2.6.22-rc6-mm1 bad_page events.

PATCH In review Alan Cox 4 participants 6 messages Jul 3, 2007

Share & tools

Alan Cox

author

2007-07-03 14:00 UTC #0 lore raw

X86 32bit with lots of debug turned on I get this:

Freeing unused kernel memory: 156k freed
Write protecting the kernel text: 1668k
Write protecting the kernel read-only data: 719k
Bad page state in process 'swapper'
page:c10000c0 flags:0x00000400 mapping:00000000 mapcount:0 count:0 Trying to fix it up, but a reboot is needed

Backtrace:
 [<c024589c>] bad_page+0x6c/0x100
 [<c024648d>] free_hot_cold_page+0x5d/0x140
 [<c02116c2>] global_flush_tlb+0x112/0x130
 [<c020102d>] init_post+0xd/0xe0
 [<c047c876>] kernel_init+0x216/0x220
 [<c0214c50>] schedule_tail+0x0/0xe0
 [<c047c660>] kernel_init+0x0/0x220
 [<c047c660>] kernel_init+0x0/0x220
 [<c0204227>] kernel_thread_helper+0x7/0x10
 =======================

Hexdump:
000: 00 06 00 00 01 00 00 00 ff ff ff ff 0f 00 00 00 010: 00 00 00 00 00 00 00 00 78 00 00 c1 b8 00 00 c1 020: 00 06 00 00 01 00 00 00 ff ff ff ff a7 03 00 00 030: 00 00 00 00 00 00 00 00 98 00 00 c1 d8 00 00 c1 040: 00 04 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 050: 00 00 00 00 00 00 00 00 b8 00 00 c1 f8 00 00 c1 060: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00 070: 00 00 00 00 00 00 00 00 d8 00 00 c1 18 01 00 c1 080: 00 06 00 00 01 00 00 00 ff ff ff ff 9c 03 00 00 090: 00 00 00 00 00 00 00 00 f8 00 00 c1 38 01 00 c1 0a0: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00 0b0: 00 00 00 00 00 00 00 00 18 01 00 c1 58 01 00 c1

Mathieu Desnoyers

2007-07-03 15:38 UTC #1 lore raw

Hi Alan,

I already sent a fix to Andrew and Andi for this (hrm, forget to CC lkml on the original message):

x86_64 mm cpa cache flush fix

X86_64 and i386 cpa cache flush fix:

list_del the deferred list entries to poison their pointers. clear the flag for every page put in the list.

Signed-off-by Mathieu Desnoyers <[email protected]>

CC Andi Kleen <[email protected]>

---
 arch/i386/mm/pageattr.c   |    3 ++-
 arch/x86_64/mm/pageattr.c |    3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

arch/i386/mm/pageattr.c +2 -1

Index: linux-2.6-lttng/arch/i386/mm/pageattr.c
===================================================================
@@ -245,10 +245,11 @@
 	spin_unlock_irq(&cpa_lock);
 	flush_map(&l);
 	list_for_each_entry_safe(pg, next, &l, lru) {
+		clear_bit(PG_arch_1, &pg->flags);
+		list_del(&pg->lru);
 		if (page_private(pg) != 0)
 			continue;
 		ClearPagePrivate(pg);
-		clear_bit(PG_arch_1, &pg->flags);
 		__free_page(pg);
 	}
 }

arch/x86_64/mm/pageattr.c +2 -1

Index: linux-2.6-lttng/arch/x86_64/mm/pageattr.c
===================================================================
@@ -235,10 +235,11 @@
 	flush_map(&l);
 
 	list_for_each_entry_safe(pg, next, &l, lru) {
+		clear_bit(PG_arch_1, &pg->flags);
+		list_del(&pg->lru);
 		if (page_private(pg) != 0)
 			continue;
 		ClearPagePrivate(pg);
-		clear_bit(PG_arch_1, &pg->flags);
 		__free_page(pg);
 	} 
 }

Quoted 40 lines · * Alan Cox ([email protected]) wrote:

