++linux-mm to get some pointers on how to test such mmu_gather changes
Dave Vasilevsky via B4 Relay <[email protected]> writes: > From: Dave Vasilevsky <[email protected]> > > On 32-bit book3s with hash-MMUs, tlb_flush() was a no-op. This was > unnoticed because all uses until recently were for unmaps, and thus > handled by __tlb_remove_tlb_entry(). > > After commit 4a18419f71cd ("mm/mprotect: use mmu_gather") in kernel 5.19, > tlb_gather_mmu() started being used for mprotect as well. This caused > mprotect to simply not work on these machines: > > int *ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); > *ptr = 1; // force HPTE to be created > mprotect(ptr, 4096, PROT_READ); > *ptr = 2; // should segfault, but succeeds I am surprised how come this was not caught? Don't we have any straight forward selftest for this? Not just mprotect then right.. Many other MM paths must also be using mmu_gather right? > > Fixed by making tlb_flush() actually flush TLB pages. This finally > agrees with the behaviour of boot3s64's tlb_flush(). > > Fixes: 4a18419f71cd ("mm/mprotect: use mmu_gather") > Signed-off-by: Dave Vasilevsky <[email protected]> > --- > arch/powerpc/include/asm/book3s/32/tlbflush.h | 8 ++++++-- > arch/powerpc/mm/book3s32/tlb.c | 6 ++++++ > 2 files changed, 12 insertions(+), 2 deletions(-) > > diff --git a/arch/powerpc/include/asm/book3s/32/tlbflush.h > b/arch/powerpc/include/asm/book3s/32/tlbflush.h > index > e43534da5207aa3b0cb3c07b78e29b833c141f3f..b8c587ad2ea954f179246a57d6e86e45e91dcfdc > 100644 > --- a/arch/powerpc/include/asm/book3s/32/tlbflush.h > +++ b/arch/powerpc/include/asm/book3s/32/tlbflush.h > @@ -11,6 +11,7 @@ > void hash__flush_tlb_mm(struct mm_struct *mm); > void hash__flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr); > void hash__flush_range(struct mm_struct *mm, unsigned long start, unsigned > long end); > +void hash__flush_gather(struct mmu_gather *tlb); > > #ifdef CONFIG_SMP > void _tlbie(unsigned long address); > @@ -28,9 +29,12 @@ void _tlbia(void); > */ > static inline void tlb_flush(struct mmu_gather *tlb) > { > - /* 603 needs to flush the whole TLB here since it doesn't use a hash > table. */ > - if (!mmu_has_feature(MMU_FTR_HPTE_TABLE)) > + if (mmu_has_feature(MMU_FTR_HPTE_TABLE)) { > + hash__flush_gather(tlb); > + } else { > + /* 603 needs to flush the whole TLB here since it doesn't use a > hash table. */ > _tlbia(); > + } > } > > static inline void flush_range(struct mm_struct *mm, unsigned long start, > unsigned long end) > diff --git a/arch/powerpc/mm/book3s32/tlb.c b/arch/powerpc/mm/book3s32/tlb.c > index > 9ad6b56bfec96e989b96f027d075ad5812500854..3da95ecfbbb296303082e378425e92a5fbdbfac8 > 100644 > --- a/arch/powerpc/mm/book3s32/tlb.c > +++ b/arch/powerpc/mm/book3s32/tlb.c > @@ -105,3 +105,9 @@ void hash__flush_tlb_page(struct vm_area_struct *vma, > unsigned long vmaddr) > flush_hash_pages(mm->context.id, vmaddr, pmd_val(*pmd), 1); > } > EXPORT_SYMBOL(hash__flush_tlb_page); > + > +void hash__flush_gather(struct mmu_gather *tlb) > +{ > + hash__flush_range(tlb->mm, tlb->start, tlb->end); > +} > +EXPORT_SYMBOL(hash__flush_gather); Shouldn't we flush all if we get tlb_flush request for full mm? e.g. Something like this maybe? +void hash__tlb_flush(struct mmu_gather *tlb) +{ + if (tlb->fullmm || tlb->need_flush_all) + hash__flush_tlb_mm(tlb->mm); + else + hash__flush_range(tlb->mm, tlb->start, tlb->end); +} It will be quicker if someone already has a set of tests which we can run to validate. If not, I will take a look and see what tests one can run to validate mmu_gather feature. > > --- > base-commit: dcb6fa37fd7bc9c3d2b066329b0d27dedf8becaa > change-id: 20251027-vasi-mprotect-g3-f8f5278d4140 > > Best regards, > -- > Dave Vasilevsky <[email protected]> Thanks again for pointing this out. How did you find this though? What hardware do you use? -ritesh
