Re: [PATCH] Linux: Use 32-bit vDSO for clock_gettime, gettimeofday, time (bug 28071)

[Adhemerval Zanella via Libc-alpha <libc-alpha@sourceware.org>]

On 10/07/2021 14:15, Florian Weimer via Libc-alpha wrote:
> The previous approach defeats the vDSO optimization on older kernels
> because a failing clock_gettime64 system call is performed on every
> function call.  It also results in a clobbered errno value, exposing
> an OpenJDK bug (JDK-8270244).
> 
> The existing layering is preserved for __ASSUME_TIME64_SYSCALLS.
> Otherwise, 32-bit time and gettimeofday use 32-bit clock_gettime,
> and clock_gettime is implemented using the vDSO.
> 
> Tested on i686-linux-gnu (with a time64 and non-time64 kernel),
> x86_64-linux-gnu.  Built with build-many-glibcs.py.
> 
> ---
>  sysdeps/unix/sysv/linux/Makefile                   |  9 +++-
>  sysdeps/unix/sysv/linux/clock_gettime.c            |  8 +++
>  sysdeps/unix/sysv/linux/gettimeofday.c             | 21 +++++---
>  sysdeps/unix/sysv/linux/time.c                     | 22 ++++++---
>  .../unix/sysv/linux/tst-clock_gettime-clobber.c    | 57 ++++++++++++++++++++++
>  sysdeps/unix/sysv/linux/tst-gettimeofday-clobber.c | 37 ++++++++++++++
>  sysdeps/unix/sysv/linux/tst-time-clobber.c         | 36 ++++++++++++++
>  7 files changed, 173 insertions(+), 17 deletions(-)
> 
> diff --git a/sysdeps/unix/sysv/linux/Makefile b/sysdeps/unix/sysv/linux/Makefile
> index 7d43dc95f2..9f00e53de4 100644
> --- a/sysdeps/unix/sysv/linux/Makefile
> +++ b/sysdeps/unix/sysv/linux/Makefile
> @@ -213,7 +213,14 @@ ifeq ($(subdir),time)
>  sysdep_headers += sys/timex.h bits/timex.h
>  
>  sysdep_routines += ntp_gettime ntp_gettimex
> -endif
> +
> +tests += \
> +  tst-clock_gettime-clobber \
> +  tst-gettimeofday-clobber \
> +  tst-time-clobber \
> +  # tests
> +
> +endif# $(subdir) == time
>  
>  ifeq ($(subdir),signal)
>  tests-special += $(objpfx)tst-signal-numbers.out
> diff --git a/sysdeps/unix/sysv/linux/clock_gettime.c b/sysdeps/unix/sysv/linux/clock_gettime.c
> index cfe9370455..86a72ecf5a 100644
> --- a/sysdeps/unix/sysv/linux/clock_gettime.c
> +++ b/sysdeps/unix/sysv/linux/clock_gettime.c
> @@ -64,6 +64,7 @@ libc_hidden_def (__clock_gettime64)
>  int
>  __clock_gettime (clockid_t clock_id, struct timespec *tp)
>  {
> +# ifdef __ASSUME_TIME64_SYSCALLS
>    int ret;
>    struct __timespec64 tp64;
>  
> @@ -81,6 +82,13 @@ __clock_gettime (clockid_t clock_id, struct timespec *tp)
>      }
>  
>    return ret;
> +# else /* !__ASSUME_TIME64_SYSCALLS */
> +#  ifdef HAVE_CLOCK_GETTIME_VSYSCALL
> +  return INLINE_VSYSCALL (clock_gettime, 2, clock_id, tp);
> +#  else
> +  return INLINE_SYSCALL_CALL (clock_gettime, clock_id, tp);
> +#  endif
> +# endif /* !__ASSUME_TIME64_SYSCALLS */
>  }
>  #endif
>  libc_hidden_def (__clock_gettime)

This does not fix the issue for __ASSUME_TIME64_SYSCALLS where it still uses
INLINE_SYSCALL_CALL which might clobber the errno, besides adding another
ifdef code path (which I really want to avoid).  Instead I think we need to 
open-coded the INLINE_VSYSCALL macro and replace all INLINE_SYSCALL_CALL 
with INTERNAL_SYSCALL_CALLS:

