Commit 9e52fc2b authored Aug 28, 2017 by Vitaly Kuznetsov Committed by Ingo Molnar Aug 31, 2017

x86/mm: Enable RCU based page table freeing (CONFIG_HAVE_RCU_TABLE_FREE=y)



There's a subtle bug in how some of the paravirt guest code handles
page table freeing on x86:

On x86 software page table walkers depend on the fact that remote TLB flush
does an IPI: walk is performed lockless but with interrupts disabled and in
case the page table is freed the freeing CPU will get blocked as remote TLB
flush is required. On other architectures which don't require an IPI to do
remote TLB flush we have an RCU-based mechanism (see
include/asm-generic/tlb.h for more details).

In virtualized environments we may want to override the ->flush_tlb_others
callback in pv_mmu_ops and use a hypercall asking the hypervisor to do a
remote TLB flush for us. This breaks the assumption about IPIs. Xen PV has
been doing this for years and the upcoming remote TLB flush for Hyper-V will
do it too.

This is not safe, as software page table walkers may step on an already
freed page.

Fix the bug by enabling the RCU-based page table freeing mechanism,
CONFIG_HAVE_RCU_TABLE_FREE=y.

Testing with kernbench and mmap/munmap microbenchmarks, and neither showed
any noticeable performance impact.

Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Acked-by: Juergen Gross <jgross@suse.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Jork Loeser <Jork.Loeser@microsoft.com>
Cc: KY Srinivasan <kys@microsoft.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: xen-devel@lists.xenproject.org
Link: http://lkml.kernel.org/r/20170828082251.5562-1-vkuznets@redhat.com


[ Rewrote/fixed/clarified the changelog. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>

parent 39e48d9b

arch/x86/Kconfig

+1 −0

Original line number	Diff line number	Diff line
		@@ -167,6 +167,7 @@ config X86
		select HAVE_HARDLOCKUP_DETECTOR_PERF if PERF_EVENTS && HAVE_PERF_EVENTS_NMI
		select HAVE_PERF_REGS
		select HAVE_PERF_USER_STACK_DUMP
		select HAVE_RCU_TABLE_FREE
		select HAVE_REGS_AND_STACK_ACCESS_API
		select HAVE_RELIABLE_STACKTRACE if X86_64 && FRAME_POINTER && STACK_VALIDATION
		select HAVE_STACK_VALIDATION if X86_64

arch/x86/include/asm/tlb.h

+14 −0

Original line number	Diff line number	Diff line
		@@ -15,4 +15,18 @@

		#include <asm-generic/tlb.h>

		/*
		* While x86 architecture in general requires an IPI to perform TLB
		* shootdown, enablement code for several hypervisors overrides
		* .flush_tlb_others hook in pv_mmu_ops and implements it by issuing
		* a hypercall. To keep software pagetable walkers safe in this case we
		* switch to RCU based table free (HAVE_RCU_TABLE_FREE). See the comment
		* below 'ifdef CONFIG_HAVE_RCU_TABLE_FREE' in include/asm-generic/tlb.h
		* for more details.
		*/
		static inline void __tlb_remove_table(void *table)
		{
		free_page_and_swap_cache(table);
		}

		#endif /* _ASM_X86_TLB_H */

arch/x86/mm/pgtable.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -56,7 +56,7 @@ void ___pte_free_tlb(struct mmu_gather tlb, struct page pte)
		{
		pgtable_page_dtor(pte);
		paravirt_release_pte(page_to_pfn(pte));
		tlb_remove_page(tlb, pte);
		tlb_remove_table(tlb, pte);
		}

		#if CONFIG_PGTABLE_LEVELS > 2
		@@ -72,21 +72,21 @@ void ___pmd_free_tlb(struct mmu_gather tlb, pmd_t pmd)
		tlb->need_flush_all = 1;
		#endif
		pgtable_pmd_page_dtor(page);
		tlb_remove_page(tlb, page);
		tlb_remove_table(tlb, page);
		}

		#if CONFIG_PGTABLE_LEVELS > 3
		void ___pud_free_tlb(struct mmu_gather tlb, pud_t pud)
		{
		paravirt_release_pud(__pa(pud) >> PAGE_SHIFT);
		tlb_remove_page(tlb, virt_to_page(pud));
		tlb_remove_table(tlb, virt_to_page(pud));
		}

		#if CONFIG_PGTABLE_LEVELS > 4
		void ___p4d_free_tlb(struct mmu_gather tlb, p4d_t p4d)
		{
		paravirt_release_p4d(__pa(p4d) >> PAGE_SHIFT);
		tlb_remove_page(tlb, virt_to_page(p4d));
		tlb_remove_table(tlb, virt_to_page(p4d));
		}
		#endif /* CONFIG_PGTABLE_LEVELS > 4 */
		#endif /* CONFIG_PGTABLE_LEVELS > 3 */

Admin message