From: Will Deacon <hidden> Date: 2012-07-16 16:23:46
The vivt_flush_cache_{range,page} functions check that the mm_struct
of the VMA being flushed has been active on the current CPU before
performing the cache maintenance.
The gate_vma has a NULL mm_struct pointer and, as such, will cause a
kernel fault if we try to flush it with the above operations. This
happens during ELF core dumps, which include the gate_vma as it may be
useful for debugging purposes.
This patch adds checks to the VIVT cache flushing functions so that VMAs
with a NULL mm_struct are ignored.
Cc: Uros Bizjak <redacted>
Reported-by: Gilles Chanteperdrix <redacted>
Signed-off-by: Will Deacon <redacted>
---
arch/arm/include/asm/cacheflush.h | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
From: Will Deacon <hidden> Date: 2012-07-19 12:28:14
Gilles, Uros,
On Mon, Jul 16, 2012 at 05:23:46PM +0100, Will Deacon wrote:
The vivt_flush_cache_{range,page} functions check that the mm_struct
of the VMA being flushed has been active on the current CPU before
performing the cache maintenance.
The gate_vma has a NULL mm_struct pointer and, as such, will cause a
kernel fault if we try to flush it with the above operations. This
happens during ELF core dumps, which include the gate_vma as it may be
useful for debugging purposes.
This patch adds checks to the VIVT cache flushing functions so that VMAs
with a NULL mm_struct are ignored.
Would one of you be able to test this patch please? I've not managed to
trigger the bug you reported on my boards, so it would be useful to know
whether or not this patch solves the problem for you.
Thanks,
Will
On Thu, Jul 19, 2012 at 2:28 PM, Will Deacon [off-list ref] wrote:
On Mon, Jul 16, 2012 at 05:23:46PM +0100, Will Deacon wrote:
quoted
The vivt_flush_cache_{range,page} functions check that the mm_struct
of the VMA being flushed has been active on the current CPU before
performing the cache maintenance.
The gate_vma has a NULL mm_struct pointer and, as such, will cause a
kernel fault if we try to flush it with the above operations. This
happens during ELF core dumps, which include the gate_vma as it may be
useful for debugging purposes.
This patch adds checks to the VIVT cache flushing functions so that VMAs
with a NULL mm_struct are ignored.
Would one of you be able to test this patch please? I've not managed to
trigger the bug you reported on my boards, so it would be useful to know
whether or not this patch solves the problem for you.
Patched kernel works as expected. Also, backport to 3.4 (where
original problem was triggered) works OK, so I'd suggest to backport
this patch to 3.4.
Tested-by: Uros Bizjak <redacted>
Thanks,
Uros.
From: Will Deacon <hidden> Date: 2012-07-19 16:37:12
On Thu, Jul 19, 2012 at 02:03:50PM +0100, Uros Bizjak wrote:
On Thu, Jul 19, 2012 at 2:28 PM, Will Deacon [off-list ref] wrote:
quoted
On Mon, Jul 16, 2012 at 05:23:46PM +0100, Will Deacon wrote:
quoted
The vivt_flush_cache_{range,page} functions check that the mm_struct
of the VMA being flushed has been active on the current CPU before
performing the cache maintenance.
The gate_vma has a NULL mm_struct pointer and, as such, will cause a
kernel fault if we try to flush it with the above operations. This
happens during ELF core dumps, which include the gate_vma as it may be
useful for debugging purposes.
This patch adds checks to the VIVT cache flushing functions so that VMAs
with a NULL mm_struct are ignored.
Would one of you be able to test this patch please? I've not managed to
trigger the bug you reported on my boards, so it would be useful to know
whether or not this patch solves the problem for you.
Patched kernel works as expected. Also, backport to 3.4 (where
original problem was triggered) works OK, so I'd suggest to backport
this patch to 3.4.
Tested-by: Uros Bizjak <redacted>
Thanks Uros, I'll add that and CC stable on the patch too.
Will
Gilles, Uros,
On Mon, Jul 16, 2012 at 05:23:46PM +0100, Will Deacon wrote:
quoted
The vivt_flush_cache_{range,page} functions check that the mm_struct
of the VMA being flushed has been active on the current CPU before
performing the cache maintenance.
The gate_vma has a NULL mm_struct pointer and, as such, will cause a
kernel fault if we try to flush it with the above operations. This
happens during ELF core dumps, which include the gate_vma as it may be
useful for debugging purposes.
This patch adds checks to the VIVT cache flushing functions so that VMAs
with a NULL mm_struct are ignored.
Would one of you be able to test this patch please?
Sorry for the delay, I am getting this mail just now.
I've not managed to
trigger the bug you reported on my boards,
I found this bug with the LTP testsuite, more precisely the test named
"abort01".
so it would be useful to know
whether or not this patch solves the problem for you.
Fixes linux 3.4 bug for me. But... are you sure this is the right fix? I
mean you are adding an almost always useless test to many cache flushes,
except in one corner case. Would not it make more sense to make the fix
local, and fix gate_vma to have a static mm struct with a valid cpumask?
Being 0 or 1 whether we want to flush the vector page (I believe we do
not want to flush it, but am not sure).
--
Gilles.
On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
Being 0 or 1 whether we want to flush the vector page (I believe we do
not want to flush it, but am not sure).
Actually, I believe we want to flush the vector page, at least on
systems with VIVT cache: on systems with VIVT cache, the vector page is
writeable in kernel mode, so may have been modified, and the address
used by elf_core_dump is not the vectors address, but the address in the
kernel direct-mapped RAM region where the vector page was allocated, so
there is a cache aliasing issue.
--
Gilles.
From: Will Deacon <hidden> Date: 2012-07-21 14:35:17
Hi Gilles,
On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
quoted
Being 0 or 1 whether we want to flush the vector page (I believe we do
not want to flush it, but am not sure).
Actually, I believe we want to flush the vector page, at least on
systems with VIVT cache: on systems with VIVT cache, the vector page is
writeable in kernel mode, so may have been modified, and the address
used by elf_core_dump is not the vectors address, but the address in the
kernel direct-mapped RAM region where the vector page was allocated, so
there is a cache aliasing issue.
It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).
As for the NULL check, it's likely to be a single additional cycle
before a cacheflush. I really consider it to be insignificant.
Will
Hi Gilles,
On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
quoted
On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
quoted
Being 0 or 1 whether we want to flush the vector page (I believe we do
not want to flush it, but am not sure).
Actually, I believe we want to flush the vector page, at least on
systems with VIVT cache: on systems with VIVT cache, the vector page is
writeable in kernel mode, so may have been modified, and the address
used by elf_core_dump is not the vectors address, but the address in the
kernel direct-mapped RAM region where the vector page was allocated, so
there is a cache aliasing issue.
It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).
Except if CONFIG_TLS_REG_EMUL is enabled, or if some faulty code wrote
by accident to the vector page, which caused the application to crash.
What is the reason to include the vector page in the core dump if not to
help debugging?
--
Gilles.
On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
On 07/21/2012 04:35 PM, Will Deacon wrote:
quoted
Hi Gilles,
On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
quoted
On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
quoted
Being 0 or 1 whether we want to flush the vector page (I believe we do
not want to flush it, but am not sure).
Actually, I believe we want to flush the vector page, at least on
systems with VIVT cache: on systems with VIVT cache, the vector page is
writeable in kernel mode, so may have been modified, and the address
used by elf_core_dump is not the vectors address, but the address in the
kernel direct-mapped RAM region where the vector page was allocated, so
there is a cache aliasing issue.
It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).
From: Will Deacon <hidden> Date: 2012-07-22 13:03:55
On Sat, Jul 21, 2012 at 03:47:37PM +0100, Gilles Chanteperdrix wrote:
On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
quoted
On 07/21/2012 04:35 PM, Will Deacon wrote:
quoted
Hi Gilles,
On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
quoted
On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
quoted
Being 0 or 1 whether we want to flush the vector page (I believe we do
not want to flush it, but am not sure).
Actually, I believe we want to flush the vector page, at least on
systems with VIVT cache: on systems with VIVT cache, the vector page is
writeable in kernel mode, so may have been modified, and the address
used by elf_core_dump is not the vectors address, but the address in the
kernel direct-mapped RAM region where the vector page was allocated, so
there is a cache aliasing issue.
It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).
Except if CONFIG_TLS_REG_EMUL is enabled
is disabled I mean.
Well spotted! I disagree about the address being flushed though -- it looks
to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
do you think we're flushing from the linear mapping?
Anyway, the TLS issue can easily be resolved by changing my previous patch so
that we flush unconditionally when there's no mm (see below).
In the meantime, I'll remove the old patch from the patch system while we
address your remaining concerns.
Cheers,
Will
---8<---
On Sat, Jul 21, 2012 at 03:47:37PM +0100, Gilles Chanteperdrix wrote:
quoted
On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
quoted
On 07/21/2012 04:35 PM, Will Deacon wrote:
quoted
Hi Gilles,
On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
quoted
On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
quoted
Being 0 or 1 whether we want to flush the vector page (I believe we do
not want to flush it, but am not sure).
Actually, I believe we want to flush the vector page, at least on
systems with VIVT cache: on systems with VIVT cache, the vector page is
writeable in kernel mode, so may have been modified, and the address
used by elf_core_dump is not the vectors address, but the address in the
kernel direct-mapped RAM region where the vector page was allocated, so
there is a cache aliasing issue.
It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).
Except if CONFIG_TLS_REG_EMUL is enabled
is disabled I mean.
Well spotted! I disagree about the address being flushed though -- it looks
to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
do you think we're flushing from the linear mapping?
I do not think we're flushing from the linear mapping, I believe the
address used by the elf_core_dump function (elf_core_dump -> kmap ->
page_address), to copy the page data to the core is the linear mapping
address, which is the reason why we need the flush at all.
--
Gilles.
From: Will Deacon <hidden> Date: 2012-07-22 15:09:54
On Sun, Jul 22, 2012 at 02:26:03PM +0100, Gilles Chanteperdrix wrote:
On 07/22/2012 03:03 PM, Will Deacon wrote:
quoted
On Sat, Jul 21, 2012 at 03:47:37PM +0100, Gilles Chanteperdrix wrote:
quoted
On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
quoted
On 07/21/2012 04:35 PM, Will Deacon wrote:
quoted
It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).
Except if CONFIG_TLS_REG_EMUL is enabled
is disabled I mean.
Well spotted! I disagree about the address being flushed though -- it looks
to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
do you think we're flushing from the linear mapping?
I do not think we're flushing from the linear mapping, I believe the
address used by the elf_core_dump function (elf_core_dump -> kmap ->
page_address), to copy the page data to the core is the linear mapping
address, which is the reason why we need the flush at all.
Ok, good, sounds like we're singing the same tune at last. If you're happy
with my proposed change to the original patch and Uros could re-test, then I
think we're in business again.
Cheers,
Will
On Sun, Jul 22, 2012 at 02:26:03PM +0100, Gilles Chanteperdrix wrote:
quoted
On 07/22/2012 03:03 PM, Will Deacon wrote:
quoted
On Sat, Jul 21, 2012 at 03:47:37PM +0100, Gilles Chanteperdrix wrote:
quoted
On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
quoted
On 07/21/2012 04:35 PM, Will Deacon wrote:
quoted
It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).
Except if CONFIG_TLS_REG_EMUL is enabled
is disabled I mean.
Well spotted! I disagree about the address being flushed though -- it looks
to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
do you think we're flushing from the linear mapping?
I do not think we're flushing from the linear mapping, I believe the
address used by the elf_core_dump function (elf_core_dump -> kmap ->
page_address), to copy the page data to the core is the linear mapping
address, which is the reason why we need the flush at all.
Ok, good, sounds like we're singing the same tune at last. If you're happy
with my proposed change to the original patch and Uros could re-test, then I
think we're in business again.
On Sun, Jul 22, 2012 at 5:09 PM, Will Deacon [off-list ref] wrote:
quoted
quoted
quoted
quoted
quoted
It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).
Except if CONFIG_TLS_REG_EMUL is enabled
is disabled I mean.
Well spotted! I disagree about the address being flushed though -- it looks
to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
do you think we're flushing from the linear mapping?
I do not think we're flushing from the linear mapping, I believe the
address used by the elf_core_dump function (elf_core_dump -> kmap ->
page_address), to copy the page data to the core is the linear mapping
address, which is the reason why we need the flush at all.
Ok, good, sounds like we're singing the same tune at last. If you're happy
with my proposed change to the original patch and Uros could re-test, then I
think we're in business again.
The updated patch is effectively the same as the patch at [1], which
works for our target as well. This patch was also tested on 3.4
branch, where it fixes the same problem.
For the patch, I can add:
Tested-by: Uros Bizjak <redacted>
[1] http://lists.infradead.org/pipermail/linux-arm-kernel/2012-June/105047.html
Thanks,
Uros.