The patch titled
ia64: race flushing icache in do_no_page path
has been added to the -mm tree. Its filename is
ia64-race-flushing-icache-in-do_no_page-path.patch
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: ia64: race flushing icache in do_no_page path
From: Mike Stroyan <mike.stroyan@xxxxxx>
This is a very similar problem to a copy-on-write cache flushing problem
that Tony Luck fixed in July 2006. In this case the do_no_page function
handles a fault in an executable or library that is mmapped from an NFS
file system. The code is copied into a newly reallocated page. The
lazy_mmu_prot_update() function should be used to flush old entries from
the icache for that page on ia64 processors. But that call is made after a
set_pte_at call that makes the page accessible to other threads executing
the same code. This was seen to cause application crashes when an OpenMP
application ran many threads calling same functions at the same time. The
first thread to reach a page starts to fault in the new code. One of the
other threads overtakes the first and executes old data from the icache.
That could result in bad instructions. It is more obvious when an old
cache line contains prefetched non-instruction bits that result in an
illegal instruction trap.
The problem has only been seen on montecito processors which have separate
level 2 icache and dcache. This dcache to icache coherency problem is more
likely to occur there because of the much larger level 2 icache. I suspect
that the non-NFS case is working because direct DMA into the new page is
making the instruction cache coherent. Any file system that uses a non-DMA
copy into the text page could show the same problem.
Signed-off-by: Mike Stroyan <mike.stroyan@xxxxxx>
Cc: Nick Piggin <nickpiggin@xxxxxxxxxxxx>
Cc: Hugh Dickins <hugh@xxxxxxxxxxx>
Cc: "Luck, Tony" <tony.luck@xxxxxxxxx>
Cc: Rik van Riel <riel@xxxxxxxxxx>
Cc: <stable@xxxxxxxxxx>
Cc: Trond Myklebust <trond.myklebust@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/memory.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -puN mm/memory.c~ia64-race-flushing-icache-in-do_no_page-path mm/memory.c
--- a/mm/memory.c~ia64-race-flushing-icache-in-do_no_page-path
+++ a/mm/memory.c
@@ -2291,6 +2291,7 @@ retry:
entry = mk_pte(new_page, vma->vm_page_prot);
if (write_access)
entry = maybe_mkwrite(pte_mkdirty(entry), vma);
+ lazy_mmu_prot_update(entry);
set_pte_at(mm, address, page_table, entry);
if (anon) {
inc_mm_counter(mm, anon_rss);
@@ -2312,7 +2313,6 @@ retry:
/* no need to invalidate: a not-present page shouldn't be cached */
update_mmu_cache(vma, address, entry);
- lazy_mmu_prot_update(entry);
unlock:
pte_unmap_unlock(page_table, ptl);
if (dirty_page) {
_
Patches currently in -mm which might be from mike.stroyan@xxxxxx are
ia64-race-flushing-icache-in-do_no_page-path.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
