2005-11-17 16:10:25

by Dinakar Guniguntala

Subject: PI BUG with -rt13

Hi,

I was testing PI support in the -rt tree (-rt13) when I hit the BUG
below. I am using the BULL/Montavista glibc patches. However I would
think this can be reproduced using just plain FUTEX_WAKE/WAIT_ROBUST
APIs as well, though I havent tried. I can send out the test code
if anybody is interested. I have attached the .config below.

-Dinakar

Attachments:

2005-11-17 16:34:04

by Dinakar Guniguntala

Subject: Re: PI BUG with -rt13

Hi,

I also get this sometimes when running the same test

-Dinakar

BUG: Unable to handle kernel NULL pointer dereference at virtual address 00000286
printing eip:
c012220c
*pde = 00000000
Oops: 0002 [#1]
PREEMPT SMP
Modules linked in:
CPU: 3
EIP: 0060:[<c012220c>] Not tainted VLI
EFLAGS: 00010287 (2.6.14-rt13)
EIP is at run_timer_softirq+0x174/0x385
eax: 00000282 ebx: 00000282 ecx: f63bde54 edx: f7f33f70
esi: c3070fe8 edi: 00000000 ebp: c3070fe0 esp: f7f33f58
ds: 007b es: 007b ss: 0068 preempt: 00000001
Process softirq-timer/3 (pid: 31, threadinfo=f7f32000 task=f7f268d0 stack_left=7972 worst_left=-1)
Stack: c3070fe0 c3071840 0000000f f7f32000 c307100c f7f32000 f63bde54 f63c1e54
0000007b f7f32000 f7f32000 c04a3380 f7f32000 c011e70a c0450788 00000001
f7f33fa8 fffffffd c04a3380 00000002 00000001 f7f32000 f7f4bedc c3070f8c
Call Trace:
[<c011e70a>] ksoftirqd+0xea/0x160 (56)
[<c011e620>] ksoftirqd+0x0/0x160 (44)
[<c012cda1>] kthread+0xa3/0xcd (4)
[<c012ccfe>] kthread+0x0/0xcd (28)
[<c0100ebd>] kernel_thread_helper+0x5/0xb (16)
Code: 04 8b 44 24 18 8d 7c 24 18 89 79 04 89 4c 24 18 89 50 04 89 02 89 5b 04 89 5e 60 eb 7f 8b 59 14 8b 79 10 89 4d 28 8b 51
<0>Fatal exception: panic in 5 seconds

2005-11-17 23:03:34

by David Singleton

Subject: Re: PI BUG with -rt13

Dinakar Guniguntala wrote:

>Hi,
>
>I was testing PI support in the -rt tree (-rt13) when I hit the BUG
>below. I am using the BULL/Montavista glibc patches. However I would
>think this can be reproduced using just plain FUTEX_WAKE/WAIT_ROBUST
>APIs as well, though I havent tried. I can send out the test code
>if anybody is interested. I have attached the .config below.
>
>
If I make the lock in the timer_base_s struct a raw spinlock this
BUG goes away.


