The perf fuzzer caused Skylake machine to crash: [ 9680.085831] Call Trace: [ 9680.088301] <IRQ> [ 9680.090363] perf_output_sample_regs+0x43/0xa0 [ 9680.094928] perf_output_sample+0x3aa/0x7a0 [ 9680.099181] perf_event_output_forward+0x53/0x80 [ 9680.103917] __perf_event_overflow+0x52/0xf0 [ 9680.108266] ? perf_trace_run_bpf_submit+0xc0/0xc0 [ 9680.113108] perf_swevent_hrtimer+0xe2/0x150 [ 9680.117475] ? check_preempt_wakeup+0x181/0x230 [ 9680.122091] ? check_preempt_curr+0x62/0x90 [ 9680.126361] ? ttwu_do_wakeup+0x19/0x140 [ 9680.130355] ? try_to_wake_up+0x54/0x460 [ 9680.134366] ? reweight_entity+0x15b/0x1a0 [ 9680.138559] ? __queue_work+0x103/0x3f0 [ 9680.142472] ? update_dl_rq_load_avg+0x1cd/0x270 [ 9680.147194] ? timerqueue_del+0x1e/0x40 [ 9680.151092] ? __remove_hrtimer+0x35/0x70 [ 9680.155191] __hrtimer_run_queues+0x100/0x280 [ 9680.159658] hrtimer_interrupt+0x100/0x220 [ 9680.163835] smp_apic_timer_interrupt+0x6a/0x140 [ 9680.168555] apic_timer_interrupt+0xf/0x20 [ 9680.172756] </IRQ> The XMM registers can only be collected by PEBS hardware events on the platforms with PEBS baseline support, e.g. Icelake, not software/probe events. Add capabilities flag PERF_PMU_CAP_EXTENDED_REGS to indicate the PMU which support extended registers. For X86, the extended registers are XMM registers. Add has_extended_regs() to check if extended registers are applied. The generic code define the mask of extended registers as 0 if arch headers haven't overridden it.
Unified · Split
| @@ -2020,6 +2020,7 @@ void __init intel_ds_init(void) · 2019 unmodified lines | |||
| 2020 | PERF_SAMPLE_TIME; | 2020 | PERF_SAMPLE_TIME; |
| 2021 | x86_pmu.flags |= PMU_FL_PEBS_ALL; | 2021 | x86_pmu.flags |= PMU_FL_PEBS_ALL; |
| 2022 | pebs_qual = "-baseline"; | 2022 | pebs_qual = "-baseline"; |
| 2023 | x86_get_pmu()->capabilities |= PERF_PMU_CAP_EXTENDED_REGS; | ||
| 2023 | } else { | 2024 | } else { |
| 2024 | /* Only basic record supported */ | 2025 | /* Only basic record supported */ |
| 2025 | x86_pmu.pebs_no_xmm_regs = 1; | 2026 | x86_pmu.pebs_no_xmm_regs = 1; |
| @@ -52,4 +52,7 @@ enum perf_event_x86_regs { · 51 unmodified lines | |||
| 52 | /* These include both GPRs and XMMX registers */ | 52 | /* These include both GPRs and XMMX registers */ |
| 53 | PERF_REG_X86_XMM_MAX = PERF_REG_X86_XMM15 + 2, | 53 | PERF_REG_X86_XMM_MAX = PERF_REG_X86_XMM15 + 2, |
| 54 | }; | 54 | }; |
| 55 | |||
| 56 | #define PERF_REG_EXTENDED_MASK (~((1ULL << PERF_REG_X86_XMM0) - 1)) | ||
| 57 | |||
| 55 | #endif /* _ASM_X86_PERF_REGS_H */ | 58 | #endif /* _ASM_X86_PERF_REGS_H */ |
| @@ -241,6 +241,7 @@ struct perf_event; · 240 unmodified lines | |||
| 241 | #define PERF_PMU_CAP_NO_INTERRUPT 0x01 | 241 | #define PERF_PMU_CAP_NO_INTERRUPT 0x01 |
| 242 | #define PERF_PMU_CAP_NO_NMI 0x02 | 242 | #define PERF_PMU_CAP_NO_NMI 0x02 |
| 243 | #define PERF_PMU_CAP_AUX_NO_SG 0x04 | 243 | #define PERF_PMU_CAP_AUX_NO_SG 0x04 |
| 244 | #define PERF_PMU_CAP_EXTENDED_REGS 0x08 | ||
| 244 | #define PERF_PMU_CAP_EXCLUSIVE 0x10 | 245 | #define PERF_PMU_CAP_EXCLUSIVE 0x10 |
| 245 | #define PERF_PMU_CAP_ITRACE 0x20 | 246 | #define PERF_PMU_CAP_ITRACE 0x20 |
