From nobody Mon Jul 11 19:59:03 2022 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 9F75512AEB21; Mon, 11 Jul 2022 19:59:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LhZTM6wLsz3h60; Mon, 11 Jul 2022 19:59:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1657569544; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BCPfYYFI+fqPoVmL+NkYj5xDkBG78KyUVtAzlXl5pjY=; b=HiS7B55yg+AHpQxRk4gwvqEA8nbbTtKh9ERkqRm3tK24yjWw6GRDNil6oSiPXz+SHIQY77 b7EyLPrIMfjSaPgoE8Wqbey0SQ9xkRO4mn1iEcc0OvZ9PbdohGgk9zqVZLiainQcHmMiGk oHjs3Au024or+NRy9aQshzj8EbudGUioLSVTS14jdnOq0qkljFceC7o51aI61r29g0cWrx 36JfjxeDbQ1133sVQGDvDbsFICYvlFxIZXHUxm9Pr0laHb+XsNgcfiME91gDhscFx7sDGO 1hZ94zj30jPIPodnjOtOrMc63iVaZiQ4tEOH47GQM2jGW94GtB0NR+As9AVUzA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4LhZTM62RszGJJ; Mon, 11 Jul 2022 19:59:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 26BJx36r003287; Mon, 11 Jul 2022 19:59:03 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 26BJx3SA003286; Mon, 11 Jul 2022 19:59:03 GMT (envelope-from git) Date: Mon, 11 Jul 2022 19:59:03 GMT Message-Id: <202207111959.26BJx3SA003286@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: a889a65ba369 - main - eventtimer: Fix several races in the timer reload code List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: a889a65ba36985dfb31111ac1607be35ca2b2c8c Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1657569544; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BCPfYYFI+fqPoVmL+NkYj5xDkBG78KyUVtAzlXl5pjY=; b=RuT19q/ONsih1GjOpzjCCSWgj+HiyRtUkak6ZNBY3pbgy3ChTJ8IY85yohwiba4Df6rS3W /xZ5x5pJZ2hx/F5vh9Kkg575U7Xh0I9juh0Yaa8F2u20/wweP70EiCA4w61mARbYgsi873 4OCVAeH/j6J1VQF8ZltP2mirjppnPotsnGrEljVh4683XqB63RTdAgOZcxhl13IE9f+kWN ZvGrf4fBySUvk8GRYE5f6ioyAEW9eyPwwBiNaOU0Ct58CFAFIp7UvjmYEc7NYqntdb92H8 N++jBi44P/kqvoufrxzwwW93D1qflbCnct8Rie7RDdUdaxnJ/NaL+cezJXUpgg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1657569544; a=rsa-sha256; cv=none; b=R92Jg23qDOgciQc5BR3S5vm2yyqq6t0gJNkozCcUgJ1nza/3H9uYQ4ZMKy8marw+yPDvsw 6ur2rMkznnqPxpi0PPkTnjPonDuECkJ0VLt7ECZ1pbR9aTFm8RIdHgh/Q/ycibotjHy9Cz HA1Gq4rG0P/2S78b1GlDQ99JCbhWUYUc4euDv0G5wrMalYaCrDYNB1Wvw0g0842CcXD7A/ yph/MBtaC+mtxxVycZWHH7bB3K9G7Doc9QTBnM+DvTHh2XX5ecbxvfp0RhJ4VnUGZRoUkN 6GdPENY5Dq3oJXD161zGIZw/DdXylXbGgDe9XgEKMPy4S+AgfiCoTbAc+qDtzg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=a889a65ba36985dfb31111ac1607be35ca2b2c8c commit a889a65ba36985dfb31111ac1607be35ca2b2c8c Author: Mark Johnston AuthorDate: 2022-06-30 18:27:07 +0000 Commit: Mark Johnston CommitDate: 2022-07-11 19:58:43 +0000 eventtimer: Fix several races in the timer reload code In handleevents(), lock the timer state before fetching the time for the next event. A concurrent callout_cc_add() call might be changing the next event time, and the race can cause handleevents() to program an out-of-date time, causing the callout to run later (by an unbounded period, up to the idle hardclock period of 1s) than requested. In cpu_idleclock(), call getnextcpuevent() with the timer state mutex held, for similar reasons. In particular, cpu_idleclock() runs with interrupts enabled, so an untimely timer interrupt can result in a stale next event time being programmed. Further, an interrupt can cause cpu_idleclock() to use a stale value for "now". In cpu_activeclock(), disable interrupts before loading "now", so as to avoid going backwards in time when calling handleevents(). It's ok to leave interrupts enabled when checking "state->idle", since the race at worst will cause handleevents() to be called unnecessarily. But use an atomic load to indicate that the test is racy. PR: 264867 Reviewed by: mav, jhb, kib MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D35735 --- sys/kern/kern_clocksource.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/sys/kern/kern_clocksource.c b/sys/kern/kern_clocksource.c index 9d53d1242482..89d19bca9317 100644 --- a/sys/kern/kern_clocksource.c +++ b/sys/kern/kern_clocksource.c @@ -214,8 +214,8 @@ handleevents(sbintime_t now, int fake) callout_process(now); } - t = getnextcpuevent(state, 0); ET_HW_LOCK(state); + t = getnextcpuevent(state, 0); if (!busy) { state->idle = 0; state->nextevent = t; @@ -678,14 +678,12 @@ cpu_initclocks_bsp(void) void cpu_initclocks_ap(void) { - sbintime_t now; struct pcpu_state *state; struct thread *td; state = DPCPU_PTR(timerstate); - now = sbinuptime(); ET_HW_LOCK(state); - state->now = now; + state->now = sbinuptime(); hardclock_sync(curcpu); spinlock_enter(); ET_HW_UNLOCK(state); @@ -769,6 +767,7 @@ cpu_idleclock(void) ) return (-1); state = DPCPU_PTR(timerstate); + ET_HW_LOCK(state); if (periodic) now = state->now; else @@ -776,7 +775,6 @@ cpu_idleclock(void) CTR3(KTR_SPARE2, "idle at %d: now %d.%08x", curcpu, (int)(now >> 32), (u_int)(now & 0xffffffff)); t = getnextcpuevent(state, 1); - ET_HW_LOCK(state); state->idle = 1; state->nextevent = t; if (!periodic) @@ -796,15 +794,15 @@ cpu_activeclock(void) struct thread *td; state = DPCPU_PTR(timerstate); - if (state->idle == 0 || busy) + if (atomic_load_int(&state->idle) == 0 || busy) return; + spinlock_enter(); if (periodic) now = state->now; else now = sbinuptime(); CTR3(KTR_SPARE2, "active at %d: now %d.%08x", curcpu, (int)(now >> 32), (u_int)(now & 0xffffffff)); - spinlock_enter(); td = curthread; td->td_intr_nesting_level++; handleevents(now, 1);