Dave

> -Dinakar
>
>
>
>
>------------------------------------------------------------------------
>
>testpi-2/1138[CPU#1]: BUG in FREE_WAITER at kernel/rt.c:1368
> [<c011a180>] __WARN_ON+0x60/0x80 (8)
> [<c037c9be>] __down_mutex+0x4fe/0x7fd (48)
> [<c01330d9>] pi_setprio+0xa1/0x642 (104)
> [<c0122196>] lock_timer_base+0x19/0x33 (8)
> [<c037edbd>] _spin_lock_irqsave+0x1d/0x46 (12)
> [<c0122196>] lock_timer_base+0x19/0x33 (8)
> [<c0122196>] lock_timer_base+0x19/0x33 (16)
> [<c01221e8>] __mod_timer+0x38/0xdf (16)
> [<c013aa7b>] sub_preempt_count+0x1a/0x1e (12)
> [<c037e71d>] __down_interruptible+0x923/0xb2b (20)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (16)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (8)
> [<c01344d6>] process_timeout+0x0/0x9 (36)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (64)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (8)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (12)
> [<c0137baa>] down_futex+0x70/0x99 (12)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (12)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (20)
> [<c013a91e>] add_preempt_count_ti+0x1e/0xc6 (100)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (44)
> [<c013c98e>] do_futex+0x96/0xfc (24)
> [<c013caec>] sys_futex+0xf8/0x104 (40)
> [<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
>---------------------------
>| preempt count: 00000001 ]
>| 1-level deep critical section nesting:
>----------------------------------------
>.. [<c013a9e0>] .... add_preempt_count+0x1a/0x1e
>.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
>
>------------------------------
>| showing all locks held by: | (testpi-2/1138 [f6d6c7b0, 69]):
>------------------------------
>
>#001: [c3078fe0] {&base->t_base.lock}
>... acquired at: lock_timer_base+0x19/0x33
>
>testpi-2/1140[CPU#3]: BUG in FREE_WAITER at kernel/rt.c:1368
> [<c011a180>] __WARN_ON+0x60/0x80 (8)
> [<c037c9be>] __down_mutex+0x4fe/0x7fd (48)
> [<c01330d9>] pi_setprio+0xa1/0x642 (104)
> [<c0122196>] lock_timer_base+0x19/0x33 (8)
> [<c037edbd>] _spin_lock_irqsave+0x1d/0x46 (12)
> [<c0122196>] lock_timer_base+0x19/0x33 (8)
> [<c0122196>] lock_timer_base+0x19/0x33 (16)
> [<c01221e8>] __mod_timer+0x38/0xdf (16)
> [<c013aa7b>] sub_preempt_count+0x1a/0x1e (12)
> [<c037e71d>] __down_interruptible+0x923/0xb2b (20)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (16)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (8)
> [<c01344d6>] process_timeout+0x0/0x9 (36)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (64)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (8)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (12)
> [<c0137baa>] down_futex+0x70/0x99 (12)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (12)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (20)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (76)
> [<c013c98e>] do_futex+0x96/0xfc (92)
> [<c013caec>] sys_futex+0xf8/0x104 (40)
> [<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
>---------------------------
>| preempt count: 00000001 ]
>| 1-level deep critical section nesting:
>----------------------------------------
>.. [<c013a9e0>] .... add_preempt_count+0x1a/0x1e
>.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
>
>------------------------------
>| showing all locks held by: | (testpi-2/1140 [f7d980a0, 0]):
>------------------------------
>
>#001: [c3098fe0] {&base->t_base.lock}
>... acquired at: lock_timer_base+0x19/0x33
>
>testpi-2/1139[CPU#0]: BUG in FREE_WAITER at kernel/rt.c:1368
>NMI watchdog detected lockup on CPU#1 (5000/5000)
> [<c011a180>] __WARN_ON+0x60/0x80 (8)
> [<c037c9be>] __down_mutex+0x4fe/0x7fd (48)
> [<c013a91e>] add_preempt_count_ti+0x1e/0xc6 (104)
> [<c0122196>] lock_timer_base+0x19/0x33 (8)
> [<c037edbd>] _spin_lock_irqsave+0x1d/0x46 (12)
> [<c0122196>] lock_timer_base+0x19/0x33 (8)
> [<c0122196>] lock_timer_base+0x19/0x33 (16)
> [<c01221e8>] __mod_timer+0x38/0xdf (16)
> [<c013aa7b>] sub_preempt_count+0x1a/0x1e (12)
> [<c037e71d>] __down_interruptible+0x923/0xb2b (20)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (16)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (8)
> [<c01344d6>] process_timeout+0x0/0x9 (36)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (64)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (8)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (12)
> [<c0137baa>] down_futex+0x70/0x99 (12)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (12)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (20)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (76)
> [<c037ec7d>] __lock_text_start+0x1d/0x41 (24)
> [<c013c98e>] do_futex+0x96/0xfc (68)
> [<c013caec>] sys_futex+0xf8/0x104 (40)
> [<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
>---------------------------
>| preempt count: 00000001 ]
>| 1-level deep critical section nesting:
>----------------------------------------
>.. [<c013a9e0>] .... add_preempt_count+0x1a/0x1e
>.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
>
>------------------------------
>| showing all locks held by: | (testpi-2/1139 [f6c347b0, 59]):
>------------------------------
>
>#00 [c3068fe01: ] {&base->t_base.lock}
>..[. acquired at: lock_timer_base+0x19/0x33
>
>testpi-2/1139[CPU#2]: BUG in FREE_WAITER at kernel/rt.c:1368
> [<c011a180>] __WARN_ON+0x60/0x80 (8)
> [<c037c9be>] __down_mutex+0x4fe/0x7fd (48)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (100)
> [<c0122238>] __mod_timer+0x88/0xdf (12)
> [<c037ec7d>] __lock_text_start+0x1d/0x41 (12)
> [<c0122238>] __mod_timer+0x88/0xdf (8)
> [<c0122238>] __mod_timer+0x88/0xdf (16)
> [<c013aa7b>] sub_preempt_count+0x1a/0x1e (12)
> [<c037e71d>] __down_interruptible+0x923/0xb2b (20)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (16)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (8)
> [<c01344d6>] process_timeout+0x0/0x9 (36)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (64)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (8)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (12)
> [<c0137baa>] down_futex+0x70/0x99 (12)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (12)
> [<c013c1ed>] futex_wait_robust+0x151/0x25b (20)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (76)
> [<c037ec7d>] __lock_text_start+0x1d/0x41 (24)
> [<c013c98e>] do_futex+0x96/0xfc (68)
> [<c013caec>] sys_futex+0xf8/0x104 (40)
> [<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
>---------------------------
>| preempt count: 00000001 ]
>| 1-level deep critical section nesting:
>----------------------------------------
>.. [<c013a9e0>] .... add_preempt_count+0x1a/0x1e
>.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
>
>------------------------------
>| showing all locks held by: | (testpi-2/1139 [f6c347b0, 59]):
>------------------------------
>
>#001: [c3088fe0] {&base->t_base.lock}
>... acquired at: __mod_timer+0x88/0xdf
>
>
>Pid: 14, comm: softirq-timer/1
>EIP: 0060:[<c037f3af>] CPU: 1
>EIP is at _raw_spin_lock+0x19/0x25
> EFLAGS: 00000086 Not tainted (2.6.14-ray-rt1)
>EAX: f7f26830 EBX: c03e4e0c ECX: 00000001 EDX: f7f26830
>ESI: c3078fe0 EDI: 00000002 EBP: f7f26830 DS: 007b ES: 007b
>CR0: 8005003b CR2: b5fb8dcc CR3: 35d67000 CR4: 000006d0
> [<c037c862>] __down_mutex+0x3a2/0x7fd (12)
> [<c037f3f4>] _raw_spin_unlock+0x12/0x2c (12)
> [<c0113828>] load_balance_newidle+0xf1/0x131 (8)
> [<c013aa7b>] sub_preempt_count+0x1a/0x1e (48)
> [<c01319a6>] ktimer_run_queues+0x27/0x131 (24)
> [<c0114551>] __wake_up+0x44/0x69 (8)
> [<c0122b8d>] run_timer_softirq+0x10b/0x3d6 (12)
> [<c037ecff>] _spin_lock_irq+0x1d/0x41 (12)
> [<c0122b8d>] run_timer_softirq+0x10b/0x3d6 (8)
> [<c0122b8d>] run_timer_softirq+0x10b/0x3d6 (16)
> [<c013a91e>] add_preempt_count_ti+0x1e/0xc6 (16)
> [<c011f0e4>] ksoftirqd+0xe7/0x183 (40)
> [<c011effd>] ksoftirqd+0x0/0x183 (32)
> [<c012d811>] kthread+0xa3/0xcd (4)
> [<c012d76e>] kthread+0x0/0xcd (28)
> [<c0100f75>] kernel_thread_helper+0x5/0xb (16)
>---------------------------
>| preempt count: 00000002 ]
>| 2-level deep critical section nesting:
>----------------------------------------
>.. [<c013a9e0>] .... add_preempt_count+0x1a/0x1e
>.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
>.. [<c013a9e0>] .... add_preempt_count+0x1a/0x1e
>.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)
>
>------------------------------
>| showing all locks held by: | (softirq-timer/1/14 [f7f26830, 98]):
>------------------------------
>
>
>
>------------------------------------------------------------------------
>
>#
># Automatically generated make config: don't edit
># Linux kernel version: 2.6.14-rt13
># Thu Nov 17 18:45:04 2005
>#
>CONFIG_X86=y
>CONFIG_GENERIC_TIME=y
>CONFIG_SEMAPHORE_SLEEPERS=y
>CONFIG_MMU=y
>CONFIG_UID16=y
>CONFIG_GENERIC_ISA_DMA=y
>CONFIG_GENERIC_IOMAP=y
>CONFIG_ARCH_MAY_HAVE_PC_FDC=y
>
>#
># Code maturity level options
>#
>CONFIG_EXPERIMENTAL=y
>CONFIG_CLEAN_COMPILE=y
>CONFIG_LOCK_KERNEL=y
>CONFIG_INIT_ENV_ARG_LIMIT=32
>
>#
># General setup
>#
>CONFIG_LOCALVERSION=""
>CONFIG_LOCALVERSION_AUTO=y
>CONFIG_SWAP=y
>CONFIG_SYSVIPC=y
># CONFIG_POSIX_MQUEUE is not set
># CONFIG_BSD_PROCESS_ACCT is not set
>CONFIG_SYSCTL=y
># CONFIG_AUDIT is not set
># CONFIG_HOTPLUG is not set
># CONFIG_KOBJECT_UEVENT is not set
>CONFIG_IKCONFIG=y
># CONFIG_IKCONFIG_PROC is not set
>CONFIG_CPUSETS=y
>CONFIG_INITRAMFS_SOURCE=""
># CONFIG_EMBEDDED is not set
>CONFIG_KALLSYMS=y
># CONFIG_KALLSYMS_ALL is not set
># CONFIG_KALLSYMS_EXTRA_PASS is not set
>CONFIG_PRINTK=y
>CONFIG_BUG=y
>CONFIG_BASE_FULL=y
>CONFIG_FUTEX=y
>CONFIG_EPOLL=y
>CONFIG_SHMEM=y
>CONFIG_CC_ALIGN_FUNCTIONS=0
>CONFIG_CC_ALIGN_LABELS=0
>CONFIG_CC_ALIGN_LOOPS=0
>CONFIG_CC_ALIGN_JUMPS=0
># CONFIG_TINY_SHMEM is not set
>CONFIG_BASE_SMALL=0
>
>#
># Loadable module support
>#
>CONFIG_MODULES=y
>CONFIG_MODULE_UNLOAD=y
># CONFIG_MODULE_FORCE_UNLOAD is not set
>CONFIG_OBSOLETE_MODPARM=y
># CONFIG_MODVERSIONS is not set
># CONFIG_MODULE_SRCVERSION_ALL is not set
>CONFIG_KMOD=y
>CONFIG_STOP_MACHINE=y
>
>#
># Processor type and features
>#
>CONFIG_X86_PC=y
># CONFIG_X86_ELAN is not set
># CONFIG_X86_VOYAGER is not set
># CONFIG_X86_NUMAQ is not set
># CONFIG_X86_SUMMIT is not set
># CONFIG_X86_BIGSMP is not set
># CONFIG_X86_VISWS is not set
># CONFIG_X86_GENERICARCH is not set
># CONFIG_X86_ES7000 is not set
># CONFIG_M386 is not set
># CONFIG_M486 is not set
># CONFIG_M586 is not set
># CONFIG_M586TSC is not set
># CONFIG_M586MMX is not set
># CONFIG_M686 is not set
># CONFIG_MPENTIUMII is not set
># CONFIG_MPENTIUMIII is not set
># CONFIG_MPENTIUMM is not set
>CONFIG_MPENTIUM4=y
># CONFIG_MK6 is not set
># CONFIG_MK7 is not set
># CONFIG_MK8 is not set
># CONFIG_MCRUSOE is not set
># CONFIG_MEFFICEON is not set
># CONFIG_MWINCHIPC6 is not set
># CONFIG_MWINCHIP2 is not set
># CONFIG_MWINCHIP3D is not set
># CONFIG_MGEODEGX1 is not set
># CONFIG_MCYRIXIII is not set
># CONFIG_MVIAC3_2 is not set
># CONFIG_X86_GENERIC is not set
>CONFIG_X86_CMPXCHG=y
>CONFIG_X86_XADD=y
>CONFIG_X86_L1_CACHE_SHIFT=7
>CONFIG_GENERIC_CALIBRATE_DELAY=y
>CONFIG_X86_WP_WORKS_OK=y
>CONFIG_X86_INVLPG=y
>CONFIG_X86_BSWAP=y
>CONFIG_X86_POPAD_OK=y
>CONFIG_X86_GOOD_APIC=y
>CONFIG_X86_INTEL_USERCOPY=y
>CONFIG_X86_USE_PPRO_CHECKSUM=y
># CONFIG_HPET_TIMER is not set
># CONFIG_KTIME_SCALAR is not set
>CONFIG_HIGH_RES_TIMERS=y
>CONFIG_HIGH_RES_RESOLUTION=1000
>CONFIG_SMP=y
>CONFIG_NR_CPUS=32
>CONFIG_SCHED_SMT=y
># CONFIG_PREEMPT_NONE is not set
># CONFIG_PREEMPT_VOLUNTARY is not set
># CONFIG_PREEMPT_DESKTOP is not set
>CONFIG_PREEMPT_RT=y
