linux-kernel - Re: framebuffer corruption due to overlapping stp instructions on arm64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 6 Aug 2018 10:44:51 +0200
From:   Pavel Machek <pavel@....cz>
To:     Ramana Radhakrishnan <ramana.gcc@...glemail.com>
Cc:     Andrew Pinski <pinskia@...il.com>,
        Mikulas Patocka <mpatocka@...hat.com>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will.deacon@....com>,
        Russell King <linux@...linux.org.uk>,
        Thomas Petazzoni <thomas.petazzoni@...e-electrons.com>,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>,
        LKML <linux-kernel@...r.kernel.org>,
        GNU C Library <libc-alpha@...rceware.org>
Subject: Re: framebuffer corruption due to overlapping stp instructions on
 arm64

On Mon 2018-08-06 09:04:33, Ramana Radhakrishnan wrote:
> On Sun, Aug 5, 2018 at 10:36 PM, Pavel Machek <pavel@....cz> wrote:
> > Hi!
> >
> >> > I tried to use a PCIe graphics card on the MacchiatoBIN board and I hit a
> >> > strange problem.
> >> >
> >> > When I use the links browser in graphics mode on the framebuffer, I get
> >> > occasional pixel corruption. Links does memcpy, memset and 4-byte writes
> >> > on the framebuffer - nothing else.
> >> >
> >> > I found out that the pixel corruption is caused by overlapping unaligned
> >> > stp instructions inside memcpy. In order to avoid branching, the arm64
> >> > memcpy implementation may write the same destination twice with different
> >> > alignment. If I put "dmb sy" between the overlapping stp instructions, the
> >> > pixel corruption goes away.
> >> >
> >> > This seems like a hardware bug. Is it a known errata? Do you have any
> >> > workarounds for it?
> >>
> >> Yes fix Links not to use memcpy on the framebuffer.
> >> It is undefined behavior to use device memory with memcpy.
> >
> > No, I don't think so. Why do you think so?
> 
> It is undefined behaviour in the architecture.

Why do you think so? Pointer to documentation would be helpful.

Normal access is used for mmapped areas, and I don't think we want to
 change that.
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)