| 246 | #define PERF_PMU_CAP_HETEROGENEOUS_CPUS 0x40 | 247 | #define PERF_PMU_CAP_HETEROGENEOUS_CPUS 0x40 |
| @@ -11,6 +11,11 @@ struct perf_regs { · 10 unmodified lines | |||
| 11 | 11 | ||
| 12 | #ifdef CONFIG_HAVE_PERF_REGS | 12 | #ifdef CONFIG_HAVE_PERF_REGS |
| 13 | #include <asm/perf_regs.h> | 13 | #include <asm/perf_regs.h> |
| 14 | |||
| 15 | #ifndef PERF_REG_EXTENDED_MASK | ||
| 16 | #define PERF_REG_EXTENDED_MASK 0 | ||
| 17 | #endif | ||
| 18 | |||
| 14 | u64 perf_reg_value(struct pt_regs *regs, int idx); | 19 | u64 perf_reg_value(struct pt_regs *regs, int idx); |
| 15 | int perf_reg_validate(u64 mask); | 20 | int perf_reg_validate(u64 mask); |
| 16 | u64 perf_reg_abi(struct task_struct *task); | 21 | u64 perf_reg_abi(struct task_struct *task); |
| @@ -18,6 +23,9 @@ void perf_get_regs_user(struct perf_regs *regs_user, · 1 unmodified line | |||
| 18 | struct pt_regs *regs, | 23 | struct pt_regs *regs, |
| 19 | struct pt_regs *regs_user_copy); | 24 | struct pt_regs *regs_user_copy); |
| 20 | #else | 25 | #else |
| 26 | |||
| 27 | #define PERF_REG_EXTENDED_MASK 0 | ||
| 28 | |||
| 21 | static inline u64 perf_reg_value(struct pt_regs *regs, int idx) | 29 | static inline u64 perf_reg_value(struct pt_regs *regs, int idx) |
| 22 | { | 30 | { |
| 23 | return 0; | 31 | return 0; |
| @@ -10036,6 +10036,12 @@ void perf_pmu_unregister(struct pmu *pmu) · 10035 unmodified lines | |||
| 10036 | } | 10036 | } |
| 10037 | EXPORT_SYMBOL_GPL(perf_pmu_unregister); | 10037 | EXPORT_SYMBOL_GPL(perf_pmu_unregister); |
| 10038 | 10038 | ||
| 10039 | static inline bool has_extended_regs(struct perf_event *event) | ||
| 10040 | { | ||
| 10041 | return (event->attr.sample_regs_user & PERF_REG_EXTENDED_MASK) || | ||
| 10042 | (event->attr.sample_regs_intr & PERF_REG_EXTENDED_MASK); | ||
| 10043 | } | ||
| 10044 | |||
| 10039 | static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) | 10045 | static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) |
| 10040 | { | 10046 | { |
| 10041 | struct perf_event_context *ctx = NULL; | 10047 | struct perf_event_context *ctx = NULL; |
| @@ -10067,12 +10073,16 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) · 25 unmodified lines | |||
| 10067 | perf_event_ctx_unlock(event->group_leader, ctx); | 10073 | perf_event_ctx_unlock(event->group_leader, ctx); |
| 10068 | 10074 | ||
| 10069 | if (!ret) { | 10075 | if (!ret) { |
| 10076 | if (!(pmu->capabilities & PERF_PMU_CAP_EXTENDED_REGS) && | ||
| 10077 | has_extended_regs(event)) | ||
| 10078 | ret = -EOPNOTSUPP; | ||
| 10079 | |||
| 10070 | if (pmu->capabilities & PERF_PMU_CAP_NO_EXCLUDE && | 10080 | if (pmu->capabilities & PERF_PMU_CAP_NO_EXCLUDE && |
| 10071 | event_has_any_exclude_flag(event)) { | 10081 | event_has_any_exclude_flag(event)) |
| 10072 | if (event->destroy) | ||
| 10073 | event->destroy(event); | ||
| 10074 | ret = -EINVAL; | 10082 | ret = -EINVAL; |
| 10075 | } | 10083 | |
| 10084 | if (ret && event->destroy) | ||
| 10085 | event->destroy(event); | ||
| 10076 | } | 10086 | } |
| 10077 | 10087 | ||
| 10078 | if (ret) | 10088 | if (ret) |