>CONFIG_PREEMPT=y
>CONFIG_PREEMPT_SOFTIRQS=y
>CONFIG_PREEMPT_HARDIRQS=y
>CONFIG_PREEMPT_BKL=y
>CONFIG_PREEMPT_RCU=y
>CONFIG_RCU_STATS=y
>CONFIG_RWSEM_GENERIC_SPINLOCK=y
>CONFIG_ASM_SEMAPHORES=y
>CONFIG_X86_LOCAL_APIC=y
>CONFIG_X86_IO_APIC=y
>CONFIG_X86_IOAPIC_FAST=y
>CONFIG_X86_TSC=y
>CONFIG_X86_MCE=y
># CONFIG_X86_MCE_NONFATAL is not set
># CONFIG_X86_MCE_P4THERMAL is not set
># CONFIG_TOSHIBA is not set
># CONFIG_I8K is not set
># CONFIG_X86_REBOOTFIXUPS is not set
># CONFIG_MICROCODE is not set
># CONFIG_X86_MSR is not set
># CONFIG_X86_CPUID is not set
>
>#
># Firmware Drivers
>#
># CONFIG_EDD is not set
># CONFIG_DELL_RBU is not set
>CONFIG_DCDBAS=m
># CONFIG_NOHIGHMEM is not set
>CONFIG_HIGHMEM4G=y
># CONFIG_HIGHMEM64G is not set
>CONFIG_HIGHMEM=y
>CONFIG_SELECT_MEMORY_MODEL=y
>CONFIG_FLATMEM_MANUAL=y
># CONFIG_DISCONTIGMEM_MANUAL is not set
># CONFIG_SPARSEMEM_MANUAL is not set
>CONFIG_FLATMEM=y
>CONFIG_FLAT_NODE_MEM_MAP=y
># CONFIG_SPARSEMEM_STATIC is not set
># CONFIG_HIGHPTE is not set
># CONFIG_MATH_EMULATION is not set
># CONFIG_MTRR is not set
># CONFIG_EFI is not set
>CONFIG_IRQBALANCE=y
># CONFIG_REGPARM is not set
>CONFIG_SECCOMP=y
># CONFIG_HZ_100 is not set
># CONFIG_HZ_250 is not set
>CONFIG_HZ_1000=y
>CONFIG_HZ=1000
>CONFIG_PHYSICAL_START=0x100000
># CONFIG_KEXEC is not set
>
>#
># Power management options (ACPI, APM)
>#
>CONFIG_PM=y
># CONFIG_PM_DEBUG is not set
>
>#
># ACPI (Advanced Configuration and Power Interface) Support
>#
>CONFIG_ACPI=y
>CONFIG_ACPI_AC=m
># CONFIG_ACPI_BATTERY is not set
># CONFIG_ACPI_BUTTON is not set
># CONFIG_ACPI_VIDEO is not set
># CONFIG_ACPI_HOTKEY is not set
>CONFIG_ACPI_FAN=m
>CONFIG_ACPI_PROCESSOR=m
>CONFIG_ACPI_THERMAL=m
>CONFIG_ACPI_ASUS=m
>CONFIG_ACPI_IBM=m
>CONFIG_ACPI_TOSHIBA=m
>CONFIG_ACPI_BLACKLIST_YEAR=0
># CONFIG_ACPI_DEBUG is not set
>CONFIG_ACPI_EC=y
>CONFIG_ACPI_POWER=y
>CONFIG_ACPI_SYSTEM=y
># CONFIG_X86_PM_TIMER is not set
># CONFIG_ACPI_CONTAINER is not set
>
>#
># APM (Advanced Power Management) BIOS Support
>#
># CONFIG_APM is not set
>
>#
># CPU Frequency scaling
>#
># CONFIG_CPU_FREQ is not set
>
>#
># Bus options (PCI, PCMCIA, EISA, MCA, ISA)
>#
>CONFIG_PCI=y
># CONFIG_PCI_GOBIOS is not set
># CONFIG_PCI_GOMMCONFIG is not set
># CONFIG_PCI_GODIRECT is not set
>CONFIG_PCI_GOANY=y
>CONFIG_PCI_BIOS=y
>CONFIG_PCI_DIRECT=y
>CONFIG_PCI_MMCONFIG=y
># CONFIG_PCIEPORTBUS is not set
># CONFIG_PCI_MSI is not set
># CONFIG_PCI_LEGACY_PROC is not set
># CONFIG_PCI_DEBUG is not set
>CONFIG_ISA_DMA_API=y
>CONFIG_ISA=y
># CONFIG_EISA is not set
># CONFIG_MCA is not set
># CONFIG_SCx200 is not set
>
>#
># PCCARD (PCMCIA/CardBus) support
>#
># CONFIG_PCCARD is not set
>
>#
># PCI Hotplug Support
>#
># CONFIG_HOTPLUG_PCI is not set
>
>#
># Executable file formats
>#
>CONFIG_BINFMT_ELF=y
># CONFIG_BINFMT_AOUT is not set
># CONFIG_BINFMT_MISC is not set
>
>#
># Networking
>#
>CONFIG_NET=y
>
>#
># Networking options
>#
>CONFIG_PACKET=y
>CONFIG_PACKET_MMAP=y
>CONFIG_UNIX=y
>CONFIG_XFRM=y
>CONFIG_XFRM_USER=y
>CONFIG_NET_KEY=y
>CONFIG_INET=y
>CONFIG_IP_MULTICAST=y
>CONFIG_IP_ADVANCED_ROUTER=y
>CONFIG_ASK_IP_FIB_HASH=y
># CONFIG_IP_FIB_TRIE is not set
>CONFIG_IP_FIB_HASH=y
>CONFIG_IP_MULTIPLE_TABLES=y
># CONFIG_IP_ROUTE_FWMARK is not set
>CONFIG_IP_ROUTE_MULTIPATH=y
># CONFIG_IP_ROUTE_MULTIPATH_CACHED is not set
>CONFIG_IP_ROUTE_VERBOSE=y
>CONFIG_IP_PNP=y
>CONFIG_IP_PNP_DHCP=y
>CONFIG_IP_PNP_BOOTP=y
>CONFIG_IP_PNP_RARP=y
>CONFIG_NET_IPIP=y
>CONFIG_NET_IPGRE=y
>CONFIG_NET_IPGRE_BROADCAST=y
>CONFIG_IP_MROUTE=y
>CONFIG_IP_PIMSM_V1=y
>CONFIG_IP_PIMSM_V2=y
>CONFIG_ARPD=y
>CONFIG_SYN_COOKIES=y
>CONFIG_INET_AH=y
>CONFIG_INET_ESP=y
># CONFIG_INET_IPCOMP is not set
>CONFIG_INET_TUNNEL=y
>CONFIG_INET_DIAG=y
>CONFIG_INET_TCP_DIAG=y
># CONFIG_TCP_CONG_ADVANCED is not set
>CONFIG_TCP_CONG_BIC=y
>
>#
># IP: Virtual Server Configuration
>#
># CONFIG_IP_VS is not set
># CONFIG_IPV6 is not set
>CONFIG_NETFILTER=y
>CONFIG_NETFILTER_DEBUG=y
># CONFIG_NETFILTER_NETLINK is not set
>
>#
># IP: Netfilter Configuration
>#
>CONFIG_IP_NF_CONNTRACK=y
># CONFIG_IP_NF_CT_ACCT is not set
># CONFIG_IP_NF_CONNTRACK_MARK is not set
># CONFIG_IP_NF_CONNTRACK_EVENTS is not set
># CONFIG_IP_NF_CT_PROTO_SCTP is not set
>CONFIG_IP_NF_FTP=y
>CONFIG_IP_NF_IRC=y
># CONFIG_IP_NF_NETBIOS_NS is not set
># CONFIG_IP_NF_TFTP is not set
># CONFIG_IP_NF_AMANDA is not set
># CONFIG_IP_NF_PPTP is not set
>CONFIG_IP_NF_QUEUE=y
>CONFIG_IP_NF_IPTABLES=y
>CONFIG_IP_NF_MATCH_LIMIT=y
># CONFIG_IP_NF_MATCH_IPRANGE is not set
>CONFIG_IP_NF_MATCH_MAC=y
>CONFIG_IP_NF_MATCH_PKTTYPE=y
>CONFIG_IP_NF_MATCH_MARK=y
>CONFIG_IP_NF_MATCH_MULTIPORT=y
>CONFIG_IP_NF_MATCH_TOS=y
># CONFIG_IP_NF_MATCH_RECENT is not set
>CONFIG_IP_NF_MATCH_ECN=y
>CONFIG_IP_NF_MATCH_DSCP=y
>CONFIG_IP_NF_MATCH_AH_ESP=y
>CONFIG_IP_NF_MATCH_LENGTH=y
>CONFIG_IP_NF_MATCH_TTL=y
>CONFIG_IP_NF_MATCH_TCPMSS=y
>CONFIG_IP_NF_MATCH_HELPER=y
>CONFIG_IP_NF_MATCH_STATE=y
>CONFIG_IP_NF_MATCH_CONNTRACK=y
>CONFIG_IP_NF_MATCH_OWNER=y
># CONFIG_IP_NF_MATCH_ADDRTYPE is not set
># CONFIG_IP_NF_MATCH_REALM is not set
># CONFIG_IP_NF_MATCH_SCTP is not set
># CONFIG_IP_NF_MATCH_DCCP is not set
># CONFIG_IP_NF_MATCH_COMMENT is not set
># CONFIG_IP_NF_MATCH_HASHLIMIT is not set
># CONFIG_IP_NF_MATCH_STRING is not set
>CONFIG_IP_NF_FILTER=y
>CONFIG_IP_NF_TARGET_REJECT=y
># CONFIG_IP_NF_TARGET_LOG is not set
># CONFIG_IP_NF_TARGET_ULOG is not set
># CONFIG_IP_NF_TARGET_TCPMSS is not set
># CONFIG_IP_NF_TARGET_NFQUEUE is not set
>CONFIG_IP_NF_NAT=y
>CONFIG_IP_NF_NAT_NEEDED=y
>CONFIG_IP_NF_TARGET_MASQUERADE=y
>CONFIG_IP_NF_TARGET_REDIRECT=y
># CONFIG_IP_NF_TARGET_NETMAP is not set
># CONFIG_IP_NF_TARGET_SAME is not set
>CONFIG_IP_NF_NAT_SNMP_BASIC=y
>CONFIG_IP_NF_NAT_IRC=y
>CONFIG_IP_NF_NAT_FTP=y
>CONFIG_IP_NF_MANGLE=y
>CONFIG_IP_NF_TARGET_TOS=y
># CONFIG_IP_NF_TARGET_ECN is not set
># CONFIG_IP_NF_TARGET_DSCP is not set
># CONFIG_IP_NF_TARGET_MARK is not set
># CONFIG_IP_NF_TARGET_CLASSIFY is not set
># CONFIG_IP_NF_TARGET_TTL is not set
># CONFIG_IP_NF_RAW is not set
># CONFIG_IP_NF_ARPTABLES is not set
>
>#
># DCCP Configuration (EXPERIMENTAL)
>#
># CONFIG_IP_DCCP is not set
>
>#
># SCTP Configuration (EXPERIMENTAL)
>#
># CONFIG_IP_SCTP is not set
># CONFIG_ATM is not set
># CONFIG_BRIDGE is not set
># CONFIG_VLAN_8021Q is not set
># CONFIG_DECNET is not set
># CONFIG_LLC2 is not set
># CONFIG_IPX is not set
># CONFIG_ATALK is not set
># CONFIG_X25 is not set
># CONFIG_LAPB is not set
># CONFIG_NET_DIVERT is not set
># CONFIG_ECONET is not set
># CONFIG_WAN_ROUTER is not set
>CONFIG_NET_SCHED=y
>CONFIG_NET_SCH_CLK_JIFFIES=y
># CONFIG_NET_SCH_CLK_GETTIMEOFDAY is not set
># CONFIG_NET_SCH_CLK_CPU is not set
># CONFIG_NET_SCH_CBQ is not set
># CONFIG_NET_SCH_HTB is not set
># CONFIG_NET_SCH_HFSC is not set
>CONFIG_NET_SCH_PRIO=y
># CONFIG_NET_SCH_RED is not set
># CONFIG_NET_SCH_SFQ is not set
># CONFIG_NET_SCH_TEQL is not set
># CONFIG_NET_SCH_TBF is not set
># CONFIG_NET_SCH_GRED is not set
># CONFIG_NET_SCH_DSMARK is not set
># CONFIG_NET_SCH_NETEM is not set
># CONFIG_NET_SCH_INGRESS is not set
># CONFIG_NET_QOS is not set
># CONFIG_NET_CLS is not set
># CONFIG_NET_CLS_ROUTE is not set
>
>#
># Network testing
>#
># CONFIG_NET_PKTGEN is not set
># CONFIG_HAMRADIO is not set
># CONFIG_IRDA is not set
># CONFIG_BT is not set
># CONFIG_IEEE80211 is not set
>
>#
># Device Drivers
>#
>
>#
># Generic Driver Options
>#
>CONFIG_STANDALONE=y
>CONFIG_PREVENT_FIRMWARE_BUILD=y
># CONFIG_FW_LOADER is not set
># CONFIG_DEBUG_DRIVER is not set
>
>#
># Connector - unified userspace <-> kernelspace linker
>#
># CONFIG_CONNECTOR is not set
>
>#
># Memory Technology Devices (MTD)
>#
># CONFIG_MTD is not set
>
>#
># Parallel port support
>#
># CONFIG_PARPORT is not set
>
>#
># Plug and Play support
>#
># CONFIG_PNP is not set
>
>#
># Block devices
>#
>CONFIG_BLK_DEV_FD=y
># CONFIG_BLK_DEV_XD is not set
># CONFIG_BLK_CPQ_DA is not set
># CONFIG_BLK_CPQ_CISS_DA is not set
># CONFIG_BLK_DEV_DAC960 is not set
># CONFIG_BLK_DEV_UMEM is not set
># CONFIG_BLK_DEV_COW_COMMON is not set
>CONFIG_BLK_DEV_LOOP=y
># CONFIG_BLK_DEV_CRYPTOLOOP is not set
>CONFIG_BLK_DEV_NBD=y
># CONFIG_BLK_DEV_SX8 is not set
>CONFIG_BLK_DEV_RAM=y
>CONFIG_BLK_DEV_RAM_COUNT=16
>CONFIG_BLK_DEV_RAM_SIZE=4096
>CONFIG_BLK_DEV_INITRD=y
># CONFIG_LBD is not set
># CONFIG_CDROM_PKTCDVD is not set
>
>#
># IO Schedulers
>#
>CONFIG_IOSCHED_NOOP=y
>CONFIG_IOSCHED_AS=y
>CONFIG_IOSCHED_DEADLINE=y
>CONFIG_IOSCHED_CFQ=y
># CONFIG_ATA_OVER_ETH is not set
>
>#
># ATA/ATAPI/MFM/RLL support
>#
>CONFIG_IDE=y
>CONFIG_BLK_DEV_IDE=y
>
>#
># Please see Documentation/ide.txt for help/info on IDE drives
>#
># CONFIG_BLK_DEV_IDE_SATA is not set
># CONFIG_BLK_DEV_HD_IDE is not set
>CONFIG_BLK_DEV_IDEDISK=y
># CONFIG_IDEDISK_MULTI_MODE is not set
>CONFIG_BLK_DEV_IDECD=y
># CONFIG_BLK_DEV_IDETAPE is not set
>CONFIG_BLK_DEV_IDEFLOPPY=y
># CONFIG_BLK_DEV_IDESCSI is not set
># CONFIG_IDE_TASK_IOCTL is not set
>
>#
># IDE chipset support/bugfixes
>#
>CONFIG_IDE_GENERIC=y
># CONFIG_BLK_DEV_CMD640 is not set
># CONFIG_BLK_DEV_IDEPCI is not set
># CONFIG_IDE_ARM is not set
># CONFIG_IDE_CHIPSETS is not set
># CONFIG_BLK_DEV_IDEDMA is not set
># CONFIG_IDEDMA_AUTO is not set
># CONFIG_BLK_DEV_HD is not set
>
>#
># SCSI device support
>#
># CONFIG_RAID_ATTRS is not set
>CONFIG_SCSI=y
>CONFIG_SCSI_PROC_FS=y
>
>#
># SCSI support type (disk, tape, CD-ROM)
>#
>CONFIG_BLK_DEV_SD=y
>CONFIG_CHR_DEV_ST=y
># CONFIG_CHR_DEV_OSST is not set
>CONFIG_BLK_DEV_SR=y
># CONFIG_BLK_DEV_SR_VENDOR is not set
># CONFIG_CHR_DEV_SG is not set
># CONFIG_CHR_DEV_SCH is not set
>
>#
># Some SCSI devices (e.g. CD jukebox) support multiple LUNs
>#
>CONFIG_SCSI_MULTI_LUN=y
>CONFIG_SCSI_CONSTANTS=y
># CONFIG_SCSI_LOGGING is not set
>
>#
># SCSI Transport Attributes
>#
>CONFIG_SCSI_SPI_ATTRS=y
># CONFIG_SCSI_FC_ATTRS is not set
># CONFIG_SCSI_ISCSI_ATTRS is not set
># CONFIG_SCSI_SAS_ATTRS is not set
>
>#
># SCSI low-level drivers
>#
># CONFIG_BLK_DEV_3W_XXXX_RAID is not set
># CONFIG_SCSI_3W_9XXX is not set
># CONFIG_SCSI_7000FASST is not set
># CONFIG_SCSI_ACARD is not set
># CONFIG_SCSI_AHA152X is not set
># CONFIG_SCSI_AHA1542 is not set
># CONFIG_SCSI_AACRAID is not set
>CONFIG_SCSI_AIC7XXX=y
>CONFIG_AIC7XXX_CMDS_PER_DEVICE=32
>CONFIG_AIC7XXX_RESET_DELAY_MS=15000
>CONFIG_AIC7XXX_DEBUG_ENABLE=y
>CONFIG_AIC7XXX_DEBUG_MASK=0
>CONFIG_AIC7XXX_REG_PRETTY_PRINT=y
># CONFIG_SCSI_AIC7XXX_OLD is not set
># CONFIG_SCSI_AIC79XX is not set
># CONFIG_SCSI_DPT_I2O is not set
># CONFIG_SCSI_IN2000 is not set
># CONFIG_MEGARAID_NEWGEN is not set
># CONFIG_MEGARAID_LEGACY is not set
># CONFIG_MEGARAID_SAS is not set
># CONFIG_SCSI_SATA is not set
># CONFIG_SCSI_BUSLOGIC is not set
># CONFIG_SCSI_DMX3191D is not set
># CONFIG_SCSI_DTC3280 is not set
># CONFIG_SCSI_EATA is not set
># CONFIG_SCSI_FUTURE_DOMAIN is not set
># CONFIG_SCSI_GDTH is not set
># CONFIG_SCSI_GENERIC_NCR5380 is not set
># CONFIG_SCSI_GENERIC_NCR5380_MMIO is not set
># CONFIG_SCSI_IPS is not set
># CONFIG_SCSI_INITIO is not set
># CONFIG_SCSI_INIA100 is not set
># CONFIG_SCSI_NCR53C406A is not set
># CONFIG_SCSI_SYM53C8XX_2 is not set
># CONFIG_SCSI_IPR is not set
># CONFIG_SCSI_PAS16 is not set
># CONFIG_SCSI_PSI240I is not set
># CONFIG_SCSI_QLOGIC_FAS is not set
># CONFIG_SCSI_QLOGIC_FC is not set
># CONFIG_SCSI_QLOGIC_1280 is not set
>CONFIG_SCSI_QLA2XXX=y
># CONFIG_SCSI_QLA21XX is not set
># CONFIG_SCSI_QLA22XX is not set
># CONFIG_SCSI_QLA2300 is not set
># CONFIG_SCSI_QLA2322 is not set
># CONFIG_SCSI_QLA6312 is not set
># CONFIG_SCSI_QLA24XX is not set
># CONFIG_SCSI_LPFC is not set
># CONFIG_SCSI_SYM53C416 is not set
># CONFIG_SCSI_DC395x is not set
># CONFIG_SCSI_DC390T is not set
># CONFIG_SCSI_T128 is not set
># CONFIG_SCSI_U14_34F is not set
># CONFIG_SCSI_ULTRASTOR is not set
># CONFIG_SCSI_NSP32 is not set
># CONFIG_SCSI_DEBUG is not set
>
>#
># Old CD-ROM drivers (not SCSI, not IDE)
>#
># CONFIG_CD_NO_IDESCSI is not set
>
>#
># Multi-device support (RAID and LVM)
>#
># CONFIG_MD is not set
>
>#
># Fusion MPT device support
>#
># CONFIG_FUSION is not set
># CONFIG_FUSION_SPI is not set
># CONFIG_FUSION_FC is not set
># CONFIG_FUSION_SAS is not set
>
>#
># IEEE 1394 (FireWire) support
>#
># CONFIG_IEEE1394 is not set
>
>#
># I2O device support
>#
># CONFIG_I2O is not set
>
>#
># Network device support
>#
>CONFIG_NETDEVICES=y
>CONFIG_DUMMY=y
># CONFIG_BONDING is not set
># CONFIG_EQUALIZER is not set
># CONFIG_TUN is not set
>
>#
># ARCnet devices
>#
># CONFIG_ARCNET is not set
>
>#
># PHY device support
>#
>
>#
># Ethernet (10 or 100Mbit)
>#
># CONFIG_NET_ETHERNET is not set
>
>#
># Ethernet (1000 Mbit)
>#
># CONFIG_ACENIC is not set
># CONFIG_DL2K is not set
># CONFIG_E1000 is not set
># CONFIG_NS83820 is not set
># CONFIG_HAMACHI is not set
># CONFIG_YELLOWFIN is not set
># CONFIG_R8169 is not set
># CONFIG_SIS190 is not set
># CONFIG_SKGE is not set
># CONFIG_SK98LIN is not set
>CONFIG_TIGON3=y
># CONFIG_BNX2 is not set
>
>#
># Ethernet (10000 Mbit)
>#
># CONFIG_CHELSIO_T1 is not set
># CONFIG_IXGB is not set
># CONFIG_S2IO is not set
>
>#
># Token Ring devices
>#
># CONFIG_TR is not set
>
>#
># Wireless LAN (non-hamradio)
>#
># CONFIG_NET_RADIO is not set
>
>#
># Wan interfaces
>#
># CONFIG_WAN is not set
># CONFIG_FDDI is not set
># CONFIG_HIPPI is not set
># CONFIG_PPP is not set
># CONFIG_SLIP is not set
># CONFIG_NET_FC is not set
># CONFIG_SHAPER is not set
># CONFIG_NETCONSOLE is not set
># CONFIG_NETPOLL is not set
># CONFIG_NET_POLL_CONTROLLER is not set
>
>#
># ISDN subsystem
>#
># CONFIG_ISDN is not set
>
>#
># Telephony Support
>#
># CONFIG_PHONE is not set
>
>#
># Input device support
>#
>CONFIG_INPUT=y
>
>#
># Userland interfaces
>#
>CONFIG_INPUT_MOUSEDEV=y
>CONFIG_INPUT_MOUSEDEV_PSAUX=y
>CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
>CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
># CONFIG_INPUT_JOYDEV is not set
># CONFIG_INPUT_TSDEV is not set
># CONFIG_INPUT_EVDEV is not set
># CONFIG_INPUT_EVBUG is not set
>
>#
># Input Device Drivers
>#
>CONFIG_INPUT_KEYBOARD=y
>CONFIG_KEYBOARD_ATKBD=y
># CONFIG_KEYBOARD_SUNKBD is not set
># CONFIG_KEYBOARD_LKKBD is not set
># CONFIG_KEYBOARD_XTKBD is not set
># CONFIG_KEYBOARD_NEWTON is not set
>CONFIG_INPUT_MOUSE=y
>CONFIG_MOUSE_PS2=y
># CONFIG_MOUSE_SERIAL is not set
># CONFIG_MOUSE_INPORT is not set
>CONFIG_MOUSE_LOGIBM=y
># CONFIG_MOUSE_PC110PAD is not set
># CONFIG_MOUSE_VSXXXAA is not set
># CONFIG_INPUT_JOYSTICK is not set
># CONFIG_INPUT_TOUCHSCREEN is not set
># CONFIG_INPUT_MISC is not set
>
>#
># Hardware I/O ports
>#
>CONFIG_SERIO=y
>CONFIG_SERIO_I8042=y
>CONFIG_SERIO_SERPORT=y
># CONFIG_SERIO_CT82C710 is not set
># CONFIG_SERIO_PCIPS2 is not set
>CONFIG_SERIO_LIBPS2=y
># CONFIG_SERIO_RAW is not set
># CONFIG_GAMEPORT is not set
>
>#
># Character devices
>#
>CONFIG_VT=y
>CONFIG_VT_CONSOLE=y
>CONFIG_HW_CONSOLE=y
># CONFIG_SERIAL_NONSTANDARD is not set
>
>#
># Serial drivers
>#
>CONFIG_SERIAL_8250=y
>CONFIG_SERIAL_8250_CONSOLE=y
># CONFIG_SERIAL_8250_ACPI is not set
>CONFIG_SERIAL_8250_NR_UARTS=4
># CONFIG_SERIAL_8250_EXTENDED is not set
>
>#
># Non-8250 serial port support
>#
>CONFIG_SERIAL_CORE=y
>CONFIG_SERIAL_CORE_CONSOLE=y
># CONFIG_SERIAL_JSM is not set
>CONFIG_UNIX98_PTYS=y
>CONFIG_LEGACY_PTYS=y
>CONFIG_LEGACY_PTY_COUNT=256
>
>#
># IPMI
>#
># CONFIG_IPMI_HANDLER is not set
>
>#
># Watchdog Cards
>#
># CONFIG_WATCHDOG is not set
># CONFIG_HW_RANDOM is not set
># CONFIG_NVRAM is not set
>CONFIG_RTC=y
># CONFIG_RTC_HISTOGRAM is not set
>CONFIG_BLOCKER=y
>CONFIG_LPPTEST=y
># CONFIG_DTLK is not set
># CONFIG_R3964 is not set
># CONFIG_APPLICOM is not set
># CONFIG_SONYPI is not set
>
>#
># Ftape, the floppy tape device driver
>#
># CONFIG_AGP is not set
># CONFIG_DRM is not set
># CONFIG_MWAVE is not set
>CONFIG_RAW_DRIVER=y
># CONFIG_HPET is not set
>CONFIG_MAX_RAW_DEVS=256
># CONFIG_HANGCHECK_TIMER is not set
>
>#
># TPM devices
>#
># CONFIG_TCG_TPM is not set
>
>#
># I2C support
>#
># CONFIG_I2C is not set
>
>#
># Dallas's 1-wire bus
>#
># CONFIG_W1 is not set
>
>#
># Hardware Monitoring support
>#
>CONFIG_HWMON=y
># CONFIG_HWMON_VID is not set
># CONFIG_SENSORS_HDAPS is not set
># CONFIG_HWMON_DEBUG_CHIP is not set
>
>#
># Misc devices
>#
># CONFIG_IBM_ASM is not set
>
>#
># Multimedia Capabilities Port drivers
>#
>
>#
># Multimedia devices
>#
># CONFIG_VIDEO_DEV is not set
>
>#
># Digital Video Broadcasting Devices
>#
># CONFIG_DVB is not set
>
>#
># Graphics support
>#
># CONFIG_FB is not set
># CONFIG_VIDEO_SELECT is not set
>
>#
># Console display driver support
>#
>CONFIG_VGA_CONSOLE=y
># CONFIG_MDA_CONSOLE is not set
>CONFIG_DUMMY_CONSOLE=y
>
>#
># Sound
>#
># CONFIG_SOUND is not set
>
>#
># USB support
>#
>CONFIG_USB_ARCH_HAS_HCD=y
>CONFIG_USB_ARCH_HAS_OHCI=y
># CONFIG_USB is not set
>
>#
># USB Gadget Support
>#
># CONFIG_USB_GADGET is not set
>
>#
># MMC/SD Card support
>#
># CONFIG_MMC is not set
>
>#
># InfiniBand support
>#
># CONFIG_INFINIBAND is not set
>
>#
># SN Devices
>#
>
>#
># File systems
>#
>CONFIG_EXT2_FS=y
>CONFIG_EXT2_FS_XATTR=y
># CONFIG_EXT2_FS_POSIX_ACL is not set
># CONFIG_EXT2_FS_SECURITY is not set
># CONFIG_EXT2_FS_XIP is not set
>CONFIG_EXT3_FS=y
>CONFIG_EXT3_FS_XATTR=y
># CONFIG_EXT3_FS_POSIX_ACL is not set
># CONFIG_EXT3_FS_SECURITY is not set
>CONFIG_JBD=y
># CONFIG_JBD_DEBUG is not set
>CONFIG_FS_MBCACHE=y
># CONFIG_REISERFS_FS is not set
># CONFIG_JFS_FS is not set
># CONFIG_FS_POSIX_ACL is not set
># CONFIG_XFS_FS is not set
># CONFIG_MINIX_FS is not set
># CONFIG_ROMFS_FS is not set
>CONFIG_INOTIFY=y
># CONFIG_QUOTA is not set
>CONFIG_DNOTIFY=y
># CONFIG_AUTOFS_FS is not set
>CONFIG_AUTOFS4_FS=y
># CONFIG_FUSE_FS is not set
>
>#
># CD-ROM/DVD Filesystems
>#
>CONFIG_ISO9660_FS=y
>CONFIG_JOLIET=y
>CONFIG_ZISOFS=y
>CONFIG_ZISOFS_FS=y
>CONFIG_UDF_FS=y
>CONFIG_UDF_NLS=y
>
>#
># DOS/FAT/NT Filesystems
>#
># CONFIG_MSDOS_FS is not set
># CONFIG_VFAT_FS is not set
># CONFIG_NTFS_FS is not set
>
>#
># Pseudo filesystems
>#
>CONFIG_PROC_FS=y
>CONFIG_PROC_KCORE=y
>CONFIG_SYSFS=y
>CONFIG_TMPFS=y
>CONFIG_HUGETLBFS=y
>CONFIG_HUGETLB_PAGE=y
>CONFIG_RAMFS=y
># CONFIG_RELAYFS_FS is not set
>
>#
># Miscellaneous filesystems
>#
># CONFIG_ADFS_FS is not set
># CONFIG_AFFS_FS is not set
># CONFIG_HFS_FS is not set
># CONFIG_HFSPLUS_FS is not set
># CONFIG_BEFS_FS is not set
># CONFIG_BFS_FS is not set
># CONFIG_EFS_FS is not set
># CONFIG_CRAMFS is not set
># CONFIG_VXFS_FS is not set
># CONFIG_HPFS_FS is not set
># CONFIG_QNX4FS_FS is not set
># CONFIG_SYSV_FS is not set
># CONFIG_UFS_FS is not set
>
>#
># Network File Systems
>#
>CONFIG_NFS_FS=y
># CONFIG_NFS_V3 is not set
># CONFIG_NFS_V4 is not set
># CONFIG_NFS_DIRECTIO is not set
>CONFIG_NFSD=y
># CONFIG_NFSD_V3 is not set
># CONFIG_NFSD_TCP is not set
># CONFIG_ROOT_NFS is not set
>CONFIG_LOCKD=y
>CONFIG_EXPORTFS=y
>CONFIG_NFS_COMMON=y
>CONFIG_SUNRPC=y
># CONFIG_RPCSEC_GSS_KRB5 is not set
># CONFIG_RPCSEC_GSS_SPKM3 is not set
># CONFIG_SMB_FS is not set
># CONFIG_CIFS is not set
># CONFIG_NCP_FS is not set
># CONFIG_CODA_FS is not set
># CONFIG_AFS_FS is not set
># CONFIG_9P_FS is not set
>
>#
># Partition Types
>#
># CONFIG_PARTITION_ADVANCED is not set
>CONFIG_MSDOS_PARTITION=y
>
>#
># Native Language Support
>#
>CONFIG_NLS=y
>CONFIG_NLS_DEFAULT="iso8859-1"
># CONFIG_NLS_CODEPAGE_437 is not set
># CONFIG_NLS_CODEPAGE_737 is not set
># CONFIG_NLS_CODEPAGE_775 is not set
># CONFIG_NLS_CODEPAGE_850 is not set
># CONFIG_NLS_CODEPAGE_852 is not set
># CONFIG_NLS_CODEPAGE_855 is not set
># CONFIG_NLS_CODEPAGE_857 is not set
># CONFIG_NLS_CODEPAGE_860 is not set
># CONFIG_NLS_CODEPAGE_861 is not set
># CONFIG_NLS_CODEPAGE_862 is not set
># CONFIG_NLS_CODEPAGE_863 is not set
># CONFIG_NLS_CODEPAGE_864 is not set
># CONFIG_NLS_CODEPAGE_865 is not set
># CONFIG_NLS_CODEPAGE_866 is not set
># CONFIG_NLS_CODEPAGE_869 is not set
># CONFIG_NLS_CODEPAGE_936 is not set
># CONFIG_NLS_CODEPAGE_950 is not set
># CONFIG_NLS_CODEPAGE_932 is not set
># CONFIG_NLS_CODEPAGE_949 is not set
># CONFIG_NLS_CODEPAGE_874 is not set
># CONFIG_NLS_ISO8859_8 is not set
># CONFIG_NLS_CODEPAGE_1250 is not set
># CONFIG_NLS_CODEPAGE_1251 is not set
># CONFIG_NLS_ASCII is not set
># CONFIG_NLS_ISO8859_1 is not set
># CONFIG_NLS_ISO8859_2 is not set
># CONFIG_NLS_ISO8859_3 is not set
># CONFIG_NLS_ISO8859_4 is not set
># CONFIG_NLS_ISO8859_5 is not set
># CONFIG_NLS_ISO8859_6 is not set
># CONFIG_NLS_ISO8859_7 is not set
># CONFIG_NLS_ISO8859_9 is not set
># CONFIG_NLS_ISO8859_13 is not set
># CONFIG_NLS_ISO8859_14 is not set
># CONFIG_NLS_ISO8859_15 is not set
># CONFIG_NLS_KOI8_R is not set
># CONFIG_NLS_KOI8_U is not set
># CONFIG_NLS_UTF8 is not set
>
>#
># Profiling support
>#
>CONFIG_PROFILING=y
>CONFIG_OPROFILE=y
>CONFIG_PROFILE_NMI=y
>
>#
># Kernel hacking
>#
># CONFIG_PRINTK_TIME is not set
>CONFIG_PRINTK_IGNORE_LOGLEVEL=y
>CONFIG_DEBUG_KERNEL=y
>CONFIG_MAGIC_SYSRQ=y
>CONFIG_LOG_BUF_SHIFT=15
>CONFIG_DETECT_SOFTLOCKUP=y
># CONFIG_SCHEDSTATS is not set
># CONFIG_DEBUG_SLAB is not set
>CONFIG_DEBUG_PREEMPT=y
>CONFIG_DEBUG_IRQ_FLAGS=y
># CONFIG_WAKEUP_TIMING is not set
>CONFIG_PREEMPT_TRACE=y
># CONFIG_CRITICAL_PREEMPT_TIMING is not set
># CONFIG_CRITICAL_IRQSOFF_TIMING is not set
>CONFIG_DEBUG_DEADLOCKS=y
># CONFIG_DEBUG_RT_LOCKING_MODE is not set
># CONFIG_DEBUG_KOBJECT is not set
># CONFIG_DEBUG_HIGHMEM is not set
>CONFIG_DEBUG_BUGVERBOSE=y
># CONFIG_DEBUG_INFO is not set
># CONFIG_DEBUG_FS is not set
># CONFIG_DEBUG_VM is not set
># CONFIG_RCU_TORTURE_TEST is not set
># CONFIG_USE_FRAME_POINTER is not set
>CONFIG_EARLY_PRINTK=y
># CONFIG_DEBUG_STACKOVERFLOW is not set
># CONFIG_KPROBES is not set
># CONFIG_DEBUG_STACK_USAGE is not set
># CONFIG_DEBUG_PAGEALLOC is not set
># CONFIG_4KSTACKS is not set
>CONFIG_X86_FIND_SMP_CONFIG=y
>CONFIG_X86_MPPARSE=y
>
>#
># Security options
>#
># CONFIG_KEYS is not set
># CONFIG_SECURITY is not set
>
>#
># Cryptographic options
>#
>CONFIG_CRYPTO=y
>CONFIG_CRYPTO_HMAC=y
>CONFIG_CRYPTO_NULL=y
>CONFIG_CRYPTO_MD4=y
>CONFIG_CRYPTO_MD5=y
>CONFIG_CRYPTO_SHA1=y
>CONFIG_CRYPTO_SHA256=y
># CONFIG_CRYPTO_SHA512 is not set
># CONFIG_CRYPTO_WP512 is not set
># CONFIG_CRYPTO_TGR192 is not set
>CONFIG_CRYPTO_DES=y
>CONFIG_CRYPTO_BLOWFISH=y
>CONFIG_CRYPTO_TWOFISH=y
>CONFIG_CRYPTO_SERPENT=y
># CONFIG_CRYPTO_AES_586 is not set
># CONFIG_CRYPTO_CAST5 is not set
># CONFIG_CRYPTO_CAST6 is not set
># CONFIG_CRYPTO_TEA is not set
># CONFIG_CRYPTO_ARC4 is not set
># CONFIG_CRYPTO_KHAZAD is not set
># CONFIG_CRYPTO_ANUBIS is not set
># CONFIG_CRYPTO_DEFLATE is not set
># CONFIG_CRYPTO_MICHAEL_MIC is not set
># CONFIG_CRYPTO_CRC32C is not set
>CONFIG_CRYPTO_TEST=y
>
>#
># Hardware crypto devices
>#
># CONFIG_CRYPTO_DEV_PADLOCK is not set
>
>#
># Library routines
>#
># CONFIG_CRC_CCITT is not set
># CONFIG_CRC16 is not set
>CONFIG_CRC32=y
># CONFIG_LIBCRC32C is not set
>CONFIG_ZLIB_INFLATE=y
>CONFIG_GENERIC_HARDIRQS=y
>CONFIG_GENERIC_IRQ_PROBE=y
>CONFIG_GENERIC_PENDING_IRQ=y
>CONFIG_X86_SMP=y
>CONFIG_X86_HT=y
>CONFIG_X86_BIOS_REBOOT=y
>CONFIG_X86_TRAMPOLINE=y
>CONFIG_PC=y
>
>

2005-11-18 09:29:04

by Ingo Molnar

Subject: Re: PI BUG with -rt13

* David Singleton <[email protected]> wrote:

> >I was testing PI support in the -rt tree (-rt13) when I hit the BUG
> >below. I am using the BULL/Montavista glibc patches. However I would
> >think this can be reproduced using just plain FUTEX_WAKE/WAIT_ROBUST
> >APIs as well, though I havent tried. I can send out the test code
> >if anybody is interested. I have attached the .config below.
> >
> >

> If I make the lock in the timer_base_s struct a raw spinlock this
> BUG goes away.

that most likely just papers over the real bug. Given task-reference
count bug i fixed in the robust/PI-futexes code (see the patch below) i
suspect some more races and/or plain incorrect code.

[this patch below also converts the robust/PI-futex code to use RCU
instead of the tasklist_lock - which should remove a major latency
source from the futex code].

Ingo

Index: linux/kernel/rt.c
===================================================================
--- linux.orig/kernel/rt.c
+++ linux/kernel/rt.c
@@ -2939,15 +2939,20 @@ EXPORT_SYMBOL(rt_mutex_owned_by);
* and now own the lock, or negative values for failure, or positive
* values for the amount of time we waited before getting the lock.
*/
-int fastcall down_futex(struct rt_mutex *lock, unsigned long time, pid_t owner_pid)
+int fastcall
+down_futex(struct rt_mutex *lock, unsigned long time, pid_t owner_pid)
{
struct task_struct *owner_task = NULL;
#ifdef CONFIG_DEBUG_DEADLOCKS
unsigned long eip = CALLER_ADDR0;
#endif
- read_lock(&tasklist_lock);
+ int ret;
+
+ rcu_read_lock();
owner_task = find_task_by_pid(owner_pid);
- read_unlock(&tasklist_lock);
+ if (!get_task_struct_rcu(owner_task))
+ owner_task = NULL;
+ rcu_read_unlock();

if (!owner_task)
return -EOWNERDEAD;
@@ -2956,7 +2961,10 @@ int fastcall down_futex(struct rt_mutex
__down_mutex(lock __EIP__);
rt_mutex_set_owner(lock, owner_task->thread_info);
}
- return __down_interruptible(lock, time __EIP__);
+ ret = __down_interruptible(lock, time __EIP__);
+ put_task_struct(owner_task);
+
+ return ret;
}
EXPORT_SYMBOL(down_futex);

2005-11-18 13:14:12

by Dinakar Guniguntala

Subject: Re: PI BUG with -rt13

On Fri, Nov 18, 2005 at 10:29:09AM +0100, Ingo Molnar wrote:
>
> * David Singleton <[email protected]> wrote:
>
> > >I was testing PI support in the -rt tree (-rt13) when I hit the BUG
> > >below. I am using the BULL/Montavista glibc patches. However I would
> > >think this can be reproduced using just plain FUTEX_WAKE/WAIT_ROBUST
> > >APIs as well, though I havent tried. I can send out the test code
> > >if anybody is interested. I have attached the .config below.
> > >
> > >
>
> > If I make the lock in the timer_base_s struct a raw spinlock this
> > BUG goes away.
>
> that most likely just papers over the real bug. Given task-reference
> count bug i fixed in the robust/PI-futexes code (see the patch below) i
> suspect some more races and/or plain incorrect code.
>
> [this patch below also converts the robust/PI-futex code to use RCU
> instead of the tasklist_lock - which should remove a major latency
> source from the futex code].
>

[snip patch]


Ingo, Thanks for providing the fix. However I still hit the same bug
even with your changes

-Dinakar


testpi-1/1153[CPU#1]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (8)
[<c0134ba6>] process_timeout+0x0/0x9 (36)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c013affe>] add_preempt_count_ti+0x1e/0xc6 (100)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (44)
[<c013d06e>] do_futex+0x96/0xfc (24)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)

------------------------------
| showing all locks held by: | (testpi-1/1153 [f7bd2730, 69]):
------------------------------

#001: [c3878fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33

testpi-1/1153[CPU#2]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (100)
[<c0122838>] __mod_timer+0x88/0xdf (12)
[<c0380c3d>] __lock_text_start+0x1d/0x41 (12)
[<c0122838>] __mod_timer+0x88/0xdf (8)
[<c0122838>] __mod_timer+0x88/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (8)
[<c0134ba6>] process_timeout+0x0/0x9 (36)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c013affe>] add_preempt_count_ti+0x1e/0xc6 (100)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (44)
[<c013d06e>] do_futex+0x96/0xfc (24)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)

------------------------------
| showing all locks held by: | (testpi-1/1153 [f7bd2730, 69]):
------------------------------

#001: [c3888fe0] {&base->t_base.lock}
... acquired at: __mod_timer+0x88/0xdf

testpi-1/1155[CPU#0]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c0134ba6>] process_timeout+0x0/0x9 (44)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (76)
[<c0380c3d>] __lock_text_start+0x1d/0x41 (24)
[<c013d06e>] do_futex+0x96/0xfc (68)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)

------------------------------
| showing all locks held by: | (testpi-1/1155 [f6fb8730, 0]):
------------------------------

#001: [c3868fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33


===================================================================


Different testcase, similar result


testpi-2/1159[CPU#1]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (8)
[<c0134ba6>] process_timeout+0x0/0x9 (36)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c013affe>] add_preempt_count_ti+0x1e/0xc6 (100)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (44)
[<c013d06e>] do_futex+0x96/0xfc (24)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)

------------------------------
| showing all locks held by: | (testpi-2/1159 [f6650020, 69]):
------------------------------
#001: [c3878fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33

testpi-2/1160[CPU#1]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c0134ba6>] process_timeout+0x0/0x9 (44)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (76)
[<c013d06e>] do_futex+0x96/0xfc (92)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)

------------------------------
| showing all locks held by: | (testpi-2/1160 [f6f58830, 59]):
------------------------------
#001: [c3878fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33

testpi-2/1161[CPU#2]: BUG in FREE_WAITER at kernel/rt.c:1368
[<c011a700>] __WARN_ON+0x60/0x80 (8)
[<c037e97e>] __down_mutex+0x4fe/0x7fd (48)
[<c01337a9>] pi_setprio+0xa1/0x642 (104)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0380d7d>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122796>] lock_timer_base+0x19/0x33 (8)
[<c0122796>] lock_timer_base+0x19/0x33 (16)
[<c01227e8>] __mod_timer+0x38/0xdf (16)
[<c013b15b>] sub_preempt_count+0x1a/0x1e (12)
[<c03806dd>] __down_interruptible+0x923/0xb2b (20)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (16)
[<c0134ba6>] process_timeout+0x0/0x9 (44)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (64)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (24)
[<c0138270>] down_futex+0x66/0xab (8)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (12)
[<c013c8cd>] futex_wait_robust+0x151/0x25b (20)
[<c03813b4>] _raw_spin_unlock+0x12/0x2c (76)
[<c0380c3d>] __lock_text_start+0x1d/0x41 (24)
[<c013d06e>] do_futex+0x96/0xfc (68)
[<c013d1cc>] sys_futex+0xf8/0x104 (40)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (60)
---------------------------
| preempt count: 00000001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b0c0>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)

------------------------------
| showing all locks held by: | (testpi-2/1161 [f6c08120, 0]):
------------------------------
#001: [c3888fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33

2005-11-18 13:27:10

by Ingo Molnar

Subject: Re: PI BUG with -rt13

* Dinakar Guniguntala <[email protected]> wrote:

> Ingo, Thanks for providing the fix. However I still hit the same bug
> even with your changes

even with my patch the robust-futex code is still quite broken. E.g. in
down_futex(), it accesses rt-mutex internals without any locking (!):

if (rt_mutex_free(lock)) {
__down_mutex(lock __EIP__);
rt_mutex_set_owner(lock, owner_task->thread_info);
}

both rt_mutex_free() and rt_mutex_set_owner() must be called with the
proper locking. David?

Ingo

2005-11-18 17:05:27

by David Singleton

Subject: Re: PI BUG with -rt13

On Nov 18, 2005, at 5:27 AM, Ingo Molnar wrote:

>
> * Dinakar Guniguntala <[email protected]> wrote:
>
>> Ingo, Thanks for providing the fix. However I still hit the same bug
>> even with your changes
>
> even with my patch the robust-futex code is still quite broken. E.g. in
> down_futex(), it accesses rt-mutex internals without any locking (!):
>
> if (rt_mutex_free(lock)) {
> __down_mutex(lock __EIP__);
> rt_mutex_set_owner(lock, owner_task->thread_info);
> }
>
> both rt_mutex_free() and rt_mutex_set_owner() must be called with the
> proper locking. David?

Yes, the lock needs to be protected by the robust semaphore.
The locking order is:

mmap_sem to protect the vma that holds the pthread_mutex

robust_sem to protect the futex_mutex chain.

futex_mutex - the rt_mutex associated with the
pthread_mutex.


This section of code performs the locking of the first waiter
on the pthread_mutex, which was locked by another thread in the
fast path in userspace. The fast path locking does not enter
the
kernel.

The first waiter locks the futex_mutex and then changes the
owner to the 'owning' thread. The waiter then calls
down_interruptible
to block on the futex_mutex.

I'll provide a patch to protect this piece of code.

David

>
> Ingo

2005-11-18 17:44:48

by Ingo Molnar

Subject: Re: PI BUG with -rt13

* david singleton <[email protected]> wrote:

> >both rt_mutex_free() and rt_mutex_set_owner() must be called with the
> >proper locking. David?
>
> Yes, the lock needs to be protected by the robust semaphore.
> The locking order is:
>
> mmap_sem to protect the vma that holds the pthread_mutex
>
> robust_sem to protect the futex_mutex chain.
>
> futex_mutex - the rt_mutex associated with the
> pthread_mutex.

well, also lock->wait_lock and lock->pi_lock. The act of making another
thread the owner of this particular mutex must be performed carefully.
Check out rt.c to see what locking dependencies there are. (We can also
do a lockless cmpxchg for unlocked mutexes, under certain
circumstances.)

Ingo

2005-11-21 19:47:50

by David Singleton

Subject: Re: PI BUG with -rt13

Signed-off-by: David Singleton <[email protected]>
Description:
This patch unifies the locking for the robust futex functions,
correctly protects the rt_mutex backing the pthread mutex and
adds the support for pthread_mutexes allocated on the heap.

diff -uar base/linux-2.6.14/kernel/futex.c wip/linux-2.6.14/kernel/futex.c
--- base/linux-2.6.14/kernel/futex.c 2005-11-18 20:36:53.000000000 -0800
+++ wip/linux-2.6.14/kernel/futex.c 2005-11-21 11:28:45.000000000 -0800
@@ -145,7 +145,8 @@
*
* Should be called with &current->mm->mmap_sem but NOT any spinlocks.
*/
-static int get_futex_key(unsigned long uaddr, union futex_key *key)
+static int get_futex_key(unsigned long uaddr, union futex_key *key,
+ struct list_head **list, struct semaphore **sem)
{
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
@@ -168,6 +169,18 @@
if (unlikely(!vma))
return -EFAULT;

+ if (vma->vm_file == NULL) {
+ if (vma->robust_init) {
+ *list = &vma->robust_list;
+ *sem = &vma->robust_sem;
+ }
+ } else if (vma->vm_file->f_mapping == NULL) {
+ return -EINVAL;
+ } else {
+ *list = &vma->vm_file->f_mapping->robust_list;
+ *sem = &vma->vm_file->f_mapping->robust_sem;
+ }
+
/*
* Permissions.
*/
@@ -306,13 +319,18 @@
struct futex_hash_bucket *bh;
struct list_head *head;
struct futex_q *this, *next;
+ struct semaphore *sem;
int ret;

down_read(&current->mm->mmap_sem);

- ret = get_futex_key(uaddr, &key);
+ ret = get_futex_key(uaddr, &key, &head, &sem);
if (unlikely(ret != 0))
goto out;
+ if (head == NULL) {
+ ret = -EINVAL;
+ goto out;
+ }

bh = hash_futex(&key);
spin_lock(&bh->lock);
@@ -341,16 +359,17 @@
union futex_key key1, key2;
struct futex_hash_bucket *bh1, *bh2;
struct list_head *head;
+ struct semaphore *sem;
struct futex_q *this, *next;
int ret, op_ret, attempt = 0;

retryfull:
down_read(&current->mm->mmap_sem);

- ret = get_futex_key(uaddr1, &key1);
+ ret = get_futex_key(uaddr1, &key1, &head, &sem);
if (unlikely(ret != 0))
goto out;
- ret = get_futex_key(uaddr2, &key2);
+ ret = get_futex_key(uaddr2, &key2, &head, &sem);
if (unlikely(ret != 0))
goto out;

@@ -454,16 +473,17 @@
union futex_key key1, key2;
struct futex_hash_bucket *bh1, *bh2;
struct list_head *head1;
+ struct semaphore *sem;
struct futex_q *this, *next;
int ret, drop_count = 0;

retry:
down_read(&current->mm->mmap_sem);

- ret = get_futex_key(uaddr1, &key1);
+ ret = get_futex_key(uaddr1, &key1, &head1, &sem);
if (unlikely(ret != 0))
goto out;
- ret = get_futex_key(uaddr2, &key2);
+ ret = get_futex_key(uaddr2, &key2, &head1, &sem);
if (unlikely(ret != 0))
goto out;

@@ -628,11 +648,13 @@
int ret, curval;
struct futex_q q;
struct futex_hash_bucket *bh;
+ struct list_head *head;
+ struct semaphore *sem;

retry:
down_read(&current->mm->mmap_sem);

