--- extensions/defs.h | 49 ++++++++++++++++++++++++++++++------------------- 1 file changed, 30 insertions(+), 19 deletions(-) diff -puN extensions/defs.h~crash-update-defs extensions/defs.h --- crash-64/extensions/defs.h~crash-update-defs 2016-04-18 02:47:23.673852954 +0900 +++ crash-64-hirofumi/extensions/defs.h 2016-04-18 02:47:23.675852964 +0900 @@ -1950,6 +1950,8 @@ struct offset_table { long pt_regs_cp0_badvaddr; long address_space_page_tree; long page_compound_head; + long irq_desc_irq_data; + long kmem_cache_node_total_objects; }; struct size_table { /* stash of commonly-used sizes */ @@ -4118,30 +4120,39 @@ struct gnu_request { ulong task; ulong debug; struct stack_hook *hookp; + struct global_iterator { + int finished; + int block_index; + struct symtab *symtab; + struct symbol *sym; + struct objfile *obj; + } global_iterator; }; /* * GNU commands */ -#define GNU_DATATYPE_INIT (1) -#define GNU_DISASSEMBLE (2) -#define GNU_GET_LINE_NUMBER (3) -#define GNU_PASS_THROUGH (4) -#define GNU_GET_DATATYPE (5) -#define GNU_COMMAND_EXISTS (6) -#define GNU_STACK_TRACE (7) -#define GNU_ALPHA_FRAME_OFFSET (8) -#define GNU_FUNCTION_NUMARGS (9) -#define GNU_RESOLVE_TEXT_ADDR (10) -#define GNU_ADD_SYMBOL_FILE (11) -#define GNU_DELETE_SYMBOL_FILE (12) -#define GNU_VERSION (13) -#define GNU_PATCH_SYMBOL_VALUES (14) -#define GNU_GET_SYMBOL_TYPE (15) -#define GNU_USER_PRINT_OPTION (16) -#define GNU_SET_CRASH_BLOCK (17) -#define GNU_GET_FUNCTION_RANGE (18) -#define GNU_DEBUG_COMMAND (100) +#define GNU_DATATYPE_INIT (1) +#define GNU_DISASSEMBLE (2) +#define GNU_GET_LINE_NUMBER (3) +#define GNU_PASS_THROUGH (4) +#define GNU_GET_DATATYPE (5) +#define GNU_COMMAND_EXISTS (6) +#define GNU_STACK_TRACE (7) +#define GNU_ALPHA_FRAME_OFFSET (8) +#define GNU_FUNCTION_NUMARGS (9) +#define GNU_RESOLVE_TEXT_ADDR (10) +#define GNU_ADD_SYMBOL_FILE (11) +#define GNU_DELETE_SYMBOL_FILE (12) +#define GNU_VERSION (13) +#define GNU_PATCH_SYMBOL_VALUES (14) +#define GNU_GET_SYMBOL_TYPE (15) +#define GNU_USER_PRINT_OPTION (16) +#define GNU_SET_CRASH_BLOCK (17) +#define GNU_GET_FUNCTION_RANGE (18) +#define GNU_GET_NEXT_DATATYPE (19) +#define GNU_LOOKUP_STRUCT_CONTENTS (20) +#define GNU_DEBUG_COMMAND (100) /* * GNU flags */ _ -- OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp&gt;

Hi, SLUB cpu_slab has 2 freelist. One is cpu_slab->freelist for local cpu. One is cpu_slab->page->freelist for remote cpu. So, we have to check both of freelists to know details. Note, page->inuse counts only for free on page->freelist, not cpu_slab->freelist. so total free objects are (page->objects - page->inuse) + count(cpu_slab->freelist)) --- memory.c | 213 ++++++++++++++++++++++++++++---------------------------------- 1 file changed, 99 insertions(+), 114 deletions(-) diff -puN memory.c~crash-slub-freelist-fix memory.c --- crash-64/memory.c~crash-slub-freelist-fix 2016-04-18 02:29:57.743774055 +0900 +++ crash-64-hirofumi/memory.c 2016-04-18 02:32:30.999515870 +0900 @@ -17914,15 +17914,62 @@ bailout: FREEBUF(si->cache_buf); } +static ushort slub_page_objects(struct meminfo *si, ulong page) +{ + ulong objects_vaddr; + ushort objects; + + /* + * Pre-2.6.27, the object count and order were fixed in the + * kmem_cache structure. Now they may change, say if a high + * order slab allocation fails, so the per-slab object count + * is kept in the slab. + */ + if (VALID_MEMBER(page_objects)) { + objects_vaddr = page + OFFSET(page_objects); + if (si->flags & SLAB_BITFIELD) + objects_vaddr += sizeof(ushort); + if (!readmem(objects_vaddr, KVADDR, &objects, + sizeof(ushort), "page.objects", RETURN_ON_ERROR)) + return 0; + /* + * Strip page.frozen