NetBSD Problem Report #14801

Received: (qmail 4067 invoked from network); 1 Dec 2001 10:24:36 -0000
Message-Id: <200112011024.fB1AOKf09330@hobbes.augustsson.net>
Date: Sat, 1 Dec 2001 11:24:20 +0100 (MET)
From: Lennart Augustsson <lennart@augustsson.net>
Reply-To: lennart@augustsson.net
To: gnats-bugs@gnats.netbsd.org
Subject: Scary pmap message
X-Send-Pr-Version: 3.95

>Number:         14801
>Category:       port-mips
>Synopsis:       Scary pmap message
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    chs
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Dec 01 10:25:00 +0000 2001
>Closed-Date:    Sat Oct 01 15:19:39 +0000 2005
>Last-Modified:  Sat Oct 01 15:19:39 +0000 2005
>Originator:     Lennart Augustsson
>Release:        NetBSD 1.5Z -current 2001-11-30
>Organization:
>Environment:
System: NetBSD 1.5Z (QUBE) #0: Fri Nov 30 17:39:14 PST 2001 lennart@qube:/usr/src/sys/arch/cobalt/compile/QUBE
Architecture: mips
Machine: cobalt
>Description:
	Sometimes these kind of messages appear on the console:
pmap_unwire: wiring for pmap 0x80700300 va 0x1000c000 didn't change!
pmap_unwire: wiring for pmap 0x807002e0 va 0x10012000 didn't change!
pmap_unwire: wiring for pmap 0x80700300 va 0x10004000 didn't change!

>How-To-Repeat:
	Just run a Qube for a while.
>Fix:
	I'm clueless.
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: port-cobalt-maintainer->chs
Responsible-Changed-By: chs 
Responsible-Changed-When: Sun Dec 9 21:16:15 PST 2001 
Responsible-Changed-Why:  

(copied from my post to port-{cobalt,mips})

I looked into the "pmap_unwire: wiring ... didn't change!" problem.
what's happening is that sometimes we're going through uvm_fault() again
for one of the wired pages, and the pmap_enter() which results from that
replaces the wired pmap entry with non-wired one.  so why would we go through
uvm_fault() again?  that's happening because sometimes the TLB entry is
recycled after the page mapped by one side of the entry is wired and before
the other page is wired.  and when MachTLBUpdate() is called for the second
page, the entry it creates only has the second side filled in.  this causes
us to get a "TLB invalid" trap when we access the other half of the TLB entry
instead of the "TLB miss" trap that we would get if there were no TLB entry
at all.  the handler for "TLB invalid" traps from usermode always calls
trap() instead of looking at the PTEs.

so the problem is that the PTEs and the TLB get out of sync, and the trap
handlers aren't expecting that.  I see several possible fixes, in
approximate decreasing order of preference:

 - change MachTLBUpdate() to take both PTEs for the TLB entry for MIPS3.

 - change the MIPS3 MachTLBUpdate() to only update existing TLB entries,
   not create new ones.

 - have the MIPS3 user "TLB invalid" trap handler try to reload from the
   PTEs before calling trap().

 - use MIPS3_TBIS() instead of MachTLBUpdate() for user mappings on MIPS3.


the last one was the easiest, so I implemented that one and it appears to
make the problem go away.  the patch is attached.  does anyone want to
implement one of the better solutions soon?  if not, I'll just check in
what I've got (after updating it to be friendly to MIPS1, etc).


Responsible-Changed-From-To: kern-bug-people->chs
Responsible-Changed-By: chs@netbsd.org
Responsible-Changed-When: Sun, 27 Mar 2005 18:46:02 +0000
Responsible-Changed-Why:
I'm working on this.


State-Changed-From-To: open->analyzed
State-Changed-By: chs@netbsd.org
State-Changed-When: Sun, 27 Mar 2005 18:51:31 +0000
State-Changed-Why:
see PR history for an analysis and work around.


From: Chuck Silvers <chs@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: PR/14801 CVS commit: src/sys/arch/mips/mips
Date: Sat, 30 Apr 2005 15:56:32 +0000 (UTC)

 Module Name:	src
 Committed By:	chs
 Date:		Sat Apr 30 15:56:32 UTC 2005

 Modified Files:
 	src/sys/arch/mips/mips: mipsX_subr.S

 Log Message:
 change *_TLBUpdate for the MIPS3-style two-entry TLBs to only update existing
 entries and not create new ones.  the problem with creating an entry is that
 we only have the data for one side of the entry, so the other side could be
 out of sync with the software PTEs, which the fault handlers are not prepared
 to deal with.  fixes PR 14801.


 To generate a diff of this commit:
 cvs rdiff -r1.15 -r1.16 src/sys/arch/mips/mips/mipsX_subr.S

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Matthias Scheler <tron@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: PR/14801 CVS commit: [netbsd-3] src/sys/arch/mips/mips
Date: Tue, 10 May 2005 12:39:46 +0000 (UTC)

 Module Name:	src
 Committed By:	tron
 Date:		Tue May 10 12:39:45 UTC 2005

 Modified Files:
 	src/sys/arch/mips/mips [netbsd-3]: mipsX_subr.S

 Log Message:
 Pull up revision 1.16 (requested by chs in ticket #269):
 change *_TLBUpdate for the MIPS3-style two-entry TLBs to only update existing
 entries and not create new ones.  the problem with creating an entry is that
 we only have the data for one side of the entry, so the other side could be
 out of sync with the software PTEs, which the fault handlers are not prepared
 to deal with.  fixes PR 14801.


 To generate a diff of this commit:
 cvs rdiff -r1.15 -r1.15.2.1 src/sys/arch/mips/mips/mipsX_subr.S

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Jeff Rizzo <riz@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: PR/14801 CVS commit: [netbsd-2] src/sys/arch/mips/mips
Date: Mon, 16 May 2005 04:55:38 +0000 (UTC)

 Module Name:	src
 Committed By:	riz
 Date:		Mon May 16 04:55:38 UTC 2005

 Modified Files:
 	src/sys/arch/mips/mips [netbsd-2]: mipsX_subr.S

 Log Message:
 Pull up revision 1.16 (requested by chs in ticket #1508):
 change *_TLBUpdate for the MIPS3-style two-entry TLBs to only update existing
 entries and not create new ones.  the problem with creating an entry is that
 we only have the data for one side of the entry, so the other side could be
 out of sync with the software PTEs, which the fault handlers are not prepared
 to deal with.  fixes PR 14801.


 To generate a diff of this commit:
 cvs rdiff -r1.13 -r1.13.6.1 src/sys/arch/mips/mips/mipsX_subr.S

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: analyzed->closed
State-Changed-By: chs@netbsd.org
State-Changed-When: Sat, 01 Oct 2005 15:19:39 +0000
State-Changed-Why:
fixed.


>Unformatted:

 Index: arch/mips/mips/pmap.c
 ===================================================================
 RCS file: /cvsroot/src/sys/arch/mips/mips/pmap.c,v
 retrieving revision 1.156
 diff -u -p -r1.156 pmap.c
 --- arch/mips/mips/pmap.c	17 Jan 2005 04:54:14 -0000	1.156
 +++ arch/mips/mips/pmap.c	13 Feb 2005 00:24:01 -0000
 @@ -825,6 +825,7 @@ pmap_page_protect(pg, prot)
 	vm_prot_t prot;
 {
 	paddr_t pa = VM_PAGE_TO_PHYS(pg);
 +	struct pmap *pmap;
 	pv_entry_t pv;
 	vaddr_t va;

 @@ -859,10 +860,10 @@ pmap_page_protect(pg, prot)
 	default:
 		pv = pa_to_pvh(pa);
 		while (pv->pv_pmap != NULL) {
 -			pmap_remove(pv->pv_pmap, pv->pv_va,
 -				    pv->pv_va + PAGE_SIZE);
 +			pmap = pv->pv_pmap;
 +			pmap_remove(pmap, pv->pv_va, pv->pv_va + PAGE_SIZE);
 +			pmap_update(pmap);
 		}
 -		pmap_update(pv->pv_pmap);
 	}
 }

 @@ -967,7 +968,7 @@ pmap_protect(pmap, sva, eva, prot)
 			 * Update the TLB if the given address is in the cache.
 			 */
 			if (needupdate)
 -				MachTLBUpdate(sva | asid, entry);
 +				MIPS_TBIS(sva | asid);
 		}
 	}
 }
 @@ -1088,7 +1089,7 @@ pmap_page_cache(paddr_t pa, int mode)
 				entry = (entry & ~MIPS3_PG_CACHEMODE) | newmode;
 				pte->pt_entry = entry;
 				if (needupdate)
 -					MachTLBUpdate(pv->pv_va | asid, entry);
 +					MIPS_TBIS(pv->pv_va | asid);
 			}
 		}
 		pv = pv->pv_next;
 @@ -1331,7 +1332,7 @@ pmap_enter(pmap, va, pa, prot, flags)
 	pte->pt_entry = npte;

 	if (pmap->pm_asidgen == pmap_asid_generation)
 -		MachTLBUpdate(va | asid, npte);
 +		MIPS_TBIS(va | asid);

 #ifdef MIPS3_PLUS	/* XXX mmu XXX */
 	if (MIPS_HAS_R4K_MMU && (prot == (VM_PROT_READ | VM_PROT_EXECUTE))) {

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.