From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from merlin.infradead.org ([205.233.59.134]:55114 "EHLO merlin.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729453AbfLKMcE (ORCPT ); Wed, 11 Dec 2019 07:32:04 -0500 Message-ID: <20191211122956.169764611@infradead.org> Date: Wed, 11 Dec 2019 13:07:22 +0100 From: Peter Zijlstra Subject: [PATCH 09/17] sh/tlb: Fix __pmd_free_tlb() References: <20191211120713.360281197@infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-arch-owner@vger.kernel.org List-ID: To: Will Deacon , "Aneesh Kumar K.V" , Andrew Morton , Nick Piggin , Peter Zijlstra Cc: linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Yoshinori Sato , Rich Felker , "David S. Miller" , Helge Deller , Geert Uytterhoeven , Paul Burton , Tony Luck , Richard Henderson , Nick Hu , Paul Walmsley Message-ID: <20191211120722._rsG4KksA8oQv76i2g7bSCmZXPGkhZnVThRoTeUSW-s@z> SH violates the freeing order for it's PMD page directories. It's __pmd_free_tlb() does not ensure there is a TLB invalidation between itself and the eventualy freeing of the page. Further complicating the situation is that SH uses non page based allocation for it's PMDs. Use the shiny new HAVE_TABLE_FREE option to enable a custom page table freeer. (SuperH uses IPI based TLB invalidation and therefore doesn't need HAVE_RCU_TABLE_FREE for its HAVE_FAST_GUP). Signed-off-by: Peter Zijlstra (Intel) --- arch/sh/Kconfig | 1 + arch/sh/include/asm/pgalloc.h | 3 ++- arch/sh/mm/pgtable.c | 6 ++++++ 3 files changed, 9 insertions(+), 1 deletion(-) --- a/arch/sh/Kconfig +++ b/arch/sh/Kconfig @@ -15,6 +15,7 @@ config SUPERH select HAVE_PERF_EVENTS select HAVE_DEBUG_BUGVERBOSE select HAVE_FAST_GUP if MMU + select MMU_GATHER_TABLE_FREE if X2TLB select ARCH_HAVE_CUSTOM_GPIO_H select ARCH_HAVE_NMI_SAFE_CMPXCHG if (GUSA_RB || CPU_SH4A) select ARCH_HAS_GCOV_PROFILE_ALL --- a/arch/sh/include/asm/pgalloc.h +++ b/arch/sh/include/asm/pgalloc.h @@ -12,7 +12,8 @@ extern void pgd_free(struct mm_struct *m extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd); extern pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address); extern void pmd_free(struct mm_struct *mm, pmd_t *pmd); -#define __pmd_free_tlb(tlb, pmdp, addr) pmd_free((tlb)->mm, (pmdp)) +extern void __tlb_remove_table(void *table); +#define __pmd_free_tlb(tlb, pmdp, addr) tlb_remove_table((tlb), (pmdp)) #endif static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd, --- a/arch/sh/mm/pgtable.c +++ b/arch/sh/mm/pgtable.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 #include #include +#include #define PGALLOC_GFP GFP_KERNEL | __GFP_ZERO @@ -55,4 +56,9 @@ void pmd_free(struct mm_struct *mm, pmd_ { kmem_cache_free(pmd_cachep, pmd); } + +void __tlb_remove_table(void *table) +{ + pmd_free(NULL, table); +} #endif /* PAGETABLE_LEVELS > 2 */