unmap() sometimes unmaps more pages than specified

Frank Mehnert <[email protected]>
Newsgroups gmane.comp.micro-kernel.l4.l4ka.general
Organization InnoTek Systemberatung GmbH
Message-ID <[email protected]>
Hi,

in a complex scenario I observed that the unmap() syscall sometimes flushes
more pages than specified. So far I could not find a small testcase and
therefore have to provide tracelogs of my current scenario:

  [note the mappings at virtuall addresses 0xa0000000 and 0xa0001000]

> ptab
Space [current]: current
Memory area (Complete/User/Kernel/Tcb/Manual/tSsm) [complete]: complete
00000000 [0e182027]: tree=fe182000
00007000 [00732027]:   phys=00732000  map=fe15390c   4KB rwx (R~X) user WB
0000b000 [0075c067]:   phys=0075c000  map=fe1538d0   4KB rwx (RWX) user WB
00010000 [0075d025]:   phys=0075d000  map=fe153920   4KB r~x (R~X) user WB
00012000 [0075f025]:   phys=0075f000  map=fe1538e4   4KB r~x (R~X) user WB
00013000 [00760025]:   phys=00760000  map=fe187178   4KB r~x (R~X) user WB
00014000 [00761025]:   phys=00761000  map=fe1871c8   4KB r~x (R~X) user WB
00015000 [00762025]:   phys=00762000  map=fe1538f8   4KB r~x (R~X) user WB
00016000 [00763025]:   phys=00763000  map=fe153948   4KB r~x (R~X) user WB
00017000 [00764025]:   phys=00764000  map=fe1871b4   4KB r~x (R~X) user WB
00018000 [00765025]:   phys=00765000  map=fe1872f4   4KB r~x (R~X) user WB
00019000 [00766025]:   phys=00766000  map=fe1872b8   4KB r~x (R~X) user WB
0001a000 [00767025]:   phys=00767000  map=fe1872cc   4KB r~x (R~X) user WB
0001c000 [00769025]:   phys=00769000  map=fe1871dc   4KB r~x (R~X) user WB
0001d000 [0076a025]:   phys=0076a000  map=fe1871f0   4KB r~x (R~X) user WB
0001e000 [0076b025]:   phys=0076b000  map=fe187240   4KB r~x (R~X) user WB
0001f000 [0076c025]:   phys=0076c000  map=fe187204   4KB r~x (R~X) user WB
00020000 [0076d025]:   phys=0076d000  map=fe1872a4   4KB r~x (R~X) user WB
00021000 [0076e025]:   phys=0076e000  map=fe187254   4KB r~x (R~X) user WB
00022000 [0076f025]:   phys=0076f000  map=fe18727c   4KB r~x (R~X) user WB
00024000 [00771025]:   phys=00771000  map=fe187290   4KB r~x (R~X) user WB
00026000 [00773025]:   phys=00773000  map=fe18722c   4KB r~x (R~X) user WB
00027000 [00774025]:   phys=00774000  map=fe153934   4KB r~x (R~X) user WB
00028000 [00775025]:   phys=00775000  map=fe187218   4KB r~x (R~X) user WB
0002a000 [00776067]:   phys=00776000  map=fe18718c   4KB rwx (RWX) user WB
0002b000 [00777067]:   phys=00777000  map=fe187268   4KB rwx (RWX) user WB
0002c000 [00778067]:   phys=00778000  map=fe15395c   4KB rwx (RWX) user WB
0002d000 [00779067]:   phys=00779000  map=fe1871a0   4KB rwx (RWX) user WB
08000000 [0e18a027]: tree=fe18a000
08048000 [00735025]:   phys=00735000  map=fe153f74   4KB r~x (R~X) user WB
a0000000 [0e188027]: tree=fe188000
a0000000 [0084d067]:   phys=0084d000  map=fe153f88   4KB rwx (RWX) user WB
a0001000 [0084e067]:   phys=0084e000  map=fe153f9c   4KB rwx (RWX) user WB
bfc00000 [0e16a027]: tree=fe16a000
bfffb000 [00331025]:   phys=00331000  map=bfffb000   4KB r~x (R~X) user WB
bfffc000 [0e16f067]:   phys=0e16f000  map=bfffc000   4KB rwx (RWX) user WB
d0800000 [004000a1]: phys=00400000  map=d0800000     4MB r~x (R~X) kernel WB
df000000 [0034a027]: tree=f034a000
df000000 [00348167]:   phys=00348000  map=df000000   4KB rwx (RWX) user global WB
df014000 [00335123]:   phys=00335000  map=df014000   4KB rwx (R~X) kernel global WB
df015000 [00336023]:   phys=00336000  map=df015000   4KB rwx (R~X) kernel WB
df016000 [00337003]:   phys=00337000  map=df016000   4KB rwx (~~~) kernel WB
df017000 [00338103]:   phys=00338000  map=df017000   4KB rwx (~~~) kernel global WB
e0000000 [0034d027]: tree=f034d000
e0000000 [0e175163]:   phys=0e175000  map=e00c0001   4KB rwx (RWX) kernel global WB
e0006000 [0e173163]:   phys=0e173000  map=e0006000   4KB rwx (RWX) kernel global WB
e0008000 [0034c163]:   phys=0034c000  map=e0358000   4KB rwx (RWX) kernel global WB
e0018000 [0034e163]:   phys=0034e000  map=e0019fe8   4KB rwx (RWX) kernel global WB
e0019000 [0035a163]:   phys=0035a000  map=e0019000   4KB rwx (RWX) kernel global WB
e00a0000 [0e020163]:   phys=0e020000  map=e00a0000   4KB rwx (RWX) kernel global WB
e00c0000 [0e027163]:   phys=0e027000  map=e00c0000   4KB rwx (RWX) kernel global WB
e00c1000 [0e0de163]:   phys=0e0de000  map=e00c1000   4KB rwx (RWX) kernel global WB
e00e0000 [0e02e163]:   phys=0e02e000  map=e00e0000   4KB rwx (RWX) kernel global WB
e0100000 [0e033163]:   phys=0e033000  map=10224a25   4KB rwx (RWX) kernel global WB
e0101000 [0e0df163]:   phys=0e0df000  map=e01b8860   4KB rwx (RWX) kernel global WB
e0102000 [0e14e163]:   phys=0e14e000  map=e01bb860   4KB rwx (RWX) kernel global WB
e0120000 [0e03c163]:   phys=0e03c000  map=e0120008   4KB rwx (RWX) kernel global WB
e0140000 [0e043163]:   phys=0e043000  map=e0140000   4KB rwx (RWX) kernel global WB
e0141000 [0e0e4163]:   phys=0e0e4000  map=e0151000   4KB rwx (RWX) kernel global WB
e0142000 [0e172163]:   phys=0e172000  map=e0152000   4KB rwx (RWX) kernel global WB
e0143000 [0e174163]:   phys=0e174000  map=e0143000   4KB rwx (RWX) kernel global WB
e0144000 [0e178163]:   phys=0e178000  map=10220030   4KB rwx (RWX) kernel global WB
e0160000 [0e04a163]:   phys=0e04a000  map=e0160001   4KB rwx (RWX) kernel global WB
e0180000 [0e04f163]:   phys=0e04f000  map=e0180400   4KB rwx (RWX) kernel global WB
e01a0000 [0e058163]:   phys=0e058000  map=102ef020   4KB rwx (RWX) kernel global WB
e01a1000 [0e0db163]:   phys=0e0db000  map=e01a5027   4KB rwx (RWX) kernel global WB
e01a2000 [0e116163]:   phys=0e116000  map=5f9a2160   4KB rwx (RWX) kernel global WB
e01c0000 [0e05f163]:   phys=0e05f000  map=e02d0672   4KB rwx (RWX) kernel global WB
e01c1000 [0e149163]:   phys=0e149000  map=e01c1000   4KB rwx (RWX) kernel global WB
e01e0000 [0e154163]:   phys=0e154000  map=001f8000   4KB rwx (RWX) kernel global WB
e01e1000 [0e15b163]:   phys=0e15b000  map=e01c1000   4KB rwx (RWX) kernel global WB
