March 2022 - Linux-stable-mirror

[PATCH AUTOSEL 4.9 1/2] ext4: don't BUG if someone dirty pages without asking ext4 first

by Sasha Levin

From: Theodore Ts'o <tytso(a)mit.edu> [ Upstream commit cc5095747edfb054ca2068d01af20be3fcc3634f ] [un]pin_user_pages_remote is dirtying pages without properly warning the file system in advance. A related race was noted by Jan Kara in 2018[1]; however, more recently instead of it being a very hard-to-hit race, it could be reliably triggered by process_vm_writev(2) which was discovered by Syzbot[2]. This is technically a bug in mm/gup.c, but arguably ext4 is fragile in that if some other kernel subsystem dirty pages without properly notifying the file system using page_mkwrite(), ext4 will BUG, while other file systems will not BUG (although data will still be lost). So instead of crashing with a BUG, issue a warning (since there may be potential data loss) and just mark the page as clean to avoid unprivileged denial of service attacks until the problem can be properly fixed. More discussion and background can be found in the thread starting at [2]. [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz [2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com Reported-by: syzbot+d59332e2db681cf18f0318a06e994ebbb529a8db(a)syzkaller.appspotmail.com Reported-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Link: https://lore.kernel.org/r/YiDS9wVfq4mM2jGK@mit.edu Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ext4/inode.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 79c067f74253..e66aa8918dee 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2048,6 +2048,15 @@ static int ext4_writepage(struct page *page, else len = PAGE_SIZE; + /* Should never happen but for bugs in other kernel subsystems */ + if (!page_has_buffers(page)) { + ext4_warning_inode(inode, + "page %lu does not have buffers attached", page->index); + ClearPageDirty(page); + unlock_page(page); + return 0; + } + page_bufs = page_buffers(page); /* * We cannot do block allocation or other extent handling in this @@ -2608,6 +2617,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) wait_on_page_writeback(page); BUG_ON(PageWriteback(page)); + /* + * Should never happen but for buggy code in + * other subsystems that call + * set_page_dirty() without properly warning + * the file system first. See [1] for more + * information. + * + * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz + */ + if (!page_has_buffers(page)) { + ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); + ClearPageDirty(page); + unlock_page(page); + continue; + } + if (mpd->map.m_len == 0) mpd->first_page = page->index; mpd->next_page = page->index + 1; -- 2.34.1

2 years, 9 months

2
2
0 0

[PATCH AUTOSEL 4.14 1/2] ext4: don't BUG if someone dirty pages without asking ext4 first

by Sasha Levin

From: Theodore Ts'o <tytso(a)mit.edu> [ Upstream commit cc5095747edfb054ca2068d01af20be3fcc3634f ] [un]pin_user_pages_remote is dirtying pages without properly warning the file system in advance. A related race was noted by Jan Kara in 2018[1]; however, more recently instead of it being a very hard-to-hit race, it could be reliably triggered by process_vm_writev(2) which was discovered by Syzbot[2]. This is technically a bug in mm/gup.c, but arguably ext4 is fragile in that if some other kernel subsystem dirty pages without properly notifying the file system using page_mkwrite(), ext4 will BUG, while other file systems will not BUG (although data will still be lost). So instead of crashing with a BUG, issue a warning (since there may be potential data loss) and just mark the page as clean to avoid unprivileged denial of service attacks until the problem can be properly fixed. More discussion and background can be found in the thread starting at [2]. [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz [2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com Reported-by: syzbot+d59332e2db681cf18f0318a06e994ebbb529a8db(a)syzkaller.appspotmail.com Reported-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Link: https://lore.kernel.org/r/YiDS9wVfq4mM2jGK@mit.edu Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ext4/inode.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 9c07c8674b21..4d3eefff3c84 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2147,6 +2147,15 @@ static int ext4_writepage(struct page *page, else len = PAGE_SIZE; + /* Should never happen but for bugs in other kernel subsystems */ + if (!page_has_buffers(page)) { + ext4_warning_inode(inode, + "page %lu does not have buffers attached", page->index); + ClearPageDirty(page); + unlock_page(page); + return 0; + } + page_bufs = page_buffers(page); /* * We cannot do block allocation or other extent handling in this @@ -2706,6 +2715,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) wait_on_page_writeback(page); BUG_ON(PageWriteback(page)); + /* + * Should never happen but for buggy code in + * other subsystems that call + * set_page_dirty() without properly warning + * the file system first. See [1] for more + * information. + * + * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz + */ + if (!page_has_buffers(page)) { + ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); + ClearPageDirty(page); + unlock_page(page); + continue; + } + if (mpd->map.m_len == 0) mpd->first_page = page->index; mpd->next_page = page->index + 1; -- 2.34.1

2 years, 9 months

2
2
0 0

[PATCH AUTOSEL 5.4 1/2] ext4: don't BUG if someone dirty pages without asking ext4 first

by Sasha Levin

From: Theodore Ts'o <tytso(a)mit.edu> [ Upstream commit cc5095747edfb054ca2068d01af20be3fcc3634f ] [un]pin_user_pages_remote is dirtying pages without properly warning the file system in advance. A related race was noted by Jan Kara in 2018[1]; however, more recently instead of it being a very hard-to-hit race, it could be reliably triggered by process_vm_writev(2) which was discovered by Syzbot[2]. This is technically a bug in mm/gup.c, but arguably ext4 is fragile in that if some other kernel subsystem dirty pages without properly notifying the file system using page_mkwrite(), ext4 will BUG, while other file systems will not BUG (although data will still be lost). So instead of crashing with a BUG, issue a warning (since there may be potential data loss) and just mark the page as clean to avoid unprivileged denial of service attacks until the problem can be properly fixed. More discussion and background can be found in the thread starting at [2]. [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz [2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com Reported-by: syzbot+d59332e2db681cf18f0318a06e994ebbb529a8db(a)syzkaller.appspotmail.com Reported-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Link: https://lore.kernel.org/r/YiDS9wVfq4mM2jGK@mit.edu Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ext4/inode.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index dcbd8ac8d471..0d62f05f8925 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2161,6 +2161,15 @@ static int ext4_writepage(struct page *page, else len = PAGE_SIZE; + /* Should never happen but for bugs in other kernel subsystems */ + if (!page_has_buffers(page)) { + ext4_warning_inode(inode, + "page %lu does not have buffers attached", page->index); + ClearPageDirty(page); + unlock_page(page); + return 0; + } + page_bufs = page_buffers(page); /* * We cannot do block allocation or other extent handling in this @@ -2710,6 +2719,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) wait_on_page_writeback(page); BUG_ON(PageWriteback(page)); + /* + * Should never happen but for buggy code in + * other subsystems that call + * set_page_dirty() without properly warning + * the file system first. See [1] for more + * information. + * + * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz + */ + if (!page_has_buffers(page)) { + ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); + ClearPageDirty(page); + unlock_page(page); + continue; + } + if (mpd->map.m_len == 0) mpd->first_page = page->index; mpd->next_page = page->index + 1; -- 2.34.1

2 years, 9 months

2
2
0 0

[PATCH AUTOSEL 4.19 1/2] ext4: don't BUG if someone dirty pages without asking ext4 first

by Sasha Levin

From: Theodore Ts'o <tytso(a)mit.edu> [ Upstream commit cc5095747edfb054ca2068d01af20be3fcc3634f ] [un]pin_user_pages_remote is dirtying pages without properly warning the file system in advance. A related race was noted by Jan Kara in 2018[1]; however, more recently instead of it being a very hard-to-hit race, it could be reliably triggered by process_vm_writev(2) which was discovered by Syzbot[2]. This is technically a bug in mm/gup.c, but arguably ext4 is fragile in that if some other kernel subsystem dirty pages without properly notifying the file system using page_mkwrite(), ext4 will BUG, while other file systems will not BUG (although data will still be lost). So instead of crashing with a BUG, issue a warning (since there may be potential data loss) and just mark the page as clean to avoid unprivileged denial of service attacks until the problem can be properly fixed. More discussion and background can be found in the thread starting at [2]. [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz [2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com Reported-by: syzbot+d59332e2db681cf18f0318a06e994ebbb529a8db(a)syzkaller.appspotmail.com Reported-by: Lee Jones <lee.jones(a)linaro.org> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Link: https://lore.kernel.org/r/YiDS9wVfq4mM2jGK@mit.edu Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- fs/ext4/inode.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 7959aae4857e..96cf0f57ca95 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2148,6 +2148,15 @@ static int ext4_writepage(struct page *page, else len = PAGE_SIZE; + /* Should never happen but for bugs in other kernel subsystems */ + if (!page_has_buffers(page)) { + ext4_warning_inode(inode, + "page %lu does not have buffers attached", page->index); + ClearPageDirty(page); + unlock_page(page); + return 0; + } + page_bufs = page_buffers(page); /* * We cannot do block allocation or other extent handling in this @@ -2697,6 +2706,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) wait_on_page_writeback(page); BUG_ON(PageWriteback(page)); + /* + * Should never happen but for buggy code in + * other subsystems that call + * set_page_dirty() without properly warning + * the file system first. See [1] for more + * information. + * + * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz + */ + if (!page_has_buffers(page)) { + ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); + ClearPageDirty(page); + unlock_page(page); + continue; + } + if (mpd->map.m_len == 0) mpd->first_page = page->index; mpd->next_page = page->index + 1; -- 2.34.1

