[PATCH] Fix lazy mode vmalloc synchronization for paravirt

[PATCH] Fix lazy mode vmalloc synchronization for paravirt

[Zachary Amsden]

[-- Attachment #1: Type: text/plain, Size: 622 bytes --]

Found this looping Ubuntu installs with VMI.

If unlucky enough to hit a vmalloc sync fault during a lazy mode 
operation (from an IRQ handler for a module which was not yet populated 
in current page directory, or from inside copy_one_pte, which touches 
swap_map, and hit in an unused 4M region), the required PDE update would 
never get flushed, causing an infinite page fault loop.

This bug affects any paravirt-ops backend which uses lazy updates, I 
believe that makes it a bug in Xen, VMI and lguest.  It only happens on 
LOWMEM kernels.

Currently for 2.6.23, but we'll want to backport to -stable as well.

Zach

[-- Attachment #2: i386-linus-vmalloc-paravirt-fix.patch --]
[-- Type: text/x-patch, Size: 823 bytes --]

    Touching vmalloc memory in the middle of a lazy mode update can generate
    a kernel PDE update, which must be flushed immediately.  The fix is to
    leave lazy mode when doing a vmalloc sync.
    
    Signed-off-by: Zachary Amsden <zach@vmware.com>

diff --git a/arch/i386/mm/fault.c b/arch/i386/mm/fault.c
diff --git a/arch/i386/mm/fault.c b/arch/i386/mm/fault.c
index 01ffdd4..fcb38e7 100644
--- a/arch/i386/mm/fault.c
+++ b/arch/i386/mm/fault.c
@@ -249,9 +249,10 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
 	pmd_k = pmd_offset(pud_k, address);
 	if (!pmd_present(*pmd_k))
 		return NULL;
-	if (!pmd_present(*pmd))
+	if (!pmd_present(*pmd)) {
 		set_pmd(pmd, *pmd_k);
-	else
+		arch_flush_lazy_mmu_mode();
+	} else
 		BUG_ON(pmd_page(*pmd) != pmd_page(*pmd_k));
 	return pmd_k;
 }

Re: [PATCH] Fix lazy mode vmalloc synchronization for paravirt

[Jeremy Fitzhardinge]

Zachary Amsden wrote:
> Found this looping Ubuntu installs with VMI.
>
> If unlucky enough to hit a vmalloc sync fault during a lazy mode
> operation (from an IRQ handler for a module which was not yet
> populated in current page directory, or from inside copy_one_pte,
> which touches swap_map, and hit in an unused 4M region), the required
> PDE update would never get flushed, causing an infinite page fault loop.

Ah, good catch.

> This bug affects any paravirt-ops backend which uses lazy updates, I
> believe that makes it a bug in Xen, VMI and lguest.  It only happens
> on LOWMEM kernels. 

No, under Xen the kernel/hypervisor PMD is not shared between processes,
so this is still used when PAE is enabled.

    J

Re: [PATCH] Fix lazy mode vmalloc synchronization for paravirt

[Zachary Amsden]

Jeremy Fitzhardinge wrote:
> No, under Xen the kernel/hypervisor PMD is not shared between processes,
> so this is still used when PAE is enabled.
>   

Ahh, yes.  So this was a lucky catch for us.  Non-PAE kernels seem to be 
increasing in value at antique sales.

Zach