Received-SPF: pass (google.com: domain of linux-kernel+bounces-195884-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Message-ID: <0494aedf-9759-4427-a7f3-39a91bd5771d@oracle.com>
Date: Thu, 30 May 2024 16:26:43 -0400
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] perf/x86/amd: check event before enable to avoid GPF
Content-Language: en-US
From: George Kennedy <george.kennedy@oracle.com>
To: Ravi Bangoria <ravi.bangoria@amd.com>
Cc: harshit.m.mogalapalli@oracle.com, peterz@infradead.org, mingo@redhat.com,
        acme@kernel.org, namhyung@kernel.org, mark.rutland@arm.com,
        alexander.shishkin@linux.intel.com, jolsa@kernel.org,
        irogers@google.com, adrian.hunter@intel.com, kan.liang@linux.intel.com,
        tglx@linutronix.de, bp@alien8.de, dave.hansen@linux.intel.com,
        x86@kernel.org, hpa@zytor.com, linux-perf-users@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <1716990659-2427-1-git-send-email-george.kennedy@oracle.com>
 <75f6aba1-8ed6-4ef8-8811-de40ae40be90@amd.com>
 <1e14ca4b-6e3e-4d57-acec-bc3ee2bed6ed@oracle.com>
Organization: Oracle Corporation
In-Reply-To: <1e14ca4b-6e3e-4d57-acec-bc3ee2bed6ed@oracle.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?VEQrbStrNEpFNGRpdnRYSHRNM1llSjNua2JVTFoxVHdqdkhQcFJhT01qVXBv?=
 =?utf-8?B?eFJENnhwSk04S0dIdWJFazlyMHpSbHVnMXdOdHpNZ2l2UFVCVXluWUdwMnRK?=
 =?utf-8?B?VEFRcGFQc1MrcW1CMy96dHd6WVBsUCtVQndiWDl4d2plQkdqcXVjYkZzU2pt?=
 =?utf-8?B?MmdtOE9GYjJUM3hjRnAvdkI4dS9FcnBDNzNFQXppWWdia1hEOWhmNHVDMmsx?=
 =?utf-8?B?SWtsTXIrb0syMkJUaGRYT2FWTFNmRWZOYVE1VmVkdEx4QmNpVFJXM04rZzdV?=
 =?utf-8?B?eDd3VVJWN2JvUEFZblJTVDZZNTdLNit1amZUZ1hBekRHVmZWWlFTT3hSUys0?=
 =?utf-8?B?aFFNSGFsNFl3dXVaOVUwbnBKeXBrTU1JR25rWG16bWd3b3Q1c0ZLaXBZMG51?=
 =?utf-8?B?NVIxRTNHR1dWM1dCcnB3TVhERU1JS05HTjFMR2xKY3V0bTVkNWphNVFYbmta?=
 =?utf-8?B?bWhEWndWMWNaN0pkZ0Y2TWF5dCtrenhBL1VodXpNMjV0RjBQeFB4MDhiZ21r?=
 =?utf-8?B?Nm1NZlVUd2ZudGk5SDNoVTFGZ0NiZTQvR0JncHJxaWIrRXhkVHluMzFTZ1lK?=
 =?utf-8?B?NjdoRmJBdnNFOGZ3VnJmYnRXWndqTXU5emo4LzBOMDNYSWdTaGZ6Z0R3dVcv?=
 =?utf-8?B?VzBQUGI3cytTdDBwYXQzeFRmTVNVaUJ4eDdDMnFWUVdlTmNsQnBlVno1N3hp?=
 =?utf-8?B?MjlUY2c5Y0ZyNnA5SUhjS055Q3E2T01UUHB0ZDNmNVV5anlpbjZwcktZc1Vw?=
 =?utf-8?B?RmRSRkxRbXMyR1pMN0FtSlJXZmRJSmlXRUJGRFpXYXVtanVLR3NreVBZeE92?=
 =?utf-8?B?bllhRi90citoMFNEQ1owNElZYmIyUTBMdVVjNUsxTGo1NGI1TDNmL2cwT0RL?=
 =?utf-8?B?NVM4dFpYRS9kaGdoUVB0RWtIN09UUVYyRWQ1SzVwSzd0VnJZaTNuanIyeDRq?=