2 years, 9 months

2
2
0 0

[PATCH AUTOSEL 5.10 1/8] locking/lockdep: Iterate lock_classes directly when reading lockdep files

by Sasha Levin

From: Waiman Long <longman(a)redhat.com> [ Upstream commit fb7275acd6fb988313dddd8d3d19efa70d9015ad ] When dumping lock_classes information via /proc/lockdep, we can't take the lockdep lock as the lock hold time is indeterminate. Iterating over all_lock_classes without holding lock can be dangerous as there is a slight chance that it may branch off to other lists leading to infinite loop or even access invalid memory if changes are made to all_lock_classes list in parallel. To avoid this problem, iteration of lock classes is now done directly on the lock_classes array itself. The lock_classes_in_use bitmap is checked to see if the lock class is being used. To avoid iterating the full array all the times, a new max_lock_class_idx value is added to track the maximum lock_class index that is currently being used. We can theoretically take the lockdep lock for iterating all_lock_classes when other lockdep files (lockdep_stats and lock_stat) are accessed as the lock hold time will be shorter for them. For consistency, they are also modified to iterate the lock_classes array directly. Signed-off-by: Waiman Long <longman(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20220211035526.1329503-2-longman@redhat.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- kernel/locking/lockdep.c | 14 +++++--- kernel/locking/lockdep_internals.h | 6 ++-- kernel/locking/lockdep_proc.c | 51 +++++++++++++++++++++++++----- 3 files changed, 56 insertions(+), 15 deletions(-) diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c index af4b35450556..13d43f712b2f 100644 --- a/kernel/locking/lockdep.c +++ b/kernel/locking/lockdep.c @@ -182,11 +182,9 @@ static DECLARE_BITMAP(list_entries_in_use, MAX_LOCKDEP_ENTRIES); static struct hlist_head lock_keys_hash[KEYHASH_SIZE]; unsigned long nr_lock_classes; unsigned long nr_zapped_classes; -#ifndef CONFIG_DEBUG_LOCKDEP -static -#endif +unsigned long max_lock_class_idx; struct lock_class lock_classes[MAX_LOCKDEP_KEYS]; -static DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS); +DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS); static inline struct lock_class *hlock_class(struct held_lock *hlock) { @@ -337,7 +335,7 @@ static inline void lock_release_holdtime(struct held_lock *hlock) * elements. These elements are linked together by the lock_entry member in * struct lock_class. */ -LIST_HEAD(all_lock_classes); +static LIST_HEAD(all_lock_classes); static LIST_HEAD(free_lock_classes); /** @@ -1239,6 +1237,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force) struct lockdep_subclass_key *key; struct hlist_head *hash_head; struct lock_class *class; + int idx; DEBUG_LOCKS_WARN_ON(!irqs_disabled()); @@ -1304,6 +1303,9 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force) * of classes. */ list_move_tail(&class->lock_entry, &all_lock_classes); + idx = class - lock_classes; + if (idx > max_lock_class_idx) + max_lock_class_idx = idx; if (verbose(class)) { graph_unlock(); @@ -5919,6 +5921,8 @@ static void zap_class(struct pending_free *pf, struct lock_class *class) WRITE_ONCE(class->name, NULL); nr_lock_classes--; __clear_bit(class - lock_classes, lock_classes_in_use); + if (class - lock_classes == max_lock_class_idx) + max_lock_class_idx--; } else { WARN_ONCE(true, "%s() failed for class %s\n", __func__, class->name); diff --git a/kernel/locking/lockdep_internals.h b/kernel/locking/lockdep_internals.h index de49f9e1c11b..a19b01635347 100644 --- a/kernel/locking/lockdep_internals.h +++ b/kernel/locking/lockdep_internals.h @@ -121,7 +121,6 @@ static const unsigned long LOCKF_USED_IN_IRQ_READ = #define MAX_LOCKDEP_CHAIN_HLOCKS (MAX_LOCKDEP_CHAINS*5) -extern struct list_head all_lock_classes; extern struct lock_chain lock_chains[]; #define LOCK_USAGE_CHARS (2*XXX_LOCK_USAGE_STATES + 1) @@ -151,6 +150,10 @@ extern unsigned int nr_large_chain_blocks; extern unsigned int max_lockdep_depth; extern unsigned int max_bfs_queue_depth; +extern unsigned long max_lock_class_idx; + +extern struct lock_class lock_classes[MAX_LOCKDEP_KEYS]; +extern unsigned long lock_classes_in_use[]; #ifdef CONFIG_PROVE_LOCKING extern unsigned long lockdep_count_forward_deps(struct lock_class *); @@ -205,7 +208,6 @@ struct lockdep_stats { }; DECLARE_PER_CPU(struct lockdep_stats, lockdep_stats); -extern struct lock_class lock_classes[MAX_LOCKDEP_KEYS]; #define __debug_atomic_inc(ptr) \ this_cpu_inc(lockdep_stats.ptr); diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c index 02ef87f50df2..ccb5292d1e19 100644 --- a/kernel/locking/lockdep_proc.c +++ b/kernel/locking/lockdep_proc.c @@ -24,14 +24,33 @@ #include "lockdep_internals.h" +/* + * Since iteration of lock_classes is done without holding the lockdep lock, + * it is not safe to iterate all_lock_classes list directly as the iteration + * may branch off to free_lock_classes or the zapped list. Iteration is done + * directly on the lock_classes array by checking the lock_classes_in_use + * bitmap and max_lock_class_idx. + */ +#define iterate_lock_classes(idx, class) \ + for (idx = 0, class = lock_classes; idx <= max_lock_class_idx; \ + idx++, class++) + static void *l_next(struct seq_file *m, void *v, loff_t *pos) { - return seq_list_next(v, &all_lock_classes, pos); + struct lock_class *class = v; + + ++class; + *pos = class - lock_classes; + return (*pos > max_lock_class_idx) ? NULL : class; } static void *l_start(struct seq_file *m, loff_t *pos) { - return seq_list_start_head(&all_lock_classes, *pos); + unsigned long idx = *pos; + + if (idx > max_lock_class_idx) + return NULL; + return lock_classes + idx; } static void l_stop(struct seq_file *m, void *v) @@ -57,14 +76,16 @@ static void print_name(struct seq_file *m, struct lock_class *class) static int l_show(struct seq_file *m, void *v) { - struct lock_class *class = list_entry(v, struct lock_class, lock_entry); + struct lock_class *class = v; struct lock_list *entry; char usage[LOCK_USAGE_CHARS]; + int idx = class - lock_classes; - if (v == &all_lock_classes) { + if (v == lock_classes) seq_printf(m, "all lock classes:\n"); + + if (!test_bit(idx, lock_classes_in_use)) return 0; - } seq_printf(m, "%p", class->key); #ifdef CONFIG_DEBUG_LOCKDEP @@ -218,8 +239,11 @@ static int lockdep_stats_show(struct seq_file *m, void *v) #ifdef CONFIG_PROVE_LOCKING struct lock_class *class; + unsigned long idx; - list_for_each_entry(class, &all_lock_classes, lock_entry) { + iterate_lock_classes(idx, class) { + if (!test_bit(idx, lock_classes_in_use)) + continue; if (class->usage_mask == 0) nr_unused++; @@ -252,6 +276,7 @@ static int lockdep_stats_show(struct seq_file *m, void *v) sum_forward_deps += lockdep_count_forward_deps(class); } + #ifdef CONFIG_DEBUG_LOCKDEP DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused); #endif @@ -343,6 +368,8 @@ static int lockdep_stats_show(struct seq_file *m, void *v) seq_printf(m, " max bfs queue depth: %11u\n", max_bfs_queue_depth); #endif + seq_printf(m, " max lock class index: %11lu\n", + max_lock_class_idx); lockdep_stats_debug_show(m); seq_printf(m, " debug_locks: %11u\n", debug_locks); @@ -620,12 +647,16 @@ static int lock_stat_open(struct inode *inode, struct file *file) if (!res) { struct lock_stat_data *iter = data->stats; struct seq_file *m = file->private_data; + unsigned long idx; - list_for_each_entry(class, &all_lock_classes, lock_entry) { + iterate_lock_classes(idx, class) { + if (!test_bit(idx, lock_classes_in_use)) + continue; iter->class = class; iter->stats = lock_stats(class); iter++; } + data->iter_end = iter; sort(data->stats, data->iter_end - data->stats, @@ -643,6 +674,7 @@ static ssize_t lock_stat_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { struct lock_class *class; + unsigned long idx; char c; if (count) { @@ -652,8 +684,11 @@ static ssize_t lock_stat_write(struct file *file, const char __user *buf, if (c != '0') return count; - list_for_each_entry(class, &all_lock_classes, lock_entry) + iterate_lock_classes(idx, class) { + if (!test_bit(idx, lock_classes_in_use)) + continue; clear_lock_stats(class); + } } return count; } -- 2.34.1

2 years, 9 months

2
8
0 0

[PATCH AUTOSEL 5.15 01/16] atomics: Fix atomic64_{read_acquire,set_release} fallbacks

by Sasha Levin

From: Mark Rutland <mark.rutland(a)arm.com> [ Upstream commit dc1b4df09acdca7a89806b28f235cd6d8dcd3d24 ] Arnd reports that on 32-bit architectures, the fallbacks for atomic64_read_acquire() and atomic64_set_release() are broken as they use smp_load_acquire() and smp_store_release() respectively, which do not work on types larger than the native word size. Since those contain compiletime_assert_atomic_type(), any attempt to use those fallbacks will result in a build-time error. e.g. with the following added to arch/arm/kernel/setup.c: | void test_atomic64(atomic64_t *v) | { | atomic64_set_release(v, 5); | atomic64_read_acquire(v); | } The compiler will complain as follows: | In file included from <command-line>: | In function 'arch_atomic64_set_release', | inlined from 'test_atomic64' at ./include/linux/atomic/atomic-instrumented.h:669:2: | ././include/linux/compiler_types.h:346:38: error: call to '__compiletime_assert_9' declared with attribute error: Need native word sized stores/loads for atomicity. | 346 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | | ^ | ././include/linux/compiler_types.h:327:4: note: in definition of macro '__compiletime_assert' | 327 | prefix ## suffix(); \ | | ^~~~~~ | ././include/linux/compiler_types.h:346:2: note: in expansion of macro '_compiletime_assert' | 346 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | | ^~~~~~~~~~~~~~~~~~~ | ././include/linux/compiler_types.h:349:2: note: in expansion of macro 'compiletime_assert' | 349 | compiletime_assert(__native_word(t), \ | | ^~~~~~~~~~~~~~~~~~ | ./include/asm-generic/barrier.h:133:2: note: in expansion of macro 'compiletime_assert_atomic_type' | 133 | compiletime_assert_atomic_type(*p); \ | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ./include/asm-generic/barrier.h:164:55: note: in expansion of macro '__smp_store_release' | 164 | #define smp_store_release(p, v) do { kcsan_release(); __smp_store_release(p, v); } while (0) | | ^~~~~~~~~~~~~~~~~~~ | ./include/linux/atomic/atomic-arch-fallback.h:1270:2: note: in expansion of macro 'smp_store_release' | 1270 | smp_store_release(&(v)->counter, i); | | ^~~~~~~~~~~~~~~~~ | make[2]: *** [scripts/Makefile.build:288: arch/arm/kernel/setup.o] Error 1 | make[1]: *** [scripts/Makefile.build:550: arch/arm/kernel] Error 2 | make: *** [Makefile:1831: arch/arm] Error 2 Fix this by only using smp_load_acquire() and smp_store_release() for native atomic types, and otherwise falling back to the regular barriers necessary for acquire/release semantics, as we do in the more generic acquire and release fallbacks. Since the fallback templates are used to generate the atomic64_*() and atomic_*() operations, the __native_word() check is added to both. For the atomic_*() operations, which are always 32-bit, the __native_word() check is redundant but not harmful, as it is always true. For the example above this works as expected on 32-bit, e.g. for arm multi_v7_defconfig: | <test_atomic64>: | push {r4, r5} | dmb ish | pldw [r0] | mov r2, #5 | mov r3, #0 | ldrexd r4, [r0] | strexd r4, r2, [r0] | teq r4, #0 | bne 484 <test_atomic64+0x14> | ldrexd r2, [r0] | dmb ish | pop {r4, r5} | bx lr ... and also on 64-bit, e.g. for arm64 defconfig: | <test_atomic64>: | bti c | paciasp | mov x1, #0x5 | stlr x1, [x0] | ldar x0, [x0] | autiasp | ret Reported-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Boqun Feng <boqun.feng(a)gmail.com> Link: https://lore.kernel.org/r/20220207101943.439825-1-mark.rutland@arm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- include/linux/atomic/atomic-arch-fallback.h | 38 ++++++++++++++++++--- scripts/atomic/fallbacks/read_acquire | 11 +++++- scripts/atomic/fallbacks/set_release | 7 +++- 3 files changed, 49 insertions(+), 7 deletions(-) diff --git a/include/linux/atomic/atomic-arch-fallback.h b/include/linux/atomic/atomic-arch-fallback.h index a3dba31df01e..6db58d180866 100644 --- a/include/linux/atomic/atomic-arch-fallback.h +++ b/include/linux/atomic/atomic-arch-fallback.h @@ -151,7 +151,16 @@ static __always_inline int arch_atomic_read_acquire(const atomic_t *v) { - return smp_load_acquire(&(v)->counter); + int ret; + + if (__native_word(atomic_t)) { + ret = smp_load_acquire(&(v)->counter); + } else { + ret = arch_atomic_read(v); + __atomic_acquire_fence(); + } + + return ret; } #define arch_atomic_read_acquire arch_atomic_read_acquire #endif @@ -160,7 +169,12 @@ arch_atomic_read_acquire(const atomic_t *v) static __always_inline void arch_atomic_set_release(atomic_t *v, int i) { - smp_store_release(&(v)->counter, i); + if (__native_word(atomic_t)) { + smp_store_release(&(v)->counter, i); + } else { + __atomic_release_fence(); + arch_atomic_set(v, i); + } } #define arch_atomic_set_release arch_atomic_set_release #endif @@ -1258,7 +1272,16 @@ arch_atomic_dec_if_positive(atomic_t *v) static __always_inline s64 arch_atomic64_read_acquire(const atomic64_t *v) { - return smp_load_acquire(&(v)->counter); + s64 ret; + + if (__native_word(atomic64_t)) { + ret = smp_load_acquire(&(v)->counter); + } else { + ret = arch_atomic64_read(v); + __atomic_acquire_fence(); + } + + return ret; } #define arch_atomic64_read_acquire arch_atomic64_read_acquire #endif @@ -1267,7 +1290,12 @@ arch_atomic64_read_acquire(const atomic64_t *v) static __always_inline void arch_atomic64_set_release(atomic64_t *v, s64 i) { - smp_store_release(&(v)->counter, i); + if (__native_word(atomic64_t)) { + smp_store_release(&(v)->counter, i); + } else { + __atomic_release_fence(); + arch_atomic64_set(v, i); + } } #define arch_atomic64_set_release arch_atomic64_set_release #endif @@ -2358,4 +2386,4 @@ arch_atomic64_dec_if_positive(atomic64_t *v) #endif #endif /* _LINUX_ATOMIC_FALLBACK_H */ -// cca554917d7ea73d5e3e7397dd70c484cad9b2c4 +// 8e2cc06bc0d2c0967d2f8424762bd48555ee40ae diff --git a/scripts/atomic/fallbacks/read_acquire b/scripts/atomic/fallbacks/read_acquire index 803ba7561076..a0ea1d26e6b2 100755 --- a/scripts/atomic/fallbacks/read_acquire +++ b/scripts/atomic/fallbacks/read_acquire @@ -2,6 +2,15 @@ cat <<EOF static __always_inline ${ret} arch_${atomic}_read_acquire(const ${atomic}_t *v) { - return smp_load_acquire(&(v)->counter); + ${int} ret; + + if (__native_word(${atomic}_t)) { + ret = smp_load_acquire(&(v)->counter); + } else { + ret = arch_${atomic}_read(v); + __atomic_acquire_fence(); + } + + return ret; } EOF diff --git a/scripts/atomic/fallbacks/set_release b/scripts/atomic/fallbacks/set_release index 86ede759f24e..05cdb7f42477 100755 --- a/scripts/atomic/fallbacks/set_release +++ b/scripts/atomic/fallbacks/set_release @@ -2,6 +2,11 @@ cat <<EOF static __always_inline void arch_${atomic}_set_release(${atomic}_t *v, ${int} i) { - smp_store_release(&(v)->counter, i); + if (__native_word(${atomic}_t)) { + smp_store_release(&(v)->counter, i); + } else { + __atomic_release_fence(); + arch_${atomic}_set(v, i); + } } EOF -- 2.34.1

2 years, 9 months

2
16
0 0

stable-rc/queue/5.4 build: 188 builds: 3 failed, 185 passed, 4 errors, 28 warnings (v5.4.188-14-gce3ed21ff148)

