From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: from second.openwall.net (second.openwall.net [193.110.157.125]) by inbox.vuxu.org (Postfix) with SMTP id DFD0F28BB0 for ; Wed, 21 Feb 2024 19:50:26 +0100 (CET) Received: (qmail 9981 invoked by uid 550); 21 Feb 2024 18:47:03 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 24242 invoked from network); 21 Feb 2024 18:29:24 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1708540350; bh=2gbTzpi4a1N3obFiGlpwydsY4IO9OTAD9wjD4yTOHtU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=H40tZsSHO3GGXtYAAc+MX1H9hfXkqwzWeiS1DXzFw/AxJv57LXIcw9mhK5Su5mCC9 i7wBl/5lZkXR64n/gvb9Qu6kwvmY4KSzCfoDfdOA/0HOVJOyFi99fo5AUrZzfMf21M H5ZfGf4y6MVG3cjBzbpNByDEsfiX1Nhpk3W13pSfKx1vxCizFYAPrtIdE1dQdlHFoa M62tazglgeiMA/9SJ7abPRLFww+GYA8BdkndbbknsJBZotawG1kAYGbU/63Fwwwo5S qZIBiA4tp0C5/RmatwR1pY7XKkdWRv+L3TpkPOGgYU7whHYd38xXjaXnKyLaZVOEPA F+OljWdJ5xjYA== Date: Wed, 21 Feb 2024 18:32:20 +0000 From: Mark Brown To: "dalias@libc.org" Cc: "Edgecombe, Rick P" , "linux-arch@vger.kernel.org" , "suzuki.poulose@arm.com" , "Szabolcs.Nagy@arm.com" , "musl@lists.openwall.com" , "linux-fsdevel@vger.kernel.org" , "linux-riscv@lists.infradead.org" , "kvmarm@lists.linux.dev" , "corbet@lwn.net" , "linux-kernel@vger.kernel.org" , "catalin.marinas@arm.com" , "oliver.upton@linux.dev" , "palmer@dabbelt.com" , "debug@rivosinc.com" , "aou@eecs.berkeley.edu" , "shuah@kernel.org" , "arnd@arndb.de" , "maz@kernel.org" , "oleg@redhat.com" , "fweimer@redhat.com" , "keescook@chromium.org" , "james.morse@arm.com" , "ebiederm@xmission.com" , "will@kernel.org" , "brauner@kernel.org" , "hjl.tools@gmail.com" , "linux-kselftest@vger.kernel.org" , "paul.walmsley@sifive.com" , "ardb@kernel.org" , "linux-arm-kernel@lists.infradead.org" , "linux-mm@kvack.org" , "thiago.bauermann@linaro.org" , "akpm@linux-foundation.org" , "sorear@fastmail.com" , "linux-doc@vger.kernel.org" Message-ID: References: <4c7bdf8fde9cc45174f10b9221fa58ffb450b755.camel@intel.com> <20240220185714.GO4163@brightrain.aerifal.cx> <9fc9c45ff6e14df80ad023e66ff7a978bd4ec91c.camel@intel.com> <20240220235415.GP4163@brightrain.aerifal.cx> <20240221012736.GQ4163@brightrain.aerifal.cx> <20240221145800.GR4163@brightrain.aerifal.cx> <4a3809e8-61b2-4341-a868-292ba6e64e8a@sirena.org.uk> <20240221175717.GS4163@brightrain.aerifal.cx> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="aNn12J2DOa91OM79" Content-Disposition: inline In-Reply-To: <20240221175717.GS4163@brightrain.aerifal.cx> X-Cookie: The second best policy is dishonesty. Subject: Re: [musl] Re: [PATCH v8 00/38] arm64/gcs: Provide support for GCS in userspace --aNn12J2DOa91OM79 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Feb 21, 2024 at 12:57:19PM -0500, dalias@libc.org wrote: > On Wed, Feb 21, 2024 at 05:36:12PM +0000, Mark Brown wrote: > > This feels like it's getting complicated and I fear it may be an uphill > > struggle to get such code merged, at least for arm64. My instinct is > > that it's going to be much more robust and generally tractable to let > > things run to some suitable synchronisation point and then disable > > there, but if we're going to do that then userspace can hopefully > > arrange to do the disabling itself through the standard disable > > interface anyway. Presumably it'll want to notice things being disabled > > at some point anyway? TBH that's been how all the prior proposals for > > process wide disable I've seen were done. > If it's possible to disable per-thread rather than per-process, some > things are easier. Disabling on account of using alt stacks only needs Both x86 and arm64 currently track shadow stack enablement per thread, not per process, so it's not just possible to do per thread it's the only thing we're currently implementing. I think the same is true for RISC-V but I didn't look as closely at that yet. > to be done on the threads using those stacks. However, for dlopen > purposes you need a way to disable shadow stack for the whole process. > Initially this is only needed for the thread that called dlopen, but > it needs to have propagated to any thread that synchronizes with > completion of the call to dlopen by the time that synchronization > occurs, and since that synchronization can happen in lots of different > ways that are purely userspace (thanks to futexes being userspace in > the uncontended case), I don't see any way to make it work without > extremely invasive, high-cost checks. Yeah, it's not particularly nice - any whole process disable is going to have some nasty cases I think. Rick's message about covered AFAIR the discussion, there were also some proposals for more limited userspaces I think. > If folks on the kernel side are not going to be amenable to doing the > things that are easy for the kernel to make it work without breaking > compatibility with existing interfaces, but that are impossible or > near-impossible for userspace to do, this seems like a dead-end. And I > suspect an operation to "disable shadow stack, but without making > threads still in SS-critical sections crash" is going to be > necessary.. Could you be more specific as to the easy things that you're referencing here? --aNn12J2DOa91OM79 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmXWQbMACgkQJNaLcl1U h9DFYgf/eUQGsS5iljaIOTVjUeRJr5sdmobctbHRbzZDrRfndMq/8GGcuj4IwRdx QH2JWncI0dBc3SdIsUCDuiT5M80YdW0MbbyF0WnodznOGFFOmAdShPrpJOYpq0PJ uxQlFwIl/RPfqC9VKTRflsuttBL5yWgTCWiM0qX0TSs8CSSzLHZJZGy0EB0BLJUj aWIcOnrEMi/h7VJY3PdqDd048xQMlVz9u3igr9rRr0yInyVXgkBu5W+9ORlWZ9Tc CDbo/yL8Wjz0PdEVRaoPUQqpVVfY01V/Ka3X3aX1b3VJBEkvcOCjncbp4epk3z9e ZahyLth4XwKs8PXzuwjgpHYnESAYJg== =//LR -----END PGP SIGNATURE----- --aNn12J2DOa91OM79--