v4.4 backport for f045402984404ddc "s390/mm: fix gmap tlb flush issues"

v4.4 backport for f045402984404ddc "s390/mm: fix gmap tlb flush issues"

[Martin Schwidefsky]

commit f045402984404ddc11016358411e445192919047 upstream.

The backport for v4.4 differs from the upstream patch because
some of the patched code has been moved to new files.

commit f045402984404ddc11016358411e445192919047
Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
Date:   Thu Jul 7 10:44:10 2016 +0200

    s390/mm: fix gmap tlb flush issues
    
    __tlb_flush_asce() should never be used if multiple asce belong to a mm.
    
    As this function changes mm logic determining if local or global tlb
    flushes will be neded, we might end up flushing only the gmap asce on all
    CPUs and a follow up mm asce flushes will only flush on the local CPU,
    although that asce ran on multiple CPUs.
    
    The missing tlb flushes will provoke strange faults in user space and even
    low address protections in user space, crashing the kernel.
    
    Fixes: 1b948d6caec4 ("s390/mm,tlb: optimize TLB flushing for zEC12")
    Cc: stable@vger.kernel.org # 3.15+
    Reported-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
    Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
---
 arch/s390/include/asm/tlbflush.h | 3 ++-
 arch/s390/mm/pgtable.c           | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
index ca148f7..eb21203 100644
--- a/arch/s390/include/asm/tlbflush.h
+++ b/arch/s390/include/asm/tlbflush.h
@@ -81,7 +81,8 @@ static inline void __tlb_flush_full(struct mm_struct *mm)
 }
 
 /*
- * Flush TLB entries for a specific ASCE on all CPUs.
+ * Flush TLB entries for a specific ASCE on all CPUs. Should never be used
+ * when more than one asce (e.g. gmap) ran on this mm.
  */
 static inline void __tlb_flush_asce(struct mm_struct *mm, unsigned long asce)
 {
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 54ef3bc..3bf55ae 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -195,7 +195,7 @@ EXPORT_SYMBOL_GPL(gmap_alloc);
 static void gmap_flush_tlb(struct gmap *gmap)
 {
 	if (MACHINE_HAS_IDTE)
-		__tlb_flush_asce(gmap->mm, gmap->asce);
+		__tlb_flush_idte(gmap->asce);
 	else
 		__tlb_flush_global();
 }
@@ -234,7 +234,7 @@ void gmap_free(struct gmap *gmap)
 
 	/* Flush tlb. */
 	if (MACHINE_HAS_IDTE)
-		__tlb_flush_asce(gmap->mm, gmap->asce);
+		__tlb_flush_idte(gmap->asce);
 	else
 		__tlb_flush_global();
 
-- 
2.8.4

Re: v4.4 backport for f045402984404ddc "s390/mm: fix gmap tlb flush issues"

[Michal Hocko]

I guess the proper form of the changelog is. Thanks for the backport!
---
>From dac9a368f485e74e23fd55113ee44e7a30d1df68 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <dahi@linux.vnet.ibm.com>
Date: Tue, 25 Oct 2016 10:50:55 +0200
Subject: [PATCH] s390/mm: fix gmap tlb flush issues

commit f045402984404ddc11016358411e445192919047 upstream.

__tlb_flush_asce() should never be used if multiple asce belong to a mm.

As this function changes mm logic determining if local or global tlb
flushes will be neded, we might end up flushing only the gmap asce on all
CPUs and a follow up mm asce flushes will only flush on the local CPU,
although that asce ran on multiple CPUs.

The missing tlb flushes will provoke strange faults in user space and even
low address protections in user space, crashing the kernel.

[schwidefsky@de.ibm.com: backport to 4.4, handle moved files]
Fixes: 1b948d6caec4 ("s390/mm,tlb: optimize TLB flushing for zEC12")
Cc: stable@vger.kernel.org # 3.15+
Reported-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
---
 arch/s390/include/asm/tlbflush.h | 3 ++-
 arch/s390/mm/pgtable.c           | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
index a2e6ef32e054..0a2031618f7f 100644
--- a/arch/s390/include/asm/tlbflush.h
+++ b/arch/s390/include/asm/tlbflush.h
@@ -81,7 +81,8 @@ static inline void __tlb_flush_full(struct mm_struct *mm)
 }
 
 /*
- * Flush TLB entries for a specific ASCE on all CPUs.
+ * Flush TLB entries for a specific ASCE on all CPUs. Should never be used
+ * when more than one asce (e.g. gmap) ran on this mm.
  */
 static inline void __tlb_flush_asce(struct mm_struct *mm, unsigned long asce)
 {
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 471a370a527b..8345ae1f117d 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -166,7 +166,7 @@ EXPORT_SYMBOL_GPL(gmap_alloc);
 static void gmap_flush_tlb(struct gmap *gmap)
 {
 	if (MACHINE_HAS_IDTE)
-		__tlb_flush_asce(gmap->mm, gmap->asce);
+		__tlb_flush_idte(gmap->asce);
 	else
 		__tlb_flush_global();
 }
@@ -205,7 +205,7 @@ void gmap_free(struct gmap *gmap)
 
 	/* Flush tlb. */
 	if (MACHINE_HAS_IDTE)
-		__tlb_flush_asce(gmap->mm, gmap->asce);
+		__tlb_flush_idte(gmap->asce);
 	else
 		__tlb_flush_global();
 
-- 
2.9.3
-- 
Michal Hocko
SUSE Labs

Re: v4.4 backport for f045402984404ddc "s390/mm: fix gmap tlb flush issues"

[Greg KH]

On Tue, Oct 25, 2016 at 10:50:55AM +0200, Martin Schwidefsky wrote:
> commit f045402984404ddc11016358411e445192919047 upstream.
> 
> The backport for v4.4 differs from the upstream patch because
> some of the patched code has been moved to new files.

Now applied, thanks.

greg k-h