oprofile: fix CPU unplug panic in ppro_stop()

PATCH In review Eric Dumazet 4 participants 5 messages Dec 2, 2008 – Dec 4, 2008 x86

Share & tools

Eric Dumazet

author

2008-12-02 06:21 UTC #0 lore raw

PATCH 1/1 oprofile: fix CPU unplug panic in ppro_stop()

If oprofile statically compiled in kernel, a cpu unplug triggers a panic in ppro_stop(), because a NULL pointer is dereferenced.

Signed-off-by Eric Dumazet <[email protected]>

---
arch/x86/oprofile/op_model_ppro.c | 4 ++++

1 files changed, 4 insertions(+)

arch/x86/oprofile/op_model_ppro.c +4 -0

index 716d26f..e9f80c7 100644
@@ -156,6 +156,8 @@ static void ppro_start(struct op_msrs const * const msrs)
 	unsigned int low, high;
 	int i;
 
+	if (!reset_value)
+		return;
 	for (i = 0; i < num_counters; ++i) {
 		if (reset_value[i]) {
 			CTRL_READ(low, high, msrs, i);

@@ -171,6 +173,8 @@ static void ppro_stop(struct op_msrs const * const msrs)
 	unsigned int low, high;
 	int i;
 
+	if (!reset_value)
+		return;
 	for (i = 0; i < num_counters; ++i) {
 		if (!reset_value[i])
 			continue;

Ingo Molnar

2008-12-02 08:17 UTC #1 lore raw

Quoted 21 lines · Eric Dumazet

If oprofile statically compiled in kernel, a cpu unplug triggers a panic in ppro_stop(), because a NULL pointer is dereferenced.
Signed-off-by Eric Dumazet <[email protected]>
---
arch/x86/oprofile/op_model_ppro.c | 4 ++++
1 files changed, 4 insertions(+)
arch/x86/oprofile/op_model_ppro.c +2 -0
index 716d26f..e9f80c7 100644
@@ -156,6 +156,8 @@ static void ppro_start(struct op_msrs const * const msrs)
 	unsigned int low, high;
 	int i;
 
+	if (!reset_value)
+		return;
 
 	for (i = 0; i < num_counters; ++i) {
 		if (reset_value[i]) {

Quoted 1 line

CTRL_READ(low, high, msrs, i);

i checked which commit caused this, and it is:

From b99170288421c79f0c2efa8b33e26e65f4bb7fb8 Mon Sep 17 00:00:00 2001
From: Andi Kleen <[email protected]>
Date: Mon, 18 Aug 2008 14:50:31 +0200
Subject: [PATCH] oprofile: Implement Intel architectural perfmon support

it is an absolutely horrible commit - which has caused the second regression in a row already. The _real_ "perfmon support" patch should have been a _oneliner_:

-#define NUM_COUNTERS 2
-#define NUM_CONTROLS 2
+#define NUM_COUNTERS 8
+#define NUM_CONTROLS 8

as Nehalem has 4 performance counters so 8 is plenty - and we dont expect more than 8 in the next 5 years or so.

It was absolutely unnecessary to add kmalloc to this rarely executed codepath - and the way it was added was absolutely horrible as well, it was tacked on in the middle of an existing codepath, instead of factoring it out nicely. Perfmon will eventually replace PMC management anyway, so there was no "this way it's cleaner" argument either. So this code should have been changed minimally, instead of slapping in a full kmalloc for a simple array extension from 2 to 4 entries ...

You need to be more careful when changing x86 architecture code.

Ingo

Robert Richter

2008-12-03 12:01 UTC #2 lore raw

Quoted 19 lines · Ingo Molnar

Quoted 16 lines · Eric Dumazet
If oprofile statically compiled in kernel, a cpu unplug triggers a panic in ppro_stop(), because a NULL pointer is dereferenced.
Signed-off-by Eric Dumazet <[email protected]>
---
arch/x86/oprofile/op_model_ppro.c | 4 ++++
1 files changed, 4 insertions(+)
arch/x86/oprofile/op_model_ppro.c +0 -0
index 716d26f..e9f80c7 100644
@@ -156,6 +156,8 @@ static void ppro_start(struct op_msrs const * const msrs)
 	unsigned int low, high;
 	int i;
 

Quoted 6 lines

Quoted 6 lines
arch/x86/oprofile/op_model_ppro.c +2 -0
+	if (!reset_value)
+		return;
 
 	for (i = 0; i < num_counters; ++i) {
 		if (reset_value[i]) {
CTRL_READ(low, high, msrs, i);

The patch fixes the null pointer access and this ok. But the root cause seems to be in the cpu hotplug and initialization code. xxx_start() should not be called before xxx_setup_ctrs() or after xxx_shutdown(). Also, running only xxx_start() and xxx_stop() in the cpu notifier functions is not sufficient. There is at least some on_each_cpu code in nmi_setup() that should be called also in the cpu notifier functions. I have to review that code.

