On Sat, Nov 22, 2014 at 9:20 AM, Borislav Petkov <b...@alien8.de> wrote: > On Fri, Nov 21, 2014 at 01:26:08PM -0800, Andy Lutomirski wrote: >> We currently pretend that IST context is like standard exception >> context, but this is incorrect. IST entries from userspace are like >> standard exceptions except that they use per-cpu stacks, so they are >> atomic. IST entries from kernel space are like NMIs from RCU's >> perspective -- they are not quiescent states even if they >> interrupted the kernel during a quiescent state. >> >> Add and use ist_enter and ist_exit to track IST context. Even >> though x86_32 has no IST stacks, we track these interrupts the same >> way. >> >> This fixes two issues: >> >> - Scheduling from an IST interrupt handler will now warn. It would >> previously appear to work as long as we got lucky and nothing >> overwrote the stack frame. (I don't know of any bugs in this >> that would trigger the warning, but it's good to be on the safe >> side.) >> >> - RCU handling in IST context was dangerous. As far as I know, >> only machine checks were likely to trigger this, but it's good to >> be on the safe side. >> >> Note that the machine check handlers appears to have been missing >> any context tracking at all before this patch. >> >> Cc: "Paul E. McKenney" <paul...@linux.vnet.ibm.com> >> Cc: Josh Triplett <j...@joshtriplett.org> >> Cc: Frédéric Weisbecker <fweis...@gmail.com> >> Signed-off-by: Andy Lutomirski <l...@amacapital.net> >> --- >> arch/x86/include/asm/traps.h | 4 +++ >> arch/x86/kernel/cpu/mcheck/mce.c | 5 ++++ >> arch/x86/kernel/cpu/mcheck/p5.c | 6 +++++ >> arch/x86/kernel/cpu/mcheck/winchip.c | 5 ++++ >> arch/x86/kernel/traps.c | 49 >> ++++++++++++++++++++++++++++++------ >> 5 files changed, 61 insertions(+), 8 deletions(-) > > ... > >> diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c >> index 0d0e922fafc1..f5c4b8813774 100644 >> --- a/arch/x86/kernel/traps.c >> +++ b/arch/x86/kernel/traps.c >> @@ -107,6 +107,39 @@ static inline void preempt_conditional_cli(struct >> pt_regs *regs) >> preempt_count_dec(); >> } >> >> +enum ctx_state ist_enter(struct pt_regs *regs) >> +{ >> + /* >> + * We are atomic because we're on the IST stack (or we're on x86_32, >> + * in which case we still shouldn't schedule. >> + */ >> + preempt_count_add(HARDIRQ_OFFSET); >> + >> + if (user_mode_vm(regs)) { >> + /* Other than that, we're just an exception. */ >> + return exception_enter(); >> + } else { >> + /* >> + * We might have interrupted pretty much anything. In >> + * fact, if we're a machine check, we can even interrupt >> + * NMI processing. We don't want in_nmi() to return true, >> + * but we need to notify RCU. >> + */ >> + rcu_nmi_enter(); >> + return IN_KERNEL; /* the value is irrelevant. */ >> + } > > I guess dropping the explicit else-branch could make it look a bit nicer > with the curly braces gone and all... > > enum ctx_state ist_enter(struct pt_regs *regs) > { > /* > * We are atomic because we're on the IST stack (or we're on x86_32, > * in which case we still shouldn't schedule. > */ > preempt_count_add(HARDIRQ_OFFSET); > > if (user_mode_vm(regs)) > /* Other than that, we're just an exception. */ > return exception_enter(); >
Two indented lines w/o curly braces makes me think of goto fail; :-/ TBH, when there are clearly two options, I tend to prefer the braces that make it very obvious what's going on. I had some memorable bugs several years ago that would have been impossible if I has used braces more liberally. --Andy > /* > * We might have interrupted pretty much anything. In fact, if we're > a > * machine check, we can even interrupt NMI processing. We don't want > * in_nmi() to return true, but we need to notify RCU. > */ > rcu_nmi_enter(); > return IN_KERNEL; /* the value is irrelevant. */ > } > >> +} >> + >> +void ist_exit(struct pt_regs *regs, enum ctx_state prev_state) >> +{ >> + preempt_count_sub(HARDIRQ_OFFSET); >> + >> + if (user_mode_vm(regs)) >> + return exception_exit(prev_state); >> + else >> + rcu_nmi_exit(); >> +} > > Ditto here. > >> + >> static nokprobe_inline int >> do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str, >> struct pt_regs *regs, long error_code) > > -- > Regards/Gruss, > Boris. > > Sent from a fat crate under my desk. Formatting is fine. > -- -- Andy Lutomirski AMA Capital Management, LLC -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/