LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Peter Zijlstra <peterz@infradead.org>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: Thomas Zeitlhofer <thomas.zeitlhofer+lkml@ze-it.at>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Hugh Dickins <hughd@google.com>,
	LKML <linux-kernel@vger.kernel.org>
Subject: Re: "BUG: using smp_processor_id() in preemptible" with KPTI on 4.14.11
Date: Thu, 4 Jan 2018 18:07:12 +0100
Message-ID: <20180104170712.GB3040@hirez.programming.kicks-ass.net> (raw)
In-Reply-To: <alpine.DEB.2.20.1801041632370.1771@nanos>

On Thu, Jan 04, 2018 at 04:37:24PM +0100, Thomas Gleixner wrote:
> > Yes:
> > 
> >    BUG: using smp_processor_id() in preemptible [00000000] code: ovsdb-server/4498
> >    caller is native_flush_tlb_single+0x57/0xc0
> >    CPU: 2 PID: 4498 Comm: ovsdb-server Not tainted 4.15.0-rc6-kvm-00423-gea1908c252eb #3
> >    Hardware name: MSI MS-7798/B75MA-P45 (MS-7798), BIOS V1.9 09/30/2013
> >    Call Trace:
> >     dump_stack+0x5c/0x86
> >     check_preemption_disabled+0xdd/0xe0
> >     native_flush_tlb_single+0x57/0xc0
> >     ? __set_pte_vaddr+0x2d/0x40
> >     __set_pte_vaddr+0x2d/0x40
> >     set_pte_vaddr+0x2f/0x40
> >     cea_set_pte+0x30/0x40
> >     ds_update_cea.constprop.4+0x4d/0x70
> >     reserve_ds_buffers+0x159/0x410
> >     ? wp_page_copy+0x370/0x6c0
> >     x86_reserve_hardware+0x150/0x160
> >     x86_pmu_event_init+0x3e/0x1f0
> >     perf_try_init_event+0x69/0x80
> >     perf_event_alloc+0x652/0x740
> >     SyS_perf_event_open+0x3f6/0xd60
> >     do_syscall_64+0x5c/0x190
> >     entry_SYSCALL64_slow_path+0x25/0x25
> >    RIP: 0033:0x72bff0a3c0b9
> >    RSP: 002b:00007ffed11c2f18 EFLAGS: 00000206 ORIG_RAX: 000000000000012a
> >    RAX: ffffffffffffffda RBX: 00007ffed11c30f0 RCX: 000072bff0a3c0b9
> >    RDX: 00000000ffffffff RSI: 0000000000000000 RDI: 00007ffed11c2f20
> >    RBP: 0000000000000000 R08: 0000000000000000 R09: 0000007000000000
> >    R10: 00000000ffffffff R11: 0000000000000206 R12: 0000000000000008
> >    R13: 0000000000000000 R14: 00007ffed11c30d0 R15: 000060986ecfb600

Fun, so set_pte_vaddr() and the whole cpu_entry_area are supposed to be
per CPU. But the DS crud does cross CPU updates of those tables.

So we need some additional fun and games..

How's the below?

---
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 8f0aace08b87..8156e47da7ba 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -5,6 +5,7 @@
 
 #include <asm/cpu_entry_area.h>
 #include <asm/perf_event.h>
+#include <asm/tlbflush.h>
 #include <asm/insn.h>
 
 #include "../perf_event.h"
@@ -283,20 +284,35 @@ static DEFINE_PER_CPU(void *, insn_buffer);
 
 static void ds_update_cea(void *cea, void *addr, size_t size, pgprot_t prot)
 {
+	unsigned long start = (unsigned long)cea;
 	phys_addr_t pa;
 	size_t msz = 0;
 
 	pa = virt_to_phys(addr);
+
+	preempt_disable();
 	for (; msz < size; msz += PAGE_SIZE, pa += PAGE_SIZE, cea += PAGE_SIZE)
 		cea_set_pte(cea, pa, prot);
+
+	/*
+	 * This is a cross-CPU update of the cpu_entry_area, we must shoot down
+	 * all TLB entries for it.
+	 */
+	flush_tlb_kernel_range(start, start + size);
+	preempt_enable();
 }
 
 static void ds_clear_cea(void *cea, size_t size)
 {
+	unsigned long start = (unsigned long)cea;
 	size_t msz = 0;
 
+	preempt_disable();
 	for (; msz < size; msz += PAGE_SIZE, cea += PAGE_SIZE)
 		cea_set_pte(cea, 0, PAGE_NONE);
+
+	flush_tlb_kernel_range(start, start + size);
+	preempt_enable();
 }
 
 static void *dsalloc_pages(size_t size, gfp_t flags, int cpu)

  reply index

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-04  1:59 Thomas Zeitlhofer
2018-01-04 10:20 ` Thomas Zeitlhofer
2018-01-04 10:51   ` Greg Kroah-Hartman
2018-01-04 12:43     ` Thomas Zeitlhofer
2018-01-04 12:55       ` Greg Kroah-Hartman
2018-01-04 15:25         ` Thomas Zeitlhofer
2018-01-04 15:37           ` Thomas Gleixner
2018-01-04 17:07             ` Peter Zijlstra [this message]
2018-01-04 18:38               ` Thomas Zeitlhofer
2018-01-06 21:38                 ` Thomas Zeitlhofer
2018-01-07  8:17                   ` Greg Kroah-Hartman
2018-01-07  8:53                     ` Thomas Zeitlhofer
2018-01-08  0:37                       ` Thomas Zeitlhofer
2018-01-04 22:11               ` [tip:x86/pti] x86/events/intel/ds: Use the proper cache flush method for mapping ds buffers tip-bot for Peter Zijlstra
2018-01-04 23:49               ` tip-bot for Peter Zijlstra

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180104170712.GB3040@hirez.programming.kicks-ass.net \
    --to=peterz@infradead.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hughd@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=thomas.zeitlhofer+lkml@ze-it.at \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git