2019-05-19 20:08:55 +08:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-only
|
2005-04-17 06:20:36 +08:00
|
|
|
/*
|
|
|
|
* linux/kernel/profile.c
|
|
|
|
* Simple profiling. Manages a direct-mapped profile hit count buffer,
|
|
|
|
* with configurable resolution, support for restricting the cpus on
|
|
|
|
* which profiling is done, and switching between cpu time and
|
|
|
|
* schedule() calls via kernel command line parameters passed at boot.
|
|
|
|
*
|
|
|
|
* Scheduler profiling support, Arjan van de Ven and Ingo Molnar,
|
|
|
|
* Red Hat, July 2004
|
|
|
|
* Consolidation of architecture support code for profiling,
|
2012-12-06 17:39:54 +08:00
|
|
|
* Nadia Yvette Chambers, Oracle, July 2004
|
2005-04-17 06:20:36 +08:00
|
|
|
* Amortized hit count accounting via per-cpu open-addressed hashtables
|
2012-12-06 17:39:54 +08:00
|
|
|
* to resolve timer interrupt livelocks, Nadia Yvette Chambers,
|
|
|
|
* Oracle, 2004
|
2005-04-17 06:20:36 +08:00
|
|
|
*/
|
|
|
|
|
2011-05-24 02:51:41 +08:00
|
|
|
#include <linux/export.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <linux/profile.h>
|
2018-10-31 06:09:49 +08:00
|
|
|
#include <linux/memblock.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <linux/notifier.h>
|
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/cpumask.h>
|
|
|
|
#include <linux/cpu.h>
|
|
|
|
#include <linux/highmem.h>
|
2006-03-23 19:00:24 +08:00
|
|
|
#include <linux/mutex.h>
|
2008-10-16 13:01:46 +08:00
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/vmalloc.h>
|
2017-02-05 19:07:04 +08:00
|
|
|
#include <linux/sched/stat.h>
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
#include <asm/sections.h>
|
IRQ: Maintain regs pointer globally rather than passing to IRQ handlers
Maintain a per-CPU global "struct pt_regs *" variable which can be used instead
of passing regs around manually through all ~1800 interrupt handlers in the
Linux kernel.
The regs pointer is used in few places, but it potentially costs both stack
space and code to pass it around. On the FRV arch, removing the regs parameter
from all the genirq function results in a 20% speed up of the IRQ exit path
(ie: from leaving timer_interrupt() to leaving do_IRQ()).
Where appropriate, an arch may override the generic storage facility and do
something different with the variable. On FRV, for instance, the address is
maintained in GR28 at all times inside the kernel as part of general exception
handling.
Having looked over the code, it appears that the parameter may be handed down
through up to twenty or so layers of functions. Consider a USB character
device attached to a USB hub, attached to a USB controller that posts its
interrupts through a cascaded auxiliary interrupt controller. A character
device driver may want to pass regs to the sysrq handler through the input
layer which adds another few layers of parameter passing.
I've build this code with allyesconfig for x86_64 and i386. I've runtested the
main part of the code on FRV and i386, though I can't test most of the drivers.
I've also done partial conversion for powerpc and MIPS - these at least compile
with minimal configurations.
This will affect all archs. Mostly the changes should be relatively easy.
Take do_IRQ(), store the regs pointer at the beginning, saving the old one:
struct pt_regs *old_regs = set_irq_regs(regs);
And put the old one back at the end:
set_irq_regs(old_regs);
Don't pass regs through to generic_handle_irq() or __do_IRQ().
In timer_interrupt(), this sort of change will be necessary:
- update_process_times(user_mode(regs));
- profile_tick(CPU_PROFILING, regs);
+ update_process_times(user_mode(get_irq_regs()));
+ profile_tick(CPU_PROFILING);
I'd like to move update_process_times()'s use of get_irq_regs() into itself,
except that i386, alone of the archs, uses something other than user_mode().
Some notes on the interrupt handling in the drivers:
(*) input_dev() is now gone entirely. The regs pointer is no longer stored in
the input_dev struct.
(*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does
something different depending on whether it's been supplied with a regs
pointer or not.
(*) Various IRQ handler function pointers have been moved to type
irq_handler_t.
Signed-Off-By: David Howells <dhowells@redhat.com>
(cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)
2006-10-05 21:55:46 +08:00
|
|
|
#include <asm/irq_regs.h>
|
Detach sched.h from mm.h
First thing mm.h does is including sched.h solely for can_do_mlock() inline
function which has "current" dereference inside. By dealing with can_do_mlock()
mm.h can be detached from sched.h which is good. See below, why.
This patch
a) removes unconditional inclusion of sched.h from mm.h
b) makes can_do_mlock() normal function in mm/mlock.c
c) exports can_do_mlock() to not break compilation
d) adds sched.h inclusions back to files that were getting it indirectly.
e) adds less bloated headers to some files (asm/signal.h, jiffies.h) that were
getting them indirectly
Net result is:
a) mm.h users would get less code to open, read, preprocess, parse, ... if
they don't need sched.h
b) sched.h stops being dependency for significant number of files:
on x86_64 allmodconfig touching sched.h results in recompile of 4083 files,
after patch it's only 3744 (-8.3%).
Cross-compile tested on
all arm defconfigs, all mips defconfigs, all powerpc defconfigs,
alpha alpha-up
arm
i386 i386-up i386-defconfig i386-allnoconfig
ia64 ia64-up
m68k
mips
parisc parisc-up
powerpc powerpc-up
s390 s390-up
sparc sparc-up
sparc64 sparc64-up
um-x86_64
x86_64 x86_64-up x86_64-defconfig x86_64-allnoconfig
as well as my two usual configs.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-05-21 05:22:52 +08:00
|
|
|
#include <asm/ptrace.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
struct profile_hit {
|
|
|
|
u32 pc, hits;
|
|
|
|
};
|
|
|
|
#define PROFILE_GRPSHIFT 3
|
|
|
|
#define PROFILE_GRPSZ (1 << PROFILE_GRPSHIFT)
|
|
|
|
#define NR_PROFILE_HIT (PAGE_SIZE/sizeof(struct profile_hit))
|
|
|
|
#define NR_PROFILE_GRP (NR_PROFILE_HIT/PROFILE_GRPSZ)
|
|
|
|
|
|
|
|
static atomic_t *prof_buffer;
|
2021-09-08 10:58:21 +08:00
|
|
|
static unsigned long prof_len;
|
|
|
|
static unsigned short int prof_shift;
|
2007-01-11 15:15:38 +08:00
|
|
|
|
2006-12-07 12:37:24 +08:00
|
|
|
int prof_on __read_mostly;
|
2007-01-11 15:15:38 +08:00
|
|
|
EXPORT_SYMBOL_GPL(prof_on);
|
|
|
|
|
2008-10-16 13:01:46 +08:00
|
|
|
int profile_setup(char *str)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2014-06-07 05:37:30 +08:00
|
|
|
static const char schedstr[] = "schedule";
|
|
|
|
static const char kvmstr[] = "kvm";
|
2022-09-01 08:31:21 +08:00
|
|
|
const char *select = NULL;
|
2005-04-17 06:20:36 +08:00
|
|
|
int par;
|
|
|
|
|
2024-08-04 17:48:10 +08:00
|
|
|
if (!strncmp(str, schedstr, strlen(schedstr))) {
|
2005-04-17 06:20:36 +08:00
|
|
|
prof_on = SCHED_PROFILING;
|
2022-09-01 08:31:21 +08:00
|
|
|
select = schedstr;
|
2007-01-11 15:15:38 +08:00
|
|
|
} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
|
|
|
|
prof_on = KVM_PROFILING;
|
2022-09-01 08:31:21 +08:00
|
|
|
select = kvmstr;
|
2005-05-17 12:53:58 +08:00
|
|
|
} else if (get_option(&str, &par)) {
|
2021-09-08 10:58:21 +08:00
|
|
|
prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
|
2005-04-17 06:20:36 +08:00
|
|
|
prof_on = CPU_PROFILING;
|
2021-09-08 10:58:21 +08:00
|
|
|
pr_info("kernel profiling enabled (shift: %u)\n",
|
2005-04-17 06:20:36 +08:00
|
|
|
prof_shift);
|
|
|
|
}
|
2022-09-01 08:31:21 +08:00
|
|
|
|
|
|
|
if (select) {
|
|
|
|
if (str[strlen(select)] == ',')
|
|
|
|
str += strlen(select) + 1;
|
|
|
|
if (get_option(&str, &par))
|
|
|
|
prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
|
|
|
|
pr_info("kernel %s profiling enabled (shift: %u)\n",
|
|
|
|
select, prof_shift);
|
|
|
|
}
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
__setup("profile=", profile_setup);
|
|
|
|
|
|
|
|
|
2008-10-30 05:01:07 +08:00
|
|
|
int __ref profile_init(void)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2008-10-16 13:01:46 +08:00
|
|
|
int buffer_bytes;
|
2008-01-26 04:08:33 +08:00
|
|
|
if (!prof_on)
|
2008-10-16 13:01:46 +08:00
|
|
|
return 0;
|
2008-01-26 04:08:33 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
/* only text is profiled */
|
|
|
|
prof_len = (_etext - _stext) >> prof_shift;
|
2022-05-31 09:28:54 +08:00
|
|
|
|
|
|
|
if (!prof_len) {
|
|
|
|
pr_warn("profiling shift: %u too large\n", prof_shift);
|
|
|
|
prof_on = 0;
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
2008-10-16 13:01:46 +08:00
|
|
|
buffer_bytes = prof_len*sizeof(atomic_t);
|
|
|
|
|
2009-07-30 06:04:09 +08:00
|
|
|
prof_buffer = kzalloc(buffer_bytes, GFP_KERNEL|__GFP_NOWARN);
|
2008-10-16 13:01:46 +08:00
|
|
|
if (prof_buffer)
|
|
|
|
return 0;
|
|
|
|
|
2009-07-30 06:04:09 +08:00
|
|
|
prof_buffer = alloc_pages_exact(buffer_bytes,
|
|
|
|
GFP_KERNEL|__GFP_ZERO|__GFP_NOWARN);
|
2008-10-16 13:01:46 +08:00
|
|
|
if (prof_buffer)
|
|
|
|
return 0;
|
|
|
|
|
2010-10-31 03:56:26 +08:00
|
|
|
prof_buffer = vzalloc(buffer_bytes);
|
|
|
|
if (prof_buffer)
|
2008-10-16 13:01:46 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
return -ENOMEM;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
2011-05-27 07:26:00 +08:00
|
|
|
static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
unsigned long pc;
|
|
|
|
pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
|
profiling: attempt to remove per-cpu profile flip buffer
This is the really old legacy kernel profiling code, which has long
since been obviated by "real profiling" (ie 'prof' and company), and
mainly remains as a source of syzbot reports.
There are anecdotal reports that people still use it for boot-time
profiling, but it's unlikely that such use would care about the old NUMA
optimizations in this code from 2004 (commit ad02973d42: "profile: 512x
Altix timer interrupt livelock fix" in the BK import archive at [1])
So in order to head off future syzbot reports, let's try to simplify
this code and get rid of the per-cpu profile buffers that are quite a
large portion of the complexity footprint of this thing (including CPU
hotplug callbacks etc).
It's unlikely anybody will actually notice, or possibly, as Thomas put
it: "Only people who indulge in nostalgia will notice :)".
That said, if it turns out that this code is actually actively used by
somebody, we can always revert this removal. Thus the "attempt" in the
summary line.
