[Morello] Change the PCS to pass memory arguments through C9 instead of passing them on the stack #205

sbaranga-arm · 2023-06-08T09:58:27Z

In practice for non-compartment calls the arguments are still passed on the stack, although now there is no explicit requirement for this.

Variadic arguments are still passed through C9 in the same way, at the first 16-byte aligned location after the last non-variadic argument.

This is done is such a way that reading more variadic arguments than were passed is guaranteed to cause an out-of-bounds fault.

Implements #158.

kevin-brodsky-arm · 2023-06-08T12:59:30Z

aapcs64-morello/aapcs64-morello.rst

@@ -380,7 +380,7 @@ Additionally, a stack-pointer register, SP in a 64-bit context or CSP in a capab
 +------------+----------+----------------------------------------------------------------------------------------------------+
 | r10-r15 | | Temporary registers. |
 +------------+----------+----------------------------------------------------------------------------------------------------+
- | r9 | | Parameter register for variadic calls, temporary register otherwise.  |
+ | r9 | | Parameter register for memory passed arguments, temporary register otherwise. |


I think "memory-passed" would be clearer (there is normally a dash between a noun and the adjective it modifies).

kevin-brodsky-arm · 2023-06-08T13:02:09Z

aapcs64-morello/aapcs64-morello.rst

+ | | If any parameters are memory passed in AAPCS64-cap, the Arguments Memory Area is |
+ | | allocated. |
+ | | The Arguments Memory area is 16-byte aligned. The Arguments Capability has the |
+ | | bounds of the Arguments Memory area and Arguments Memory area and the address of the |


"and Arguments Memory area" is repeated.

kevin-brodsky-arm · 2023-06-08T13:08:43Z

aapcs64-morello/aapcs64-morello.rst

@@ -808,7 +815,7 @@ The ``va_list`` type may refer to any parameter in a parameter list. All Anonymo
 The va_start() macro
 --------------------

-The ``va_start`` macro shall initialize the ``va_list`` argument to the value of C9 as seen in the entry of the callee.
+The ``va_start`` macro shall initialize the ``va_list`` argument to the value of derived from C9 with the address of the first Anonymous argument.


s/of derived/derived/
It also feels strange to say the value derived from [...], rather a value? Using "value" feels a bit confusing too as it seems to refer to the capability address in other places.

kevin-brodsky-arm · 2023-06-08T13:11:23Z

aapcs64-morello/aapcs64-morello.rst

 +------------------------------+------------------------------------------------------------------------------------------+


+.. note::
+ The Arguments Capability is a capability that has the bounds of the arguments memory area and its address will be that of the first memory passed argument. The address of the Arguments Capability is 16-byte aligned. The capability offset of the Arguments Capability may not be zero. The capability offset is such that the first 16-byte aligned location after the last memory passed argument will be larger or equal than capability limit of the Arguments Capability.


"larger than or equal to the capability limit..."

I wonder if this paragraph shouldn't start by explaining how the Arguments Memory Area is defined. I don't really understand how it all fits in terms of bounds representability right now.

I agree about the precision issues, but also it'd be very useful to include a diagram here. I don't know if we have the infrastructure for that in this document, but it would really help.

I'm a bit confused about the relationship between the offset and bounds at various points. For example, here the "address will be that of the first memory passed argument", but also its offset may not be zero. However, won't the first memory-passed argument be allocated to the first slot in the arguments memory area, and therefore require an offset of zero?

It's likely that I've just misunderstood something obvious!

Thanks! I'll try to clarify this in some way and look at adding a diagram. We need to add some padding at the start of the arguments area to make the length representable. So the 'offset' (maybe this should be 'capability offset'?) is just the size of the padding, and the first argument (and first slot) is located at the address (capability value in Morello terms) of C9.

We don't say how the (capability) offset is computed and leave that up to the implementation. In practice the way to do this would be to run the algorithm once to get the number of bytes that we need for argument passing and compute from that the minimal amount of padding required to make everything representable. With the current wording we can have multiple legal values of offset, but just one being minimal/optimal.

Hopefully this clarifies things?

Ok, that does clarify things, but couldn't the offset still be zero in the (common) case where the area is precisely representable without padding?

At the moment any sane implementation should give a zero offset in this case. We could add the additional constraint that the offset needs to be minimal, which would then require a zero offset. Any thoughts?

dpgao · 2023-07-07T09:42:48Z

aapcs64-morello/aapcs64-morello.rst


- In AAPCS64-cap if the callee is variadic and there are fewer than 4096 Anonymous arguments, the length of C9 divided by 16 is equal to the number of Anonymous arguments. The length of C9 divided by 16 is always greater or equal to the number of Anonymous arguments.
+.. note::
+ In AAPCS64-cap if the callee is variadic the number of Anonymous arguments is equal to (length(C)-offset(C)/16) where C is the adjusted value of C9 that has the address of the first Anonymous Argument.


