From: Andy Lutomirski <luto@kernel.org>
To: Rik van Riel <riel@surriel.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
86@vger.kernel.org, Andrew Lutomirski <luto@kernel.org>,
Ingo Molnar <mingo@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
Mike Galbraith <efault@gmx.de>,
songliubraving@fb.com, kernel-team <kernel-team@fb.com>
Subject: Re: [PATCH 2/7] x86,tlb: leave lazy TLB mode at page table free time
Date: Fri, 22 Jun 2018 07:58:43 -0700 [thread overview]
Message-ID: <CALCETrX+EmeV5PxfwDwO=W4Deu9T_nPj5WbQX0mgxMV08vN=tg@mail.gmail.com> (raw)
In-Reply-To: <20180620195652.27251-3-riel@surriel.com>
On Wed, Jun 20, 2018 at 12:57 PM Rik van Riel <riel@surriel.com> wrote:
>
> Andy discovered that speculative memory accesses while in lazy
> TLB mode can crash a system, when a CPU tries to dereference a
> speculative access using memory contents that used to be valid
> page table memory, but have since been reused for something else
> and point into la-la land.
>
> The latter problem can be prevented in two ways. The first is to
> always send a TLB shootdown IPI to CPUs in lazy TLB mode, while
> the second one is to only send the TLB shootdown at page table
> freeing time.
>
> The second should result in fewer IPIs, since operationgs like
> mprotect and madvise are very common with some workloads, but
> do not involve page table freeing. Also, on munmap, batching
> of page table freeing covers much larger ranges of virtual
> memory than the batching of unmapped user pages.
>
> Signed-off-by: Rik van Riel <riel@surriel.com>
> Tested-by: Song Liu <songliubraving@fb.com>
> ---
> arch/x86/include/asm/tlbflush.h | 5 +++++
> arch/x86/mm/tlb.c | 24 ++++++++++++++++++++++++
> include/asm-generic/tlb.h | 10 ++++++++++
> mm/memory.c | 22 ++++++++++++++--------
> 4 files changed, 53 insertions(+), 8 deletions(-)
>
> diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
> index 6690cd3fc8b1..3aa3204b5dc0 100644
> --- a/arch/x86/include/asm/tlbflush.h
> +++ b/arch/x86/include/asm/tlbflush.h
> @@ -554,4 +554,9 @@ extern void arch_tlbbatch_flush(struct arch_tlbflush_unmap_batch *batch);
> native_flush_tlb_others(mask, info)
> #endif
>
> +extern void tlb_flush_remove_tables(struct mm_struct *mm);
> +extern void tlb_flush_remove_tables_local(void *arg);
> +
> +#define HAVE_TLB_FLUSH_REMOVE_TABLES
> +
> #endif /* _ASM_X86_TLBFLUSH_H */
> diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
> index e055d1a06699..61773b07ed54 100644
> --- a/arch/x86/mm/tlb.c
> +++ b/arch/x86/mm/tlb.c
> @@ -646,6 +646,30 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
> put_cpu();
> }
>
> +void tlb_flush_remove_tables_local(void *arg)
> +{
> + struct mm_struct *mm = arg;
> +
> + if (this_cpu_read(cpu_tlbstate.loaded_mm) == mm &&
> + this_cpu_read(cpu_tlbstate.is_lazy))
> + /*
> + * We're in lazy mode. We need to at least flush our
> + * paging-structure cache to avoid speculatively reading
> + * garbage into our TLB. Since switching to init_mm is barely
> + * slower than a minimal flush, just switch to init_mm.
> + */
> + switch_mm_irqs_off(NULL, &init_mm, NULL);
Can you add braces?
> +}
> +
> +void tlb_flush_remove_tables(struct mm_struct *mm)
> +{
> + int cpu = get_cpu();
> + /*
> + * XXX: this really only needs to be called for CPUs in lazy TLB mode.
> + */
> + if (cpumask_any_but(mm_cpumask(mm), cpu) < nr_cpu_ids)
> + smp_call_function_many(mm_cpumask(mm), tlb_flush_remove_tables_local, (void *)mm, 1);
I suspect that most if the gain will come from fixing this limitation :)
next prev parent reply other threads:[~2018-06-22 14:59 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-20 19:56 [PATCH 0/7] x86,tlb,mm: make lazy TLB mode even lazier Rik van Riel
2018-06-20 19:56 ` [PATCH 1/7] mm: allocate mm_cpumask dynamically based on nr_cpu_ids Rik van Riel
2018-06-20 21:32 ` kbuild test robot
2018-06-21 20:18 ` Rik van Riel
2018-06-21 0:24 ` kbuild test robot
2018-06-22 15:10 ` Dave Hansen
2018-06-22 17:45 ` Rik van Riel
2018-06-20 19:56 ` [PATCH 2/7] x86,tlb: leave lazy TLB mode at page table free time Rik van Riel
2018-06-21 0:23 ` Rik van Riel
2018-06-22 14:58 ` Andy Lutomirski [this message]
2018-06-22 15:17 ` Rik van Riel
2018-06-20 19:56 ` [PATCH 3/7] x86,tlb: change tlbstate.is_lazy to tlbstate.state Rik van Riel
2018-06-22 17:01 ` Dave Hansen
2018-06-22 17:08 ` Rik van Riel
2018-06-20 19:56 ` [PATCH 4/7] x86,tlb: make lazy TLB mode lazier Rik van Riel
2018-06-22 15:04 ` Andy Lutomirski
2018-06-22 15:15 ` Rik van Riel
2018-06-22 15:34 ` Andy Lutomirski
2018-06-22 17:05 ` Dave Hansen
2018-06-22 17:16 ` Rik van Riel
2018-06-20 19:56 ` [PATCH 5/7] x86,tlb: only send page table free TLB flush to lazy TLB CPUs Rik van Riel
2018-06-22 17:23 ` Dave Hansen
2018-06-20 19:56 ` [PATCH 6/7] x86,mm: always use lazy TLB mode Rik van Riel
2018-06-20 19:56 ` [PATCH 7/7] x86,idle: do not leave mm in idle state Rik van Riel
2018-06-20 22:20 ` kbuild test robot
2018-06-21 0:25 ` Rik van Riel
2018-06-22 15:36 ` Andy Lutomirski
2018-06-22 15:53 ` Rik van Riel
2018-06-22 16:01 ` Andy Lutomirski
2018-06-22 20:18 ` Rik van Riel
2018-06-22 22:05 ` Andy Lutomirski
2018-06-23 0:55 ` Rik van Riel
2018-06-29 14:29 [PATCH v3 0/7] x86,tlb,mm: make lazy TLB mode even lazier Rik van Riel
2018-06-29 14:29 ` [PATCH 2/7] x86,tlb: leave lazy TLB mode at page table free time Rik van Riel
2018-06-29 16:39 ` Dave Hansen
2018-06-29 16:56 ` Rik van Riel
2018-07-06 21:56 [PATCH v4 0/7] x86,tlb,mm: make lazy TLB mode even lazier Rik van Riel
2018-07-06 21:56 ` [PATCH 2/7] x86,tlb: leave lazy TLB mode at page table free time Rik van Riel
2018-07-10 14:28 [PATCH v5 0/7] x86,tlb,mm: make lazy TLB mode even lazier Rik van Riel
2018-07-10 14:28 ` [PATCH 2/7] x86,tlb: leave lazy TLB mode at page table free time Rik van Riel
2018-07-16 19:03 [PATCH v6 0/7] x86,tlb,mm: make lazy TLB mode even lazier Rik van Riel
2018-07-16 19:03 ` [PATCH 2/7] x86,tlb: leave lazy TLB mode at page table free time Rik van Riel
2018-08-16 1:54 ` Andy Lutomirski
2018-08-16 5:31 ` Rik van Riel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CALCETrX+EmeV5PxfwDwO=W4Deu9T_nPj5WbQX0mgxMV08vN=tg@mail.gmail.com' \
--to=luto@kernel.org \
--cc=86@vger.kernel.org \
--cc=dave.hansen@linux.intel.com \
--cc=efault@gmx.de \
--cc=kernel-team@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=riel@surriel.com \
--cc=songliubraving@fb.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).