linux-kernel - Re: Possibility of conflicting memory types in lazier TLB mode?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3b217554a8a337de544482d20ddf8f2152559cd3.camel@surriel.com>
Date:   Fri, 15 May 2020 15:24:28 -0400
From:   Rik van Riel <riel@...riel.com>
To:     Nicholas Piggin <npiggin@...il.com>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        linux-kernel@...r.kernel.org, x86@...nel.org
Subject: Re: Possibility of conflicting memory types in lazier TLB mode?

On Fri, 2020-05-15 at 16:50 +1000, Nicholas Piggin wrote:
> 
> But what about if there are (real, not speculative) stores in the
> store 
> queue still on the lazy thread from when it was switched, that have
> not 
> yet become coherent? The page is freed by another CPU and reallocated
> for something that maps it as nocache. Do you have a coherency
> problem 
> there?
> 
> Ensuring the store queue is drained when switching to lazy seems like
> it 
> would fix it, maybe context switch code does that already or you
> have 
> some other trick or reason it's not a problem. Am I way off base
> here?

On x86, all stores become visible in-order globally.

I suspect that
means any pending stores in the queue
would become visible to the rest of the system before
the store to the "current" cpu-local variable, as
well as other writes from the context switch code
become visible to the rest of the system.

Is that too naive a way of preventing the scenario you
describe?

What am I overlooking?

-- 
All Rights Reversed.

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)