/* Get current value of CLOCK and store it in TP.  */
int
__clock_gettime64 (clockid_t clock_id, struct __timespec64 *tp)
{
  int r;

#ifdef HAVE_CLOCK_GETTIME64_VSYSCALL
  int (*vdso_time64)(clockid_t clock_id, struct __timespec64 *tp)
    = GLRO(dl_vdso_clock_gettime64);
  if (vdso_time64 != NULL)
    {
      r = INTERNAL_VSYSCALL_CALL (vdso_time64, 2, clock_id, tp);                                                  
      if (r == 0)                                                                                                 
        return 0;
      return INLINE_SYSCALL_ERROR_RETURN_VALUE (-r);                                                              
    }
#endif
#ifdef HAVE_CLOCK_GETTIME_VSYSCALL
  int (*vdso_time)(clockid_t clock_id, struct timespec *tp)                                                       
    = GLRO(dl_vdso_clock_gettime);                                                                                
  if (vdso_time != NULL)                                                                                          
    { 
      struct timespec tp32;
      r = INTERNAL_VSYSCALL_CALL (vdso_time, 2, clock_id, &tp32);                                                 
      if (r == 0)                                                                                                 
        { 
          *tp = valid_timespec_to_timespec64 (tp32);                                                              
          return 0;                                                                                               
        }
      return INLINE_SYSCALL_ERROR_RETURN_VALUE (-r);                                                              
    }
#endif                                                                                                            
  
  r = INTERNAL_SYSCALL_CALL (clock_gettime64, clock_id, tp);                                                      
  if (r == 0)                                                                                                     
    return 0;
  if (-r != ENOSYS)
    return INLINE_SYSCALL_ERROR_RETURN_VALUE (-r);                                                                

#ifndef __ASSUME_TIME64_SYSCALLS
  /* Fallback code that uses 32-bit support.  */                                                                  
  struct timespec tp32;
  r = INTERNAL_SYSCALL_CALL (clock_gettime, clock_id, &tp32);                                                     
  if (r == 0)                                                                                                     
    { 
      *tp = valid_timespec_to_timespec64 (tp32);
      return 0;
    }
#endif

  return INLINE_SYSCALL_ERROR_RETURN_VALUE (-r);

}

Keep in mind the previous code preferred 64-bit syscall for the case
where the kernel provides 64-bit time_t syscalls *and* also a 32-bit 
vDSO (in this case the *64-bit* syscall should be preferable over the
vDSO). I do not know if this is still the case for most of architectures, 
maybe we should ignore this scenario and assume that if the architecture
provided a clock_gettime vDSO and ahs 64-bit support it would also provide
a 64-bit vDSO clock_gettime.

I have tested the above with the clobber tests on this patch on a kernel
v5.11 (64-bit vDSO), v4.4 (32-bit vDSO), and 3.10 (no vDSO).

