linux-kernel - Re: [PATCh 0/3] x86,tlb: context switch optimizations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241114113303.GN6497@noisy.programming.kicks-ass.net>
Date: Thu, 14 Nov 2024 12:33:03 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: Rik van Riel <riel@...riel.com>
Cc: Borislav Petkov <bp@...en8.de>, linux-kernel@...r.kernel.org,
	dave.hansen@...ux.intel.com, luto@...nel.org, tglx@...utronix.de,
	mingo@...hat.com, x86@...nel.org, kernel-team@...a.com,
	hpa@...or.com, bigeasy@...utronix.de
Subject: Re: [PATCh 0/3] x86,tlb: context switch optimizations

On Wed, Nov 13, 2024 at 09:38:26AM -0500, Rik van Riel wrote:
> On Wed, 13 Nov 2024 10:55:50 +0100
> Borislav Petkov <bp@...en8.de> wrote:
> On Fri, Nov 08, 2024 at 07:27:47PM -0500, Rik van Riel wrote:
> > > While profiling switch_mm_irqs_off with several workloads,
> > > it appears there are two hot spots that probably don't need
> > > to be there.
> > 
> > One of those three is causing the below here, zapping them from tip.
> > 
> 
> This is interesting, and unexpected.
> 
> > [    3.186469] ------------[ cut here ]------------
> > [    3.186469] WARNING: CPU: 16 PID: 97 at kernel/smp.c:807
> > smp_call_function_many_cond+0x188/0x720
> 
> This is the lockdep_assert_irqs_enabled() from this branch:
> 
>         if (cpu_online(this_cpu) && !oops_in_progress &&
>             !early_boot_irqs_disabled)
>                 lockdep_assert_irqs_enabled();
> 
> > [    3.186469] Call Trace:
> > [    3.186469]  <TASK>
> > [    3.186469]  on_each_cpu_cond_mask+0x50/0x90
> > [    3.186469]  flush_tlb_mm_range+0x1a8/0x1f0
> > [    3.186469]  __text_poke+0x366/0x5d0
> 
> ... and sure enough, it looks like __text_poke() calls
> flush_tlb_mm_range() with IRQs disabled!
> 
> > [    3.186469]  text_poke_bp_batch+0xa1/0x3d0
> > [    3.186469]  text_poke_finish+0x1b/0x30
> > [    3.186469]  arch_jump_label_transform_apply+0x18/0x30
> > [    3.186469]  static_key_slow_inc_cpuslocked+0x55/0xa0
> ...
> 
> I have no good explanation for why that lockdep_assert_irqs_enabled()
> would not be firing without my patches applied.
> 
> We obviously should not be sending out any IPIs with IRQs disabled.
> 
> However, __text_poke has been sending IPIs with interrupts disabled
> for 4 years now! No wonder we see deadlocks involving __text_poke
> on a semi-regular basis.

I don't think we have. Isn't the problem with patch 1, where we
unuse_temporary_mm() now fails to clear the bit, with the direct result
being that flush_tlb_mm_range() now thinks it should be doing IPIs,
where previously it was a strict CPU local affair.