn't >> provide a variant that skips only this check, we create custom helpers >> for this purpose. >> >> The majority of reads and writes to userspace pointers in the Rust >> Binder driver uses these accessor methods. Benchmarking has found that >> skipping the `check_object_size` check makes a big difference for the >> cases being skipped here. (And that the check doesn't make a difference >> for the cases that use the raw read/write methods.) >> >> This code is based on something that was originally written by Wedson on >> the old rust branch. It was modified by Alice to skip the >> `check_object_size` check, and to update various comments, including the >> notes about kernel pointers in `WritableToBytes`. >> >> Co-developed-by: Wedson Almeida Filho >> Signed-off-by: Wedson Almeida Filho >> Reviewed-by: Benno Lossin >> Reviewed-by: Boqun Feng >> Signed-off-by: Alice Ryhl >=20 > Couple of docs nits but this looks good to me. >=20 > Reviewed-by: Trevor Gross Thanks for taking a look! >> +/// Types for which any bit pattern is valid. >> +/// >> +/// Not all types are valid for all values. For example, a `bool` must = be either zero or one, so >> +/// reading arbitrary bytes into something that contains a `bool` is no= t okay. >> +/// >> +/// It's okay for the type to have padding, as initializing those bytes= has no effect. >> +/// >> +/// # Safety >> +/// >> +/// All bit-patterns must be valid for this type. >> +pub unsafe trait FromBytes {} >=20 > No `UnsafeCell` is also a requirement in zerocopy/bytemuck I can add that requirement. >> +/// Types that can be viewed as an immutable slice of initialized bytes= . >> +/// >> +/// If a struct implements this trait, then it is okay to copy it byte-= for-byte to userspace. This >> +/// means that it should not have any padding, as padding bytes are uni= nitialized. Reading >> +/// uninitialized memory is not just undefined behavior, it may even le= ad to leaking sensitive >> +/// information on the stack to userspace. >> +/// >> +/// The struct should also not hold kernel pointers, as kernel pointer = addresses are also considered >> +/// sensitive. However, leaking kernel pointers is not considered undef= ined behavior by Rust, so >> +/// this is a correctness requirement, but not a safety requirement. >=20 > I don't think mentions of userspace are relevant here since the trait > is more general. Maybe a `# Interfacing with userspace` section if > there is enough relevant information. I think it is relevant. It is the main purpose of the trait right now, and it is also part of the justification for why the rules are what they are. >> +/// # Safety >> +/// >> +/// Values of this type may not contain any uninitialized bytes. >=20 > No UnsafeCell Will add. >> +pub unsafe trait AsBytes {} >=20 >> diff --git a/rust/kernel/uaccess.rs b/rust/kernel/uaccess.rs >> index c97029cdeba1..e3953eec61a3 100644 >> --- a/rust/kernel/uaccess.rs >> +++ b/rust/kernel/uaccess.rs >> @@ -4,10 +4,15 @@ >> //! >> //! C header: [`include/linux/uaccess.h`](srctree/include/linux/uaccess= .h) >> >> -use crate::{bindings, error::code::*, error::Result}; >> +use crate::{ >> + bindings, >> + error::code::*, >> + error::Result, >> + types::{AsBytes, FromBytes}, >> +}; >> use alloc::vec::Vec; >> use core::ffi::{c_ulong, c_void}; >> -use core::mem::MaybeUninit; >> +use core::mem::{size_of, MaybeUninit}; >> >> /// A pointer to an area in userspace memory, which can be either read-= only or read-write. >> /// >> @@ -238,6 +243,38 @@ pub fn read_slice(&mut self, out: &mut [u8]) -> Res= ult { >> self.read_raw(out) >> } >> >> + /// Reads a value of the specified type. >> + /// >> + /// Fails with `EFAULT` if the read encounters a page fault. >> + pub fn read(&mut self) -> Result { >> [...] >> + /// Writes the provided Rust value to this userspace pointer. >> + /// >> + /// Fails with `EFAULT` if the write encounters a page fault. >> + pub fn write(&mut self, value: &T) -> Result { >=20 > Read & write could use an example if you are up for it I may or may not add an example. Alice