Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.600.7\))
Subject: Re: [RESEND PATCH v3 1/2] RISC-V: mm: Restrict address space for
 sv39,sv48,sv57
From:   Jessica Clarke <jrtc27@jrtc27.com>
In-Reply-To: <ZKdUpzvyfy9f48MI@ghost>
Date:   Fri, 7 Jul 2023 01:52:47 +0100
Cc:     Alexandre Ghiti <alex@ghiti.fr>,
        linux-riscv <linux-riscv@lists.infradead.org>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        Conor Dooley <conor@kernel.org>,
        Paul Walmsley <paul.walmsley@sifive.com>,
        Palmer Dabbelt <palmer@rivosinc.com>,
        Albert Ou <aou@eecs.berkeley.edu>,
        Anup Patel <anup@brainfault.org>,
        konstantin@linuxfoundation.org, linux-doc@vger.kernel.org,
        linux-kselftest@vger.kernel.org, Linux-MM <linux-mm@kvack.org>,
        mick@ics.forth.gr
Content-Transfer-Encoding: quoted-printable
Message-Id: <34483C0C-FA31-41E6-9263-1F9A08CEBE2C@jrtc27.com>
References: <20230705190002.384799-1-charlie@rivosinc.com>
 <20230705190002.384799-2-charlie@rivosinc.com>
 <2084462d-b11d-7a48-3049-6bafbe81e7b4@ghiti.fr> <ZKdUpzvyfy9f48MI@ghost>
To:     Charlie Jenkins <charlie@rivosinc.com>
Precedence: bulk

On 7 Jul 2023, at 00:56, Charlie Jenkins <charlie@rivosinc.com> wrote:
>=20
> On Thu, Jul 06, 2023 at 11:11:37AM +0200, Alexandre Ghiti wrote:
>> Hi Charlie,
>>=20
>>=20
>> On 05/07/2023 20:59, Charlie Jenkins wrote:
>>> Make sv48 the default address space for mmap as some applications
>>> currently depend on this assumption. The RISC-V specification =
enforces
>>> that bits outside of the virtual address range are not used, so
>>> restricting the size of the default address space as such should be
>>> temporary.
>>=20
>>=20
>> What do you mean in the last sentence above?
>>=20
> Applications like Java and Go broke when sv57 was implemented because
> they shove bits into the upper space of pointers. However riscv =
enforces
> that all of the upper bits in the virtual address are equal to the =
most=20
> significant bit. "Temporary" may not have been the best word, but this =
change=20
> would be irrelevant if application developers were following this =
rule, if I
> am understanding this requirement correctly. What this means to me is
> that riscv hardware is not guaranteed to not discard the bits in the =
virtual=20
> address that are not used in paging.

RISC-V guarantees that it will not discard the bits*. Java and Go =
aren=E2=80=99t
actually dereferencing the pointers with their own metadata in the top
bits (doing so would require a pointer masking extension, like how Arm
has TBI), they=E2=80=99re just temporarily storing it there, assuming =
they=E2=80=99re
not significant bits, then masking out and re-canonicalising the
address prior to dereferencing. Which breaks, not because the hardware
is looking at the higher bits (otherwise you could never use Sv57 for
such applications even if you kept your addresses < 2^47), but because
the chosen addresses have those high bits as significant.

* A page fault is guaranteed if the address isn=E2=80=99t sign-extended

Jess