linux-kernel - Re: Linux-kernel examples for LKMM recipes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 Oct 2017 15:44:07 -0400 (EDT)
From:   Alan Stern <stern@...land.harvard.edu>
To:     "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
cc:     Andrea Parri <parri.andrea@...il.com>,
        Will Deacon <will.deacon@....com>, <peterz@...radead.org>,
        <boqun.feng@...il.com>, <npiggin@...il.com>, <dhowells@...hat.com>,
        Jade Alglave <j.alglave@....ac.uk>,
        Luc Maranget <luc.maranget@...ia.fr>,
        Kernel development list <linux-kernel@...r.kernel.org>
Subject: Re: Linux-kernel examples for LKMM recipes

On Wed, 11 Oct 2017, Paul E. McKenney wrote:

> This document lists the litmus-test patterns that we have been discussing,
> along with examples from the Linux kernel.  This is intended to feed into
> the recipes document.  All examples are from v4.13.
> 
> 0.	Single-variable SC.
> 
> 	a.	Within a single CPU, the use of the ->dynticks_nmi_nesting
> 		counter by rcu_nmi_enter() and rcu_nmi_exit() qualifies
> 		(see kernel/rcu/tree.c).  The counter is accessed by
> 		interrupts and NMIs as well as by process-level code.
> 		This counter can be accessed by other CPUs, but only
> 		for debug output.

I'm not sure that single-variable SC can really be represented by an 
example.  It gets used literally all over the kernel -- it's such a 
large part of the way we think about computer programs that we rely on 
it unconsciously.

For example, the very first function in the very first C source file 
in the kernel/ directory (namely, check_free_space() in kernel/acct.c) 
includes this code:

        if (acct->active) {
                u64 suspend = sbuf.f_blocks * SUSPEND;
                do_div(suspend, 100);

How do we know that the value which gets divided by 100 is
sbuf.f_blocks * SUSPEND and not the random garbage which was stored in
suspend's memory location before it was initialized?  Answer:
per-variable SC.

Okay, maybe that's not really applicable, since it doesn't involve
accesses to shared memory.  Here's an example that does.  
get_futex_key() in kernel/futex.c calls READ_ONCE(page->mapping) twice.  
How do we know that the value retrieved by the second call was not
stored _earlier_ than the value retrieved by the first call?  
Per-variable SC.

> 	b.	Between CPUs, I would put forward the ->dflags
> 		updates, but this is anything but simple.  But maybe
> 		OK for an illustration?

Pretty much any code that accesses the same shared variable twice on
the same CPU could be an example of per-variable SC.  But I don't think 
people would learn much by studying such examples.

Alan