forked from luck/tmp_suning_uos_patched
ac53c4fca4
Problem: 1) Huge page mapping of anonymous memory is initially invalid. Will be faulted in by copy-on-write mechanism. 2) Userspace attempts store at the end of the huge mapping. 3) TLB Refill exception handler fill TLB with a normal (4K sized) invalid page at the end of the huge mapping virtual address range. 4) Userspace restarted, and re-attempts the store at the end of the huge mapping. 5) Page from #3 is invalid, we get a fault and go to the hugepage fault handler. This tries to map a huge page and calls huge_ptep_set_access_flags() to install the mapping. 6) We just call the generic ptep_set_access_flags() to set up the page tables, but the flush there assumes a normal (4K sized) page and only tries to flush the first part of the huge page virtual address out of the TLB, since the existing entry from step #3 doesn't conflict, nothing is flushed. 7) We attempt to load the mapping into the TLB, but because it conflicts with the entry from step #3, we get a Machine Check exception. The fix: Flush the entire rage covered by the huge page in huge_ptep_set_access_flags(), and remove the optimization in local_flush_tlb_range() so that the flush actually does the correct thing. Signed-off-by: David Daney <david.daney@cavium.com> Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: Hillf Danton <dhillf@gmail.com> Patchwork: https://patchwork.linux-mips.org/patch/4661/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org> (cherry picked from commit dd617f258cc39d36be26afee9912624a2d23112c) |
||
|---|---|---|
| .. | ||
| c-octeon.c | ||
| c-r3k.c | ||
| c-r4k.c | ||
| c-tx39.c | ||
| cache.c | ||
| cerr-sb1.c | ||
| cex-gen.S | ||
| cex-oct.S | ||
| cex-sb1.S | ||
| dma-default.c | ||
| extable.c | ||
| fault.c | ||
| gup.c | ||
| highmem.c | ||
| hugetlbpage.c | ||
| init.c | ||
| ioremap.c | ||
| Makefile | ||
| mmap.c | ||
| page-funcs.S | ||
| page.c | ||
| pgtable-32.c | ||
| pgtable-64.c | ||
| sc-ip22.c | ||
| sc-mips.c | ||
| sc-r5k.c | ||
| sc-rm7k.c | ||
| tlb-r3k.c | ||
| tlb-r4k.c | ||
| tlb-r8k.c | ||
| tlbex-fault.S | ||
| tlbex.c | ||
| uasm.c | ||