Repository navigation
feat(relinker): support SSE guest GS memory accesses - #11689
Felipebmaitan wants to merge 60 commits into
Conversation
…ower of two ElfReader accepted any p_align on an executable's PT_LOAD, and on the uncovered PT_SCE_RELRO it turns into one, although the gABI says p_align should be 0, 1 or a power of two. When such a segment starts on a page that an earlier segment maps with other bytes, the Linux patcher pads the output one byte at a time to the next offset congruent to its address modulo that alignment: a 3221-byte executable with an alignment of 0xfffffffffffffffb ran for 46 s, reached 12.9 GiB and failed with std::bad_alloc. Both segments are now refused, as the reader already refuses a PT_TLS alignment that is not a power of two. The guest module reader takes its headers from the same function, so the power-of-two half of its own alignment check can no longer fail and is dropped; its offset congruence check stays. A power-of-two alignment still reaches the padding, which the relinker technical debt now records. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # docs/dev/debt/relinker.md
|
Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.
|
# Conflicts: # core/relinker/relinker/tests/test_windows_guest_gs.py
There was a problem hiding this comment.
Correction (2026-11-01): this review's claim that maintainers close PRs without a title ID is wrong. CONTRIBUTING allows Unblocks: none; a title is only required when the PR fixes a title. The technical points below are unaffected.
No title ID and no log line. The Tested section states "No PS5, title, title-unblock or performance verification is claimed". Maintainers close PRs that name no title ID plus a log line proving a title reaches the change on main. Which title runs SSE %gs: accesses through this path, and what does main log for it today?
Stacked branch. 43 commits and 39 files (+2336) because the branch carries #11624, #11628, #11661 and the carried #11090/#11276 prerequisites. The main-target diff mixes four PRs. Please keep this draft until the prerequisites merge, or retarget it so only the SSE layer is reviewed. #11698 builds on this one in the same way, so the same applies there.
|
@CnRJay Addressed the Nov 1 stacking request at Fresh validation and limits:
Windows 11 ARM64 VM with WinLibs GCC 15.2 x64 translation: the external production-component harness builds the real libc/libkernel sources. At each of the five exact heads, guest_sysarch, guest_pthread_frame_chain and guest_pthread_join_detach pass (3/4); guest_thread_self aborts. Replacing only Thread.cpp with pinned main's implementation reproduces that failure; this is a component control, not a full main run. On the final head, guest_gs_lookup and guest_gs_no_avx pass, as does the separately built entry-stub bounds test. The no-AVX negative control exits 255 with the previous runtime and 0 with the policy. Physical non-AVX hardware remains untested. The broader final Windows run is not passing: 12/37 passed, 24 failed and the initially unbuilt bounds target was not run (it subsequently passed separately). Replay cases fail red-zone checks; a standalone probe with no AnyPS5 code reproduces the same canary loss when RSP is restored via the Windows exception context, with or without a continue handler. The full startup fixture fails on DLL replacement locking even on retry. Eight separate positive fixtures using the unchanged production DLL in fresh directories all exit 42: scalar/short/SSE/VEX executable startup and the corresponding guest-module initializers. These runs establish reached production startup/GS execution, not native x86 exception correctness. No assertions were weakened and no translated-host workaround was added. Fresh hosted Windows checks are pending. Full upstream Linux CI was skipped; dispatching the full selected chain returns HTTP 403 (admin rights required). A collaborator-run full build/test and native x86 Windows exception/red-zone validation remain external gates. The overlap scan remains fail-closed for conflicting/stale peers; no blanket no-overlap claim is made. I compared shared source changes (signal masks/reaping/stack/affinity and exception delivery, CMake tests, #10662 RELRO normalization and #12282 instruction-container lookup). #10518 remains open and declared; #10861 remains a declared debt merge-order dependency under its own owner, and I did not modify its branch. #11090/#11276 are merged. No merge or replacement PR was made. Fresh hosted checks exist on these heads, including Windows jobs; full Linux product CI is skipped. Dispatching the full selected chain with |
