linux-kernel - Re: [PATCH] arm64: mmu: no write cache for O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 27 Mar 2020 17:02:48 +0000
From:   Mark Rutland <mark.rutland@....com>
To:     "Wang, Li" <li.wang@...driver.com>
Cc:     Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will@...nel.org>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] arm64: mmu: no write cache for O_SYNC flag

On Sat, Mar 28, 2020 at 12:47:32AM +0800, Wang, Li wrote:
> 
> 在 2020/3/27 22:29, Mark Rutland 写道:
> > On Thu, Mar 26, 2020 at 09:36:25AM -0700, Li Wang wrote:
> > > reproduce steps:
> > > 1.
> > > disable CONFIG_STRICT_DEVMEM in linux kernel
> > > 2.
> > > Process A gets a Physical Address of global variable by
> > > "/proc/self/pagemap".
> > > 3.
> > > Process B writes a value to the same Physical Address by mmap():
> > > fd=open("/dev/mem",O_SYNC);
> > > Virtual Address=mmap(fd);
> > Is this just to demonstrate the behaviour, or is this meant to be
> > indicative of a real use-case? I'm struggling to see the latter.
> > 
> > > problem symptom:
> > > after Process B write a value to the Physical Address,
> > > Process A of the value of global variable does not change.
> > > They both W/R the same Physical Address.
> > If Process A is not using the same attributes as process B, there is no
> > guarantee of coherency. How did process A map this memory?
> 
> 
> about 2 Process:
> 
> Process A:
> 
> the memory is not declared by map function, it is just a global variable.

Then it is exactly as I described previously, and Process A has it
mapped with a Normal Write-Back Cacheable mappping.

Process B requests a mapping of that memory via /dev/mem. It passes the
O_SYNC flag, and to ensure that accesses go to "the underlying hardware"
the kernel makes this mapping Normal Non-Cacheable (which means it
should not look in a cache, or be allocated into one).

The two mappings are not coherent because process A uses the cache, but
process B does not. This is the expected behaviour, consistent with the
semantic of O_SYNC. If you need the two to be coherent, they must both
use the same attributes.

Process B can be coherent with process A if it does *not* pass O_SYNC,
which would give it a Normal Write-Back Cacheable mapping that was
coherent with process A.

> if you agree that O_SYNC flag means "is transferred to the underlying
> hardware",
> 
> the arm64 does not do that:
> 
> when use O_SYNC flag under arm64 arch, it adds write cache feature,

As above, this is not the case. O_SYNC causes the kernel to use a
non-cacheable mapping, where it would normally create a cacheable
mapping. i.e. O_SYNC *removes* cacheability.

It just happens that process A is using a cacheable mapping, which is
the case regardless of what process B does.

Thanks,
Mark.