From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C37A5C3F6B0 for ; Thu, 25 Aug 2022 01:36:58 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0CB896B0074; Wed, 24 Aug 2022 21:36:58 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 07ABB6B0075; Wed, 24 Aug 2022 21:36:58 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E840A940007; Wed, 24 Aug 2022 21:36:57 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id D91AD6B0074 for ; Wed, 24 Aug 2022 21:36:57 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id B02AC14132D for ; Thu, 25 Aug 2022 01:36:57 +0000 (UTC) X-FDA: 79836401274.27.11D6B46 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by imf24.hostedemail.com (Postfix) with ESMTP id 6CB9918006D for ; Thu, 25 Aug 2022 01:36:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1661391416; x=1692927416; h=from:to:cc:subject:references:date:in-reply-to: message-id:mime-version; bh=FTVuUuJ4Lc3bgKKtX+XXFr3/nIW0Mm2/GA4OVkkE7hw=; b=FHc0Vn8i1QgObDPoleqzjc3q1kkviNwG23N+wjg2xtaSdQ2C7M9fyM9c 993zVrTv/cumSigPNkGFPqXc7xboZz67H5eg4sNwL/A8xWbIs+1u4Qsgf aNlD83s/D6f5bs4rK3fzGFLy1Azek/DsbC9ztoJ1iGQbGU6diOUpQENGX JX2g/CGrcy3QPumtH0d3GNua1ifxEbVPpLQgSOfp5EUg4SBWk7sdMRly3 XwGWMF7sUBGG6eScYJV9TjS/2v/Lv0x9NesrUsBKk8lrBW30UIjfSY6o8 PaTMjqseAv0LmdGzB1/xP9l4oJffJtBNkJyPQuEdPMaEeC9Z9Qzik90jf A==; X-IronPort-AV: E=McAfee;i="6500,9779,10449"; a="274507637" X-IronPort-AV: E=Sophos;i="5.93,262,1654585200"; d="scan'208";a="274507637" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Aug 2022 18:36:55 -0700 X-IronPort-AV: E=Sophos;i="5.93,262,1654585200"; d="scan'208";a="586663677" Received: from yhuang6-desk2.sh.intel.com (HELO yhuang6-desk2.ccr.corp.intel.com) ([10.238.208.55]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Aug 2022 18:36:50 -0700 From: "Huang, Ying" To: Alistair Popple Cc: linux-mm@kvack.org, akpm@linux-foundation.org, Peter Xu , Nadav Amit , huang ying , LKML , "Sierra Guiza, Alejandro (Alex)" , Felix Kuehling , Jason Gunthorpe , John Hubbard , David Hildenbrand , Ralph Campbell , Matthew Wilcox , Karol Herbst , Lyude Paul , Ben Skeggs , Logan Gunthorpe , paulus@ozlabs.org, linuxppc-dev@lists.ozlabs.org, stable@vger.kernel.org Subject: Re: [PATCH v3 1/3] mm/migrate_device.c: Flush TLB while holding PTL References: <3b01af093515ce2960ac39bb16ff77473150d179.1661309831.git-series.apopple@nvidia.com> Date: Thu, 25 Aug 2022 09:36:39 +0800 In-Reply-To: <3b01af093515ce2960ac39bb16ff77473150d179.1661309831.git-series.apopple@nvidia.com> (Alistair Popple's message of "Wed, 24 Aug 2022 13:03:37 +1000") Message-ID: <87sfll2jfc.fsf@yhuang6-desk2.ccr.corp.intel.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=ascii ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1661391417; a=rsa-sha256; cv=none; b=zFBdCqK2YuGPdJafGHrho5g1Dm3JKgiarc+HQeUOIa85cXXDkZzNAdziUjAQeCpoRN9P0x cSVmwXB2iQBRzJ7l8azz7jba6wNO+IIj6FMzHLpqByOt6DLZ2b8Z7BqVVRgsQy+/zyRsBE VFn8QUqNGmBCv4mPDkk7vFNVK7o5Lzk= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=FHc0Vn8i; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf24.hostedemail.com: domain of ying.huang@intel.com designates 192.55.52.151 as permitted sender) smtp.mailfrom=ying.huang@intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1661391417; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=wDMOXQhDd2PbGRiVg2h0XNq9M+SiBc/Dwr+eDvfGu/Q=; b=LQeHzw8cxZPl2/WRIfrWstFZr/cyJ1D/RlT+s2STFk4Co0cDQl64NJhKYI/nt474Bmr5qv 3aTGBcB4LsVL8ZvSt5D4ZmbxE3m6f14BPRB37nlFWl1gXUjedhmoIeEdNx4+1gC3HByjke b7lEEiNVyFWJZygL20SOfnNYAYAfxfs= Authentication-Results: imf24.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=FHc0Vn8i; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf24.hostedemail.com: domain of ying.huang@intel.com designates 192.55.52.151 as permitted sender) smtp.mailfrom=ying.huang@intel.com X-Rspamd-Queue-Id: 6CB9918006D X-Rspamd-Server: rspam02 X-Stat-Signature: ts7wrotim1pbiofi13u8dghp6hu9c3jw X-Rspam-User: X-HE-Tag: 1661391416-835188 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Alistair Popple writes: > When clearing a PTE the TLB should be flushed whilst still holding the > PTL to avoid a potential race with madvise/munmap/etc. For example > consider the following sequence: > > CPU0 CPU1 > ---- ---- > > migrate_vma_collect_pmd() > pte_unmap_unlock() > madvise(MADV_DONTNEED) > -> zap_pte_range() > pte_offset_map_lock() > [ PTE not present, TLB not flushed ] > pte_unmap_unlock() > [ page is still accessible via stale TLB ] > flush_tlb_range() > > In this case the page may still be accessed via the stale TLB entry > after madvise returns. Fix this by flushing the TLB while holding the > PTL. > > Signed-off-by: Alistair Popple > Reported-by: Nadav Amit > Fixes: 8c3328f1f36a ("mm/migrate: migrate_vma() unmap page from vma while collecting pages") > Cc: stable@vger.kernel.org > > --- > > Changes for v3: > > - New for v3 > --- > mm/migrate_device.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/mm/migrate_device.c b/mm/migrate_device.c > index 27fb37d..6a5ef9f 100644 > --- a/mm/migrate_device.c > +++ b/mm/migrate_device.c > @@ -254,13 +254,14 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp, > migrate->dst[migrate->npages] = 0; > migrate->src[migrate->npages++] = mpfn; > } > - arch_leave_lazy_mmu_mode(); > - pte_unmap_unlock(ptep - 1, ptl); > > /* Only flush the TLB if we actually modified any entries */ > if (unmapped) > flush_tlb_range(walk->vma, start, end); It appears that we can increase "unmapped" only if ptep_get_and_clear() is used? Best Regards, Huang, Ying > + arch_leave_lazy_mmu_mode(); > + pte_unmap_unlock(ptep - 1, ptl); > + > return 0; > } > > > base-commit: ffcf9c5700e49c0aee42dcba9a12ba21338e8136