Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1599399 > unrolled thread

perf: race with automatic rdpmc() disabling

Back to article view | Back to linux.kernel

Contents

  perf: race with automatic rdpmc() disabling Vince Weaver <vincent.weaver@maine.edu> - 2017-03-13 15:00 +0100
    Re: perf: race with automatic rdpmc() disabling Andy Lutomirski <luto@kernel.org> - 2017-03-13 17:50 +0100
      Re: perf: race with automatic rdpmc() disabling Peter Zijlstra <peterz@infradead.org> - 2017-03-13 18:00 +0100
        Re: perf: race with automatic rdpmc() disabling Andy Lutomirski <luto@kernel.org> - 2017-03-13 22:10 +0100

#1599399 — perf: race with automatic rdpmc() disabling

Hello

I've been trying to track this issue down for a few days and haven't been 
able to isolate it.  So maybe someone who understands low-level perf mmap
reference counting can help here.

As you might recall, 7911d3f7af14a614617e38245fedf98a724e46a9
introduced automatic disabling of userspace rdpmc when no perf_events 
were running.

I've run into a problem with PAPI when using rdpmc.  If you have PAPI
measuring events in multiple pthread threads, sometimes (but not always)
the program will GPF because CR4/rdpmc gets turned off while events are 
still active.

I've been trying to put together a reproducible test case but haven't been 
able to manage.  I have a PAPI test that will show the problem about 
50% of the time but I can't seem to isolate the problem.

Any ideas?

If you really want to try to reproduce it, get the current git version of 
PAPI
	git clone https://bitbucket.org/icl/papi.git
edit src/components/perf_event/perf_event.c 
	so that #define PERF_USE_RDPMC 1
in src run ./configure , make
then run the ./ctests/zero_pthreads test a few times.  It will GPF and I'm
relatively (though not entirely) sure it's not a PAPI issue.  
The problem does go away if you set /sys/devices/cpu/rdpmc to 2

Vince

[toc] | [next] | [standalone]

#1599593

On Mon, Mar 13, 2017 at 6:58 AM, Vince Weaver <vincent.weaver@maine.edu> wrote:
> Hello
>
> I've been trying to track this issue down for a few days and haven't been
> able to isolate it.  So maybe someone who understands low-level perf mmap
> reference counting can help here.
>
> As you might recall, 7911d3f7af14a614617e38245fedf98a724e46a9
> introduced automatic disabling of userspace rdpmc when no perf_events
> were running.
>
> I've run into a problem with PAPI when using rdpmc.  If you have PAPI
> measuring events in multiple pthread threads, sometimes (but not always)
> the program will GPF because CR4/rdpmc gets turned off while events are
> still active.
>
> I've been trying to put together a reproducible test case but haven't been
> able to manage.  I have a PAPI test that will show the problem about
> 50% of the time but I can't seem to isolate the problem.
>
> Any ideas?
>
> If you really want to try to reproduce it, get the current git version of
> PAPI
>         git clone https://bitbucket.org/icl/papi.git
> edit src/components/perf_event/perf_event.c
>         so that #define PERF_USE_RDPMC 1
> in src run ./configure , make
> then run the ./ctests/zero_pthreads test a few times.  It will GPF and I'm
> relatively (though not entirely) sure it's not a PAPI issue.
> The problem does go away if you set /sys/devices/cpu/rdpmc to 2

Hmm

static void x86_pmu_event_mapped(struct perf_event *event)
{
    if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
        return;

    if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)

<-- thread 1 stalls here

        on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
}

Suppose you start with perf_rdpmc_allowed == 0.  Thread 1 runs
x86_pmu_event_mapped and gets preempted (or just runs slowly) where I
marked.  Then thread 2 runs the whole function, does *not* update CR4,
returns to userspace, and GPFs.

The big hammer solution is to stick a per-mm mutex around it.  Let me
ponder whether a smaller hammer is available.

[toc] | [prev] | [next] | [standalone]

#1599610

On Mon, Mar 13, 2017 at 09:44:02AM -0700, Andy Lutomirski wrote:
> static void x86_pmu_event_mapped(struct perf_event *event)
> {
>     if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
>         return;
> 
>     if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
> 
> <-- thread 1 stalls here
> 
>         on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
> }
> 
> Suppose you start with perf_rdpmc_allowed == 0.  Thread 1 runs
> x86_pmu_event_mapped and gets preempted (or just runs slowly) where I
> marked.  Then thread 2 runs the whole function, does *not* update CR4,
> returns to userspace, and GPFs.
> 
> The big hammer solution is to stick a per-mm mutex around it.  Let me
> ponder whether a smaller hammer is available.

Reminds me a bit of what we ended up with in kernel/jump_label.c:static_key_slow_inc().

[toc] | [prev] | [next] | [standalone]

#1599823

On Mon, Mar 13, 2017 at 9:55 AM, Peter Zijlstra <peterz@infradead.org> wrote:
> On Mon, Mar 13, 2017 at 09:44:02AM -0700, Andy Lutomirski wrote:
>> static void x86_pmu_event_mapped(struct perf_event *event)
>> {
>>     if (!(event->hw.flags & PERF_X86_EVENT_RDPMC_ALLOWED))
>>         return;
>>
>>     if (atomic_inc_return(&current->mm->context.perf_rdpmc_allowed) == 1)
>>
>> <-- thread 1 stalls here
>>
>>         on_each_cpu_mask(mm_cpumask(current->mm), refresh_pce, NULL, 1);
>> }
>>
>> Suppose you start with perf_rdpmc_allowed == 0.  Thread 1 runs
>> x86_pmu_event_mapped and gets preempted (or just runs slowly) where I
>> marked.  Then thread 2 runs the whole function, does *not* update CR4,
>> returns to userspace, and GPFs.
>>
>> The big hammer solution is to stick a per-mm mutex around it.  Let me
>> ponder whether a smaller hammer is available.
>
> Reminds me a bit of what we ended up with in kernel/jump_label.c:static_key_slow_inc().
>
>

One thing I don't get: isn't mmap_sem held for write the whole time?

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web