X86 32bit with lots of debug turned on I get this:
Freeing unused kernel memory: 156k freed
Write protecting the kernel text: 1668k
Write protecting the kernel read-only data: 719k
Bad page state in process 'swapper'
page:c10000c0 flags:0x00000400 mapping:00000000 mapcount:0 count:0 Trying to fix it up, but a reboot is needed
Backtrace:
 [<c024589c>] bad_page+0x6c/0x100
 [<c024648d>] free_hot_cold_page+0x5d/0x140
 [<c02116c2>] global_flush_tlb+0x112/0x130
 [<c020102d>] init_post+0xd/0xe0
 [<c047c876>] kernel_init+0x216/0x220
 [<c0214c50>] schedule_tail+0x0/0xe0
 [<c047c660>] kernel_init+0x0/0x220
 [<c047c660>] kernel_init+0x0/0x220
 [<c0204227>] kernel_thread_helper+0x7/0x10
 =======================
Hexdump:
000: 00 06 00 00 01 00 00 00 ff ff ff ff 0f 00 00 00
010: 00 00 00 00 00 00 00 00 78 00 00 c1 b8 00 00 c1
020: 00 06 00 00 01 00 00 00 ff ff ff ff a7 03 00 00
030: 00 00 00 00 00 00 00 00 98 00 00 c1 d8 00 00 c1
040: 00 04 00 00 00 00 00 00 ff ff ff ff 00 00 00 00
050: 00 00 00 00 00 00 00 00 b8 00 00 c1 f8 00 00 c1
060: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
070: 00 00 00 00 00 00 00 00 d8 00 00 c1 18 01 00 c1
080: 00 06 00 00 01 00 00 00 ff ff ff ff 9c 03 00 00
090: 00 00 00 00 00 00 00 00 f8 00 00 c1 38 01 00 c1
0a0: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
0b0: 00 00 00 00 00 00 00 00 18 01 00 c1 58 01 00 c1
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Signature · 3 lines

Mathieu Desnoyers
Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68

Frederik Deweerdt

2007-07-03 16:29 UTC #2 lore raw

Quoted 6 lines · Mathieu Desnoyers

Hi Alan,
I already sent a fix to Andrew and Andi for this (hrm, forget to CC lkml on the original message):

Quoted 7 lines

x86_64 mm cpa cache flush fix
X86_64 and i386 cpa cache flush fix:
list_del the deferred list entries to poison their pointers. clear the flag for every page put in the list.

Hi Mathieu,

I've tried the patch on rc6-mm1, but it doesn't seem to fix the problem. From what I understood, the bad_page() is called on PG_reserved being set (flags:0x00000400), not the lru pointer being not NULL or PG_arch_1 being set.

Regards,
Frederik

Quoted 2 lines

Signed-off-by Mathieu Desnoyers <[email protected]>
CC Andi Kleen <[email protected]>

[...]

Quoted 11 lines

arch/i386/mm/pageattr.c +2 -1

 	flush_map(&l);
 	list_for_each_entry_safe(pg, next, &l, lru) {
+		clear_bit(PG_arch_1, &pg->flags);
+		list_del(&pg->lru);
 		if (page_private(pg) != 0)
 			continue;
 		ClearPagePrivate(pg);
-		clear_bit(PG_arch_1, &pg->flags);
 		__free_page(pg);
 	}
 }

[...]

Quoted 2 lines · * Alan Cox ([email protected]) wrote:

Quoted 1 line
X86 32bit with lots of debug turned on I get this:

[...]

