Re: [musl] [C23 string conversion 1/3] C23: add the new memset_explicit function

[Rich Felker <dalias@libc.org>]

On Sat, May 27, 2023 at 08:49:47AM +0200, Jₑₙₛ Gustedt wrote:
> Rich,
> 
> on Fri, 26 May 2023 16:57:21 -0400 you (Rich Felker <dalias@libc.org>)
> wrote:
> 
> > Do you have something in mind about how the explcit_bzero
> > implementation we have doesn't do that?
> 
> I would be more comfortable with a stronger synchronization barrier
> that works for all memory models and also in the presence of threads
> and signals. So maybe using `a_barrier()`?

There is no distinction here with repect to signals. With respect to
threads, I guess it's a distinction of whether data races in other
threads could still see the value that was supposed to have been
cleared. This is impossible already is there is any synchronization
ordering the operation of clearing with the access from another
thread. If there is not, then the operations are unordered with
respect to one another and the value *could already have been seen*
just by execution in a different order, before the explicit_memset. So
I don't see how this is supposed to be helpful.

> Also I think that relying on the compiler's `memset` is not a good
> strategy. This puts us at their merci of whatever efficiency games
> they are playing, now or in the future.

It's not the compiler's memset. It's the external function. Because
this is all built as -ffreestanding, the compiler is not able to
expand calls to standard functions as the builtins. -ffreestanding
implies -fno-builtin.

However, I claim it would actually be better/safer if it were the
compiler's memset.

Consider the case where explicit_bzero is inlined in the caller (the
only one in which anything significantly differs), and the caller is
trying to clear a private key in a local variable whose address has
not otherwise been taken (or for which all accesses through the
address were already collapsed via ipa/inlining).

With the compiler's memset, it can operate directly on the caller's
local variable in-place in a register, just zeroing the register,
*then* spill the zero to actual memory for the __asm__ barrier.

With an external memset, it has to first spill the key to memory for
memset to clear it. The copy in the register remains in place until
the register is reused for something else.

This is one aspect in which your version is preferable, but it
would/will be fixed by making src/include/string.h re-enable use of
builtins conditional on a configure test for them.

Rich