On Tue, Mar 16, 2021 at 04:27:56PM +0100, Peter Zijlstra wrote:
> On Thu, Mar 11, 2021 at 01:37:04PM +0100, Frederic Weisbecker wrote:
> > Enqueuing a local timer after the tick has been stopped will result in
> > the timer being ignored until the next random interrupt.
> >
> > Perform sanity checks to report these situations.
> >
> > Reviewed-by: Rafael J. Wysocki <rafael.j.wyso...@intel.com>
> > Signed-off-by: Frederic Weisbecker <frede...@kernel.org>
> > Cc: Peter Zijlstra <pet...@infradead.org>
> > Cc: Thomas Gleixner <t...@linutronix.de>
> > Cc: Ingo Molnar <mi...@kernel.org>
> > Cc: Paul E. McKenney <paul...@kernel.org>
> > ---
> > kernel/sched/core.c | 20 +++++++++++++++++++-
> > 1 file changed, 19 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> > index ca2bb629595f..24552911f92b 100644
> > --- a/kernel/sched/core.c
> > +++ b/kernel/sched/core.c
> > @@ -674,6 +674,22 @@ int get_nohz_timer_target(void)
> > return cpu;
> > }
> >
> > +/* Make sure the timer won't be ignored in dynticks-idle case */
> > +static void wake_idle_assert_possible(void)
> > +{
> > +#ifdef CONFIG_SCHED_DEBUG
> > + /*
> > + * Timers are re-evaluated after idle IRQs. In case of softirq,
> > + * we assume IRQ tail. Ksoftirqd shouldn't reach here as the
> > + * timer base wouldn't be idle. And inline softirq processing
> > + * after a call to local_bh_enable() within idle loop sound too
> > + * fun to be considered here.
> > + */
> > + WARN_ONCE(in_task(),
> > + "Late timer enqueue may be ignored\n");
> > +#endif
> > +}
> > +
> > /*
> > * When add_timer_on() enqueues a timer into the timer wheel of an
> > * idle CPU then this timer might expire before the next timer event
> > @@ -688,8 +704,10 @@ static void wake_up_idle_cpu(int cpu)
> > {
> > struct rq *rq = cpu_rq(cpu);
> >
> > - if (cpu == smp_processor_id())
> > + if (cpu == smp_processor_id()) {
> > + wake_idle_assert_possible();
> > return;
> > + }
> >
> > if (set_nr_and_not_polling(rq->idle))
> > smp_send_reschedule(cpu);
>
> I'm not entirely sure I understand this one. What's the callchain that
> leads to this?
That's while calling add_timer*() or mod_timer() on an idle target.
Now the issue is only relevant when these timer functions are called
after cpuidle_select(), which arguably makes a small vulnerable window
that could be spotted in the future if the timer functions are called
after instrumentation_end()?
Thanks.
