Hi,

IMHO, it seems there is a serious bug with rt_down_timeout. Every time
I call it, I got an exception because this function is apparently
empty !
I recompile the kernel (2.6.26.5-rt9) with a printk in the function
run_hrtimer_pending which print "NULL" because fn=NULL.

Here is the function I modified :

static void run_hrtimer_pending(struct hrtimer_cpu_base *cpu_base)
{
spin_lock_irq(&cpu_base->lock);

while (!list_empty(&cpu_base->cb_pending)) {
enum hrtimer_restart (*fn)(struct hrtimer *);
struct hrtimer *timer;
int restart;

timer = list_entry(cpu_base->cb_pending.next,
struct hrtimer, cb_entry);

debug_hrtimer_deactivate(timer);
timer_stats_account_hrtimer(timer);
if (timer)
fn = timer->function; // ***** *****
else printk("TIMER NULL\n"); // ***** *****
__remove_hrtimer(timer, timer->base, HRTIMER_STATE_CALLBACK, 0);
spin_unlock_irq(&cpu_base->lock);
// ***** *****
if (fn == NULL)
printk("fn = null\n");
else restart = fn(timer);
// *****
*****
spin_lock_irq(&cpu_base->lock);

timer->state &= ~HRTIMER_STATE_CALLBACK;
if (restart == HRTIMER_RESTART) {
BUG_ON(hrtimer_active(timer));
/*
* Enqueue the timer, allow reprogramming of the event
* device
*/
enqueue_hrtimer(timer, timer->base, 1);
} else if (hrtimer_active(timer)) {
/*
* If the timer was rearmed on another CPU, reprogram
* the event device.
*/
struct hrtimer_clock_base *base = timer->base;

if (base->first == &timer->node &&
hrtimer_reprogram(timer, base)) {
/*
* Timer is expired. Thus move it from tree to
* pending list again.
*/
__remove_hrtimer(timer, base,
HRTIMER_STATE_PENDING, 0);
list_add_tail(&timer->cb_entry,
&base->cpu_base->cb_pending);
}
}
}
spin_unlock_irq(&cpu_base->lock);

wake_up_timer_waiters(cpu_base);
}

-------------------------------------------------------------------------------------------------

Here is the dmesg :

fn = null
BUG: unable to handle kernel NULL pointer dereference at 00000000
IP: [<00000000>]
*pde = 00000000
Oops: 0000 [#1] PREEMPT
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in: cp16xx(P) e100 mii

Pid: 5, comm: sirq-timer/0 Tainted: P (2.6.26.5-rt9-ipipe #2)
EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0
EIP is at 0x0
EAX: dc11df0c EBX: 00000000 ECX: 00000001 EDX: 00000000
ESI: dc11df0c EDI: c0498e20 EBP: ddc29f58 ESP: ddc29f40
DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 preempt:00000001
Process sirq-timer/0 (pid: 5, ti=ddc29000 task=ddc44d80 task.ti=ddc29000)
Stack: c0133e3a 00000000 c0498ea4 00000202 c050af80 fffffffd ddc29f6c c0134a38
c050af80 ddc29f6c 00000202 ddc29fa0 c0126452 00000001 00000002 c050aab0
ddc29f88 c013da9b ddc29fa0 00000046 00000002 00000002 c050aab0 fffffffd
Call Trace:
[] ? run_hrtimer_pending+0x5a/0x110
[] ? hrtimer_run_pending+0x48/0xe0
[] ? run_timer_softirq+0x82/0x2c0
[] ? trace_hardirqs_on+0xb/0x10
[] ? ksoftirqd+0x10d/0x230
[] ? ksoftirqd+0x0/0x230
[] ? kthread+0x46/0x80
[] ? kthread+0x0/0x80
[] ? kernel_thread_helper+0x7/0x10
=======================
INFO: lockdep is turned off.
Code: Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:ddc29f40
---[ end trace ce167a848c96a955 ]---

Am I alone (in this case) ?
TIA

TB
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/