Package: linux-image-2.6.18-4-xen-686
Version: 2.6.18.dfsg.1-12
Severity: normal
Tags: patch
We're seeing some issues with the RHEL5 32b xen kernel that are leading
to frequent XenRT failures. Guests crash during boot when the host has
>4GB of RAM with alarmingly high probability.
The problem is that trying to clear a pte by setting it to PFN 0 can
potentially cause the entry to be temporarily invalid since it writes
the upper word first (i.e. the PTE remains present). It also not correct
to launder the 0 through p2m which set_pte will do. The combination of
these causes a crash when swapper_pg_dir and PFN 0 have MFNs on opposite
sides of the 4G boundary.
The attached patch fixes the problem. This is from:
http://xenbits.xensource.com/xen-unstable.hg?cs=c6efd6c2feaa
The same bug was reported against RHEL5 here:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=234375
Thanks,
Ian.
-- System Information:
Debian Release: 4.0
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-3-amd64
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
# HG changeset patch
# User [EMAIL PROTECTED]
# Date 1163425074 0
# Node ID c6efd6c2feaa3ec851685cc872a1ce989d998220
# Parent 16977bd93dbebe30060e4b4462938f21f5b14275
[LINUX] Fix clear_fixmap().
On i386-PAE, clear_fixmap() results in ill use of set_pte(). In all
contexts, p2m translations shouldn't occur here. Note that this is not
really an issue on native linux, as there is
(a) no pfn-to-mfn translation and
(b) __set_fixmap() takes an unsigned long physical address rather than
a paddr_t, which makes it so that bits 32 and up of the physical
address are always zero, permitting either order store when
clearing the entry.
Signed-off-by: Jan Beulich <[EMAIL PROTECTED]>
diff -r 16977bd93dbe -r c6efd6c2feaa
linux-2.6-xen-sparse/arch/i386/mm/pgtable-xen.c
--- a/linux-2.6-xen-sparse/arch/i386/mm/pgtable-xen.c Mon Nov 13 12:06:21
2006 +0000
+++ b/linux-2.6-xen-sparse/arch/i386/mm/pgtable-xen.c Mon Nov 13 13:37:54
2006 +0000
@@ -102,8 +102,11 @@ static void set_pte_pfn(unsigned long va
return;
}
pte = pte_offset_kernel(pmd, vaddr);
- /* <pfn,flags> stored as-is, to permit clearing entries */
- set_pte(pte, pfn_pte(pfn, flags));
+ if (pgprot_val(flags))
+ /* <pfn,flags> stored as-is, to permit clearing entries */
+ set_pte(pte, pfn_pte(pfn, flags));
+ else
+ pte_clear(&init_mm, vaddr, pte);
/*
* It's enough to flush this one mapping.
@@ -140,8 +143,11 @@ static void set_pte_pfn_ma(unsigned long
return;
}
pte = pte_offset_kernel(pmd, vaddr);
- /* <pfn,flags> stored as-is, to permit clearing entries */
- set_pte(pte, pfn_pte_ma(pfn, flags));
+ if (pgprot_val(flags))
+ /* <pfn,flags> stored as-is, to permit clearing entries */
+ set_pte(pte, pfn_pte_ma(pfn, flags));
+ else
+ pte_clear(&init_mm, vaddr, pte);
/*
* It's enough to flush this one mapping.
diff -r 16977bd93dbe -r c6efd6c2feaa
linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c
--- a/linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c Mon Nov 13 12:06:21
2006 +0000
+++ b/linux-2.6-xen-sparse/arch/x86_64/mm/init-xen.c Mon Nov 13 13:37:54
2006 +0000
@@ -260,7 +260,10 @@ static void set_pte_phys(unsigned long v
return;
}
}
- new_pte = pfn_pte(phys >> PAGE_SHIFT, prot);
+ if (pgprot_val(prot))
+ new_pte = pfn_pte(phys >> PAGE_SHIFT, prot);
+ else
+ new_pte = __pte(0);
pte = pte_offset_kernel(pmd, vaddr);
if (!pte_none(*pte) &&
