| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 11 Jul 2017 22:42:04 +0800
From: Alex Shi <alex.shi@...aro.org>
To: open list <linux-kernel@...r.kernel.org>
Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
Thomas Gleixner <tglx@...utronix.de>,
Anders Roxell <anders.roxell@...aro.org>,
Rik van Riel <riel@...hat.com>,
Steven Rostedt <rostedt@...dmis.org>,
"Rafael J . Wysocki" <rafael.j.wysocki@...el.com>,
Daniel Lezcano <daniel.lezcano@...aro.org>,
linux-rt-users <linux-rt-users@...r.kernel.org>
Subject: Re: [PATCH] cpu_pm: replace raw_notifier to atomic_notifier
It is a serious bug: add a waiting lock in idle and cause boot failure
in arm/arm64 RT.
Any more comments for this change?
On 07/06/2017 04:47 PM, Alex Shi wrote:
> This patch replace a rwlock and raw notifier by atomic notifier which
> protected by spin_lock and rcu.
>
> The first to reason to have this replace is due to a 'scheduling while
> atomic' bug of RT kernel on arm/arm64 platform. On arm/arm64, rwlock
> cpu_pm_notifier_lock in cpu_pm cause a potential schedule after irq
> disable in idle call chain:
>
> cpu_startup_entry
> cpu_idle_loop
> local_irq_disable()
> cpuidle_idle_call
> call_cpuidle
> cpuidle_enter
> cpuidle_enter_state
> ->enter :arm_enter_idle_state
> cpu_pm_enter/exit
> CPU_PM_CPU_IDLE_ENTER
> read_lock(&cpu_pm_notifier_lock); <-- sleep in idle
> __rt_spin_lock();
> schedule();
>
> The kernel panic is here:
> [ 4.609601] BUG: scheduling while atomic: swapper/1/0/0x00000002
> [ 4.609608] [<ffff0000086fae70>] arm_enter_idle_state+0x18/0x70
> [ 4.609614] Modules linked in:
> [ 4.609615] [<ffff0000086f9298>] cpuidle_enter_state+0xf0/0x218
> [ 4.609620] [<ffff0000086f93f8>] cpuidle_enter+0x18/0x20
> [ 4.609626] Preemption disabled at:
> [ 4.609627] [<ffff0000080fa234>] call_cpuidle+0x24/0x40
> [ 4.609635] [<ffff000008882fa4>] schedule_preempt_disabled+0x1c/0x28
> [ 4.609639] [<ffff0000080fa49c>] cpu_startup_entry+0x154/0x1f8
> [ 4.609645] [<ffff00000808e004>] secondary_start_kernel+0x15c/0x1a0
>
> Daniel Lezcano said this notification is needed on arm/arm64 platforms.
> Sebastian suggested using atomic_notifier instead of rwlock, which is not
> only removing the sleeping in idle, but also getting better latency
> improvement.
>
> This patch passed Fengguang's 0day testing.
>
> Signed-off-by: Alex Shi <alex.shi@...aro.org>
> Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Anders Roxell <anders.roxell@...aro.org>
> Cc: Rik van Riel <riel@...hat.com>
> Cc: Steven Rostedt <rostedt@...dmis.org>
> Cc: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
> Cc: Daniel Lezcano <daniel.lezcano@...aro.org>
> Cc: linux-rt-users <linux-rt-users@...r.kernel.org>
> ---
> kernel/cpu_pm.c | 43 ++++++-------------------------------------
> 1 file changed, 6 insertions(+), 37 deletions(-)
>
> diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c
> index 009cc9a..10f4640 100644
> --- a/kernel/cpu_pm.c
> +++ b/kernel/cpu_pm.c
> @@ -22,14 +22,13 @@
> #include <linux/spinlock.h>
> #include <linux/syscore_ops.h>
>
> -static DEFINE_RWLOCK(cpu_pm_notifier_lock);
> -static RAW_NOTIFIER_HEAD(cpu_pm_notifier_chain);
> +static ATOMIC_NOTIFIER_HEAD(cpu_pm_notifier_chain);
>
> static int cpu_pm_notify(enum cpu_pm_event event, int nr_to_call, int *nr_calls)
> {
> int ret;
>
> - ret = __raw_notifier_call_chain(&cpu_pm_notifier_chain, event, NULL,
> + ret = __atomic_notifier_call_chain(&cpu_pm_notifier_chain, event, NULL,
> nr_to_call, nr_calls);
>
> return notifier_to_errno(ret);
> @@ -47,14 +46,7 @@ static int cpu_pm_notify(enum cpu_pm_event event, int nr_to_call, int *nr_calls)
> */
> int cpu_pm_register_notifier(struct notifier_block *nb)
> {
> - unsigned long flags;
> - int ret;
> -
> - write_lock_irqsave(&cpu_pm_notifier_lock, flags);
> - ret = raw_notifier_chain_register(&cpu_pm_notifier_chain, nb);
> - write_unlock_irqrestore(&cpu_pm_notifier_lock, flags);
> -
> - return ret;
> + return atomic_notifier_chain_register(&cpu_pm_notifier_chain, nb);
> }
> EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
>
> @@ -69,14 +61,7 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
> */
> int cpu_pm_unregister_notifier(struct notifier_block *nb)
> {
> - unsigned long flags;
> - int ret;
> -
> - write_lock_irqsave(&cpu_pm_notifier_lock, flags);
> - ret = raw_notifier_chain_unregister(&cpu_pm_notifier_chain, nb);
> - write_unlock_irqrestore(&cpu_pm_notifier_lock, flags);
> -
> - return ret;
> + return atomic_notifier_chain_unregister(&cpu_pm_notifier_chain, nb);
> }
> EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier);
>
> @@ -100,7 +85,6 @@ int cpu_pm_enter(void)
> int nr_calls;
> int ret = 0;
>
> - read_lock(&cpu_pm_notifier_lock);
> ret = cpu_pm_notify(CPU_PM_ENTER, -1, &nr_calls);
> if (ret)
> /*
> @@ -108,7 +92,6 @@ int cpu_pm_enter(void)
> * PM entry who are notified earlier to prepare for it.
> */
> cpu_pm_notify(CPU_PM_ENTER_FAILED, nr_calls - 1, NULL);
> - read_unlock(&cpu_pm_notifier_lock);
>
> return ret;
> }
> @@ -128,13 +111,7 @@ EXPORT_SYMBOL_GPL(cpu_pm_enter);
> */
> int cpu_pm_exit(void)
> {
> - int ret;
> -
> - read_lock(&cpu_pm_notifier_lock);
> - ret = cpu_pm_notify(CPU_PM_EXIT, -1, NULL);
> - read_unlock(&cpu_pm_notifier_lock);
> -
> - return ret;
> + return cpu_pm_notify(CPU_PM_EXIT, -1, NULL);
> }
> EXPORT_SYMBOL_GPL(cpu_pm_exit);
>
> @@ -159,7 +136,6 @@ int cpu_cluster_pm_enter(void)
> int nr_calls;
> int ret = 0;
>
> - read_lock(&cpu_pm_notifier_lock);
> ret = cpu_pm_notify(CPU_CLUSTER_PM_ENTER, -1, &nr_calls);
> if (ret)
> /*
> @@ -167,7 +143,6 @@ int cpu_cluster_pm_enter(void)
> * PM entry who are notified earlier to prepare for it.
> */
> cpu_pm_notify(CPU_CLUSTER_PM_ENTER_FAILED, nr_calls - 1, NULL);
> - read_unlock(&cpu_pm_notifier_lock);
>
> return ret;
> }
> @@ -190,13 +165,7 @@ EXPORT_SYMBOL_GPL(cpu_cluster_pm_enter);
> */
> int cpu_cluster_pm_exit(void)
> {
> - int ret;
> -
> - read_lock(&cpu_pm_notifier_lock);
> - ret = cpu_pm_notify(CPU_CLUSTER_PM_EXIT, -1, NULL);
> - read_unlock(&cpu_pm_notifier_lock);
> -
> - return ret;
> + return cpu_pm_notify(CPU_CLUSTER_PM_EXIT, -1, NULL);
> }
> EXPORT_SYMBOL_GPL(cpu_cluster_pm_exit);
>
>
Powered by blists - more mailing lists