Before rseq became extensible, its original size was 32 bytes even though the active rseq area was only 20 bytes. This had the following impact in terms of userspace ecosystem evolution: * The GNU libc between 2.35 and 2.39 expose a __rseq_size symbol set to 32, even though the size of the active rseq area is really 20. * The GNU libc 2.40 changes this __rseq_size to 20, thus making it express the active rseq area. * Starting from glibc 2.41, __rseq_size corresponds to the AT_RSEQ_FEATURE_SIZE from getauxval(3). This means that users of __rseq_size can always expect it to correspond to the active rseq area, except for the value 32, for which the active rseq area is 20 bytes. Exposing a 32 bytes feature size would make life needlessly painful for userspace. Therefore, add a reserved field at the end of the rseq area to bump the feature size to 33 bytes. This reserved field is expected to be replaced with whatever field will come next, expecting that this field will be larger than 1 byte. The effect of this change is to increase the size from 32 to 64 bytes before we actually have fields using that memory. Clarify the allocation size and alignment requirements in the struct rseq uapi comment. Change the value returned by getauxval(AT_RSEQ_ALIGN) to return the value of the active rseq area size rounded up to next power of 2, which guarantees that the rseq structure will always be aligned on the nearest power of two large enough to contain it, even as it grows. Change the alignment check in the rseq registration accordingly. This will minimize the amount of ABI corner-cases we need to document and require userspace to play games with. The rule stays simple when __rseq_size != 32: #define rseq_field_available(field) (__rseq_size >= offsetofend(struct rseq_abi, field))
Showing the changes to include/uapi/linux (1 of 4 files). Show all
Unified · Split
| @@ -87,10 +87,17 @@ struct rseq_slice_ctrl { · 86 unmodified lines | |||
| 87 | }; | 87 | }; |
| 88 | 88 | ||
| 89 | /* | 89 | /* |
| 90 | * struct rseq is aligned on 4 * 8 bytes to ensure it is always | 90 | * The original size and alignment of the allocation for struct rseq is |
| 91 | * contained within a single cache-line. | 91 | * 32 bytes. |
| 92 | * | 92 | * |
| 93 | * A single struct rseq per thread is allowed. | 93 | * The allocation size needs to be greater or equal to |
| 94 | * max(getauxval(AT_RSEQ_FEATURE_SIZE), 32), and the allocation needs to | ||
| 95 | * be aligned on max(getauxval(AT_RSEQ_ALIGN), 32). | ||
| 96 | * | ||
| 97 | * As an alternative, userspace is allowed to use both the original size | ||
| 98 | * and alignment of 32 bytes for backward compatibility. | ||
| 99 | * | ||
| 100 | * A single active struct rseq registration per thread is allowed. | ||
| 94 | */ | 101 | */ |
| 95 | struct rseq { | 102 | struct rseq { |
| 96 | /* | 103 | /* |
| @@ -180,10 +187,21 @@ struct rseq { · 83 unmodified lines | |||
| 180 | */ | 187 | */ |
| 181 | struct rseq_slice_ctrl slice_ctrl; | 188 | struct rseq_slice_ctrl slice_ctrl; |
| 182 | 189 | ||
| 190 | /* | ||
| 191 | * Before rseq became extensible, its original size was 32 bytes even | ||
| 192 | * though the active rseq area was only 20 bytes. | ||
| 193 | * Exposing a 32 bytes feature size would make life needlessly painful | ||
| 194 | * for userspace. Therefore, add a reserved byte after byte 32 | ||
| 195 | * to bump the rseq feature size from 32 to 33. | ||
| 196 | * The next field to be added to the rseq area will be larger | ||
| 197 | * than one byte, and will replace this reserved byte. | ||
| 198 | */ | ||
| 199 | __u8 __reserved; | ||
| 200 | |||
| 183 | /* | 201 | /* |
| 184 | * Flexible array member at end of structure, after last feature field. | 202 | * Flexible array member at end of structure, after last feature field. |
| 185 | */ | 203 | */ |
| 186 | char end[]; | 204 | char end[]; |
| 187 | } __attribute__((aligned(4 * sizeof(__u64)))); | 205 | } __attribute__((aligned(32))); |
| 188 | 206 | ||
| 189 | #endif /* _UAPI_LINUX_RSEQ_H */ | 207 | #endif /* _UAPI_LINUX_RSEQ_H */ |