> diff --git a/sysdeps/unix/sysv/linux/gettimeofday.c b/sysdeps/unix/sysv/linux/gettimeofday.c
> index 4197be5656..1b353956ea 100644
> --- a/sysdeps/unix/sysv/linux/gettimeofday.c
> +++ b/sysdeps/unix/sysv/linux/gettimeofday.c
> @@ -16,18 +16,17 @@
>     License along with the GNU C Library; if not, see
>     <https://www.gnu.org/licenses/>.  */
>  
> +#include <dl-vdso.h>
> +#include <libc-vdso.h>
>  #include <time.h>
>  #include <string.h>
> +#include <sysdep-vdso.h>
>  
>  /* Optimize the function call by setting the PLT directly to vDSO symbol.  */
>  #ifdef USE_IFUNC_GETTIMEOFDAY
>  # include <sysdep.h>
> -# include <sysdep-vdso.h>
>  
>  # ifdef SHARED
> -# include <dl-vdso.h>
> -# include <libc-vdso.h>
> -
>  static int
>  __gettimeofday_syscall (struct timeval *restrict tv, void *restrict tz)
>  {
> @@ -54,7 +53,7 @@ __gettimeofday (struct timeval *restrict tv, void *restrict tz)
>  }
>  # endif
>  weak_alias (__gettimeofday, gettimeofday)
> -#else /* USE_IFUNC_GETTIMEOFDAY  */
> +#else /* !USE_IFUNC_GETTIMEOFDAY  */
>  /* Conversion of gettimeofday function to support 64 bit time on archs
>     with __WORDSIZE == 32 and __TIMESIZE == 32/64  */
>  #include <errno.h>
> @@ -73,9 +72,12 @@ __gettimeofday64 (struct __timeval64 *restrict tv, void *restrict tz)
>    return 0;
>  }
>  
> -# if __TIMESIZE != 64
> +# if __TIMESIZE == 64
> +weak_alias (__gettimeofday, gettimeofday)
> +# else /* __TIMESIZE != 64 */
>  libc_hidden_def (__gettimeofday64)
>  
> +#  ifdef __ASSUME_TIME64_SYSCALL
>  int
>  __gettimeofday (struct timeval *restrict tv, void *restrict tz)
>  {
> @@ -92,6 +94,9 @@ __gettimeofday (struct timeval *restrict tv, void *restrict tz)
>    *tv = valid_timeval64_to_timeval (tv64);
>    return 0;
>  }
> -# endif
>  weak_alias (__gettimeofday, gettimeofday)
> -#endif
> +#  else /* !__ASSUME_TIME64_SYSCALL */
> +#   include <time/gettimeofday.c>
> +#  endif /* !__ASSUME_TIME64_SYSCALL */
> +# endif
> +#endif /* !USE_IFUNC_GETTIMEOFDAY  */

By making clock_gettime not clobbering the errno in case of success
as above there is no need to change Linux gettimeofday (since it only sets
errno for the case of EOVERFLOW).

> diff --git a/sysdeps/unix/sysv/linux/time.c b/sysdeps/unix/sysv/linux/time.c
> index 43fec7d3a7..b194127691 100644
> --- a/sysdeps/unix/sysv/linux/time.c
> +++ b/sysdeps/unix/sysv/linux/time.c
> @@ -16,16 +16,16 @@
>     License along with the GNU C Library; if not, see
>     <https://www.gnu.org/licenses/>.  */
>  
> +#include <dl-vdso.h>
> +#include <libc-vdso.h>
> +#include <sysdep-vdso.h>
> +
>  /* Optimize the function call by setting the PLT directly to vDSO symbol.  */
>  #ifdef USE_IFUNC_TIME
>  # include <time.h>
>  # include <sysdep.h>
> -# include <sysdep-vdso.h>
>  
>  #ifdef SHARED
> -# include <dl-vdso.h>
> -# include <libc-vdso.h>
> -
>  static time_t
>  time_syscall (time_t *t)
>  {
> @@ -46,7 +46,7 @@ time (time_t *t)
>    return INLINE_VSYSCALL (time, 1, t);
>  }
>  # endif /* !SHARED */
> -#else /* USE_IFUNC_TIME  */
> +#else /* !USE_IFUNC_TIME  */
>  # include <time.h>
>  # include <time-clockid.h>
>  # include <errno.h>
> @@ -63,10 +63,13 @@ __time64 (__time64_t *timer)
>      *timer = ts.tv_sec;
>    return ts.tv_sec;
>  }
> +# if __TIMESIZE == 64
> +weak_alias (__time, time)
>  
> -# if __TIMESIZE != 64
> +# else /* __TIMESIZE != 64 */
>  libc_hidden_def (__time64)
>  
> +#  ifdef __ASSUME_TIME64_SYSCALL
>  time_t
>  __time (time_t *timer)
>  {
> @@ -82,6 +85,9 @@ __time (time_t *timer)
>      *timer = t;
>    return t;
>  }
> -# endif
>  weak_alias (__time, time)
> -#endif
> +#  else /* !__ASSUME_TIME64_SYSCALL */
> +#   include <time/time.c>
> +#  endif /* !__ASSUME_TIME64_SYSCALL */
> +# endif /* __TIMESIZE != 64 */
> +#endif /* !USE_IFUNC_TIME */

Same for time.

