[PATCH v4][BZ 18034][AArch64] Lazy TLSDESC relocation data race fix

[Szabolcs Nagy]

On 03/06/15 11:40, Torvald Riegel wrote:
> On Mon, 2015-06-01 at 11:25 +0100, Szabolcs Nagy wrote:
>> i added a comment to the _dl_tlsdesc_resolve_early_return_p
>> call in aarch64 tlsdesc.c about the retry loop.
> 
> That's good, but it would have been better if you could have briefly
> pointed out that this relates to mo_relaxed loads in
> _dl_tlsdesc_resolve_early_return_p.  And/or added a comment there saying
> that the mo_relaxed loads are fine because of this retry loop in the
> caller(s).
> 
>> -  const ElfW(Rela) *reloc = td->arg;
>> +  const ElfW(Rela) *reloc = atomic_load_relaxed (&td->arg);
> 
> Good change.  Can you add a brief comment saying why the mo_relaxed load
> is sufficient?  IIRC, this is because of the acquire loads done by the
> caller.
> 
> OK with those changes.
> 

updated the comments in the code and the description:


Lazy TLSDESC initialization needs to be synchronized with concurrent TLS
accesses.  The TLS descriptor contains a function pointer (entry) and an
argument that is accessed from the entry function.  With lazy initialization
the first call to the entry function updates the entry and the argument to
their final value.  A final entry function must make sure that it accesses an
initialized argument, this needs synchronization on systems with weak memory
ordering otherwise the writes of the first call can be observed out of order.

There are at least two issues with the current code:

tlsdesc.c (i386, x86_64, arm, aarch64) uses volatile memory accesses on the
write side (in the initial entry function) instead of C11 atomics.

And on systems with weak memory ordering (arm, aarch64) the read side
synchronization is missing from the final entry functions (dl-tlsdesc.S).

This patch only deals with aarch64.

* Write side:

Volatile accesses were replaced with C11 relaxed atomics, and a release
store was used for the initialization of entry so the read side can
synchronize with it.

* Read side:

TLS access generated by the compiler and an entry function code is roughly

  ldr x1, [x0]    // load the entry
  blr x1          // call it

entryfunc:
  ldr x0, [x0,#8] // load the arg
  ret

Various alternatives were considered to force the ordering in the entry
function between the two loads:

(1) barrier

entryfunc:
  dmb ishld
  ldr x0, [x0,#8]

(2) address dependency (if the address of the second load depends on the
result of the first one the ordering is guaranteed):

entryfunc:
  ldr x1,[x0]
  and x1,x1,#8
  orr x1,x1,#8
  ldr x0,[x0,x1]

(3) load-acquire (ARMv8 instruction that is ordered before subsequent
loads and stores)

entryfunc:
  ldar xzr,[x0]
  ldr x0,[x0,#8]

Option (1) is the simplest but slowest (note: this runs at every TLS
access), options (2) and (3) do one extra load from [x0] (same address
loads are ordered so it happens-after the load on the call site),
option (2) clobbers x1 which is problematic because existing gcc does
not expect that, so approach (3) was chosen.

A new _dl_tlsdesc_return_lazy entry function was introduced for lazily
relocated static TLS, so non-lazy static TLS can avoid the synchronization
cost.

Changelog:

2015-06-15  Szabolcs Nagy  <szabolcs.nagy@arm.com>

	[BZ #18034]
	* sysdeps/aarch64/dl-tlsdesc.h (_dl_tlsdesc_return_lazy): Declare.
	* sysdeps/aarch64/dl-tlsdesc.S (_dl_tlsdesc_return_lazy): Define.
	(_dl_tlsdesc_undefweak): Guarantee TLSDESC entry and argument load-load
	ordering using ldar.
	(_dl_tlsdesc_dynamic): Likewise.
	(_dl_tlsdesc_return_lazy): Likewise.
	* sysdeps/aarch64/tlsdesc.c (_dl_tlsdesc_resolve_rela_fixup): Use
	relaxed atomics instead of volatile and synchronize with release store.
	(_dl_tlsdesc_resolve_hold_fixup): Use relaxed atomics instead of
	volatile.
	* elf/tlsdeschtab.h (_dl_tlsdesc_resolve_early_return_p): Likewise.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: tlsdesc-v4.diff
Type: text/x-patch
Size: 6896 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20150615/14e66a43/attachment.bin>