Re: [PATCH 04/12] mips: Reserve memory for the kernel image resources

From: Mike Rapoport
Date: Tue May 21 2019 - 11:55:58 EST


Hi Geert,

On Tue, May 21, 2019 at 04:56:39PM +0200, Geert Uytterhoeven wrote:
> Hi Serge,
>
> On Wed, Apr 24, 2019 at 12:50 AM Serge Semin <fancer.lancer@xxxxxxxxx> wrote:
> > The reserved_end variable had been used by the bootmem_init() code
> > to find a lowest limit of memory available for memmap blob. The original
> > code just tried to find a free memory space higher than kernel was placed.
> > This limitation seems justified for the memmap ragion search process, but
> > I can't see any obvious reason to reserve the unused space below kernel
> > seeing some platforms place it much higher than standard 1MB. Moreover
> > the RELOCATION config enables it to be loaded at any memory address.
> > So lets reserve the memory occupied by the kernel only, leaving the region
> > below being free for allocations. After doing this we can now discard the
> > code freeing a space between kernel _text and VMLINUX_LOAD_ADDRESS symbols
> > since it's going to be free anyway (unless marked as reserved by
> > platforms).
> >
> > Signed-off-by: Serge Semin <fancer.lancer@xxxxxxxxx>
>
> This is now commit b93ddc4f9156205e ("mips: Reserve memory for the kernel
> image resources") in v5.2-rc1, which causes rbtx4927 to crash during boot:
>
> VFS: Mounted root (nfs filesystem) on device 0:13.
> devtmpfs: mounted
> BUG: Bad page state in process swapper pfn:00001
> page:804b7820 refcount:0 mapcount:-128 mapping:00000000 index:0x1
> flags: 0x0()
> raw: 00000000 00000100 00000200 00000000 00000001 00000000 ffffff7f 00000000
> page dumped because: nonzero mapcount
> Modules linked in:
> CPU: 0 PID: 1 Comm: swapper Not tainted
> 5.2.0-rc1-rbtx4927-00468-g3c05ea3d4077b756-dirty #137
> Stack : 00000000 10008400 8040dd2c 87c1b974 8044af63 8040dd2c
> 00000001 804a3490
> 00000001 81000000 0030f231 80148558 00000003 10008400
> 87c1dd80 7599ee13
> 00000000 00000000 804b0000 00000000 00000007 00000000
> 00000085 00000000
> 62722d31 00000084 804b0000 39347874 00000000 804b7820
> 8040cef8 81000010
> 00000001 00000007 00000001 81000000 00000008 8021de24
> 00000000 804a0000
> ...
> Call Trace:
> [<8010adec>] show_stack+0x74/0x104
> [<801a5e44>] bad_page+0x130/0x138
> [<801a654c>] free_pcppages_bulk+0x17c/0x3b0
> [<801a789c>] free_unref_page+0x40/0x68
> [<801120f4>] free_init_pages+0xec/0x104
> [<803bdde8>] free_initmem+0x10/0x58
> [<803bdb8c>] kernel_init+0x20/0x100
> [<801057c8>] ret_from_kernel_thread+0x14/0x1c
> Disabling lock debugging due to kernel taint
> BUG: Bad page state in process swapper pfn:00002
> [...]
>
> CONFIG_RELOCATABLE is not set, so the only relevant part is the
> change quoted below.
>
> > --- a/arch/mips/kernel/setup.c
> > +++ b/arch/mips/kernel/setup.c
> > @@ -371,7 +371,6 @@ static void __init bootmem_init(void)
> >
> > static void __init bootmem_init(void)
> > {
> > - unsigned long reserved_end;
> > phys_addr_t ramstart = PHYS_ADDR_MAX;
> > int i;
> >
> > @@ -382,10 +381,10 @@ static void __init bootmem_init(void)
> > * will reserve the area used for the initrd.
> > */
> > init_initrd();
> > - reserved_end = (unsigned long) PFN_UP(__pa_symbol(&_end));
> >
> > - memblock_reserve(PHYS_OFFSET,
> > - (reserved_end << PAGE_SHIFT) - PHYS_OFFSET);
> > + /* Reserve memory occupied by kernel. */
> > + memblock_reserve(__pa_symbol(&_text),
> > + __pa_symbol(&_end) - __pa_symbol(&_text));
> >
> > /*
> > * max_low_pfn is not a number of pages. The number of pages
>
> With some debug code added:
>
> Determined physical RAM map:
> memory: 08000000 @ 00000000 (usable)
> bootmem_init:390: PHYS_OFFSET = 0x0
> bootmem_init:391: __pa_symbol(&_text) = 0x100000
> bootmem_init:392: __pa_symbol(&_end) = 0x4b77c8
> bootmem_init:393: PFN_UP(__pa_symbol(&_end)) = 0x4b8

Have you tried adding memblock=debug to the command line?
Not sure it'll help, but still :)

> Hence the old code reserved 1 MiB extra at the beginning.
>
> Note that the new code also dropped the rounding up of the memory block
> size to a multiple of PAGE_SIZE. I'm not sure the latter actually
> matters or not.

I'd say that bad page state for pfn 1 is caused by "freeing" the first 1M.

> Do you have a clue? Thanks!
>
> Gr{oetje,eeting}s,
>
> Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx
>
> In personal conversations with technical people, I call myself a hacker. But
> when I'm talking to journalists I just say "programmer" or something like that.
> -- Linus Torvalds
>

--
Sincerely yours,
Mike.