linux-kernel - Re: [PATCH 0/2] arm64: Only call into preempt_schedule() if need

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Nov 2018 09:56:40 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Will Deacon <will.deacon@....com>
Cc:     linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        ard.biesheuvel@...aro.org, catalin.marinas@....com, rml@...h9.net,
        tglx@...utronix.de, schwidefsky@...ibm.com
Subject: Re: [PATCH 0/2] arm64: Only call into preempt_schedule() if
 need_resched()

On Tue, Nov 27, 2018 at 07:45:00PM +0000, Will Deacon wrote:
> Hi all,
> 
> This pair of patches improves our preempt_enable() implementation slightly
> on arm64 by making the resulting call to preempt_schedule() conditional
> on need_resched(), which is tracked in bit 32 of the preempt count. The
> logic is inverted so that we can detect the preempt count going to zero
> and need_resched being set with a single CBZ instruction.

>   40:   a9bf7bfd        stp     x29, x30, [sp, #-16]!
>   44:   910003fd        mov     x29, sp
>   48:   d5384101        mrs     x1, sp_el0
>   4c:   f9400820        ldr     x0, [x1, #16]

We load x0 which is a u64, right?

>   50:   d1000400        sub     x0, x0, #0x1
>   54:   b9001020        str     w0, [x1, #16]

But we store w0, which is the low u32, such as to not touch the high
word which contains the preempt bit.

>   58:   b4000060        cbz     x0, 64 <will+0x24>
>   5c:   a8c17bfd        ldp     x29, x30, [sp], #16
>   60:   d65f03c0        ret
>   64:   94000000        bl      0 <preempt_schedule>
>   68:   a8c17bfd        ldp     x29, x30, [sp], #16
>   6c:   d65f03c0        ret

Why not?

   58:   b4000060        cbnz    x0, 60 <will+0x24>
   5c:   94000000        bl      0 <preempt_schedule>
   60:   a8c17bfd        ldp     x29, x30, [sp], #16
   64:   d65f03c0        ret

which seems shorter.


So it's still early, and I haven't finished (or really even started) my
pot 'o tea, but what about:


	ldr x0, [x1, #16]	// seees the high bit set -- no preempt needed
	sub x0, x0, #1

	<interrupt>
	  ...
	  resched_curr()
	    set_tsk_need_resched();
	    set_preempt_need_resched();
	</interrupt> // sees preempt_count != 0, does not preempt

	str w0, [x1, #16] // stores preempt_count == 0
	cbnz x0, 1f // taken, we still observe the high word from before

1:	ret


Which then ends with preempt_count==0, need_resched==0 and no actual
preemption afaict.

Can you use mis-matched ll x0 / sc w0 to do this same thing and detector
the intermediate write on the high word?