[ Note: in a small nod to "the profiling code can cause NUMA problems",
this also removes the "increment the last entry in the profiling array
on any unknown hits" logic. That would account any program counter in
a module to that single counter location, and might exacerbate any
NUMA cacheline bouncing issues ]
Link: https://lore.kernel.org/all/CAHk-=wgs52BxT4Zjmjz8aNvHWKxf5_ThBY4bYL1Y6CTaNL2dTw@mail.gmail.com/
Link: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git [1]
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2024-07-30 01:58:28 +08:00
|
|
|
if (pc < prof_len)
|
|
|
|
atomic_add(nr_hits, &prof_buffer[pc]);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
2011-05-27 07:26:00 +08:00
|
|
|
|
|
|
|
void profile_hits(int type, void *__pc, unsigned int nr_hits)
|
|
|
|
{
|
|
|
|
if (prof_on != type || !prof_buffer)
|
|
|
|
return;
|
|
|
|
do_profile_hits(type, __pc, nr_hits);
|
|
|
|
}
|
2007-01-23 12:40:33 +08:00
|
|
|
EXPORT_SYMBOL_GPL(profile_hits);
|
|
|
|
|
IRQ: Maintain regs pointer globally rather than passing to IRQ handlers
Maintain a per-CPU global "struct pt_regs *" variable which can be used instead
of passing regs around manually through all ~1800 interrupt handlers in the
Linux kernel.
The regs pointer is used in few places, but it potentially costs both stack
space and code to pass it around. On the FRV arch, removing the regs parameter
from all the genirq function results in a 20% speed up of the IRQ exit path
(ie: from leaving timer_interrupt() to leaving do_IRQ()).
Where appropriate, an arch may override the generic storage facility and do
something different with the variable. On FRV, for instance, the address is
maintained in GR28 at all times inside the kernel as part of general exception
handling.
Having looked over the code, it appears that the parameter may be handed down
through up to twenty or so layers of functions. Consider a USB character
device attached to a USB hub, attached to a USB controller that posts its
interrupts through a cascaded auxiliary interrupt controller. A character
device driver may want to pass regs to the sysrq handler through the input
layer which adds another few layers of parameter passing.
I've build this code with allyesconfig for x86_64 and i386. I've runtested the
main part of the code on FRV and i386, though I can't test most of the drivers.
I've also done partial conversion for powerpc and MIPS - these at least compile
with minimal configurations.
This will affect all archs. Mostly the changes should be relatively easy.
Take do_IRQ(), store the regs pointer at the beginning, saving the old one:
struct pt_regs *old_regs = set_irq_regs(regs);
And put the old one back at the end:
set_irq_regs(old_regs);
Don't pass regs through to generic_handle_irq() or __do_IRQ().
In timer_interrupt(), this sort of change will be necessary:
- update_process_times(user_mode(regs));
- profile_tick(CPU_PROFILING, regs);
+ update_process_times(user_mode(get_irq_regs()));
+ profile_tick(CPU_PROFILING);
I'd like to move update_process_times()'s use of get_irq_regs() into itself,
except that i386, alone of the archs, uses something other than user_mode().
Some notes on the interrupt handling in the drivers:
(*) input_dev() is now gone entirely. The regs pointer is no longer stored in
the input_dev struct.
(*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does
something different depending on whether it's been supplied with a regs
pointer or not.
(*) Various IRQ handler function pointers have been moved to type
irq_handler_t.
Signed-Off-By: David Howells <dhowells@redhat.com>
(cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)
2006-10-05 21:55:46 +08:00
|
|
|
void profile_tick(int type)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
IRQ: Maintain regs pointer globally rather than passing to IRQ handlers
Maintain a per-CPU global "struct pt_regs *" variable which can be used instead
of passing regs around manually through all ~1800 interrupt handlers in the
Linux kernel.
The regs pointer is used in few places, but it potentially costs both stack
space and code to pass it around. On the FRV arch, removing the regs parameter
from all the genirq function results in a 20% speed up of the IRQ exit path
(ie: from leaving timer_interrupt() to leaving do_IRQ()).
Where appropriate, an arch may override the generic storage facility and do
something different with the variable. On FRV, for instance, the address is
maintained in GR28 at all times inside the kernel as part of general exception
handling.