- ret = get_futex_key(uaddr, &q.key);
+ ret = get_futex_key(uaddr, &q.key, &head, &sem);
if (unlikely(ret != 0))
goto out_release_sem;

@@ -775,6 +797,8 @@
{
struct futex_q *q;
struct file *filp;
+ struct list_head *head;
+ struct semaphore *sem;
int ret, err;

ret = -EINVAL;
@@ -810,7 +834,7 @@
}

down_read(&current->mm->mmap_sem);
- err = get_futex_key(uaddr, &q->key);
+ err = get_futex_key(uaddr, &q->key, &head, &sem);

if (unlikely(err != 0)) {
up_read(&current->mm->mmap_sem);
@@ -863,133 +887,6 @@
};

/*
- * Get parameters which are the keys for a robust futex.
- *
- * For shared mappings, it's (page->index, vma->vm_file->f_dentry->d_inode,
- * offset_within_page). For private mappings, it's (uaddr, current->mm).
- * We can usually work out the index without swapping in the page.
- *
- * Returns: 0, or negative error code.
- * The key words are stored in *key on success.
- *
- * Should be called with &current->mm->mmap_sem but NOT any spinlocks.
- */
-static int get_robust_futex_key(unsigned long uaddr, union futex_key *key,
- struct futex_robust **robust)
-{
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
- struct address_space *mapping;
- struct page *page;
- struct list_head *head;
- struct futex_robust *this, *next;
- int found = 0;
- int err = 1;
-
- /*
- * The futex address must be "naturally" aligned.
- */
- key->both.offset = uaddr % PAGE_SIZE;
- if (unlikely((key->both.offset % sizeof(u32)) != 0))
- return -EINVAL;
- uaddr -= key->both.offset;
-
- /*
- * The futex is hashed differently depending on whether
- * it's in a shared or private mapping. So check vma first.
- */
- vma = find_extend_vma(mm, uaddr);
- if (unlikely(!vma))
- return -EFAULT;
-
- if (vma->vm_file == NULL)
- return -EINVAL;
- /*
- * Permissions.
- */
- if (unlikely((vma->vm_flags & (VM_IO|VM_READ)) != VM_READ))
- return (vma->vm_flags & VM_IO) ? -EPERM : -EACCES;
-
- /*
- * Private mappings are handled in a simple way.
- *
- * NOTE: When userspace waits on a MAP_SHARED mapping, even if
- * it's a read-only handle, it's expected that futexes attach to
- * the object not the particular process. Therefore we use
- * VM_MAYSHARE here, not VM_SHARED which is restricted to shared
- * mappings of _writable_ handles.
- */
- if (likely(!(vma->vm_flags & VM_MAYSHARE))) {
- key->private.mm = mm;
- key->private.uaddr = uaddr;
- err = 0;
- goto out;
- }
-
- /*
- * Linear file mappings are also simple.
- */
- key->shared.inode = vma->vm_file->f_dentry->d_inode;
- key->both.offset++; /* Bit 0 of offset indicates inode-based key. */
- if (likely(!(vma->vm_flags & VM_NONLINEAR))) {
- key->shared.pgoff = (((uaddr - vma->vm_start) >> PAGE_SHIFT)
- + vma->vm_pgoff);
- err = 0;
- goto out;
- }
-
- /*
- * We could walk the page table to read the non-linear
- * pte, and get the page index without fetching the page
- * from swap. But that's a lot of code to duplicate here
- * for a rare case, so we simply fetch the page.
- */
-
- /*
- * Do a quick atomic lookup first - this is the fastpath.
- */
- spin_lock(&current->mm->page_table_lock);
- page = follow_page(mm, uaddr, 0);
- if (likely(page != NULL)) {
- key->shared.pgoff =
- page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
- spin_unlock(&current->mm->page_table_lock);
- err = 0;
- goto out;
- }
- spin_unlock(&current->mm->page_table_lock);
-
- /*
- * Do it the general way.
- */
- err = get_user_pages(current, mm, uaddr, 1, 0, 0, &page, NULL);
- if (err >= 0) {
- key->shared.pgoff =
- page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
- put_page(page);
- err = 0;
- }
-out:
- mapping = vma->vm_file->f_mapping;
- if (mapping) {
- down(&mapping->robust_sem);
- head = &mapping->robust_list;
-
- list_for_each_entry_safe(this, next, head, list) {
- if (match_futex(&this->key, key)) {
- found++;
- *robust = this;
- break;
- }
- }
- up(&mapping->robust_sem);
- }
- if (!found)
- err = -EINVAL;
- return err;
-}
-
-/*
* there really isn't an atomic page fault, so we're going to
* put the burden on the user. If either futex_get_user or futex_put_user
* return -EFAULT, it really means it's avoiding a race condition
@@ -1027,29 +924,29 @@
{
struct thread_info *ti = current_thread_info();
union futex_key key;
- struct futex_hash_bucket *bh;
- struct list_head *head;
- struct futex_q *this, *next;
+ struct list_head *head = NULL;
+ struct semaphore *sem = NULL;
+ struct futex_robust *this, *next;
int ret;
int value;
int found = 0;
- struct futex_robust *robust;

retry:
down_read(&current->mm->mmap_sem);

- ret = get_robust_futex_key(uaddr, &key, &robust);
+ ret = get_futex_key(uaddr, &key, &head, &sem);
if (ret != 0)
goto out;
-
- bh = hash_futex(&key);
- spin_lock(&bh->lock);
+ if (head == NULL) {
+ ret = -EINVAL;
+ goto out;
+ }
+ down(sem);

ret = get_futex_value_locked(&value, (int __user *)uaddr);

if (unlikely(ret)) {
- spin_unlock(&bh->lock);
-
+ up(sem);
/* If we would have faulted, release mmap_sem, fault it in and
* start all over again.
*/
@@ -1062,8 +959,6 @@
return ret;
}

- head = &bh->chain;
-
/*
* if the owner died, mark the futex as not recoverable
* and wake up all waiting tasks.
@@ -1075,23 +970,21 @@
goto out_unlock;
}
list_for_each_entry_safe(this, next, head, list) {
- if (match_futex (&this->key, &robust->key)) {
- up_futex(&robust->futex_mutex);
- ret++;
+ if (match_futex (&this->key, &key)) {
+ up_futex(&this->futex_mutex);
}
}
goto out_unlock;
}

- /* find the first waiting task */
list_for_each_entry_safe(this, next, head, list) {
- if (match_futex (&this->key, &robust->key)) {
+ if (match_futex (&this->key, &key)) {
found++;
- if ((rt_mutex_owner(&robust->futex_mutex)) != ti) {
+ if ((rt_mutex_owner(&this->futex_mutex)) != ti) {
ret = -EINVAL;
- goto out;
+ goto out_unlock;
}
- if (!rt_mutex_has_waiters(&robust->futex_mutex)) {
+ if (!rt_mutex_has_waiters(&this->futex_mutex)) {
value = 0;
break;
} else {
@@ -1110,11 +1003,11 @@
ret = -EFAULT;
goto out_unlock;
}
- up_futex(&robust->futex_mutex);
+ up_futex(&this->futex_mutex);
ret = 1;

out_unlock:
- spin_unlock(&bh->lock);
+ up(sem);
out:
up_read(&current->mm->mmap_sem);
return ret;
@@ -1132,24 +1025,29 @@
static int futex_wait_robust(unsigned long uaddr, unsigned long time)
{
int ret, curval;
- struct futex_q q;
- struct futex_hash_bucket *bh;
- struct futex_robust *robust;
+ struct futex_robust *this, *next;
+ struct list_head *head = NULL;
+ struct semaphore *sem = NULL;
+ union futex_key key;
pid_t owner_pid;
+ int found = 0;

retry:
down_read(&current->mm->mmap_sem);

- ret = get_robust_futex_key(uaddr, &q.key, &robust);
+ ret = get_futex_key(uaddr, &key, &head, &sem);
if (ret != 0)
- goto out_release_sem;
-
- bh = queue_lock(&q, -1, NULL);
+ goto out;
+ if (head == NULL) {
+ ret = -EINVAL;
+ goto out;
+ }
+ down(sem);

ret = get_futex_value_locked(&curval, (int __user *)uaddr);

if (unlikely(ret)) {
- queue_unlock(&q, bh);
+ up(sem);

/* If we would have faulted, release mmap_sem, fault it in and
* start all over again.
@@ -1170,54 +1068,49 @@
*/
if (curval == 0) {
ret = -EAGAIN;
- queue_unlock(&q, bh);
- goto out_release_sem;
+ goto out_unlock;
+ }
+ if ((curval & FUTEX_PID) == current->pid) {
+ ret = -EAGAIN;
+ goto out_unlock;
}

/* if owner has died, we don't want to wait */
if ((curval & FUTEX_OWNER_DIED)) {
ret = -EOWNERDEAD;
- queue_unlock(&q, bh);
- goto out_release_sem;
+ goto out_unlock;
}

- __queue_me(&q, bh);
-
- /*
- * Now the futex is queued and we have checked the data, we
- * don't want to hold mmap_sem while we sleep.
- */
- up_read(&current->mm->mmap_sem);
-
- /*
- * There might have been scheduling since the queue_me(), as we
- * cannot hold a spinlock across the get_user() in case it
- * faults, and we cannot just set TASK_INTERRUPTIBLE state when
- * queueing ourselves into the futex hash. This code thus has to
- * rely on the futex_wake() code removing us from hash when it
- * wakes us up.
- */
+ list_for_each_entry_safe(this, next, head, list) {
+ if (match_futex(&this->key, &key)) {
+ found++;
+ break;
+ }
+ }
+ if (!found) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
+ get_key_refs(&key);

- ret = down_futex(&robust->futex_mutex, time, owner_pid);
- unqueue_me(&q);
- if (ret < 0) {
- goto out;
- } else {
+ ret = down_futex(&this->futex_mutex, time, owner_pid, sem);
+ if (ret >= 0) {
curval = futex_get_user(uaddr);
curval &= ~FUTEX_PID;
curval |= current->pid;
- if (rt_mutex_has_waiters(&robust->futex_mutex))
+ if (rt_mutex_has_waiters(&this->futex_mutex))
curval |= FUTEX_WAITERS;
ret = futex_put_user(curval, uaddr);
if (curval & FUTEX_OWNER_DIED) {
ret = -EOWNERDEAD;
}
- goto out;
}
+ return ret;

-out_release_sem:
- up_read(&current->mm->mmap_sem);
+out_unlock:
+ up(sem);
out:
+ up_read(&current->mm->mmap_sem);
return ret;
}

@@ -1330,31 +1223,30 @@
/**
* find_owned_futex - find futexes owned by the current task
* @vma: the vma to search for futexes
+ * @head: list head for list of robust futexes
+ * @sem: semaphore that protects the list
*
* Walk the list of registered robust futexes for this @vma,
* setting the %FUTEX_OWNER_DIED flag on those futexes owned
* by the current, exiting task.
*/
-static void find_owned_futex(struct vm_area_struct *vma)
+static void find_owned_futex(struct vm_area_struct *vma, struct list_head *head,
+ struct semaphore *sem)
{
struct thread_info *ti = current_thread_info();
- struct address_space *mapping;
- struct list_head *head;
struct futex_robust *this, *next;
unsigned long uaddr;
int value;

- mapping = vma->vm_file->f_mapping;
- down(&mapping->robust_sem);
+ down(sem);

- head = &mapping->robust_list;
list_for_each_entry_safe(this, next, head, list) {

uaddr = get_futex_uaddr(&this->key, vma);
if (uaddr == 0)
continue;

- up(&mapping->robust_sem);
+ up(sem);
up_read(&current->mm->mmap_sem);
value = futex_get_user(uaddr);
if (this->futex_mutex.mutex_attr & FUTEX_ATTR_ROBUST)
@@ -1371,11 +1263,11 @@
value &= ~FUTEX_PID;
futex_put_user(value, uaddr);
}
- down(&mapping->robust_sem);
+ down(sem);
down_read(&current->mm->mmap_sem);
}

- up(&mapping->robust_sem);
+ up(sem);
}

/**
@@ -1390,6 +1282,7 @@
struct mm_struct *mm;
struct vm_area_struct *vma;
struct list_head *list;
+ struct semaphore *sem;

if (tsk==NULL)
return;
@@ -1401,22 +1294,36 @@
down_read(&mm->mmap_sem);

for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) {
- if (vma->vm_file == NULL)
- continue;
+ if (vma->vm_file == NULL) {
+ if (vma->robust_init) {
+ sem = &vma->robust_sem;
+ list = &vma->robust_list;
+ } else
+ continue;

- if (vma->vm_file->f_mapping == NULL)
- continue;
+ } else {
+ if (vma->vm_file->f_mapping == NULL)
+ continue;

- list = &vma->vm_file->f_mapping->robust_list;
+ list = &vma->vm_file->f_mapping->robust_list;
+ sem = &vma->vm_file->f_mapping->robust_sem;
+ }
if (list_empty(list))
continue;

- find_owned_futex(vma);
+ find_owned_futex(vma, list, sem);
}

up_read(&mm->mmap_sem);
}

+static void futex_init_anon(struct vm_area_struct *vma)
+{
+ INIT_LIST_HEAD(&vma->robust_list);
+ init_MUTEX(&vma->robust_sem);
+ vma->robust_init = 1;
+}
+
/**
* futex_register - Record the existence of a robust futex in a vma.
* @uaddr: user space address of the robust futex
@@ -1431,8 +1338,8 @@
struct futex_robust *robust;
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
- struct file *file;
- struct address_space *mapping;
+ struct list_head *head = NULL;
+ struct semaphore *sem = NULL;

robust = kmalloc(sizeof(*robust), GFP_KERNEL);
down_read(&current->mm->mmap_sem);
@@ -1449,7 +1356,7 @@
* priority queueing is default on robust mutexes.
*/

- ret = get_futex_key(uaddr, &robust->key);
+ ret = get_futex_key(uaddr, &robust->key, &head, &sem);
if (unlikely(ret != 0)) {
kfree(robust);
goto out;
@@ -1462,17 +1369,25 @@
goto out;
}