github-actions
Bot
added
needs rebase
|
Published current-main refresh at Fresh exact-head validation: six production libc/libkernel sysarch/pthread tests pass at each of the five heads (Linux amd64 under macOS translation, external component harness using the real production CMake source targets). Focused macOS arm64 Release relinker suites pass: scalar 42/42; short, SSE and VEX 43/43 each. Conventions and diff whitespace checks pass. These conversion/Linux component results are not a fresh native Windows runtime run. The previous heads' executable checks completed successfully; cancelled metadata runs are not new failures. B-Howell's native Windows six-test x3 pass/control remains independent evidence for the previous state head; I do not relabel it as testing these new heads. The old sysarch abort is addressed. No physical non-AVX, console/title or performance evidence is invented. Full selected-chain workflow dispatch after this push returned HTTP 403 (admin rights required). A collaborator can run |
What
Replay the bounded legacy SSE memory moves described in relinker debt through the protected GS frame: packed/scalar moves, MOVD/MOVQ and low/high-lane moves, including selected plain SSE followers of short GS instructions. Native instructions supply widths, alignment, lane and MXCSR behavior. Unmodeled arithmetic, prefixes, MMX and VEX/EVEX/XOP keep UD2 fallback.
Nov 3 refresh at
6246fb56d3e17d319d7c3e97b90092d1302bc7bcmerges main1e658521a0a599872612bb91949311e2956b5283through the existing stack, retaining every fetched maintainer commit. Restore main's shared GuestCopyIn/Out calls in sysarch; this removes the unintended local-copy diagnostic/Windows-write divergence. GS branches, EFAULT/EINVAL handling, four-byte i386 output, FS NotImplemented behavior and operation diagnostics remain. This addresses XairRrR's optional, nonblocking suggestion, not a new blocking review demand.Entry-stub bounds/RVA checks, #11090 guards, cached metadata registration/unload behavior, borrowed-span fallback and the VEX OS-enabled-AVX policy/--no-avx regression survive. Both GS continuation and main call-tracing debt entries are preserved.
Draft until prerequisites merge; base remains main. Increment over #11661.
Tested
Fresh Nov 3 checks: macOS arm64 Release relinker-only passes at each exact dependent head (scalar 42/42; short, SSE and VEX 43/43), including GS, entry-root/bounds, TLS and load regressions. Production libc/libkernel components are built separately on Linux amd64 under macOS translation with an external CMake harness; all five exact heads pass six production tests each: guest_sysarch, guest_thread_self, guest_pthread_frame_chain, guest_pthread_join_detach, guest_pthread_start and guest_pthread_attr. Relinker-only checks are not production Windows execution.
The prior heads' completed executable checks passed; cancelled metadata runs are not new failures. B-Howell's independent native Windows report covers old state head e0576a2 merged onto b28bb77: six tests x3, plus a failing main-production control. It is third-party prior-head evidence, not a rerun of the refreshed heads. The old sysarch failure is addressed. Previous translated-Windows red-zone/DLL-lock limits and physical non-AVX-host limits remain; no new hardware, console/title or performance claim is made.
Conventions and diff whitespace checks pass against pinned current main. Overlap scan rerun remains fail-closed for conflicting peer branches; no overlap-clear claim or repeated no-change overlap comment is made. #10518 remains open and declared; #10861 is owned separately and its branch was not modified. Fresh upstream native Windows/full production checks and re-review remain required after this push.
Checklist
main; no other open PR implements the same functionsNotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file.mdfiles or images added to the repository (attach them to this PR)Full selected-chain CI dispatch was attempted after pushing and returned HTTP 403: admin rights required. A collaborator can dispatch build.yml on main with
pr=11624 11628 11661 11689 11698,full=true,select=true. Fresh hosted checks are distinct from prior-head successful checks.