AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Roderik_Wildenburg]

Dear Gilles,

I admit, the mechanism for allocating all memory of the target is not very sophisticated. The idea was, that MAXHEAPBLOCKS*MEMORYCHUNKSIZE is much much more, than memory available (at least with my target (128MB) this is true). I should have mentioned this in the source code, sorry. If your target has more then (MAXHEAPBLOCKS*MEMORYCHUNKSIZE=320MB(approcimate)) memory, you should increase MAXHEAPBLOCKS.

If this condition is fulfiled, I think, there should be no illegal memory access. Do you agree ?

Roderik
 

> -----Ursprüngliche Nachricht-----
> Von: Gilles Chanteperdrix [mailto:gilles.chanteperdrix@xenomai.org
> Gesendet: Dienstag, 5. September 2006 17:18
> An: Wildenburg, Roderik RAEK3 MRA
> Cc: xenomai@xenomai.org
> Betreff: Re: [Xenomai-help] resubmission : memset of heap 
> crashes Xenomai-Task
> 
> Roderik_Wildenburg@domain.hid wrote:
>  > Some times ago (2006.07.06) I had the problem described below. 
>  > As far as I can see, there is no solution for this till now. 
>  > I think, it is worth a second go, as I believe, a 
> industrial strength application can´t accept this behavior.
>  > Therefore I would like to ask the Xenomai-PPC gurus (as 
> far as I can see, it could only be reproduced on PPC (not 
> Qemu)) again, to judge, whether this is a serios problem or 
> just something I have to live with.
>  >
>  > Thank you in advance
>  > Roderik
>  >
>  >
>  > Xenomai Version : 2.2-rc2
>  > Skin : native
>  > Kernel : 2.4.25
>  > Arch.: PPC
>  >
>  > I try to allocate as much memory as possible with the functions :
>  > rt_heap_create and
>  > rt_heap_alloc.
>  > (see source attached)
>  >
>  > When I try to use the allocated memory with memset, the 
> Xenomai-task crashes with a "Segmentation fault".
> 
> You are doing:
> 
> RT_HEAP bigheap[MAXHEAPBLOCKS];
>    
> 
>    for(i=0;i<MAXHEAPBLOCKS;i++)
>    {
>        /* some treatment */
>    }
> 
>    /* access bigheap[i] */
> 
> After the for loop, i is MAXHEAPBLOCKS, so, you are accessing 
> the bigheap array beyond its end, probably overriding the 
> bigbuf array.
> 
> -- 
> 
> 
> 					    Gilles Chanteperdrix.
> 

Re: AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Gilles Chanteperdrix]

[-- Attachment #1: message body and .signature --]
[-- Type: text/plain, Size: 826 bytes --]

Roderik_Wildenburg@domain.hid wrote:
 > Dear Gilles,
 > 
 > I admit, the mechanism for allocating all memory of the target is not very sophisticated. The idea was, that MAXHEAPBLOCKS*MEMORYCHUNKSIZE is much much more, than memory available (at least with my target (128MB) this is true). I should have mentioned this in the source code, sorry. If your target has more then (MAXHEAPBLOCKS*MEMORYCHUNKSIZE=320MB(approcimate)) memory, you should increase MAXHEAPBLOCKS.
 > 
 > If this condition is fulfiled, I think, there should be no illegal memory access. Do you agree ?

I disagree. Please apply the attached patch to heap.c. If I am right, it
should make the program abort with the message:
"Stopping here, in order to avoid later SEGV."

If you are right, the program should segfault.

-- 


					    Gilles Chanteperdrix.

[-- Attachment #2: roderik-heap.diff --]
[-- Type: text/plain, Size: 431 bytes --]

--- heap.c~	2006-09-06 14:27:31.000000000 +0200
+++ heap.c	2006-09-06 14:25:45.000000000 +0200
@@ -101,7 +101,11 @@ void display(void *cookie)
    {
       memsize+=addsize;
       if(!(ret=rt_heap_create(&bigheap[i],nbuf,memsize,H_PRIO|H_MAPPABLE)))
+      {
+	 printf("Stopping here, in order to avoid later SEGV.\n");
+	 exit(EXIT_FAILURE);
          rt_heap_delete(&bigheap[i]);
+      }
    }while(ret==0);
 
    memsize>>=1;

Re: AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Gilles Chanteperdrix]

[-- Attachment #1: message body and .signature --]
[-- Type: text/plain, Size: 630 bytes --]

Roderik_Wildenburg@domain.hid wrote:
 > Dear Gilles,
 > 
 > I admit, the mechanism for allocating all memory of the target is not very sophisticated. The idea was, that MAXHEAPBLOCKS*MEMORYCHUNKSIZE is much much more, than memory available (at least with my target (128MB) this is true). I should have mentioned this in the source code, sorry. If your target has more then (MAXHEAPBLOCKS*MEMORYCHUNKSIZE=320MB(approcimate)) memory, you should increase MAXHEAPBLOCKS.
 > 
 > If this condition is fulfiled, I think, there should be no illegal memory access. Do you agree ?
 > 

A better patch.

-- 


					    Gilles Chanteperdrix.

[-- Attachment #2: roderik-heap.diff --]
[-- Type: text/plain, Size: 498 bytes --]

--- heap.c~	2006-09-06 14:27:31.000000000 +0200
+++ heap.c	2006-09-06 14:37:07.000000000 +0200
@@ -101,7 +101,15 @@ void display(void *cookie)
    {
       memsize+=addsize;
       if(!(ret=rt_heap_create(&bigheap[i],nbuf,memsize,H_PRIO|H_MAPPABLE)))
+      {
+	 if (i > MAXHEAPBLOCKS - 1)
+	 {
+	    printf("i= %d is out of bounds, stopping here, avoid later SEGV.\n",
+		   i);
+	    exit(EXIT_FAILURE);
+	 }
          rt_heap_delete(&bigheap[i]);
+      }
    }while(ret==0);
 
    memsize>>=1;

Re: AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Wolfgang Grandegger]

Hi Gilles,

Gilles Chanteperdrix wrote:
> Roderik_Wildenburg@domain.hid wrote:
>  > Dear Gilles,
>  > 
>  > I admit, the mechanism for allocating all memory of the target is not very sophisticated. The idea was, that MAXHEAPBLOCKS*MEMORYCHUNKSIZE is much much more, than memory available (at least with my target (128MB) this is true). I should have mentioned this in the source code, sorry. If your target has more then (MAXHEAPBLOCKS*MEMORYCHUNKSIZE=320MB(approcimate)) memory, you should increase MAXHEAPBLOCKS.
>  > 
>  > If this condition is fulfiled, I think, there should be no illegal memory access. Do you agree ?
>  > 
> 
> A better patch.
> 
> 
> 
> ------------------------------------------------------------------------
> 
> --- heap.c~	2006-09-06 14:27:31.000000000 +0200
> +++ heap.c	2006-09-06 14:37:07.000000000 +0200
> @@ -101,7 +101,15 @@ void display(void *cookie)
>     {
>        memsize+=addsize;
>        if(!(ret=rt_heap_create(&bigheap[i],nbuf,memsize,H_PRIO|H_MAPPABLE)))
> +      {
> +	 if (i > MAXHEAPBLOCKS - 1)
> +	 {
> +	    printf("i= %d is out of bounds, stopping here, avoid later SEGV.\n",
> +		   i);
> +	    exit(EXIT_FAILURE);
> +	 }
>           rt_heap_delete(&bigheap[i]);
> +      }
>     }while(ret==0);
>  
>     memsize>>=1;
> 
> 
> ------------------------------------------------------------------------

I was able to reproduce the problem on my MPC5200 system some time ago
and I have checked the index "i" as well. "i" was not out-of-range, 
IIRC. The problem only shows up on PowerPC., at least Jan was unable
to reproduce it on a x86 system. How could we debug the seg fault. Do
you have a good idea? Would the IPIPE tracer help?

Wolfgang.

Re: AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Gilles Chanteperdrix]

Wolfgang Grandegger wrote:
 > 
 > I was able to reproduce the problem on my MPC5200 system some time ago
 > and I have checked the index "i" as well. "i" was not out-of-range, 
 > IIRC. The problem only shows up on PowerPC., at least Jan was unable
 > to reproduce it on a x86 system. How could we debug the seg fault. Do
 > you have a good idea? Would the IPIPE tracer help?

I do not see how i could not be out of range. After a 
for(i=0;i<MAXHEAPBLOCKS;i++)
loop, i is guaranteed to be MAXHEAPBLOCKS, which is one step beyond the
array index limit.

-- 


					    Gilles Chanteperdrix.

Re: AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Gilles Chanteperdrix]

Gilles Chanteperdrix wrote:
 > Wolfgang Grandegger wrote:
 >  > 
 >  > I was able to reproduce the problem on my MPC5200 system some time ago
 >  > and I have checked the index "i" as well. "i" was not out-of-range, 
 >  > IIRC. The problem only shows up on PowerPC., at least Jan was unable
 >  > to reproduce it on a x86 system. How could we debug the seg fault. Do
 >  > you have a good idea? Would the IPIPE tracer help?
 > 
 > I do not see how i could not be out of range. After a 
 > for(i=0;i<MAXHEAPBLOCKS;i++)
 > loop, i is guaranteed to be MAXHEAPBLOCKS, which is one step beyond the
 > array index limit.

But there is a break in the for loop. Ok. Got it.

-- 


					    Gilles Chanteperdrix.

Re: AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Gilles Chanteperdrix]

Wolfgang Grandegger wrote:
 > I was able to reproduce the problem on my MPC5200 system some time ago
 > and I have checked the index "i" as well. "i" was not out-of-range, 
 > IIRC. The problem only shows up on PowerPC., at least Jan was unable
 > to reproduce it on a x86 system. How could we debug the seg fault. Do
 > you have a good idea? Would the IPIPE tracer help?

Ok. Now the question remains: does this problem still exist with version
2.2.2 ? The heaps overhead computations have changed recently.

-- 


					    Gilles Chanteperdrix.

Re: AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Jan Kiszka]

[-- Attachment #1: Type: text/plain, Size: 905 bytes --]

Wolfgang Grandegger wrote:
> ...
> I was able to reproduce the problem on my MPC5200 system some time ago
> and I have checked the index "i" as well. "i" was not out-of-range,
> IIRC. The problem only shows up on PowerPC., at least Jan was unable
> to reproduce it on a x86 system. How could we debug the seg fault. Do
> you have a good idea? Would the IPIPE tracer help?

First of all, do we know where the demo precisely faults? In which
heap's memset? We could then analyse how this heap is being set up in
the kernel, if all mappings are done as expected, if reasonable address
are passed to the user, etc.

I may have my hands on a 405 board on Friday, but I'm not sure if I can
do much more testing than a simple run of the program. Of course,
testing will primarily take place over latest Xenomai...

Roderik, you said you tested under Qemu as well? For PPC or x86 arch?

Jan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 250 bytes --]

Re: AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Gilles Chanteperdrix]

Wolfgang Grandegger wrote:
 > I was able to reproduce the problem on my MPC5200 system some time ago
 > and I have checked the index "i" as well. "i" was not out-of-range, 
 > IIRC. The problem only shows up on PowerPC., at least Jan was unable
 > to reproduce it on a x86 system. How could we debug the seg fault. Do
 > you have a good idea? Would the IPIPE tracer help?

Maybe registering a SIGSEGV handler would help. If an handler is
registered with the SA_SIGINFO flag, it is possible to get the address
of the fault as a parameter of the handler.

-- 


					    Gilles Chanteperdrix.

AW: [Xenomai-help] resubmission : memset of heap crashes Xenomai-Task

[Roderik_Wildenburg]

> Daniel Schnell [mailto:danielsch@domain.hid] wrote :

> Hi,
> 
> I have tried your program on my mpc5200 (Kernel 2.4.25, 
> Xenomai 2.2.1, 256 MB RAM). Besides it doesn't do much and 
> also the heap allocation seems not to work, I had no crashes.
> 

Thank you for testing Daniel !
The idea was, to test Xenomai with very low memory available (especially network performance tests). Therefore I implemented a algorithm (I admit, not a very sophisticated one), which allocates nearly all memory available. To make sure, that memory is not available for Xenomai, the kernel or other applications,I touche the allocated memory (memset). So, the program realy does not do very much, beside allocating and touching as much memory as possible. Unfortunatelly this crashes the programm (segmentation fault) without doing any "illegal".
What do you mean with "the heap allocation seems not to work" ? Is this a Xenomai  or a program malfunction ?
Perhaps your test didn´t crash as this allocation does not work ?
With my target it takes a while (approx 1min.) till the programm crashes. Did you wait a while ?
Perhaps the problem is already solved in 2.2.1.

Thank you for your support
Roderik