From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751968AbcHTEpl (ORCPT ); Sat, 20 Aug 2016 00:45:41 -0400 Received: from mail-it0-f49.google.com ([209.85.214.49]:34823 "EHLO mail-it0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751081AbcHTEpk (ORCPT ); Sat, 20 Aug 2016 00:45:40 -0400 From: Vince Weaver X-Google-Original-From: Vince Weaver Date: Sat, 20 Aug 2016 00:44:54 -0400 (EDT) X-X-Sender: vince@macbook-air To: Peter Zijlstra cc: Vince Weaver , linux-kernel@vger.kernel.org, Borislav Petkov , Ingo Molnar , Arnaldo Carvalho de Melo , Huang Rui Subject: Re: perf: fuzzer crashes immediately on AMD system In-Reply-To: <20160819100130.GD10121@twins.programming.kicks-ass.net> Message-ID: References: <20160819100130.GD10121@twins.programming.kicks-ass.net> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 19 Aug 2016, Peter Zijlstra wrote: > On Thu, Aug 18, 2016 at 10:46:31AM -0400, Vince Weaver wrote: > > On Thu, 18 Aug 2016, Vince Weaver wrote: > > > > > Tried the perf_fuzzer on my A10 fam15h/model13h system with 4.8-rc2 and it > > > falls over more or less immediately. > > > > > > This maps to variable_test_bit() > > > called by ctx = find_get_context(pmu, task, event); > > > in kernel/events/core.c:9467 > > > > > > It happens quickly enough I can probably track down the exact event that > > > causes this, if needed. > > > > I have a one line reproducer: > > > > perf stat -a -e amd_nb/config=0x37,config1=0x20/ /bin/ls > > OK, cannot reproduce on my fam15h/model1h. I'll go dig through the > various manuals to see if I can spot the fail. > > Huang could you either prod someone at AMD or do yourself, audit the AMD > perf code for all the various new models? This is bizzarre, I can't make any sense of the crash. To recap, the crash looks like this: BUG: unable to handle kernel paging request at ffffffff85e67600 IP: [] find_get_context.isra.75+0x28/0x20f The code in question is this code: if (!cpu_online(cpu)) which maps to test_bit(cpumask_check(cpu), cpumask_bits((cpumask))); which assembles to ffffffff810e4ca9: 41 89 cc mov %ecx,%r12d ffffffff810e4cac: 7f 1e jg ffffffff810e4ccc ffffffff810e4cae: 44 89 e0 mov %r12d,%eax * ffffffff810e4cb1: 48 0f a3 05 87 0f 7f bt %rax,0x7f0f87(%rip) # ffffffff818d5c40 <__cpu_online_mask> ffffffff810e4cb8: 00 ffffffff810e4cb9: 0f 92 c0 setb %al ffffffff810e4cbc: 84 c0 test %al,%al There is no way that 0x7f0f87(%rip) should ever possibly be the ffffffff85e67600 value that causes the fault. Though oddly rax when the call happens (according to the oops message) is RAX: 0000000022c8ce30 which seems nonsensical for a CPU number, but shouldn't cause an invalid memory address. Also oddly RDI matches RAX but RCX doesn't which I think should be true with that assembly. So very weird. I even wrote a kernel module and dumped the raw kernel memory to make sure the instruction stream didn't get overwritten somehow, but as far as I can tell the code in memory matches the disassembly. anyway I am out of time to look at this for now. Vince