| From 12b9d7ccb841805e347fec8f733f368f43ddba40 Mon Sep 17 00:00:00 2001 |
| From: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca> |
| Date: Wed, 1 Jul 2009 17:37:22 -0400 |
| Subject: x86: Fix fixmap page order for FIX_TEXT_POKE0,1 |
| |
| From: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca> |
| |
| commit 12b9d7ccb841805e347fec8f733f368f43ddba40 upstream. |
| |
| Masami reported: |
| |
| > Since the fixmap pages are assigned higher address to lower, |
| > text_poke() has to use it with inverted order (FIX_TEXT_POKE1 |
| > to FIX_TEXT_POKE0). |
| |
| I prefer to just invert the order of the fixmap declaration. |
| It's simpler and more straightforward. |
| |
| Backward fixmaps seems to be used by both x86 32 and 64. |
| |
| It's really rare but a nasty bug, because it only hurts when |
| instructions to patch are crossing a page boundary. If this |
| happens, the fixmap write accesses will spill on the following |
| fixmap, which may very well crash the system. And this does not |
| crash the system, it could leave illegal instructions in place. |
| Thanks Masami for finding this. |
| |
| It seems to have crept into the 2.6.30-rc series, so this calls |
| for a -stable inclusion. |
| |
| Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca> |
| Acked-by: Masami Hiramatsu <mhiramat@redhat.com> |
| LKML-Reference: <20090701213722.GH19926@Krystal> |
| Signed-off-by: Ingo Molnar <mingo@elte.hu> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| arch/x86/include/asm/fixmap.h | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/arch/x86/include/asm/fixmap.h |
| +++ b/arch/x86/include/asm/fixmap.h |
| @@ -111,8 +111,8 @@ enum fixed_addresses { |
| #ifdef CONFIG_PARAVIRT |
| FIX_PARAVIRT_BOOTMAP, |
| #endif |
| - FIX_TEXT_POKE0, /* reserve 2 pages for text_poke() */ |
| - FIX_TEXT_POKE1, |
| + FIX_TEXT_POKE1, /* reserve 2 pages for text_poke() */ |
| + FIX_TEXT_POKE0, /* first page is last, because allocation is backward */ |
| __end_of_permanent_fixed_addresses, |
| /* |
| * 256 temporary boot-time mappings, used by early_ioremap(), |
