[PATCH] x86-64, espfix: consider IRQs are off when initializing

[PATCH] x86-64, espfix: consider IRQs are off when initializing

[Sasha Levin]

When going through our initialization code (init_espfix_ap() ) we need to
keep in mind IRQs are off, and we need to handle it appropriately:

 - Do not allocate with __GFP_FS.
 - No point in using a mutex.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
 arch/x86/kernel/espfix_64.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
index 6afbb16..3ef78ce 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -64,7 +64,7 @@ DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
 DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
 
 /* Initialization mutex - should this be a spinlock? */
-static DEFINE_MUTEX(espfix_init_mutex);
+static DEFINE_SPINLOCK(espfix_init_mutex);
 
 /* Page allocation bitmap - each page serves ESPFIX_STACKS_PER_PAGE CPUs */
 #define ESPFIX_MAX_PAGES  DIV_ROUND_UP(CONFIG_NR_CPUS, ESPFIX_STACKS_PER_PAGE)
@@ -161,7 +161,7 @@ void init_espfix_ap(void)
 	if (likely(stack_page))
 		goto done;
 
-	mutex_lock(&espfix_init_mutex);
+	spin_lock(&espfix_init_mutex);
 
 	/* Did we race on the lock? */
 	stack_page = ACCESS_ONCE(espfix_pages[page]);
@@ -191,7 +191,7 @@ void init_espfix_ap(void)
 	}
 
 	pte_p = pte_offset_kernel(&pmd, addr);
-	stack_page = (void *)__get_free_page(GFP_KERNEL);
+	stack_page = (void *)__get_free_page(GFP_ATOMIC);
 	pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
 	paravirt_alloc_pte(&init_mm, __pa(stack_page) >> PAGE_SHIFT);
 	for (n = 0; n < ESPFIX_PTE_CLONES; n++)
@@ -201,7 +201,7 @@ void init_espfix_ap(void)
 	ACCESS_ONCE(espfix_pages[page]) = stack_page;
 
 unlock_done:
-	mutex_unlock(&espfix_init_mutex);
+	spin_unlock(&espfix_init_mutex);
 done:
 	this_cpu_write(espfix_stack, addr);
 	this_cpu_write(espfix_waddr, (unsigned long)stack_page
-- 
1.7.10.4

Re: [PATCH] x86-64, espfix: consider IRQs are off when initializing

[H. Peter Anvin]

On 07/17/2014 08:13 AM, Sasha Levin wrote:
> When going through our initialization code (init_espfix_ap() ) we need to
> keep in mind IRQs are off, and we need to handle it appropriately:
> 
>  - Do not allocate with __GFP_FS.
>  - No point in using a mutex.
> 
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

I don't think this is safe.  The whole point was that if we do
GFP_ATOMIC we have to accept failure, and if we have a spin lock then
sleeping is not permitted.  It is unclear to me is sleeping is safe in
this context even so, so we may still have a problem, but calling
__get_free_page(GFP_ATOMIC) and then unconditionally use the results is
not right.

	-hpa

Re: [PATCH] x86-64, espfix: consider IRQs are off when initializing

[Sasha Levin]

On 07/17/2014 11:48 AM, H. Peter Anvin wrote:
> On 07/17/2014 08:13 AM, Sasha Levin wrote:
>> > When going through our initialization code (init_espfix_ap() ) we need to
>> > keep in mind IRQs are off, and we need to handle it appropriately:
>> > 
>> >  - Do not allocate with __GFP_FS.
>> >  - No point in using a mutex.
>> > 
>> > Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
> I don't think this is safe.  The whole point was that if we do
> GFP_ATOMIC we have to accept failure, and if we have a spin lock then
> sleeping is not permitted.  It is unclear to me is sleeping is safe in
> this context even so, so we may still have a problem, but calling
> __get_free_page(GFP_ATOMIC) and then unconditionally use the results is
> not right.

This is the result of getting an error message for allocating with GFP_KERNEL
saying that we can't do that with IRQs off.

My assumption after that was that we're not going to be sleeping at all, which
is why spinlock/GFP_ATOMIC would be correct here.


Thanks,
Sasha

Re: [PATCH] x86-64, espfix: consider IRQs are off when initializing

[H. Peter Anvin]

On 07/17/2014 08:58 AM, Sasha Levin wrote:
> 
> This is the result of getting an error message for allocating with GFP_KERNEL
> saying that we can't do that with IRQs off.
> 
> My assumption after that was that we're not going to be sleeping at all, which
> is why spinlock/GFP_ATOMIC would be correct here.
> 

So we have a problem, but the proposed solution is wrong.  This is
messy... we need this code to be successfully executed before we can
safely schedule *user space* on that processor, but there is no
requirement that we execute it before we enable *interrupts* on that
processor, so maybe there is a way we can fulfill those requirements.

The alternative would be to fail to enable the processor or going into a
spin loop, but either of those would been rather toxic to me.

	-hpa