bit. + */ + if (si->flags & SLAB_BITFIELD) { + if (__BYTE_ORDER == __LITTLE_ENDIAN) { + objects <<= 1; + objects >>= 1; + } + if (__BYTE_ORDER == __BIG_ENDIAN) + objects >>= 1; + } + + if (CRASHDEBUG(1) && (objects != si->objects)) + error(NOTE, "%s: slab: %lx oo objects: %ld " + "slab objects: %d\n", + si->curname, si->slab, + si->objects, objects); + + if (objects == (ushort)(-1)) { + error(INFO, "%s: slab: %lx invalid page.objects: -1\n", + si->curname, si->slab); + return 0; + } + } else + objects = (ushort)si->objects; + + return objects; +} + static short count_cpu_partial(struct meminfo *si, int cpu) { short cpu_partial_inuse, cpu_partial_objects, free_objects; - ulong cpu_partial, objects_vaddr; + ulong cpu_partial; free_objects = 0; - if (VALID_MEMBER(kmem_cache_cpu_partial)) { + if (VALID_MEMBER(kmem_cache_cpu_partial) && VALID_MEMBER(page_objects)) { readmem(ULONG(si->cache_buf + OFFSET(kmem_cache_cpu_slab)) + kt->__per_cpu_offset[cpu] + OFFSET(kmem_cache_cpu_partial), KVADDR, &cpu_partial, sizeof(ulong), @@ -17939,27 +17986,13 @@ count_cpu_partial(struct meminfo *si, in return 0; if (cpu_partial_inuse == -1) return 0; - if (VALID_MEMBER(page_objects)) { - objects_vaddr = cpu_partial + OFFSET(page_objects); - if (si->flags & SLAB_BITFIELD) - objects_vaddr += sizeof(ushort); - if (!readmem(objects_vaddr, KVADDR, - &cpu_partial_objects, sizeof(ushort), - "page.objects", RETURN_ON_ERROR)) - return 0; - if (si->flags & SLAB_BITFIELD) { - if (__BYTE_ORDER == __LITTLE_ENDIAN) { - cpu_partial_objects <<= 1; - cpu_partial_objects >>= 1; - } - if (__BYTE_ORDER == __BIG_ENDIAN) - cpu_partial_objects >>= 1; - } - if (cpu_partial_objects == (short)(-1)) - return 0; - free_objects += - cpu_partial_objects - cpu_partial_inuse; - } + + cpu_partial_objects = slub_page_objects(si, + cpu_partial); + if (!cpu_partial_objects) + return 0; + free_objects += cpu_partial_objects - cpu_partial_inuse; + readmem(cpu_partial + OFFSET(page_next), KVADDR, &cpu_partial, sizeof(ulong), "page.next", RETURN_ON_ERROR); @@ -18011,14 +18044,12 @@ get_kmem_cache_slub_data(long cmd, struc KVADDR, &inuse, sizeof(short), "page inuse", RETURN_ON_ERROR)) return FALSE; - if (!cpu_freelist) - if (!readmem(cpu_slab_ptr + OFFSET(page_freelist), - KVADDR, &cpu_freelist, sizeof(ulong), - "page freelist", RETURN_ON_ERROR)) - return FALSE; + objects = slub_page_objects(si, cpu_slab_ptr); + if (!objects) + return FALSE; - free_objects += - count_free_objects(si, cpu_freelist); + free_objects += objects - inuse; + free_objects += count_free_objects(si, cpu_freelist); free_objects += count_cpu_partial(si, i); if (!node_total_avail) @@ -18255,7 +18286,7 @@ static int do_slab_slub(struct meminfo *si, int verbose) { physaddr_t paddr; - ulong vaddr, objects_vaddr; + ulong vaddr; ushort inuse, objects; ulong freelist, cpu_freelist, cpu_slab_ptr; int i, free_objects, cpu_slab, is_free, node; @@ -18287,50 +18318,17 @@ do_slab_slub(struct meminfo *si, int ver if (!readmem(si->slab + OFFSET(page_freelist), KVADDR, &freelist, sizeof(void *), "page.freelist", RETURN_ON_ERROR)) return FALSE; - /* - * Pre-2.6.27, the object count and order were fixed in the - * kmem_cache structure. Now they may change, say if a high - * order slab allocation fails, so the per-slab object count - * is kept in the slab. - */ - if (VALID_MEMBER(page_objects)) { - objects_vaddr = si->slab + OFFSET(page_objects); - if (si->flags & SLAB_BITFIELD) - objects_vaddr += sizeof(ushort); - if (!readmem(objects_vaddr, KVADDR, &objects, - sizeof(ushort), "page.objects", RETURN_ON_ERROR)) - return FALSE; - /* - * Strip page.frozen bit. - */ - if (si->flags & SLAB_BITFIELD) { - if (__BYTE_ORDER == __LITTLE_ENDIAN) { - objects <<= 1; - objects >>= 1; - } - if (__BYTE_ORDER == __BIG_ENDIAN) - objects >>= 1; - } - - if (CRASHDEBUG(1) && (objects != si->objects)) - error(NOTE, "%s: slab: %lx oo objects: %ld " - "slab objects: %d\n", - si->curname, si->slab, - si->objects, objects); - if (objects == (ushort)(-1)) { - error(INFO, "%s: slab: %lx invalid page.objects: -1\n", - si->curname, si->slab); - return FALSE; - } - } else - objects = (ushort)si->objects; + objects = slub_page_objects(si, si->slab); + if (!objects) + return FALSE; if (!verbose) { DUMP_SLAB_INFO_SLUB(); return TRUE; } + cpu_freelist = 0; for (i = 0, cpu_slab = -1; i < kt->cpus; i++) { cpu_slab_ptr = get_cpu_slab_ptr(si, i, &cpu_freelist); @@ -18342,11 +18340,15 @@ do_slab_slub(struct meminfo *si, int ver * Later slub scheme uses the per-cpu freelist * so count the free objects by hand. */ - if (cpu_freelist) - freelist = cpu_freelist; - if ((free_objects = count_free_objects(si, freelist)) < 0) + if ((free_objects = count_free_objects(si, cpu_freelist)) < 0) return FALSE; - inuse = si->objects - free_objects; + /* + * If the object is freed on foreign cpu, the + * object is liked to page->freelist. + */ + if (freelist) + free_objects += objects - inuse; + inuse = objects - free_objects; break; } } @@ -18377,28 +18379,31 @@ do_slab_slub(struct meminfo *si, int ver for (p = vaddr; p < vaddr + objects * si->size; p += si->size) { hq_open(); is_free = FALSE; - for (is_free = 0, q = freelist; q; - q = get_freepointer(si, (void *)q)) { + /* Search an object on both of freelist and cpu_freelist */ + ulong lists[] = { freelist, cpu_freelist, }; + for (int i = 0; i < sizeof(lists) / sizeof(lists[0]); i++) { + for (is_free = 0, q = lists[i]; q; + q = get_freepointer(si, (void *)q)) { - if (q == BADADDR) { - hq_close(); - return FALSE; - } - if (q & PAGE_MAPPING_ANON) - break; - if (p == q) { - is_free = TRUE; - break; - } - if (!hq_enter(q)) { - hq_close(); - error(INFO, - "%s: slab: %lx duplicate freelist object: %lx\n", - si->curname, si->slab, q); - return FALSE; + if (q == BADADDR) { + hq_close(); + return FALSE; + } + if (q & PAGE_MAPPING_ANON) + break; + if (p == q) { + is_free = TRUE; + goto found_object; + } + if (!hq_enter(q)) { + hq_close(); + error(INFO, "%s: slab: %lx duplicate freelist object: %lx\n", + si->curname, si->slab, q); + return FALSE; + } } - } + found_object: hq_close(); if (si->flags & ADDRESS_SPECIFIED) { @@ -18677,7 +18682,7 @@ compound_head(ulong page) long count_partial(ulong node, struct meminfo *si, ulong *free) { - ulong list_head, next, last, objects_vaddr; + ulong list_head, next, last; short inuse, objects; ulong total_inuse; ulong count = 0; @@ -18708,31 +18713,11 @@ count_partial(ulong node, struct meminfo total_inuse += inuse; if (VALID_MEMBER(page_objects)) { - objects_vaddr = last + OFFSET(page_objects); - if (si->flags & SLAB_BITFIELD) - objects_vaddr += sizeof(ushort); - if (!readmem(objects_vaddr, KVADDR, &objects, - sizeof(ushort), "page.objects", RETURN_ON_ERROR)) { - hq_close(); - return -1; - } - - if (si->flags & SLAB_BITFIELD) { - if (__BYTE_ORDER == __LITTLE_ENDIAN) { - objects <<= 1; - objects >>= 1; - } - if (__BYTE_ORDER == __BIG_ENDIAN) - objects >>= 1; - } - - if (objects == (short)(-1)) { - error(INFO, "%s: slab: %lx invalid page.objects: -1\n", - si->curname, last); + objects = slub_page_objects(si, last); + if (!objects) { hq_close(); return -1; } - *free += objects - inuse; } _

----- Original Message ----- > OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp&gt; writes: > > OK. More simpler proof, the following is enough to convince you?

