5.10-stable patches

added patches:
	perf-core-fix-reentry-problem-in-perf_output_read_group.patch

2 files changed, 81 insertions, 0 deletions

diff --git a/queue-5.10/perf-core-fix-reentry-problem-in-perf_output_read_group.patch b/queue-5.10/perf-core-fix-reentry-problem-in-perf_output_read_group.patch
new file mode 100644
index 0000000000..ff60bcaceb
--- /dev/null
+++ b/queue-5.10/perf-core-fix-reentry-problem-in-perf_output_read_group.patch
@@ -0,0 +1,80 @@
+From 6b959ba22d34ca793ffdb15b5715457c78e38b1a Mon Sep 17 00:00:00 2001
+From: Yang Jihong <yangjihong1@huawei.com>
+Date: Fri, 2 Sep 2022 16:29:18 +0800
+Subject: perf/core: Fix reentry problem in perf_output_read_group()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+commit 6b959ba22d34ca793ffdb15b5715457c78e38b1a upstream.
+
+perf_output_read_group may respond to IPI request of other cores and invoke
+__perf_install_in_context function. As a result, hwc configuration is modified.
+causing inconsistency and unexpected consequences.
+
+Interrupts are not disabled when perf_output_read_group reads PMU counter.
+In this case, IPI request may be received from other cores.
+As a result, PMU configuration is modified and an error occurs when
+reading PMU counter:
+
+		     CPU0                                         CPU1
+						      __se_sys_perf_event_open
+							perf_install_in_context
+  perf_output_read_group                                  smp_call_function_single
+    for_each_sibling_event(sub, leader) {                   generic_exec_single
+      if ((sub != event) &&                                   remote_function
+	  (sub->state == PERF_EVENT_STATE_ACTIVE))                    |
+  <enter IPI handler: __perf_install_in_context>   <----RAISE IPI-----+
+  __perf_install_in_context
+    ctx_resched
+      event_sched_out
+	armpmu_del
+	  ...
+	  hwc->idx = -1; // event->hwc.idx is set to -1
+  ...
+  <exit IPI>
+	      sub->pmu->read(sub);
+		armpmu_read
+		  armv8pmu_read_counter
+		    armv8pmu_read_hw_counter
+		      int idx = event->hw.idx; // idx = -1
+		      u64 val = armv8pmu_read_evcntr(idx);
+			u32 counter = ARMV8_IDX_TO_COUNTER(idx); // invalid counter = 30
+			read_pmevcntrn(counter) // undefined instruction
+
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20220902082918.179248-1-yangjihong1@huawei.com
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/events/core.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6890,9 +6890,16 @@ static void perf_output_read_group(struc
+ {
+ 	struct perf_event *leader = event->group_leader, *sub;
+ 	u64 read_format = event->attr.read_format;
++	unsigned long flags;
+ 	u64 values[6];
+ 	int n = 0;
+ 
++	/*
++	 * Disabling interrupts avoids all counter scheduling
++	 * (context switches, timer based rotation and IPIs).
++	 */
++	local_irq_save(flags);
++
+ 	values[n++] = 1 + leader->nr_siblings;
+ 
+ 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+@@ -6928,6 +6935,8 @@ static void perf_output_read_group(struc
+ 
+ 		__output_copy(handle, values, n * sizeof(u64));
+ 	}
++
++	local_irq_restore(flags);
+ }
+ 
+ #define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\
diff --git a/queue-5.10/series b/queue-5.10/series
index 4589b9137f..49d54dbede 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -146,3 +146,4 @@ x86-mmio-disable-kvm-mitigation-when-x86_feature_clear_cpu_buf-is-set.patch
 documentation-hw-vuln-add-documentation-for-rfds.patch
 x86-rfds-mitigate-register-file-data-sampling-rfds.patch
 kvm-x86-export-rfds_no-and-rfds_clear-to-guests.patch
+perf-core-fix-reentry-problem-in-perf_output_read_group.patch