Bug 253687 - [hwpmc] kernel panic when listing available hardware performance counters
Summary: [hwpmc] kernel panic when listing available hardware performance counters
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 13.0-STABLE
Hardware: amd64 Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: hwpmc, panic, regression
Depends on:
Blocks:
 
Reported: 2021-02-19 10:14 UTC by Zhenlei Huang
Modified: 2021-06-09 03:25 UTC (History)
5 users (show)

See Also:


Attachments
FreeBSD 13.0 BETA2 hwpmc core dump text (61.49 KB, text/plain)
2021-02-19 10:14 UTC, Zhenlei Huang
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Zhenlei Huang 2021-02-19 10:14:05 UTC
Created attachment 222630 [details]
FreeBSD 13.0 BETA2 hwpmc core dump text

Steps to repeat:

1. Fresh install FreeBSD 13.0 BETA2 on Fusion 12.1.0 VM (FreeBSD 12 64bit guest type).
2. kldload hwpmc
3. pmccontrol -l

Kernel panic core dump text summary:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0xc
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff82c25a90
stack pointer           = 0x0:0xfffffe007c8ed9b0
frame pointer           = 0x0:0xfffffe007c8edac0
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 832 (pmccontrol)
trap number             = 12
panic: page fault
cpuid = 0
time = 1613757734
KDB: stack backtrace:
#0 0xffffffff80c56695 at kdb_backtrace+0x65
#1 0xffffffff80c09261 at vpanic+0x181
#2 0xffffffff80c090d3 at panic+0x43
#3 0xffffffff810891a7 at trap_fatal+0x387
#4 0xffffffff810891ff at trap_pfault+0x4f
#5 0xffffffff8108885d at trap+0x27d
#6 0xffffffff8105fc38 at calltrap+0x8
#7 0xffffffff8108a0f5 at amd64_syscall+0x755
#8 0xffffffff8106055e at fast_syscall_common+0xf8
Uptime: 1m34s
Dumping 174 out of 471 MB:..10%..19%..28%..37%..46%..56%..65%..74%..83%..92%
Comment 1 John-Mark Gurney freebsd_committer 2021-03-02 01:35:26 UTC
Can you get a back trace for the exact line number of the functions?

Also, the panic happens in an odd place, not where I'd expect such a panic to happen.
Comment 2 Zhenlei Huang 2021-03-02 02:57:57 UTC
(kgdb) bt
#0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:55
#1  doadump (textdump=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:399
#2  0xffffffff80c08e56 in kern_reboot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:486
#3  0xffffffff80c092d0 in vpanic (fmt=<optimized out>, ap=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:919
#4  0xffffffff80c090d3 in panic (fmt=<unavailable>) at /usr/src/sys/kern/kern_shutdown.c:843
#5  0xffffffff810891a7 in trap_fatal (frame=0xfffffe007c8ed8f0, eva=12) at /usr/src/sys/amd64/amd64/trap.c:915
#6  0xffffffff810891ff in trap_pfault (frame=frame@entry=0xfffffe007c8ed8f0, usermode=false, signo=<optimized out>, signo@entry=0x0, ucode=<optimized out>, 
    ucode@entry=0x0) at /usr/src/sys/amd64/amd64/trap.c:732
#7  0xffffffff8108885d in trap (frame=0xfffffe007c8ed8f0) at /usr/src/sys/amd64/amd64/trap.c:398
#8  <signal handler called>
#9  pmc_syscall_handler (td=<optimized out>, syscall_args=<optimized out>) at /usr/src/sys/dev/hwpmc/hwpmc_mod.c:3679
#10 0xffffffff8108a0f5 in syscallenter (td=0xfffffe007d395700) at /usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:161
#11 amd64_syscall (td=0xfffffe007d395700, traced=0) at /usr/src/sys/amd64/amd64/trap.c:1156
#12 <signal handler called>
#13 0x00000008009bc48a in ?? ()
Backtrace stopped: Cannot access memory at address 0x7fffffffe9c8
(kgdb) frame 9
#9  pmc_syscall_handler (td=<optimized out>, syscall_args=<optimized out>) at /usr/src/sys/dev/hwpmc/hwpmc_mod.c:3679
3679				if ((error = pcd->pcd_describe(cpu, ari, p, &pm)) != 0)
(kgdb) print pcd
$5 = (struct pmc_classdep *) 0x0
(kgdb)
Comment 3 Zhenlei Huang 2021-03-02 04:47:58 UTC
Some additional debug info:

(kgdb) print md->pmd_npmc
$1 = 33
(kgdb) print p - pmcinfo
$2 = 24
(kgdb) print pmc_rowindex_to_classdep[23]
$3 = (struct pmc_classdep *) 0xfffff8000440a5a0
(kgdb) print pmc_rowindex_to_classdep[24]
$4 = (struct pmc_classdep *) 0x0
(kgdb) print pmc_rowindex_to_classdep[25]
$5 = (struct pmc_classdep *) 0x0
(kgdb) print pmc_rowindex_to_classdep[26]
$6 = (struct pmc_classdep *) 0x0
(kgdb) print pmc_rowindex_to_classdep[27]
$7 = (struct pmc_classdep *) 0x0
(kgdb) print pmc_rowindex_to_classdep[28]
$8 = (struct pmc_classdep *) 0x0
(kgdb) print pmc_rowindex_to_classdep[29]
$9 = (struct pmc_classdep *) 0x0
(kgdb) print pmc_rowindex_to_classdep[30]
$10 = (struct pmc_classdep *) 0x0
(kgdb) print pmc_rowindex_to_classdep[31]
$11 = (struct pmc_classdep *) 0x0
(kgdb) print pmc_rowindex_to_classdep[32]
$12 = (struct pmc_classdep *) 0x0
(kgdb)

Hope it helps.
Comment 4 Zhenlei Huang 2021-03-09 05:07:20 UTC
It is still an issue on FreeBSD 13.0-RC1 .