Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings
forked fromtorvalds/linux

Commitb6bdb75

Browse files
toshikanitorvalds
authored andcommitted
mm/vmalloc: add interfaces to free unmapped page table
On architectures with CONFIG_HAVE_ARCH_HUGE_VMAP set, ioremap() maycreate pud/pmd mappings. A kernel panic was observed on arm64 systemswith Cortex-A75 in the following steps as described by Hanjun Guo. 1. ioremap a 4K size, valid page table will build, 2. iounmap it, pte0 will set to 0; 3. ioremap the same address with 2M size, pgd/pmd is unchanged, then set the a new value for pmd; 4. pte0 is leaked; 5. CPU may meet exception because the old pmd is still in TLB, which will lead to kernel panic.This panic is not reproducible on x86. INVLPG, called from iounmap,purges all levels of entries associated with purged address on x86. x86still has memory leak.The patch changes the ioremap path to free unmapped page table(s) sincedoing so in the unmap path has the following issues: - The iounmap() path is shared with vunmap(). Since vmap() only supports pte mappings, making vunmap() to free a pte page is an overhead for regular vmap users as they do not need a pte page freed up. - Checking if all entries in a pte page are cleared in the unmap path is racy, and serializing this check is expensive. - The unmap path calls free_vmap_area_noflush() to do lazy TLB purges. Clearing a pud/pmd entry before the lazy TLB purges needs extra TLB purge.Add two interfaces, pud_free_pmd_page() and pmd_free_pte_page(), whichclear a given pud/pmd entry and free up a page for the lower levelentries.This patch implements their stub functions on x86 and arm64, which workas workaround.[akpm@linux-foundation.org: fix typo in pmd_free_pte_page() stub]Link:http://lkml.kernel.org/r/20180314180155.19492-2-toshi.kani@hpe.comFixes:e61ce6a ("mm: change ioremap to set up huge I/O mappings")Reported-by: Lei Li <lious.lilei@hisilicon.com>Signed-off-by: Toshi Kani <toshi.kani@hpe.com>Cc: Catalin Marinas <catalin.marinas@arm.com>Cc: Wang Xuefeng <wxf.wang@hisilicon.com>Cc: Will Deacon <will.deacon@arm.com>Cc: Hanjun Guo <guohanjun@huawei.com>Cc: Michal Hocko <mhocko@suse.com>Cc: Thomas Gleixner <tglx@linutronix.de>Cc: Ingo Molnar <mingo@redhat.com>Cc: "H. Peter Anvin" <hpa@zytor.com>Cc: Borislav Petkov <bp@suse.de>Cc: Matthew Wilcox <willy@infradead.org>Cc: Chintan Pandya <cpandya@codeaurora.org>Cc: <stable@vger.kernel.org>Signed-off-by: Andrew Morton <akpm@linux-foundation.org>Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent1705f7c commitb6bdb75

File tree

4 files changed

+48
-2
lines changed

4 files changed

+48
-2
lines changed

‎arch/arm64/mm/mmu.c‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -972,3 +972,13 @@ int pmd_clear_huge(pmd_t *pmdp)
972972
pmd_clear(pmdp);
973973
return1;
974974
}
975+
976+
intpud_free_pmd_page(pud_t*pud)
977+
{
978+
returnpud_none(*pud);
979+
}
980+
981+
intpmd_free_pte_page(pmd_t*pmd)
982+
{
983+
returnpmd_none(*pmd);
984+
}

‎arch/x86/mm/pgtable.c‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -702,4 +702,28 @@ int pmd_clear_huge(pmd_t *pmd)
702702

703703
return0;
704704
}
705+
706+
/**
707+
* pud_free_pmd_page - Clear pud entry and free pmd page.
708+
* @pud: Pointer to a PUD.
709+
*
710+
* Context: The pud range has been unmaped and TLB purged.
711+
* Return: 1 if clearing the entry succeeded. 0 otherwise.
712+
*/
713+
intpud_free_pmd_page(pud_t*pud)
714+
{
715+
returnpud_none(*pud);
716+
}
717+
718+
/**
719+
* pmd_free_pte_page - Clear pmd entry and free pte page.
720+
* @pmd: Pointer to a PMD.
721+
*
722+
* Context: The pmd range has been unmaped and TLB purged.
723+
* Return: 1 if clearing the entry succeeded. 0 otherwise.
724+
*/
725+
intpmd_free_pte_page(pmd_t*pmd)
726+
{
727+
returnpmd_none(*pmd);
728+
}
705729
#endif/* CONFIG_HAVE_ARCH_HUGE_VMAP */

‎include/asm-generic/pgtable.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -983,6 +983,8 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot);
983983
intpmd_set_huge(pmd_t*pmd,phys_addr_taddr,pgprot_tprot);
984984
intpud_clear_huge(pud_t*pud);
985985
intpmd_clear_huge(pmd_t*pmd);
986+
intpud_free_pmd_page(pud_t*pud);
987+
intpmd_free_pte_page(pmd_t*pmd);
986988
#else/* !CONFIG_HAVE_ARCH_HUGE_VMAP */
987989
staticinlineintp4d_set_huge(p4d_t*p4d,phys_addr_taddr,pgprot_tprot)
988990
{
@@ -1008,6 +1010,14 @@ static inline int pmd_clear_huge(pmd_t *pmd)
10081010
{
10091011
return0;
10101012
}
1013+
staticinlineintpud_free_pmd_page(pud_t*pud)
1014+
{
1015+
return0;
1016+
}
1017+
staticinlineintpmd_free_pte_page(pmd_t*pmd)
1018+
{
1019+
return0;
1020+
}
10111021
#endif/* CONFIG_HAVE_ARCH_HUGE_VMAP */
10121022

10131023
#ifndef__HAVE_ARCH_FLUSH_PMD_TLB_RANGE

‎lib/ioremap.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,8 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
9191

9292
if (ioremap_pmd_enabled()&&
9393
((next-addr)==PMD_SIZE)&&
94-
IS_ALIGNED(phys_addr+addr,PMD_SIZE)) {
94+
IS_ALIGNED(phys_addr+addr,PMD_SIZE)&&
95+
pmd_free_pte_page(pmd)) {
9596
if (pmd_set_huge(pmd,phys_addr+addr,prot))
9697
continue;
9798
}
@@ -117,7 +118,8 @@ static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr,
117118

118119
if (ioremap_pud_enabled()&&
119120
((next-addr)==PUD_SIZE)&&
120-
IS_ALIGNED(phys_addr+addr,PUD_SIZE)) {
121+
IS_ALIGNED(phys_addr+addr,PUD_SIZE)&&
122+
pud_free_pmd_page(pud)) {
121123
if (pud_set_huge(pud,phys_addr+addr,prot))
122124
continue;
123125
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp