Subject: memory mapping oddity

From: Philip Blundell <[email-masked]>
Date: Thu, 09 Dec 1999 19:42:14 +0000

A while ago I noticed that under some circumstances NWFPE would generate an 
oops while trying to load an instruction from user memory.  Apparently the 
undefined instruction trap was being called with LR pointing to a bad address.
At the time I chose to ignore it and just added an exception wrapper to NWFPE 
to catch the bad access -- this shuts up the error messages but doesn't really 
address the problem.

It now seems that the same thing can happen with the SWI vector.  Again the 
effect is that the load of the SWI instruction aborts with a message like this:

Unable to handle kernel paging request at virtual address 6776e2ac
pgd = c2628000
*pgd = 00000000, *pmd = 00000000
Internal error: Oops: 2
CPU: 0
pc : [<c00324e4>]    lr : [<6776e2b0>]
sp : c32f3fb8  ip : bffff9c4  fp : 00000000
r10: 4010188c  r9 : 0200a3dc  r8 : c32f3ff4
r7 : 0200a3f0  r6 : 20000010  r5 : 0200a3dc  r4 : 00000015
r3 : 0200a3e4  r2 : 00000100  r1 : bffff804  r0 : 0080493c
Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  Segment user
Control: 262917D  Table: 0262917D  DAC: 00000015

The code in question is:

c00324c0 <vector_swi>:
c00324c0:       e24dd048        sub     sp, sp, #72
c00324c4:       e88d1fff        stmia   sp, {r0, r1, r2, r3, r4, r5, r6, r7, r8,
 r9, sl, fp, ip}
c00324c8:       e28d803c        add     r8, sp, #60
c00324cc:       e9486000        stmdb   r8, {sp, lr}^
c00324d0:       e588e000        str     lr, [r8]
c00324d4:       e14f6000        mrs     r6, spsr
c00324d8:       e5886004        str     r6, [r8, #4]
c00324dc:       e5880008        str     r0, [r8, #8]
c00324e0:       e3a0b000        mov     fp, #0
c00324e4:       e51e6004        ldr     r6, [lr, -#4]

It seems hard to imagine what might cause this.  I can just about conceive of 
some TLB synchronisation issue where a page has been unmapped in the D-TLB but 
not the I-TLB (because it's not marked as VM_EXEC), but I'm unconvinced.

Does anyone have any thoughts?  Again we could add an exception wrapper to 
stop the kernel actually coming to grief but I am not sure this is the right 
thing to do.  Incidentally, someone changed the first instruction fetch in 
NWFPE to be an LDRT rather than a plain LDR; if this was actually necessary 
(I'm not sure it was) then perhaps the SWI handler should do the same.

p.

unsubscribe: body of `unsubscribe linux-arm-kernel' to [email-masked]

---

From: Russell King - ARM Linux Admin <[email-masked]>
Date: Thu, 9 Dec 1999 20:37:09 +0000 (GMT)

> (I'm not sure it was) then perhaps the SWI handler should do the same.

No, SWIs can be called from kernel-space as well as user-space.  An ldrt would
fault if called from kernel-space.
   _____
  |_____| ------------------------------------------------- ---+---+-
  |   |        Russell King       [email-masked]      --- ---
  | | | |  http://www.arm.linux.org.uk/~rmk/armlinux.html    /  /  |
  | +-+-+                                                     --- -+-
  /   |               THE developer of ARM Linux              |+| /|\
 /  | | |                                                     ---  |
    +-+-+ -------------------------------------------------  /\\\  |

---

From: Philip Blundell <[email-masked]>
Date: Thu, 09 Dec 1999 21:01:45 +0000

>fault if called from kernel-space.

Can they still?  I thought all, or almost all, of the instances of that 
had been eliminated.

p.

---

From: Russell King - ARM Linux Admin <[email-masked]>
Date: Thu, 9 Dec 1999 21:14:24 +0000 (GMT)

> effect is that the load of the SWI instruction aborts with a message like this:

Incidentally, Rebel.com just reported similar problems with 2.2.12.

My kernels are still rock stable, so I can't help here.
   _____

---

From: Philip Blundell <[email-masked]>
Date: Thu, 09 Dec 1999 21:28:22 +0000

>My kernels are still rock stable, so I can't help here.

It's not an instability as such; I only saw two instances of the SWI problem 
in 24 hours of running crashme, and the undefined instruction one was 
similarly rare.  Neither seems to do any real harm.

Unless you are testing under high load I wouldn't expect you to have seen the 
problem.

p.

---

From: Russell King - ARM Linux Admin <[email-masked]>
Date: Sun, 12 Dec 1999 10:07:21 +0000 (GMT)

> Can they still?  I thought all, or almost all, of the instances of that 

A lot of the SWI calls in the kernel have been eliminated, but there are certain
calls (eg, clone) which still need the SWI register stack layout and return
structure to work.  IIRC, clone is the only instance where this is used.
   _____
  |_____| ------------------------------------------------- ---+---+-
  |   |        Russell King       [email-masked]      --- ---
  | | | |  http://www.arm.linux.org.uk/~rmk/armlinux.html    /  /  |
  | +-+-+                                                     --- -+-
  /   |               THE developer of ARM Linux              |+| /|\
 /  | | |                                                     ---  |
    +-+-+ -------------------------------------------------  /\\\  |