linux-kernel - RE: Mapping PCI BAR through /sys/devices/pci* sets cache-disable andwrite-through

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1208409631.10327.5.camel@koto.keithp.com>
Date:	Wed, 16 Apr 2008 22:20:31 -0700
From:	Keith Packard <keithp@...thp.com>
To:	"Pallipadi, Venkatesh" <venkatesh.pallipadi@...el.com>
Cc:	linux-kernel <linux-kernel@...r.kernel.org>,
	"Siddha, Suresh B" <suresh.b.siddha@...el.com>
Subject: RE: Mapping PCI BAR through /sys/devices/pci* sets cache-disable
	andwrite-through

On Wed, 2008-04-16 at 15:23 -0700, Pallipadi, Venkatesh wrote:

> Setting flags "_PAGE_PCD | _PAGE_PWT" maps to PAT_3 which is "UC". So,
> the mapping X server will get is UC and if X sets MTRR to WC, it will
> not have any effect on this mapping, which will be still UC. There may
> be apps which depend on this /sys/ interface giving UC mapping always...

Sure, but X wants WC in the biggest way (our measurements show WC being
more than 6 times faster for writes, the operation we do the most of).

Jesse Barnes suggested using the fact that the BAR was prefetchable to
guess that this region should not be mapped UC. I don't know of any
other information available at this API that would help make a better
choice; there are no ioctls on /sys files that we could use to
manipulate the mapping.

> With PAT patches, we now have /sys/devices/pci*resource_wc (in addition
> to resource) for any PREFETCHABLE region. So, X has to change to use
> that new interface to get WC mapping.

Yeah, we'll do that when it becomes available. Would it make sense in
the pre-PAT world to use Jesse's guess?

In any case, we'll continue to use the fact that mprotect is also broken
to get our WC mapping working (using mprotect PROT_NONE followed by
mprotect PROT_READ|PROT_WRITE causes the CD and WT bits to get cleared).
We're fortunate in this case that we've found a bug to exploit that
gives us the desired behaviour.

-- 
keith.packard@...el.com

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)