by kernelci.org bot

stable-rc/queue/5.4 build: 188 builds: 3 failed, 185 passed, 4 errors, 28 warnings (v5.4.188-14-gce3ed21ff148) Full Build Summary: https://kernelci.org/build/stable-rc/branch/queue%2F5.4/kernel/v5.4.188-14-… Tree: stable-rc Branch: queue/5.4 Git Describe: v5.4.188-14-gce3ed21ff148 Git Commit: ce3ed21ff14824b8a1225ec232b0eaf563ea3199 Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Built: 7 unique architectures Build Failures Detected: arm: rpc_defconfig: (gcc-10) FAIL mips: ip27_defconfig: (gcc-10) FAIL ip28_defconfig: (gcc-10) FAIL Errors and Warnings Detected: arc: arm64: defconfig (gcc-10): 2 warnings defconfig+arm64-chromebook (gcc-10): 2 warnings arm: assabet_defconfig (gcc-10): 1 warning collie_defconfig (gcc-10): 1 warning h3600_defconfig (gcc-10): 1 warning neponset_defconfig (gcc-10): 1 warning rpc_defconfig (gcc-10): 4 errors shannon_defconfig (gcc-10): 1 warning i386: allnoconfig (gcc-10): 2 warnings i386_defconfig (gcc-10): 2 warnings tinyconfig (gcc-10): 2 warnings mips: mtx1_defconfig (gcc-10): 3 warnings riscv: x86_64: allnoconfig (gcc-10): 3 warnings tinyconfig (gcc-10): 3 warnings x86_64_defconfig (gcc-10): 2 warnings x86_64_defconfig+x86-chromebook (gcc-10): 2 warnings Errors summary: 2 arm-linux-gnueabihf-gcc: error: unrecognized -march target: armv3m 2 arm-linux-gnueabihf-gcc: error: missing argument to ‘-march=’ Warnings summary: 7 ld: warning: creating DT_TEXTREL in a PIE 5 drivers/video/fbdev/sa1100fb.c:975:21: warning: ‘sa1100fb_min_dma_period’ defined but not used [-Wunused-function] 4 ld: arch/x86/boot/compressed/head_64.o: warning: relocation in read-only section `.head.text' 4 arch/arm64/include/asm/memory.h:238:15: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] 3 ld: arch/x86/boot/compressed/head_32.o: warning: relocation in read-only section `.head.text' 2 sound/pci/echoaudio/echoaudio_dsp.c:647:9: warning: iteration 1073741824 invokes undefined behavior [-Waggressive-loop-optimizations] 2 arch/x86/entry/entry_64.S:1732: Warning: no instruction mnemonic suffix given and no register operands; using default for `sysret' 1 sound/pci/echoaudio/echoaudio_dsp.c:658:9: warning: iteration 1073741824 invokes undefined behavior [-Waggressive-loop-optimizations] Section mismatches summary: 2 WARNING: vmlinux.o(.text+0xcacc): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text.unlikely+0x3774): Section mismatch in reference from the function pmax_setup_memory_region() to the function .init.text:add_memory_region() 1 WARNING: vmlinux.o(.text.unlikely+0x349c): Section mismatch in reference from the function pmax_setup_memory_region() to the function .init.text:add_memory_region() 1 WARNING: vmlinux.o(.text+0xcf00): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0xce00): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0xcd0c): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0xcc00): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0xcad4): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0xcaac): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0xc978): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0xc834): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0xb8d0): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0x7ecc): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() 1 WARNING: vmlinux.o(.text+0x7530): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() ================================================================================ Detailed per-defconfig build reports: -------------------------------------------------------------------------------- 32r2el_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- allnoconfig (x86_64, gcc-10) — PASS, 0 errors, 3 warnings, 0 section mismatches Warnings: arch/x86/entry/entry_64.S:1732: Warning: no instruction mnemonic suffix given and no register operands; using default for `sysret' ld: arch/x86/boot/compressed/head_64.o: warning: relocation in read-only section `.head.text' ld: warning: creating DT_TEXTREL in a PIE -------------------------------------------------------------------------------- allnoconfig (i386, gcc-10) — PASS, 0 errors, 2 warnings, 0 section mismatches Warnings: ld: arch/x86/boot/compressed/head_32.o: warning: relocation in read-only section `.head.text' ld: warning: creating DT_TEXTREL in a PIE -------------------------------------------------------------------------------- allnoconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- am200epdkit_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ar7_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- aspeed_g4_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- aspeed_g5_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- assabet_defconfig (arm, gcc-10) — PASS, 0 errors, 1 warning, 0 section mismatches Warnings: drivers/video/fbdev/sa1100fb.c:975:21: warning: ‘sa1100fb_min_dma_period’ defined but not used [-Wunused-function] Section mismatches: WARNING: vmlinux.o(.text+0xcacc): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- at91_dt_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ath25_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ath79_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- axm55xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- axs103_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- axs103_smp_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- badge4_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text+0xcc00): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- bcm2835_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- bcm47xx_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- bcm63xx_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- bigsur_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- bmips_be_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- bmips_stb_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- capcella_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- cavium_octeon_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- cerfcube_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text+0x7530): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- ci20_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- cm_x2xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- cm_x300_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- cobalt_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- colibri_pxa270_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- colibri_pxa300_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- collie_defconfig (arm, gcc-10) — PASS, 0 errors, 1 warning, 0 section mismatches Warnings: drivers/video/fbdev/sa1100fb.c:975:21: warning: ‘sa1100fb_min_dma_period’ defined but not used [-Wunused-function] Section mismatches: WARNING: vmlinux.o(.text+0xb8d0): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- corgi_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- davinci_all_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- db1xxx_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- decstation_64_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- decstation_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text.unlikely+0x3774): Section mismatch in reference from the function pmax_setup_memory_region() to the function .init.text:add_memory_region() -------------------------------------------------------------------------------- decstation_r4k_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text.unlikely+0x349c): Section mismatch in reference from the function pmax_setup_memory_region() to the function .init.text:add_memory_region() -------------------------------------------------------------------------------- defconfig (riscv, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- defconfig (arm64, gcc-10) — PASS, 0 errors, 2 warnings, 0 section mismatches Warnings: arch/arm64/include/asm/memory.h:238:15: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] arch/arm64/include/asm/memory.h:238:15: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] -------------------------------------------------------------------------------- defconfig+arm64-chromebook (arm64, gcc-10) — PASS, 0 errors, 2 warnings, 0 section mismatches Warnings: arch/arm64/include/asm/memory.h:238:15: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] arch/arm64/include/asm/memory.h:238:15: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast] -------------------------------------------------------------------------------- dove_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- e55_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ebsa110_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- efm32_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- em_x270_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ep93xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text+0x7ecc): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- eseries_pxa_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- exynos_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ezx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- fuloong2e_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- gcw0_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- gemini_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- gpr_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- h3600_defconfig (arm, gcc-10) — PASS, 0 errors, 1 warning, 0 section mismatches Warnings: drivers/video/fbdev/sa1100fb.c:975:21: warning: ‘sa1100fb_min_dma_period’ defined but not used [-Wunused-function] Section mismatches: WARNING: vmlinux.o(.text+0xcacc): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- h5000_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- hackkit_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text+0xce00): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- haps_hs_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- haps_hs_smp_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- hisi_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- hsdk_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- i386_defconfig (i386, gcc-10) — PASS, 0 errors, 2 warnings, 0 section mismatches Warnings: ld: arch/x86/boot/compressed/head_32.o: warning: relocation in read-only section `.head.text' ld: warning: creating DT_TEXTREL in a PIE -------------------------------------------------------------------------------- imote2_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- imx_v4_v5_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- imx_v6_v7_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- integrator_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- iop32x_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ip22_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ip27_defconfig (mips, gcc-10) — FAIL, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ip28_defconfig (mips, gcc-10) — FAIL, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ip32_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- ixp4xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- jazz_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- jmr3927_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- jornada720_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text+0xc978): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- keystone_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- lart_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text+0xcad4): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- lasat_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- lemote2f_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- loongson1b_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- loongson1c_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- loongson3_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- lpc18xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- lpc32xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- lpd270_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- lubbock_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- magician_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mainstone_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- malta_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- malta_kvm_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- malta_kvm_guest_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- malta_qemu_32r6_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- maltaaprp_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- maltasmvp_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- maltasmvp_eva_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- maltaup_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- maltaup_xpa_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- markeins_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- milbeaut_m10v_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mini2440_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mips_paravirt_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mmp2_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- moxart_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mpc30x_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mps2_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- msp71xx_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mtx1_defconfig (mips, gcc-10) — PASS, 0 errors, 3 warnings, 0 section mismatches Warnings: sound/pci/echoaudio/echoaudio_dsp.c:647:9: warning: iteration 1073741824 invokes undefined behavior [-Waggressive-loop-optimizations] sound/pci/echoaudio/echoaudio_dsp.c:658:9: warning: iteration 1073741824 invokes undefined behavior [-Waggressive-loop-optimizations] sound/pci/echoaudio/echoaudio_dsp.c:647:9: warning: iteration 1073741824 invokes undefined behavior [-Waggressive-loop-optimizations] -------------------------------------------------------------------------------- multi_v4t_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- multi_v5_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- multi_v7_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mvebu_v5_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mvebu_v7_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- mxs_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- neponset_defconfig (arm, gcc-10) — PASS, 0 errors, 1 warning, 0 section mismatches Warnings: drivers/video/fbdev/sa1100fb.c:975:21: warning: ‘sa1100fb_min_dma_period’ defined but not used [-Wunused-function] Section mismatches: WARNING: vmlinux.o(.text+0xcd0c): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- netwinder_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- nhk8815_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- nlm_xlp_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- nlm_xlr_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- nsim_hs_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- nsim_hs_smp_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- nsimosci_hs_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- nsimosci_hs_smp_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- omap1_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- omap2plus_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- omega2p_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- orion5x_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- oxnas_v6_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- palmz72_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pcm027_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pic32mzda_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pistachio_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pleb_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text+0xc834): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- pnx8335_stb225_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- prima2_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pxa168_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pxa255-idp_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pxa3xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pxa910_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- pxa_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- qcom_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- qi_lb60_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- rb532_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- rbtx49xx_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- realview_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- rm200_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- rpc_defconfig (arm, gcc-10) — FAIL, 4 errors, 0 warnings, 0 section mismatches Errors: arm-linux-gnueabihf-gcc: error: unrecognized -march target: armv3m arm-linux-gnueabihf-gcc: error: missing argument to ‘-march=’ arm-linux-gnueabihf-gcc: error: unrecognized -march target: armv3m arm-linux-gnueabihf-gcc: error: missing argument to ‘-march=’ -------------------------------------------------------------------------------- rt305x_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- s3c2410_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- s3c6400_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- s5pv210_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- sama5_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- sb1250_swarm_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- shannon_defconfig (arm, gcc-10) — PASS, 0 errors, 1 warning, 0 section mismatches Warnings: drivers/video/fbdev/sa1100fb.c:975:21: warning: ‘sa1100fb_min_dma_period’ defined but not used [-Wunused-function] Section mismatches: WARNING: vmlinux.o(.text+0xcaac): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- shmobile_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- simpad_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches Section mismatches: WARNING: vmlinux.o(.text+0xcf00): Section mismatch in reference from the function __arm_ioremap_pfn_caller() to the function .meminit.text:memblock_is_map_memory() -------------------------------------------------------------------------------- socfpga_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- spear13xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- spear3xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- spear6xx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- spitz_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- stm32_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- sunxi_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- tango4_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- tb0219_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- tb0226_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- tb0287_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- tct_hammer_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- tegra_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- tinyconfig (x86_64, gcc-10) — PASS, 0 errors, 3 warnings, 0 section mismatches Warnings: arch/x86/entry/entry_64.S:1732: Warning: no instruction mnemonic suffix given and no register operands; using default for `sysret' ld: arch/x86/boot/compressed/head_64.o: warning: relocation in read-only section `.head.text' ld: warning: creating DT_TEXTREL in a PIE -------------------------------------------------------------------------------- tinyconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- tinyconfig (i386, gcc-10) — PASS, 0 errors, 2 warnings, 0 section mismatches Warnings: ld: arch/x86/boot/compressed/head_32.o: warning: relocation in read-only section `.head.text' ld: warning: creating DT_TEXTREL in a PIE -------------------------------------------------------------------------------- trizeps4_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- u300_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- u8500_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- vdk_hs38_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- vdk_hs38_smp_defconfig (arc, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- versatile_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- vexpress_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- vf610m4_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- viper_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- vocore2_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- vt8500_v6_v7_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- workpad_defconfig (mips, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- x86_64_defconfig (x86_64, gcc-10) — PASS, 0 errors, 2 warnings, 0 section mismatches Warnings: ld: arch/x86/boot/compressed/head_64.o: warning: relocation in read-only section `.head.text' ld: warning: creating DT_TEXTREL in a PIE -------------------------------------------------------------------------------- x86_64_defconfig+x86-chromebook (x86_64, gcc-10) — PASS, 0 errors, 2 warnings, 0 section mismatches Warnings: ld: arch/x86/boot/compressed/head_64.o: warning: relocation in read-only section `.head.text' ld: warning: creating DT_TEXTREL in a PIE -------------------------------------------------------------------------------- xcep_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- zeus_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches -------------------------------------------------------------------------------- zx_defconfig (arm, gcc-10) — PASS, 0 errors, 0 warnings, 0 section mismatches --- For more info write to <info(a)kernelci.org>

