Hello,

I observed a race condition in Fiasco.OC. My environment is very complicated, but basically I have multiple threads, and each thread keep creating kernel object via l4_factory_create_xxxx and map the object to a new task.

Here is the trace I got:

//printed from obj_space-virt.cpp in function caps_alloc:

Chen: caps_alloc for virt addr 0xf0826000 (index 0x2600), new cap location 0xfeb04000, [virt 0xf0826000-> mem 0xfeb04000] in space 0xfedd7f08
Chen: caps_alloc for virt addr 0xf0826010 (index 0x2601), new cap location 0xfeb05000, [virt 0xf0826000-> mem 0xfeb05000] in space 0xfedd7f08
Chen: v_insert cap 0xfed5a6a0 (index 0x2600 (entry addr 0xfeb04000) in space 0xfedd7f08
Chen: v_insert cap 0xfeb000b4 (index 0x2601) (entry addr 0xfeb05010) in space 0xfedd7f08

//printed from map_util
thread 0xfed4c000: v_fabricate is false: (Obj_space) from [0xfedd7ef4/12], s_phys 0x0: 00002601 size: 00000001 to [0xfedd7e9c/18] recv addr 0x2541

// then I got
KERNEL: Warning: nothing mapped: (Obj_space) from [0xfedd7ef4/12]: 00002602 size: 00000001 to [0xfedd7e9c/18] recv addr 0x2542
Omnicore Panic: task map failed!

Basically, different object index (2600 and 2601) causes two different page to be created and mapped to the same cap_table virtual address 0xf0826000. Although one of the mapping
will fail, but the current logic did not return the correct address.

The fix I put in to solve this problem is to add the following lines after the switch statement in caps_alloc function:

if (s != Insert_ok ) {
      Mapped_allocator::allocator()->q_unaligned_free(ram_quota(),
          Config::PAGE_SIZE, mem);
      mem= alien_lookup(virt & ~(Config::PAGE_SIZE/sizeof(Entry)-1));
}

Please let me know if this is correct. Thanks.

Even with this fix, I still got another kernel "nothing mapped error" when I ask each thread not only to create and map kernel objects, but also to delete objects using l4_task_unmap. If I do not use l4_task_unmap, everything is fine. I am still investigating why, but I got a feeling that there may be other race conditions on the cap_table related operations.

Best,
Chen