Received-SPF: pass (google.com: domain of linux-kernel+bounces-200700-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Message-ID: <7b27a039-ddb9-4beb-a1b4-ba2b74a3043e@oracle.com>
Date: Tue, 4 Jun 2024 09:23:19 -0400
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] perf/x86/amd: check event before enable to avoid GPF
To: Ravi Bangoria <ravi.bangoria@amd.com>
Cc: harshit.m.mogalapalli@oracle.com, peterz@infradead.org, mingo@redhat.com,
        acme@kernel.org, namhyung@kernel.org, mark.rutland@arm.com,
        alexander.shishkin@linux.intel.com, jolsa@kernel.org,
        irogers@google.com, adrian.hunter@intel.com, kan.liang@linux.intel.com,
        tglx@linutronix.de, bp@alien8.de, dave.hansen@linux.intel.com,
        x86@kernel.org, hpa@zytor.com, linux-perf-users@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <1716990659-2427-1-git-send-email-george.kennedy@oracle.com>
 <75f6aba1-8ed6-4ef8-8811-de40ae40be90@amd.com>
 <1e14ca4b-6e3e-4d57-acec-bc3ee2bed6ed@oracle.com>
 <0494aedf-9759-4427-a7f3-39a91bd5771d@oracle.com>
 <3ec1cb26-c889-45ab-b8cc-92f933a2b5d1@amd.com>
Content-Language: en-US
From: George Kennedy <george.kennedy@oracle.com>
In-Reply-To: <3ec1cb26-c889-45ab-b8cc-92f933a2b5d1@amd.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?Y3dNQmJ6Vk0ybWIyY1BKdjZvaHpqWjVJSmNsSnZmM1hGS3dDeWtNa2lhcWh3?=
 =?utf-8?B?UG5KYjJtVTZLQlRTbHFabDFOeDRwSzBjbHg0Mi9sU1dnQTNjbUZ1NkZyWG9Z?=
 =?utf-8?B?NjZCWDcxZVJxL1pKdVZQSGxFMitnc0F1eTlSQkFQMFI4V05TZ3M5OFhBL0R3?=
 =?utf-8?B?RkYrVWp4cFRwSDZzL0hQZjdjNHhtZEJFaCs0UllzaG1YL2dXd3VhT1JCbGF1?=
 =?utf-8?B?SzNJZjNaWnZTOXpLTjhNOXZITGhaZGNaeHdEQzBqMHBtZGtvcEJqU1J5OFkx?=
 =?utf-8?B?U3pUNHFPaUVML01RZjkvVUcyVlE3dnBzMkgxWXNJRUl1cnRxYWxvdEIvSzVi?=
 =?utf-8?B?SHRSNkhSUXVtb0hMb3B2TFowQVhSRGxadlc2TGM5N1pTZWZpRHQ3cVpoUTFt?=
 =?utf-8?B?bEpMZzlWM1M3K1AwTGFqbWJQbUhMcmZKalBqb1NQOVNNbGZMVU5jZXZod0FU?=
 =?utf-8?B?YmVpUEVtbC9IK2t0bS9ld1JWMWowVXJPMGtGQVBRVnhRa085dU5ZL2luNHNk?=
 =?utf-8?B?clYyZm5LRmZXY0VaUzRpdnFnUlV1RzhYdEt4SEVucTBFdFdSUGEyY1VaSmNx?=
 =?utf-8?B?eG5kMmJHemo4M2FDRWpBenBUQWpncmpTZ2lIYUdBZVYrT3d5Y3lyRTdBNlVm?=
 =?utf-8?B?U1dpNndOUHBkRmdHSWxmTEt6eEg4SUtmUjVhdzhWVyt1clpITXJjZHlWQkVN?=
 =?utf-8?B?eUlhZmpoR1JoSlpXS3F0OTFQeVdvazgxbCtWTkVKWXZiRWVVMEN3dDRpUjcz?=
 =?utf-8?B?QTNUNkl2RkM5RkdJU2JZUkJWSmtWR0w4MCtScDJ2OWRVcVhPanFWcXZ3S09y?=
 =?utf-8?B?V1E4aUtxdXV0aEdYZFdJazRJdmVybVVTeGFRbVY3czlxYnl3YUM1YzZIaG9x?=
 =?utf-8?B?RmY4c2VKTUtreFQxelRmaDJLUU9ueGNnODdTZDZKajRkczFuVDBrNDQyWkFj?=
 =?utf-8?B?cS8zdlNKODVjZjYzdEdESzhVRWdJL0RwYXArN3JLN21PSjNPQVdZaVRRZWht?=
