linux-kernel - Re: Overlapping ioremap() calls, set_memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.20.1603211721070.25290@eddie.linux-mips.org>
Date:	Mon, 21 Mar 2016 17:38:40 +0000 (GMT)
From:	"Maciej W. Rozycki" <macro@...ux-mips.org>
To:	Ingo Molnar <mingo@...nel.org>
cc:	Toshi Kani <toshi.kani@....com>,
	"Luis R. Rodriguez" <mcgrof@...nel.org>,
	Toshi Kani <toshi.kani@...com>,
	Paul McKenney <paulmck@...ux.vnet.ibm.com>,
	Dave Airlie <airlied@...hat.com>,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	linux-arch@...r.kernel.org, X86 ML <x86@...nel.org>,
	Daniel Vetter <daniel.vetter@...el.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	"H. Peter Anvin" <hpa@...or.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Borislav Petkov <bp@...en8.de>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Andy Lutomirski <luto@...nel.org>,
	Brian Gerst <brgerst@...il.com>
Subject: Re: Overlapping ioremap() calls, set_memory_*() semantics

On Wed, 9 Mar 2016, Ingo Molnar wrote:

> > > So to go back to the original suggestion from Luis, I've quoted it, but
> > > with a s/overlapping/aliased substitution:
> > > 
> > > > I had suggested long ago then that one possible resolution was for us
> > > > to add an API that *enables* aliased ioremap() calls, and only use it
> > > > on select locations in the kernel. This means we only have to convert a
> > > > few users to that call to white list such semantics, and by default
> > > > we'd disable aliased calls. To kick things off -- is this strategy
> > > > agreeable for all other architectures?
> > > 
> > > I'd say that since the overwhelming majority of ioremap() calls are not
> > > aliased, ever, thus making it 'harder' to accidentally alias is probably
> > > a good idea.
> > 
> > Did you mean 'aliased' or 'aliased with different cache attribute'?  The former 
> > check might be too strict.
> 
> I'd say even 'same attribute' aliasing is probably relatively rare.

 Please note that aliased cached mappings (any kinds of, not necessarily 
from `ioremap') cause a lot of headache (read: handling trouble) with 
architectures such as MIPS which support virtually indexed caches which 
suffer from cache aliasing.  There is a risk of data corruption if the 
same physical memory address space location is accessed through different 
virtual mappings as not all hardware catches duplicate cache entries 
created in such a case.

 We handle it in software for user mappings (although I keep having a 
feeling something always keeps escaping, due to the vast diversity of 
cache configurations possible), however I don't think we do for `ioremap', 
so disallowing aliased `ioremap' mappings by default sounds like a good 
idea to me.

 FWIW,

  Maciej