86f40622af
When enable LPAE and big-endian in a hisilicon board, while specify mem=384M mem=512M@7680M, will get bad page state: Freeing unused kernel memory: 180K (c0466000 - c0493000) BUG: Bad page state in process init pfn:fa442 page:c7749840 count:0 mapcount:-1 mapping: (null) index:0x0 page flags: 0x40000400(reserved) Modules linked in: CPU: 0 PID: 1 Comm: init Not tainted 3.10.27+ #66 [<c000f5f0>] (unwind_backtrace+0x0/0x11c) from [<c000cbc4>] (show_stack+0x10/0x14) [<c000cbc4>] (show_stack+0x10/0x14) from [<c009e448>] (bad_page+0xd4/0x104) [<c009e448>] (bad_page+0xd4/0x104) from [<c009e520>] (free_pages_prepare+0xa8/0x14c) [<c009e520>] (free_pages_prepare+0xa8/0x14c) from [<c009f8ec>] (free_hot_cold_page+0x18/0xf0) [<c009f8ec>] (free_hot_cold_page+0x18/0xf0) from [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) from [<c00b6458>] (handle_mm_fault+0xf4/0x120) [<c00b6458>] (handle_mm_fault+0xf4/0x120) from [<c0013754>] (do_page_fault+0xfc/0x354) [<c0013754>] (do_page_fault+0xfc/0x354) from [<c0008400>] (do_DataAbort+0x2c/0x90) [<c0008400>] (do_DataAbort+0x2c/0x90) from [<c0008fb4>] (__dabt_usr+0x34/0x40) The bad pfn:fa442 is not system memory(mem=384M mem=512M@7680M), after debugging, I find in page fault handler, will get wrong pfn from pte just after set pte, as follow: do_anonymous_page() { ... set_pte_at(mm, address, page_table, entry); //debug code pfn = pte_pfn(entry); pr_info("pfn:0x%lx, pte:0x%llxn", pfn, pte_val(entry)); //read out the pte just set new_pte = pte_offset_map(pmd, address); new_pfn = pte_pfn(*new_pte); pr_info("new pfn:0x%lx, new pte:0x%llxn", pfn, pte_val(entry)); ... } pfn: 0x1fa4f5, pte:0xc00001fa4f575f new_pfn:0xfa4f5, new_pte:0xc00000fa4f5f5f //new pfn/pte is wrong. The bug is happened in cpu_v7_set_pte_ext(ptep, pte): An LPAE PTE is a 64bit quantity, passed to cpu_v7_set_pte_ext in the r2 and r3 registers. On an LE kernel, r2 contains the LSB of the PTE, and r3 the MSB. On a BE kernel, the assignment is reversed. Unfortunately, the current code always assumes the LE case, leading to corruption of the PTE when clearing/setting bits. This patch fixes this issue much like it has been done already in the cpu_v7_switch_mm case. CC stable <stable@vger.kernel.org> Signed-off-by: Jianguo Wu <wujianguo@huawei.com> Acked-by: Marc Zyngier <marc.zyngier@arm.com> Acked-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> |
||
---|---|---|
.. | ||
abort-ev4.S | ||
abort-ev4t.S | ||
abort-ev5t.S | ||
abort-ev5tj.S | ||
abort-ev6.S | ||
abort-ev7.S | ||
abort-lv4t.S | ||
abort-macro.S | ||
abort-nommu.S | ||
alignment.c | ||
cache-aurora-l2.h | ||
cache-fa.S | ||
cache-feroceon-l2.c | ||
cache-l2x0.c | ||
cache-nop.S | ||
cache-tauros2.c | ||
cache-tauros3.h | ||
cache-v4.S | ||
cache-v4wb.S | ||
cache-v4wt.S | ||
cache-v6.S | ||
cache-v7.S | ||
cache-xsc3l2.c | ||
context.c | ||
copypage-fa.c | ||
copypage-feroceon.c | ||
copypage-v4mc.c | ||
copypage-v4wb.c | ||
copypage-v4wt.c | ||
copypage-v6.c | ||
copypage-xsc3.c | ||
copypage-xscale.c | ||
dma-mapping.c | ||
dump.c | ||
extable.c | ||
fault-armv.c | ||
fault.c | ||
fault.h | ||
flush.c | ||
fsr-2level.c | ||
fsr-3level.c | ||
highmem.c | ||
hugetlbpage.c | ||
idmap.c | ||
init.c | ||
iomap.c | ||
ioremap.c | ||
Kconfig | ||
Makefile | ||
mm.h | ||
mmap.c | ||
mmu.c | ||
nommu.c | ||
pabort-legacy.S | ||
pabort-v6.S | ||
pabort-v7.S | ||
pgd.c | ||
proc-arm7tdmi.S | ||
proc-arm9tdmi.S | ||
proc-arm720.S | ||
proc-arm740.S | ||
proc-arm920.S | ||
proc-arm922.S | ||
proc-arm925.S | ||
proc-arm926.S | ||
proc-arm940.S | ||
proc-arm946.S | ||
proc-arm1020.S | ||
proc-arm1020e.S | ||
proc-arm1022.S | ||
proc-arm1026.S | ||
proc-fa526.S | ||
proc-feroceon.S | ||
proc-macros.S | ||
proc-mohawk.S | ||
proc-sa110.S | ||
proc-sa1100.S | ||
proc-syms.c | ||
proc-v6.S | ||
proc-v7-2level.S | ||
proc-v7-3level.S | ||
proc-v7.S | ||
proc-v7m.S | ||
proc-xsc3.S | ||
proc-xscale.S | ||
tcm.h | ||
tlb-fa.S | ||
tlb-v4.S | ||
tlb-v4wb.S | ||
tlb-v4wbi.S | ||
tlb-v6.S | ||
tlb-v7.S |