From: David Miller <davem@davemloft.net> To: nitin.m.gupta@oracle.com Cc: sparclinux@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: sparc64 MM regression... Date: Thu, 15 Mar 2018 16:00:30 -0400 (EDT) [thread overview] Message-ID: <20180315.160030.601332550949971028.davem@davemloft.net> (raw) In-Reply-To: <20180315.152815.1012910593389921933.davem@davemloft.net> From: David Miller <davem@davemloft.net> Date: Thu, 15 Mar 2018 15:28:15 -0400 (EDT) > > So I bisected a userspace corruption regression down to commit: > > commit a8e654f01cb725d0bfd741ebca1bf4c9337969cc > Author: Nitin Gupta <nitin.m.gupta@oracle.com> > Date: Wed Jan 31 16:18:09 2018 -0800 > > sparc64: update pmdp_invalidate() to return old pmd value > > The transformation is basically from a set_pte_at() call into > an atomic cmpxchg64() loop to set the pmd. > > The problem is that set_pmd_at() does more than just assign > the pmd entry. > > It also does some accounting and also queues up a batch TLB > flush entry. > > So the side effect of this change is that the TLB is never > flushed for these changed PMDs, and thus the userland memory > corruption I was seeing. This seems to do the trick: diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c index 847ddff..b5cfab7 100644 --- a/arch/sparc/mm/tlb.c +++ b/arch/sparc/mm/tlb.c @@ -163,13 +163,10 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr, pte_unmap(pte); } -void set_pmd_at(struct mm_struct *mm, unsigned long addr, - pmd_t *pmdp, pmd_t pmd) -{ - pmd_t orig = *pmdp; - - *pmdp = pmd; +static void __set_pmd_acct(struct mm_struct *mm, unsigned long addr, + pmd_t orig, pmd_t pmd) +{ if (mm == &init_mm) return; @@ -219,6 +216,15 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, } } +void set_pmd_at(struct mm_struct *mm, unsigned long addr, + pmd_t *pmdp, pmd_t pmd) +{ + pmd_t orig = *pmdp; + + *pmdp = pmd; + __set_pmd_acct(mm, addr, orig, pmd); +} + static inline pmd_t pmdp_establish(struct vm_area_struct *vma, unsigned long address, pmd_t *pmdp, pmd_t pmd) { @@ -227,6 +233,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma, do { old = *pmdp; } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd); + __set_pmd_acct(vma->vm_mm, address, old, pmd); return old; }
WARNING: multiple messages have this Message-ID (diff)
From: David Miller <davem@davemloft.net> To: nitin.m.gupta@oracle.com Cc: sparclinux@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: sparc64 MM regression... Date: Thu, 15 Mar 2018 20:00:30 +0000 [thread overview] Message-ID: <20180315.160030.601332550949971028.davem@davemloft.net> (raw) In-Reply-To: <20180315.152815.1012910593389921933.davem@davemloft.net> From: David Miller <davem@davemloft.net> Date: Thu, 15 Mar 2018 15:28:15 -0400 (EDT) > > So I bisected a userspace corruption regression down to commit: > > commit a8e654f01cb725d0bfd741ebca1bf4c9337969cc > Author: Nitin Gupta <nitin.m.gupta@oracle.com> > Date: Wed Jan 31 16:18:09 2018 -0800 > > sparc64: update pmdp_invalidate() to return old pmd value > > The transformation is basically from a set_pte_at() call into > an atomic cmpxchg64() loop to set the pmd. > > The problem is that set_pmd_at() does more than just assign > the pmd entry. > > It also does some accounting and also queues up a batch TLB > flush entry. > > So the side effect of this change is that the TLB is never > flushed for these changed PMDs, and thus the userland memory > corruption I was seeing. This seems to do the trick: diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c index 847ddff..b5cfab7 100644 --- a/arch/sparc/mm/tlb.c +++ b/arch/sparc/mm/tlb.c @@ -163,13 +163,10 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr, pte_unmap(pte); } -void set_pmd_at(struct mm_struct *mm, unsigned long addr, - pmd_t *pmdp, pmd_t pmd) -{ - pmd_t orig = *pmdp; - - *pmdp = pmd; +static void __set_pmd_acct(struct mm_struct *mm, unsigned long addr, + pmd_t orig, pmd_t pmd) +{ if (mm = &init_mm) return; @@ -219,6 +216,15 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, } } +void set_pmd_at(struct mm_struct *mm, unsigned long addr, + pmd_t *pmdp, pmd_t pmd) +{ + pmd_t orig = *pmdp; + + *pmdp = pmd; + __set_pmd_acct(mm, addr, orig, pmd); +} + static inline pmd_t pmdp_establish(struct vm_area_struct *vma, unsigned long address, pmd_t *pmdp, pmd_t pmd) { @@ -227,6 +233,7 @@ static inline pmd_t pmdp_establish(struct vm_area_struct *vma, do { old = *pmdp; } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd); + __set_pmd_acct(vma->vm_mm, address, old, pmd); return old; }
next prev parent reply other threads:[~2018-03-15 20:00 UTC|newest] Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-03-15 19:28 sparc64 MM regression David Miller 2018-03-15 19:28 ` David Miller 2018-03-15 20:00 ` David Miller [this message] 2018-03-15 20:00 ` David Miller
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180315.160030.601332550949971028.davem@davemloft.net \ --to=davem@davemloft.net \ --cc=linux-kernel@vger.kernel.org \ --cc=nitin.m.gupta@oracle.com \ --cc=sparclinux@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.