From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5C65C48BEB for ; Wed, 21 Feb 2024 19:10:25 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 59E306B0082; Wed, 21 Feb 2024 14:10:25 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 54E776B0083; Wed, 21 Feb 2024 14:10:25 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 415FA6B0085; Wed, 21 Feb 2024 14:10:25 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 3384A6B0082 for ; Wed, 21 Feb 2024 14:10:25 -0500 (EST) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 03904A0F67 for ; Wed, 21 Feb 2024 19:10:24 +0000 (UTC) X-FDA: 81816752010.26.3E3AAF1 Received: from brightrain.aerifal.cx (brightrain.aerifal.cx [104.156.224.86]) by imf26.hostedemail.com (Postfix) with ESMTP id 61DA314001F for ; Wed, 21 Feb 2024 19:10:23 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=none; spf=pass (imf26.hostedemail.com: domain of dalias@libc.org designates 104.156.224.86 as permitted sender) smtp.mailfrom=dalias@libc.org; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1708542623; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+XF0TcJsSAYgKYdVZf6dYi9NrJJgZ31O5GnfQIaNHMY=; b=6oiCH+Ecef2JsZVMh7JECflqaV7Rh6knLGYU4P1djOzt+WX6EQe2A/xHLcQGuqolaeEJsy 3waARQCMOws9kEXARSM9UrLDZvDMI0NBh8gDa60p+8TttaOggANW7w58DjH6wu9NAvO7Sb LOabkXYqjRhjkUoC1ev/i8qefLddHIc= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1708542623; a=rsa-sha256; cv=none; b=y767YSArunT8KVF/2YCxoTNVWEpN8YDd0wMB1g3gzZZXs6EGhAe0OkDY/hRtr4dNhIKdKB 3akcGxGjqOLJQatFdTl12+lrYSOgNACW/U5wYIcDRiYvDRxicgJkC732xYrkK5eGRtrncZ HfdMpdBnj2q5Zm748BKOXqBJ2KTmW1s= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=none; spf=pass (imf26.hostedemail.com: domain of dalias@libc.org designates 104.156.224.86 as permitted sender) smtp.mailfrom=dalias@libc.org; dmarc=none Date: Wed, 21 Feb 2024 14:10:39 -0500 From: "dalias@libc.org" To: Mark Brown Cc: "Edgecombe, Rick P" , "linux-arch@vger.kernel.org" , "suzuki.poulose@arm.com" , "Szabolcs.Nagy@arm.com" , "musl@lists.openwall.com" , "linux-fsdevel@vger.kernel.org" , "linux-riscv@lists.infradead.org" , "kvmarm@lists.linux.dev" , "corbet@lwn.net" , "linux-kernel@vger.kernel.org" , "catalin.marinas@arm.com" , "oliver.upton@linux.dev" , "palmer@dabbelt.com" , "debug@rivosinc.com" , "aou@eecs.berkeley.edu" , "shuah@kernel.org" , "arnd@arndb.de" , "maz@kernel.org" , "oleg@redhat.com" , "fweimer@redhat.com" , "keescook@chromium.org" , "james.morse@arm.com" , "ebiederm@xmission.com" , "will@kernel.org" , "brauner@kernel.org" , "hjl.tools@gmail.com" , "linux-kselftest@vger.kernel.org" , "paul.walmsley@sifive.com" , "ardb@kernel.org" , "linux-arm-kernel@lists.infradead.org" , "linux-mm@kvack.org" , "thiago.bauermann@linaro.org" , "akpm@linux-foundation.org" , "sorear@fastmail.com" , "linux-doc@vger.kernel.org" Subject: Re: [musl] Re: [PATCH v8 00/38] arm64/gcs: Provide support for GCS in userspace Message-ID: <20240221191039.GV4163@brightrain.aerifal.cx> References: <20240220185714.GO4163@brightrain.aerifal.cx> <9fc9c45ff6e14df80ad023e66ff7a978bd4ec91c.camel@intel.com> <20240220235415.GP4163@brightrain.aerifal.cx> <20240221012736.GQ4163@brightrain.aerifal.cx> <20240221145800.GR4163@brightrain.aerifal.cx> <4a3809e8-61b2-4341-a868-292ba6e64e8a@sirena.org.uk> <20240221175717.GS4163@brightrain.aerifal.