- file = vma->vm_file;
- if (!file) {
- ret = -EINVAL;
- kfree(robust);
- goto out;
+ if (vma->vm_file == NULL) {
+ if (vma->robust_init == 0)
+ futex_init_anon(vma);
+ head = &vma->robust_list;
+ sem = &vma->robust_sem;
+ } else {
+ if (vma->vm_file->f_mapping) {
+ head = &vma->vm_file->f_mapping->robust_list;
+ sem = &vma->vm_file->f_mapping->robust_sem;
+ } else {
+ ret = -EINVAL;
+ kfree(robust);
+ goto out;
+ }
}

- mapping = file->f_mapping;
- down(&mapping->robust_sem);
- list_add_tail(&robust->list, &mapping->robust_list);
- up(&mapping->robust_sem);
+ down(sem);
+ list_add_tail(&robust->list, head);
+ up(sem);

out:
up_read(&current->mm->mmap_sem);
@@ -1492,35 +1407,21 @@
{
struct thread_info *ti = current_thread_info();
union futex_key key;
- struct mm_struct *mm = current->mm;
- struct vm_area_struct *vma;
- struct file *file;
- struct address_space *mapping;
- struct list_head *head;
- struct futex_robust *this, *next, *robust;
+ struct list_head *head = NULL;
+ struct semaphore *sem = NULL;
+ struct futex_robust *this, *next;
int ret;

- down_read(&mm->mmap_sem);
+ down_read(&current->mm->mmap_sem);

- ret = get_robust_futex_key(uaddr, &key, &robust);
+ ret = get_futex_key(uaddr, &key, &head, &sem);
if (unlikely(ret != 0))
goto out;
-
- vma = find_extend_vma(mm, uaddr);
- if (unlikely(!vma)) {
- ret = -EFAULT;
- goto out;
- }
-
- file = vma->vm_file;
- if (!file) {
+ if (head == NULL) {
ret = -EINVAL;
goto out;
}
-
- mapping = file->f_mapping;
- down(&mapping->robust_sem);
- head = &mapping->robust_list;
+ down(sem);

list_for_each_entry_safe(this, next, head, list) {
if (match_futex (&this->key, &key)) {
@@ -1540,9 +1441,9 @@
}
}

- up(&mapping->robust_sem);
+ up(sem);
out:
- up_read(&mm->mmap_sem);
+ up_read(&current->mm->mmap_sem);
return ret;
}

@@ -1562,24 +1463,45 @@
int ret = 0;
int value = 0;
union futex_key key;
- struct futex_robust *robust;
+ struct futex_robust *this, *next;
+ struct list_head *head = NULL;
+ struct semaphore *sem = NULL;

down_read(&current->mm->mmap_sem);
- ret = get_robust_futex_key(uaddr, &key, &robust);
- up_read(&current->mm->mmap_sem);
+ ret = get_futex_key(uaddr, &key, &head, &sem);
if (ret != 0)
- return ret;
- /*
- * can't recover a futex we don't own
- */
- if (!rt_mutex_owned_by(&robust->futex_mutex, ti)) {
- return -EINVAL;
+ goto out;
+ if (head == NULL) {
+ ret = -EINVAL;
+ goto out;
+ }
+
+ down(sem);
+ list_for_each_entry_safe(this, next, head, list) {
+ if (match_futex(&this->key, &key)) {
+ /*
+ * can't recover a futex we don't own
+ */
+ if (!rt_mutex_owned_by(&this->futex_mutex, ti)) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
+ break;
+ }
+ }
+
+ if ((value = futex_get_user(uaddr)) == -EFAULT) {
+ ret = -EFAULT;
+ goto out_unlock;
}
- if ((value = futex_get_user(uaddr)) == -EFAULT)
- return ret;

value &= ~FUTEX_OWNER_DIED;
- return (futex_put_user(value, uaddr));
+ ret = futex_put_user(value, uaddr);
+out_unlock:
+ up(sem);
+out:
+ up_read(&current->mm->mmap_sem);
+ return ret;
}

long do_futex(unsigned long uaddr, int op, int val, unsigned long timeout,
diff -uar base/linux-2.6.14/kernel/rt.c wip/linux-2.6.14/kernel/rt.c
--- base/linux-2.6.14/kernel/rt.c 2005-11-18 20:36:53.000000000 -0800
+++ wip/linux-2.6.14/kernel/rt.c 2005-11-21 11:37:15.000000000 -0800
@@ -2927,6 +2927,40 @@
}
EXPORT_SYMBOL(rt_mutex_owned_by);

+static int
+down_try_futex(struct rt_mutex *lock, struct thread_info *proxy_owner __EIP_DECL__)
+{
+ struct thread_info *old_owner;
+ struct task_struct *task = proxy_owner->task;
+ unsigned long flags;
+ int ret = 0;
+
+ trace_lock_irqsave(&trace_lock, flags, proxy_owner);
+ TRACE_BUG_ON_LOCKED(!raw_irqs_disabled());
+ _raw_spin_lock(&task->pi_lock);
+ _raw_spin_lock(&lock->wait_lock);
+
+ old_owner = lock_owner(lock);
+ init_lists(lock);
+
+ if (likely(!old_owner) || __grab_lock(lock, task, old_owner->task)) {
+ /* granted */
+ TRACE_WARN_ON_LOCKED(!plist_empty(&lock->wait_list) && !old_owner);
+ if (old_owner) {
+ _raw_spin_lock(&old_owner->task->pi_lock);
+ set_new_owner(lock, old_owner, proxy_owner __EIP__);
+ _raw_spin_unlock(&old_owner->task->pi_lock);
+ } else
+ set_new_owner(lock, old_owner, proxy_owner __EIP__);
+ ret = 1;
+ }
+ _raw_spin_unlock(&lock->wait_lock);
+ _raw_spin_unlock(&task->pi_lock);
+ trace_unlock_irqrestore(&trace_lock, flags, proxy_owner);
+
+ return ret;
+}
+
/*
* This call has two functions. The first is to lock the lock on behalf of
* another thread if the rt_mutex has no owner. If the rt_mutex has no
@@ -2939,24 +2973,58 @@
* and now own the lock, or negative values for failure, or positive
* values for the amount of time we waited before getting the lock.
*/
-int fastcall down_futex(struct rt_mutex *lock, unsigned long time, pid_t owner_pid)
+int fastcall
+down_futex(struct rt_mutex *lock, unsigned long time, pid_t owner_pid, struct semaphore *sem)
{
struct task_struct *owner_task = NULL;
#ifdef CONFIG_DEBUG_DEADLOCKS
unsigned long eip = CALLER_ADDR0;
#endif
- read_lock(&tasklist_lock);
+ int ret = 0;
+
+ rcu_read_lock();
owner_task = find_task_by_pid(owner_pid);
- read_unlock(&tasklist_lock);
+ if (!get_task_struct_rcu(owner_task))
+ owner_task = NULL;
+ rcu_read_unlock();

- if (!owner_task)
- return -EOWNERDEAD;
+ /*
+ * if the owner can't be found or has changed to us
+ * then just return.
+ */

- if (rt_mutex_free(lock)) {
- __down_mutex(lock __EIP__);
- rt_mutex_set_owner(lock, owner_task->thread_info);
+ if (!owner_task || owner_task == current) {
+ up(sem);
+ up_read(&current->mm->mmap_sem);
+ return -EAGAIN;
}
- return __down_interruptible(lock, time __EIP__);
+
+ /*
+ * This works for both ways the down_try_futex functions.
+ * If it gets the lock then we are the first waiter (This
+ * is being called from wait_robust because the lock is
+ * contended) and we've just locked the lock on behalf of
+ * the owning thread. If it finds contention then we aren't
+ * the first waiter and we'll just block on the down_interruptible.
+ */
+
+ down_try_futex(lock, owner_task->thread_info __EIP__));
+
+ /*
+ * we can now drop the locks because the rt_mutex is held.
+ * and we'll just block on the down interruptible OR
+ * we'll get the lock and return without blocking, if
+ * it was unlocked between the down_try_futex and the
+ * down interruptible.
+ */
+
+ up(sem);
+ up_read(&current->mm->mmap_sem);
+
+ ret = __down_interruptible(lock, time __EIP__);
+ put_task_struct(owner_task);
+
+ return ret;
}
EXPORT_SYMBOL(down_futex);

Only in wip/linux-2.6.14/kernel/: rt.c.rej
Only in wip/linux-2.6.14/include/linux: autoconf.h
diff -uar base/linux-2.6.14/include/linux/mm.h wip/linux-2.6.14/include/linux/mm.h
--- base/linux-2.6.14/include/linux/mm.h 2005-11-18 20:36:53.000000000 -0800
+++ wip/linux-2.6.14/include/linux/mm.h 2005-11-21 10:51:19.000000000 -0800
@@ -109,6 +109,11 @@
#ifdef CONFIG_NUMA
struct mempolicy *vm_policy; /* NUMA policy for the VMA */
#endif
+#ifdef CONFIG_FUTEX
+ int robust_init; /* robust initialized? */
+ struct list_head robust_list; /* list of robust futexes in this vma */
+ struct semaphore robust_sem; /* semaphore to protect the list */
+#endif
};

/*
diff -uar base/linux-2.6.14/include/linux/rt_lock.h wip/linux-2.6.14/include/linux/rt_lock.h
--- base/linux-2.6.14/include/linux/rt_lock.h 2005-11-18 20:36:53.000000000 -0800
+++ wip/linux-2.6.14/include/linux/rt_lock.h 2005-11-21 10:51:29.000000000 -0800
@@ -383,7 +383,7 @@
#endif /* CONFIG_PREEMPT_RT */

extern void FASTCALL(up_futex(struct rt_mutex *lock));
-extern int FASTCALL(down_futex(struct rt_mutex *lock, unsigned long time, pid_t owner_pid));
+extern int FASTCALL(down_futex(struct rt_mutex *lock, unsigned long time, pid_t owner_pid, struct semaphore *sem));
extern int FASTCALL(rt_mutex_owned_by(struct rt_mutex *lock, struct thread_info *t));
extern int FASTCALL(rt_mutex_has_waiters(struct rt_mutex *lock));
extern struct thread_info *FASTCALL(rt_mutex_owner(struct rt_mutex *lock));
Only in wip/linux-2.6.14/include/linux: version.h

Attachments:

2005-11-21 21:26:50

by Ingo Molnar

Subject: Re: PI BUG with -rt13

* David Singleton <[email protected]> wrote:

> Ingo,
> here is a patch that provides the correct locking for the rt_mutex
> backing the robust pthread_mutex. The patch also unifies the locking
> for all the robust functions and adds support for pthread_mutexes on
> the heap.

thanks. Could you split up the patch into a fix and a 'heap' patch (at a
minimum)?

it's this portion of the 'heap' patch that looks problematic:

> --- base/linux-2.6.14/include/linux/mm.h 2005-11-18 20:36:53.000000000 -0800
> +++ wip/linux-2.6.14/include/linux/mm.h 2005-11-21 10:51:19.000000000 -0800
> @@ -109,6 +109,11 @@
> #ifdef CONFIG_NUMA
> struct mempolicy *vm_policy; /* NUMA policy for the VMA */
> #endif
> +#ifdef CONFIG_FUTEX
> + int robust_init; /* robust initialized? */
> + struct list_head robust_list; /* list of robust futexes in this vma */
> + struct semaphore robust_sem; /* semaphore to protect the list */
> +#endif
> };

why is there per-vma info needed?

Also, what testing did this patch have - should it solve Dinakar's
problem(s)?

Ingo

2005-11-22 02:01:47

by David Singleton

Subject: Re: PI BUG with -rt13

>
> Ingo

Attachments:

2005-11-22 02:13:52

by David Singleton

Subject: Re: PI BUG with -rt13

Dave Carlson has tried the patch and although it works better, he's
discovered another race in the exit path.

I'll start working on the exit path race fix now that I have the race
in down_futex
fixed.


Dave

On Nov 21, 2005, at 1:26 PM, Ingo Molnar wrote:

>
> * David Singleton <[email protected]> wrote:
>
>> Ingo,
>> here is a patch that provides the correct locking for the rt_mutex
>> backing the robust pthread_mutex. The patch also unifies the locking
>> for all the robust functions and adds support for pthread_mutexes on
>> the heap.
>
> thanks. Could you split up the patch into a fix and a 'heap' patch (at
> a
> minimum)?
>
> it's this portion of the 'heap' patch that looks problematic:
>
>> --- base/linux-2.6.14/include/linux/mm.h 2005-11-18
>> 20:36:53.000000000 -0800
>> +++ wip/linux-2.6.14/include/linux/mm.h 2005-11-21 10:51:19.000000000
>> -0800
>> @@ -109,6 +109,11 @@
>> #ifdef CONFIG_NUMA
>> struct mempolicy *vm_policy; /* NUMA policy for the VMA */
>> #endif
>> +#ifdef CONFIG_FUTEX
>> + int robust_init; /* robust initialized? */
>> + struct list_head robust_list; /* list of robust futexes in this vma
>> */
>> + struct semaphore robust_sem; /* semaphore to protect the list */
>> +#endif
>> };
>
> why is there per-vma info needed?
>
> Also, what testing did this patch have - should it solve Dinakar's
> problem(s)?
>
> Ingo

2005-11-22 09:31:47

by Dinakar Guniguntala

Subject: Re: PI BUG with -rt13

On Mon, Nov 21, 2005 at 07:24:55PM -0800, david singleton wrote:
>
>
> Dinakar,
> can you try the attached patch? I believe it has the fix you
> require. It has the
> correct locking fix I just sent, the patch-2.6.4-rt13-rf2, and has the
> correct
> lock order in the exit path that was causing the circular deadlock in
> Dave Carlson's
> application.

