From: Yinghai Lu <yinghai@kernel.org>
To: Bjorn Helgaas <bhelgaas@google.com>
Cc: Andreas Noever <andreas.noever@gmail.com>,
Matthew Garrett <mjg59@srcf.ucam.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"Rafael J. Wysocki" <rjw@sisk.pl>,
"linux-pci@vger.kernel.org" <linux-pci@vger.kernel.org>,
Mika Westerberg <mika.westerberg@linux.intel.com>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Subject: Re: [3.11.4] Thunderbolt/PCI unplug oops in pci_pme_list_scan
Date: Thu, 24 Oct 2013 22:13:18 -0700 [thread overview]
Message-ID: <CAE9FiQUPgHtQ-p6R3MR+j=gKiQPcW5F2nqB=FwJdEovFLsuXjA@mail.gmail.com> (raw)
In-Reply-To: <CAErSpo5yhg1EgJmmOtJeh0myd50tJuu6qVMdVnwR276WTxL8kg@mail.gmail.com>
On Thu, Oct 24, 2013 at 8:33 PM, Bjorn Helgaas <bhelgaas@google.com> wrote:
>
>>>> Bisection points to 928bea964827d7824b548c1f8e06eccbbc4d0d7d .
>>>
>>> This is "PCI: Delay enabling bridges until they're needed" by Yinghai.
>>
>> that double disabling should be addressed by:
>>
>> https://lkml.org/lkml/2013/4/25/608
>>
>> [PATCH] PCI: Remove duplicate pci_disable_device for pcie port
>
> I'll look at that patch again. I had some questions about it the
> first time, but perhaps it makes more sense after 928bea9648 has been
> applied.
>
> Andreas originally reported a GPF oops in pci_pme_list_scan(). I
> posted a refcounting patch, which made the problem go away, but I
> can't explain why, and I don't want to apply it without understanding
> that. Decoding his oops shows this:
>
> 24: 0f 1f 00 nopl (%rax)
> 27: 48 8b 50 10 mov 0x10(%rax),%rdx
> 2b:* 48 8b 52 38 mov 0x38(%rdx),%rdx <-- trapping instruction
> 2f: 48 85 d2 test %rdx,%rdx
>
> %rax is the pci_dev pointer, so 0x10(%rax) is the dev->bus pointer,
> which we put in %rdx. The oops says %rdx = 6b6b6b6b6b6b6b6b, which is
> POISON_FREE, so I think we loaded dev->bus out of a struct pci_dev
> that has already been freed.
>
> pci_pme_list_scan() holds pci_pme_list_mutex while it traverses
> pci_pme_list, and the pci_stop_and_remove_bus_device() path removes
> the pci_dev by calling pci_pme_active(), which also holds
> pci_pme_list_mutex, so I don't understand how pci_pme_list_scan() can
> see a pci_dev that has already been freed.
>
> If I understand Andreas correctly, 928bea9648 also fixes the crash,
> even without my refcounting change. Can you explain why?
928bea will make the dev->enable_cnt increase wrongly, as we have
pci_enable_device for child
pci_enable_bridge for parent
pci_enable_bridge for grandparent
pci_enable_device for grandparent
pci_enable_device for parent
pci_enable_brdige for grandparent
pci_enable_device for grandparent.
...
in that case grandprent will be enabled two times, and will enable_cnt will have
extra increase.
so later pci_disable_device will not really call do_pci_disable_device
do the really work, as enable_cnt still big.
solution could be:
let pci_enable_bridge call __pci_enable_device.
and __pci_enable_device will not call pci_enable_bridge.
Thanks
Yinghai
next prev parent reply other threads:[~2013-10-25 5:13 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-14 22:47 [3.11.4] Thunderbolt/PCI unplug oops in pci_pme_list_scan Andreas Noever
2013-10-14 23:50 ` Bjorn Helgaas
2013-10-15 2:44 ` Matthew Garrett
2013-10-16 20:21 ` Bjorn Helgaas
2013-10-17 13:59 ` Andreas Noever
2013-10-23 3:32 ` Bjorn Helgaas
2013-10-24 5:53 ` Yinghai Lu
2013-10-25 3:33 ` Bjorn Helgaas
2013-10-25 5:13 ` Yinghai Lu [this message]
2013-10-25 5:28 ` Yinghai Lu
2013-10-25 23:01 ` Bjorn Helgaas
2013-10-27 0:39 ` Andreas Noever
2013-11-15 11:52 ` Mika Westerberg
2013-11-19 1:33 ` Bjorn Helgaas
2013-11-19 1:54 ` Yijing Wang
2013-11-19 17:18 ` Bjorn Helgaas
2013-11-20 1:14 ` Yijing Wang
2013-11-20 1:20 ` Bjorn Helgaas
2013-11-20 1:39 ` Yijing Wang
2013-11-19 10:06 ` Mika Westerberg
2013-10-30 7:57 ` Yijing Wang
2013-10-31 6:48 ` Yinghai Lu
2013-10-23 23:53 ` Bjorn Helgaas
2013-10-29 3:30 ` Bjorn Helgaas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAE9FiQUPgHtQ-p6R3MR+j=gKiQPcW5F2nqB=FwJdEovFLsuXjA@mail.gmail.com' \
--to=yinghai@kernel.org \
--cc=andreas.noever@gmail.com \
--cc=bhelgaas@google.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=mika.westerberg@linux.intel.com \
--cc=mjg59@srcf.ucam.org \
--cc=rjw@sisk.pl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).