* [BUG] intr_remap: Simplify the code further
@ 2010-10-29 22:22 Russ Anderson
2010-10-30 0:37 ` Suresh Siddha
0 siblings, 1 reply; 8+ messages in thread
From: Russ Anderson @ 2010-10-29 22:22 UTC (permalink / raw)
To: linux-kernel
Cc: Thomas Gleixner, Ingo Molnar, Suresh Siddha, David Woodhouse,
Jesse Barnes
There is a regression that is causing a NULL pointer dereference
in free_irte when shutting down xpc. git bisect narrowed it down
to git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139, which
changed free_irte(). Reverse applying the patch fixes the problem.
git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139
---------------------------------------------------------
commit d585d060b42bd36f6f0b23ff327d3b91f80c7139
Author: Thomas Gleixner <tglx@linutronix.de>
Date: Sun Oct 10 12:34:27 2010 +0200
intr_remap: Simplify the code further
Having irq_2_iommu in struct irq_cfg allows further simplifications.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
---------------------------------------------------------
The failing output on real hardware:
----------------------------------------------------------------------------
Sending all processes the TERM signal... done
Sending all processes the KILL signal...
Please stand by while rebooting the system...
[ 4020.514342] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
[ 4020.523091] IP: [<ffffffff8121a791>] free_irte+0x46/0xe4
[ 4020.529024] PGD 3f5ac5067 PUD 3f6487067 PMD 0
[ 4020.534007] Oops: 0000 [#1] SMP
[ 4020.537626] last sysfs file:
/sys/devices/pci0000:00/0000:00:03.0/0000:04:00.0/host0/port-0:0/end_device-0:0/target0:0:0/0:0:0:0/vendor
[ 4020.551197] xpc : all partitions have deactivated
[ 4020.556437] CPU 25
[ 4020.558580] Modules linked in:
[ 4020.562199]
[ 4020.563858] Pid: 13489, comm: reboot Not tainted 2.6.36-tip+ #5 /Stoutland Platform
[ 4020.572390] RIP: 0010:[<ffffffff8121a791>] [<ffffffff8121a791>] free_irte+0x46/0xe4
[ 4020.581030] RSP: 0018:ffff88047cdb1c38 EFLAGS: 00010046
[ 4020.586948] RAX: 0000000000000246 RBX: ffff8803f6b50b60 RCX: 0000000000000000
[ 4020.594900] RDX: 0000000000000113 RSI: 0000000000000000 RDI: 0000000000000000
[ 4020.602851] RBP: ffff88047cdb1c68 R08: ffff8803f6b50ac0 R09: 00000000ffffffff
[ 4020.610802] R10: ffff8803f78a2200 R11: 00000084f04c73c1 R12: 0000000000000000
[ 4020.618754] R13: 0000000000000246 R14: 0000000000000000 R15: 0000000000000000
[ 4020.626705] FS: 00007fec1bfd1700(0000) GS:ffff8803ffd20000(0000) knlGS:0000000000000000
[ 4020.635722] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 4020.642123] CR2: 0000000000000080 CR3: 00000003f5704000 CR4: 00000000000006e0
[ 4020.650074] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4020.658026] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 4020.665976] Process reboot (pid: 13489, threadinfo ffff88047cdb0000, task ffff88047a2058e0)
[ 4020.675282] Stack:
aster Resource Control: runlevel 6 has been reached
[ 4020.677520] ffff88047cdb1c68
ffffffff8109172d ffff8803f6b50b80 ffff8803f6b50b80
INIT: no more processes left in this runlevel
[ 4020.685807] 0000000000000065 ffff8803f6b50b40 ffff88047cdb1c98 ffffffff8101cd32
[ 4020.694093] ffff88047cdb1ca8 ffff8803f6b50b80 0000000000000065 0000000000000292
[ 4020.702379] Call Trace:
[ 4020.705109] [<ffffffff8109172d>] ? irq_modify_status+0x55/0x5e
[ 4020.711709] [<ffffffff8101cd32>] destroy_irq+0x41/0x7e
[ 4020.717534] [<ffffffff81031fe2>] uv_teardown_irq+0xb6/0xc1
[ 4020.723743] [<ffffffff81090f92>] ? free_irq+0x50/0x59
[ 4020.729470] [<ffffffff812e0da3>] ? xp_restrict_memprotect_uv+0x0/0x30
[ 4020.736744] [<ffffffff812e3a12>] xpc_destroy_gru_mq_uv+0x54/0x98
[ 4020.743533] [<ffffffff812e3a66>] xpc_exit_uv+0x10/0x1e
[ 4020.749355] [<ffffffff812e1299>] xpc_do_exit+0x1e3/0x1f2
[ 4020.755371] [<ffffffff812e12d3>] xpc_system_reboot+0x2b/0x2f
[ 4020.761778] [<ffffffff815c0b19>] notifier_call_chain+0x33/0x5b
[ 4020.768378] [<ffffffff810612a4>] __blocking_notifier_call_chain+0x4d/0x6a
[ 4020.776038] [<ffffffff810612d0>] blocking_notifier_call_chain+0xf/0x11
[ 4020.783411] [<ffffffff81055c1e>] kernel_restart_prepare+0x18/0x2e
[ 4020.790289] [<ffffffff81055c6d>] kernel_restart+0x11/0x43
[ 4020.796401] [<ffffffff81055de5>] sys_reboot+0x139/0x174
[ 4020.802322] [<ffffffff810ef23b>] ? fput+0x20d/0x21c
[ 4020.807853] [<ffffffff810ec3a0>] ? filp_close+0x67/0x72
[ 4020.813772] [<ffffffff81002aab>] system_call_fastpath+0x16/0x1b
[ 4020.820464] Code: c3 0f 84 b4 00 00 00 48 c7 c7 d4 d8 e5 81 45 31 e4 e8 95 2e 3a 00 66 83 7b 0a 00 49 89
c5 75 75 48 8b 33 0f b7 7b 08 0f b6 4b 0c <48> 8b 86 80 00 00 00 48 89 fa 48 c1 e2 04 48 03 10 b8 01 00 00
[ 4020.842190] RIP [<ffffffff8121a791>] free_irte+0x46/0xe4
[ 4020.848217] RSP <ffff88047cdb1c38>
[ 4020.852101] CR2: 0000000000000080
[ 4021.091896] ---[ end trace 113a8c342207f0d1 ]---
/etc/init.d/rc: line 317: 13489 Killed $link start
----------------------------------------------------------------------------
Output from on the simulator:
----------------------------------------------------------------------------
[ 0.205968] xpc : can't setup our reserved page
Breakpoint reached at <0xffffffff811fdeb8> on cpu 0
All cpus stopped because one or more cpus hit breakpoint(s); the "stat"
cmd will show which cpu(s) hit breakpoints and which were still running.
<199934998> <bust_spinlocks> 55 push %rbp
mdb:/> lastct 100
199933847: ret <__phys_addr+0x33> -> <virt_to_head_page+0x9>
199933857: ret <virt_to_head_page+0x2f> -> <kfree+0x4d>
199933885: ret <kfree+0xb3> -> <pde_put+0x68>
199933889: ret <pde_put+0x6c> -> <remove_proc_entry+0x230>
199933897: ret <remove_proc_entry+0x23e> -> <unregister_handler_proc+0x2c>
199933901: ret <unregister_handler_proc+0x30> -> <__free_irq+0x134>
199933903: call <__free_irq+0x137> -> <synchronize_irq>
199933910: call <synchronize_irq+0xd> -> <irq_to_desc>
199933915: call <irq_to_desc+0xd> -> <radix_tree_lookup>
199933943: ret <radix_tree_lookup+0x5a> -> <irq_to_desc+0x12>
199933945: ret <irq_to_desc+0x13> -> <synchronize_irq+0x12>
199933953: call <synchronize_irq+0x30> -> <_raw_spin_lock_irqsave>
199933966: ret <_raw_spin_lock_irqsave+0x22> -> <synchronize_irq+0x35>
199933970: call <synchronize_irq+0x40> -> <_raw_spin_unlock_irqrestore>
199933977: ret <_raw_spin_unlock_irqrestore+0xa> -> <synchronize_irq+0x45>
199933990: ret <synchronize_irq+0xd4> -> <__free_irq+0x13c>
199934002: ret <__free_irq+0x178> -> <free_irq+0x40>
199934004: call <free_irq+0x43> -> <kfree>
199934018: call <kfree+0x48> -> <virt_to_head_page>
199934021: call <virt_to_head_page+0x4> -> <__phys_addr>
199934030: ret <__phys_addr+0x33> -> <virt_to_head_page+0x9>
199934040: ret <virt_to_head_page+0x2f> -> <kfree+0x4d>
199934068: ret <kfree+0xb3> -> <free_irq+0x48>
199934070: call <free_irq+0x4b> -> <chip_bus_sync_unlock>
199934078: ret <chip_bus_sync_unlock+0x17> -> <free_irq+0x50>
199934084: ret <free_irq+0x58> -> <xpc_destroy_gru_mq_uv+0x4a>
199934086: call <xpc_destroy_gru_mq_uv+0x4f> -> <uv_teardown_irq>
199934095: call <uv_teardown_irq+0x17> -> <_raw_spin_lock_irqsave>
199934108: ret <_raw_spin_lock_irqsave+0x22> -> <uv_teardown_irq+0x1c>
199934148: call <uv_teardown_irq+0x7c> -> <rb_erase>
199934180: ret <rb_erase+0x27f> -> <uv_teardown_irq+0x81>
199934182: call <uv_teardown_irq+0x84> -> <kfree>
199934196: call <kfree+0x48> -> <virt_to_head_page>
199934199: call <virt_to_head_page+0x4> -> <__phys_addr>
199934208: ret <__phys_addr+0x33> -> <virt_to_head_page+0x9>
199934218: ret <virt_to_head_page+0x2f> -> <kfree+0x4d>
199934246: ret <kfree+0xb3> -> <uv_teardown_irq+0x89>
199934250: call <uv_teardown_irq+0xa9> -> <_raw_spin_unlock_irqrestore>
199934257: ret <_raw_spin_unlock_irqrestore+0xa> -> <uv_teardown_irq+0xae>
199934259: call <uv_teardown_irq+0xb1> -> <destroy_irq>
199934268: call <destroy_irq+0x13> -> <irq_get_irq_data>
199934271: call <irq_get_irq_data+0x4> -> <irq_to_desc>
199934276: call <irq_to_desc+0xd> -> <radix_tree_lookup>
199934304: ret <radix_tree_lookup+0x5a> -> <irq_to_desc+0x12>
199934306: ret <irq_to_desc+0x13> -> <irq_get_irq_data+0x9>
199934308: ret <irq_get_irq_data+0xa> -> <destroy_irq+0x18>
199934315: call <destroy_irq+0x2b> -> <irq_modify_status>
199934324: call <irq_modify_status+0x11> -> <irq_to_desc>
199934329: call <irq_to_desc+0xd> -> <radix_tree_lookup>
199934357: ret <radix_tree_lookup+0x5a> -> <irq_to_desc+0x12>
199934359: ret <irq_to_desc+0x13> -> <irq_modify_status+0x16>
199934367: call <irq_modify_status+0x33> -> <_raw_spin_lock_irqsave>
199934380: ret <_raw_spin_lock_irqsave+0x22> -> <irq_modify_status+0x38>
199934388: call <irq_modify_status+0x50> -> <_raw_spin_unlock_irqrestore>
199934395: ret <_raw_spin_unlock_irqrestore+0xa> -> <irq_modify_status+0x55>
199934401: ret <irq_modify_status+0x5d> -> <destroy_irq+0x30>
199934405: call <destroy_irq+0x3c> -> <free_irte>
199934413: call <free_irte+0x11> -> <irq_2_iommu>
199934416: call <irq_2_iommu+0x4> -> <irq_get_irq_data>
199934419: call <irq_get_irq_data+0x4> -> <irq_to_desc>
199934424: call <irq_to_desc+0xd> -> <radix_tree_lookup>
199934452: ret <radix_tree_lookup+0x5a> -> <irq_to_desc+0x12>
199934454: ret <irq_to_desc+0x13> -> <irq_get_irq_data+0x9>
199934456: ret <irq_get_irq_data+0xa> -> <irq_2_iommu+0x9>
199934464: ret <irq_2_iommu+0x20> -> <free_irte+0x16>
199934470: call <free_irte+0x2c> -> <_raw_spin_lock_irqsave>
199934483: ret <_raw_spin_lock_irqsave+0x22> -> <free_irte+0x31>
199934490: int <free_irte+0x46> -> <page_fault>
199934492: call <page_fault+0x4> -> <error_entry>
----------------------------------------------------------------------------
--
Russ Anderson, OS RAS/Partitioning Project Lead
SGI - Silicon Graphics Inc rja@sgi.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] intr_remap: Simplify the code further
2010-10-29 22:22 [BUG] intr_remap: Simplify the code further Russ Anderson
@ 2010-10-30 0:37 ` Suresh Siddha
2010-10-30 1:50 ` Russ Anderson
0 siblings, 1 reply; 8+ messages in thread
From: Suresh Siddha @ 2010-10-30 0:37 UTC (permalink / raw)
To: Russ Anderson
Cc: linux-kernel@vger.kernel.org, Thomas Gleixner, Ingo Molnar,
David Woodhouse, Jesse Barnes
On Fri, 2010-10-29 at 15:22 -0700, Russ Anderson wrote:
> There is a regression that is causing a NULL pointer dereference
> in free_irte when shutting down xpc. git bisect narrowed it down
> to git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139, which
> changed free_irte(). Reverse applying the patch fixes the problem.
>
Russ, Is this with !CONFIG_SPARSE_IRQ?
thanks,
suresh
>
>
> git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139
> ---------------------------------------------------------
> commit d585d060b42bd36f6f0b23ff327d3b91f80c7139
> Author: Thomas Gleixner <tglx@linutronix.de>
> Date: Sun Oct 10 12:34:27 2010 +0200
>
> intr_remap: Simplify the code further
>
> Having irq_2_iommu in struct irq_cfg allows further simplifications.
>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Reviewed-by: Ingo Molnar <mingo@elte.hu>
> Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
> Cc: David Woodhouse <dwmw2@infradead.org>
> Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
> ---------------------------------------------------------
>
>
>
>
> The failing output on real hardware:
> ----------------------------------------------------------------------------
> Sending all processes the TERM signal... done
> Sending all processes the KILL signal...
> Please stand by while rebooting the system...
> [ 4020.514342] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
> [ 4020.523091] IP: [<ffffffff8121a791>] free_irte+0x46/0xe4
> [ 4020.529024] PGD 3f5ac5067 PUD 3f6487067 PMD 0
> [ 4020.534007] Oops: 0000 [#1] SMP
> [ 4020.537626] last sysfs file:
> /sys/devices/pci0000:00/0000:00:03.0/0000:04:00.0/host0/port-0:0/end_device-0:0/target0:0:0/0:0:0:0/vendor
> [ 4020.551197] xpc : all partitions have deactivated
> [ 4020.556437] CPU 25
> [ 4020.558580] Modules linked in:
> [ 4020.562199]
> [ 4020.563858] Pid: 13489, comm: reboot Not tainted 2.6.36-tip+ #5 /Stoutland Platform
> [ 4020.572390] RIP: 0010:[<ffffffff8121a791>] [<ffffffff8121a791>] free_irte+0x46/0xe4
> [ 4020.581030] RSP: 0018:ffff88047cdb1c38 EFLAGS: 00010046
> [ 4020.586948] RAX: 0000000000000246 RBX: ffff8803f6b50b60 RCX: 0000000000000000
> [ 4020.594900] RDX: 0000000000000113 RSI: 0000000000000000 RDI: 0000000000000000
> [ 4020.602851] RBP: ffff88047cdb1c68 R08: ffff8803f6b50ac0 R09: 00000000ffffffff
> [ 4020.610802] R10: ffff8803f78a2200 R11: 00000084f04c73c1 R12: 0000000000000000
> [ 4020.618754] R13: 0000000000000246 R14: 0000000000000000 R15: 0000000000000000
> [ 4020.626705] FS: 00007fec1bfd1700(0000) GS:ffff8803ffd20000(0000) knlGS:0000000000000000
> [ 4020.635722] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 4020.642123] CR2: 0000000000000080 CR3: 00000003f5704000 CR4: 00000000000006e0
> [ 4020.650074] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 4020.658026] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [ 4020.665976] Process reboot (pid: 13489, threadinfo ffff88047cdb0000, task ffff88047a2058e0)
> [ 4020.675282] Stack:
> aster Resource Control: runlevel 6 has been reached
> [ 4020.677520] ffff88047cdb1c68
> ffffffff8109172d ffff8803f6b50b80 ffff8803f6b50b80
> INIT: no more processes left in this runlevel
> [ 4020.685807] 0000000000000065 ffff8803f6b50b40 ffff88047cdb1c98 ffffffff8101cd32
> [ 4020.694093] ffff88047cdb1ca8 ffff8803f6b50b80 0000000000000065 0000000000000292
> [ 4020.702379] Call Trace:
> [ 4020.705109] [<ffffffff8109172d>] ? irq_modify_status+0x55/0x5e
> [ 4020.711709] [<ffffffff8101cd32>] destroy_irq+0x41/0x7e
> [ 4020.717534] [<ffffffff81031fe2>] uv_teardown_irq+0xb6/0xc1
> [ 4020.723743] [<ffffffff81090f92>] ? free_irq+0x50/0x59
> [ 4020.729470] [<ffffffff812e0da3>] ? xp_restrict_memprotect_uv+0x0/0x30
> [ 4020.736744] [<ffffffff812e3a12>] xpc_destroy_gru_mq_uv+0x54/0x98
> [ 4020.743533] [<ffffffff812e3a66>] xpc_exit_uv+0x10/0x1e
> [ 4020.749355] [<ffffffff812e1299>] xpc_do_exit+0x1e3/0x1f2
> [ 4020.755371] [<ffffffff812e12d3>] xpc_system_reboot+0x2b/0x2f
> [ 4020.761778] [<ffffffff815c0b19>] notifier_call_chain+0x33/0x5b
> [ 4020.768378] [<ffffffff810612a4>] __blocking_notifier_call_chain+0x4d/0x6a
> [ 4020.776038] [<ffffffff810612d0>] blocking_notifier_call_chain+0xf/0x11
> [ 4020.783411] [<ffffffff81055c1e>] kernel_restart_prepare+0x18/0x2e
> [ 4020.790289] [<ffffffff81055c6d>] kernel_restart+0x11/0x43
> [ 4020.796401] [<ffffffff81055de5>] sys_reboot+0x139/0x174
> [ 4020.802322] [<ffffffff810ef23b>] ? fput+0x20d/0x21c
> [ 4020.807853] [<ffffffff810ec3a0>] ? filp_close+0x67/0x72
> [ 4020.813772] [<ffffffff81002aab>] system_call_fastpath+0x16/0x1b
> [ 4020.820464] Code: c3 0f 84 b4 00 00 00 48 c7 c7 d4 d8 e5 81 45 31 e4 e8 95 2e 3a 00 66 83 7b 0a 00 49 89
> c5 75 75 48 8b 33 0f b7 7b 08 0f b6 4b 0c <48> 8b 86 80 00 00 00 48 89 fa 48 c1 e2 04 48 03 10 b8 01 00 00
> [ 4020.842190] RIP [<ffffffff8121a791>] free_irte+0x46/0xe4
> [ 4020.848217] RSP <ffff88047cdb1c38>
> [ 4020.852101] CR2: 0000000000000080
> [ 4021.091896] ---[ end trace 113a8c342207f0d1 ]---
> /etc/init.d/rc: line 317: 13489 Killed $link start
> ----------------------------------------------------------------------------
>
>
> Output from on the simulator:
> ----------------------------------------------------------------------------
> [ 0.205968] xpc : can't setup our reserved page
>
> Breakpoint reached at <0xffffffff811fdeb8> on cpu 0
>
> All cpus stopped because one or more cpus hit breakpoint(s); the "stat"
> cmd will show which cpu(s) hit breakpoints and which were still running.
> <199934998> <bust_spinlocks> 55 push %rbp
> mdb:/> lastct 100
> 199933847: ret <__phys_addr+0x33> -> <virt_to_head_page+0x9>
> 199933857: ret <virt_to_head_page+0x2f> -> <kfree+0x4d>
> 199933885: ret <kfree+0xb3> -> <pde_put+0x68>
> 199933889: ret <pde_put+0x6c> -> <remove_proc_entry+0x230>
> 199933897: ret <remove_proc_entry+0x23e> -> <unregister_handler_proc+0x2c>
> 199933901: ret <unregister_handler_proc+0x30> -> <__free_irq+0x134>
> 199933903: call <__free_irq+0x137> -> <synchronize_irq>
> 199933910: call <synchronize_irq+0xd> -> <irq_to_desc>
> 199933915: call <irq_to_desc+0xd> -> <radix_tree_lookup>
> 199933943: ret <radix_tree_lookup+0x5a> -> <irq_to_desc+0x12>
> 199933945: ret <irq_to_desc+0x13> -> <synchronize_irq+0x12>
> 199933953: call <synchronize_irq+0x30> -> <_raw_spin_lock_irqsave>
> 199933966: ret <_raw_spin_lock_irqsave+0x22> -> <synchronize_irq+0x35>
> 199933970: call <synchronize_irq+0x40> -> <_raw_spin_unlock_irqrestore>
> 199933977: ret <_raw_spin_unlock_irqrestore+0xa> -> <synchronize_irq+0x45>
> 199933990: ret <synchronize_irq+0xd4> -> <__free_irq+0x13c>
> 199934002: ret <__free_irq+0x178> -> <free_irq+0x40>
> 199934004: call <free_irq+0x43> -> <kfree>
> 199934018: call <kfree+0x48> -> <virt_to_head_page>
> 199934021: call <virt_to_head_page+0x4> -> <__phys_addr>
> 199934030: ret <__phys_addr+0x33> -> <virt_to_head_page+0x9>
> 199934040: ret <virt_to_head_page+0x2f> -> <kfree+0x4d>
> 199934068: ret <kfree+0xb3> -> <free_irq+0x48>
> 199934070: call <free_irq+0x4b> -> <chip_bus_sync_unlock>
> 199934078: ret <chip_bus_sync_unlock+0x17> -> <free_irq+0x50>
> 199934084: ret <free_irq+0x58> -> <xpc_destroy_gru_mq_uv+0x4a>
> 199934086: call <xpc_destroy_gru_mq_uv+0x4f> -> <uv_teardown_irq>
> 199934095: call <uv_teardown_irq+0x17> -> <_raw_spin_lock_irqsave>
> 199934108: ret <_raw_spin_lock_irqsave+0x22> -> <uv_teardown_irq+0x1c>
> 199934148: call <uv_teardown_irq+0x7c> -> <rb_erase>
> 199934180: ret <rb_erase+0x27f> -> <uv_teardown_irq+0x81>
> 199934182: call <uv_teardown_irq+0x84> -> <kfree>
> 199934196: call <kfree+0x48> -> <virt_to_head_page>
> 199934199: call <virt_to_head_page+0x4> -> <__phys_addr>
> 199934208: ret <__phys_addr+0x33> -> <virt_to_head_page+0x9>
> 199934218: ret <virt_to_head_page+0x2f> -> <kfree+0x4d>
> 199934246: ret <kfree+0xb3> -> <uv_teardown_irq+0x89>
> 199934250: call <uv_teardown_irq+0xa9> -> <_raw_spin_unlock_irqrestore>
> 199934257: ret <_raw_spin_unlock_irqrestore+0xa> -> <uv_teardown_irq+0xae>
> 199934259: call <uv_teardown_irq+0xb1> -> <destroy_irq>
> 199934268: call <destroy_irq+0x13> -> <irq_get_irq_data>
> 199934271: call <irq_get_irq_data+0x4> -> <irq_to_desc>
> 199934276: call <irq_to_desc+0xd> -> <radix_tree_lookup>
> 199934304: ret <radix_tree_lookup+0x5a> -> <irq_to_desc+0x12>
> 199934306: ret <irq_to_desc+0x13> -> <irq_get_irq_data+0x9>
> 199934308: ret <irq_get_irq_data+0xa> -> <destroy_irq+0x18>
> 199934315: call <destroy_irq+0x2b> -> <irq_modify_status>
> 199934324: call <irq_modify_status+0x11> -> <irq_to_desc>
> 199934329: call <irq_to_desc+0xd> -> <radix_tree_lookup>
> 199934357: ret <radix_tree_lookup+0x5a> -> <irq_to_desc+0x12>
> 199934359: ret <irq_to_desc+0x13> -> <irq_modify_status+0x16>
> 199934367: call <irq_modify_status+0x33> -> <_raw_spin_lock_irqsave>
> 199934380: ret <_raw_spin_lock_irqsave+0x22> -> <irq_modify_status+0x38>
> 199934388: call <irq_modify_status+0x50> -> <_raw_spin_unlock_irqrestore>
> 199934395: ret <_raw_spin_unlock_irqrestore+0xa> -> <irq_modify_status+0x55>
> 199934401: ret <irq_modify_status+0x5d> -> <destroy_irq+0x30>
> 199934405: call <destroy_irq+0x3c> -> <free_irte>
> 199934413: call <free_irte+0x11> -> <irq_2_iommu>
> 199934416: call <irq_2_iommu+0x4> -> <irq_get_irq_data>
> 199934419: call <irq_get_irq_data+0x4> -> <irq_to_desc>
> 199934424: call <irq_to_desc+0xd> -> <radix_tree_lookup>
> 199934452: ret <radix_tree_lookup+0x5a> -> <irq_to_desc+0x12>
> 199934454: ret <irq_to_desc+0x13> -> <irq_get_irq_data+0x9>
> 199934456: ret <irq_get_irq_data+0xa> -> <irq_2_iommu+0x9>
> 199934464: ret <irq_2_iommu+0x20> -> <free_irte+0x16>
> 199934470: call <free_irte+0x2c> -> <_raw_spin_lock_irqsave>
> 199934483: ret <_raw_spin_lock_irqsave+0x22> -> <free_irte+0x31>
> 199934490: int <free_irte+0x46> -> <page_fault>
> 199934492: call <page_fault+0x4> -> <error_entry>
>
> ----------------------------------------------------------------------------
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] intr_remap: Simplify the code further
2010-10-30 0:37 ` Suresh Siddha
@ 2010-10-30 1:50 ` Russ Anderson
2010-10-30 2:55 ` Yinghai Lu
0 siblings, 1 reply; 8+ messages in thread
From: Russ Anderson @ 2010-10-30 1:50 UTC (permalink / raw)
To: Suresh Siddha
Cc: linux-kernel@vger.kernel.org, Thomas Gleixner, Ingo Molnar,
David Woodhouse, Jesse Barnes, rja
On Fri, Oct 29, 2010 at 05:37:42PM -0700, Suresh Siddha wrote:
> On Fri, 2010-10-29 at 15:22 -0700, Russ Anderson wrote:
> > There is a regression that is causing a NULL pointer dereference
> > in free_irte when shutting down xpc. git bisect narrowed it down
> > to git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139, which
> > changed free_irte(). Reverse applying the patch fixes the problem.
> >
>
> Russ, Is this with !CONFIG_SPARSE_IRQ?
CONFIG_SPARSE_IRQ=y
--
Russ Anderson, OS RAS/Partitioning Project Lead
SGI - Silicon Graphics Inc rja@sgi.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] intr_remap: Simplify the code further
2010-10-30 1:50 ` Russ Anderson
@ 2010-10-30 2:55 ` Yinghai Lu
2010-10-30 3:48 ` Russ Anderson
0 siblings, 1 reply; 8+ messages in thread
From: Yinghai Lu @ 2010-10-30 2:55 UTC (permalink / raw)
To: Russ Anderson
Cc: Suresh Siddha, linux-kernel@vger.kernel.org, Thomas Gleixner,
Ingo Molnar, David Woodhouse, Jesse Barnes, rja
[-- Attachment #1: Type: text/plain, Size: 607 bytes --]
On Fri, Oct 29, 2010 at 6:50 PM, Russ Anderson <rja@sgi.com> wrote:
> On Fri, Oct 29, 2010 at 05:37:42PM -0700, Suresh Siddha wrote:
>> On Fri, 2010-10-29 at 15:22 -0700, Russ Anderson wrote:
>> > There is a regression that is causing a NULL pointer dereference
>> > in free_irte when shutting down xpc. git bisect narrowed it down
>> > to git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139, which
>> > changed free_irte(). Reverse applying the patch fixes the problem.
>> >
>>
>> Russ, Is this with !CONFIG_SPARSE_IRQ?
>
>
> CONFIG_SPARSE_IRQ=y
>
can you try attached patch?
Yinghai
[-- Attachment #2: fix_uv_free_irte.patch --]
[-- Type: text/x-patch, Size: 469 bytes --]
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 5e43502..383f4bb 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -3109,7 +3109,7 @@ void destroy_irq(unsigned int irq)
irq_set_status_flags(irq, IRQ_NOREQUEST|IRQ_NOPROBE);
- if (intr_remapping_enabled)
+ if (irq_remapped(get_irq_chip_data(irq)))
free_irte(irq);
raw_spin_lock_irqsave(&vector_lock, flags);
__clear_irq_vector(irq, cfg);
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [BUG] intr_remap: Simplify the code further
2010-10-30 2:55 ` Yinghai Lu
@ 2010-10-30 3:48 ` Russ Anderson
2010-10-30 8:19 ` [PATCH] x86, uv: Fix uv with destroy_irq() Yinghai Lu
0 siblings, 1 reply; 8+ messages in thread
From: Russ Anderson @ 2010-10-30 3:48 UTC (permalink / raw)
To: Yinghai Lu
Cc: Suresh Siddha, linux-kernel@vger.kernel.org, Thomas Gleixner,
Ingo Molnar, David Woodhouse, Jesse Barnes, rja
On Fri, Oct 29, 2010 at 07:55:49PM -0700, Yinghai Lu wrote:
> On Fri, Oct 29, 2010 at 6:50 PM, Russ Anderson <rja@sgi.com> wrote:
> > On Fri, Oct 29, 2010 at 05:37:42PM -0700, Suresh Siddha wrote:
> >> On Fri, 2010-10-29 at 15:22 -0700, Russ Anderson wrote:
> >> > There is a regression that is causing a NULL pointer dereference
> >> > in free_irte when shutting down xpc. git bisect narrowed it down
> >> > to git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139, which
> >> > changed free_irte(). Reverse applying the patch fixes the problem.
> >> >
> >>
> >> Russ, Is this with !CONFIG_SPARSE_IRQ?
> >
> >
> > CONFIG_SPARSE_IRQ=y
> >
>
> can you try attached patch?
That fixes it.
> Yinghai
Thanks!
--
Russ Anderson, OS RAS/Partitioning Project Lead
SGI - Silicon Graphics Inc rja@sgi.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] x86, uv: Fix uv with destroy_irq()
2010-10-30 3:48 ` Russ Anderson
@ 2010-10-30 8:19 ` Yinghai Lu
2010-10-30 8:22 ` Thomas Gleixner
2010-10-30 8:36 ` [tip:x86/urgent] x86: Check irq_remapped instead of remapping_enabled in destroy_irq() tip-bot for Yinghai Lu
0 siblings, 2 replies; 8+ messages in thread
From: Yinghai Lu @ 2010-10-30 8:19 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, H. Peter Anvin
Cc: Russ Anderson, Suresh Siddha, linux-kernel@vger.kernel.org
Russ found that:
| There is a regression that is causing a NULL pointer dereference
| in free_irte when shutting down xpc. git bisect narrowed it down
| to git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139, which
| changed free_irte(). Reverse applying the patch fixes the problem.
and he bisected to
| commit d585d060b42bd36f6f0b23ff327d3b91f80c7139
| Author: Thomas Gleixner <tglx@linutronix.de>
|Date: Sun Oct 10 12:34:27 2010 +0200
|
| intr_remap: Simplify the code further
|
| Having irq_2_iommu in struct irq_cfg allows further simplifications.
We need to use irq_mapped() for every irq instead of intr_remapping_enabled
overall
Reported-by: Russ Anderson <rja@sgi.com>
Bisected-by: Russ Anderson <rja@sgi.com>
Tested-by: Russ Anderson <rja@sgi.com>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
---
arch/x86/kernel/apic/io_apic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Index: linux-2.6/arch/x86/kernel/apic/io_apic.c
===================================================================
--- linux-2.6.orig/arch/x86/kernel/apic/io_apic.c
+++ linux-2.6/arch/x86/kernel/apic/io_apic.c
@@ -3109,7 +3109,7 @@ void destroy_irq(unsigned int irq)
irq_set_status_flags(irq, IRQ_NOREQUEST|IRQ_NOPROBE);
- if (intr_remapping_enabled)
+ if (irq_remapped(get_irq_chip_data(irq)))
free_irte(irq);
raw_spin_lock_irqsave(&vector_lock, flags);
__clear_irq_vector(irq, cfg);
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] x86, uv: Fix uv with destroy_irq()
2010-10-30 8:19 ` [PATCH] x86, uv: Fix uv with destroy_irq() Yinghai Lu
@ 2010-10-30 8:22 ` Thomas Gleixner
2010-10-30 8:36 ` [tip:x86/urgent] x86: Check irq_remapped instead of remapping_enabled in destroy_irq() tip-bot for Yinghai Lu
1 sibling, 0 replies; 8+ messages in thread
From: Thomas Gleixner @ 2010-10-30 8:22 UTC (permalink / raw)
To: Yinghai Lu
Cc: Ingo Molnar, H. Peter Anvin, Russ Anderson, Suresh Siddha,
linux-kernel@vger.kernel.org
On Sat, 30 Oct 2010, Yinghai Lu wrote:
>
> Russ found that:
>
> | There is a regression that is causing a NULL pointer dereference
> | in free_irte when shutting down xpc. git bisect narrowed it down
> | to git commit d585d060b42bd36f6f0b23ff327d3b91f80c7139, which
> | changed free_irte(). Reverse applying the patch fixes the problem.
>
> and he bisected to
>
> | commit d585d060b42bd36f6f0b23ff327d3b91f80c7139
> | Author: Thomas Gleixner <tglx@linutronix.de>
> |Date: Sun Oct 10 12:34:27 2010 +0200
> |
> | intr_remap: Simplify the code further
> |
> | Having irq_2_iommu in struct irq_cfg allows further simplifications.
>
> We need to use irq_mapped() for every irq instead of intr_remapping_enabled
> overall
>
> Reported-by: Russ Anderson <rja@sgi.com>
> Bisected-by: Russ Anderson <rja@sgi.com>
> Tested-by: Russ Anderson <rja@sgi.com>
> Signed-off-by: Yinghai Lu <yinghai@kernel.org>
>
> ---
> arch/x86/kernel/apic/io_apic.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> Index: linux-2.6/arch/x86/kernel/apic/io_apic.c
> ===================================================================
> --- linux-2.6.orig/arch/x86/kernel/apic/io_apic.c
> +++ linux-2.6/arch/x86/kernel/apic/io_apic.c
> @@ -3109,7 +3109,7 @@ void destroy_irq(unsigned int irq)
>
> irq_set_status_flags(irq, IRQ_NOREQUEST|IRQ_NOPROBE);
>
> - if (intr_remapping_enabled)
> + if (irq_remapped(get_irq_chip_data(irq)))
No need for get_irq_chip_data(). We have cfg already. Will fix.
Thanks,
tglx
> free_irte(irq);
> raw_spin_lock_irqsave(&vector_lock, flags);
> __clear_irq_vector(irq, cfg);
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [tip:x86/urgent] x86: Check irq_remapped instead of remapping_enabled in destroy_irq()
2010-10-30 8:19 ` [PATCH] x86, uv: Fix uv with destroy_irq() Yinghai Lu
2010-10-30 8:22 ` Thomas Gleixner
@ 2010-10-30 8:36 ` tip-bot for Yinghai Lu
1 sibling, 0 replies; 8+ messages in thread
From: tip-bot for Yinghai Lu @ 2010-10-30 8:36 UTC (permalink / raw)
To: linux-tip-commits
Cc: linux-kernel, rja, hpa, mingo, yinghai, suresh.b.siddha, tglx
Commit-ID: 7b79462a20826a7269322113c68ca78d5f67c0bd
Gitweb: http://git.kernel.org/tip/7b79462a20826a7269322113c68ca78d5f67c0bd
Author: Yinghai Lu <yinghai@kernel.org>
AuthorDate: Sat, 30 Oct 2010 01:19:29 -0700
Committer: Thomas Gleixner <tglx@linutronix.de>
CommitDate: Sat, 30 Oct 2010 10:28:31 +0200
x86: Check irq_remapped instead of remapping_enabled in destroy_irq()
Russ Anderson reported:
| There is a regression that is causing a NULL pointer dereference
| in free_irte when shutting down xpc. git bisect narrowed it down
| to git commit d585d06(intr_remap: Simplify the code further), which
| changed free_irte(). Reverse applying the patch fixes the problem.
We need to use irq_remapped() for each irq instead of checking only
intr_remapping_enabled as there might be non remapped irqs even when
remapping is enabled.
[ tglx: use cfg instead of retrieving it again. Massaged changelog ]
Reported-bisected-and-tested-by: Russ Anderson <rja@sgi.com>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Cc: Suresh Siddha <suresh.b.siddha@intel.com>
LKML-Reference: <4CCBD511.40607@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
---
arch/x86/kernel/apic/io_apic.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 0929191..7cc0a72 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -3109,7 +3109,7 @@ void destroy_irq(unsigned int irq)
irq_set_status_flags(irq, IRQ_NOREQUEST|IRQ_NOPROBE);
- if (intr_remapping_enabled)
+ if (irq_remapped(cfg))
free_irte(irq);
raw_spin_lock_irqsave(&vector_lock, flags);
__clear_irq_vector(irq, cfg);
^ permalink raw reply related [flat|nested] 8+ messages in thread
end of thread, other threads:[~2010-10-30 8:37 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-10-29 22:22 [BUG] intr_remap: Simplify the code further Russ Anderson
2010-10-30 0:37 ` Suresh Siddha
2010-10-30 1:50 ` Russ Anderson
2010-10-30 2:55 ` Yinghai Lu
2010-10-30 3:48 ` Russ Anderson
2010-10-30 8:19 ` [PATCH] x86, uv: Fix uv with destroy_irq() Yinghai Lu
2010-10-30 8:22 ` Thomas Gleixner
2010-10-30 8:36 ` [tip:x86/urgent] x86: Check irq_remapped instead of remapping_enabled in destroy_irq() tip-bot for Yinghai Lu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox