From: Dinakar Guniguntala <dino@in.ibm.com>
To: Ingo Molnar <mingo@elte.hu>
Cc: David Singleton <dsingleton@mvista.com>, linux-kernel@vger.kernel.org
Subject: Re: PI BUG with -rt13
Date: Fri, 18 Nov 2005 18:51:37 +0530 [thread overview]
Message-ID: <20051118132137.GA5639@in.ibm.com> (raw)
In-Reply-To: <20051118092909.GC4858@elte.hu>
On Fri, Nov 18, 2005 at 10:29:09AM +0100, Ingo Molnar wrote:
>
> * David Singleton <dsingleton@mvista.com> wrote:
>
> > >I was testing PI support in the -rt tree (-rt13) when I hit the BUG
> > >below. I am using the BULL/Montavista glibc patches. However I would
> > >think this can be reproduced using just plain FUTEX_WAKE/WAIT_ROBUST
> > >APIs as well, though I havent tried. I can send out the test code
> > >if anybody is interested. I have attached the .config below.
> > >
> > >
>
> > If I make the lock in the timer_base_s struct a raw spinlock this
> > BUG goes away.
>
> that most likely just papers over the real bug. Given task-reference
> count bug i fixed in the robust/PI-futexes code (see the patch below) i
> suspect some more races and/or plain incorrect code.
>
> [this patch below also converts the robust/PI-futex code to use RCU
> instead of the tasklist_lock - which should remove a major latency
> source from the futex code].
>
[snip patch]
Ingo, Thanks for providing the fix. However I still hit the same bug
even with your changes
-Dinakar
testpi-1/1153[CPU#1]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (8)
[<c0134ba6>] process_timeout+0x0/0x9 (36)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c013affe>] add_preempt_count_ti+0x1e/0xc6 (100)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (44)
[<c013d06e>] do_futex+0x96/0xfc (24)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
------------------------------
| showing all locks held by: | (testpi-1/1153 [f7bd2730, 69]):
------------------------------
#001: [c3878fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33
testpi-1/1153[CPU#2]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (100)
[<c0122838>] __mod_timer+0x88/0xdf (12)
[<c0380c3d>] __lock_text_start+0x1d/0x41 (12)
[<c0122838>] __mod_timer+0x88/0xdf (8)
[<c0122838>] __mod_timer+0x88/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (8)
[<c0134ba6>] process_timeout+0x0/0x9 (36)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c013affe>] add_preempt_count_ti+0x1e/0xc6 (100)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (44)
[<c013d06e>] do_futex+0x96/0xfc (24)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
------------------------------
| showing all locks held by: | (testpi-1/1153 [f7bd2730, 69]):
------------------------------
#001: [c3888fe0] {&base->t_base.lock}
... acquired at: __mod_timer+0x88/0xdf
testpi-1/1155[CPU#0]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c0134ba6>] process_timeout+0x0/0x9 (44)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (76)
[<c0380c3d>] __lock_text_start+0x1d/0x41 (24)
[<c013d06e>] do_futex+0x96/0xfc (68)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
------------------------------
| showing all locks held by: | (testpi-1/1155 [f6fb8730, 0]):
------------------------------
#001: [c3868fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33
===================================================================
Different testcase, similar result
testpi-2/1159[CPU#1]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (8)
[<c0134ba6>] process_timeout+0x0/0x9 (36)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c013affe>] add_preempt_count_ti+0x1e/0xc6 (100)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (44)
[<c013d06e>] do_futex+0x96/0xfc (24)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
------------------------------
| showing all locks held by: | (testpi-2/1159 [f6650020, 69]):
------------------------------
#001: [c3878fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33
testpi-2/1160[CPU#1]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c0134ba6>] process_timeout+0x0/0x9 (44)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (76)
[<c013d06e>] do_futex+0x96/0xfc (92)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
------------------------------
| showing all locks held by: | (testpi-2/1160 [f6f58830, 59]):
------------------------------
#001: [c3878fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33
testpi-2/1161[CPU#2]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c0134ba6>] process_timeout+0x0/0x9 (44)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (76)
[<c0380c3d>] __lock_text_start+0x1d/0x41 (24)
[<c013d06e>] do_futex+0x96/0xfc (68)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
------------------------------
| showing all locks held by: | (testpi-2/1161 [f6c08120, 0]):
------------------------------
#001: [c3888fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33
next prev parent reply other threads:[~2005-11-18 13:14 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-11-17 16:18 PI BUG with -rt13 Dinakar Guniguntala
2005-11-17 16:41 ` Dinakar Guniguntala
2005-11-17 23:03 ` David Singleton
2005-11-18 9:29 ` Ingo Molnar
2005-11-18 13:21 ` Dinakar Guniguntala [this message]
2005-11-18 13:27 ` Ingo Molnar
2005-11-18 17:05 ` david singleton
2005-11-18 17:44 ` Ingo Molnar
2005-11-21 19:48 ` David Singleton
2005-11-21 21:26 ` Ingo Molnar
2005-11-22 2:01 ` david singleton
2005-11-24 14:57 ` Ingo Molnar
2005-11-24 20:26 ` Dinakar Guniguntala
2005-11-24 20:32 ` Dinakar Guniguntala
2005-11-24 22:25 ` david singleton
2005-11-25 4:56 ` david singleton
2005-11-25 7:34 ` Dinakar Guniguntala
2005-11-25 8:04 ` Dinakar Guniguntala
2005-11-25 5:04 ` Ingo Molnar
2005-11-25 13:27 ` Dinakar Guniguntala
2005-11-25 8:03 ` Ingo Molnar
2005-11-22 2:13 ` david singleton
[not found] ` <8D664A17-5B07-11DA-A840-000A959BB91E@mvista.com>
2005-11-22 9:37 ` Dinakar Guniguntala
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20051118132137.GA5639@in.ibm.com \
--to=dino@in.ibm.com \
--cc=dsingleton@mvista.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@elte.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox