booting with BootX corrupts memory

booting with BootX corrupts memory

[Olaf Hering]

Booting an old Mac with BootX corrupts memory, the kernel seldom gets
into init. Even the built-in initramfs archive gets corrupted. So far I
havent figured out where the corruption starts. The only data point so
far is that a passed initrd gets overwritten with stuff that looks like
part of the device-tree after the call to free_area_init_node() from
paging_init(). Perhaps the virtual/real address mapping isnt handled
correctly.

This is broken since at least 2.6.15, 2.6.14 dies very early, 2.6.13 was
still ok.

Symptoms differ, depending on used .config and wether an initrd is passed.
This one is without CONFIG_BOOTX_TEXT.

.....
Using PowerMac machine description
Total memory = 72MB; using 256kB for hash table (at c0a80000)
Linux version 2.6.18-rc3 (olaf@g5) (gcc version 4.1.0 (SUSE Linux)) #39 Mon Jul 31 19:06:09 CEST 2006
1f8b0808 d4015944 0203696e 69747264 20313438 323100ec bd0f7c94 c5b92f3e Found initrd at 0xc04e0000:0xc0ac3b46
Found a Grand Central mac-io controller, rev: 2, mapped at 0xfdf00000
PowerMac motherboard: PowerMac 7200/7300
Cache coherency enabled for bandit/PSX
Found Bandit PCI host bridge at 0x00000000f2000000. Firmware bus number: 0->1
1f8b0808 d4015944 0203696e 69747264 20313438 323100ec bd0f7c94 c5b92f3e paging_init(334) exit
00000400 00000001 ffffffff 00000000 00000000 00000000 c04e0018 c04e0018 paging_init(344) exit
Built 1 zonelists.  Total pages: 18432
Kernel command line: ramdisk_size=8192 start_shell nosshkey console=ttyS0,38400 onsole=tty0 video=platinumfb:off minmemory=0 memyasttext=0
irq: Found primary Apple PIC /bandit/gc for 32 irqs
irq: System has 32 possible interrupts
PID hash table entries: 512 (order: 9, 2048 bytes)
Console: colour dummy device 80x25
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 56688k/73728k available (2608k kernel code, 16976k reserved, 136k data, 2110k bss, 1472k init)
Mount-cache hash table entries: 512
Unpacking initramfs... done
Freeing initrd memory: 6030k freed
Bad page state in process 'swapper'
page:c04d8f00 flags:0x00000080 mapping:00000000 mapcount:0 count:0
Trying to fix it up, but a reboot is needed
Backtrace:
Call Trace:
[C159DF20] [C0007A58] show_stack+0x50/0x184 (unreliable)
[C159DF40] [C0048EDC] bad_page+0x58/0x9c
[C159DF50] [C0049228] free_hot_cold_page+0xa0/0x15c
[C159DF70] [C0011F88] free_initrd_mem+0x70/0xac
[C159DF80] [C011F614] populate_rootfs+0x84/0xa0
[C159DFA0] [C000390C] init+0x2c/0x260
[C159DFF0] [C000F390] kernel_thread+0x44/0x60
Bad page state in process 'swapper'
page:c04d8f20 flags:0x00000080 mapping:00000000 mapcount:0 count:0
Trying to fix it up, but a reboot is needed
Backtrace:
Call Trace:
[C159DF20] [C0007A58] show_stack+0x50/0x184 (unreliable)
[C159DF40] [C0048EDC] bad_page+0x58/0x9c
[C159DF50] [C0049228] free_hot_cold_page+0xa0/0x15c
[C159DF70] [C0011F88] free_initrd_mem+0x70/0xac
[C159DF80] [C011F614] populate_rootfs+0x84/0xa0
[C159DFA0] [C000390C] init+0x2c/0x260
[C159DFF0] [C000F390] kernel_thread+0x44/0x60
Bad page state in process 'swapper'
page:c04d8f40 flags:0x00000080 mapping:00000000 mapcount:0 count:0
Trying to fix it up, but a reboot is needed
Backtrace:
Call Trace:
[C159DF20] [C0007A58] show_stack+0x50/0x184 (unreliable)
...

Re: booting with BootX corrupts memory

[Niels Kristian Bech Jensen]

 On Tue, Aug  1, Olaf Hering wrote:

> Booting an old Mac with BootX corrupts memory, the kernel seldom gets
> into init. Even the built-in initramfs archive gets corrupted. So far I
> havent figured out where the corruption starts. The only data point so
> far is that a passed initrd gets overwritten with stuff that looks like
> part of the device-tree after the call to free_area_init_node() from
> paging_init(). Perhaps the virtual/real address mapping isnt handled
> correctly.

> This is broken since at least 2.6.15, 2.6.14 dies very early, 2.6.13 was
> still ok.

> Symptoms differ, depending on used .config and wether an initrd is passed.

I think I've been hit by this bug on my beige G3 running Ubuntu Edgy.

When booting with initrd the boot process stops before any kernel output (CONFIG_BOOTX_TEXT is not enabled). Booting without initrd works fine - at least until it cannot find the root filesystem driver. ;-)

Anything I can do to help debug this?

Regards,
-- 
Niels Kristian Bech Jensen

Stop software piracy --- use free software.

Re: booting with BootX corrupts memory

[Benjamin Herrenschmidt]

On Wed, 2006-08-09 at 06:00 +0200, Niels Kristian Bech Jensen wrote:
>  On Tue, Aug  1, Olaf Hering wrote:
> 
> > Booting an old Mac with BootX corrupts memory, the kernel seldom gets
> > into init. Even the built-in initramfs archive gets corrupted. So far I
> > havent figured out where the corruption starts. The only data point so
> > far is that a passed initrd gets overwritten with stuff that looks like
> > part of the device-tree after the call to free_area_init_node() from
> > paging_init(). Perhaps the virtual/real address mapping isnt handled
> > correctly.
> 
> > This is broken since at least 2.6.15, 2.6.14 dies very early, 2.6.13 was
> > still ok.
> 
> > Symptoms differ, depending on used .config and wether an initrd is passed.
> 
> I think I've been hit by this bug on my beige G3 running Ubuntu Edgy.
> 
> When booting with initrd the boot process stops before any kernel output (CONFIG_BOOTX_TEXT is not enabled).
> Booting without initrd works fine - at least until it cannot find the root filesystem driver. ;-)

Does this patch helps ?

Index: linux-work/arch/powerpc/platforms/powermac/bootx_init.c
===================================================================
--- linux-work.orig/arch/powerpc/platforms/powermac/bootx_init.c	2006-08-17 16:16:03.000000000 +1000
+++ linux-work/arch/powerpc/platforms/powermac/bootx_init.c	2006-08-18 14:01:36.000000000 +1000
@@ -411,8 +411,15 @@
 	DBG("End of boot params: %x\n", mem_end);
 	rsvmap[0] = mem_start;
 	rsvmap[1] = mem_end;
-	rsvmap[2] = 0;
-	rsvmap[3] = 0;
+	if (bootx_info->ramDisk) {
+		rsvmap[2] = ((unsigned long)bootx_info) + bootx_info->ramDisk;
+		rsvmap[3] = rsvmap[2] + bootx_info->ramDiskSize;
+		rsvmap[4] = 0;
+		rsvmap[5] = 0;
+	} else {
+		rsvmap[2] = 0;
+		rsvmap[3] = 0;
+	}
 
 	return (unsigned long)hdr;
 }
@@ -543,12 +550,12 @@
 	 */
 	if (bi->version < 5) {
 		space = bi->deviceTreeOffset + bi->deviceTreeSize;
-		if (bi->ramDisk)
+		if (bi->ramDisk >= space)
 			space = bi->ramDisk + bi->ramDiskSize;
 	} else
 		space = bi->totalParamsSize;
 
-	bootx_printf("Total space used by parameters & ramdisk: %x \n", space);
+	bootx_printf("Total space used by parameters & ramdisk: 0x%x \n", space);
 
 	/* New BootX will have flushed all TLBs and enters kernel with
 	 * MMU switched OFF, so this should not be useful anymore.

Re: booting with BootX corrupts memory

[Olaf Hering]

On Fri, Aug 18, 2006 at 02:02:12PM +1000, Benjamin Herrenschmidt wrote:
> On Wed, 2006-08-09 at 06:00 +0200, Niels Kristian Bech Jensen wrote:
> >  On Tue, Aug  1, Olaf Hering wrote:
> > 
> > > Booting an old Mac with BootX corrupts memory, the kernel seldom gets
> > > into init. Even the built-in initramfs archive gets corrupted. So far I
> > > havent figured out where the corruption starts. The only data point so
> > > far is that a passed initrd gets overwritten with stuff that looks like
> > > part of the device-tree after the call to free_area_init_node() from
> > > paging_init(). Perhaps the virtual/real address mapping isnt handled
> > > correctly.
> > 
> > > This is broken since at least 2.6.15, 2.6.14 dies very early, 2.6.13 was
> > > still ok.
> > 
> > > Symptoms differ, depending on used .config and wether an initrd is passed.
> > 
> > I think I've been hit by this bug on my beige G3 running Ubuntu Edgy.
> > 
> > When booting with initrd the boot process stops before any kernel output (CONFIG_BOOTX_TEXT is not enabled).
> > Booting without initrd works fine - at least until it cannot find the root filesystem driver. ;-)
> 
> Does this patch helps ?

No, now I dont even get console= output on serial console.

Re: booting with BootX corrupts memory

[Olaf Hering]

On Fri, Aug 18, 2006 at 09:01:13AM +0200, Olaf Hering wrote:

> On Fri, Aug 18, 2006 at 02:02:12PM +1000, Benjamin Herrenschmidt wrote:
> > On Wed, 2006-08-09 at 06:00 +0200, Niels Kristian Bech Jensen wrote:
> > >  On Tue, Aug  1, Olaf Hering wrote:
> > > 
> > > > Booting an old Mac with BootX corrupts memory, the kernel seldom gets
> > > > into init. Even the built-in initramfs archive gets corrupted. So far I
> > > > havent figured out where the corruption starts. The only data point so
> > > > far is that a passed initrd gets overwritten with stuff that looks like
> > > > part of the device-tree after the call to free_area_init_node() from
> > > > paging_init(). Perhaps the virtual/real address mapping isnt handled
> > > > correctly.
> > > 
> > > > This is broken since at least 2.6.15, 2.6.14 dies very early, 2.6.13 was
> > > > still ok.
> > > 
> > > > Symptoms differ, depending on used .config and wether an initrd is passed.
> > > 
> > > I think I've been hit by this bug on my beige G3 running Ubuntu Edgy.
> > > 
> > > When booting with initrd the boot process stops before any kernel output (CONFIG_BOOTX_TEXT is not enabled).
> > > Booting without initrd works fine - at least until it cannot find the root filesystem driver. ;-)
> > 
> > Does this patch helps ?
> 
> No, now I dont even get console= output on serial console.

It doesnt work on a 7200, butit works on a beige G3.
But later it locks up in 'PM: Adding info for No Bus:target0:0',
after mesh init. This one is likely unrelated.

Re: booting with BootX corrupts memory

[Benjamin Herrenschmidt]

> > No, now I dont even get console= output on serial console.
> 
> It doesnt work on a 7200, butit works on a beige G3.
> But later it locks up in 'PM: Adding info for No Bus:target0:0',
> after mesh init. This one is likely unrelated.

Depends.... does it work if you netboot a zImage.coff ?

Ben.

Re: booting with BootX corrupts memory

[Olaf Hering]

On Tue, Aug 22, Benjamin Herrenschmidt wrote:

> 
> > > No, now I dont even get console= output on serial console.
> > 
> > It doesnt work on a 7200, butit works on a beige G3.
> > But later it locks up in 'PM: Adding info for No Bus:target0:0',
> > after mesh init. This one is likely unrelated.
> 
> Depends.... does it work if you netboot a zImage.coff ?

Have to try that, but 2.6.16 freezes as well.

Re: booting with BootX corrupts memory

[Niels Kristian Bech Jensen]

On Fri, 2006-08-18 at 14:02 +1000, Benjamin Herrenschmidt wrote:
> On Wed, 2006-08-09 at 06:00 +0200, Niels Kristian Bech Jensen wrote:
> >  On Tue, Aug  1, Olaf Hering wrote:
> > 
> > > Booting an old Mac with BootX corrupts memory, the kernel seldom gets
> > > into init. Even the built-in initramfs archive gets corrupted. So far I
> > > havent figured out where the corruption starts. The only data point so
> > > far is that a passed initrd gets overwritten with stuff that looks like
> > > part of the device-tree after the call to free_area_init_node() from
> > > paging_init(). Perhaps the virtual/real address mapping isnt handled
> > > correctly.
> > 
> > > This is broken since at least 2.6.15, 2.6.14 dies very early, 2.6.13 was
> > > still ok.
> > 
> > > Symptoms differ, depending on used .config and wether an initrd is passed.
> > 
> > I think I've been hit by this bug on my beige G3 running Ubuntu Edgy.
> > 
> > When booting with initrd the boot process stops before any kernel output (CONFIG_BOOTX_TEXT is not enabled).
> > Booting without initrd works fine - at least until it cannot find the root filesystem driver. ;-)
> 
> Does this patch helps ?
> 
Yes, it fixes the problem for me. Thanks.

-- 
Niels Kristian Bech Jensen

Stop software piracy --- use free software.