Linux-MIPS Archive on
 help / Atom feed
From: Jiwei Sun <>
To: <>, <>,
Cc: <>, <>,
Subject: [PATCH] MIPS: reset all task's asid to 0 after asid_cache(cpu) overflows
Date: Sun, 5 Mar 2017 11:24:20 +0800
Message-ID: <> (raw)

If asid_cache(cpu) overflows, there may be two tasks with the same
asid. It is a risk that the two different tasks may have the same
address space.

A process will update its asid to newer version only when switch_mm()
is called and matches the following condition:
    if ((cpu_context(cpu, next) ^ asid_cache(cpu))
                    & asid_version_mask(cpu))
            get_new_mmu_context(next, cpu);
If asid_cache(cpu) overflows, cpu_context(cpu,next) and asid_cache(cpu)
will be reset to asid_first_version(cpu), and start a new cycle. It
can result in two tasks that have the same ASID in the process list.

For example, in CONFIG_CPU_MIPS32_R2, task named A's asid on CPU1 is
0x100, and has been sleeping and been not scheduled. After a long period
of time, another running task named B's asid on CPU1 is 0xffffffff, and
asid cached in the CPU1 is 0xffffffff too, next task named C is forked,
when schedule from B to C on CPU1, asid_cache(cpu) will overflow, so C's
asid on CPU1 will be 0x100 according to get_new_mmu_context(). A's asid
is the same as C, if now A is rescheduled on CPU1, A's asid is not able
to renew according to 'if' clause, and the local TLB entry can't be
flushed too, A's address space will be the same as C.

If asid_cache(cpu) overflows, all of user space task's asid on this CPU
are able to set a invalid value (such as 0), it will avoid the risk.

Signed-off-by: Jiwei Sun <>
 arch/mips/include/asm/mmu_context.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index ddd57ad..1f60efc 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -108,8 +108,15 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
 		local_flush_tlb_all();	/* start new asid cycle */
-		if (!asid)		/* fix version if needed */
+		if (!asid) {		/* fix version if needed */
+			struct task_struct *p;
+			for_each_process(p) {
+				if ((p->mm))
+					cpu_context(cpu, p->mm) = 0;
+			}
 			asid = asid_first_version(cpu);
+		}
 	cpu_context(cpu, mm) = asid_cache(cpu) = asid;

             reply index

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-05  3:24 Jiwei Sun [this message]
2017-03-05  9:38 ` Sergei Shtylyov
2017-03-06  7:21   ` jsun4
2017-03-06  8:34     ` Sergei Shtylyov
2017-03-07 12:06       ` Jiwei Sun
2017-03-06  2:44 yhb
2017-03-06  8:00 ` jsun4

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-MIPS Archive on

Archives are clonable:
	git clone --mirror linux-mips/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-mips linux-mips/ \
	public-inbox-index linux-mips

Newsgroup available over NNTP:

AGPL code for this site: git clone public-inbox