2 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.16 01/20] atomics: Fix atomic64_{read_acquire,set_release} fallbacks

by Sasha Levin

From: Mark Rutland <mark.rutland(a)arm.com> [ Upstream commit dc1b4df09acdca7a89806b28f235cd6d8dcd3d24 ] Arnd reports that on 32-bit architectures, the fallbacks for atomic64_read_acquire() and atomic64_set_release() are broken as they use smp_load_acquire() and smp_store_release() respectively, which do not work on types larger than the native word size. Since those contain compiletime_assert_atomic_type(), any attempt to use those fallbacks will result in a build-time error. e.g. with the following added to arch/arm/kernel/setup.c: | void test_atomic64(atomic64_t *v) | { | atomic64_set_release(v, 5); | atomic64_read_acquire(v); | } The compiler will complain as follows: | In file included from <command-line>: | In function 'arch_atomic64_set_release', | inlined from 'test_atomic64' at ./include/linux/atomic/atomic-instrumented.h:669:2: | ././include/linux/compiler_types.h:346:38: error: call to '__compiletime_assert_9' declared with attribute error: Need native word sized stores/loads for atomicity. | 346 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | | ^ | ././include/linux/compiler_types.h:327:4: note: in definition of macro '__compiletime_assert' | 327 | prefix ## suffix(); \ | | ^~~~~~ | ././include/linux/compiler_types.h:346:2: note: in expansion of macro '_compiletime_assert' | 346 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) | | ^~~~~~~~~~~~~~~~~~~ | ././include/linux/compiler_types.h:349:2: note: in expansion of macro 'compiletime_assert' | 349 | compiletime_assert(__native_word(t), \ | | ^~~~~~~~~~~~~~~~~~ | ./include/asm-generic/barrier.h:133:2: note: in expansion of macro 'compiletime_assert_atomic_type' | 133 | compiletime_assert_atomic_type(*p); \ | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ./include/asm-generic/barrier.h:164:55: note: in expansion of macro '__smp_store_release' | 164 | #define smp_store_release(p, v) do { kcsan_release(); __smp_store_release(p, v); } while (0) | | ^~~~~~~~~~~~~~~~~~~ | ./include/linux/atomic/atomic-arch-fallback.h:1270:2: note: in expansion of macro 'smp_store_release' | 1270 | smp_store_release(&(v)->counter, i); | | ^~~~~~~~~~~~~~~~~ | make[2]: *** [scripts/Makefile.build:288: arch/arm/kernel/setup.o] Error 1 | make[1]: *** [scripts/Makefile.build:550: arch/arm/kernel] Error 2 | make: *** [Makefile:1831: arch/arm] Error 2 Fix this by only using smp_load_acquire() and smp_store_release() for native atomic types, and otherwise falling back to the regular barriers necessary for acquire/release semantics, as we do in the more generic acquire and release fallbacks. Since the fallback templates are used to generate the atomic64_*() and atomic_*() operations, the __native_word() check is added to both. For the atomic_*() operations, which are always 32-bit, the __native_word() check is redundant but not harmful, as it is always true. For the example above this works as expected on 32-bit, e.g. for arm multi_v7_defconfig: | <test_atomic64>: | push {r4, r5} | dmb ish | pldw [r0] | mov r2, #5 | mov r3, #0 | ldrexd r4, [r0] | strexd r4, r2, [r0] | teq r4, #0 | bne 484 <test_atomic64+0x14> | ldrexd r2, [r0] | dmb ish | pop {r4, r5} | bx lr ... and also on 64-bit, e.g. for arm64 defconfig: | <test_atomic64>: | bti c | paciasp | mov x1, #0x5 | stlr x1, [x0] | ldar x0, [x0] | autiasp | ret Reported-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Boqun Feng <boqun.feng(a)gmail.com> Link: https://lore.kernel.org/r/20220207101943.439825-1-mark.rutland@arm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- include/linux/atomic/atomic-arch-fallback.h | 38 ++++++++++++++++++--- scripts/atomic/fallbacks/read_acquire | 11 +++++- scripts/atomic/fallbacks/set_release | 7 +++- 3 files changed, 49 insertions(+), 7 deletions(-) diff --git a/include/linux/atomic/atomic-arch-fallback.h b/include/linux/atomic/atomic-arch-fallback.h index a3dba31df01e..6db58d180866 100644 --- a/include/linux/atomic/atomic-arch-fallback.h +++ b/include/linux/atomic/atomic-arch-fallback.h @@ -151,7 +151,16 @@ static __always_inline int arch_atomic_read_acquire(const atomic_t *v) { - return smp_load_acquire(&(v)->counter); + int ret; + + if (__native_word(atomic_t)) { + ret = smp_load_acquire(&(v)->counter); + } else { + ret = arch_atomic_read(v); + __atomic_acquire_fence(); + } + + return ret; } #define arch_atomic_read_acquire arch_atomic_read_acquire #endif @@ -160,7 +169,12 @@ arch_atomic_read_acquire(const atomic_t *v) static __always_inline void arch_atomic_set_release(atomic_t *v, int i) { - smp_store_release(&(v)->counter, i); + if (__native_word(atomic_t)) { + smp_store_release(&(v)->counter, i); + } else { + __atomic_release_fence(); + arch_atomic_set(v, i); + } } #define arch_atomic_set_release arch_atomic_set_release #endif @@ -1258,7 +1272,16 @@ arch_atomic_dec_if_positive(atomic_t *v) static __always_inline s64 arch_atomic64_read_acquire(const atomic64_t *v) { - return smp_load_acquire(&(v)->counter); + s64 ret; + + if (__native_word(atomic64_t)) { + ret = smp_load_acquire(&(v)->counter); + } else { + ret = arch_atomic64_read(v); + __atomic_acquire_fence(); + } + + return ret; } #define arch_atomic64_read_acquire arch_atomic64_read_acquire #endif @@ -1267,7 +1290,12 @@ arch_atomic64_read_acquire(const atomic64_t *v) static __always_inline void arch_atomic64_set_release(atomic64_t *v, s64 i) { - smp_store_release(&(v)->counter, i); + if (__native_word(atomic64_t)) { + smp_store_release(&(v)->counter, i); + } else { + __atomic_release_fence(); + arch_atomic64_set(v, i); + } } #define arch_atomic64_set_release arch_atomic64_set_release #endif @@ -2358,4 +2386,4 @@ arch_atomic64_dec_if_positive(atomic64_t *v) #endif #endif /* _LINUX_ATOMIC_FALLBACK_H */ -// cca554917d7ea73d5e3e7397dd70c484cad9b2c4 +// 8e2cc06bc0d2c0967d2f8424762bd48555ee40ae diff --git a/scripts/atomic/fallbacks/read_acquire b/scripts/atomic/fallbacks/read_acquire index 803ba7561076..a0ea1d26e6b2 100755 --- a/scripts/atomic/fallbacks/read_acquire +++ b/scripts/atomic/fallbacks/read_acquire @@ -2,6 +2,15 @@ cat <<EOF static __always_inline ${ret} arch_${atomic}_read_acquire(const ${atomic}_t *v) { - return smp_load_acquire(&(v)->counter); + ${int} ret; + + if (__native_word(${atomic}_t)) { + ret = smp_load_acquire(&(v)->counter); + } else { + ret = arch_${atomic}_read(v); + __atomic_acquire_fence(); + } + + return ret; } EOF diff --git a/scripts/atomic/fallbacks/set_release b/scripts/atomic/fallbacks/set_release index 86ede759f24e..05cdb7f42477 100755 --- a/scripts/atomic/fallbacks/set_release +++ b/scripts/atomic/fallbacks/set_release @@ -2,6 +2,11 @@ cat <<EOF static __always_inline void arch_${atomic}_set_release(${atomic}_t *v, ${int} i) { - smp_store_release(&(v)->counter, i); + if (__native_word(${atomic}_t)) { + smp_store_release(&(v)->counter, i); + } else { + __atomic_release_fence(); + arch_${atomic}_set(v, i); + } } EOF -- 2.34.1

