Re: tmpfs breakage in 5.99.53?

["J. Hannken-Illjes" <hannken%eis.cs.tu-bs.de@localhost>]

Yes, a fault-in is missing.  For me this little shell script will expose
the failure:

#! /bin/sh

N=0
STR1="string1"
STR2="string2"

mkdir /t || exit 1
mount -t tmpfs tmpfs /t
cd /t

while [ ${N} -lt 10000 ]; do
        echo "${STR1}" > data
        echo "${STR2}" > data

        echo "${STR2}" | cmp -s - data || break

        N=$(( N + 1 ))
done

printf "After round %d:\n" ${N}
hexdump -C data

cd /
umount /t
rmdir /t

exit 0

To get a panic this assertion will help:

RCS file: /cvsroot/src/sys/uvm/uvm_bio.c,v
--- uvm_bio.c   17 Jun 2011 09:50:52 -0000      1.75
+++ uvm_bio.c   18 Jun 2011 13:31:43 -0000
@@ -724,4 +724,6 @@ ubc_uiomove(struct uvm_object *uobj, str
                        error = uiomove(win, bytelen, uio);
                }
+               KASSERT(error != 0 ||
+                   pmap_extract(pmap_kernel(), (vaddr_t)win, NULL));
                if (error != 0 && overwrite) {
                        /*

So it looks like a page was unmapped but it is still possible to write it
without getting a page-fault.  Not being a pmap expert I forced an update
after page removal:

RCS file: /cvsroot/src/sys/uvm/uvm_aobj.c,v
--- uvm_aobj.c  12 Jun 2011 03:36:02 -0000      1.115
+++ uvm_aobj.c  18 Jun 2011 13:31:43 -0000
@@ -888,4 +888,5 @@ uao_put(struct uvm_object *uobj, voff_t 
                TAILQ_REMOVE(&uobj->memq, &endmp, listq.queue);
        }
+       pmap_update(pmap_kernel());
        mutex_exit(uobj->vmobjlock);
        return 0;

With this update in place the error will not occur anymore.

--
Juergen Hannken-Illjes - hannken%eis.cs.tu-bs.de@localhost - TU Braunschweig 
(Germany)

On Jun 17, 2011, at 11:30 AM, tsugutomo.enami%jp.sony.com@localhost wrote:

> Julio Merino <jmmv%julipedia.org@localhost> writes:
> 
>> # /usr/tests/atf/test-programs/c_helpers -r /foo/bar/result \
>>  expect_exit_but_pass
>> # cat /foo/bar/result
> 
> It looks like necessary fault doesn't occur timely.
> 
> The above two commands involve following operations and two faults:
>       ubc_uiomove for write
>        uao_put(PGO_FREE)
>       ubc_uiomove for write
>       ubc_uiomove for read
> 
> When the 2nd faults occurs during 2nd ubc_uiomove for write, resulting
> file contains correct text.  On failure case, the 2nd fault occurs
> during ubc_uiomove for read.
> 
> enami.