linux-toradex.git/drivers/oprofile, branch tegra

oprofile: Fix uninitialized memory access when writing to writing to oprofilefs

2012-01-11T17:30:03+00:00

commit 913050b91eb94f194392dd797b1ff3779f606ac0 upstream.

If oprofilefs_ulong_from_user() is called with count equals
zero, *val remains unchanged. Depending on the implementation it
might be uninitialized.

Change oprofilefs_ulong_from_user()'s interface to return count
on success. Thus, we are able to return early if count equals
zero which avoids using *val uninitialized. Fixing all users of
oprofilefs_ulong_ from_user().

This follows write syscall implementation when count is zero:
"If count is zero ... [and if] no errors are detected, 0 will be
returned without causing any other effect." (man 2 write)

Reported-By: Mike Waychison 
Signed-off-by: Robert Richter 
Cc: Andrew Morton 
Cc: oprofile-list 
Link: http://lkml.kernel.org/r/20111219153830.GH16765@erda.amd.com
Signed-off-by: Ingo Molnar 
Signed-off-by: Greg Kroah-Hartman 

Change-Id: Ic9b5dd12ec6e93b609b0e61acd02944352cd436d
Reviewed-on: http://git-master/r/74177
Reviewed-by: Varun Wadekar 
Tested-by: Varun Wadekar

oprofile: Fix crash when unloading module (hr timer mode)

2011-12-09T16:55:55+00:00

commit 87121ca504fd1d963a66b3fb0c72054b0fd9a177 upstream.

Oprofile may crash in a KVM guest while unlaoding modules. This
happens if oprofile_arch_init() fails and oprofile switches to the hr
timer mode as a fallback. In this case oprofile_arch_exit() is called,
but it never was initialized properly which causes the crash. This
patch fixes this.

oprofile: using timer interrupt.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [] unregister_syscore_ops+0x41/0x58
PGD 41da3f067 PUD 41d80e067 PMD 0
Oops: 0002 [#1] PREEMPT SMP
CPU 5
Modules linked in: oprofile(-)

Pid: 2382, comm: modprobe Not tainted 3.1.0-rc7-00018-g709a39d #18 Advanced Micro Device Anaheim/Anaheim
RIP: 0010:[]  [] unregister_syscore_ops+0x41/0x58
RSP: 0018:ffff88041de1de98  EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffffffffa00060e0 RCX: dead000000200200
RDX: 0000000000000000 RSI: dead000000100100 RDI: ffffffff8178c620
RBP: ffff88041de1dea8 R08: 0000000000000001 R09: 0000000000000082
R10: 0000000000000000 R11: ffff88041de1dde8 R12: 0000000000000080
R13: fffffffffffffff5 R14: 0000000000000001 R15: 0000000000610210
FS:  00007f9ae5bef700(0000) GS:ffff88042fd40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000008 CR3: 000000041ca44000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process modprobe (pid: 2382, threadinfo ffff88041de1c000, task ffff88042db6d040)
Stack:
 ffff88041de1deb8 ffffffffa0006770 ffff88041de1deb8 ffffffffa000251e
 ffff88041de1dec8 ffffffffa00022c2 ffff88041de1ded8 ffffffffa0004993
 ffff88041de1df78 ffffffff81073115 656c69666f72706f 0000000000610200
Call Trace:
 [] op_nmi_exit+0x15/0x17 [oprofile]
 [] oprofile_arch_exit+0xe/0x10 [oprofile]
 [] oprofile_exit+0x13/0x15 [oprofile]
 [] sys_delete_module+0x1c3/0x22f
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b
Code: 20 c6 78 81 e8 c5 cc 23 00 48 8b 13 48 8b 43 08 48 be 00 01 10 00 00 00 ad de 48 b9 00 02 20 00 00 00 ad de 48 c7 c7 20 c6 78 81
 89 42 08 48 89 10 48 89 33 48 89 4b 08 e8 a6 c0 23 00 5a 5b
RIP  [] unregister_syscore_ops+0x41/0x58
 RSP 
CR2: 0000000000000008
---[ end trace 06d4e95b6aa3b437 ]---

Signed-off-by: Robert Richter 
Signed-off-by: Greg Kroah-Hartman

atomic: use

2011-07-26T23:49:47+00:00

This allows us to move duplicated code in 
(atomic_inc_not_zero() for now) to 

Signed-off-by: Arun Sharma 
Reviewed-by: Eric Dumazet 
Cc: Ingo Molnar 
Cc: David Miller 
Cc: Eric Dumazet 
Acked-by: Mike Frysinger 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

perf: Remove the nmi parameter from the oprofile_perf backend

2011-07-21T18:41:58+00:00

In commit a8b0ca17b80e ("perf: Remove the nmi parameter from the
swevent and overflow interface") one site was overlooked.

Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/20110708173442.GB31972@e102144-lin.cambridge.arm.com
Signed-off-by: Ingo Molnar

perf: Add context field to perf_event

2011-07-01T09:06:38+00:00

The perf_event overflow handler does not receive any caller-derived
argument, so many callers need to resort to looking up the perf_event
in their local data structure.  This is ugly and doesn't scale if a
single callback services many perf_events.

Fix by adding a context parameter to perf_event_create_kernel_counter()
(and derived hardware breakpoints APIs) and storing it in the perf_event.
The field can be accessed from the callback as event->overflow_handler_context.
All callers are updated.

Signed-off-by: Avi Kivity 
Signed-off-by: Peter Zijlstra 
Link: http://lkml.kernel.org/r/1309362157-6596-2-git-send-email-avi@redhat.com
Signed-off-by: Ingo Molnar

oprofile: Fix locking dependency in sync_start()

2011-05-31T14:33:34+00:00

This fixes the A->B/B->A locking dependency, see the warning below.

The function task_exit_notify() is called with (task_exit_notifier)
.rwsem set and then calls sync_buffer() which locks buffer_mutex. In
sync_start() the buffer_mutex was set to prevent notifier functions to
be started before sync_start() is finished. But when registering the
notifier, (task_exit_notifier).rwsem is locked too, but now in
different order than in sync_buffer(). In theory this causes a locking
dependency, what does not occur in practice since task_exit_notify()
is always called after the notifier is registered which means the lock
is already released.

However, after checking the notifier functions it turned out the
buffer_mutex in sync_start() is unnecessary. This is because
sync_buffer() may be called from the notifiers even if sync_start()
did not finish yet, the buffers are already allocated but empty. No
need to protect this with the mutex.

So we fix this theoretical locking dependency by removing buffer_mutex
in sync_start(). This is similar to the implementation before commit:

 750d857 oprofile: fix crash when accessing freed task structs

which introduced the locking dependency.

Lockdep warning:

oprofiled/4447 is trying to acquire lock:
 (buffer_mutex){+.+...}, at: [] sync_buffer+0x31/0x3ec [oprofile]

but task is already holding lock:
 ((task_exit_notifier).rwsem){++++..}, at: [] __blocking_notifier_call_chain+0x39/0x67

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 ((task_exit_notifier).rwsem){++++..}:
       [] lock_acquire+0xf8/0x11e
       [] down_write+0x44/0x67
       [] blocking_notifier_chain_register+0x52/0x8b
       [] profile_event_register+0x2d/0x2f
       [] sync_start+0x47/0xc6 [oprofile]
       [] oprofile_setup+0x60/0xa5 [oprofile]
       [] event_buffer_open+0x59/0x8c [oprofile]
       [] __dentry_open+0x1eb/0x308
       [] nameidata_to_filp+0x60/0x67
       [] do_last+0x5be/0x6b2
       [] path_openat+0xc7/0x360
       [] do_filp_open+0x3d/0x8c
       [] do_sys_open+0x110/0x1a9
       [] sys_open+0x20/0x22
       [] system_call_fastpath+0x16/0x1b

-> #0 (buffer_mutex){+.+...}:
       [] __lock_acquire+0x1085/0x1711
       [] lock_acquire+0xf8/0x11e
       [] mutex_lock_nested+0x63/0x309
       [] sync_buffer+0x31/0x3ec [oprofile]
       [] task_exit_notify+0x16/0x1a [oprofile]
       [] notifier_call_chain+0x37/0x63
       [] __blocking_notifier_call_chain+0x50/0x67
       [] blocking_notifier_call_chain+0x14/0x16
       [] profile_task_exit+0x1a/0x1c
       [] do_exit+0x2a/0x6fc
       [] do_group_exit+0x83/0xae
       [] sys_exit_group+0x17/0x1b
       [] system_call_fastpath+0x16/0x1b

other info that might help us debug this:

