Bug 769469

Summary: Bug in bt_ioremap on i386 kernel
Product: Red Hat Enterprise Linux 5 Reporter: jordan hargrave <jordan_hargrave>
Component: kernelAssignee: Larry Woodman <lwoodman>
Status: CLOSED WONTFIX QA Contact: Red Hat Kernel QE team <kernel-qe>
Severity: high Docs Contact:
Priority: unspecified    
Version: 5.8CC: jordan_hargrave, lwoodman
Target Milestone: rcFlags: pm-rhel: needinfo? (jordan_hargrave)
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-02 13:01:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description jordan hargrave 2011-12-20 22:58:26 UTC
Description of problem:

bt_ioremap does not calculate # of pages correctly for a boundary condition.
On systems with SMBIOS/DMI table length of 0x1001, only one page is mapped instead of two.  This causes a 'Unknown interrupt or fault at EIP 00000060 xxxxxx xxxxxx' error message to appear.

Version-Release number of selected component (if applicable):
5.x (reproduced on 5.7 and 5.8 beta kernels)

How reproducible: 
always


Steps to Reproduce:
1. BIOS with SMBIOS Table Length of 0x1001
2. Install RHEL5.x 32-bit kernel
3.
  
Actual results:
System spews error messages 'Unknown interrupt or fault at eip 00000060 xxxxxxxx xxxxxxxx'

Expected results:
System boots properly

Additional info:
This is a boundary condition, it only occurs if the SMBIOS (or any other function that calls bt_ioremap with size == 0xZ001)

Error is line #305: size gets set to 0x0fff instead of 0x1001

283 void __init *bt_ioremap(unsigned long phys_addr, unsigned long size)

284 {

285         unsigned long offset, last_addr;

286         unsigned int nrpages;

287         enum fixed_addresses idx;

288 

289         /* Don't allow wraparound or zero size */

290         last_addr = phys_addr + size - 1;

291         if (!size || last_addr < phys_addr)

292                 return NULL;

293 

294         /*

295          * Don't remap the low PCI/ISA area, it's always mapped..

296          */

297         if (phys_addr >= ISA_START_ADDRESS && last_addr < ISA_END_ADDRESS)

298                 return phys_to_virt(phys_addr);

299 

300         /*

301          * Mappings have to be page-aligned

302          */

303         offset = phys_addr & ~PAGE_MASK;

304         phys_addr &= PAGE_MASK;

305         size = PAGE_ALIGN(last_addr) - phys_addr;

306 

307         /*

308          * Mappings have to fit in the FIX_BTMAP area.

309          */

310         nrpages = size >> PAGE_SHIFT;

Comment 1 RHEL Program Management 2014-03-07 13:33:01 UTC
This bug/component is not included in scope for RHEL-5.11.0 which is the last RHEL5 minor release. This Bugzilla will soon be CLOSED as WONTFIX (at the end of RHEL5.11 development phase (Apr 22, 2014)). Please contact your account manager or support representative in case you need to escalate this bug.

Comment 2 RHEL Program Management 2014-06-02 13:01:49 UTC
Thank you for submitting this request for inclusion in Red Hat Enterprise Linux 5. We've carefully evaluated the request, but are unable to include it in RHEL5 stream. If the issue is critical for your business, please provide additional business justification through the appropriate support channels (https://access.redhat.com/site/support).