David,

This fixes the problem that I was noticing !!
Thank you and Ingo for fixing this

-Dinakar

>
> On Nov 21, 2005, at 1:26 PM, Ingo Molnar wrote:
> >* David Singleton <[email protected]> wrote:
> >
> >>Ingo,
> >> here is a patch that provides the correct locking for the rt_mutex
> >>backing the robust pthread_mutex. The patch also unifies the locking
> >>for all the robust functions and adds support for pthread_mutexes on
> >>the heap.
> >
> >thanks. Could you split up the patch into a fix and a 'heap' patch (at
> >a
> >minimum)?
> >
> >it's this portion of the 'heap' patch that looks problematic:
> >
> >>--- base/linux-2.6.14/include/linux/mm.h 2005-11-18
> >>20:36:53.000000000 -0800
> >>+++ wip/linux-2.6.14/include/linux/mm.h 2005-11-21
> >>10:51:19.000000000 -0800
> >>@@ -109,6 +109,11 @@
> >> #ifdef CONFIG_NUMA
> >> struct mempolicy *vm_policy; /* NUeMA policy for the VMA */
> >> #endif
> >>+#ifdef CONFIG_FUTEX
> >>+ int robust_init; /* robust initialized? */
> >>+ struct list_head robust_list; /* list of robust futexes in this
> >>vma */
> >>+ struct semaphore robust_sem; /* semaphore to protect the list */
> >>+#endif
> >> };
> >
> >why is there per-vma info needed?
> >
> >Also, what testing did this patch have - should it solve Dinakar's
> >problem(s)?
> >
> > Ingo

2005-11-24 14:57:33

by Ingo Molnar

Subject: Re: PI BUG with -rt13

* david singleton <[email protected]> wrote:

> Sure. Attached is the locking fix patch. [...]

thanks, applied - it should show up in -rt15.

Ingo

2005-11-24 20:20:53

by Dinakar Guniguntala

Subject: Re: PI BUG with -rt13

On Thu, Nov 24, 2005 at 03:57:34PM +0100, Ingo Molnar wrote:
>
> * david singleton <[email protected]> wrote:
>
> > Sure. Attached is the locking fix patch. [...]
>
> thanks, applied - it should show up in -rt15.
>

I just noticed with the above fix, Paul's testcase completely
hangs up and when killed I hit the BUG mentioned below.
Till -rt13, this testcase just ran to completion

check_monotonic_clock: monotonic inconsistency detected!
from 52d314a423 (355728663587) to 50a53da892 (346369665170).
pthread_cond_ma/6345[CPU#2]: BUG in check_monotonic_clock at kernel/time/timeofday.c:156
[<c011a840>] __WARN_ON+0x60/0x80 (8)
[<c0139972>] check_monotonic_clock+0xcc/0x109 (48)
[<c0139dfe>] get_monotonic_clock+0x110/0x146 (68)
[<c013100c>] ktimer_interrupt+0x54/0x2f6 (92)
[<c010163c>] __switch_to+0x2a/0x248 (12)
[<c037d82b>] __schedule+0x41b/0xab7 (40)
[<c013b86e>] add_preempt_count_ti+0x1e/0xc6 (20)
[<c013b86e>] add_preempt_count_ti+0x1e/0xc6 (8)
[<c01393e4>] handle_nextevent_update+0xd/0x23 (20)
[<c010caaa>] smp_apic_timer_interrupt+0x5c/0x65 (12)
[<c01037a4>] apic_timer_interrupt+0x1c/0x24 (12)
[<c037f39f>] __down_mutex+0x69f/0x7fd (44)
[<c0122856>] lock_timer_base+0x19/0x33 (24)
[<c0122856>] lock_timer_base+0x19/0x33 (76)
[<c0122856>] lock_timer_base+0x19/0x33 (20)
[<c03815fd>] _spin_lock_irqsave+0x1d/0x46 (12)
[<c0122856>] lock_timer_base+0x19/0x33 (8)
[<c0122856>] lock_timer_base+0x19/0x33 (16)
[<c01228a8>] __mod_timer+0x38/0xdf (16)
[<c037e86e>] schedule_timeout+0x4f/0xa2 (32)
[<c0123773>] process_timeout+0x0/0x9 (32)
[<c013c95d>] futex_wait+0x225/0x2b5 (24)
[<c012e332>] add_wait_queue+0x12/0x30 (80)
[<c013b9cb>] sub_preempt_count+0x1a/0x1e (20)
[<c0381c34>] _raw_spin_unlock+0x12/0x2c (44)
[<c037db39>] __schedule+0x729/0xab7 (8)
[<c0114b4d>] default_wake_function+0x0/0x22 (12)
[<c0114b4d>] default_wake_function+0x0/0x22 (32)
[<c013d84f>] do_futex+0xf3/0xf8 (40)
[<c013d949>] sys_futex+0xf5/0x101 (40)
[<c013d951>] sys_futex+0xfd/0x101 (36)
[<c0102ce7>] sysenter_past_esp+0x54/0x75 (24)
---------------------------
| preempt count: 00010001 ]
| 1-level deep critical section nesting:
----------------------------------------
.. [<c013b930>] .... add_preempt_count+0x1a/0x1e
.....[<00000000>] .. ( <= stext+0x3feffd68/0x8)

------------------------------
| showing all locks held by: | (pthread_cond_ma/6345 [f2a52120, 0]):
------------------------------

#001: [c3888fe0] {&base->t_base.lock}
... acquired at: lock_timer_base+0x19/0x33


I have attached the testcase below. Run it as

gcc -g -lpthread pthread_cond_many.c -o pthread_cond_many
sh ./pthread_cond_many.sh --realtime


-Dinakar

Attachments:

2005-11-24 20:27:13

by Dinakar Guniguntala

Subject: Re: PI BUG with -rt13

On Fri, Nov 25, 2005 at 01:56:37AM +0530, Dinakar Guniguntala wrote:
> On Thu, Nov 24, 2005 at 03:57:34PM +0100, Ingo Molnar wrote:
> >
> > * david singleton <[email protected]> wrote:
> >
> > > Sure. Attached is the locking fix patch. [...]
> >
> > thanks, applied - it should show up in -rt15.
> >
>
> I just noticed with the above fix, Paul's testcase completely
> hangs up and when killed I hit the BUG mentioned below.
> Till -rt13, this testcase just ran to completion

Forgot to mention that I notice the same failure with -rt15 as well

-Dinakar

2005-11-24 22:25:15

by David Singleton

Subject: Re: PI BUG with -rt13

On Nov 24, 2005, at 12:32 PM, Dinakar Guniguntala wrote:

> On Fri, Nov 25, 2005 at 01:56:37AM +0530, Dinakar Guniguntala wrote:
>> On Thu, Nov 24, 2005 at 03:57:34PM +0100, Ingo Molnar wrote:
>>>
>>> * david singleton <[email protected]> wrote:
>>>
>>>> Sure. Attached is the locking fix patch. [...]
>>>
>>> thanks, applied - it should show up in -rt15.
>>>
>>
>> I just noticed with the above fix, Paul's testcase completely
>> hangs up and when killed I hit the BUG mentioned below.
>> Till -rt13, this testcase just ran to completion
>
> Forgot to mention that I notice the same failure with -rt15 as well
>

I'll start looking at this right away.

thanks

David
> -Dinakar
>

2005-11-25 04:56:09

by David Singleton

Subject: Re: PI BUG with -rt13

On Nov 24, 2005, at 12:32 PM, Dinakar Guniguntala wrote:

> On Fri, Nov 25, 2005 at 01:56:37AM +0530, Dinakar Guniguntala wrote:
>> On Thu, Nov 24, 2005 at 03:57:34PM +0100, Ingo Molnar wrote:
>>>
>>> * david singleton <[email protected]> wrote:
>>>
>>>> Sure. Attached is the locking fix patch. [...]
>>>
>>> thanks, applied - it should show up in -rt15.
>>>
>>
>> I just noticed with the above fix, Paul's testcase completely
>> hangs up and when killed I hit the BUG mentioned below.
>> Till -rt13, this testcase just ran to completion
>
> Forgot to mention that I notice the same failure with -rt15 as well

Good news and bad news.

Good news. This test doesn't exercise the robust futex code.

Pthread mutexes that want priority queuing, priority inheritance and/or
robustness
must have either the robust (PTHREAD_MUTEX_ROBUST_NP) attribute set
and/or the PTHREAD_PRIO_INHERIT attribute set at mutex creation time.

e.g.
pthread_mutexattr_setrobust_np (&mutex_attr, PTHREAD_MUTEX_ROBUST_NP);

pthread_mutexattr_setprotocol(&state->mutex_attr, PTHREAD_PRIO_INHERIT);

pthread_mutexes that don't have either of these attributes set on the
pthread_mutex
will exercise the original futex code.

Now a question before the bad news, Are you in the OOM path when you
think the system is hung? What does 'top' say about freemem and
available
and used swap space?

If you are not in the OOM path then the bad news is this looks like an
SMP timer
problem.

David

>
> -Dinakar
>

2005-11-25 05:04:03

by Ingo Molnar

Subject: Re: PI BUG with -rt13

* Dinakar Guniguntala <[email protected]> wrote:

> I just noticed with the above fix, Paul's testcase completely hangs up
> and when killed I hit the BUG mentioned below. Till -rt13, this
> testcase just ran to completion

does it still hang if you disable CONFIG_PARANOID_GENERIC_TIME in your
.config?

Ingo

2005-11-25 07:28:39

by Dinakar Guniguntala

Subject: Re: PI BUG with -rt13

On Thu, Nov 24, 2005 at 08:56:06PM -0800, david singleton wrote:
> On Nov 24, 2005, at 12:32 PM, Dinakar Guniguntala wrote:
>
> >>I just noticed with the above fix, Paul's testcase completely
> >>hangs up and when killed I hit the BUG mentioned below.
> >>Till -rt13, this testcase just ran to completion
> >
> >Forgot to mention that I notice the same failure with -rt15 as well
>
> Good news and bad news.
> Good news. This test doesn't exercise the robust futex code.
> Pthread mutexes that want priority queuing, priority inheritance and/or
> robustness must have either the robust (PTHREAD_MUTEX_ROBUST_NP)
> attribute set and/or the PTHREAD_PRIO_INHERIT attribute set at mutex
> creation time.

Davi, Thank you for looking into this

Yes, this particular testcase does not exercise the robust futex code.
However, the testcase only hangs when I apply your fix on top of
-rt13. A Vanilla -rt13 works fine

> Now a question before the bad news, Are you in the OOM path when you
> think the system is hung? What does 'top' say about freemem and
> available and used swap space?

Since one of the threads is a SCHED_FIFO, the system takes forever
to respond to simple commands like ls/ps. I'll get back on this

>
> If you are not in the OOM path then the bad news is this looks like an
> SMP timer problem.
>

-Dinakar

2005-11-25 07:58:46

by Dinakar Guniguntala

Subject: Re: PI BUG with -rt13

On Fri, Nov 25, 2005 at 01:04:23PM +0530, Dinakar Guniguntala wrote:
> On Thu, Nov 24, 2005 at 08:56:06PM -0800, david singleton wrote:
> > On Nov 24, 2005, at 12:32 PM, Dinakar Guniguntala wrote:
> >
> > >>I just noticed with the above fix, Paul's testcase completely
> > >>hangs up and when killed I hit the BUG mentioned below.
> > >>Till -rt13, this testcase just ran to completion
> > >
> > >Forgot to mention that I notice the same failure with -rt15 as well
> >
> > Good news and bad news.
> > Good news. This test doesn't exercise the robust futex code.
> > Pthread mutexes that want priority queuing, priority inheritance and/or
> > robustness must have either the robust (PTHREAD_MUTEX_ROBUST_NP)
> > attribute set and/or the PTHREAD_PRIO_INHERIT attribute set at mutex
> > creation time.
>
> Davi, Thank you for looking into this
>
> Yes, this particular testcase does not exercise the robust futex code.
> However, the testcase only hangs when I apply your fix on top of
> -rt13. A Vanilla -rt13 works fine

Just to make myself clear, this is not the same testcase where I
saw PI issues that I reported ealier in the thread. I guess since
I reported both problems in the same thread, it is sort of confusing.
Hope that clears up any confusion

-Dinakar

2005-11-25 08:03:56

by Ingo Molnar

Subject: Re: PI BUG with -rt13

* david singleton <[email protected]> wrote:

> > why is there per-vma info needed?
>
> I've had numerous requests to add support for pthread_mutexes that
> have been 'malloc'd and end up in the heap.
>
> The original robust futex patch only supported shared pthread mutexes,
> backed either by a file in which the pthread mutex was written on in
> anonymous memory allocated via mmap with the MAP_SHARE and
> MAP_ANONYMOUS flags.
>
> Anonymous memory gets backed by an inode on which we lookup and hang
> the robust mutex structure (and which gets freed on the last reference
> to the inode.)
>
> The choice seemed either to back heap with the anonymous memory/inode
> framework or just hang the struct on the vma itself.

putting it into the vma is just about the worst solution. vma size is
something we are very sensitive to. Your patch adds:

+ int robust_init; /* robust initialized? */
+ struct list_head robust_list; /* list of robust futexes in this vma */
+ struct semaphore robust_sem; /* semaphore to protect the list */

which is unacceptable. _And_ you were also talking about making it an
rbtree... why do you want to make it a tree?

also, funky runtime flags like 'robust_init' are just sloppy.

add a separate pointer, and put the above fields into a separate SLAB.
That way the overhead to the vma is a single pointer. (which might still
be unacceptable to upstream!)

Ingo

2005-11-25 13:21:23

by Dinakar Guniguntala

Subject: Re: PI BUG with -rt13

On Fri, Nov 25, 2005 at 06:04:02AM +0100, Ingo Molnar wrote:
>
> * Dinakar Guniguntala <[email protected]> wrote:
>
> > I just noticed with the above fix, Paul's testcase completely hangs up
> > and when killed I hit the BUG mentioned below. Till -rt13, this
> > testcase just ran to completion
>
> does it still hang if you disable CONFIG_PARANOID_GENERIC_TIME in your
> .config?

Disabling CONFIG_PARANOID_GENERIC_TIME does not help. I get the same
hang. Just got my kgdb setup. Hopefully I should have more info

-Dinakar