DDE Linux struct page object aliasing

[cnuke]

Due to the way the memory-allocation code is currently implemented and the struct page object handling is integrate aliasing that has unexpected side-effects can occur. Since struct page objects are created for a page-size aligned address [1] when requested, allocations that fall within the same virtual page address range share the same object.

Such objects are created lazy and and life-time management is only performed via ref-counting when the page API [2] (alloc_pages, free_pages etc.) is used. Since the current implementation removes struct page objects [3] when performing allocations still referenced objects can become invalid and can be corrupted as the memory is re-used.

[1]

genode/repos/dde_linux/src/lib/lx_emul/virt_to_page.c

Lines 20 to 37 in 7377166

	struct page *lx_emul_virt_to_pages(void const *virt, unsigned long count)
	{
	/* sanitize argument */
	void * const page_aligned_virt = (void *)((uintptr_t)virt & PAGE_MASK);
	struct page *page = lx_emul_associated_page(page_aligned_virt, 1);
	if (!page) {
	unsigned long i;
	struct page * p = kzalloc(sizeof(struct page)*count, 0);
	page = p;
	for (i = 0; i < count; i++, p++) {
	p->virtual = (void*)((uintptr_t)page_aligned_virt + i*PAGE_SIZE);
	init_page_count(p);
	lx_emul_associate_page_with_virt_addr(p, p->virtual);
	}
	}

[2] shadow/mmc/page_alloc.c

[3]

genode/repos/dde_linux/src/lib/lx_emul/alloc.cc

Lines 20 to 25 in 7377166

	extern "C" void * lx_emul_mem_alloc_aligned(unsigned long size, unsigned long align)
	{
	void * const ptr = Lx_kit::env().memory.alloc(size, align);
	lx_emul_forget_pages(ptr, size);
	return ptr;
	};

[nfeske]

Fixed in Genode 23.11.

[chelmuth]

The real fix is still not merged.

[chelmuth]

Commit cfe7915 implements page-struct management per DMA buffer. Repositories for allwinner, imx, rpi, and zynq were also adapted for the change. NOw I cross fingers for nightly. Also, any test results for Pinephone and MNT Reform are much appreciated.

[cnuke]

@chelmuth please merge 1dadb8f and b337484 to the corresponding staging branches as they contained the needed adaptation to the used_apis file of the graphics drivers.

[cnuke]

I briefly tested the glmark2 preset on the PinePhone with the current staging branch. It works with the page-struct commits but after the sixth scenario the gpu driver fails to upgrade the Platform session and issues a RAM resource request of 16M. When I revert cfe7915 and 06b00b5 it finishes successfully without any resource request.

I can look into that later this week.

[cnuke]

@chelmuth commit 74c561f appears to solve the unexpected memory consumption. I'll will give the MNT Reform 2 a spin next.

[cnuke]

The MNT Reform 2 also plays ball if the aforementioned fixup is applied (otherwise the imx8mq_gpu_drvrequests more caps).