From bc1da38c3d29b4950b302b36fd180bf86bdcb45c Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Mon, 15 Jul 2024 10:05:37 -0700 Subject: crypto/subtle: add DIT closure Add a new function, WithDataIndependentTiming, which takes a function as an argument, and encloses it with calls to set/unset the DIT PSTATE bit on Arm64. Since DIT is OS thread-local, for the duration of the execution of WithDataIndependentTiming, we lock the goroutine to the OS thread, using LockOSThread. For long running operations, this is likely to not be performant, but we expect this to be tightly scoped around cryptographic operations that have bounded execution times. If locking to the OS thread turns out to be too slow, another option is to add a bit to the g state indicating if a goroutine has DIT enabled, and then have the scheduler enable/disable DIT when scheduling a g. Additionally, we add a new GODEBUG, dataindependenttiming, which allows setting DIT for an entire program. Running a program with dataindependenttiming=1 enables DIT for the program during initialization. In an ideal world PSTATE.DIT would be inherited from the parent thread, so we'd only need to set it in the main thread and then all subsequent threads would inherit the value. While this does happen in the Linux kernel [0], it is not the case for darwin [1]. Rather than add complex logic to only set it on darwin for each new thread, we just unconditionally set it in mstart1 and cgocallbackg1 regardless of the OS. DIT will already impose some overhead, and the cost of setting the bit is only ~two instructions (CALL, MSR), so it should be cheap enough. Fixes #66450 Updates #49702 [0] https://github.com/torvalds/linux/blob/e8bdb3c8be08c9a3edc0a373c0aa8729355a0705/arch/arm64/kernel/process.c#L373 [1] https://github.com/apple-oss-distributions/xnu/blob/8d741a5de7ff4191bf97d57b9f54c2f6d4a15585/osfmk/arm64/status.c#L1666 Change-Id: I78eda691ff9254b0415f2b54770e5850a0179749 Reviewed-on: https://go-review.googlesource.com/c/go/+/598336 Reviewed-by: Michael Knyszek Reviewed-by: Filippo Valsorda Reviewed-by: Michael Pratt LUCI-TryBot-Result: Go LUCI --- src/runtime/cgocall.go | 12 ++++++++++++ src/runtime/proc.go | 4 ++++ src/runtime/runtime1.go | 2 ++ 3 files changed, 18 insertions(+) (limited to 'src/runtime') diff --git a/src/runtime/cgocall.go b/src/runtime/cgocall.go index 0effcb8053..326674cd2e 100644 --- a/src/runtime/cgocall.go +++ b/src/runtime/cgocall.go @@ -425,6 +425,13 @@ func cgocallbackg1(fn, frame unsafe.Pointer, ctxt uintptr) { restore := true defer unwindm(&restore) + var ditAlreadySet bool + if debug.dataindependenttiming == 1 && gp.m.isextra { + // We only need to enable DIT for threads that were created by C, as it + // should already by enabled on threads that were created by Go. + ditAlreadySet = sys.EnableDIT() + } + if raceenabled { raceacquire(unsafe.Pointer(&racecgosync)) } @@ -440,6 +447,11 @@ func cgocallbackg1(fn, frame unsafe.Pointer, ctxt uintptr) { racereleasemerge(unsafe.Pointer(&racecgosync)) } + if debug.dataindependenttiming == 1 && !ditAlreadySet { + // Only unset DIT if it wasn't already enabled when cgocallback was called. + sys.DisableDIT() + } + // Do not unwind m->g0->sched.sp. // Our caller, cgocallback, will do that. restore = false diff --git a/src/runtime/proc.go b/src/runtime/proc.go index 3f360ef129..17c375de1a 100644 --- a/src/runtime/proc.go +++ b/src/runtime/proc.go @@ -1848,6 +1848,10 @@ func mstart1() { mstartm0() } + if debug.dataindependenttiming == 1 { + sys.EnableDIT() + } + if fn := gp.m.mstartfn; fn != nil { fn() } diff --git a/src/runtime/runtime1.go b/src/runtime/runtime1.go index 56886ea571..7a092e8039 100644 --- a/src/runtime/runtime1.go +++ b/src/runtime/runtime1.go @@ -331,6 +331,7 @@ var debug struct { traceadvanceperiod int32 traceCheckStackOwnership int32 profstackdepth int32 + dataindependenttiming int32 // debug.malloc is used as a combined debug check // in the malloc function and should be set @@ -367,6 +368,7 @@ var dbgvars = []*dbgVar{ {name: "asynctimerchan", atomic: &debug.asynctimerchan}, {name: "cgocheck", value: &debug.cgocheck}, {name: "clobberfree", value: &debug.clobberfree}, + {name: "dataindependenttiming", value: &debug.dataindependenttiming}, {name: "disablethp", value: &debug.disablethp}, {name: "dontfreezetheworld", value: &debug.dontfreezetheworld}, {name: "efence", value: &debug.efence}, -- cgit v1.3