Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf fixes from Ingo Molnar:
 "The biggest changes are fixes for races that kept triggering Trinity
  crashes, plus liblockdep build fixes and smaller misc fixes.

  The liblockdep bits in perf/urgent are a pull mistake - they should
  have been in locking/urgent - but by the time I noticed other commits
  were added and testing was done :-/ Sorry about that"

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix a race between ring_buffer_detach() and ring_buffer_attach()
  perf: Prevent false warning in perf_swevent_add
  perf: Limit perf_event_attr::sample_period to 63 bits
  tools/liblockdep: Remove all build files when doing make clean
  tools/liblockdep: Build liblockdep from tools/Makefile
  perf/x86/intel: Fix Silvermont's event constraints
  perf: Fix perf_event_init_context()
  perf: Fix race in removing an event

1 files changed, 92 insertions, 82 deletions

diff --git a/kernel/events/core.c b/kernel/events/core.c
index f83a71a3e46d..440eefc67397 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1443,6 +1443,11 @@ group_sched_out(struct perf_event *group_event,
                 cpuctx->exclusive = 0;
 }
 
+struct remove_event {
+        struct perf_event *event;
+        bool detach_group;
+};
+
 /*
  * Cross CPU call to remove a performance event
  *
@@ -1451,12 +1456,15 @@ group_sched_out(struct perf_event *group_event,
  */
 static int __perf_remove_from_context(void *info)
 {
-        struct perf_event *event = info;
+        struct remove_event *re = info;
+        struct perf_event *event = re->event;
         struct perf_event_context *ctx = event->ctx;
         struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
 
         raw_spin_lock(&ctx->lock);
         event_sched_out(event, cpuctx, ctx);
+        if (re->detach_group)
+                perf_group_detach(event);
         list_del_event(event, ctx);
         if (!ctx->nr_events && cpuctx->task_ctx == ctx) {
                 ctx->is_active = 0;
@@ -1481,10 +1489,14 @@ static int __perf_remove_from_context(void *info)
  * When called from perf_event_exit_task, it's OK because the
  * context has been detached from its task.
  */
-static void perf_remove_from_context(struct perf_event *event)
+static void perf_remove_from_context(struct perf_event *event, bool detach_group)
 {
         struct perf_event_context *ctx = event->ctx;
         struct task_struct *task = ctx->task;
+        struct remove_event re = {
+                .event = event,
+                .detach_group = detach_group,
+        };
 
         lockdep_assert_held(&ctx->mutex);
 
@@ -1493,12 +1505,12 @@ static void perf_remove_from_context(struct perf_event *event)
                  * Per cpu events are removed via an smp call and
                  * the removal is always successful.
                  */
-                cpu_function_call(event->cpu, __perf_remove_from_context, event);
+                cpu_function_call(event->cpu, __perf_remove_from_context, &re);
                 return;
         }
 
 retry:
-        if (!task_function_call(task, __perf_remove_from_context, event))
+        if (!task_function_call(task, __perf_remove_from_context, &re))
                 return;
 
         raw_spin_lock_irq(&ctx->lock);
@@ -1515,6 +1527,8 @@ retry:
          * Since the task isn't running, its safe to remove the event, us
          * holding the ctx->lock ensures the task won't get scheduled in.
          */
+        if (detach_group)
+                perf_group_detach(event);
         list_del_event(event, ctx);
         raw_spin_unlock_irq(&ctx->lock);
 }
@@ -3178,7 +3192,8 @@ static void free_event_rcu(struct rcu_head *head)
 }
 
 static void ring_buffer_put(struct ring_buffer *rb);
-static void ring_buffer_detach(struct perf_event *event, struct ring_buffer *rb);
+static void ring_buffer_attach(struct perf_event *event,
+                               struct ring_buffer *rb);
 
 static void unaccount_event_cpu(struct perf_event *event, int cpu)
 {
@@ -3238,8 +3253,6 @@ static void free_event(struct perf_event *event)
         unaccount_event(event);
 
         if (event->rb) {
-                struct ring_buffer *rb;
-
                 /*
                  * Can happen when we close an event with re-directed output.
                  *
@@ -3247,12 +3260,7 @@ static void free_event(struct perf_event *event)
                  * over us; possibly making our ring_buffer_put() the last.
                  */
                 mutex_lock(&event->mmap_mutex);
-                rb = event->rb;
-                if (rb) {
-                        rcu_assign_pointer(event->rb, NULL);
-                        ring_buffer_detach(event, rb);
-                        ring_buffer_put(rb); /* could be last */
-                }
+                ring_buffer_attach(event, NULL);
                 mutex_unlock(&event->mmap_mutex);
         }
 
@@ -3281,10 +3289,7 @@ int perf_event_release_kernel(struct perf_event *event)
          *     to trigger the AB-BA case.
          */
         mutex_lock_nested(&ctx->mutex, SINGLE_DEPTH_NESTING);
-        raw_spin_lock_irq(&ctx->lock);
-        perf_group_detach(event);
-        raw_spin_unlock_irq(&ctx->lock);
-        perf_remove_from_context(event);
+        perf_remove_from_context(event, true);
         mutex_unlock(&ctx->mutex);
 
         free_event(event);
@@ -3839,28 +3844,47 @@ unlock:
 static void ring_buffer_attach(struct perf_event *event,
                                struct ring_buffer *rb)
 {
+        struct ring_buffer *old_rb = NULL;
         unsigned long flags;
 
-        if (!list_empty(&event->rb_entry))
-                return;
+        if (event->rb) {
+                /*
+                 * Should be impossible, we set this when removing
+                 * event->rb_entry and wait/clear when adding event->rb_entry.
+                 */
+                WARN_ON_ONCE(event->rcu_pending);
 
-        spin_lock_irqsave(&rb->event_lock, flags);
-        if (list_empty(&event->rb_entry))
-                list_add(&event->rb_entry, &rb->event_list);
-        spin_unlock_irqrestore(&rb->event_lock, flags);
-}
+                old_rb = event->rb;
+                event->rcu_batches = get_state_synchronize_rcu();
+                event->rcu_pending = 1;
 
-static void ring_buffer_detach(struct perf_event *event, struct ring_buffer *rb)
-{
-        unsigned long flags;
+                spin_lock_irqsave(&old_rb->event_lock, flags);
+                list_del_rcu(&event->rb_entry);
+                spin_unlock_irqrestore(&old_rb->event_lock, flags);
+        }
 
-        if (list_empty(&event->rb_entry))
-                return;
+        if (event->rcu_pending && rb) {
+                cond_synchronize_rcu(event->rcu_batches);
+                event->rcu_pending = 0;
+        }
+
+        if (rb) {
+                spin_lock_irqsave(&rb->event_lock, flags);
+                list_add_rcu(&event->rb_entry, &rb->event_list);
+                spin_unlock_irqrestore(&rb->event_lock, flags);
+        }
+
+        rcu_assign_pointer(event->rb, rb);