[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Will Deacon]

The vivt_flush_cache_{range,page} functions check that the mm_struct
of the VMA being flushed has been active on the current CPU before
performing the cache maintenance.

The gate_vma has a NULL mm_struct pointer and, as such, will cause a
kernel fault if we try to flush it with the above operations. This
happens during ELF core dumps, which include the gate_vma as it may be
useful for debugging purposes.

This patch adds checks to the VIVT cache flushing functions so that VMAs
with a NULL mm_struct are ignored.

Cc: Uros Bizjak <ubizjak@gmail.com>
Reported-by: Gilles Chanteperdrix <gilles.chanteperdrix@xenomai.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
---
 arch/arm/include/asm/cacheflush.h |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index 004c1bc..8cf828e 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -215,7 +215,9 @@ static inline void vivt_flush_cache_mm(struct mm_struct *mm)
 static inline void
 vivt_flush_cache_range(struct vm_area_struct *vma, unsigned long start, unsigned long end)
 {
-	if (cpumask_test_cpu(smp_processor_id(), mm_cpumask(vma->vm_mm)))
+	struct mm_struct *mm = vma->vm_mm;
+
+	if (mm && cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm)))
 		__cpuc_flush_user_range(start & PAGE_MASK, PAGE_ALIGN(end),
 					vma->vm_flags);
 }
@@ -223,7 +225,9 @@ vivt_flush_cache_range(struct vm_area_struct *vma, unsigned long start, unsigned
 static inline void
 vivt_flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr, unsigned long pfn)
 {
-	if (cpumask_test_cpu(smp_processor_id(), mm_cpumask(vma->vm_mm))) {
+	struct mm_struct *mm = vma->vm_mm;
+
+	if (mm && cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm))) {
 		unsigned long addr = user_addr & PAGE_MASK;
 		__cpuc_flush_user_range(addr, addr + PAGE_SIZE, vma->vm_flags);
 	}
-- 
1.7.4.1

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Will Deacon]

Gilles, Uros,

On Mon, Jul 16, 2012 at 05:23:46PM +0100, Will Deacon wrote:
> The vivt_flush_cache_{range,page} functions check that the mm_struct
> of the VMA being flushed has been active on the current CPU before
> performing the cache maintenance.
> 
> The gate_vma has a NULL mm_struct pointer and, as such, will cause a
> kernel fault if we try to flush it with the above operations. This
> happens during ELF core dumps, which include the gate_vma as it may be
> useful for debugging purposes.
> 
> This patch adds checks to the VIVT cache flushing functions so that VMAs
> with a NULL mm_struct are ignored.

Would one of you be able to test this patch please? I've not managed to
trigger the bug you reported on my boards, so it would be useful to know
whether or not this patch solves the problem for you.

Thanks,

Will

> diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
> index 004c1bc..8cf828e 100644
> --- a/arch/arm/include/asm/cacheflush.h
> +++ b/arch/arm/include/asm/cacheflush.h
> @@ -215,7 +215,9 @@ static inline void vivt_flush_cache_mm(struct mm_struct *mm)
>  static inline void
>  vivt_flush_cache_range(struct vm_area_struct *vma, unsigned long start, unsigned long end)
>  {
> -	if (cpumask_test_cpu(smp_processor_id(), mm_cpumask(vma->vm_mm)))
> +	struct mm_struct *mm = vma->vm_mm;
> +
> +	if (mm && cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm)))
>  		__cpuc_flush_user_range(start & PAGE_MASK, PAGE_ALIGN(end),
>  					vma->vm_flags);
>  }
> @@ -223,7 +225,9 @@ vivt_flush_cache_range(struct vm_area_struct *vma, unsigned long start, unsigned
>  static inline void
>  vivt_flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr, unsigned long pfn)
>  {
> -	if (cpumask_test_cpu(smp_processor_id(), mm_cpumask(vma->vm_mm))) {
> +	struct mm_struct *mm = vma->vm_mm;
> +
> +	if (mm && cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm))) {
>  		unsigned long addr = user_addr & PAGE_MASK;
>  		__cpuc_flush_user_range(addr, addr + PAGE_SIZE, vma->vm_flags);
>  	}
> -- 
> 1.7.4.1
> 

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Uros Bizjak]

On Thu, Jul 19, 2012 at 2:28 PM, Will Deacon <will.deacon@arm.com> wrote:

> On Mon, Jul 16, 2012 at 05:23:46PM +0100, Will Deacon wrote:
>> The vivt_flush_cache_{range,page} functions check that the mm_struct
>> of the VMA being flushed has been active on the current CPU before
>> performing the cache maintenance.
>>
>> The gate_vma has a NULL mm_struct pointer and, as such, will cause a
>> kernel fault if we try to flush it with the above operations. This
>> happens during ELF core dumps, which include the gate_vma as it may be
>> useful for debugging purposes.
>>
>> This patch adds checks to the VIVT cache flushing functions so that VMAs
>> with a NULL mm_struct are ignored.
>
> Would one of you be able to test this patch please? I've not managed to
> trigger the bug you reported on my boards, so it would be useful to know
> whether or not this patch solves the problem for you.

Patched kernel works as expected. Also, backport to 3.4 (where
original problem was triggered) works OK, so I'd suggest to backport
this patch to 3.4.

Tested-by: Uros Bizjak <ubizjak@gmail.com>

Thanks,
Uros.

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Will Deacon]

On Thu, Jul 19, 2012 at 02:03:50PM +0100, Uros Bizjak wrote:
> On Thu, Jul 19, 2012 at 2:28 PM, Will Deacon <will.deacon@arm.com> wrote:
> 
> > On Mon, Jul 16, 2012 at 05:23:46PM +0100, Will Deacon wrote:
> >> The vivt_flush_cache_{range,page} functions check that the mm_struct
> >> of the VMA being flushed has been active on the current CPU before
> >> performing the cache maintenance.
> >>
> >> The gate_vma has a NULL mm_struct pointer and, as such, will cause a
> >> kernel fault if we try to flush it with the above operations. This
> >> happens during ELF core dumps, which include the gate_vma as it may be
> >> useful for debugging purposes.
> >>
> >> This patch adds checks to the VIVT cache flushing functions so that VMAs
> >> with a NULL mm_struct are ignored.
> >
> > Would one of you be able to test this patch please? I've not managed to
> > trigger the bug you reported on my boards, so it would be useful to know
> > whether or not this patch solves the problem for you.
> 
> Patched kernel works as expected. Also, backport to 3.4 (where
> original problem was triggered) works OK, so I'd suggest to backport
> this patch to 3.4.
> 
> Tested-by: Uros Bizjak <ubizjak@gmail.com>

Thanks Uros, I'll add that and CC stable on the patch too.

Will

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Gilles Chanteperdrix]

On 07/19/2012 02:28 PM, Will Deacon wrote:
> Gilles, Uros,
> 
> On Mon, Jul 16, 2012 at 05:23:46PM +0100, Will Deacon wrote:
>> The vivt_flush_cache_{range,page} functions check that the mm_struct
>> of the VMA being flushed has been active on the current CPU before
>> performing the cache maintenance.
>>
>> The gate_vma has a NULL mm_struct pointer and, as such, will cause a
>> kernel fault if we try to flush it with the above operations. This
>> happens during ELF core dumps, which include the gate_vma as it may be
>> useful for debugging purposes.
>>
>> This patch adds checks to the VIVT cache flushing functions so that VMAs
>> with a NULL mm_struct are ignored.
> 
> Would one of you be able to test this patch please?

Sorry for the delay, I am getting this mail just now.

> I've not managed to
> trigger the bug you reported on my boards,

I found this bug with the LTP testsuite, more precisely the test named
"abort01".

> so it would be useful to know
> whether or not this patch solves the problem for you.

Fixes linux 3.4 bug for me. But... are you sure this is the right fix? I
mean you are adding an almost always useless test to many cache flushes,
except in one corner case. Would not it make more sense to make the fix
local, and fix gate_vma to have a static mm struct with a valid cpumask?
Being 0 or 1 whether we want to flush the vector page (I believe we do
not want to flush it, but am not sure).

-- 
                                                                Gilles.

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Gilles Chanteperdrix]

On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
> Being 0 or 1 whether we want to flush the vector page (I believe we do
> not want to flush it, but am not sure).

Actually, I believe we want to flush the vector page, at least on
systems with VIVT cache: on systems with VIVT cache, the vector page is
writeable in kernel mode, so may have been modified, and the address
used by elf_core_dump is not the vectors address, but the address in the
kernel direct-mapped RAM region where the vector page was allocated, so
there is a cache aliasing issue.

-- 
                                                                Gilles.

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Will Deacon]

Hi Gilles,

On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
> On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
> > Being 0 or 1 whether we want to flush the vector page (I believe we do
> > not want to flush it, but am not sure).
> 
> Actually, I believe we want to flush the vector page, at least on
> systems with VIVT cache: on systems with VIVT cache, the vector page is
> writeable in kernel mode, so may have been modified, and the address
> used by elf_core_dump is not the vectors address, but the address in the
> kernel direct-mapped RAM region where the vector page was allocated, so
> there is a cache aliasing issue.

It may be writable, but we never actually write to it after it has been
initialised so there's no need to worry about caching issues (the cache is
flushed in devicemaps_init).

As for the NULL check, it's likely to be a single additional cycle
before a cacheflush. I really consider it to be insignificant.

Will

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Gilles Chanteperdrix]

On 07/21/2012 04:35 PM, Will Deacon wrote:
> Hi Gilles,
> 
> On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
>> On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
>>> Being 0 or 1 whether we want to flush the vector page (I believe we do
>>> not want to flush it, but am not sure).
>>
>> Actually, I believe we want to flush the vector page, at least on
>> systems with VIVT cache: on systems with VIVT cache, the vector page is
>> writeable in kernel mode, so may have been modified, and the address
>> used by elf_core_dump is not the vectors address, but the address in the
>> kernel direct-mapped RAM region where the vector page was allocated, so
>> there is a cache aliasing issue.
> 
> It may be writable, but we never actually write to it after it has been
> initialised so there's no need to worry about caching issues (the cache is
> flushed in devicemaps_init).

Except if CONFIG_TLS_REG_EMUL is enabled, or if some faulty code wrote
by accident to the vector page, which caused the application to crash.
What is the reason to include the vector page in the core dump if not to
help debugging?

-- 
                                                                Gilles.

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Gilles Chanteperdrix]

On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
> On 07/21/2012 04:35 PM, Will Deacon wrote:
>> Hi Gilles,
>>
>> On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
>>> On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
>>>> Being 0 or 1 whether we want to flush the vector page (I believe we do
>>>> not want to flush it, but am not sure).
>>>
>>> Actually, I believe we want to flush the vector page, at least on
>>> systems with VIVT cache: on systems with VIVT cache, the vector page is
>>> writeable in kernel mode, so may have been modified, and the address
>>> used by elf_core_dump is not the vectors address, but the address in the
>>> kernel direct-mapped RAM region where the vector page was allocated, so
>>> there is a cache aliasing issue.
>>
>> It may be writable, but we never actually write to it after it has been
>> initialised so there's no need to worry about caching issues (the cache is
>> flushed in devicemaps_init).
> 
> Except if CONFIG_TLS_REG_EMUL is enabled

is disabled I mean.

-- 
                                                                Gilles.

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Will Deacon]

On Sat, Jul 21, 2012 at 03:47:37PM +0100, Gilles Chanteperdrix wrote:
> On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
> > On 07/21/2012 04:35 PM, Will Deacon wrote:
> >> Hi Gilles,
> >>
> >> On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
> >>> On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
> >>>> Being 0 or 1 whether we want to flush the vector page (I believe we do
> >>>> not want to flush it, but am not sure).
> >>>
> >>> Actually, I believe we want to flush the vector page, at least on
> >>> systems with VIVT cache: on systems with VIVT cache, the vector page is
> >>> writeable in kernel mode, so may have been modified, and the address
> >>> used by elf_core_dump is not the vectors address, but the address in the
> >>> kernel direct-mapped RAM region where the vector page was allocated, so
> >>> there is a cache aliasing issue.
> >>
> >> It may be writable, but we never actually write to it after it has been
> >> initialised so there's no need to worry about caching issues (the cache is
> >> flushed in devicemaps_init).
> > 
> > Except if CONFIG_TLS_REG_EMUL is enabled
> 
> is disabled I mean.

Well spotted! I disagree about the address being flushed though -- it looks
to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
do you think we're flushing from the linear mapping?

Anyway, the TLS issue can easily be resolved by changing my previous patch so
that we flush unconditionally when there's no mm (see below).

In the meantime, I'll remove the old patch from the patch system while we
address your remaining concerns.

Cheers,

Will

---8<---

diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index 8cf828e..e4448e1 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -217,7 +217,7 @@ vivt_flush_cache_range(struct vm_area_struct *vma, unsigned long start, unsigned
 {
        struct mm_struct *mm = vma->vm_mm;
 
-       if (mm && cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm)))
+       if (!mm || cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm)))
                __cpuc_flush_user_range(start & PAGE_MASK, PAGE_ALIGN(end),
                                        vma->vm_flags);
 }
@@ -227,7 +227,7 @@ vivt_flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr, unsig
 {
        struct mm_struct *mm = vma->vm_mm;
 
-       if (mm && cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm))) {
+       if (!mm || cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm))) {
                unsigned long addr = user_addr & PAGE_MASK;
                __cpuc_flush_user_range(addr, addr + PAGE_SIZE, vma->vm_flags);
        }

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Gilles Chanteperdrix]

On 07/22/2012 03:03 PM, Will Deacon wrote:
> On Sat, Jul 21, 2012 at 03:47:37PM +0100, Gilles Chanteperdrix wrote:
>> On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
>>> On 07/21/2012 04:35 PM, Will Deacon wrote:
>>>> Hi Gilles,
>>>>
>>>> On Sat, Jul 21, 2012 at 02:18:35PM +0100, Gilles Chanteperdrix wrote:
>>>>> On 07/20/2012 10:41 PM, Gilles Chanteperdrix wrote:
>>>>>> Being 0 or 1 whether we want to flush the vector page (I believe we do
>>>>>> not want to flush it, but am not sure).
>>>>>
>>>>> Actually, I believe we want to flush the vector page, at least on
>>>>> systems with VIVT cache: on systems with VIVT cache, the vector page is
>>>>> writeable in kernel mode, so may have been modified, and the address
>>>>> used by elf_core_dump is not the vectors address, but the address in the
>>>>> kernel direct-mapped RAM region where the vector page was allocated, so
>>>>> there is a cache aliasing issue.
>>>>
>>>> It may be writable, but we never actually write to it after it has been
>>>> initialised so there's no need to worry about caching issues (the cache is
>>>> flushed in devicemaps_init).
>>>
>>> Except if CONFIG_TLS_REG_EMUL is enabled
>>
>> is disabled I mean.
> 
> Well spotted! I disagree about the address being flushed though -- it looks
> to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
> do you think we're flushing from the linear mapping?

I do not think we're flushing from the linear mapping, I believe the
address used by the elf_core_dump function (elf_core_dump -> kmap ->
page_address), to copy the page data to the core is the linear mapping
address, which is the reason why we need the flush at all.

-- 
                                                                Gilles.

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Will Deacon]

On Sun, Jul 22, 2012 at 02:26:03PM +0100, Gilles Chanteperdrix wrote:
> On 07/22/2012 03:03 PM, Will Deacon wrote:
> > On Sat, Jul 21, 2012 at 03:47:37PM +0100, Gilles Chanteperdrix wrote:
> >> On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
> >>> On 07/21/2012 04:35 PM, Will Deacon wrote:
> >>>> It may be writable, but we never actually write to it after it has been
> >>>> initialised so there's no need to worry about caching issues (the cache is
> >>>> flushed in devicemaps_init).
> >>>
> >>> Except if CONFIG_TLS_REG_EMUL is enabled
> >>
> >> is disabled I mean.
> > 
> > Well spotted! I disagree about the address being flushed though -- it looks
> > to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
> > do you think we're flushing from the linear mapping?
> 
> I do not think we're flushing from the linear mapping, I believe the
> address used by the elf_core_dump function (elf_core_dump -> kmap ->
> page_address), to copy the page data to the core is the linear mapping
> address, which is the reason why we need the flush at all.

Ok, good, sounds like we're singing the same tune at last. If you're happy
with my proposed change to the original patch and Uros could re-test, then I
think we're in business again.

Cheers,

Will

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Gilles Chanteperdrix]

On 07/22/2012 05:09 PM, Will Deacon wrote:
> On Sun, Jul 22, 2012 at 02:26:03PM +0100, Gilles Chanteperdrix wrote:
>> On 07/22/2012 03:03 PM, Will Deacon wrote:
>>> On Sat, Jul 21, 2012 at 03:47:37PM +0100, Gilles Chanteperdrix wrote:
>>>> On 07/21/2012 04:40 PM, Gilles Chanteperdrix wrote:
>>>>> On 07/21/2012 04:35 PM, Will Deacon wrote:
>>>>>> It may be writable, but we never actually write to it after it has been
>>>>>> initialised so there's no need to worry about caching issues (the cache is
>>>>>> flushed in devicemaps_init).
>>>>>
>>>>> Except if CONFIG_TLS_REG_EMUL is enabled
>>>>
>>>> is disabled I mean.
>>>
>>> Well spotted! I disagree about the address being flushed though -- it looks
>>> to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
>>> do you think we're flushing from the linear mapping?
>>
>> I do not think we're flushing from the linear mapping, I believe the
>> address used by the elf_core_dump function (elf_core_dump -> kmap ->
>> page_address), to copy the page data to the core is the linear mapping
>> address, which is the reason why we need the flush at all.
> 
> Ok, good, sounds like we're singing the same tune at last. If you're happy
> with my proposed change to the original patch and Uros could re-test, then I
> think we're in business again.

It is OK for me.

-- 
                                                                Gilles.

[PATCH] ARM: mm: avoid attempting to flush the gate_vma with VIVT caches

[Uros Bizjak]

On Sun, Jul 22, 2012 at 5:09 PM, Will Deacon <will.deacon@arm.com> wrote:
>> >>>> It may be writable, but we never actually write to it after it has been
>> >>>> initialised so there's no need to worry about caching issues (the cache is
>> >>>> flushed in devicemaps_init).
>> >>>
>> >>> Except if CONFIG_TLS_REG_EMUL is enabled
>> >>
>> >> is disabled I mean.
>> >
>> > Well spotted! I disagree about the address being flushed though -- it looks
>> > to me like we flush from 0xffff0000 - 0xffff1000, which is what we want. Why
>> > do you think we're flushing from the linear mapping?
>>
>> I do not think we're flushing from the linear mapping, I believe the
>> address used by the elf_core_dump function (elf_core_dump -> kmap ->
>> page_address), to copy the page data to the core is the linear mapping
>> address, which is the reason why we need the flush at all.
>
> Ok, good, sounds like we're singing the same tune at last. If you're happy
> with my proposed change to the original patch and Uros could re-test, then I
> think we're in business again.

The updated patch is effectively the same as the patch at [1], which
works for our target as well. This patch was also tested on 3.4
branch, where it fixes the same problem.

For the patch, I can add:

Tested-by: Uros Bizjak <ubizjak@gmail.com>

[1] http://lists.infradead.org/pipermail/linux-arm-kernel/2012-June/105047.html

Thanks,
Uros.