Quoted 44 lines

Quoted 33 lines
Bad page state in process 'swapper'
page:c10000c0 flags:0x00000400 mapping:00000000 mapcount:0 count:0 Trying to fix it up, but a reboot is needed
Backtrace:
 [<c024589c>] bad_page+0x6c/0x100
 [<c024648d>] free_hot_cold_page+0x5d/0x140
 [<c02116c2>] global_flush_tlb+0x112/0x130
 [<c020102d>] init_post+0xd/0xe0
 [<c047c876>] kernel_init+0x216/0x220
 [<c0214c50>] schedule_tail+0x0/0xe0
 [<c047c660>] kernel_init+0x0/0x220
 [<c047c660>] kernel_init+0x0/0x220
 [<c0204227>] kernel_thread_helper+0x7/0x10
 =======================
Hexdump:
000: 00 06 00 00 01 00 00 00 ff ff ff ff 0f 00 00 00
010: 00 00 00 00 00 00 00 00 78 00 00 c1 b8 00 00 c1
020: 00 06 00 00 01 00 00 00 ff ff ff ff a7 03 00 00
030: 00 00 00 00 00 00 00 00 98 00 00 c1 d8 00 00 c1
040: 00 04 00 00 00 00 00 00 ff ff ff ff 00 00 00 00
050: 00 00 00 00 00 00 00 00 b8 00 00 c1 f8 00 00 c1
060: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
070: 00 00 00 00 00 00 00 00 d8 00 00 c1 18 01 00 c1
080: 00 06 00 00 01 00 00 00 ff ff ff ff 9c 03 00 00
090: 00 00 00 00 00 00 00 00 f8 00 00 c1 38 01 00 c1
0a0: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
0b0: 00 00 00 00 00 00 00 00 18 01 00 c1 58 01 00 c1
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Signature · 8 lines
Mathieu Desnoyers
Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Mathieu Desnoyers

2007-07-03 17:33 UTC #3 lore raw

PATCH 1/1 i386 CPA fix - do not free reserved pages

Right, there is a test missing, can you try this fix on top of my x86_64 mm cpa cache flush fix ?

i386 CPA fix - do not free reserved pages

We have to use the same conditions found in change_page_attr in global_tlb_flush regarding the conditions that leads to free the page.

Signed-off-by Mathieu Desnoyers <[email protected]>

---
 arch/i386/mm/pageattr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

arch/i386/mm/pageattr.c +1 -1

Index: linux-2.6-lttng/arch/i386/mm/pageattr.c
===================================================================
@@ -247,7 +247,7 @@
 	list_for_each_entry_safe(pg, next, &l, lru) {
 		clear_bit(PG_arch_1, &pg->flags);
 		list_del(&pg->lru);
-		if (page_private(pg) != 0)
+		if (PageReserved(pg) || !cpu_has_pse || page_private(pg) != 0)
 			continue;
 		ClearPagePrivate(pg);
 		__free_page(pg);

Quoted 87 lines · * Frederik Deweerdt ([email protected]) wrote:

Quoted 6 lines · Mathieu Desnoyers
Hi Alan,
I already sent a fix to Andrew and Andi for this (hrm, forget to CC lkml on the original message):
Quoted 7 lines
x86_64 mm cpa cache flush fix
X86_64 and i386 cpa cache flush fix:
list_del the deferred list entries to poison their pointers. clear the flag for every page put in the list.
Hi Mathieu,
I've tried the patch on rc6-mm1, but it doesn't seem to fix the problem. From what I understood, the bad_page() is called on PG_reserved being set (flags:0x00000400), not the lru pointer being not NULL or PG_arch_1 being set.
Regards,
Frederik
Quoted 2 lines
Signed-off-by Mathieu Desnoyers <[email protected]>
CC Andi Kleen <[email protected]>
[...]
Quoted 11 lines
(quoted diff) +2 -1
 	flush_map(&l);
 	list_for_each_entry_safe(pg, next, &l, lru) {
+		clear_bit(PG_arch_1, &pg->flags);
+		list_del(&pg->lru);
 		if (page_private(pg) != 0)
 			continue;
 		ClearPagePrivate(pg);
-		clear_bit(PG_arch_1, &pg->flags);
 		__free_page(pg);
 	}
 }
[...]
Quoted 2 lines · * Alan Cox ([email protected]) wrote:
Quoted 1 line
X86 32bit with lots of debug turned on I get this:
[...]
Quoted 44 lines
Quoted 33 lines
Bad page state in process 'swapper'
page:c10000c0 flags:0x00000400 mapping:00000000 mapcount:0 count:0 Trying to fix it up, but a reboot is needed
Backtrace:
 [<c024589c>] bad_page+0x6c/0x100
 [<c024648d>] free_hot_cold_page+0x5d/0x140
 [<c02116c2>] global_flush_tlb+0x112/0x130
 [<c020102d>] init_post+0xd/0xe0
 [<c047c876>] kernel_init+0x216/0x220
 [<c0214c50>] schedule_tail+0x0/0xe0
 [<c047c660>] kernel_init+0x0/0x220
 [<c047c660>] kernel_init+0x0/0x220
 [<c0204227>] kernel_thread_helper+0x7/0x10
 =======================
Hexdump:
000: 00 06 00 00 01 00 00 00 ff ff ff ff 0f 00 00 00
010: 00 00 00 00 00 00 00 00 78 00 00 c1 b8 00 00 c1
020: 00 06 00 00 01 00 00 00 ff ff ff ff a7 03 00 00
030: 00 00 00 00 00 00 00 00 98 00 00 c1 d8 00 00 c1
040: 00 04 00 00 00 00 00 00 ff ff ff ff 00 00 00 00
050: 00 00 00 00 00 00 00 00 b8 00 00 c1 f8 00 00 c1
060: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
070: 00 00 00 00 00 00 00 00 d8 00 00 c1 18 01 00 c1
080: 00 06 00 00 01 00 00 00 ff ff ff ff 9c 03 00 00
090: 00 00 00 00 00 00 00 00 f8 00 00 c1 38 01 00 c1
0a0: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
0b0: 00 00 00 00 00 00 00 00 18 01 00 c1 58 01 00 c1
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Signature · 8 lines
Mathieu Desnoyers
Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Signature · 3 lines