 =?utf-8?B?MUNQd0VMK29qZG1DMGVoZjdzRCtuM240bC9iSGNpa2hXR1Y0cnpSSm95dEZp?=
 =?utf-8?B?MnNZaUozR0VTZmlDU0xyZ2FqdmJmUXhqMlF3cXJsa1BCR2NNV1dOYW5IY0ls?=
 =?utf-8?B?U1RlUklyTVpLSHc1RmYyR3U2dk9rWGxnYjBjVnowelBoWEI1WFhyNXVzaUtL?=
 =?utf-8?B?MThHU1RkQ3V4VWlLSDVzaVgwTGFrdVhCMFIrYngwbWdxN0lIVG1VclpTR1o0?=
 =?utf-8?B?YjlZRXFqWkxvUHh0R0RSckpPYUpwV0NqdkxwUVdUZW5EQW8xNENQaWN0RTdK?=
 =?utf-8?B?YzRXNHc0TjhyUjlrQWpacUFDdEx6OHFZOXFDWFdDWE96Q2VRTS9TLzlzb1Vw?=
 =?utf-8?B?RTRJWUhHRHZlbTd0OXpuQmVXazhuY2xRcUFsMVZNaDJnUVl6dzBhM09DdDIx?=
 =?utf-8?B?SUxJeThHOWdGYjhwMjRnR2dqeTczejFyK1p2UnduaXpTT2lmcjNLOVN0WC9p?=
 =?utf-8?B?YkxodFdRaWViMjRMQjIxeGpKb2RDNlNMQlJXZHVDK2doTnQzUytZbCtLSmxG?=
 =?utf-8?B?a0VKRDMwVitSYVVxUzhoaFlRTGtwQ1lwMm4zTFZyaWNVTnE5dzFVZjlpcVJC?=
 =?utf-8?B?dEFzUTc1TTFwODlveUZJL3lyS2xLTlVjaUU5WGVsTzlGMzJ2T0trK1VreG1j?=
 =?utf-8?B?cWFJQ1BLNldWQm1pbWdjVjZ0WXVkRXBtajVCREJCMkRLVU9qeDcrSWtkbENM?=
 =?utf-8?B?M3NLanprM2NyUWdkd1lBUExFVHA2RkhTK2tiNmhxblZXdkF0R21GU2lWMGh4?=
 =?utf-8?B?VjhXbUhBOXJOK0YrdjZ0d3VKS1UzTmNLcUVBNmtLSXdoREJmcGw3anhrRDJj?=
 =?utf-8?B?dkRtSVJsdEtQTHhRN1hwWmtzY0VCanN5KzZPWDNCQVdhMW1nenRLUFM3TGM5?=
 =?utf-8?B?M0xOVXB4cExDNVdtdXNzaFhvS2ErdVczcVRkcFM1UlBZWWhBTUlHMnE0d1JT?=
 =?utf-8?B?bnd4eEF3eHloeHozU0tjdGdXcEp4cjFFeFg1cUNmM3RmVTJJMjBUUXgrRG51?=
 =?utf-8?B?a2xkOVlzL29VQTRHUGs4d1pJdWJkeHBFNS96Yk1PYjlFZXRKdDkzOUVJbHJh?=
 =?utf-8?B?cFVlakpHQXRBcGhCd085dzdBdm1wSkdjS0tBQ3BXL3N4a3Buc2hQVUF2am1s?=
 =?utf-8?B?QzQxcEk4QTdjdnNGT3NhQWRWbjRlZHpETWJLaEVCL1NUV05SZTZkUDVCNXVu?=
 =?utf-8?B?emc9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	YMUu2n1EjqOhOeRu8sBlvhCwip0ZEpZaF2Vx7FOG2mNqyKmZK876zUrEFEp9POeRZ4T1QFFra1LE5po/Vypls9HbGRzlFIcm20BhtkaEq2RzMNy43lb/2onJ0JS0UEQrUmpetW9tA7ZMIX3t03Pp7PNatexAdy+Y/CiQL2OjmfANm3Xs/+tUOzUHiC2BIyE1mwjbgTeDPTgZuisJV//5VlFie/ESdu/UhVTup3YYPlDkRQJSVDVBLQJvkMkrnSkFi0usQlFFyQnU8vHnmOTsOVBwulG3fzqz5S8t2loMjY7Xm8c4jKrq2Jnz9iHc9yOG1pEIAtNh9oVlZPspoTYL2yjquKOcJ08HrFidaxDYm98RYFLLhFD+GSh1BDPlrAqsphYimnqfE4WyWGN2pZfk/c6O2MJ8GiuabOQNCb5rA3gsvzi1FA6vauKo5467ZM6bc5zZ2HhXRKAMbI8/2Zl2MkZ3PVys0MVcbdx3Yzv1adhnjqqqgVC+wLnpll8cuPDm1XRPFPTPSpnUQB7kZGNkq/tnolqtxUNvH0rbrlNW2+X/ADJ01HOeKacKLGA74od+SBVv6u43NlwZ1fKZqYYmvggtQ2naUZ8NP5c+ujAuRZ8=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 758e2657-e917-4e8e-2e94-08dc80e6d402
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB5895.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 May 2024 20:26:46.9218
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: u+HQy2kVhu5haOKgsp82gxTlh8WSv1buj9C95Mg0WrEo2ABwuRIrDADcw7WYb9TRPxlQl9F8QfhfsQ6Qnr7hSTFTGAZ0OPlxcaKL0V/nSMs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR10MB7427
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.12.28.16
 definitions=2024-05-30_17,2024-05-30_01,2024-05-17_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 malwarescore=0 bulkscore=0
 suspectscore=0 mlxscore=0 adultscore=0 spamscore=0 mlxlogscore=999
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2405010000
 definitions=main-2405300152
X-Proofpoint-ORIG-GUID: F2yVQv4tgvZKZL6apSsuTctbO5E6l6Ar
X-Proofpoint-GUID: F2yVQv4tgvZKZL6apSsuTctbO5E6l6Ar

Hi Ravi,

On 5/30/2024 2:30 PM, George Kennedy wrote:
> Hi Ravi,
>
> On 5/29/2024 11:37 PM, Ravi Bangoria wrote:
>> Hi George,
>>
>>> Events can be deleted and the entry can be NULL.
>> Can you please also explain "how".
> It looks like x86_pmu_stop() is clearing the bit in active_mask and 
> setting the events entry to NULL (and doing it in the correct order) 
> for the same events index that amd_pmu_enable_all() is trying to enable.
>>
>>> Check event for NULL in amd_pmu_enable_all() before enable to avoid 
>>> a GPF.
>>> This appears to be an AMD only issue.
>>>
>>> Syzkaller reported a GPF in amd_pmu_enable_all.
>> Can you please provide a bug report link? Also, any reproducer?
> The Syzkaller reproducer can be found in this link:
> https://lore.kernel.org/netdev/CAMt6jhyec7-TSFpr3F+_ikjpu39WV3jnCBBGwpzpBrPx55w20g@mail.gmail.com/T/#u 
>
>>
>>> @@ -760,7 +760,8 @@ static void amd_pmu_enable_all(int added)
>>>           if (!test_bit(idx, cpuc->active_mask))
>>>               continue;
>>>   -        amd_pmu_enable_event(cpuc->events[idx]);
>>> +        if (cpuc->events[idx])
>>> +            amd_pmu_enable_event(cpuc->events[idx]);
>> What if cpuc->events[idx] becomes NULL after if (cpuc->events[idx]) but
>> before amd_pmu_enable_event(cpuc->events[idx])?
> Good question, but the crash has not reproduced with the proposed fix 
> in hours of testing. It usually reproduces within minutes without the 
> fix.

Also, a similar fix is done in __intel_pmu_enable_all() in 
arch/x86/events/intel/core.c except that a WARN_ON_ONCE is done as well.
See: 
https://elixir.bootlin.com/linux/v6.10-rc1/source/arch/x86/events/intel/core.c#L2256

>
> Thank you,
> George
>>
>> Thanks,
>> Ravi
>