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Rspamd-Queue-Id: 61DA314001F X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: 98hfq88iw75fbbrji9dp5m7daftiz1wu X-HE-Tag: 1708542623-935695 X-HE-Meta: U2FsdGVkX1+UVDUwnKCjhqlREPvmo2A/CuCASxF5JizOAz4sPfDABtK8217FrfScMyjHqA1l/P9nAmPv39SHr2kFmnHpLwPwWIrVFBNeb6TU/zz2F48rz9UNLF5uSHMgHx4rAlkaIj8Ppo4R4gku8qdw8piPcF+o/hwtQLWGE9xrMlUHhR/fF3Qo1ktIqFlfgMPYJIrugsGn6+h+pZ3lZhqDEf1mHDKmO3cUwgYbgtBrXq7uIBcH7trTGlAfAqqGUkcusFaed5yisaGbYCErNgVVZnQWpXEUsuwP/Ecs/K9BGHo5Ub9BIIrwnjU19yC+oUsIqu//l9n2IPrqG8ZAvpeUYN1sOZHIEDzyXuzqs8oTl/7NuxLfMTqgX+qCuuFHQF77KvnZSr3OVr8QdIHzxfRFDUoezV4lHUEr1NWHxe+iOEPLy0ZYMdfY0rHsxBQD2vTzucA6xcOqVVfkNK3D0tFFKuP1JffFdmv2Ha4Uj61jN9kmrMChjXWW581rc0dNOttQFjdTEjSl3thdWr6i0ioIOyLKmd4+Ahlcr33LnAlPMnNxwQK9bgbxGQ6WusfNChzU+I0nk2f1IzcfnVbVKzYjq/DD/sc6F1ziDrtOHDXXBVXzpjxfzHka64jvcd5nOs4q0FH0NFynA4BzF1gc7K4njMStHH4gAjEoWpNPgqUf4sAKo6rpIK7NKnTYLL3EFBAy5V2+kIXGZvWVr5HbVvxQ3zPlxLloxrk8UpJzBEqHQxs8/6qhQTOjPOY9uWiBby4QyMIaUXA= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000006, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, Feb 21, 2024 at 06:32:20PM +0000, Mark Brown wrote: > On Wed, Feb 21, 2024 at 12:57:19PM -0500, dalias@libc.org wrote: > > On Wed, Feb 21, 2024 at 05:36:12PM +0000, Mark Brown wrote: > > > > This feels like it's getting complicated and I fear it may be an uphill > > > struggle to get such code merged, at least for arm64. My instinct is > > > that it's going to be much more robust and generally tractable to let > > > things run to some suitable synchronisation point and then disable > > > there, but if we're going to do that then userspace can hopefully > > > arrange to do the disabling itself through the standard disable > > > interface anyway. Presumably it'll want to notice things being disabled > > > at some point anyway? TBH that's been how all the prior proposals for > > > process wide disable I've seen were done. > > > If it's possible to disable per-thread rather than per-process, some > > things are easier. Disabling on account of using alt stacks only needs > > Both x86 and arm64 currently track shadow stack enablement per thread, > not per process, so it's not just possible to do per thread it's the > only thing we're currently implementing. I think the same is true for > RISC-V but I didn't look as closely at that yet. That's nice! It allows still keeping part of the benefit of SS in programs which have some threads running with custom stacks. We do however need a global-disable option for dlopen. In musl this could be done via the same mechanism ("synccall") used for set*id -- it's basically userspace IPI. But just having a native operation would be nicer, and would probably help glibc where I don't think they abstracted their set*id mechanism to do other things like this. > > If folks on the kernel side are not going to be amenable to doing the > > things that are easy for the kernel to make it work without breaking > > compatibility with existing interfaces, but that are impossible or > > near-impossible for userspace to do, this seems like a dead-end. And I > > suspect an operation to "disable shadow stack, but without making > > threads still in SS-critical sections crash" is going to be > > necessary.. > > Could you be more specific as to the easy things that you're referencing > here? Basically the ARCH_SHSTK_SUPPRESS_UD proposal. Rich