linux-kernel - Re: [RFC PATCH] LKMM: Add ctrl_dep() macro for control dependency

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87o87r4gfp.fsf@mid.deneb.enyo.de>
Date:   Thu, 14 Oct 2021 20:19:54 +0200
From:   Florian Weimer <fw@...eb.enyo.de>
To:     "Paul E. McKenney" <paulmck@...nel.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Segher Boessenkool <segher@...nel.crashing.org>,
        Will Deacon <will@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Alan Stern <stern@...land.harvard.edu>,
        Andrea Parri <parri.andrea@...il.com>,
        Boqun Feng <boqun.feng@...il.com>,
        Nicholas Piggin <npiggin@...il.com>,
        David Howells <dhowells@...hat.com>,
        j alglave <j.alglave@....ac.uk>,
        luc maranget <luc.maranget@...ia.fr>,
        akiyks <akiyks@...il.com>,
        linux-toolchains <linux-toolchains@...r.kernel.org>,
        linux-arch <linux-arch@...r.kernel.org>
Subject: Re: [RFC PATCH] LKMM: Add ctrl_dep() macro for control dependency

* Paul E. McKenney:

>> > Yes, I know, we for sure have conflicting constraints on "reasonable"
>> > on copy on this email.  What else is new?  ;-)
>> >
>> > I could imagine a tag of some sort on the load and store, linking the
>> > operations that needed to be ordered.  You would also want that same
>> > tag on any conditional operators along the way?  Or would the presence
>> > of the tags on the load and store suffice?
>> 
>> If the load is assigned to a local variable whose address is not taken
>> and which is only assigned this once, it could be used to label the
>> store.  Then the compiler checks if all paths from the load to the
>> store feature a condition that depends on the local variable (where
>> qualifying conditions probably depend on the architecture).  If it
>> can't prove that is the case, it emits a fake no-op condition that
>> triggers the hardware barrier.  This formulation has the advantage
>> that it does not add side effects to operators like <.  It even
>> generalizes to different barrier-implying instructions besides
>> conditional branches.
>
> So something like this?
>
> 	tagvar = READ_ONCE(a);
> 	if (tagvar)
> 		WRITE_ONCE_COND(b, 1, tagvar);

Yes, something like that.  The syntax only makes sense if tagvar is
assigned only once (statically).

> (This seems to me to be an eminently reasonable syntax.)
>
> Or did I miss a turn in there somewhere?

The important bit is that the compiler emits the extra condition when
necessary, and the information in the snippet above seems to provide
enough information to optimize it away in principle, when it's safe.
This assumes that we can actually come up with a concrete model what
triggers the hardware barrier, of course.  For example, if tagvar is
spilled to the stack, is it still possible to apply an effective
condition to it after it is loaded from the stack?  If not, then the
compiler would have to put in a barrier before spilling tagvar if it
is used in any WRITE_ONCE_COND statement.