Having looked over the code, it appears that the parameter may be handed down
through up to twenty or so layers of functions. Consider a USB character
device attached to a USB hub, attached to a USB controller that posts its
interrupts through a cascaded auxiliary interrupt controller. A character
device driver may want to pass regs to the sysrq handler through the input
layer which adds another few layers of parameter passing.
I've build this code with allyesconfig for x86_64 and i386. I've runtested the
main part of the code on FRV and i386, though I can't test most of the drivers.
I've also done partial conversion for powerpc and MIPS - these at least compile
with minimal configurations.
This will affect all archs. Mostly the changes should be relatively easy.
Take do_IRQ(), store the regs pointer at the beginning, saving the old one:
struct pt_regs *old_regs = set_irq_regs(regs);
And put the old one back at the end:
set_irq_regs(old_regs);
Don't pass regs through to generic_handle_irq() or __do_IRQ().
In timer_interrupt(), this sort of change will be necessary:
- update_process_times(user_mode(regs));
- profile_tick(CPU_PROFILING, regs);
+ update_process_times(user_mode(get_irq_regs()));
+ profile_tick(CPU_PROFILING);
I'd like to move update_process_times()'s use of get_irq_regs() into itself,
except that i386, alone of the archs, uses something other than user_mode().
Some notes on the interrupt handling in the drivers:
(*) input_dev() is now gone entirely. The regs pointer is no longer stored in
the input_dev struct.
(*) finish_unlinks() in drivers/usb/host/ohci-q.c needs checking. It does
something different depending on whether it's been supplied with a regs
pointer or not.
(*) Various IRQ handler function pointers have been moved to type
irq_handler_t.
Signed-Off-By: David Howells <dhowells@redhat.com>
(cherry picked from 1b16e7ac850969f38b375e511e3fa2f474a33867 commit)
2006-10-05 21:55:46 +08:00
|
|
|
struct pt_regs *regs = get_irq_regs();
|
|
|
|
|
profiling: remove prof_cpu_mask
syzbot is reporting uninit-value at profile_hits(), for there is a race
window between
if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL))
return -ENOMEM;
cpumask_copy(prof_cpu_mask, cpu_possible_mask);
in profile_init() and
cpumask_available(prof_cpu_mask) &&
cpumask_test_cpu(smp_processor_id(), prof_cpu_mask))
in profile_tick(); prof_cpu_mask remains uninitialzed until cpumask_copy()
completes while cpumask_available(prof_cpu_mask) returns true as soon as
alloc_cpumask_var(&prof_cpu_mask) completes.
We could replace alloc_cpumask_var() with zalloc_cpumask_var() and
call cpumask_copy() from create_proc_profile() on only UP kernels, for
profile_online_cpu() calls cpumask_set_cpu() as needed via
cpuhp_setup_state(CPUHP_AP_ONLINE_DYN) on SMP kernels. But this patch
removes prof_cpu_mask because it seems unnecessary.
The cpumask_test_cpu(smp_processor_id(), prof_cpu_mask) test
in profile_tick() is likely always true due to
a CPU cannot call profile_tick() if that CPU is offline
and
cpumask_set_cpu(cpu, prof_cpu_mask) is called when that CPU becomes
online and cpumask_clear_cpu(cpu, prof_cpu_mask) is called when that
CPU becomes offline
. This test could be false during transition between online and offline.
But according to include/linux/cpuhotplug.h , CPUHP_PROFILE_PREPARE
belongs to PREPARE section, which means that the CPU subjected to
profile_dead_cpu() cannot be inside profile_tick() (i.e. no risk of
use-after-free bug) because interrupt for that CPU is disabled during
PREPARE section. Therefore, this test is guaranteed to be true, and
can be removed. (Since profile_hits() checks prof_buffer != NULL, we
don't need to check prof_buffer != NULL here unless get_irq_regs() or
user_mode() is such slow that we want to avoid when prof_buffer == NULL).
do_profile_hits() is called from profile_tick() from timer interrupt
only if cpumask_test_cpu(smp_processor_id(), prof_cpu_mask) is true and
prof_buffer is not NULL. But syzbot is also reporting that sometimes
do_profile_hits() is called while current thread is still doing vzalloc(),
where prof_buffer must be NULL at this moment. This indicates that multiple
threads concurrently tried to write to /sys/kernel/profiling interface,
which caused that somebody else try to re-allocate prof_buffer despite
somebody has already allocated prof_buffer. Fix this by using
serialization.