2 years, 9 months

2
20
0 0

stable-rc/queue/5.16 baseline: 118 runs, 1 regressions (v5.16.18-6-gf2dce803af00)

by kernelci.org bot

stable-rc/queue/5.16 baseline: 118 runs, 1 regressions (v5.16.18-6-gf2dce803af00) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions ------------------------+-------+------------+----------+-----------+------------ sun50i-a64-bananapi-m64 | arm64 | lab-clabbe | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/queue%2F5.16/kernel/v5.16.18… Test: baseline Tree: stable-rc Branch: queue/5.16 Describe: v5.16.18-6-gf2dce803af00 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: f2dce803af00067a267eb53806b5511a5e2e681e Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions ------------------------+-------+------------+----------+-----------+------------ sun50i-a64-bananapi-m64 | arm64 | lab-clabbe | gcc-10 | defconfig | 1 Details: https://kernelci.org/test/plan/id/6241d982820bd59643ae0681 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: defconfig Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/queue-5.16/v5.16.18-6-gf2dce803af00… HTML log: https://storage.kernelci.org//stable-rc/queue-5.16/v5.16.18-6-gf2dce803af00… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2022… * baseline.login: https://kernelci.org/test/case/id/6241d982820bd59643ae0682 failing since 3 days (last pass: v5.16.17-3-g38c8070eb777, first fail: v5.16.17-34-g92d627424f3c)

2 years, 9 months

1
0
0 0

Re: [PATCH AUTOSEL 5.17 16/43] random: use computational hash for entropy extraction

by Michael Brooks

I should have said 'predicate', not 'axiom'. Please review the rigorous proof of correctness as listed on my github. Another issue I'd like to bring up in 5.17 is the apparent lack of mathematical proofs and overuse of the word "entropy" when we should be using the word uniqueness - do we really want to go live with something that isn't documented at all and just trust the word of any one individual? My team put together mathematical proof of correctness, the onerious of proving a defect in the implementation is up to individuals who run the code and observe a failing - that is the point of code review. The proposed changes to the pool means it no longer needs to be "drained" or "accumulated", however we still may need a lock to make sure the /dev/random device driver is ready for use prior to access. Although I am actually not entirely convinced that this lock is needed because it directly impacts boot time because of KSLR. We could lock and wait for the slow long term storage to wake up and feed us the seed - but is that really necessary? The alternate_rand() function in the provided patch should be sufficient for the vast majority of non-paranoid users, I don't see how a would-be adversary could undermine this construction - sure it isn't ideally secure as a fully loaded keypool - but it's good enough to thwart a memory corruption exploit. A fast boot option is preferable IMHO. Regards, Mike On Mon, Mar 28, 2022 at 9:16 AM Michael Brooks <m(a)sweetwater.ai> wrote: > > Jason, > > I think this is an astute observation - the current design of the pool has this defect of being emptied leading to deadlocks, and in addition, access to it undermines the predictability of the pool. This needs to be fundamentally addressed. > > What if access to the pool could never undermine the predictability of the pool state? If this axiom holds, then there would never be a reason to keep a global counter for how much “entropy” or uniqueness is in the pool - and that would remove the lock that handle_irq_event_percpu() is fighting over... which creates a condition where one lock is being battled over by every irq event - which is made worse as the machine has additional CPUs. This one lock is so bad, it is basically a GIL, and we need to have a serious discussion on how to remove this one lock. > > This may sound far fetched, but there is actually some clever cryptography that can provide a good solution here. What if the pool was not a linear structure FILO structure, but actually a jump table? What if access to this jump table was randomized, so that no two callers could take the same path through the table? What if in addition, upon read - the reader "covers their tracks" and modifies their entrypoint into the table to prevent any other caller from being able to follow the same path? This is exactly what keypoolrandom does. > > Now, if the output of this jump table is used as an input to cryptographic primitives such as an ideal block cipher or hash function - then even a single bit flip would cause an avalanche which dramatically affects the output - and also obscures how it was generated. Therefore, access using this method could never undermine the pool state - therefore this speciture structure never "drains" but rather becomes less and less predictable over time. > > This kind of jump table has been written and is called https://github.com/TheRook/KeypoolRandom. This took three years to write, has been peer reviewed and has exquisite documentation, if you take the time to read over this code and the docs - I think you'll enjoy it. This project is very easy to compile and to run - it is the software equivalent of a breakout board, and doesn't require a full kernel compile to see how it functions. > > Regards, > Michael Brooks > > > On Mon, Mar 28, 2022 at 4:20 AM Sasha Levin <sashal(a)kernel.org> wrote: >> >> From: "Jason A. Donenfeld" <Jason(a)zx2c4.com> >> >> [ Upstream commit 6e8ec2552c7d13991148e551e3325a624d73fac6 ] >> >> The current 4096-bit LFSR used for entropy collection had a few >> desirable attributes for the context in which it was created. For >> example, the state was huge, which meant that /dev/random would be able >> to output quite a bit of accumulated entropy before blocking. It was >> also, in its time, quite fast at accumulating entropy byte-by-byte, >> which matters given the varying contexts in which mix_pool_bytes() is >> called. And its diffusion was relatively high, which meant that changes >> would ripple across several words of state rather quickly. >> >> However, it also suffers from a few security vulnerabilities. In >> particular, inputs learned by an attacker can be undone, but moreover, >> if the state of the pool leaks, its contents can be controlled and >> entirely zeroed out. I've demonstrated this attack with this SMT2 >> script, <https://xn--4db.cc/5o9xO8pb>, which Boolector/CaDiCal solves in >> a matter of seconds on a single core of my laptop, resulting in little >> proof of concept C demonstrators such as <https://xn--4db.cc/jCkvvIaH/c>. >> >> For basically all recent formal models of RNGs, these attacks represent >> a significant cryptographic flaw. But how does this manifest >> practically? If an attacker has access to the system to such a degree >> that he can learn the internal state of the RNG, arguably there are >> other lower hanging vulnerabilities -- side-channel, infoleak, or >> otherwise -- that might have higher priority. On the other hand, seed >> files are frequently used on systems that have a hard time generating >> much entropy on their own, and these seed files, being files, often leak >> or are duplicated and distributed accidentally, or are even seeded over >> the Internet intentionally, where their contents might be recorded or >> tampered with. Seen this way, an otherwise quasi-implausible >> vulnerability is a bit more practical than initially thought. >> >> Another aspect of the current mix_pool_bytes() function is that, while >> its performance was arguably competitive for the time in which it was >> created, it's no longer considered so. This patch improves performance >> significantly: on a high-end CPU, an i7-11850H, it improves performance >> of mix_pool_bytes() by 225%, and on a low-end CPU, a Cortex-A7, it >> improves performance by 103%. >> >> This commit replaces the LFSR of mix_pool_bytes() with a straight- >> forward cryptographic hash function, BLAKE2s, which is already in use >> for pool extraction. Universal hashing with a secret seed was considered >> too, something along the lines of <https://eprint.iacr.org/2013/338>, >> but the requirement for a secret seed makes for a chicken & egg problem. >> Instead we go with a formally proven scheme using a computational hash >> function, described in sections 5.1, 6.4, and B.1.8 of >> <https://eprint.iacr.org/2019/198>. >> >> BLAKE2s outputs 256 bits, which should give us an appropriate amount of >> min-entropy accumulation, and a wide enough margin of collision >> resistance against active attacks. mix_pool_bytes() becomes a simple >> call to blake2s_update(), for accumulation, while the extraction step >> becomes a blake2s_final() to generate a seed, with which we can then do >> a HKDF-like or BLAKE2X-like expansion, the first part of which we fold >> back as an init key for subsequent blake2s_update()s, and the rest we >> produce to the caller. This then is provided to our CRNG like usual. In >> that expansion step, we make opportunistic use of 32 bytes of RDRAND >> output, just as before. We also always reseed the crng with 32 bytes, >> unconditionally, or not at all, rather than sometimes with 16 as before, >> as we don't win anything by limiting beyond the 16 byte threshold. >> >> Going for a hash function as an entropy collector is a conservative, >> proven approach. The result of all this is a much simpler and much less >> bespoke construction than what's there now, which not only plugs a >> vulnerability but also improves performance considerably. >> >> Cc: Theodore Ts'o <tytso(a)mit.edu> >> Cc: Dominik Brodowski <linux(a)dominikbrodowski.net> >> Reviewed-by: Eric Biggers <ebiggers(a)google.com> >> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> >> Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson(a)gmail.com> >> Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> >> Signed-off-by: Sasha Levin <sashal(a)kernel.org> >> --- >> drivers/char/random.c | 304 ++++++++---------------------------------- >> 1 file changed, 55 insertions(+), 249 deletions(-) >> >> diff --git a/drivers/char/random.c b/drivers/char/random.c >> index 3404a91edf29..882f78829a24 100644 >> --- a/drivers/char/random.c >> +++ b/drivers/char/random.c >> @@ -42,61 +42,6 @@ >> */ >> >> /* >> - * (now, with legal B.S. out of the way.....) >> - * >> - * This routine gathers environmental noise from device drivers, etc., >> - * and returns good random numbers, suitable for cryptographic use. >> - * Besides the obvious cryptographic uses, these numbers are also good >> - * for seeding TCP sequence numbers, and other places where it is >> - * desirable to have numbers which are not only random, but hard to >> - * predict by an attacker. >> - * >> - * Theory of operation >> - * =================== >> - * >> - * Computers are very predictable devices. Hence it is extremely hard >> - * to produce truly random numbers on a computer --- as opposed to >> - * pseudo-random numbers, which can easily generated by using a >> - * algorithm. Unfortunately, it is very easy for attackers to guess >> - * the sequence of pseudo-random number generators, and for some >> - * applications this is not acceptable. So instead, we must try to >> - * gather "environmental noise" from the computer's environment, which >> - * must be hard for outside attackers to observe, and use that to >> - * generate random numbers. In a Unix environment, this is best done >> - * from inside the kernel. >> - * >> - * Sources of randomness from the environment include inter-keyboard >> - * timings, inter-interrupt timings from some interrupts, and other >> - * events which are both (a) non-deterministic and (b) hard for an >> - * outside observer to measure. Randomness from these sources are >> - * added to an "entropy pool", which is mixed using a CRC-like function. >> - * This is not cryptographically strong, but it is adequate assuming >> - * the randomness is not chosen maliciously, and it is fast enough that >> - * the overhead of doing it on every interrupt is very reasonable. >> - * As random bytes are mixed into the entropy pool, the routines keep >> - * an *estimate* of how many bits of randomness have been stored into >> - * the random number generator's internal state. >> - * >> - * When random bytes are desired, they are obtained by taking the BLAKE2s >> - * hash of the contents of the "entropy pool". The BLAKE2s hash avoids >> - * exposing the internal state of the entropy pool. It is believed to >> - * be computationally infeasible to derive any useful information >> - * about the input of BLAKE2s from its output. Even if it is possible to >> - * analyze BLAKE2s in some clever way, as long as the amount of data >> - * returned from the generator is less than the inherent entropy in >> - * the pool, the output data is totally unpredictable. For this >> - * reason, the routine decreases its internal estimate of how many >> - * bits of "true randomness" are contained in the entropy pool as it >> - * outputs random numbers. >> - * >> - * If this estimate goes to zero, the routine can still generate >> - * random numbers; however, an attacker may (at least in theory) be >> - * able to infer the future output of the generator from prior >> - * outputs. This requires successful cryptanalysis of BLAKE2s, which is >> - * not believed to be feasible, but there is a remote possibility. >> - * Nonetheless, these numbers should be useful for the vast majority >> - * of purposes. >> - * >> * Exported interfaces ---- output >> * =============================== >> * >> @@ -298,23 +243,6 @@ >> * >> * mknod /dev/random c 1 8 >> * mknod /dev/urandom c 1 9 >> - * >> - * Acknowledgements: >> - * ================= >> - * >> - * Ideas for constructing this random number generator were derived >> - * from Pretty Good Privacy's random number generator, and from private >> - * discussions with Phil Karn. Colin Plumb provided a faster random >> - * number generator, which speed up the mixing function of the entropy >> - * pool, taken from PGPfone. Dale Worley has also contributed many >> - * useful ideas and suggestions to improve this driver. >> - * >> - * Any flaws in the design are solely my responsibility, and should >> - * not be attributed to the Phil, Colin, or any of authors of PGP. >> - * >> - * Further background