linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
* Re: [Bugme-new] [Bug 13302] New: "bad pmd" on fork() of process with hugepage shared memory segments attached
@ 2009-05-15  5:32 starlight
  2009-05-15 14:55 ` Mel Gorman
  0 siblings, 1 reply; 25+ messages in thread
From: starlight @ 2009-05-15  5:32 UTC (permalink / raw)
  To: Mel Gorman
  Cc: Andrew Morton, linux-mm, bugzilla-daemon, bugme-daemon,
	Adam Litke, Eric B Munson

[-- Attachment #1: Type: text/plain, Size: 1105 bytes --]

Whacked at a this, attempting to build a testcase from a 
combination of the original daemon strace in the bug report
and knowledge of what the daemon is doing.

What emerged is something that will destroy RHEL5 
2.6.18-128.1.6.el5 100% every time.  Completely fills the kernel 
message log with "bad pmd" errors and wrecks hugepages.

Unfortunately it only occasionally breaks 2.6.29.1.  Haven't
been able to produce "bad pmd" messages, but did get the
kernel to think it's out of large page memory when in
theory it was not.  Saw a lot of really strange accounting
in the hugepage section of /proc/meminfo.

For what it's worth, the testcase code is attached.

Note that hugepages=2048 is assumed--the bug seems to require 
use of more than 50% of large page memory.

Definately will be posted under the RHEL5 bug report, which is 
the more pressing issue here than far-future kernel support.

In addition, the original segment attach bug 
http://bugzilla.kernel.org/show_bug.cgi?id=12134 is still there 
and can be reproduced every time with the 'create_seg_strace' 
and 'access_seg_straceX' sequences.

[-- Attachment #2: do_tcbm.txt --]
[-- Type: text/plain, Size: 28 bytes --]

g++ -Wall -g -o tcbm tcbm.C

[-- Attachment #3: tcbm.C.txt --]
[-- Type: text/plain, Size: 3873 bytes --]

extern "C" {
#include <errno.h>
#include <memory.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sched.h>
#include <sys/wait.h>
#include <sys/shm.h>
#include <sys/resource.h>
#include <sys/mman.h>
}

extern "C"
void child_signal_handler(
   const int
)
{
   int   errno_save;
   pid_t dead_pid;
   int   dead_status;

   errno_save = errno;

   do {
      dead_pid = waitpid(-1, &dead_status, WNOHANG);
      if (dead_pid == -1) {
         if (errno == ECHILD) break;
         perror("waitpid");
         exit(1);
      }
   } while (dead_pid != 0);

   errno = errno_save;

   return;
}

int rabbits(void)
{
   int pid = fork();
   if (pid != 0) {

      return 0;

   } else {

      const int sched_policy = sched_getscheduler(0);
      if (sched_policy == -1) {
         perror("sched_getscheduler");
      }
      if (sched_policy != SCHED_OTHER) {
         sched_param sched;
         memset(&sched, 0, sizeof(sched));
         sched.sched_priority = 0;
         if (sched_setscheduler(0, SCHED_OTHER, &sched) != 0) {
            perror("sched_setscheduler");
         }
      }
      errno = 0;                   // -1 return value legitimate
      const int nice = getpriority(PRIO_PROCESS, 0);
      if (errno != 0) {
         perror("getpriority");
      }
      if (nice < -10) {
         if (setpriority(PRIO_PROCESS, 0, -10) != 0) {   // somewhat elevated
            perror("setpriority");
         }
      }

      char* program;
      program = (char*) "script";
      char* pargs[2];
      pargs[0] = program;
      pargs[1] = NULL;
      execvp(program, pargs);
      perror("execvp");
      exit(1);

   }

}

int main(
   int          argc,
   const char** argv,
   const char** envp
)
{
#if 1
   sched_param sched;
   memset(&sched, 0, sizeof(sched));
   sched.sched_priority = 26;
   if (sched_setscheduler(0, SCHED_RR, &sched) != 0) {
      perror("sched_setscheduler(SCHED_RR, 26)");
      return 1;
   }
#endif

#if 0
   if (mlockall(MCL_CURRENT|MCL_FUTURE) != 0) {
      perror("mlockall");
      return 1;
   }
#endif

   struct sigaction sas_child;
   memset(&sas_child, 0, sizeof(sas_child));
   sas_child.sa_handler = child_signal_handler;
   if (sigaction(SIGCHLD, &sas_child, NULL) != 0) {
      perror("sigaction(SIGCHLD)");
      return 1;
   }

   int seg1id = shmget(0x12345600,
                       (size_t) 0xC0000000,
                       IPC_CREAT|SHM_HUGETLB|0640
                      );
   if (seg1id == -1) {
      perror("shmget(3GB)");
      return 1;
   }
   void* seg1adr = shmat(seg1id, (void*) 0x400000000, 0);
   if (seg1adr == (void*) -1) {
      perror("shmat(3GB)");
      return 1;
   }
#if 1
   memset(seg1adr, 0xFF, (size_t) 0x60000000);
   if (mlock(seg1adr, (size_t) 0xC0000000) != 0) {
      perror("mlock(3GB)");
      return 1;
   }
#endif

   int seg2id = shmget(0x12345601,
                       (size_t) 0x40000000,
                       IPC_CREAT|SHM_HUGETLB|0640
                      );
   if (seg2id == -1) {
      perror("shmget(1GB)");
      return 1;
   }
   void* seg2adr = shmat(seg2id, (void*) 0x500000000, 0);
   if (seg2adr == (void*) -1) {
      perror("shmat(1GB)");
      return 1;
   }
#if 1
   memset(seg2adr, 0xFF, (size_t) 0x40000000);
   if (mlock(seg2adr, (size_t) 0x40000000) != 0) {
      perror("mlock(1GB)");
      return 1;
   }
#endif

   for (int i1 = 0; i1 < 50; i1++) {
      void* mmtarg = mmap(NULL,
                          528384,
                          PROT_READ|PROT_WRITE,
                          MAP_PRIVATE|MAP_ANONYMOUS,
                          -1,
                          0
                         );
      if (mmtarg == (void*) -1) {
         perror("mmap");
         return 1;
      }
   }

   for (int i1 = 0; i1 < 50; i1++) {
      rabbits();
      usleep(500);
   }

   while (true) {
      pause();
   }

   return 0;
}

^ permalink raw reply	[flat|nested] 25+ messages in thread
* Re: [Bugme-new] [Bug 13302] New: "bad pmd" on fork() of process with hugepage shared memory segments attached
@ 2009-05-15 18:44 starlight
  2009-05-18 16:36 ` Mel Gorman
  0 siblings, 1 reply; 25+ messages in thread
From: starlight @ 2009-05-15 18:44 UTC (permalink / raw)
  To: Mel Gorman
  Cc: Andrew Morton, linux-mm, bugzilla-daemon, bugme-daemon,
	Adam Litke, Eric B Munson

[-- Attachment #1: Type: text/plain, Size: 476 bytes --]

This was really bugging me, so I hacked out
the test case for the attach failure.

Hoses 2.6.29.1 100% every time.  Run it like this:

tcbm_att
tcbm_att -
tcbm_att -
tcbm_att -

It will break on the last iteration with ENOMEM
and ENOMEM is all any shmget() or shmat() call
gets forever more.

After removing the segments this appears:

HugePages_Total:    2048
HugePages_Free:     2048
HugePages_Rsvd:     1280
HugePages_Surp:        0

Even though no segments show in 'ipcs'.

[-- Attachment #2: tcbm_att.C.txt --]
[-- Type: text/plain, Size: 2429 bytes --]

extern "C" {
#include <errno.h>
#include <memory.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/shm.h>
}

int main(
   int          argc,
   const char** argv,
   const char** envp
)
{
   if (argc == 1) {

      int seg1id = shmget(0x12345600,
                          (size_t) 0x40000000,
                          IPC_CREAT|SHM_HUGETLB|0640
                         );
      if (seg1id == -1) {
         perror("shmget(1GB)");
         return 1;
      }
      void* seg1adr = shmat(seg1id, (void*) 0x400000000, 0);
      if (seg1adr == (void*) -1) {
         perror("shmat(1GB)");
         return 1;
      }

      int seg2id = shmget(0x12345601,
                          (size_t) 0x10000000,
                          IPC_CREAT|SHM_HUGETLB|0640
                         );
      if (seg2id == -1) {
         perror("shmget(256MB)");
         return 1;
      }
      void* seg2adr = shmat(seg2id, (void*) 0x580000000, 0);
      if (seg2adr == (void*) -1) {
         perror("shmat(256MB)");
         return 1;
      }

      char* seg_p = (char*) seg1adr;
      int i1 = 182;
      while (i1 > 0) {
         memset(seg_p, 0x55, 0x400000);
         seg_p += 0x400000;
         i1--;
      }

      seg_p = (char*) seg2adr;
      i1 = 6;
      while (i1 > 0) {
         memset(seg_p, 0xAA, 0x400000);
         seg_p += 0x400000;
         i1--;
      }

      if (shmdt((void*) 0x400000000) != 0) {
         perror("shmdt(1GB)");
         return 1;
      }

      if (shmdt((void*) 0x580000000) != 0) {
         perror("shmdt(256MB)");
         return 1;
      }

   } else {

      int seg1id = shmget(0x12345600, 0, 0);
      if (seg1id == -1) {
         perror("shmget(1GB)");
         return 1;
      }
      void* seg1adr = shmat(seg1id, (void*) 0x400000000, SHM_RDONLY);
      if (seg1adr == (void*) -1) {
         perror("shmat(1GB)");
         return 1;
      }

      int seg2id = shmget(0x12345601, 0, 0);
      if (seg2id == -1) {
         perror("shmget(256MB)");
         return 1;
      }
      void* seg2adr = shmat(seg2id, (void*) 0x580000000, SHM_RDONLY);
      if (seg2adr == (void*) -1) {
         perror("shmat(256MB)");
         return 1;
      }

      if (shmdt((void*) 0x400000000) != 0) {
         perror("shmdt(1GB)");
         return 1;
      }

      if (shmdt((void*) 0x580000000) != 0) {
         perror("shmdt(256MB)");
         return 1;
      }

   }

   return 0;
}

[-- Attachment #3: do_tcbm_att.txt --]
[-- Type: application/octet-stream, Size: 36 bytes --]

g++ -Wall -g -o tcbm_att tcbm_att.C

^ permalink raw reply	[flat|nested] 25+ messages in thread
* Re: [Bugme-new] [Bug 13302] New: "bad pmd" on fork() of process with hugepage shared memory segments attached
@ 2009-05-15 18:53 starlight
  2009-05-20 11:35 ` Mel Gorman
  0 siblings, 1 reply; 25+ messages in thread
From: starlight @ 2009-05-15 18:53 UTC (permalink / raw)
  To: Mel Gorman
  Cc: Andrew Morton, linux-mm, bugzilla-daemon, bugme-daemon,
	Adam Litke, Eric B Munson

Here's another possible clue:

I tried the first 'tcbm' testcase on a 2.6.27.7
kernel that was hanging around from a few months
ago and it breaks it 100% of the time.

Completely hoses huge memory.  Enough "bad pmd"
errors to fill the kernel log.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

^ permalink raw reply	[flat|nested] 25+ messages in thread
end of thread, other threads:[~2009-05-25 13:16 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <bug-13302-10286@http.bugzilla.kernel.org/>
2009-05-13 20:08 ` [Bugme-new] [Bug 13302] New: "bad pmd" on fork() of process with hugepage shared memory segments attached Andrew Morton
2009-05-14 10:53   ` Mel Gorman
2009-05-14 10:59     ` Mel Gorman
2009-05-14 17:20       ` starlight
2009-05-14 17:49         ` Mel Gorman
2009-05-14 18:42           ` starlight
2009-05-14 19:10           ` starlight
2009-05-14 17:16     ` starlight
2009-05-15  5:32 starlight
2009-05-15 14:55 ` Mel Gorman
2009-05-15 15:02   ` starlight
  -- strict thread matches above, loose matches on Subject: below --
2009-05-15 18:44 starlight
2009-05-18 16:36 ` Mel Gorman
2009-05-15 18:53 starlight
2009-05-20 11:35 ` Mel Gorman
2009-05-20 14:29   ` Mel Gorman
2009-05-20 14:53   ` Lee Schermerhorn
2009-05-20 15:05     ` Lee Schermerhorn
2009-05-20 15:41       ` Mel Gorman
2009-05-21  0:41         ` KOSAKI Motohiro
2009-05-22 16:41           ` Mel Gorman
2009-05-24 13:44             ` KOSAKI Motohiro
2009-05-25  8:51               ` Mel Gorman
2009-05-25 10:10                 ` Hugh Dickins
2009-05-25 13:17                   ` Mel Gorman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).