lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sat, 12 Jul 2014 14:53:17 +0000 (UTC)
From:	Mathieu Desnoyers <>
To:	Thomas Gleixner <>
Cc:	LKML <>,
	John Stultz <>,
	Peter Zijlstra <>,
	Steven Rostedt <>
Subject: Re: [patch 54/55] timekeeping: Provide fast and NMI safe access to

----- Original Message -----
> From: "Thomas Gleixner" <>
> To: "LKML" <>
> Cc: "John Stultz" <>, "Peter Zijlstra" <>, "Steven Rostedt"
> <>, "Mathieu Desnoyers" <>
> Sent: Friday, July 11, 2014 9:45:19 AM
> Subject: [patch 54/55] timekeeping: Provide fast and NMI safe access to CLOCK_MONOTONIC[_RAW]
> Tracers want a correlated time between the kernel instrumentation and
> user space. We really do not want to export sched_clock() to user
> space, so we need to provide something sensible for this.
> Using separate data structures with an non blocking sequence count
> based update mechanism allows us to do that. The data structure
> required for the readout has a sequence counter and two copies of the
> timekeeping data.
> On the update side:
>   tkf->seq++;
>   smp_wmb();
>   update(tkf->base[0], tk;
>   tkf->seq++;
>   smp_wmb();
>   update(tkf->base[1], tk;
> On the reader side:
>   do {
>      seq = tkf->seq;
>      smp_rmb();
>      idx = seq & 0x01;
>      now = now(tkf->base[idx]);
>      smp_rmb();
>   } while (seq != tkf->seq)
> So if NMI hits the update of base[0] it will use base[1] which is
> still consistent. In case of CLOCK_MONOTONIC this can result in
> slightly wrong timestamps (a few nanoseconds) accross an update. Not a
> big issue for the intended use case.

Hi Thomas,

I'm perhaps missing something here, but what happens with the
following scenario ?

Initial conditions:

tkf->seq = 0
tkf->base[0] and tkf->base[1] are initialized.

CPU 0                                      CPU 1
------------                               ----------------
  tkf->seq++ (reordered before update)
                                           seq = tkf->seq (reads 2)
                                           idx = seq & 0x01
                                           now = now(tkf->base[idx]   (reads base[0])
  update(tkf->base[0], tk) (racy concurrent update)
                                           while (seq != tkf->seq) (they are equal)

So AFAIU, we end up returning a corrupted value. Adding a
smp_wmb() between update of base[0] and increment of seq,
as well as between update of base[1] and the _following_
increment of seq (next update call) would fix this.

Thoughts ?



Mathieu Desnoyers
EfficiOS Inc.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists