svn commit: r304555 - head/sys/compat/cloudabi

Konstantin Belousov kostikbel at gmail.com
Mon Aug 22 10:05:04 UTC 2016


On Mon, Aug 22, 2016 at 06:55:58PM +1000, Bruce Evans wrote:
> No.  PSL_AC is ignored in kernel mode.
Not quite.  On recent processors there is a feature called SMAP.  If enabled,
user mode pages accesses from kernel mode require eflags.ac set to 1.  If
EFLAGS.AC == 0, usermode access causes #PF with protection violation AFAIR.

> Not quite that short.  i386 has the 1-byte cli instruction for conveniently
> setting the interrupt enable flag, but setting PSL_AC seems to take at
> least 3 instructions and 6-7 bytes (pushf; orb $N,$M(%[re][bs]p); popf).
In ring 0, when SMAP is present, there are two new instructions
STAC (set AC) and CLAC (clear AC).  From the manual, the instructions
are not available in ring 3 for convenient manipulation of EFLAGS.AC.

But I think that the original question was about accesses which cause
#AC and not about instructions which manipulate EFLAGS.AC.  The description
of #AC in SDM contains all relevant details.  In short, or userspace
accesses must be naturally aligned, otherwise #AC is triggered.

I used to have trivial LD_PRELOAD-able dso which just set EFLAGS.AC, but
it is not much useful exactly because x86 compilers systematically generate
unaligned accesses.

Typed languages runtimes sometimes use a witty trick with AC to get
tag checking for free. If you assign e.g. a tag 0x7 to pointers, i.e.
store tag 0x7 in three low bits of the pointer representation, then load
instruction would be
	movq	-0x7(%rdx), %rax
and you get the #AC fault in case of any other tag.  Quite nifty and gives
zero runtime cost for basic dynamic type checking.


More information about the svn-src-head mailing list