Reported-by: syzbot <syzbot+b1a83ab2a9eb9321fbdd@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=b1a83ab2a9eb9321fbdd
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+b1a83ab2a9eb9321fbdd@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2024-07-27 18:59:57 +08:00
|
|
|
/* This is the old kernel-only legacy profiling */
|
|
|
|
if (!user_mode(regs))
|
2005-04-17 06:20:36 +08:00
|
|
|
profile_hit(type, (void *)profile_pc(regs));
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
|
|
#include <linux/proc_fs.h>
|
2009-09-19 03:57:09 +08:00
|
|
|
#include <linux/seq_file.h>
|
2016-12-25 03:46:01 +08:00
|
|
|
#include <linux/uaccess.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This function accesses profiling information. The returned data is
|
|
|
|
* binary: the sampling step and the actual contents of the profile
|
|
|
|
* buffer. Use of the program readprofile is recommended in order to
|
|
|
|
* get meaningful info out of these data.
|
|
|
|
*/
|
|
|
|
static ssize_t
|
|
|
|
read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
|
|
|
|
{
|
|
|
|
unsigned long p = *ppos;
|
|
|
|
ssize_t read;
|
2008-01-26 04:08:33 +08:00
|
|
|
char *pnt;
|
2021-09-08 10:58:21 +08:00
|
|
|
unsigned long sample_step = 1UL << prof_shift;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
if (p >= (prof_len+1)*sizeof(unsigned int))
|
|
|
|
return 0;
|
|
|
|
if (count > (prof_len+1)*sizeof(unsigned int) - p)
|
|
|
|
count = (prof_len+1)*sizeof(unsigned int) - p;
|
|
|
|
read = 0;
|
|
|
|
|
|
|
|
while (p < sizeof(unsigned int) && count > 0) {
|
2008-01-26 04:08:33 +08:00
|
|
|
if (put_user(*((char *)(&sample_step)+p), buf))
|
2006-12-07 12:36:37 +08:00
|
|
|
return -EFAULT;
|
2005-04-17 06:20:36 +08:00
|
|
|
buf++; p++; count--; read++;
|
|
|
|
}
|
|
|
|
pnt = (char *)prof_buffer + p - sizeof(atomic_t);
|
2008-01-26 04:08:33 +08:00
|
|
|
if (copy_to_user(buf, (void *)pnt, count))
|
2005-04-17 06:20:36 +08:00
|
|
|
return -EFAULT;
|
|
|
|
read += count;
|
|
|
|
*ppos += read;
|
|
|
|
return read;
|
|
|
|
}
|
|
|
|
|
2022-07-22 03:55:09 +08:00
|
|
|
/* default is to not implement this call */
|
|
|
|
int __weak setup_profiling_timer(unsigned mult)
|
|
|
|
{
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
/*
|
|
|
|
* Writing to /proc/profile resets the counters
|
|
|
|
*
|
|
|
|
* Writing a 'profiling multiplier' value into it also re-sets the profiling
|
|
|
|
* interrupt frequency, on architectures that support this.
