Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1600640 > unrolled thread

Re: perf: race with automatic rdpmc() disabling

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: perf: race with automatic rdpmc() disabling Andy Lutomirski <luto@amacapital.net> - 2017-03-14 17:00 +0100
    Re: perf: race with automatic rdpmc() disabling Vince Weaver <vincent.weaver@maine.edu> - 2017-03-14 17:50 +0100
      Re: perf: race with automatic rdpmc() disabling Andy Lutomirski <luto@amacapital.net> - 2017-03-15 21:20 +0100
        Re: perf: race with automatic rdpmc() disabling Vince Weaver <vincent.weaver@maine.edu> - 2017-03-16 06:50 +0100

#1600640 — Re: perf: race with automatic rdpmc() disabling

On Mon, Mar 13, 2017 at 2:05 PM, Andy Lutomirski <luto@kernel.org> wrote:
> On Mon, Mar 13, 2017 at 9:55 AM, Peter Zijlstra <peterz@infradead.org> wrote:
>> On Mon, Mar 13, 2017 at 09:44:02AM -0700, Andy Lutomirski wrote:
>>> static void x86_pmu_event_mapped(struct perf_event *event)
>>> {
>>>     if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
>>>         return;
>>>
>>>     if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
>>>
>>> <-- thread 1 stalls here
>>>
>>>         on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
>>> }
>>>
>>> Suppose you start with perf_rdpmc_allowed == 0.  Thread 1 runs
>>> x86_pmu_event_mapped and gets preempted (or just runs slowly) where I
>>> marked.  Then thread 2 runs the whole function, does *not* update CR4,
>>> returns to userspace, and GPFs.
>>>
>>> The big hammer solution is to stick a per-mm mutex around it.  Let me
>>> ponder whether a smaller hammer is available.
>>
>> Reminds me a bit of what we ended up with in kernel/jump_label.c:static_key_slow_inc().
>>
>>
>
> One thing I don't get: isn't mmap_sem held for write the whole time?

mmap_sem is indeed held, so my theory is wrong.  I can reproduce it,
but I don't see the bug yet...

--Andy

-- 
Andy Lutomirski
AMA Capital Management, LLC

[toc] | [next] | [standalone]

#1600685

On Tue, 14 Mar 2017, Andy Lutomirski wrote:

> On Mon, Mar 13, 2017 at 2:05 PM, Andy Lutomirski <luto@kernel.org> wrote:
> > On Mon, Mar 13, 2017 at 9:55 AM, Peter Zijlstra <peterz@infradead.org> wrote:
> >> On Mon, Mar 13, 2017 at 09:44:02AM -0700, Andy Lutomirski wrote:
> >>> static void x86_pmu_event_mapped(struct perf_event *event)
> >>> {
> >>>     if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
> >>>         return;
> >>>
> >>>     if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
> >>>
> >>> <-- thread 1 stalls here
> >>>
> >>>         on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
> >>> }
> >>>
> >>> Suppose you start with perf_rdpmc_allowed == 0.  Thread 1 runs
> >>> x86_pmu_event_mapped and gets preempted (or just runs slowly) where I
> >>> marked.  Then thread 2 runs the whole function, does *not* update CR4,
> >>> returns to userspace, and GPFs.
> >>>
> >>> The big hammer solution is to stick a per-mm mutex around it.  Let me
> >>> ponder whether a smaller hammer is available.
> >>
> >> Reminds me a bit of what we ended up with in kernel/jump_label.c:static_key_slow_inc().
> >>
> >>
> >
> > One thing I don't get: isn't mmap_sem held for write the whole time?
> 
> mmap_sem is indeed held, so my theory is wrong.  I can reproduce it,
> but I don't see the bug yet...

It could still be a PAPI bug, as I'm having absolutely no luck trying to 
come up with a plain perf_event reproducer.

Let me dig through the PAPI code again and make sure I'm not missing 
something.

Vince

[toc] | [prev] | [next] | [standalone]

#1601707

On Tue, Mar 14, 2017 at 9:45 AM, Vince Weaver <vincent.weaver@maine.edu> wrote:
> On Tue, 14 Mar 2017, Andy Lutomirski wrote:
>
>> On Mon, Mar 13, 2017 at 2:05 PM, Andy Lutomirski <luto@kernel.org> wrote:
>> > On Mon, Mar 13, 2017 at 9:55 AM, Peter Zijlstra <peterz@infradead.org> wrote:
>> >> On Mon, Mar 13, 2017 at 09:44:02AM -0700, Andy Lutomirski wrote:
>> >>> static void x86_pmu_event_mapped(struct perf_event *event)
>> >>> {
>> >>>     if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
>> >>>         return;
>> >>>
>> >>>     if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
>> >>>
>> >>> <-- thread 1 stalls here
>> >>>
>> >>>         on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
>> >>> }
>> >>>
>> >>> Suppose you start with perf_rdpmc_allowed == 0.  Thread 1 runs
>> >>> x86_pmu_event_mapped and gets preempted (or just runs slowly) where I
>> >>> marked.  Then thread 2 runs the whole function, does *not* update CR4,
>> >>> returns to userspace, and GPFs.
>> >>>
>> >>> The big hammer solution is to stick a per-mm mutex around it.  Let me
>> >>> ponder whether a smaller hammer is available.
>> >>
>> >> Reminds me a bit of what we ended up with in kernel/jump_label.c:static_key_slow_inc().
>> >>
>> >>
>> >
>> > One thing I don't get: isn't mmap_sem held for write the whole time?
>>
>> mmap_sem is indeed held, so my theory is wrong.  I can reproduce it,
>> but I don't see the bug yet...
>
> It could still be a PAPI bug, as I'm having absolutely no luck trying to
> come up with a plain perf_event reproducer.
>
> Let me dig through the PAPI code again and make sure I'm not missing
> something.

Can you give this a try:

https://git.kernel.org/pub/scm/linux/kernel/git/luto/linux.git/commit/?h=x86/fixes&id=9edb8154863ba1a7f6f1f15ffe6aecf3cf32bf21

(The link doesn't work yet but it should in a minute or two.)

--Andy

[toc] | [prev] | [next] | [standalone]

#1601956

On Wed, 15 Mar 2017, Andy Lutomirski wrote:

> Can you give this a try:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/luto/linux.git/commit/?h=x86/fixes&id=9edb8154863ba1a7f6f1f15ffe6aecf3cf32bf21
> 
> (The link doesn't work yet but it should in a minute or two.)

I've tested it and I am unable to reproduce the problem with the patch 
applied.

Vince

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web