vmalloc bugs in 2.4.5???

vmalloc bugs in 2.4.5???

[machael]

hello:
    I use linux-2.4.5 and I think VMALLOC may have some bugs which i don't
know how to fixup.
    I try to replace some kernel functions with my own implementations.I
will explain it in the following:
    Let's say:
        void (*my_func)(void)=func1;
     where "my_func" is a function pointer defined in kernel, and "func1" is
 a function(void func1(void)) implemented in kernel.And "my_func" is an
 EXPORTED SYMBOL in mips_ksyms.c.

    Now I want to replace "func1" with my own "func2" in a module
 my_module.o:
     extern void (*my_func)(void);
     my_func = func2;
     where "func2" is a function (void fun2(void)) implemented in
 "my_module.o".

     If I do "insmod my_module.o", the kernel should run OK. In fact, it is
 often met an "unhandled kernel unaligned access" or "do_page_fault"
 exception and then panics.

     We know "func1" should be in KSEG0(unmapped , cached) ,So it's address
should be 0x8XXXXXXX.And "my_func" should also pointed to this same address
before inserting
 my_module.o.  "func2" should be in KSEG2(mapped, cached) since it is
 implemented in module, So it's address should be 0xCXXXXXXX.After inserting
 my_module.o, "my_func" should be changed to pointed to this new address in
 KSEG2. But kernel panics......
    If I change "module_map()" in include/asm/module.h from vmalloc to
kmalloc, kernel runs ok after inserting my module. So I think vmalloc may
have some bugs.

    Anyone knows how to fixup it?

    machael

vmalloc bugs in 2.4.5???

[machael]

hello:
    I use linux-2.4.5 and I think VMALLOC may have some bugs which i don't
know how to fixup.
    I try to replace some kernel functions with my own implementations.I
will explain it in the following:
    Let's say:
        void (*my_func)(void)=func1;
     where "my_func" is a function pointer defined in kernel, and "func1" is
 a function(void func1(void)) implemented in kernel.And "my_func" is an
 EXPORTED SYMBOL in mips_ksyms.c.

    Now I want to replace "func1" with my own "func2" in a module
 my_module.o:
     extern void (*my_func)(void);
     my_func = func2;
     where "func2" is a function (void fun2(void)) implemented in
 "my_module.o".

     If I do "insmod my_module.o", the kernel should run OK. In fact, it is
 often met an "unhandled kernel unaligned access" or "do_page_fault"
 exception and then panics.

     We know "func1" should be in KSEG0(unmapped , cached) ,So it's address
should be 0x8XXXXXXX.And "my_func" should also pointed to this same address
before inserting
 my_module.o.  "func2" should be in KSEG2(mapped, cached) since it is
 implemented in module, So it's address should be 0xCXXXXXXX.After inserting
 my_module.o, "my_func" should be changed to pointed to this new address in
 KSEG2. But kernel panics......
    If I change "module_map()" in include/asm/module.h from vmalloc to
kmalloc, kernel runs ok after inserting my module. So I think vmalloc may
have some bugs.

    Anyone knows how to fixup it?

    machael

Re: vmalloc bugs in 2.4.5???

[Ralf Baechle]

On Mon, Nov 05, 2001 at 03:34:44PM +0800, machael wrote:

>     I use linux-2.4.5 and I think VMALLOC may have some bugs which i don't
> know how to fixup.

Vmalloc is probably innocent I'd rather guess cache flushing is broken on
your platform.

  Ralf

Re: vmalloc bugs in 2.4.5???

[machael]

> >     I use linux-2.4.5 and I think VMALLOC may have some bugs which i
don't
> > know how to fixup.
>
> Vmalloc is probably innocent I'd rather guess cache flushing is broken on
> your platform.

Yes, It is possible. But I don't know how to fixup this broken cache
flushing?
And when and where should I flush cache (icache and dcache) manually?I am
really know little things about cache.

Can you help me?
Thank you very much.

machael

Re: vmalloc bugs in 2.4.5???

[machael]

> >     I use linux-2.4.5 and I think VMALLOC may have some bugs which i
don't
> > know how to fixup.
>
> Vmalloc is probably innocent I'd rather guess cache flushing is broken on
> your platform.

Yes, It is possible. But I don't know how to fixup this broken cache
flushing?
And when and where should I flush cache (icache and dcache) manually?I am
really know little things about cache.

Can you help me?
Thank you very much.

machael

Re: vmalloc bugs in 2.4.5???

[Atsushi Nemoto]

>>>>> On Tue, 6 Nov 2001 13:08:39 -0800, Ralf Baechle <ralf@oss.sgi.com> said:
ralf> Vmalloc is probably innocent I'd rather guess cache flushing is
ralf> broken on your platform.

In 2.4.5, flush_cache_all() (and flush_tlb_all()) is called in
vmalloc_area_pages().  I think this call protect us from virtual
aliasing problem.

By the way, does anybody have any problem with vmalloc on recent
kernel?

In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
disappered from vmalloc_area_pages().  I have a data corruption
problem in vmalloc()ed area without this call.  I think we still need
this call.

--- linux-sgi-cvs/mm/vmalloc.c	Tue Sep 18 05:16:31 2001
+++ linux.new/mm/vmalloc.c	Wed Nov  7 10:33:47 2001
@@ -144,6 +144,7 @@
 	int ret;
 
 	dir = pgd_offset_k(address);
+	flush_cache_all();
 	spin_lock(&init_mm.page_table_lock);
 	do {
 		pmd_t *pmd;
@@ -163,6 +164,7 @@
 		ret = 0;
 	} while (address && (address < end));
 	spin_unlock(&init_mm.page_table_lock);
+ 	flush_tlb_all();
 	return ret;
 }
 
---
Atsushi Nemoto

Re: vmalloc bugs in 2.4.5???

[machael]

> ralf> Vmalloc is probably innocent I'd rather guess cache flushing is
> ralf> broken on your platform.
> 
> In 2.4.5, flush_cache_all() (and flush_tlb_all()) is called in
> vmalloc_area_pages().  I think this call protect us from virtual
> aliasing problem.
> 
> By the way, does anybody have any problem with vmalloc on recent
> kernel?
> 
> In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
> disappered from vmalloc_area_pages().  I have a data corruption
> problem in vmalloc()ed area without this call.  I think we still need
> this call.
> 
> --- linux-sgi-cvs/mm/vmalloc.c Tue Sep 18 05:16:31 2001
> +++ linux.new/mm/vmalloc.c Wed Nov  7 10:33:47 2001
> @@ -144,6 +144,7 @@
>   int ret;
>  
>   dir = pgd_offset_k(address);
> + flush_cache_all();
>   spin_lock(&init_mm.page_table_lock);
>   do {
>   pmd_t *pmd;
> @@ -163,6 +164,7 @@
>   ret = 0;
>   } while (address && (address < end));
>   spin_unlock(&init_mm.page_table_lock);
> + flush_tlb_all();
>   return ret;
>  }

In 2.4.5, vmalloc has these two lines in vmalloc_area_pages().
So what else may be the problem?
Thanks!

machael

Re: vmalloc bugs in 2.4.5???

[machael]

> ralf> Vmalloc is probably innocent I'd rather guess cache flushing is
> ralf> broken on your platform.
> 
> In 2.4.5, flush_cache_all() (and flush_tlb_all()) is called in
> vmalloc_area_pages().  I think this call protect us from virtual
> aliasing problem.
> 
> By the way, does anybody have any problem with vmalloc on recent
> kernel?
> 
> In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
> disappered from vmalloc_area_pages().  I have a data corruption
> problem in vmalloc()ed area without this call.  I think we still need
> this call.
> 
> --- linux-sgi-cvs/mm/vmalloc.c Tue Sep 18 05:16:31 2001
> +++ linux.new/mm/vmalloc.c Wed Nov  7 10:33:47 2001
> @@ -144,6 +144,7 @@
>   int ret;
>  
>   dir = pgd_offset_k(address);
> + flush_cache_all();
>   spin_lock(&init_mm.page_table_lock);
>   do {
>   pmd_t *pmd;
> @@ -163,6 +164,7 @@
>   ret = 0;
>   } while (address && (address < end));
>   spin_unlock(&init_mm.page_table_lock);
> + flush_tlb_all();
>   return ret;
>  }

In 2.4.5, vmalloc has these two lines in vmalloc_area_pages().
So what else may be the problem?
Thanks!

machael

Re: vmalloc bugs in 2.4.5???

[Ralf Baechle]

On Wed, Nov 07, 2001 at 10:39:47AM +0900, Atsushi Nemoto wrote:

> In 2.4.5, flush_cache_all() (and flush_tlb_all()) is called in
> vmalloc_area_pages().  I think this call protect us from virtual
> aliasing problem.
> 
> By the way, does anybody have any problem with vmalloc on recent
> kernel?
> 
> In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
> disappered from vmalloc_area_pages().  I have a data corruption
> problem in vmalloc()ed area without this call.  I think we still need
> this call.

Entirely correct.  I'm just trying to find why this call got removed
in 2.4.10.  Clearly wrong;  I had not noticed that these two lines
got removed and thus was assuming the code of those two must somehow
be malfunctioning.

  Ralf

Re: vmalloc bugs in 2.4.5???

[machael]

> On Wed, Nov 07, 2001 at 10:39:47AM +0900, Atsushi Nemoto wrote:
>
> > In 2.4.5, flush_cache_all() (and flush_tlb_all()) is called in
> > vmalloc_area_pages().  I think this call protect us from virtual
> > aliasing problem.
> >
> > By the way, does anybody have any problem with vmalloc on recent
> > kernel?
> >
> > In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
> > disappered from vmalloc_area_pages().  I have a data corruption
> > problem in vmalloc()ed area without this call.  I think we still need
> > this call.
>
> Entirely correct.  I'm just trying to find why this call got removed
> in 2.4.10.  Clearly wrong;  I had not noticed that these two lines
> got removed and thus was assuming the code of those two must somehow
> be malfunctioning.

I have added these two lines to vmalloc_area_pages in 2.4.10,but the
problems  still appear.
Why?

machael

Re: vmalloc bugs in 2.4.5???

[machael]

> On Wed, Nov 07, 2001 at 10:39:47AM +0900, Atsushi Nemoto wrote:
>
> > In 2.4.5, flush_cache_all() (and flush_tlb_all()) is called in
> > vmalloc_area_pages().  I think this call protect us from virtual
> > aliasing problem.
> >
> > By the way, does anybody have any problem with vmalloc on recent
> > kernel?
> >
> > In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
> > disappered from vmalloc_area_pages().  I have a data corruption
> > problem in vmalloc()ed area without this call.  I think we still need
> > this call.
>
> Entirely correct.  I'm just trying to find why this call got removed
> in 2.4.10.  Clearly wrong;  I had not noticed that these two lines
> got removed and thus was assuming the code of those two must somehow
> be malfunctioning.

I have added these two lines to vmalloc_area_pages in 2.4.10,but the
problems  still appear.
Why?

machael

Re: vmalloc bugs in 2.4.5???

[Maciej W. Rozycki]

On Wed, 7 Nov 2001, Ralf Baechle wrote:

> > In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
> > disappered from vmalloc_area_pages().  I have a data corruption
> > problem in vmalloc()ed area without this call.  I think we still need
> > this call.
> 
> Entirely correct.  I'm just trying to find why this call got removed
> in 2.4.10.  Clearly wrong;  I had not noticed that these two lines
> got removed and thus was assuming the code of those two must somehow
> be malfunctioning.

 See a mail titled "flush_tlb_all in vmalloc_area_pages" dated Sep 7th,
2001 sent to the linux-kernel list for the patch in question.  There was a
discussion on cache flushing wrt to a TLB on the list under "[PATCH]
change name of rep_nop" subject later as well.

-- 
+  Maciej W. Rozycki, Technical University of Gdansk, Poland   +
+--------------------------------------------------------------+
+        e-mail: macro@ds2.pg.gda.pl, PGP key available        +

Re: vmalloc bugs in 2.4.5???

[Ralf Baechle]

On Wed, Nov 07, 2001 at 10:39:47AM +0900, Atsushi Nemoto wrote:

Time to revisit a pile of old problems in my mailfolder ...

> >>>>> On Tue, 6 Nov 2001 13:08:39 -0800, Ralf Baechle <ralf@oss.sgi.com> said:
> ralf> Vmalloc is probably innocent I'd rather guess cache flushing is
> ralf> broken on your platform.
> 
> In 2.4.5, flush_cache_all() (and flush_tlb_all()) is called in
> vmalloc_area_pages().  I think this call protect us from virtual
> aliasing problem.
> 
> By the way, does anybody have any problem with vmalloc on recent
> kernel?
> 
> In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
> disappered from vmalloc_area_pages().  I have a data corruption
> problem in vmalloc()ed area without this call.  I think we still need
> this call.
> 
> --- linux-sgi-cvs/mm/vmalloc.c	Tue Sep 18 05:16:31 2001
> +++ linux.new/mm/vmalloc.c	Wed Nov  7 10:33:47 2001
> @@ -144,6 +144,7 @@
>  	int ret;
>  
>  	dir = pgd_offset_k(address);
> +	flush_cache_all();
>  	spin_lock(&init_mm.page_table_lock);
>  	do {
>  		pmd_t *pmd;
> @@ -163,6 +164,7 @@
>  		ret = 0;
>  	} while (address && (address < end));
>  	spin_unlock(&init_mm.page_table_lock);
> + 	flush_tlb_all();
>  	return ret;
>  }

Have you ever resolved this problem?  I've just doublechecked the
vmalloc code and it seems as if it should be entirely safe without these
two calls.  The tlb is flushed on vfree so no stale entries for a
vmalloc address can ever be in the tlb at vmalloc time, so this
flush_tlb_all() is just an expensive nop.  And the same it true for
flush_cache_all() no matter if caches are physically or virtually
indexed.

  Ralf

Re: vmalloc bugs in 2.4.5???

[Atsushi Nemoto]

>>>>> On Wed, 26 Dec 2001 01:32:21 -0200, Ralf Baechle <ralf@oss.sgi.com> said:
>> In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
>> disappered from vmalloc_area_pages().  I have a data corruption
>> problem in vmalloc()ed area without this call.  I think we still
>> need this call.

ralf> Have you ever resolved this problem?  I've just doublechecked
ralf> the vmalloc code and it seems as if it should be entirely safe
ralf> without these two calls.  The tlb is flushed on vfree so no
ralf> stale entries for a vmalloc address can ever be in the tlb at
ralf> vmalloc time, so this flush_tlb_all() is just an expensive nop.
ralf> And the same it true for flush_cache_all() no matter if caches
ralf> are physically or virtually indexed.

I am still using the patch and have not tried without the two calls
recently...

When I found this problem, I suppose that vmalloc called after
free_pages causes the data corruption.  vmalloc can re-use pages freed
by free_pages and it seems free_pages does not flush cache.  If
vmalloc is to use a page which is associated with dirty cache and has
different "color", virtual aliasing happens and data may be corrupt.
Is this wrong?

---
Atsushi Nemoto

Re: vmalloc bugs in 2.4.5???

[Ralf Baechle]

On Thu, Dec 27, 2001 at 10:55:18AM +0900, Atsushi Nemoto wrote:

> >> In somewhere between 2.4.6 and 2.4.9, the call to flush_cache_all()
> >> disappered from vmalloc_area_pages().  I have a data corruption
> >> problem in vmalloc()ed area without this call.  I think we still
> >> need this call.
> 
> ralf> Have you ever resolved this problem?  I've just doublechecked
> ralf> the vmalloc code and it seems as if it should be entirely safe
> ralf> without these two calls.  The tlb is flushed on vfree so no
> ralf> stale entries for a vmalloc address can ever be in the tlb at
> ralf> vmalloc time, so this flush_tlb_all() is just an expensive nop.
> ralf> And the same it true for flush_cache_all() no matter if caches
> ralf> are physically or virtually indexed.
> 
> I am still using the patch and have not tried without the two calls
> recently...
> 
> When I found this problem, I suppose that vmalloc called after
> free_pages causes the data corruption.  vmalloc can re-use pages freed
> by free_pages and it seems free_pages does not flush cache.  If
> vmalloc is to use a page which is associated with dirty cache and has
> different "color", virtual aliasing happens and data may be corrupt.
> Is this wrong?

Yes, you're right as for the cache.  But there is no reason for the
TLB flush, right?

  Ralf

Re: vmalloc bugs in 2.4.5???

[Atsushi Nemoto]

>>>>> On Thu, 27 Dec 2001 01:12:22 -0200, Ralf Baechle <ralf@oss.sgi.com> said:
ralf> Yes, you're right as for the cache.  But there is no reason for
ralf> the TLB flush, right?

Yes, I agree.

---
Atsushi Nemoto

Re: vmalloc bugs in 2.4.5???

[Ralf Baechle]

On Thu, Dec 27, 2001 at 12:51:22PM +0900, Atsushi Nemoto wrote:

> >>>>> On Thu, 27 Dec 2001 01:12:22 -0200, Ralf Baechle <ralf@oss.sgi.com> said:
> ralf> Yes, you're right as for the cache.  But there is no reason for
> ralf> the TLB flush, right?
> 
> Yes, I agree.

Ok, I'll make a patch for Marcelo.  Being in Brazil right now is useful,
I can beat him into accepting it ;-)

  Ralf

Re: vmalloc bugs in 2.4.5???

[Tommy S. Christensen]

Ralf Baechle wrote:
> 
> On Thu, Dec 27, 2001 at 12:51:22PM +0900, Atsushi Nemoto wrote:
> 
> > >>>>> On Thu, 27 Dec 2001 01:12:22 -0200, Ralf Baechle <ralf@oss.sgi.com> said:
> > ralf> Yes, you're right as for the cache.  But there is no reason for
> > ralf> the TLB flush, right?
> >
> > Yes, I agree.
> 
> Ok, I'll make a patch for Marcelo.  Being in Brazil right now is useful,
> I can beat him into accepting it ;-)
> 
>   Ralf

Great! But please make sure that the cache is flushed after the pages
are allocated instead of before.

With 2.4.9 that still had the cache-flushing in vmalloc_area_pages(), I
got cache aliasing problems in low memory situations (since alloc_page()
will re-schedule when no pages are available).

-Tommy

Re: vmalloc bugs in 2.4.5???

[Ralf Baechle]

On Thu, Dec 27, 2001 at 05:01:23PM +0100, Tommy S. Christensen wrote:

> Great! But please make sure that the cache is flushed after the pages
> are allocated instead of before.
> 
> With 2.4.9 that still had the cache-flushing in vmalloc_area_pages(), I
> got cache aliasing problems in low memory situations (since alloc_page()
> will re-schedule when no pages are available).

Correct; I fixed that one.  That's actually a nasty one, affects all
previous Linux releases.  I wonder how this one went unnoticed for so long.
Probably because loading modules is a relativly rare event or so.

  Ralf

Re: vmalloc bugs in 2.4.5???

[machael thailer]

----- Original Message ----- 
From: Ralf Baechle <ralf@oss.sgi.com>
To: Tommy S. Christensen <tommy.christensen@eicon.com>
Cc: Atsushi Nemoto <nemoto@toshiba-tops.co.jp>; <dony.he@huawei.com>; <linux-mips@oss.sgi.com>
Sent: Friday, December 28, 2001 5:19 AM
Subject: Re: vmalloc bugs in 2.4.5???


> On Thu, Dec 27, 2001 at 05:01:23PM +0100, Tommy S. Christensen wrote:
> 
> > Great! But please make sure that the cache is flushed after the pages
> > are allocated instead of before.
> > 
> > With 2.4.9 that still had the cache-flushing in vmalloc_area_pages(), I
> > got cache aliasing problems in low memory situations (since alloc_page()
> > will re-schedule when no pages are available).
> 
> Correct; I fixed that one.  That's actually a nasty one, affects all
> previous Linux releases.  I wonder how this one went unnoticed for so long.
> Probably because loading modules is a relativly rare event or so.

How do you fix it? Can you mail your fixup code to me please?

machael

Re: vmalloc bugs in 2.4.5???

[machael thailer]

----- Original Message ----- 
From: Ralf Baechle <ralf@oss.sgi.com>
To: Tommy S. Christensen <tommy.christensen@eicon.com>
Cc: Atsushi Nemoto <nemoto@toshiba-tops.co.jp>; <dony.he@huawei.com>; <linux-mips@oss.sgi.com>
Sent: Friday, December 28, 2001 5:19 AM
Subject: Re: vmalloc bugs in 2.4.5???


> On Thu, Dec 27, 2001 at 05:01:23PM +0100, Tommy S. Christensen wrote:
> 
> > Great! But please make sure that the cache is flushed after the pages
> > are allocated instead of before.
> > 
> > With 2.4.9 that still had the cache-flushing in vmalloc_area_pages(), I
> > got cache aliasing problems in low memory situations (since alloc_page()
> > will re-schedule when no pages are available).
> 
> Correct; I fixed that one.  That's actually a nasty one, affects all
> previous Linux releases.  I wonder how this one went unnoticed for so long.
> Probably because loading modules is a relativly rare event or so.

How do you fix it? Can you mail your fixup code to me please?

machael