[PATCH] the page count of buddy seems to be buggy under no MMU

[zhan rongkai <zhanrk@gmail.com>]

This set_page_refs() function is copied from linux-2.6.10 mm/page_alloc.c

static inline void set_page_refs(struct page *page, int order)
{
#ifdef CONFIG_MMU
	set_page_count(page, 1);
#else
	int i;

	/*
	 * We need to reference all the pages for this order, otherwise if
	 * anyone accesses one of the pages with (get/put) it will be freed.
	 */
	for (i = 0; i < (1 << order); i++)
		set_page_count(page+i, 1);
#endif /* CONFIG_MMU */
}

So when we are under no MMU, the __free_pages() function also should
de-reference all the pages for this order (order > 0), too. However,
the current __free_pages() only decrements the first page's refcount,
which will cause __free_pages_ok() to dump stack!

---------------------------------------------------------

--- linux-2.6.10.orig/mm/page_alloc.c	2004-12-25 05:33:51.000000000 +0800
+++ linux-2.6.10/mm/page_alloc.c	2005-01-21 17:14:08.000000000 +0800
@@ -786,6 +786,8 @@
 		free_hot_cold_page(pvec->pages[i], pvec->cold);
 }
 
+#ifdef CONFIG_MMU
+
 fastcall void __free_pages(struct page *page, unsigned int order)
 {
 	if (!PageReserved(page) && put_page_testzero(page)) {
@@ -796,6 +798,35 @@
 	}
 }
 
+#else
+
+fastcall void __free_pages(struct page *page, unsigned int order)
+{
+	if (PageReserved(page))
+		return;
+	
+	if (order == 0) {
+		if (put_page_testzero(page))
+			free_hot_page(page);
+	} else {
+		int i, result = 0;
+		
+		/*
+		 * We need to de-reference all the pages for this order -- see
set_page_refs()
+		 */
+		for (i = 0; i < (1 << order); i++)
+			result += put_page_testzero(page + i);
+		
+		if (result) {
+			if (result != (1 << order))
+				BUG();
+			__free_pages_ok(page, order);
+		}
+	}
+}
+
+#endif /* CONFIG_MMU */
+
 EXPORT_SYMBOL(__free_pages);
 
 fastcall void free_pages(unsigned long addr, unsigned int order)

-- 
Rongkai Zhan