• David S. Miller's avatar
    sparc64: Fix race in TLB batch processing. · f36391d2
    David S. Miller authored
    As reported by Dave Kleikamp, when we emit cross calls to do batched
    TLB flush processing we have a race because we do not synchronize on
    the sibling cpus completing the cross call.
    So meanwhile the TLB batch can be reset (tb->tlb_nr set to zero, etc.)
    and either flushes are missed or flushes will flush the wrong
    Fix this by using generic infrastructure to synchonize on the
    completion of the cross call.
    This first required getting the flush_tlb_pending() call out from
    switch_to() which operates with locks held and interrupts disabled.
    The problem is that smp_call_function_many() cannot be invoked with
    IRQs disabled and this is explicitly checked for with WARN_ON_ONCE().
    We get the batch processing outside of locked IRQ disabled sections by
    using some ideas from the powerpc port. Namely, we only batch inside
    of arch_{enter,leave}_lazy_mmu_mode() calls.  If we're not in such a
    region, we flush TLBs synchronously.
    1) Get rid of xcall_flush_tlb_pending and per-cpu type
    2) Do TLB batch cross calls instead via:
    3) Batch only in lazy mmu sequences:
    	a) Add 'active' member to struct tlb_batch
    	c) Set 'active' in arch_enter_lazy_mmu_mode()
    	d) Run batch and clear 'active' in arch_leave_lazy_mmu_mode()
    	e) Check 'active' in tlb_batch_add_one() and do a synchronous
               flush if it's clear.
    4) Add infrastructure for synchronous TLB page flushes.
    	a) Implement __flush_tlb_page and per-cpu variants, patch
    	   as needed.
    	b) Likewise for xcall_flush_tlb_page.
    	c) Implement smp_flush_tlb_page() to invoke the cross-call.
    	d) Wire up global_flush_tlb_page() to the right routine based
               upon CONFIG_SMP
    5) It turns out that singleton batches are very common, 2 out of every
       3 batch flushes have only a single entry in them.
       The batch flush waiting is very expensive, both because of the poll
       on sibling cpu completeion, as well as because passing the tlb batch
       pointer to the sibling cpus invokes a shared memory dereference.
       Therefore, in flush_tlb_pending(), if there is only one entry in
       the batch perform a completely asynchronous global_flush_tlb_page()
    Reported-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Acked-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
pgtable_64.h 27.3 KB