e01e2000 [0e186163]:   phys=0e186000  map=001fa7bc   4KB rwx (RWX) kernel global WB
e0200000 [0e162163]:   phys=0e162000  map=e0200000   4KB rwx (RWX) kernel global WB
e0201000 [0e17e163]:   phys=0e17e000  map=e0201000   4KB rwx (RWX) kernel global WB
e0220000 [0e167163]:   phys=0e167000  map=e0220000   4KB rwx (RWX) kernel global WB
efc00000 [0e18d027]: tree=fe18d000
efc2d000 [0e18c021]:   phys=0e18c000  map=efc2d000   4KB r~x (R~X) kernel WB
f0000000 [000001e3]: phys=00000000  map=f0000000     4MB rwx (RWX) kernel global WB
fdc00000 [0dc001e7]: phys=0dc00000  map=fdc00000     4MB rwx (RWX) user global WB
fe000000 [0e0001e3]: phys=0e000000  map=fe000000     4MB rwx (RWX) kernel global WB
fe400000 [0e4001e3]: phys=0e400000  map=fe400000     4MB rwx (RWX) kernel global WB
fe800000 [0e8001e3]: phys=0e800000  map=fe800000     4MB rwx (RWX) kernel global WB
fec00000 [0ec001e3]: phys=0ec00000  map=fec00000     4MB rwx (RWX) kernel global WB
> mdb
/mdb> dumpmem
Address [0x0]: 0084d000
table 0d800000 [objsize=4M  radix=1024  count=520] (f0364030)
  [1] vaddr: 00800000  spc: f035c000  rights: [o=rwx i=rwx e=rwx] (fe005ac4)
    [2] vaddr: 00800000  spc: fe03d000  rights: [o=rwx i=rwx e=rwx] (fe0780d8)
      table 0084d000 [objsize=4K  radix=1024  count=2] (f03641a0)
        [3] vaddr: a0000000  spc: fe16c000  rights: [o=rwx i=rwx e=rwx (fe153f88)
/mdb> dumpmem
Address [0x0]: 0084e000
table 0d800000 [objsize=4M  radix=1024  count=520] (f0364030)
  [1] vaddr: 00800000  spc: f035c000  rights: [o=rwx i=rwx e=rwx] (fe005ac4)
    [2] vaddr: 00800000  spc: fe03d000  rights: [o=rwx i=rwx e=rwx] (fe0780d8)
      table 0084d000 [objsize=4K  radix=1024  count=2] (f03641a0)
        [3] vaddr: a0001000  spc: fe16c000  rights: [o=rwx i=rwx e=rwx] (fe153f9c)
/mdb> up
> tracepoints
/tracepoints> enableall
/tracepoints> up
> go
timeslice expired for 01100001
Unwind: tcb=00a08001 p=ffffffff s=WAIT_TIMEOUT (saved: p=00000000 s=ABORTED)
SYS_IPC: current: 00900001, to_tid: 00a08001, from_tid: ffffffff, to: 0x4000000, tag: 0x82 (label=0x0, u=2, t=2)
IPC transfer message: src=00900001, dst=00a08001
tag=00000082, untyped: 2, typed: 2, acceptor: 1
IPC string item:  src_item=00002000  dst_item=00002000
  src: substrings=1 (idx=1)  len=00000008
  dst: substrings=1 (idx=1)  len=00000008
  src: addr=0051fd04 len=00000008 (idx=1)
  dst: addr=012ffab4 len=00000008 (idx=1)
IPC string copy: 00900001 @ 0051fd04 -> 00a08001 @ 012ffab4, len=0x8
timeslice expired for 00a08001
Unwind: tcb=0080c001 p=0080c001 s=WAIT_TIMEOUT (saved: p=00000000 s=ABORTED)
SYS_IPC: current: 0080c001, to_tid: 00000000, from_tid: 0080c001, to: 0x106c
wakeup timeout (curr=00a08001 wu=e0101800) Current time = 2859192
SYS_IPC: current: 00a08001, to_tid: 00000000, from_tid: ffffffff, to: 0x40020c3
Unwind: tcb=0080c001 p=0080c001 s=WAIT_TIMEOUT (saved: p=00000000 s=ABORTED)
SYS_IPC: current: 0080c001, to_tid: 00000000, from_tid: 0080c001, to: 0x1847

  [unmap syscall should unmap 0xa0001000 size 4K in the target address space
   => physical address is 0x0084e000]

SYS_UNMAP: control=0x0 (num=0, flush=0) eip=0xbfffb8c6
unmap_fpage (f_spc=fe03d000  f_fp=0084e0c7)
mem::mapctrl (fe0780d8, 80 [~~~~u~], 0, 00000000) phys=00800000
kmem_free (fe17f000, 4096 [4K]), ip: f0316a11
> ptab
Space [current]: current
Memory area (Complete/User/Kernel/Tcb/Manual/tSsm) [complete]: complete
00000000 [0e182027]: tree=fe182000
00007000 [00732027]:   phys=00732000  map=fe15390c   4KB rwx (R~X) user WB
0000b000 [0075c067]:   phys=0075c000  map=fe1538d0   4KB rwx (RWX) user WB
00010000 [0075d025]:   phys=0075d000  map=fe153920   4KB r~x (R~X) user WB
00012000 [0075f025]:   phys=0075f000  map=fe1538e4   4KB r~x (R~X) user WB
00013000 [00760025]:   phys=00760000  map=fe187178   4KB r~x (R~X) user WB
00014000 [00761025]:   phys=00761000  map=fe1871c8   4KB r~x (R~X) user WB
00015000 [00762025]:   phys=00762000  map=fe1538f8   4KB r~x (R~X) user WB
00016000 [00763025]:   phys=00763000  map=fe153948   4KB r~x (R~X) user WB
00017000 [00764025]:   phys=00764000  map=fe1871b4   4KB r~x (R~X) user WB
00018000 [00765025]:   phys=00765000  map=fe1872f4   4KB r~x (R~X) user WB
00019000 [00766025]:   phys=00766000  map=fe1872b84KB r~x (R~X) user WB
0001a000 [00767025]:   phys=00767000  map=fe1872cc   4KB r~x (R~X) user WB
0001c000 [00769025]:   phys=00769000  map=fe1871dc   4KB r~x (R~X) user WB
0001d000 [0076a025]:   phys=0076a000  map=fe1871f0   4KB r~x (R~X) user WB
0001e000 [0076b025]:   phys=0076b000  map=fe187240   4KB r~x (R~X) user WB
0001f000 [0076c025]:   phys=0076c000  map=fe187204   4KB r~x (R~X) user WB
00020000 [0076d025]:   phys=0076d000  map=fe1872a4   4KB r~x (R~X) user WB
00021000 [0076e025]:   phys=0076e000  map=fe187254   4KB r~x (R~X) user WB
00022000 [0076f025]:   phys=0076f000  map=fe18727c   4KB r~x (R~X) user WB
00024000 [00771025]:   phys=00771000  map=fe187290   4KB r~x (R~X) user WB
00026000 [00773025]:   phys=00773000  map=fe18722c   4KB r~x (R~X) user WB
00027000 [00774025]:   phys=00774000  map=fe153934   4KB r~x (R~X) user WB
00028000 [00775025]:   phys=00775000  map=fe187218   4KB r~x (R~X) user WB
0002a000 [00776067]:   phys=00776000  map=fe18718c   4KB rwx (RWX) user WB
0002b000 [00777067]:   phys=00777000  map=fe187268   4KB rwx (RWX) user WB
0002c000 [00778067]:   phys=00778000  map=fe15395c   4KB rwx (RWX) user WB
0002d000 [00779067]:   phys=00779000  map=fe1871a0   4KB rwx (RWX) user WB
08000000 [0e18a027]: tree=fe18a000
08048000 [00735025]:   phys=00735000  map=fe153f74   4KB r~x (R~X) user WB
a0000000 [0e188027]: tree=fe188000

  [both (!) mappings vanished -- only the page at 0xa0001000 should
   have been unmapped]

bfc00000 [0e16a027]: tree=fe16a000
bfffb000 [00331025]:   phys=00331000  map=bfffb000   4KB r~x (R~X) user WB
bfffc000 [0e16f067]:   phys=0e16f000  map=bfffc000   4KB rwx (RWX) user WB
d0800000 [004000a1]: phys=00400000  map=d0800000     4MB r~x (R~X) kernel WB
df000000 [0034a027]: tree=f034a000
df000000 [00348167]:   phys=00348000  map=df000000   4KB rwx (RWX) user global WB
df014000 [00335123]:   phys=00335000  map=df014000   4KB rwx (R~X) kernel global WB
df015000 [00336023]:   phys=00336000  map=df015000   4KB rwx (R~X) kernel WB
df016000 [00337003]:   phys=00337000  map=df016000   4KB rwx (~~~) kernel WB
df017000 [00338103]:   phys=00338000  map=df017000   4KB rwx (~~~) kernel global WB
e0000000 [0034d027]: tree=f034d000
e0000000 [0e175163]:   phys=0e175000  map=e00c0001   4KB rwx (RWX) kernel global WB
e0006000 [0e173163]:   phys=0e173000  map=e0006000   4KB rwx (RWX) kernel global WB
e0008000 [0034c163]:   phys=0034c000  map=e0358000   4KB rwx (RWX) kernel global WB
e0018000 [0034e163]:   phys=0034e000  map=e0019fe8   4KB rwx (RWX) kernel global WB
e0019000 [0035a163]:   phys=0035a000  map=e0019000   4KB rwx (RWX) kernel global WB
e00a0000 [0e020163]:   phys=0e020000  map=e00a0000   4KB rwx (RWX) kernel global WB
e00c0000 [0e027163]:   phys=0e027000  map=e00c0000   4KB rwx (RWX) kernel global WB
e00c1000 [0e0de163]:   phys=0e0de000  map=e00c1000   4KB rwx (RWX) kernel global WB
e00e0000 [0e02e163]:   phys=0e02e000  map=e00e0000   4KB rwx (RWX) kernel global WB
e0100000 [0e033163]:   phys=0e033000  map=10224a25   4KB rwx (RWX) kernel global WB
e0101000 [0e0df163]:   phys=0e0df000  map=e01b8860   4KB rwx (RWX) kernel global WB
e0102000 [0e14e163]:   phys=0e14e000  map=e01bb860   4KB rwx (RWX) kernel global WB
e0120000 [0e03c163]:   phys=0e03c000  map=e0120008   4KB rwx (RWX) kernel global WB
e0140000 [0e043163]:   phys=0e043000  map=e0140000   4KB rwx (RWX) kernel global WB
e0141000 [0e0e4163]:   phys=0e0e4000  map=e0151000   4KB rwx (RWX) kernel global WB
e0142000 [0e172163]:   phys=0e172000  map=e0152000   4KB rwx (RWX) kernel global WB
e0143000 [0e174163]:   phys=0e174000  map=e0143000   4KB rwx (RWX) kernel global WB
e0144000 [0e178163]:   phys=0e178000  map=10220030   4KB rwx (RWX) kernel global WB
e0160000 [0e04a163]:   phys=0e04a000  map=e0160001   4KB rwx (RWX) kernel global WB
e0180000 [0e04f163]:   phys=0e04f000  map=e0180400   4KB rwx (RWX) kernel global WB
e01a0000 [0e058163]:   phys=0e058000  map=102ef020   4KB rwx (RWX) kernel global WB
e01a1000 [0e0db163]:   phys=0e0db000  map=e01a5027   4KB rwx (RWX) kernel global WB
e01a2000 [0e116163]:   phys=0e116000  map=5f9a2160   4KB rwx (RWX) kernel global WB
e01c0000 [0e05f163]:   phys=0e05f000  map=e02d0672   4KB rwx (RWX) kernel global WB
e01c1000 [0e149163]:   phys=0e149000  map=e01c1000   4KB rwx (RWX) kernel global WB
e01e0000 [0e154163]:   phys=0e154000  map=001f8000   4KB rwx (RWX) kernel global WB
e01e1000 [0e15b163]:   phys=0e15b000  map=e01c1000   4KB rwx (RWX) kernel global WB
e01e2000 [0e186163]:   phys=0e18600map=001fa7bc   4KB rwx (RWX) kernel global WB
e0200000 [0e162163]:   phys=0e162000  map=e0200000   4KB rwx (RWX) kernel global WB
e0201000 [0e17e163]:   phys=0e17e000  map=e0201000   4KB rwx (RWX) kernel global WB
e0220000 [0e167163]:   phys=0e167000  map=e0220000   4KB rwx (RWX) kernel global WB
efc00000 [0e18d027]: tree=fe18d000
efc2d000 [0e18c021]:   phys=0e18c000  map=efc2d000   4KB r~x (R~X) kernel WB
f0000000 [000001e3]: phys=00000000  map=f0000000     4MB rwx (RWX) kernel global WB
fdc00000 [0dc001e7]: phys=0dc00000  map=fdc00000     4MB rwx (RWX) user global WB
fe000000 [0e0001e3]: phys=0e000000  map=fe000000     4MB rwx (RWX) kernel global WB
fe400000 [0e4001e3]: phys=0e400000  map=fe400000     4MB rwx (RWX) kernel global WB
fe800000 [0e8001e3]: phys=0e800000  map=fe800000     4MB rwx (RWX) kernel global WB
fec00000 [0ec001e3]: phys=0ec00000  map=fec00000     4MB rwx (RWX) kernel global WB

Please tell me if you need more information.

Frank
-- 
## InnoTek Systemberatung GmbH, http://www.innotek.de ##
signature.asc (application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQBEmnDR6z8pigLf3EcRArrBAJ9xoTMZIfTzqqajgwPZkZ2KxRlncQCeKx63
wTSp1Ix+9T0xBABRhFVEUpY=
=3a28
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.