> diff --git a/sysdeps/unix/sysv/linux/tst-clock_gettime-clobber.c b/sysdeps/unix/sysv/linux/tst-clock_gettime-clobber.c
> new file mode 100644
> index 0000000000..81a32bd15a
> --- /dev/null
> +++ b/sysdeps/unix/sysv/linux/tst-clock_gettime-clobber.c
> @@ -0,0 +1,57 @@
> +/* Check that clock_gettime does not clobber errno on success.
> +   Copyright (C) 2021 Free Software Foundation, Inc.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <https://www.gnu.org/licenses/>.  */
> +
> +#include <errno.h>
> +#include <time.h>
> +#include <support/check.h>
> +#include <stdio.h>
> +
> +static void
> +test_clock (clockid_t clk)
> +{
> +  printf ("info: testing clock: %d\n", (int) clk);
> +
> +  for (int original_errno = 0; original_errno < 2; ++original_errno)
> +    {
> +      errno = original_errno;
> +      struct timespec ts;
> +      if (clock_gettime (clk, &ts) == 0)
> +        TEST_COMPARE (errno, original_errno);
> +    }
> +}
> +
> +static int
> +do_test (void)
> +{
> +  test_clock (CLOCK_BOOTTIME);
> +  test_clock (CLOCK_BOOTTIME_ALARM);
> +  test_clock (CLOCK_MONOTONIC);
> +  test_clock (CLOCK_MONOTONIC_COARSE);
> +  test_clock (CLOCK_MONOTONIC_RAW);
> +  test_clock (CLOCK_PROCESS_CPUTIME_ID);
> +  test_clock (CLOCK_REALTIME);
> +  test_clock (CLOCK_REALTIME_ALARM);
> +  test_clock (CLOCK_REALTIME_COARSE);
> +#ifdef CLOCK_TAI
> +  test_clock (CLOCK_TAI);
> +#endif
> +  test_clock (CLOCK_THREAD_CPUTIME_ID);
> +  return 0;
> +}
> +
> +#include <support/test-driver.c>

Ok.

> diff --git a/sysdeps/unix/sysv/linux/tst-gettimeofday-clobber.c b/sysdeps/unix/sysv/linux/tst-gettimeofday-clobber.c
> new file mode 100644
> index 0000000000..bb9bdb67b0
> --- /dev/null
> +++ b/sysdeps/unix/sysv/linux/tst-gettimeofday-clobber.c
> @@ -0,0 +1,37 @@
> +/* Check that gettimeofday does not clobber errno.
> +   Copyright (C) 2021 Free Software Foundation, Inc.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <https://www.gnu.org/licenses/>.  */
> +
> +#include <errno.h>
> +#include <stddef.h>
> +#include <support/check.h>
> +#include <sys/time.h>
> +
> +static int
> +do_test (void)
> +{
> +  for (int original_errno = 0; original_errno < 2; ++original_errno)
> +    {
> +      errno = original_errno;
> +      struct timeval tv;
> +      gettimeofday (&tv, NULL);
> +      TEST_COMPARE (errno, original_errno);
> +    }
> +  return 0;
> +}
> +
> +#include <support/test-driver.c>

Ok.

> diff --git a/sysdeps/unix/sysv/linux/tst-time-clobber.c b/sysdeps/unix/sysv/linux/tst-time-clobber.c
> new file mode 100644
> index 0000000000..ad83be9be8
> --- /dev/null
> +++ b/sysdeps/unix/sysv/linux/tst-time-clobber.c
> @@ -0,0 +1,36 @@
> +/* Check that time does not clobber errno.
> +   Copyright (C) 2021 Free Software Foundation, Inc.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Lesser General Public
> +   License as published by the Free Software Foundation; either
> +   version 2.1 of the License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Lesser General Public License for more details.
> +
> +   You should have received a copy of the GNU Lesser General Public
> +   License along with the GNU C Library; if not, see
> +   <https://www.gnu.org/licenses/>.  */
> +
> +#include <errno.h>
> +#include <stddef.h>
> +#include <support/check.h>
> +#include <time.h>
> +
> +static int
> +do_test (void)
> +{
> +  for (int original_errno = 0; original_errno < 2; ++original_errno)
> +    {
> +      errno = original_errno;
> +      time (NULL);
> +      TEST_COMPARE (errno, original_errno);
> +    }
> +  return 0;
> +}
> +
> +#include <support/test-driver.c>
> 

Ok.