Pull powerpc fix from Michael Ellerman: "Just one fix, to add a barrier in the switch_mm() code to make sure the mm cpumask update is ordered vs the MMU starting to load translations. As far as we know no one's actually hit the bug, but that's just luck. Thanks to Benjamin Herrenschmidt, Nicholas Piggin" * tag 'powerpc-4.13-8' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/mm: Ensure cpumask update is ordered
Unified · Split
| @@ -90,6 +90,24 @@ static inline void switch_mm_irqs_off(struct mm_struct *prev, · 89 unmodified lines | ||
| 90 | 90 | /* Mark this context has been used on the new CPU */ |
| 91 | 91 | if (!cpumask_test_cpu(smp_processor_id(), mm_cpumask(next))) { |
| 92 | 92 | cpumask_set_cpu(smp_processor_id(), mm_cpumask(next)); |
| 93 | + | |
| 94 | + /* | |
| 95 | + * This full barrier orders the store to the cpumask above vs | |
| 96 | + * a subsequent operation which allows this CPU to begin loading | |
| 97 | + * translations for next. | |
| 98 | + * | |
| 99 | + * When using the radix MMU that operation is the load of the | |
| 100 | + * MMU context id, which is then moved to SPRN_PID. | |
| 101 | + * | |
| 102 | + * For the hash MMU it is either the first load from slb_cache | |
| 103 | + * in switch_slb(), and/or the store of paca->mm_ctx_id in | |
| 104 | + * copy_mm_to_paca(). | |
| 105 | + * | |
| 106 | + * On the read side the barrier is in pte_xchg(), which orders | |
| 107 | + * the store to the PTE vs the load of mm_cpumask. | |
| 108 | + */ | |
| 109 | + smp_mb(); | |
| 110 | + | |
| 93 | 111 | new_on_cpu = true; |
| 94 | 112 | } |
| 95 | 113 | |
| @@ -87,6 +87,7 @@ static inline bool pte_xchg(pte_t *ptep, pte_t old, pte_t new) · 86 unmodified lines | ||
| 87 | 87 | unsigned long *p = (unsigned long *)ptep; |
| 88 | 88 | __be64 prev; |
| 89 | 89 | |
| 90 | + /* See comment in switch_mm_irqs_off() */ | |
| 90 | 91 | prev = (__force __be64)__cmpxchg_u64(p, (__force unsigned long)pte_raw(old), |
| 91 | 92 | (__force unsigned long)pte_raw(new)); |
| 92 | 93 | |
| @@ -62,6 +62,7 @@ static inline bool pte_xchg(pte_t *ptep, pte_t old, pte_t new) · 61 unmodified lines | ||
| 62 | 62 | { |
| 63 | 63 | unsigned long *p = (unsigned long *)ptep; |
| 64 | 64 | |
| 65 | + /* See comment in switch_mm_irqs_off() */ | |
| 65 | 66 | return pte_val(old) == __cmpxchg_u64(p, pte_val(old), pte_val(new)); |
| 66 | 67 | } |
| 67 | 68 | #endif |