Query regarding __hrtimer_get_next_event()

Query regarding __hrtimer_get_next_event()

[Neeraj Upadhyay]

Hi,

We have one query regarding the __hrtimer_get_next_event().
The expires_next.tv64 is set to 0 if it is < 0. We observed
an hrtimer interrupt storm for one of the hrtimers with
below properties:

* Expires for the hrtimer was set to KTIME_MAX.
* cpu base was HRTIMER_BASE_REALTIME with negative base->offset.
* Due to below sub, expires overflowed to a negative value and
   expires_next.tv64 was set to 0
     expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
* Due to this, clockevent was programmed to min_delta_ns, everytime
   as __hrtimer_get_next_event() returned 0.


   static ktime_t __hrtimer_get_next_event(...)
   {
     <snip>
     for (; active; base++, active >>= 1) {

       <snip>
       timer = container_of(next, struct hrtimer, node);
       expires = ktime_sub(hrtimer_get_expires(timer),
         base->offset);
       if (expires.tv64 < expires_next.tv64) {
         expires_next = expires;
         hrtimer_update_next_timer(cpu_base, timer);
       }
     }
     <snip>
     if (expires_next.tv64 < 0)
       expires_next.tv64 = 0;
     return expires_next;
   }

This may not be a valid use case (queuing a hrtimer with KTIME_MAX)
expires, but should we guard the hrtimer next event code against
this by using KTIME_MAX upper bound. Is something like below a
proper way to guard it? Or am I missing something here?

expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
+  /*
+   * if expires is a very high positive value and base->offset is
+   * negative, expires can overflow and get negative value. Set
+   * expires to KTIME_MAX, if we encounter this.
+   */
+   if (hrtimer_get_expires(timer).tv64 > 0 &&
+      base->offset.tv64 < 0 && expires.tv64 < 0)
+       expires.tv64 = KTIME_MAX;
+


Thanks
Neeraj

-- 
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation

Re: Query regarding __hrtimer_get_next_event()

[Thomas Gleixner]

On Thu, 26 Oct 2017, Neeraj Upadhyay wrote:
> We have one query regarding the __hrtimer_get_next_event().
> The expires_next.tv64 is set to 0 if it is < 0. We observed
> an hrtimer interrupt storm for one of the hrtimers with
> below properties:
> 
> * Expires for the hrtimer was set to KTIME_MAX.
> * cpu base was HRTIMER_BASE_REALTIME with negative base->offset.
> * Due to below sub, expires overflowed to a negative value and
>   expires_next.tv64 was set to 0
>     expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
> * Due to this, clockevent was programmed to min_delta_ns, everytime
>   as __hrtimer_get_next_event() returned 0.
> 
> 
> This may not be a valid use case (queuing a hrtimer with KTIME_MAX)
> expires, but should we guard the hrtimer next event code against
> this by using KTIME_MAX upper bound. Is something like below a
> proper way to guard it? Or am I missing something here?

Can you please explain how you managed to have a negative base->offset?

Thanks,

	tglx

Re: Query regarding __hrtimer_get_next_event()

[Neeraj Upadhyay]

Hi tglx,

Forgot to mention, we are using kernel stable version 3.18
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/tree/kernel/time/timekeeping.c?h=v3.18.77

wall time is being set to a value close to epoch
but less than epoch + current uptime.

Looks like 
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/kernel/time?id=e1d7ba8735551ed79c7a0463a042353574b96da3

handles this case, but is not present in 3.18 tree.
We will try by pulling this patch to 3.18 tree.


int do_settimeofday(const struct timespec *tv)
{
xt = tk_xtime(tk);
ts_delta.tv_sec = tv->tv_sec - xt.tv_sec;
ts_delta.tv_nsec = tv->tv_nsec - xt.tv_nsec;

<snip>
tk_set_wall_to_mono(tk, timespec64_sub(tk->wall_to_monotonic, ts_delta));
}

xt = (
tv_sec = 1508807131,
tv_nsec = 223767601)
2017/10/24 9:5:31

tk->wall_to_monotonic = (
tv_sec = -1508803094,
tv_nsec = 15152092)

ts_delta = (tv_sec = -1508803200, tv_nsec = -767601)

wall_to_monotonic is bigger than the ts_delta, so leading
to wall_to_monotonic become positive value, resulting in
-ve off_real.


Thanks
Neeraj


On 10/26/2017 06:27 PM, Thomas Gleixner wrote:
> On Thu, 26 Oct 2017, Neeraj Upadhyay wrote:
>> We have one query regarding the __hrtimer_get_next_event().
>> The expires_next.tv64 is set to 0 if it is < 0. We observed
>> an hrtimer interrupt storm for one of the hrtimers with
>> below properties:
>>
>> * Expires for the hrtimer was set to KTIME_MAX.
>> * cpu base was HRTIMER_BASE_REALTIME with negative base->offset.
>> * Due to below sub, expires overflowed to a negative value and
>>    expires_next.tv64 was set to 0
>>      expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
>> * Due to this, clockevent was programmed to min_delta_ns, everytime
>>    as __hrtimer_get_next_event() returned 0.
>>
>>
>> This may not be a valid use case (queuing a hrtimer with KTIME_MAX)
>> expires, but should we guard the hrtimer next event code against
>> this by using KTIME_MAX upper bound. Is something like below a
>> proper way to guard it? Or am I missing something here?
> Can you please explain how you managed to have a negative base->offset?
>
> Thanks,
>
> 	tglx

-- 
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation

Re: Query regarding __hrtimer_get_next_event()

[Thomas Gleixner]

On Thu, 26 Oct 2017, Neeraj Upadhyay wrote:

> Hi tglx,
> 
> Forgot to mention, we are using kernel stable version 3.18
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/tree/kernel/time/timekeeping.c?h=v3.18.77
> 
> wall time is being set to a value close to epoch
> but less than epoch + current uptime.
> 
> Looks like
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/kernel/time?id=e1d7ba8735551ed79c7a0463a042353574b96da3
> 
> handles this case, but is not present in 3.18 tree.
> We will try by pulling this patch to 3.18 tree.

Sigh. This should have been tagged for stable.

Thanks,

	tglx