But going back to the error report, the "slab: 0" is kind of confusing: crash> kmem -s kmalloc-32 CACHE NAME OBJSIZE ALLOCATED TOTAL SLABS SSIZE kmem: kmalloc-32: slab: 0 invalid freepointer: ffff001090e33f80 ffff880333001c00 kmalloc-32 32 122658 125440 980 4k crash>

I'm thinking we should clarify that error message, perhaps by storing the cpu number in si->cpu, and displaying it when si->slab is NULL?

Dave Anderson <anderson(a)redhat.com&gt; writes: > ----- Original Message ----- >> OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp&gt; writes: >> >> OK. More simpler proof, the following is enough to convince you? [...] > But going back to the error report, the "slab: 0" is kind of confusing: > > crash> kmem -s kmalloc-32 > CACHE NAME OBJSIZE ALLOCATED TOTAL SLABS > SSIZE > kmem: kmalloc-32: slab: 0 invalid freepointer: ffff001090e33f80 > ffff880333001c00 kmalloc-32 32 122658 125440 980 > 4k > crash> [...] > I'm thinking we should clarify that error message, perhaps by storing the cpu > number in si->cpu, and displaying it when si->slab is NULL? Just a idea for now though (means not tested error path at all), how about the following? We know already slab pointer at that point. So, this sets si->slab temporarily. (and slub_page_objects() just uses slab in argument, not si->slab).

Thanks. --- memory.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff -puN memory.c~crash-slub-freelist-error-fix memory.c --- crash-64/memory.c~crash-slub-freelist-error-fix 2016-04-21 05:04:11.660627253 +0900 +++ crash-64-hirofumi/memory.c 2016-04-21 05:20:01.673010107 +0900 @@ -17947,12 +17947,12 @@ static ushort slub_page_objects(struct m if (CRASHDEBUG(1) && (objects != si->objects)) error(NOTE, "%s: slab: %lx oo objects: %ld " "slab objects: %d\n", - si->curname, si->slab, + si->curname, page, si->objects, objects); if (objects == (ushort)(-1)) { error(INFO, "%s: slab: %lx invalid page.objects: -1\n", - si->curname, si->slab); + si->curname, page); return 0; } } else @@ -18039,14 +18039,22 @@ get_kmem_cache_slub_data(long cmd, struc switch (cmd) { - case GET_SLUB_OBJECTS: + case GET_SLUB_OBJECTS: { + /* For better error report, set cur slab to si->slab. */ + ulong orig_slab = si->slab; + si->slab = cpu_slab_ptr; + if (!readmem(cpu_slab_ptr + OFFSET(page_inuse), - KVADDR, &inuse, sizeof(short), - "page inuse", RETURN_ON_ERROR)) + KVADDR, &inuse, sizeof(short), + "page inuse", RETURN_ON_ERROR)) { + si->slab = orig_slab; return FALSE; + } objects = slub_page_objects(si, cpu_slab_ptr); - if (!objects) + if (!objects) { + si->slab = orig_slab; return FALSE; + } free_objects += objects - inuse; free_objects += count_free_objects(si, cpu_freelist); @@ -18055,6 +18063,9 @@ get_kmem_cache_slub_data(long cmd, struc if (!node_total_avail) total_objects += inuse; total_slabs++; + + si->slab = orig_slab; + } break; case GET_SLUB_SLABS: _ -- OGAWA Hirofumi <hirofumi(a)mail.parknet.co.jp&gt;