Mathieu Desnoyers
Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68

Frederik Deweerdt

2007-07-03 19:26 UTC #4 lore raw

Re: [PATCH] i386 CPA fix - do not free reserved pages

Quoted 2 lines · Mathieu Desnoyers

Right, there is a test missing, can you try this fix on top of my x86_64 mm cpa cache flush fix ?

No warning with both patches applied, thanks Mathieu.

Frederik

Quoted 126 lines

i386 CPA fix - do not free reserved pages
We have to use the same conditions found in change_page_attr in global_tlb_flush regarding the conditions that leads to free the page.
Signed-off-by Mathieu Desnoyers <[email protected]>
---
 arch/i386/mm/pageattr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Index: linux-2.6-lttng/arch/i386/mm/pageattr.c
===================================================================
arch/i386/mm/pageattr.c +1 -1
@@ -247,7 +247,7 @@
 	list_for_each_entry_safe(pg, next, &l, lru) {
 		clear_bit(PG_arch_1, &pg->flags);
 		list_del(&pg->lru);
-		if (page_private(pg) != 0)
+		if (PageReserved(pg) || !cpu_has_pse || page_private(pg) != 0)
 			continue;
 		ClearPagePrivate(pg);
 		__free_page(pg);
Quoted 87 lines · * Frederik Deweerdt ([email protected]) wrote:
Quoted 6 lines · Mathieu Desnoyers
Hi Alan,
I already sent a fix to Andrew and Andi for this (hrm, forget to CC lkml on the original message):
Quoted 7 lines
x86_64 mm cpa cache flush fix
X86_64 and i386 cpa cache flush fix:
list_del the deferred list entries to poison their pointers. clear the flag for every page put in the list.
Hi Mathieu,
I've tried the patch on rc6-mm1, but it doesn't seem to fix the problem. From what I understood, the bad_page() is called on PG_reserved being set (flags:0x00000400), not the lru pointer being not NULL or PG_arch_1 being set.
Regards,
Frederik
Quoted 2 lines
Signed-off-by Mathieu Desnoyers <[email protected]>
CC Andi Kleen <[email protected]>
[...]
Quoted 11 lines
(quoted diff) +2 -1
 	flush_map(&l);
 	list_for_each_entry_safe(pg, next, &l, lru) {
+		clear_bit(PG_arch_1, &pg->flags);
+		list_del(&pg->lru);
 		if (page_private(pg) != 0)
 			continue;
 		ClearPagePrivate(pg);
-		clear_bit(PG_arch_1, &pg->flags);
 		__free_page(pg);
 	}
 }
[...]
Quoted 2 lines · * Alan Cox ([email protected]) wrote:
Quoted 1 line
X86 32bit with lots of debug turned on I get this:
[...]
Quoted 44 lines
Quoted 33 lines
Bad page state in process 'swapper'
page:c10000c0 flags:0x00000400 mapping:00000000 mapcount:0 count:0 Trying to fix it up, but a reboot is needed
Backtrace:
 [<c024589c>] bad_page+0x6c/0x100
 [<c024648d>] free_hot_cold_page+0x5d/0x140
 [<c02116c2>] global_flush_tlb+0x112/0x130
 [<c020102d>] init_post+0xd/0xe0
 [<c047c876>] kernel_init+0x216/0x220
 [<c0214c50>] schedule_tail+0x0/0xe0
 [<c047c660>] kernel_init+0x0/0x220
 [<c047c660>] kernel_init+0x0/0x220
 [<c0204227>] kernel_thread_helper+0x7/0x10
 =======================
Hexdump:
000: 00 06 00 00 01 00 00 00 ff ff ff ff 0f 00 00 00
010: 00 00 00 00 00 00 00 00 78 00 00 c1 b8 00 00 c1
020: 00 06 00 00 01 00 00 00 ff ff ff ff a7 03 00 00
030: 00 00 00 00 00 00 00 00 98 00 00 c1 d8 00 00 c1
040: 00 04 00 00 00 00 00 00 ff ff ff ff 00 00 00 00
050: 00 00 00 00 00 00 00 00 b8 00 00 c1 f8 00 00 c1
060: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
070: 00 00 00 00 00 00 00 00 d8 00 00 c1 18 01 00 c1
080: 00 06 00 00 01 00 00 00 ff ff ff ff 9c 03 00 00
090: 00 00 00 00 00 00 00 00 f8 00 00 c1 38 01 00 c1
0a0: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00
0b0: 00 00 00 00 00 00 00 00 18 01 00 c1 58 01 00 c1
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Signature · 8 lines
Mathieu Desnoyers
Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/
Signature · 8 lines
Mathieu Desnoyers
Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal
OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F  BA06 3F25 A8FE 3BAE 9A68
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Andrew Morton

