[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Z-KS7H6666PZ3eKv@gmail.com>
Date: Tue, 25 Mar 2025 12:26:36 +0100
From: Ingo Molnar <mingo@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>
Cc: Eric Dumazet <edumazet@...gle.com>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
Dave Hansen <dave.hansen@...ux.intel.com>,
"H . Peter Anvin" <hpa@...or.com>,
Steven Rostedt <rostedt@...dmis.org>,
linux-kernel <linux-kernel@...r.kernel.org>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Masami Hiramatsu <mhiramat@...nel.org>, x86@...nel.org,
bpf@...r.kernel.org, Eric Dumazet <eric.dumazet@...il.com>,
Greg Thelen <gthelen@...gle.com>,
Stephane Eranian <eranian@...gle.com>
Subject: Re: [PATCH] x86/alternatives: remove false sharing in
poke_int3_handler()
* Peter Zijlstra <peterz@...radead.org> wrote:
> On Tue, Mar 25, 2025 at 09:41:10AM +0100, Ingo Molnar wrote:
> >
> > * Peter Zijlstra <peterz@...radead.org> wrote:
> >
> > > On Mon, Mar 24, 2025 at 08:53:31AM +0100, Eric Dumazet wrote:
> > >
> > > > BTW the atomic_cond_read_acquire() part is never called even during my
> > > > stress test.
> > >
> > > Yes, IIRC this is due to text_poke_sync() serializing the state, as that
> > > does a synchronous IPI broadcast, which by necessity requires all
> > > previous INT3 handlers to complete.
> > >
> > > You can only hit that case if the INT3 remains after step-3 (IOW you're
> > > actively writing INT3 into the text). This is exceedingly rare.
> >
> > Might make sense to add a comment for that.
>
> Sure, find below.
>
> > Also, any strong objections against doing this in the namespace:
> >
> > s/bp_/int3_
> >
> > ?
> >
> > Half of the code already calls it a variant of 'int3', half of it 'bp',
> > which I had to think for a couple of seconds goes for breakpoint, not
> > base pointer ... ;-)
>
> It actually is breakpoint, as in INT3 raises #BP. For complete confusion
> the things that are commonly known as debug breakpoints, those things in
> DR7, they raise #DB or debug exceptions.
Yeah, it's a software breakpoint, swbp, that raises the #BP trap.
'bp' is confusingly aliased (in my brain at least) with 'base pointer'
register naming and assembler syntax: as in bp, ebp, rbp.
So I'd prefer if it was named consistently:
text_poke_int3_batch()
text_poke_int3_handler()
...
Not the current mishmash of:
text_poke_bp_batch()
poke_int3_handler()
...
Does this make more sense?
> > Might as well standardize on int3_ and call it a day?
>
> Yeah, perhaps. At some point you've got to know that INT3->#BP and
> DR7->#DB and it all sorta makes sense, but *shrug* :-)
Yeah, so I do know what #BP is, but what the heck disambiguates the two
meanings of _bp and why do we have the above jungle of an inconsistent
namespace? :-)
Picking _int3 would neatly solve all of that.
> diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
> index bf82c6f7d690..01e94603e767 100644
> --- a/arch/x86/kernel/alternative.c
> +++ b/arch/x86/kernel/alternative.c
> @@ -2749,6 +2749,13 @@ static void text_poke_bp_batch(struct text_poke_loc *tp, unsigned int nr_entries
>
> /*
> * Remove and wait for refs to be zero.
> + *
> + * Notably, if after step-3 above the INT3 got removed, then the
> + * text_poke_sync() will have serialized against any running INT3
> + * handlers and the below spin-wait will not happen.
> + *
> + * IOW. unless the replacement instruction is INT3, this case goes
> + * unused.
> */
> if (!atomic_dec_and_test(&bp_desc.refs))
> atomic_cond_read_acquire(&bp_desc.refs, !VAL);
Thanks! I stuck this into tip:x86/alternatives, with your SOB.
Ingo
Powered by blists - more mailing lists