linux-kernel - Re: [MIPS]clocks_calc_mult_shift() may gen a too big mult value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4EAEE92D.4080402@gmail.com>
Date:	Mon, 31 Oct 2011 11:30:05 -0700
From:	David Daney <ddaney.cavm@...il.com>
To:	John Stultz <johnstul@...ibm.com>,
	"tglx@...utronix.de" <tglx@...utronix.de>
CC:	zhangfx <zhangfx@...ote.com>, Chen Jie <chenj@...ote.com>,
	Yong Zhang <yong.zhang0@...il.com>,
	"linux-mips@...ux-mips.org" <linux-mips@...ux-mips.org>,
	LKML <linux-kernel@...r.kernel.org>, yanhua <yanh@...ote.com>,
	项宇 <xiangy@...ote.com>,
	孙海勇 <sunhy@...ote.com>
Subject: Re: [MIPS]clocks_calc_mult_shift() may gen a too big mult value

On 10/31/2011 11:12 AM, John Stultz wrote:
> On Mon, 2011-10-31 at 21:59 +0800, zhangfx wrote:
[...]
>>
>> In short, choosing a mult close to 2^32 is dangerous. But I don't know
>> what's the best way to avoid it for general cases, because I don't know
>> how big error can be and the adj can be for different systems.
>
> Ah. Ok, sorry for being so slow to understand.
>
> So yea, I think you're right that the issue seems to be that for certain
> feq values, the resulting mult,shift pair is optimized a little too far,
> and we don't leave enough room for ntp adjustments to mult, without the
> possibility of overflowing mult.
>
> The following patch should handle it (although I'm at a conf right now,
> so I couldn't test it), although I might be trying to be too smart here.
> Rather then just checking if mult is larger then 0xf0000000, we try to
> quantify the largest valid mult adjustment, and then make sure mult +
> that value doesn't overflow. NTP limits adjustments to 500ppm, but the
> kernel might have to deal with larger internal adjustments. Probably we
> could be safe ruling out larger then 5% adjustments.
>
> So then its just a matter of 1/2^4. So the largest mult adjustment
> should be 1<<  (cs->shift - 4)
>
> Does this seem reasonable? Let me know if this seems to work for you.
>
> Thomas: does this fix look like its in a reasonable spot? I don't want
> to clutter up the calc_mult_shift() code up since this really only
> applies to clocksources and not clockevents.
>
> NOT TESTED&  NOT FOR INCLUSION (YET)
> Signed-off-by: John Stultz<john.stultz@...aro.org>
> diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
> index cf52fda..73518d2 100644
> --- a/kernel/time/clocksource.c
> +++ b/kernel/time/clocksource.c
> @@ -640,7 +640,7 @@ static void clocksource_enqueue(struct clocksource *cs)
>   void __clocksource_updatefreq_scale(struct clocksource *cs, u32 scale, u32 freq)
>   {
>   	u64 sec;
> -
> +	u32 maxadj;
>   	/*
>   	 * Calc the maximum number of seconds which we can run before
>   	 * wrapping around. For clocksources which have a mask>  32bit
> @@ -661,6 +661,22 @@ void __clocksource_updatefreq_scale(struct clocksource *cs, u32 scale, u32 freq)
>
>   	clocks_calc_mult_shift(&cs->mult,&cs->shift, freq,
>   			       NSEC_PER_SEC / scale, sec * scale);
> +
> +	/*
> +	 * Since mult may be adjusted by ntp, add an extra saftey margin
> +	 * for clocksources that have large mults, to avoid overflow.
> +	 *
> +	 * Assume we won't try to correct for more then 5% adjustments

Can we do any better than making assumptions about this?

The current assumption appears to be that only very small adjustments 
will be made, and that didn't workout so well.

Is it possible to put hard constraints on these things, so that it will 
always work?

David Daney


> +	 * (50,000 ppm), which approximates to 1/16 or 1/2^4.
> +	 * Thus 1<<  (shift - 4) is the largest mult adjustment we'll
> +	 * support.
> +	 */
> +	maxadj = 1<<  (shift-4);
> +	if ((cs->mult + maxadj<  cs->mult) || (cs->mult - maxadj>  cs->mult)) {
> +		cs->mult>>= 1;
> +		cs->shift--;
> +	}
> +
>   	cs->max_idle_ns = clocksource_max_deferment(cs);
>   }
>   EXPORT_SYMBOL_GPL(__clocksource_updatefreq_scale);
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/