|
|
|
|
*/
|
|
|
|
static ssize_t write_profile(struct file *file, const char __user *buf,
|
|
|
|
size_t count, loff_t *ppos)
|
|
|
|
{
|
|
|
|
#ifdef CONFIG_SMP
|
|
|
|
if (count == sizeof(int)) {
|
|
|
|
unsigned int multiplier;
|
|
|
|
|
|
|
|
if (copy_from_user(&multiplier, buf, sizeof(int)))
|
|
|
|
return -EFAULT;
|
|
|
|
|
|
|
|
if (setup_profiling_timer(multiplier))
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
|
|
|
|
return count;
|
|
|
|
}
|
|
|
|
|
2020-02-04 09:37:17 +08:00
|
|
|
static const struct proc_ops profile_proc_ops = {
|
|
|
|
.proc_read = read_profile,
|
|
|
|
.proc_write = write_profile,
|
|
|
|
.proc_lseek = default_llseek,
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
2016-07-14 01:16:59 +08:00
|
|
|
int __ref create_proc_profile(void)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2016-07-14 01:16:59 +08:00
|
|
|
struct proc_dir_entry *entry;
|
2014-03-11 04:42:08 +08:00
|
|
|
int err = 0;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
if (!prof_on)
|
|
|
|
return 0;
|
2008-04-29 16:02:31 +08:00
|
|
|
entry = proc_create("profile", S_IWUSR | S_IRUGO,
|
2020-02-04 09:37:17 +08:00
|
|
|
NULL, &profile_proc_ops);
|
profiling: remove prof_cpu_mask
syzbot is reporting uninit-value at profile_hits(), for there is a race
window between
if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL))
return -ENOMEM;
cpumask_copy(prof_cpu_mask, cpu_possible_mask);
in profile_init() and
cpumask_available(prof_cpu_mask) &&
cpumask_test_cpu(smp_processor_id(), prof_cpu_mask))
in profile_tick(); prof_cpu_mask remains uninitialzed until cpumask_copy()
completes while cpumask_available(prof_cpu_mask) returns true as soon as
alloc_cpumask_var(&prof_cpu_mask) completes.
We could replace alloc_cpumask_var() with zalloc_cpumask_var() and
call cpumask_copy() from create_proc_profile() on only UP kernels, for
profile_online_cpu() calls cpumask_set_cpu() as needed via
cpuhp_setup_state(CPUHP_AP_ONLINE_DYN) on SMP kernels. But this patch
removes prof_cpu_mask because it seems unnecessary.
The cpumask_test_cpu(smp_processor_id(), prof_cpu_mask) test
in profile_tick() is likely always true due to
a CPU cannot call profile_tick() if that CPU is offline
and
cpumask_set_cpu(cpu, prof_cpu_mask) is called when that CPU becomes
online and cpumask_clear_cpu(cpu, prof_cpu_mask) is called when that
CPU becomes offline
. This test could be false during transition between online and offline.
But according to include/linux/cpuhotplug.h , CPUHP_PROFILE_PREPARE
belongs to PREPARE section, which means that the CPU subjected to
profile_dead_cpu() cannot be inside profile_tick() (i.e. no risk of
use-after-free bug) because interrupt for that CPU is disabled during
PREPARE section. Therefore, this test is guaranteed to be true, and
can be removed. (Since profile_hits() checks prof_buffer != NULL, we
don't need to check prof_buffer != NULL here unless get_irq_regs() or
user_mode() is such slow that we want to avoid when prof_buffer == NULL).
do_profile_hits() is called from profile_tick() from timer interrupt
only if cpumask_test_cpu(smp_processor_id(), prof_cpu_mask) is true and
prof_buffer is not NULL. But syzbot is also reporting that sometimes
do_profile_hits() is called while current thread is still doing vzalloc(),
where prof_buffer must be NULL at this moment. This indicates that multiple
threads concurrently tried to write to /sys/kernel/profiling interface,
which caused that somebody else try to re-allocate prof_buffer despite
somebody has already allocated prof_buffer. Fix this by using
serialization.
Reported-by: syzbot <syzbot+b1a83ab2a9eb9321fbdd@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=b1a83ab2a9eb9321fbdd
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+b1a83ab2a9eb9321fbdd@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2024-07-27 18:59:57 +08:00
|
|
|
if (entry)
|
|
|
|
proc_set_size(entry, (1 + prof_len) * sizeof(atomic_t));
|
2014-03-11 04:42:08 +08:00
|
|
|
return err;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
2014-04-04 05:48:35 +08:00
|
|
|
subsys_initcall(create_proc_profile);
|
2005-04-17 06:20:36 +08:00
|
|
|
#endif /* CONFIG_PROC_FS */
|