Should this be (length(C)-offset(C))/16 instead?

Yes, thanks for catching that.

jacobbramley · 2023-07-11T07:27:35Z

aapcs64-morello/aapcs64-morello.rst

@@ -808,7 +815,7 @@ The ``va_list`` type may refer to any parameter in a parameter list. All Anonymo
 The va_start() macro
 --------------------

-The ``va_start`` macro shall initialize the ``va_list`` argument to the value of C9 as seen in the entry of the callee.
+The ``va_start`` macro shall initialize the ``va_list`` argument to the value of derived from C9 with the address of the first Anonymous argument.


Rather than C9, consider referring to "the Arguments Capability". A compiler might need to spill it (or move it to something callee-saved) before va_start is called.

jacobbramley · 2023-07-11T07:46:25Z

aapcs64-morello/aapcs64-morello.rst

 +------------------------------+------------------------------------------------------------------------------------------+


+.. note::
+ The Arguments Capability is a capability that has the bounds of the arguments memory area and its address will be that of the first memory passed argument. The address of the Arguments Capability is 16-byte aligned. The capability offset of the Arguments Capability may not be zero. The capability offset is such that the first 16-byte aligned location after the last memory passed argument will be larger or equal than capability limit of the Arguments Capability.


I agree about the precision issues, but also it'd be very useful to include a diagram here. I don't know if we have the infrastructure for that in this document, but it would really help.

I'm a bit confused about the relationship between the offset and bounds at various points. For example, here the "address will be that of the first memory passed argument", but also its offset may not be zero. However, won't the first memory-passed argument be allocated to the first slot in the arguments memory area, and therefore require an offset of zero?

It's likely that I've just misunderstood something obvious!

kevin-brodsky-arm · 2023-07-19T15:09:36Z

aapcs64-morello/aapcs64-morello.rst

+
+The Rounded Memory Arguments Length (RMAL) is the least representable capability length greater or equal to MAL.
+
+The size of the Arguments Memory Area is equal to RNML. The minimal alignment of the Arguments Memory Area is 16 bytes. The alignment of the Arguments Memory Area is large enough to allow the bounds of the Arguments Memory Area to be exactly representable by a capability.


I can't find the defiinition of RNML, could it be RMAL?

Thanks! Yes, it should have been RMAL.

instead of passing them on the stack. In practice for non-compartment calls the arguments are still passed on the stack, although now there is no explicit requirement for this. Variadic arguments are still passed through C9 in the same way, at the first 16-byte aligned location after the last non-variadic argument. This is done is such a way that reading more variadic arguments than were passed is guaranteed to cause an out-of-bounds fault. Implements ARM-software#158.

kevin-brodsky-arm reviewed Jun 8, 2023

View reviewed changes

dpgao reviewed Jul 7, 2023

View reviewed changes

jacobbramley reviewed Jul 11, 2023

View reviewed changes

sbaranga-arm force-pushed the memargs_morello_c9 branch from 0671cb6 to 342f39b Compare July 19, 2023 10:23

kevin-brodsky-arm reviewed Jul 19, 2023

View reviewed changes

sbaranga-arm force-pushed the memargs_morello_c9 branch from 342f39b to 738e8ed Compare July 24, 2023 07:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Morello] Change the PCS to pass memory arguments through C9 instead of passing them on the stack #205

[Morello] Change the PCS to pass memory arguments through C9 instead of passing them on the stack #205

sbaranga-arm commented Jun 8, 2023

kevin-brodsky-arm Jun 8, 2023

kevin-brodsky-arm Jun 8, 2023

kevin-brodsky-arm Jun 8, 2023

kevin-brodsky-arm Jun 8, 2023

jacobbramley Jul 11, 2023

sbaranga-arm Jul 11, 2023

jacobbramley Jul 11, 2023

sbaranga-arm Jul 11, 2023

dpgao Jul 7, 2023

sbaranga-arm Jul 7, 2023

jacobbramley Jul 11, 2023

jacobbramley Jul 11, 2023

kevin-brodsky-arm Jul 19, 2023

sbaranga-arm Jul 24, 2023


		The Rounded Memory Arguments Length (RMAL) is the least representable capability length greater or equal to MAL.

		The size of the Arguments Memory Area is equal to RNML. The minimal alignment of the Arguments Memory Area is 16 bytes. The alignment of the Arguments Memory Area is large enough to allow the bounds of the Arguments Memory Area to be exactly representable by a capability.

[Morello] Change the PCS to pass memory arguments through C9 instead of passing them on the stack #205

Are you sure you want to change the base?

[Morello] Change the PCS to pass memory arguments through C9 instead of passing them on the stack #205

Conversation

sbaranga-arm commented Jun 8, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment