From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756804AbbBQKtX (ORCPT ); Tue, 17 Feb 2015 05:49:23 -0500 Received: from mx1.redhat.com ([209.132.183.28]:42054 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755146AbbBQKtV (ORCPT ); Tue, 17 Feb 2015 05:49:21 -0500 Date: Tue, 17 Feb 2015 11:47:30 +0100 From: Oleg Nesterov To: Borislav Petkov Cc: riel@redhat.com, dave.hansen@linux.intel.com, sbsiddha@gmail.com, luto@amacapital.net, tglx@linutronix.de, mingo@kernel.org, hpa@zytor.com, fenghua.yu@intel.com, x86@kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 2/8] x86, fpu: unlazy_fpu: don't do __thread_fpu_end() if use_eager_fpu() Message-ID: <20150217104730.GA22233@redhat.com> References: <1423252925-14451-1-git-send-email-riel@redhat.com> <1423252925-14451-3-git-send-email-riel@redhat.com> <20150216202540.GM4458@pd.tnic> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150216202540.GM4458@pd.tnic> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02/16, Borislav Petkov wrote: > > On Fri, Feb 06, 2015 at 03:01:59PM -0500, riel@redhat.com wrote: > > From: Oleg Nesterov > > > > unlazy_fpu()->__thread_fpu_end() doesn't look right if use_eager_fpu(). > > Unconditional __thread_fpu_end() is only correct if we know that this > > thread can't return to user-mode and use FPU. > > > > Fortunately it has only 2 callers. fpu_copy() checks use_eager_fpu(), > > and init_fpu(current) can be only called by the coredumping thread via > > regset->get(). But it is exported to modules, and imo this should be > > fixed anyway. > > > > And if we check use_eager_fpu() we can use __save_fpu() like fpu_copy() > > and save_init_fpu() do. > > > > - It seems that even !use_eager_fpu() case doesn't need the unconditional > > __thread_fpu_end(), we only need it if __save_init_fpu() returns 0. > > I can follow so far. > > > - It is still not clear to me if __save_init_fpu() can safely nest with > > another save + restore from __kernel_fpu_begin(). If not, we can use > > kernel_fpu_disable() to fix the race. > > Well, my primitive understanding would say no, not safely, for the > simple reason that we have only one XSAVE state area per thread. > However, __kernel_fpu_begin() is called with preemption disabled so ... > I guess I'm still not seeing the race. This is not about preemption. But let me first say that I do not know how the FPU hardware actually works, and I do not understand the FPU asm code at all. Let's look at this code if (__thread_has_fpu(tsk)) { __save_init_fpu(tsk); // interrupt -> kernel_fpu_begin() __thread_fpu_end(tsk); } Suppose that kernel_fpu_begin() from interrupt races with __save_init_fpu() in progress. Is this safe? I do not know. My concern is that (I think) __save_init_fpu() can save the FPU state _and_ modify it (say, it can reset some register to default value). This means that the nested __save_init_fpu() from __kernel_fpu_begin() can save the modified register again to current->thread.fpu. If my understanding is wrong, then why switch_fpu_prepare() clears .last_cpu if __save_init_fpu() returns 0 (which iiuc means that CPU's state does not match the saved state) ? Plus I have other (more vague) concerns... > Btw, what is kernel_fpu_disable()? Can't find it here. It's already in Linus's tree, see 14e153ef75eecae8fd0738ffb42120f4962a00cd x86, fpu: Introduce per-cpu in_kernel_fpu state 33a3ebdc077fd85f1bf4d4586eea579b297461ae x86, fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() 7575637ab293861a799f3bbafe0d8c597389f4e9 x86, fpu: Fix math_state_restore() race with kernel_fpu_begin() And, Borislav, thanks for looking at this! Oleg.