[...]

Quoted 7 lines

It was absolutely unnecessary to add kmalloc to this rarely executed codepath - and the way it was added was absolutely horrible as well, it was tacked on in the middle of an existing codepath, instead of factoring it out nicely. Perfmon will eventually replace PMC management anyway, so there was no "this way it's cleaner" argument either. So this code should have been changed minimally, instead of slapping in a full kmalloc for a simple array extension from 2 to 4 entries ...

Ingo, you are right that using kmalloc is unnecessary for reset_value. So, Andi, maybe you could make this code easier?

-Robert

Signature · 3 lines

Advanced Micro Devices, Inc.
Operating System Research Center
email: [email protected]

Andi Kleen

2008-12-03 14:08 UTC #3 lore raw

Quoted 21 lines · Robert Richter

Quoted 20 lines · Ingo Molnar
Quoted 18 lines · Eric Dumazet
If oprofile statically compiled in kernel, a cpu unplug triggers a panic in ppro_stop(), because a NULL pointer is dereferenced.
Signed-off-by Eric Dumazet <[email protected]>
---
arch/x86/oprofile/op_model_ppro.c | 4 ++++
1 files changed, 4 insertions(+)
arch/x86/oprofile/op_model_ppro.c +2 -0
index 716d26f..e9f80c7 100644
@@ -156,6 +156,8 @@ static void ppro_start(struct op_msrs const * const msrs)
 	unsigned int low, high;
 	int i;
 
+	if (!reset_value)
+		return;
 

Quoted 8 lines

Quoted 3 lines
Quoted 3 lines
arch/x86/oprofile/op_model_ppro.c +0 -0
 	for (i = 0; i < num_counters; ++i) {
 		if (reset_value[i]) {
CTRL_READ(low, high, msrs, i);
The patch fixes the null pointer access and this ok. But the root cause seems to be in the cpu hotplug and initialization code. xxx_start() should not be called before xxx_setup_ctrs() or after xxx_shutdown().

Yes, it would be better to fix that. At least it would make the code cleaner than the add checks for this backdoor everywhere.

Quoted 4 lines

Also, running only xxx_start() and xxx_stop() in
the cpu notifier functions is not sufficient. There is at least some on_each_cpu code in nmi_setup() that should be called also in the cpu notifier functions. I have to review that code.

AFAIK cpu hotplug has more problems in oprofile anyways. That is why I didn't test that case.

Quoted 7 lines

[...]
Quoted 1 line
It was absolutely unnecessary to add kmalloc to this rarely executed codepath - and the way it was added was absolutely horrible as well, it was tacked on in the middle of an existing codepath, instead of factoring it out nicely. Perfmon will eventually replace PMC management anyway, so there was no "this way it's cleaner" argument either. So this code should have been changed minimally, instead of slapping in a full kmalloc for a simple array extension from 2 to 4 entries ...
Ingo, you are right that using kmalloc is unnecessary for reset_value. So, Andi, maybe you could make this code easier?

The reason I added the kmalloc is that there's also a varying number of separate fixed function counters (although that's not currently submitted).

Also I would prefer to not have a hard coded number for future CPUs. Contrary to other people's opinion architectural perfmon is not for Nehalem only.

-Andi

Robert Richter

2008-12-04 00:13 UTC #4 lore raw

In reply to Eric Dumazet

Quoted 4 lines · Eric Dumazet

If oprofile statically compiled in kernel, a cpu unplug triggers a panic in ppro_stop(), because a NULL pointer is dereferenced.
Signed-off-by Eric Dumazet <[email protected]>

Eric, I applied your patch and it will go upstream for 2.6.28.

Thanks,

-Robert

Signature · 3 lines

Advanced Micro Devices, Inc.
Operating System Research Center
email: [email protected]