** Description changed:
- Description:
+ [Impact]
+
+ s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
+ The command 'perf stat -e cycles -- <command>' crashes the kernel
+ when CPUs are hotplug added during that run.
+
+ Root cause is the allocation of struct cpu_cf_events at first
+ event initialization. The allocation is dynamic and the first
+ event that has task context creates such a structure for
+ each online CPU. This is not sufficient. CPUs may be offline
+ during event creation and can be set online during the
+ perf run time. For example commands
+
+ # echo 0 > /sys/devices/system/cpu/cpu1/online
+ # perf stat -e cycles -i -- stress-ng -t10s --matrix X
+ # sleep 1
+ # echo 1 > /sys/devices/system/cpu/cpu1/online
+
+ create an event for CPUs 0,2-X. Since the events are created with
+ task-context, the scheduler will eventually schedule the program
+ on CPU1. This CPU has not created and initialized any per
+ CPU event infrastructure as that CPU was not online at the time
+ of the perf invocation. Thus when the scheduler runs stress-ng
+ on CPU1, the function cpumf_pmu_add() refers to a NULL pointer:
+
+ struct cpu_cf_events *cpuhw = this_cpu_cfhw();
+
+ This function call is invoked after the task stress-ng has been
+ made runnable on CPU1. And this_cpu_cfhw() returns NULL.
+
+ The result is a panic.
+
+ The issue arises only in per-task context when the CPUMF facility is
+ used and the scheduler picks a random CPU for such a process to run on.
+ The scheduler enables the CPUMF infrastructure via PMU callback
+ functions pmu::add() and pmu::del().
+
+ Introduce a CPU hotplug prepare/dead callback pair which creates and
+ removes the per CPU counter data while the CPU is offline. Count the
+ users which track every CPU (cpu == -1), that is perf_event_open()
+ events with task context and /dev/hwctr device sessions, in the new
+ counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex.
+ This ensures the infrastructure is available when
+ new CPU is selected to run the per-task context process.
+
+ In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference
+ pointer to data structures is set to NULL before the data is freed
+ to prevent interrupt handlers to access stale data.
+
+ [Fix]
+
+ Backport commit:
+ - 337bd95507a1 ("s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks")
+
+ [Test Plan]
+
+ Run the following commands:
+ # echo 0 > /sys/devices/system/cpu/cpu1/online
+ # perf stat -e cycles -i -- stress-ng -t10s --matrix X
+ # sleep 1
+ # echo 1 > /sys/devices/system/cpu/cpu1/online
+
+ [Regression Potential]
+
+ The change is confined to arch/s390/kernel/perf_cpum_cf.c,
+ affecting only s390 systems using the CPU-Measurement Counter Facility PMU.
+ It reworks locking and reference counting and adds two new CPU hotplug
callbacks
+ that now run on every hotplug transition on affected systems.
+ A bookkeeping mismatch in the new tskctx counter or a lock-ordering error
+ could reintroduce use-after-free or refcount bugs similar to the one being
fixed.
+
+ ---
+
+ Description:
kernel: CPU hotplug unsupported by CPUMF
- Symptom:
+ Symptom:
The kernel crashes with a panic when CPU hotplug add is triggered during
execution of command 'perf stat -- <command>' on LPAR. z/VM is not affected.
- Problem:
+ Problem:
CPU hotplug add does not allocate memory and does not initialise per-CPU
variables required by the PMU device driver.
- Reproduction:
+ Reproduction:
Run the following commands
# echo 0 > /sys/devices/system/cpu/cpu1/online
# perf stat -e cycles -i -- stress-ng -t10s --matrix X
# sleep 1
# echo 1 > /sys/devices/system/cpu/cpu1/online
- Solution:
+ Solution:
Install CPU hotplug handler function to support CPU hotplug add and delete
operations.
- Upstream-ID:
+ Upstream-ID:
ddd52d6c635a2dc628a238c637d928425b0e3f53
** Changed in: linux (Ubuntu)
Status: New => Invalid
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2165732
Title:
[UBUNTU 24.04] kernel: CPU hotplug unsupported by CPUMF
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/2165732/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
