lkml.org 
[lkml]   [2021]   [Nov]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 251/251] hugetlbfs: flush TLBs correctly after huge_pmd_unshare
    Date
    From: Nadav Amit <namit@vmware.com>

    commit a4a118f2eead1d6c49e00765de89878288d4b890 upstream.

    When __unmap_hugepage_range() calls to huge_pmd_unshare() succeed, a TLB
    flush is missing. This TLB flush must be performed before releasing the
    i_mmap_rwsem, in order to prevent an unshared PMDs page from being
    released and reused before the TLB flush took place.

    Arguably, a comprehensive solution would use mmu_gather interface to
    batch the TLB flushes and the PMDs page release, however it is not an
    easy solution: (1) try_to_unmap_one() and try_to_migrate_one() also call
    huge_pmd_unshare() and they cannot use the mmu_gather interface; and (2)
    deferring the release of the page reference for the PMDs page until
    after i_mmap_rwsem is dropeed can confuse huge_pmd_unshare() into
    thinking PMDs are shared when they are not.

    Fix __unmap_hugepage_range() by adding the missing TLB flush, and
    forcing a flush when unshare is successful.

    Fixes: 24669e58477e ("hugetlb: use mmu_gather instead of a temporary linked list for accumulating pages)" # 3.6
    Signed-off-by: Nadav Amit <namit@vmware.com>
    Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
    Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    include/asm-generic/tlb.h | 6 ++++++
    mm/hugetlb.c | 19 +++++++++++++++++++
    2 files changed, 25 insertions(+)

    --- a/include/asm-generic/tlb.h
    +++ b/include/asm-generic/tlb.h
    @@ -196,6 +196,12 @@ static inline void tlb_remove_check_page
    #define tlb_end_vma __tlb_end_vma
    #endif

    +static inline void tlb_flush_pmd_range(struct mmu_gather *tlb,
    + unsigned long address, unsigned long size)
    +{
    + __tlb_adjust_range(tlb, address, size);
    +}
    +
    #ifndef __tlb_remove_tlb_entry
    #define __tlb_remove_tlb_entry(tlb, ptep, address) do { } while (0)
    #endif
    --- a/mm/hugetlb.c
    +++ b/mm/hugetlb.c
    @@ -3386,6 +3386,7 @@ void __unmap_hugepage_range(struct mmu_g
    unsigned long sz = huge_page_size(h);
    const unsigned long mmun_start = start; /* For mmu_notifiers */
    const unsigned long mmun_end = end; /* For mmu_notifiers */
    + bool force_flush = false;

    WARN_ON(!is_vm_hugetlb_page(vma));
    BUG_ON(start & ~huge_page_mask(h));
    @@ -3407,6 +3408,8 @@ void __unmap_hugepage_range(struct mmu_g
    ptl = huge_pte_lock(h, mm, ptep);
    if (huge_pmd_unshare(mm, &address, ptep)) {
    spin_unlock(ptl);
    + tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE);
    + force_flush = true;
    continue;
    }

    @@ -3463,6 +3466,22 @@ void __unmap_hugepage_range(struct mmu_g
    }
    mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
    tlb_end_vma(tlb, vma);
    +
    + /*
    + * If we unshared PMDs, the TLB flush was not recorded in mmu_gather. We
    + * could defer the flush until now, since by holding i_mmap_rwsem we
    + * guaranteed that the last refernece would not be dropped. But we must
    + * do the flushing before we return, as otherwise i_mmap_rwsem will be
    + * dropped and the last reference to the shared PMDs page might be
    + * dropped as well.
    + *
    + * In theory we could defer the freeing of the PMD pages as well, but
    + * huge_pmd_unshare() relies on the exact page_count for the PMD page to
    + * detect sharing, so we cannot defer the release of the page either.
    + * Instead, do flush now.
    + */
    + if (force_flush)
    + tlb_flush_mmu(tlb);
    }

    void __unmap_hugepage_range_final(struct mmu_gather *tlb,

    \
     
     \ /
      Last update: 2021-11-24 13:49    [W:4.019 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site