1 lock held by oprofiled/4447:
 #0:  ((task_exit_notifier).rwsem){++++..}, at: [] __blocking_notifier_call_chain+0x39/0x67

stack backtrace:
Pid: 4447, comm: oprofiled Not tainted 2.6.39-00007-gcf4d8d4 #10
Call Trace:
 [] print_circular_bug+0xae/0xbc
 [] __lock_acquire+0x1085/0x1711
 [] ? sync_buffer+0x31/0x3ec [oprofile]
 [] lock_acquire+0xf8/0x11e
 [] ? sync_buffer+0x31/0x3ec [oprofile]
 [] ? mark_lock+0x42f/0x552
 [] ? sync_buffer+0x31/0x3ec [oprofile]
 [] mutex_lock_nested+0x63/0x309
 [] ? sync_buffer+0x31/0x3ec [oprofile]
 [] sync_buffer+0x31/0x3ec [oprofile]
 [] ? __blocking_notifier_call_chain+0x39/0x67
 [] ? __blocking_notifier_call_chain+0x39/0x67
 [] task_exit_notify+0x16/0x1a [oprofile]
 [] notifier_call_chain+0x37/0x63
 [] __blocking_notifier_call_chain+0x50/0x67
 [] blocking_notifier_call_chain+0x14/0x16
 [] profile_task_exit+0x1a/0x1c
 [] do_exit+0x2a/0x6fc
 [] ? retint_swapgs+0xe/0x13
 [] do_group_exit+0x83/0xae
 [] sys_exit_group+0x17/0x1b
 [] system_call_fastpath+0x16/0x1b

Reported-by: Marcin Slusarz 
Cc: Carl Love 
Cc:  # .36+
Signed-off-by: Robert Richter

oprofile: Free potentially owned tasks in case of errors

2011-05-31T14:33:33+00:00

After registering the task free notifier we possibly have tasks in our
dying_tasks list. Free them after unregistering the notifier in case
of an error.

Cc:  # .36+
Signed-off-by: Robert Richter

oprofile: Use linux/mutex.h

2011-05-24T10:45:59+00:00

The oprofile code is still including asm/mutex.h instead of
linux/mutex.h.

Signed-off-by: Anton Blanchard 
Signed-off-by: Robert Richter

oprofile, s390: Rework hwsampler implementation

2011-02-15T10:10:20+00:00

This patch is a rework of the hwsampler oprofile implementation that
has been applied recently. Now there are less non-architectural
changes. The only changes are:

* introduction of oprofile_add_ext_hw_sample(), and
* removal of section attributes of oprofile_timer_init/_exit().

To setup hwsampler for oprofile we need to modify start()/stop()
callbacks and additional hwsampler control files in oprofilefs. We do
not reinitialize the timer or hwsampler mode by restarting calling
init/exit() anymore, instead hwsampler_running is used to switch the
mode directly in oprofile_hwsampler_start/_stop(). For locking reasons
there is also hwsampler_file that reflects the value in oprofilefs.

The overall diffstat of the oprofile s390 hwsampler implemenation
shows the low impact to non-architectural code:

 arch/Kconfig                         |    3 +
 arch/s390/Kconfig                    |    1 +
 arch/s390/oprofile/Makefile          |    2 +-
 arch/s390/oprofile/hwsampler.c       | 1256 ++++++++++++++++++++++++++++++++++
 arch/s390/oprofile/hwsampler.h       |  113 +++
 arch/s390/oprofile/hwsampler_files.c |  162 +++++
 arch/s390/oprofile/init.c            |    6 +-
 drivers/oprofile/cpu_buffer.c        |   24 +-
 drivers/oprofile/timer_int.c         |    4 +-
 include/linux/oprofile.h             |    7 +
 10 files changed, 1567 insertions(+), 11 deletions(-)

Acked-by: Heiko Carstens 
Signed-off-by: Robert Richter

oprofile, s390: Enhance OProfile to support System zs hardware sampling feature

2011-02-15T10:08:50+00:00

OProfile is enhanced to export all files for controlling System z's
hardware sampling, and to invoke hwsampler exported functions to
initialize and use System z's hardware sampling.

The patch invokes hwsampler_setup() during oprofile init and exports
following hwsampler files under oprofilefs if hwsampler's setup
succeeded:

A new directory for hardware sampling based files

 /dev/oprofile/hwsampling/

The userland daemon must explicitly write to the following files
to disable (or enable) hardware based sampling

 /dev/oprofile/hwsampling/hwsampler

to modify the actual sampling rate

 /dev/oprofile/hwsampling/hw_interval

to modify the amount of sampling memory (measured in 4K pages)

 /dev/oprofile/hwsampling/hw_sdbt_blocks

The following files are read only and show
the possible minimum sampling rate

 /dev/oprofile/hwsampling/hw_min_interval

the possible maximum sampling rate

 /dev/oprofile/hwsampling/hw_max_interval

The patch splits the oprofile_timer_[init/exit] function so that it
can be also called through user context (oprofilefs) to avoid kernel
oops.

Applied with following changes:
* whitespace changes in Makefile and timer_int.c

Signed-off-by: Mahesh Salgaonkar 
Signed-off-by: Maran Pakkirisamy 
Signed-off-by: Heinz Graalfs 
Acked-by: Heiko Carstens 
Signed-off-by: Robert Richter