From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Thomas Gleixner <tglx@linutronix.de>,
linux-kernel <linux-kernel@vger.kernel.org>,
linux-api <linux-api@vger.kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
"Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
Boqun Feng <boqun.feng@gmail.com>,
Dave Watson <davejwatson@fb.com>, Paul Turner <pjt@google.com>,
Andrew Morton <akpm@linux-foundation.org>,
Russell King <linux@arm.linux.org.uk>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
Andi Kleen <andi@firstfloor.org>, Chris Lameter <cl@linux.com>,
Ben Maurer <bmaurer@fb.com>, rostedt <rostedt@goodmis.org>,
Josh Triplett <josh@joshtriplett.org>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>,
Michael Kerrisk <mtk.manpages@gmail.com>,
Joel Fernandes <joelaf@google.com>
Subject: Re: [RFC PATCH for 4.18] rseq: use __u64 for rseq_cs fields, validate user inputs
Date: Mon, 2 Jul 2018 21:19:02 -0400 (EDT) [thread overview]
Message-ID: <459661281.10865.1530580742205.JavaMail.zimbra@efficios.com> (raw)
In-Reply-To: <8B2E4CEB-3080-4602-8B62-774E400892EB@amacapital.net>
----- On Jul 2, 2018, at 7:37 PM, Andy Lutomirski luto@amacapital.net wrote:
>> On Jul 2, 2018, at 4:22 PM, Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
>> wrote:
>>
>> ----- On Jul 2, 2018, at 7:16 PM, Mathieu Desnoyers
>> mathieu.desnoyers@efficios.com wrote:
>>
>>> ----- On Jul 2, 2018, at 7:06 PM, Linus Torvalds torvalds@linux-foundation.org
>>> wrote:
>>>
>>>> On Mon, Jul 2, 2018 at 4:00 PM Mathieu Desnoyers
>>>> <mathieu.desnoyers@efficios.com> wrote:
>>>>>
>>>>> Unfortunately, that rseq->rseq_cs field needs to be updated by user-space
>>>>> with single-copy atomicity. Therefore, we want 32-bit user-space to initialize
>>>>> the padding with 0, and only update the low bits with single-copy atomicity.
>>>>
>>>> Well... It's actually still single-copy atomicity as a 64-bit value.
>>>>
>>>> Why? Because it doesn't matter how you write the upper bits. You'll be
>>>> writing the same value to them (zero) anyway.
>>>>
>>>> So who cares if the write ends up being two instructions, because the
>>>> write to the upper bits doesn't actually *do* anything.
>>>>
>>>> Hmm?
>>>
>>> Are there any kind of guarantees that a __u64 update on a 32-bit architecture
>>> won't be torn into something daft like byte-per-byte stores when performed
>>> from C code ?
>>>
>>> I don't worry whether the upper bits get updated or how, but I really care
>>> about not having store tearing of the low bits update.
>>
>> For the records, most updates of those low bits are done in assembly
>> from critical sections, for which we control exactly how the update is
>> performed.
>>
>> However, there is one helper function in user-space that updates that value
>> from C through a volatile store, e.g.:
>>
>> static inline void rseq_prepare_unload(void)
>> {
>> __rseq_abi.rseq_cs = 0;
>> }
>
> How about making the field be:
>
> union {
> __u64 rseq_cs;
> struct {
> __u32 rseq_cs_low;
> __u32 rseq_cs_high;
> };
> };
>
> 32-bit user code that cares about performance can just write to rseq_cs_low
> because it already knows that rseq_cs_high == 0.
>
> The header could even supply a static inline helper write_rseq_cs() that
> atomically writes a pointer and just does the right thing for 64-bit, for
> 32-bit BE, and for 32-bit LE.
>
> I think the union really is needed because we can’t rely on user code being
> built with -fno-strict-aliasing. Or the helper could use inline asm.
>
> Anyway, the point is that we get optimal code generation (a single instruction
> write of the correct number of bits) without any compat magic in the kernel.
That works for me! Any objection from anyone else for this approach ?
Thanks,
Mathieu
>
>>
>> Thanks,
>>
>> Mathieu
>>
>>>
>>> Thanks,
>>>
>>> Mathieu
>>>
>>>
>>> --
>>> Mathieu Desnoyers
>>> EfficiOS Inc.
>>> http://www.efficios.com
>>
>> --
>> Mathieu Desnoyers
>> EfficiOS Inc.
> > http://www.efficios.com
--
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com
next prev parent reply other threads:[~2018-07-03 1:19 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-02 22:31 [RFC PATCH for 4.18] rseq: use __u64 for rseq_cs fields, validate user inputs Mathieu Desnoyers
2018-07-02 22:45 ` Linus Torvalds
2018-07-02 23:00 ` Mathieu Desnoyers
2018-07-02 23:06 ` Linus Torvalds
2018-07-02 23:16 ` Mathieu Desnoyers
2018-07-02 23:22 ` Linus Torvalds
2018-07-02 23:25 ` Mathieu Desnoyers
2018-07-02 23:22 ` Mathieu Desnoyers
2018-07-02 23:37 ` Andy Lutomirski
2018-07-03 1:19 ` Mathieu Desnoyers [this message]
2018-07-03 2:01 ` Mathieu Desnoyers
2018-07-03 2:18 ` Linus Torvalds
2018-07-03 2:30 ` Mathieu Desnoyers
2018-07-03 2:33 ` Andy Lutomirski
2018-07-03 2:44 ` Linus Torvalds
2018-07-03 8:14 ` Peter Zijlstra
2018-07-03 8:29 ` Heiko Carstens
2018-07-03 8:43 ` Peter Zijlstra
2018-07-03 8:55 ` Heiko Carstens
2018-07-03 9:17 ` Heiko Carstens
2018-07-03 9:24 ` Peter Zijlstra
2018-07-03 9:21 ` Peter Zijlstra
2018-07-03 16:40 ` Andi Kleen
2018-07-03 17:02 ` Peter Zijlstra
2018-07-03 17:06 ` Andy Lutomirski
2018-07-03 17:10 ` Linus Torvalds
2018-07-03 17:26 ` Mathieu Desnoyers
2018-07-03 17:34 ` Peter Zijlstra
2018-07-03 17:38 ` Mathieu Desnoyers
2018-07-03 17:48 ` Peter Zijlstra
2018-07-03 17:58 ` Mathieu Desnoyers
2018-07-03 18:11 ` Peter Zijlstra
2018-07-03 18:15 ` Mathieu Desnoyers
2018-07-03 18:28 ` Peter Zijlstra
2018-07-03 18:41 ` Mathieu Desnoyers
2018-07-03 19:08 ` Peter Zijlstra
2018-07-03 17:59 ` Linus Torvalds
2018-07-03 18:09 ` Mathieu Desnoyers
2018-07-03 18:10 ` Peter Zijlstra
2018-07-03 0:19 ` Christopher Lameter
2018-07-03 0:23 ` Mathieu Desnoyers
2018-07-03 0:35 ` Christopher Lameter
2018-07-03 1:17 ` Mathieu Desnoyers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=459661281.10865.1530580742205.JavaMail.zimbra@efficios.com \
--to=mathieu.desnoyers@efficios.com \
--cc=akpm@linux-foundation.org \
--cc=andi@firstfloor.org \
--cc=bmaurer@fb.com \
--cc=boqun.feng@gmail.com \
--cc=catalin.marinas@arm.com \
--cc=cl@linux.com \
--cc=davejwatson@fb.com \
--cc=hpa@zytor.com \
--cc=joelaf@google.com \
--cc=josh@joshtriplett.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@arm.linux.org.uk \
--cc=luto@amacapital.net \
--cc=mingo@redhat.com \
--cc=mtk.manpages@gmail.com \
--cc=paulmck@linux.vnet.ibm.com \
--cc=peterz@infradead.org \
--cc=pjt@google.com \
--cc=rostedt@goodmis.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).