linux-kernel - Re: [PATCH 1/2] compiler.h: Introduce ptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <60123be5-ae24-4426-b9ca-6f39e64ab76b@app.fastmail.com>
Date: Sun, 29 Sep 2024 07:55:23 +0800
From: "Boqun Feng" <boqun.feng@...il.com>
To: "Alan Huang" <mmpgouride@...il.com>,
 "Mathieu Desnoyers" <mathieu.desnoyers@...icios.com>
Cc: "Alan Stern" <stern@...land.harvard.edu>,
 "Linus Torvalds" <torvalds@...ux-foundation.org>,
 LKML <linux-kernel@...r.kernel.org>,
 "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
 "Sebastian Andrzej Siewior" <bigeasy@...utronix.de>,
 "Paul E. McKenney" <paulmck@...nel.org>, "Will Deacon" <will@...nel.org>,
 "Peter Zijlstra" <peterz@...radead.org>,
 "John Stultz" <jstultz@...gle.com>,
 "Neeraj Upadhyay" <Neeraj.Upadhyay@....com>,
 "Frederic Weisbecker" <frederic@...nel.org>,
 "Joel Fernandes" <joel@...lfernandes.org>,
 "Josh Triplett" <josh@...htriplett.org>,
 "Uladzislau Rezki (Sony)" <urezki@...il.com>,
 rostedt <rostedt@...dmis.org>, "Lai Jiangshan" <jiangshanlai@...il.com>,
 Zqiang <qiang.zhang1211@...il.com>, "Ingo Molnar" <mingo@...hat.com>,
 "Waiman Long" <longman@...hat.com>,
 "Mark Rutland" <mark.rutland@....com>,
 "Thomas Gleixner" <tglx@...utronix.de>,
 "Vlastimil Babka" <vbabka@...e.cz>, maged.michael@...il.com,
 "Mateusz Guzik" <mjguzik@...il.com>, "Gary Guo" <gary@...yguo.net>,
 "Jonas Oberhauser" <jonas.oberhauser@...weicloud.com>,
 RCU <rcu@...r.kernel.org>, linux-mm@...ck.org, lkmm@...ts.linux.dev
Subject: Re: [PATCH 1/2] compiler.h: Introduce ptr_eq() to preserve address dependency



On Sun, Sep 29, 2024, at 6:26 AM, Alan Huang wrote:
> 2024年9月28日 23:55，Mathieu Desnoyers <mathieu.desnoyers@...icios.com> wrote：
>> 
>> On 2024-09-28 17:49, Alan Stern wrote:
>>> On Sat, Sep 28, 2024 at 11:32:18AM -0400, Mathieu Desnoyers wrote:
>>>> On 2024-09-28 16:49, Alan Stern wrote:
>>>>> On Sat, Sep 28, 2024 at 09:51:27AM -0400, Mathieu Desnoyers wrote:
>>>>>> equality, which does not preserve address dependencies and allows the
>>>>>> following misordering speculations:
>>>>>> 
>>>>>> - If @b is a constant, the compiler can issue the loads which depend
>>>>>>    on @a before loading @a.
>>>>>> - If @b is a register populated by a prior load, weakly-ordered
>>>>>>    CPUs can speculate loads which depend on @a before loading @a.
>>>>> 
>>>>> It shouldn't matter whether @a and @b are constants, registers, or
>>>>> anything else.  All that matters is that the compiler uses the wrong
>>>>> one, which allows weakly ordered CPUs to speculate loads you wouldn't
>>>>> expect it to, based on the source code alone.
>>>> 
>>>> I only partially agree here.
>>>> 
>>>> On weakly-ordered architectures, indeed we don't care whether the
>>>> issue is caused by the compiler reordering the code (constant)
>>>> or the CPU speculating the load (registers).
>>>> 
>>>> However, on strongly-ordered architectures, AFAIU, only the constant
>>>> case is problematic (compiler reordering the dependent load), because
>>> I thought you were trying to prevent the compiler from using one pointer
>>> instead of the other, not trying to prevent it from reordering anything.
>>> Isn't this the point the documentation wants to get across when it says
>>> that comparing pointers can be dangerous?
>> 
>> The motivation for introducing ptr_eq() is indeed because the
>> compiler barrier is not sufficient to prevent the compiler from
>> using one pointer instead of the other.
>
> barrier_data(&b) prevents that.
>

It prevents that because it acts as barrier() + OPTIMIZER_HIDE_VAR(b).
I don’t see much value of using that since we can resolve the problem
with OPTIMIZER_HIDE_VAR() alone.

Regards,
Boqun

>> 
>> But it turns out that ptr_eq() is also a good tool to prevent the
>> compiler from reordering loads in case where the comparison is
>> done against a constant.
>> 
>>>> CPU speculating the loads across the control dependency is not an
>>>> issue.
>>>> 
>>>> So am I tempted to keep examples that clearly state whether
>>>> the issue is caused by compiler reordering instructions, or by
>>>> CPU speculation.
>>> Isn't it true that on strongly ordered CPUs, a compiler barrier is
>>> sufficient to prevent the rcu_dereference() problem?  So the whole idea
>>> behind ptr_eq() is that it prevents the problem on all CPUs.
>> 
>> Correct. But given that we have ptr_eq(), it's good to show how it
>> equally prevents the compiler from reordering address-dependent loads
>> (comparison with constant) *and* prevents the compiler from using
>> one pointer rather than the other (comparison between two non-constant
>> pointers) which affects speculation on weakly-ordered CPUs.
>> 
>>> You can make your examples as specific as you like, but the fact remains
>>> that ptr_eq() is meant to prevent situations where both:
>>> The compiler uses the wrong pointer for a load, and
>>> The CPU performs the load earlier than you want.
>>> If either one of those doesn't hold then the problem won't arise.
>> 
>> Correct.
>> 
>> Thanks,
>> 
>> Mathieu
>> 
>> 
>> -- 
>> Mathieu Desnoyers
>> EfficiOS Inc.
>> https://www.efficios.com
>> 
>>