From: Guixin Liu <kanie@linux.alibaba.com>
To: Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@redhat.com>,
Arnaldo Carvalho de Melo <acme@kernel.org>,
Namhyung Kim <namhyung@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Alexander Shishkin <alexander.shishkin@linux.intel.com>,
Jiri Olsa <jolsa@kernel.org>, Ian Rogers <irogers@google.com>,
Adrian Hunter <adrian.hunter@intel.com>,
James Clark <james.clark@linaro.org>,
Thomas Gleixner <tglx@kernel.org>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
hpa@zytor.com, Kan Liang <kan.liang@linux.intel.com>
Cc: x86@kernel.org, linux-perf-users@vger.kernel.org,
Xunlei Pang <xlpang@linux.alibaba.com>,
oliver.yang@linux.alibaba.com
Subject: [PATCH] perf/x86/intel/uncore: Re-register PMU on PCI device hot-add
Date: Thu, 16 Apr 2026 13:45:49 +0800 [thread overview]
Message-ID: <20260416054549.45585-1-kanie@linux.alibaba.com> (raw)
When an uncore PCI device is removed and then rescanned back, the PMU
and its associated box are unregistered during removal but never
re-registered during the rescan. This causes a NULL pointer dereference
(on box) when the device is removed again.
Reproduction steps:
1. Boot the system with uncore PCI devices enumerated
2. Remove an uncore PCI device (e.g., via sysfs or physical removal)
- BUS_NOTIFY_DEL_DEVICE triggers uncore_pci_pmu_unregister()
- pmu->boxes[die] is set to NULL and the box is freed
3. Rescan the PCI bus to re-enumerate the device
- The PCI device appears again, but uncore does not re-register
the PMU/box because uncore_pci_pmus_register() only runs during
module initialization, not on PCI hotplug events
4. Remove the device again
- BUS_NOTIFY_DEL_DEVICE triggers uncore_pci_pmu_unregister()
- box = pmu->boxes[die] returns NULL → BUG() / crash
Root cause:
The uncore subsystem only registers PMUs and boxes during module
initialization (uncore_pci_pmus_register). It does not handle PCI
hotplug/rescan events to re-register PMUs when devices reappear.
Fix:
Extend the uncore PCI bus notifier to handle BUS_NOTIFY_ADD_DEVICE
events. When a previously-registered uncore PCI device is re-added,
call uncore_pci_pmu_register() to recreate the box and restore the
PMU state. This ensures that subsequent removal operations work
correctly.
Fixes: 42839ef4a20a ("perf/x86/intel/uncore: Generic support for the PCI type of uncore blocks")
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
arch/x86/events/intel/uncore.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 786bd51a0d89..211318733a35 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -1272,8 +1272,7 @@ static int uncore_bus_notify(struct notifier_block *nb,
struct intel_uncore_pmu *pmu;
int die;
- /* Unregister the PMU when the device is going to be deleted. */
- if (action != BUS_NOTIFY_DEL_DEVICE)
+ if (action != BUS_NOTIFY_DEL_DEVICE && action != BUS_NOTIFY_ADD_DEVICE)
return NOTIFY_DONE;
pmu = uncore_pci_find_dev_pmu(pdev, ids);
@@ -1283,7 +1282,16 @@ static int uncore_bus_notify(struct notifier_block *nb,
if (uncore_pci_get_dev_die_info(pdev, &die))
return NOTIFY_DONE;
- uncore_pci_pmu_unregister(pmu, die);
+ switch (action) {
+ case BUS_NOTIFY_DEL_DEVICE:
+ uncore_pci_pmu_unregister(pmu, die);
+ break;
+ case BUS_NOTIFY_ADD_DEVICE:
+ uncore_pci_pmu_register(pdev, pmu->type, pmu, die);
+ break;
+ default:
+ return NOTIFY_DONE;
+ }
return NOTIFY_OK;
}
--
2.32.0.3.g01195cf9f
next reply other threads:[~2026-04-16 5:46 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-16 5:45 Guixin Liu [this message]
2026-04-16 6:16 ` [PATCH] perf/x86/intel/uncore: Re-register PMU on PCI device hot-add sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260416054549.45585-1-kanie@linux.alibaba.com \
--to=kanie@linux.alibaba.com \
--cc=acme@kernel.org \
--cc=adrian.hunter@intel.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=irogers@google.com \
--cc=james.clark@linaro.org \
--cc=jolsa@kernel.org \
--cc=kan.liang@linux.intel.com \
--cc=linux-perf-users@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mingo@redhat.com \
--cc=namhyung@kernel.org \
--cc=oliver.yang@linux.alibaba.com \
--cc=peterz@infradead.org \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
--cc=xlpang@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox