Re: kern/54994: Critical bug in uarea_poolpage_alloc() for archs with __HAVE_CPU_UAREA_ROUTINES

[Jason Thorpe <thorpej%me.com@localhost>]

The following reply was made to PR kern/54994; it has been noted by GNATS.

From: Jason Thorpe <thorpej%me.com@localhost>
To: Rin Okuyama <rokuyama.rk%gmail.com@localhost>
Cc: Nick Hudson <nick.hudson%gmx.co.uk@localhost>,
 kern-bug-people%netbsd.org@localhost,
 gnats-admin%netbsd.org@localhost,
 netbsd-bugs%netbsd.org@localhost,
 gnats-bugs%netbsd.org@localhost
Subject: Re: kern/54994: Critical bug in uarea_poolpage_alloc() for archs with
 __HAVE_CPU_UAREA_ROUTINES
Date: Wed, 26 Feb 2020 14:13:05 -0800

 > On Feb 26, 2020, at 7:13 AM, Rin Okuyama <rokuyama.rk%gmail.com@localhost> =
 wrote:
 >=20
 > Certainly. Then, what should we do?
 >=20
 > Until now, we've learned:
 >=20
 > (1) uarea_poolpage_alloc() can fall back into uvm_km_alloc():
 >=20
 > 	https://nxr.netbsd.org/xref/src/sys/uvm/uvm_glue.c#269
 >=20
 >    This does not work if low-level routines need physically
 >    contiguous (i.e., direct-mapped) pages for u-area.
 >=20
 > (2) However, all ports with __HAVE_CPU_UAREA_ROUTINES actually do
 >    *not* need contiguous u-area anymore, as far as we can see.
 
 AFAIK, they *never* did.  Certainly, Alpha does not require a =
 physically-contiguous u-area, neither does x86.  Heck, neither does =
 MIPS, assuming wired TLB entries are used to keep the kernel stack =
 mapped.  A physically contiguous u-area is ONLY required if you are =
 using a direct-mapped segment to provide the address of the u-area to =
 the CPU.
 
 > (3) Unfortunately, (2) does not mean that fallback of (1) is safe.
 >    If some ports, that need direct-mapped u-area, bump USPACE from
 >    1 to 2 (or more), fallback of uvm_km_alloc() results in memory
 >    corruption. This is what we observed on powerpc/ibm4xx.
 >=20
 > So, we have some options to do:
 >=20
 > (a) Add MD flag to forbid fallback of uvm_km_alloc().
 >=20
 > Or if this seems too much,
 >=20
 > (b) Leave some comments in uarea_poolpage_alloc().
 >=20
 > Thoughts?
 
 We need to understand why the fallback fails on the platforms where it =
 does fail.  The following statements should all be true:
 
 1- If physically-contiguous pages for the u-area can be allocated and =
 mapped with a direct-mapped segment, we should be able to use that.
 
 2- If phusically-contiguous pages for the u-area cannot be allocated, =
 then the system should be able to use a u-area that is virtually mapped =
 but not physically contiguous.
 
 (2) used to be the way the system always worked for UPAGES > 1.
 
 >=20
 > Thanks,
 > rin
 
 -- thorpej