linux-kernel - RE: [PATCH v7 04/21] x86/split_lock: Align x86_capability to unsigned long to avoid split locked access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 18 Apr 2019 11:08:14 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     David Laight <David.Laight@...LAB.COM>,
        'Fenghua Yu' <fenghua.yu@...el.com>,
        'Thomas Gleixner' <tglx@...utronix.de>,
        'Ingo Molnar' <mingo@...hat.com>,
        'Borislav Petkov' <bp@...en8.de>,
        'H Peter Anvin' <hpa@...or.com>,
        'Paolo Bonzini' <pbonzini@...hat.com>,
        'Dave Hansen' <dave.hansen@...el.com>,
        'Ashok Raj' <ashok.raj@...el.com>,
        'Peter Zijlstra' <peterz@...radead.org>,
        'Ravi V Shankar' <ravi.v.shankar@...el.com>,
        "'Xiaoyao Li '" <xiaoyao.li@...el.com>,
        'Christopherson Sean J' <sean.j.christopherson@...el.com>,
        'Kalle Valo' <kvalo@...eaurora.org>,
        'Michael Chan' <michael.chan@...adcom.com>
CC:     'linux-kernel' <linux-kernel@...r.kernel.org>,
        'x86' <x86@...nel.org>,
        "'kvm@...r.kernel.org'" <kvm@...r.kernel.org>,
        "'netdev@...r.kernel.org'" <netdev@...r.kernel.org>,
        "'linux-wireless@...r.kernel.org'" <linux-wireless@...r.kernel.org>
Subject: RE: [PATCH v7 04/21] x86/split_lock: Align x86_capability to unsigned
 long to avoid split locked access

From: David Laight
> Sent: 18 April 2019 10:21
> From: Fenghua Yu
> > Sent: 17 April 2019 22:34
> >
> > set_cpu_cap() calls locked BTS and clear_cpu_cap() calls locked BTR to
> > operate on bitmap defined in x86_capability.
> >
> > Locked BTS/BTR accesses a single unsigned long location. In 64-bit mode,
> > the location is at:
> > base address of x86_capability + (bit offset in x86_capability / 64) * 8
> >
> > Since base address of x86_capability may not be aligned to unsigned long,
> > the single unsigned long location may cross two cache lines and
> > accessing the location by locked BTS/BTR introductions will cause
> > split lock.
> 
> Isn't the problem that the type (and definition) of x86_capability[] are wrong.
> If the 'bitmap' functions are used for it, it should be defined as a bitmap.
> This would make it 'unsigned long' not __u32.
> 
> This type munging of bitmaps only works on LE systems.
> 
> OTOH the locked BTS/BTR instructions could be changed to use 32 bit accesses.
> ISTR some of the associated functions use byte accesses.
> 
> Perhaps there ought to be asm wrappers for BTS/BTR that do 8bit and
> 32bit accesses.

A quick look shows that this isn't the only __32[] that is being
cast to (unsigned long) and then to set/test/clear_bit() in those
files.

I wonder how much other code is applying such casts?

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)