2007-07-03 15:55 UTC #5 lore raw

In reply to Alan Cox

Quoted 21 lines · On Tue, 3 Jul 2007 15:06:56 +0100 Alan Cox <[email protected]> wrote:

X86 32bit with lots of debug turned on I get this:
Freeing unused kernel memory: 156k freed
Write protecting the kernel text: 1668k
Write protecting the kernel read-only data: 719k
Bad page state in process 'swapper'
page:c10000c0 flags:0x00000400 mapping:00000000 mapcount:0 count:0 Trying to fix it up, but a reboot is needed
Backtrace:
 [<c024589c>] bad_page+0x6c/0x100
 [<c024648d>] free_hot_cold_page+0x5d/0x140
 [<c02116c2>] global_flush_tlb+0x112/0x130
 [<c020102d>] init_post+0xd/0xe0
 [<c047c876>] kernel_init+0x216/0x220
 [<c0214c50>] schedule_tail+0x0/0xe0
 [<c047c660>] kernel_init+0x0/0x220
 [<c047c660>] kernel_init+0x0/0x220
 [<c0204227>] kernel_thread_helper+0x7/0x10
 =======================

Quoted 13 lines

Hexdump:
000: 00 06 00 00 01 00 00 00 ff ff ff ff 0f 00 00 00 010: 00 00 00 00 00 00 00 00 78 00 00 c1 b8 00 00 c1 020: 00 06 00 00 01 00 00 00 ff ff ff ff a7 03 00 00 030: 00 00 00 00 00 00 00 00 98 00 00 c1 d8 00 00 c1 040: 00 04 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 050: 00 00 00 00 00 00 00 00 b8 00 00 c1 f8 00 00 c1 060: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00 070: 00 00 00 00 00 00 00 00 d8 00 00 c1 18 01 00 c1 080: 00 06 00 00 01 00 00 00 ff ff ff ff 9c 03 00 00 090: 00 00 00 00 00 00 00 00 f8 00 00 c1 38 01 00 c1 0a0: 00 06 00 00 01 00 00 00 ff ff ff ff 00 04 00 00 0b0: 00 00 00 00 00 00 00 00 18 01 00 c1 58 01 00 c1

Wow, freeing lots of PageReserved() pages. I assume via free_initmem(), but it's strange that free_initmem() makes no appearance in the backtrace.

I don't know which change could have caused this. Nobody else has reported this, but 32-on-64 might be pretty rare. If you can send the config I'll see if it happens here?