information on this topic may be obtained from >> - * RFC 1750, "Randomness Recommendations for Security", by Donald >> - * Eastlake, Steve Crocker, and Jeff Schiller. >> */ >> >> #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt >> @@ -358,79 +286,15 @@ >> >> /* #define ADD_INTERRUPT_BENCH */ >> >> -/* >> - * If the entropy count falls under this number of bits, then we >> - * should wake up processes which are selecting or polling on write >> - * access to /dev/random. >> - */ >> -static int random_write_wakeup_bits = 28 * (1 << 5); >> - >> -/* >> - * Originally, we used a primitive polynomial of degree .poolwords >> - * over GF(2). The taps for various sizes are defined below. They >> - * were chosen to be evenly spaced except for the last tap, which is 1 >> - * to get the twisting happening as fast as possible. >> - * >> - * For the purposes of better mixing, we use the CRC-32 polynomial as >> - * well to make a (modified) twisted Generalized Feedback Shift >> - * Register. (See M. Matsumoto & Y. Kurita, 1992. Twisted GFSR >> - * generators. ACM Transactions on Modeling and Computer Simulation >> - * 2(3):179-194. Also see M. Matsumoto & Y. Kurita, 1994. Twisted >> - * GFSR generators II. ACM Transactions on Modeling and Computer >> - * Simulation 4:254-266) >> - * >> - * Thanks to Colin Plumb for suggesting this. >> - * >> - * The mixing operation is much less sensitive than the output hash, >> - * where we use BLAKE2s. All that we want of mixing operation is that >> - * it be a good non-cryptographic hash; i.e. it not produce collisions >> - * when fed "random" data of the sort we expect to see. As long as >> - * the pool state differs for different inputs, we have preserved the >> - * input entropy and done a good job. The fact that an intelligent >> - * attacker can construct inputs that will produce controlled >> - * alterations to the pool's state is not important because we don't >> - * consider such inputs to contribute any randomness. The only >> - * property we need with respect to them is that the attacker can't >> - * increase his/her knowledge of the pool's state. Since all >> - * additions are reversible (knowing the final state and the input, >> - * you can reconstruct the initial state), if an attacker has any >> - * uncertainty about the initial state, he/she can only shuffle that >> - * uncertainty about, but never cause any collisions (which would >> - * decrease the uncertainty). >> - * >> - * Our mixing functions were analyzed by Lacharme, Roeck, Strubel, and >> - * Videau in their paper, "The Linux Pseudorandom Number Generator >> - * Revisited" (see: http://eprint.iacr.org/2012/251.pdf). In their >> - * paper, they point out that we are not using a true Twisted GFSR, >> - * since Matsumoto & Kurita used a trinomial feedback polynomial (that >> - * is, with only three taps, instead of the six that we are using). >> - * As a result, the resulting polynomial is neither primitive nor >> - * irreducible, and hence does not have a maximal period over >> - * GF(2**32). They suggest a slight change to the generator >> - * polynomial which improves the resulting TGFSR polynomial to be >> - * irreducible, which we have made here. >> - */ >> enum poolinfo { >> - POOL_WORDS = 128, >> - POOL_WORDMASK = POOL_WORDS - 1, >> - POOL_BYTES = POOL_WORDS * sizeof(u32), >> - POOL_BITS = POOL_BYTES * 8, >> + POOL_BITS = BLAKE2S_HASH_SIZE * 8, >> POOL_BITSHIFT = ilog2(POOL_BITS), >> >> /* To allow fractional bits to be tracked, the entropy_count field is >> * denominated in units of 1/8th bits. */ >> POOL_ENTROPY_SHIFT = 3, >> #define POOL_ENTROPY_BITS() (input_pool.entropy_count >> POOL_ENTROPY_SHIFT) >> - POOL_FRACBITS = POOL_BITS << POOL_ENTROPY_SHIFT, >> - >> - /* x^128 + x^104 + x^76 + x^51 +x^25 + x + 1 */ >> - POOL_TAP1 = 104, >> - POOL_TAP2 = 76, >> - POOL_TAP3 = 51, >> - POOL_TAP4 = 25, >> - POOL_TAP5 = 1, >> - >> - EXTRACT_SIZE = BLAKE2S_HASH_SIZE / 2 >> + POOL_FRACBITS = POOL_BITS << POOL_ENTROPY_SHIFT >> }; >> >> /* >> @@ -438,6 +302,12 @@ enum poolinfo { >> */ >> static DECLARE_WAIT_QUEUE_HEAD(random_write_wait); >> static struct fasync_struct *fasync; >> +/* >> + * If the entropy count falls under this number of bits, then we >> + * should wake up processes which are selecting or polling on write >> + * access to /dev/random. >> + */ >> +static int random_write_wakeup_bits = POOL_BITS * 3 / 4; >> >> static DEFINE_SPINLOCK(random_ready_list_lock); >> static LIST_HEAD(random_ready_list); >> @@ -493,73 +363,31 @@ MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression"); >> * >> **********************************************************************/ >> >> -static u32 input_pool_data[POOL_WORDS] __latent_entropy; >> - >> static struct { >> + struct blake2s_state hash; >> spinlock_t lock; >> - u16 add_ptr; >> - u16 input_rotate; >> int entropy_count; >> } input_pool = { >> + .hash.h = { BLAKE2S_IV0 ^ (0x01010000 | BLAKE2S_HASH_SIZE), >> + BLAKE2S_IV1, BLAKE2S_IV2, BLAKE2S_IV3, BLAKE2S_IV4, >> + BLAKE2S_IV5, BLAKE2S_IV6, BLAKE2S_IV7 }, >> + .hash.outlen = BLAKE2S_HASH_SIZE, >> .lock = __SPIN_LOCK_UNLOCKED(input_pool.lock), >> }; >> >> -static ssize_t extract_entropy(void *buf, size_t nbytes, int min); >> -static ssize_t _extract_entropy(void *buf, size_t nbytes); >> +static bool extract_entropy(void *buf, size_t nbytes, int min); >> +static void _extract_entropy(void *buf, size_t nbytes); >> >> static void crng_reseed(struct crng_state *crng, bool use_input_pool); >> >> -static const u32 twist_table[8] = { >> - 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158, >> - 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 }; >> - >> /* >> * This function adds bytes into the entropy "pool". It does not >> * update the entropy estimate. The caller should call >> * credit_entropy_bits if this is appropriate. >> - * >> - * The pool is stirred with a primitive polynomial of the appropriate >> - * degree, and then twisted. We twist by three bits at a time because >> - * it's cheap to do so and helps slightly in the expected case where >> - * the entropy is concentrated in the low-order bits. >> */ >> static void _mix_pool_bytes(const void *in, int nbytes) >> { >> - unsigned long i; >> - int input_rotate; >> - const u8 *bytes = in; >> - u32 w; >> - >> - input_rotate = input_pool.input_rotate; >> - i = input_pool.add_ptr; >> - >> - /* mix one byte at a time to simplify size handling and churn faster */ >> - while (nbytes--) { >> - w = rol32(*bytes++, input_rotate); >> - i = (i - 1) & POOL_WORDMASK; >> - >> - /* XOR in the various taps */ >> - w ^= input_pool_data[i]; >> - w ^= input_pool_data[(i + POOL_TAP1) & POOL_WORDMASK]; >> - w ^= input_pool_data[(i + POOL_TAP2) & POOL_WORDMASK]; >> - w ^= input_pool_data[(i + POOL_TAP3) & POOL_WORDMASK]; >> - w ^= input_pool_data[(i + POOL_TAP4) & POOL_WORDMASK]; >> - w ^= input_pool_data[(i + POOL_TAP5) & POOL_WORDMASK]; >> - >> - /* Mix the result back in with a twist */ >> - input_pool_data[i] = (w >> 3) ^ twist_table[w & 7]; >> - >> - /* >> - * Normally, we add 7 bits of rotation to the pool. >> - * At the beginning of the pool, add an extra 7 bits >> - * rotation, so that successive passes spread the >> - * input bits across the pool evenly. >> - */ >> - input_rotate = (input_rotate + (i ? 7 : 14)) & 31; >> - } >> - >> - input_pool.input_rotate = input_rotate; >> - input_pool.add_ptr = i; >> + blake2s_update(&input_pool.hash, in, nbytes); >> } >> >> static void __mix_pool_bytes(const void *in, int nbytes) >> @@ -953,15 +781,14 @@ static int crng_slow_load(const u8 *cp, size_t len) >> static void crng_reseed(struct crng_state *crng, bool use_input_pool) >> { >> unsigned long flags; >> - int i, num; >> + int i; >> union { >> u8 block[CHACHA_BLOCK_SIZE]; >> u32 key[8]; >> } buf; >> >> if (use_input_pool) { >> - num = extract_entropy(&buf, 32, 16); >> - if (num == 0) >> + if (!extract_entropy(&buf, 32, 16)) >> return; >> } else { >> _extract_crng(&primary_crng, buf.block); >> @@ -1329,74 +1156,48 @@ static size_t account(size_t nbytes, int min) >> } >> >> /* >> - * This function does the actual extraction for extract_entropy. >> - * >> - * Note: we assume that .poolwords is a multiple of 16 words. >> + * This is an HKDF-like construction for using the hashed collected entropy >> + * as a PRF key, that's then expanded block-by-block. >> */ >> -static void extract_buf(u8 *out) >> +static void _extract_entropy(void *buf, size_t nbytes) >> { >> - struct blake2s_state state __aligned(__alignof__(unsigned long)); >> - u8 hash[BLAKE2S_HASH_SIZE]; >> - unsigned long *salt; >> unsigned long flags; >> - >> - blake2s_init(&state, sizeof(hash)); >> - >> - /* >> - * If we have an architectural hardware random number >> - * generator, use it for BLAKE2's salt & personal fields. >> - */ >> - for (salt = (unsigned long *)&state.h[4]; >> - salt < (unsigned long *)&state.h[8]; ++salt) { >> - unsigned long v; >> - if (!arch_get_random_long(&v)) >> - break; >> - *salt ^= v; >> + u8 seed[BLAKE2S_HASH_SIZE], next_key[BLAKE2S_HASH_SIZE]; >> + struct { >> + unsigned long rdrand[32 / sizeof(long)]; >> + size_t counter; >> + } block; >> + size_t i; >> + >> + for (i = 0; i < ARRAY_SIZE(block.rdrand); ++i) { >> + if (!arch_get_random_long(&block.rdrand[i])) >> + block.rdrand[i] = random_get_entropy(); >> } >> >> - /* Generate a hash across the pool */ >> spin_lock_irqsave(&input_pool.lock, flags); >> - blake2s_update(&state, (const u8 *)input_pool_data, POOL_BYTES); >> - blake2s_final(&state, hash); /* final zeros out state */ >> >> - /* >> - * We mix the hash back into the pool to prevent backtracking >> - * attacks (where the attacker knows the state of the pool >> - * plus the current outputs, and attempts to find previous >> - * outputs), unless the hash function can be inverted. By >> - * mixing at least a hash worth of hash data back, we make >> - * brute-forcing the feedback as hard as brute-forcing the >> - * hash. >> - */ >> - __mix_pool_bytes(hash, sizeof(hash)); >> - spin_unlock_irqrestore(&input_pool.lock, flags); >> + /* seed = HASHPRF(last_key, entropy_input) */ >> + blake2s_final(&input_pool.hash, seed); >> >> - /* Note that EXTRACT_SIZE is half of hash size here, because above >> - * we've dumped the full length back into mixer. By reducing the >> - * amount that we emit, we retain a level of forward secrecy. >> - */ >> - memcpy(out, hash, EXTRACT_SIZE); >> - memzero_explicit(hash, sizeof(hash)); >> -} >> + /* next_key = HASHPRF(seed, RDRAND || 0) */ >> + block.counter = 0; >> + blake2s(next_key, (u8 *)&block, seed, sizeof(next_key), sizeof(block), sizeof(seed)); >> + blake2s_init_key(&input_pool.hash, BLAKE2S_HASH_SIZE, next_key, sizeof(next_key)); >> >> -static ssize_t _extract_entropy(void *buf, size_t nbytes) >> -{ >> - ssize_t ret = 0, i; >> - u8 tmp[EXTRACT_SIZE]; >> + spin_unlock_irqrestore(&input_pool.lock, flags); >> + memzero_explicit(next_key, sizeof(next_key)); >> >> while (nbytes) { >> - extract_buf(tmp); >> - i = min_t(int, nbytes, EXTRACT_SIZE); >> - memcpy(buf, tmp, i); >> + i = min_t(size_t, nbytes, BLAKE2S_HASH_SIZE); >> + /* output = HASHPRF(seed, RDRAND || ++counter) */ >> + ++block.counter; >> + blake2s(buf, (u8 *)&block, seed, i, sizeof(block), sizeof(seed)); >> nbytes -= i; >> buf += i; >> - ret += i; >> } >> >> - /* Wipe data just returned from memory */ >> - memzero_explicit(tmp, sizeof(tmp)); >> - >> - return ret; >> + memzero_explicit(seed, sizeof(seed)); >> + memzero_explicit(&block, sizeof(block)); >> } >> >> /* >> @@ -1404,13 +1205,18 @@ static ssize_t _extract_entropy(void *buf, size_t nbytes) >> * returns it in a buffer. >> * >> * The min parameter specifies the minimum amount we can pull before >> - * failing to avoid races that defeat catastrophic reseeding. >> + * failing to avoid races that defeat catastrophic reseeding. If we >> + * have less than min entropy available, we return false and buf is >> + * not filled. >> */ >> -static ssize_t extract_entropy(void *buf, size_t nbytes, int min) >> +static bool extract_entropy(void *buf, size_t nbytes, int min) >> { >> trace_extract_entropy(nbytes, POOL_ENTROPY_BITS(), _RET_IP_); >> - nbytes = account(nbytes, min); >> - return _extract_entropy(buf, nbytes); >> + if (account(nbytes, min)) { >> + _extract_entropy(buf, nbytes); >> + return true; >> + } >> + return false; >> } >> >> #define warn_unseeded_randomness(previous) \ >> @@ -1674,7 +1480,7 @@ static void __init init_std_data(void) >> unsigned long rv; >> >> mix_pool_bytes(&now, sizeof(now)); >> - for (i = POOL_BYTES; i > 0; i -= sizeof(rv)) { >> + for (i = BLAKE2S_BLOCK_SIZE; i > 0; i -= sizeof(rv)) { >> if (!arch_get_random_seed_long(&rv) && >> !arch_get_random_long(&rv)) >> rv = random_get_entropy(); >> -- >> 2.34.1 >>

2 years, 9 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2022