 =?utf-8?B?RVd0NTVHcXpJSkoyN2hTR0pyVlJ6cVdGd2oxM0VTcTdtZmVDQ1JEV1lBVThL?=
 =?utf-8?B?UUVxMDRkbTBnL2x2OVczMnk4UjcvNFhFZ1pCeklUci82dFh1TTZNN05rRVRa?=
 =?utf-8?B?ZExOY0NsOFA5bklHQ01vd3k5UEZzOW81bXhPejBudmdDckY4czdSV2h0RTBR?=
 =?utf-8?B?QnJ5U0ZIU09EU3JET0VoWFNRczc3STMzV2xaRnVpUDlXd3JQWk8rd3RzVEtY?=
 =?utf-8?B?RWZCWVc1UzdxNnB2bHpVTEM4OG1RdS9nMC95RkQyb1czeGkyQ2IvdjV6T2dX?=
 =?utf-8?B?bW9kZ0I4N0kyWG5CVEVSQkNjU0JsKzBzTmNTZmFiaUxoYXZOcGhGOVpJNHdI?=
 =?utf-8?B?dDdqWUdUQnJFbitGQlNYVVJ0dEJLTFlYK0w3VWRUL1FPWmc1bW02ZUlFV2Iy?=
 =?utf-8?B?K0taL3B6VGtWS1Jrbk1rU0VlbGxZMmNVanpxTzlleHl0Q1VLYTFiSnhVVTZu?=
 =?utf-8?B?MTNHaHlzSUZoWTZwUHlPdkxPREtkTnp4dTluY3JIWDh3QldKZHp6MDJLNENV?=
 =?utf-8?B?Q3plaXAzK3VCSWtvdEVEUFZ2MUpmVXNBMWtzdjhnQ3BPM0Vja2tZaG5vZVhv?=
 =?utf-8?B?N2x1SldLRFU2cUtyT0NIKytTQnlYQmdyd3puNzFESi91NGFVOXJ3UzVhMTll?=
 =?utf-8?B?dWY1TlloRllXd0F0MFBwTFBJV1QrdkVnTmVKWEpXYXpaQW9PSGVpK0tGcDAw?=
 =?utf-8?B?aExrbTE1WTR5SjdQOVFCQ1hCM0VKS01sZnp2YVJzOTNNZEZlRWQrQnpISzYv?=
 =?utf-8?B?NWZudy9oR2hGamRPS2ZoWm80dmlKTUtQdXFkNTdkc2dHOWxXR2swZkxpTEdP?=
 =?utf-8?B?V1dEVUpXTmxiNkRiSWxzclpmWHBpaC9icjBhMWwrbmpFT1ZER1ZSanlDWmVp?=
 =?utf-8?B?clZJU29wOThUcEdIOVFnbkszZVNKS2p3ekJRMkhZb3NGRjlRaEN3V3RWWkov?=
 =?utf-8?B?d3pJR0Y3RmFDbFNSRksweWZ3RFF0T24xVVU0bjBxRnhIdWpFeTBTK0JNRjRm?=
 =?utf-8?B?WGNNd1F1ZC9Yd05md2gxZ281QVZkaG1PNVJ0WC8yUmF5YjBkc1Jrbi96Q284?=
 =?utf-8?B?YjFUN1NFK3lwRGdSREViaFdxWlBIZlBZNEtRVml1NjNSWnBWdk9YVGxmeWRF?=
 =?utf-8?B?Y1E9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	IQegPRMwecMtIcbkSVDNUHrv/Je633/RuZQOyYmN17P+xUVu/2aRkXldPYONMHR0Leam5STxFBuDfQylhvWdT9PCnG3MlM2fvxRJdD9UlXyt/qz3mHyMSkVO1yQuVhb26wJvh08yKEvTbojjTKOz0Ggg0zUcl5oQAmDzDIMCXWfJruaxhnpsaDja2n1lGRCrLB4J5QsMIhIPMHMOWreVV5zWph6V08cPsHP6JxBL217DVNzAVwtRtD/51HAHHcfrR6O0RWo/f7SHZQFAEo/7fQMTL/Zen/CrKpNDWOvTI7tSvLHLfHL1YKBuGb4q0V15nS2Bl/oXmpiCwjtk8gVmFw2rqKEKbpqHYqRwj22Ze7wzBpF0hOnADQOCqNV/dtrH31LTlZ+HrggqgDblF1lLqpDsWf4gZF+UnlhsyWKKgOSX+55U9nrF6c/QJdPV+oekftaC8Xvlci2UKbCFO1Gu4xFg0oNm8wpI0fEhG0jbN68w9WAKtyOWr98F3eB7TD+6VJpFfihLl2L79bpMJ3U0gingEQVKrKm9yunG15FulsyYSEfC0I8IkNPweips0w00SSVCaSRuBeBA9Rqks0joAAvBCcj89YKpcVtjS2L8zZA=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: be50a6b4-3d65-4cca-27ba-08dc849982c3
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB5895.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Jun 2024 13:23:24.0345
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Pdh6PrPUsAXojzk6h2bCfnSPTLn+p0DMjzcC0QXc7DyiRLJm/v9ial4qHHWNGbBte+MYIF6/E6+O1+2ZrpLsmT7n57lEvXmkWmbnD/ADNHI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN6PR10MB8024
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.28.16
 definitions=2024-06-04_05,2024-06-04_01,2024-05-17_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 phishscore=0
 adultscore=0 bulkscore=0 spamscore=0 malwarescore=0 mlxscore=0
 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2405010000 definitions=main-2406040107
X-Proofpoint-ORIG-GUID: RrU9zoW4nn5gAQ4GMLiX7iT8PtBMjkD2
X-Proofpoint-GUID: RrU9zoW4nn5gAQ4GMLiX7iT8PtBMjkD2


On 6/4/2024 9:16 AM, Ravi Bangoria wrote:
>>>>> Events can be deleted and the entry can be NULL.
>>>> Can you please also explain "how".
>>> It looks like x86_pmu_stop() is clearing the bit in active_mask and setting the events entry to NULL (and doing it in the correct order) for the same events index that amd_pmu_enable_all() is trying to enable.
>>>>> Check event for NULL in amd_pmu_enable_all() before enable to avoid a GPF.
>>>>> This appears to be an AMD only issue.
>>>>>
>>>>> Syzkaller reported a GPF in amd_pmu_enable_all.
>>>> Can you please provide a bug report link? Also, any reproducer?
>>> The Syzkaller reproducer can be found in this link:
>>> https://lore.kernel.org/netdev/CAMt6jhyec7-TSFpr3F+_ikjpu39WV3jnCBBGwpzpBrPx55w20g@mail.gmail.com/T/#u
>>>>> @@ -760,7 +760,8 @@ static void amd_pmu_enable_all(int added)
>>>>>            if (!test_bit(idx, cpuc->active_mask))
>>>>>                continue;
>>>>>    -        amd_pmu_enable_event(cpuc->events[idx]);
>>>>> +        if (cpuc->events[idx])
>>>>> +            amd_pmu_enable_event(cpuc->events[idx]);
>>>> What if cpuc->events[idx] becomes NULL after if (cpuc->events[idx]) but
>>>> before amd_pmu_enable_event(cpuc->events[idx])?
>>> Good question, but the crash has not reproduced with the proposed fix in hours of testing. It usually reproduces within minutes without the fix.
>> Also, a similar fix is done in __intel_pmu_enable_all() in arch/x86/events/intel/core.c except that a WARN_ON_ONCE is done as well.
>> See: https://elixir.bootlin.com/linux/v6.10-rc1/source/arch/x86/events/intel/core.c#L2256
> There are subtle differences between Intel and AMD pmu implementation.
> __intel_pmu_enable_all() enables all event with single WRMSR whereas
> amd_pmu_enable_all() loops over each PMC and enables it individually.
>
> The WARN_ON_ONCE() is important because it will warn about potential
> sw bug somewhere else.
We could add a similar WARN_ON_ONCE() to the proposed patch. Thanks, George
>
> Thanks,
> Ravi