linux-kernel - Re: [PATCH RFC] vm_unmap_aliases: allow callers to inhibit TLB flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200902200441.08541.nickpiggin@yahoo.com.au>
Date:	Fri, 20 Feb 2009 04:41:07 +1100
From:	Nick Piggin <nickpiggin@...oo.com.au>
To:	Jeremy Fitzhardinge <jeremy@...p.org>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Linux Memory Management List <linux-mm@...ck.org>,
	"the arch/x86 maintainers" <x86@...nel.org>,
	Arjan van de Ven <arjan@...ux.intel.com>
Subject: Re: [PATCH RFC] vm_unmap_aliases: allow callers to inhibit TLB flush

On Friday 20 February 2009 04:02:38 Jeremy Fitzhardinge wrote:
> Nick Piggin wrote:
> > On Wednesday 18 February 2009 08:57:56 Jeremy Fitzhardinge wrote:
> >> Nick Piggin wrote:
> >>> I have patches to move the tlb flushing to an asynchronous process
> >>> context... but all tweaks to that (including flushing at vmap) are just
> >>> variations on the existing flushing scheme and don't solve your
> >>> problem, so I don't think we really need to change that for the moment
> >>> (my patches are mainly for latency improvement and to allow vunmap to
> >>> be usable from interrupt context).
> >>
> >> Hi Nick,
> >>
> >> I'm very interested in being able to call vm_unmap_aliases() from
> >> interrupt context.  Does the work you mention here encompass that?
> >
> > No, and it can't because we can't do the global kernel tlb flush
> > from interrupt context.
> >
> > There is basically no point in doing the vm_unmap_aliases from
> > interrupt context without doing the global TLB flush as well,
> > because you still cannot reuse the virtual memory, you still have
> > possible aliases to it, and you still need to schedule a TLB flush
> > at some point anyway.
>
> But that's only an issue when you actually do want to reuse the virtual
> address space.  Couldn't you set a flag saying "tlb flush needed", so
> when cpu X is about to use some of that address space, it flushes
> first?  Avoids the need for synchronous cross-cpu tlb flushes.  It
> assumes they're not currently using that address space, but I think that
> would indicate a bug anyway.

Then what is the point of the vm_unmap_aliases? If you are doing it
for security it won't work because other CPUs might still be able
to write through dangling TLBs. If you are not doing it for
security then it does not need to be done at all.

Unless it is something strange that Xen does with the page table
structure and you just need to get rid of those?


> (Xen does something like this internally to either defer or avoid many
> expensive tlb operations.)
>
> >> For Xen dom0, when someone does something like dma_alloc_coherent, we
> >> allocate the memory as normal, and then swizzle the underlying physical
> >> pages to be machine physically contiguous (vs contiguous pseudo-physical
> >> guest memory), and within the addressable range for the device.  In
> >> order to do that, we need to make sure the pages are only mapped by the
> >> linear mapping, and there are no other aliases.
> >
> > These are just stale aliases that will no longer be operated on
> > unless there is a kernel bug -- so can you just live with them,
> > or is it a security issue of memory access escaping its domain?
>
> The underlying physical page is being exchanged, so the old page is
> being returned to Xen's free page pool.  It will refuse to do the
> exchange if the guest still has pagetable references to the page.

But it refuses to do this because it is worried about dangling TLBs?
Or some implementation detail that can't handle the page table
entries?


> > If it is really no other way around it, it would be possible to
> > allow arch code to take advantage of this if it knows its TLB
> > flush is interrupt safe.
>
> It's almost safe.  I've got this patch in my tree to tie up the
> flush_tlb_all loose end, though I won't claim its pretty.

Hmm. Let's just try to establish that it is really required first.

Or... what if we just allow a compile and/or boot time flag to direct
that it does not want lazy vmap unmapping and it will just revert to
synchronous unmapping? If Xen needs lots of flushing anyway it might
not be a win anyway.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/