linux-kernel - Re: [patch V2 0/4] sched/mmcid: Cure mode transition woes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87v7gc230j.ffs@tglx>
Date: Wed, 04 Feb 2026 11:53:48 +0100
From: Thomas Gleixner <tglx@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>, Mathieu Desnoyers
 <mathieu.desnoyers@...icios.com>
Cc: LKML <linux-kernel@...r.kernel.org>, Ihor Solodrai
 <ihor.solodrai@...ux.dev>, Shrikanth Hegde <sshegde@...ux.ibm.com>,
 Michael Jeanson <mjeanson@...icios.com>
Subject: Re: [patch V2 0/4] sched/mmcid: Cure mode transition woes

On Mon, Feb 02 2026 at 13:54, Peter Zijlstra wrote:
> On Mon, Feb 02, 2026 at 06:46:34AM -0500, Mathieu Desnoyers wrote:
>> On 2026-02-02 05:14, Peter Zijlstra wrote:
>> > On Mon, Feb 02, 2026 at 10:39:35AM +0100, Thomas Gleixner wrote:
>> > 
>> > > --- a/kernel/sched/core.c
>> > > +++ b/kernel/sched/core.c
>> > > @@ -10445,6 +10445,12 @@ static bool mm_update_max_cids(struct mm
>> > >   	/* Flip the mode and set the transition flag to bridge the transfer */
>> > >   	WRITE_ONCE(mc->mode, mc->mode ^ (MM_CID_TRANSIT | MM_CID_ONCPU));
>> > > +	/*
>> > > +	 * Order the store against the subsequent fixups so that
>> > > +	 * acquire(rq::lock) cannot be reordered by the CPU before the
>> > > +	 * store.
>> > > +	 */
>> > > +	smp_mb();
>> > >   	return true;
>> > >   }
>> > > @@ -10487,6 +10493,16 @@ static inline void mm_update_cpus_allowe
>> > >   	irq_work_queue(&mc->irq_work);
>> > >   }
>> > > +static inline void mm_cid_complete_transit(struct mm_struct *mm, unsigned int mode)
>> > > +{
>> > > +	/*
>> > > +	 * Ensure that the store removing the TRANSIT bit cannot be
>> > > +	 * reordered by the CPU before the fixups have been completed.
>> > > +	 */
>> > > +	smp_mb();
>> > > +	WRITE_ONCE(mm->mm_cid.mode, mode);
>> > > +}
>> > 
>> > I think this could've been smp_store_release(), but this is the slow
>> > path so nobody cares and this is nicely symmetric.
>> 
>> I'm not sure the store-release would work here. What load-acquire
>> would it pair with ?
>
> The purpose here -- per the comment is to ensure the fixup stuff is
> visible before the TRANSIT bit goes 0, store-release ensures that.
>
> That pairs with whatever cares about this barrier now.

I thought about this and stopped reading memory-barriers.txt after brain
started to hurt.

        acquire A
        store   B
        release A

        acquire C
        store   D
        release C

A and C are independent of each other as are B and D. So according to
the docs acquire C can be reordered before release A. So far so
good. But what's unclear to me is whether this scenarion is possible:

        acquire A
        acquire C
        store   D
        release C
        store   B
        release A

because that would screw up stuff badly.

Thanks,

        tglx