From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758064AbdJMNi1 (ORCPT ); Fri, 13 Oct 2017 09:38:27 -0400 Received: from mail.efficios.com ([167.114.142.141]:49689 "EHLO mail.efficios.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753231AbdJMNiZ (ORCPT ); Fri, 13 Oct 2017 09:38:25 -0400 Date: Fri, 13 Oct 2017 13:40:16 +0000 (UTC) From: Mathieu Desnoyers To: Florian Weimer Cc: "Paul E. McKenney" , Boqun Feng , Peter Zijlstra , Paul Turner , Andrew Hunter , Andy Lutomirski , Dave Watson , Josh Triplett , Will Deacon , linux-kernel , Thomas Gleixner , Andi Kleen , Chris Lameter , Ingo Molnar , "H. Peter Anvin" , Ben Maurer , rostedt , Linus Torvalds , Andrew Morton , Russell King , Catalin Marinas , Michael Kerrisk , Alexander Viro , linux-api Message-ID: <695804241.40580.1507902016119.JavaMail.zimbra@efficios.com> In-Reply-To: <19edaac0-98d7-e7a0-aceb-b861a2befce4@redhat.com> References: <20171012230326.19984-1-mathieu.desnoyers@efficios.com> <20171012230326.19984-2-mathieu.desnoyers@efficios.com> <19edaac0-98d7-e7a0-aceb-b861a2befce4@redhat.com> Subject: Re: [RFC PATCH v9 for 4.15 01/14] Restartable sequences system call MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [167.114.142.141] X-Mailer: Zimbra 8.7.11_GA_1854 (ZimbraWebClient - FF52 (Linux)/8.7.11_GA_1854) Thread-Topic: Restartable sequences system call Thread-Index: vLHcCSOpZ4NBvz4mQtwFPN+K7u0B9g== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ----- On Oct 13, 2017, at 8:50 AM, Florian Weimer fweimer@redhat.com wrote: > On 10/13/2017 01:03 AM, Mathieu Desnoyers wrote: >> Expose a new system call allowing each thread to register one userspace >> memory area to be used as an ABI between kernel and user-space for two >> purposes: user-space restartable sequences and quick access to read the >> current CPU number value from user-space. >> >> * Restartable sequences (per-cpu atomics) >> >> Restartables sequences allow user-space to perform update operations on >> per-cpu data without requiring heavy-weight atomic operations. >> >> The restartable critical sections (percpu atomics) work has been started >> by Paul Turner and Andrew Hunter. It lets the kernel handle restart of >> critical sections. [1] [2] The re-implementation proposed here brings a >> few simplifications to the ABI which facilitates porting to other >> architectures and speeds up the user-space fast path. This part: >> A locking-based >> fall-back, purely implemented in user-space, is proposed here to deal >> with debugger single-stepping. This fallback interacts with rseq_start() >> and rseq_finish(), which force retries in response to concurrent >> lock-based activity. should have been updated in this series to: A second system call, cpu_opv(), is proposed as fallback to deal with debugger single-stepping. cpu_opv() executes a sequence of operations on behalf of user-space with preemption disabled. > This functionality essentially relies on writable function pointers (or > pointers to data containing function pointers), right? Is there a way > to make this a less attractive target for exploit writers? The proposed ABI does not require to store any function pointer. For a given rseq_finish() critical section, pointers to specific instructions (within a function) are emitted at link-time into a struct rseq_cs: struct rseq_cs { RSEQ_FIELD_u32_u64(start_ip); RSEQ_FIELD_u32_u64(post_commit_ip); RSEQ_FIELD_u32_u64(abort_ip); uint32_t flags; } __attribute__((aligned(4 * sizeof(uint64_t)))); Then, at runtime, the fast-path stores the address of that struct rseq_cs into the TLS struct rseq "rseq_cs" field. So all we store at runtime is a pointer to data, not a pointer to functions. But you seem to hint that having a pointer to data containing pointers to code may still be making it easier for exploit writers. Can you elaborate on the scenario ? Thanks, Mathieu > > Thanks, > Florian -- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com