sparc64, mm BUG in 3.9-rc8

From: Meelis Roos <mroos@linux.ee>

From: Meelis Roos <mroos@linux.ee>
Date: Mon, 22 Apr 2013 16:57:22 +0300 (EEST)

> Hello, I got a non-booting Sun E420R (sparc64) with 3.9-rc8: BUG-s in 
> mm/slub.c:925 and mm/memory.c:1267 (the latter keeps scrolling until 
> other things break and panic comes from trying to kill init). This is 
> reproducible. Same machine runs 3.9.0-rc7-00004-gbb33db7 successfully.
> Configuration is below.

It's certainly a bug in the TLB shootdown fix, please verify that
reverting the following fixes things:

From f36391d2790d04993f48da6a45810033a2cdf847 Mon Sep 17 00:00:00 2001
From: "David S. Miller" <davem@davemloft.net>
Date: Fri, 19 Apr 2013 17:26:26 -0400
Subject: [PATCH] sparc64: Fix race in TLB batch processing.

As reported by Dave Kleikamp, when we emit cross calls to do batched
TLB flush processing we have a race because we do not synchronize on
the sibling cpus completing the cross call.

So meanwhile the TLB batch can be reset (tb->tlb_nr set to zero, etc.)
and either flushes are missed or flushes will flush the wrong
addresses.

Fix this by using generic infrastructure to synchonize on the
completion of the cross call.

This first required getting the flush_tlb_pending() call out from
switch_to() which operates with locks held and interrupts disabled.
The problem is that smp_call_function_many() cannot be invoked with
IRQs disabled and this is explicitly checked for with WARN_ON_ONCE().

We get the batch processing outside of locked IRQ disabled sections by
using some ideas from the powerpc port. Namely, we only batch inside
of arch_{enter,leave}_lazy_mmu_mode() calls.  If we're not in such a
region, we flush TLBs synchronously.

1) Get rid of xcall_flush_tlb_pending and per-cpu type
   implementations.

2) Do TLB batch cross calls instead via:

	smp_call_function_many()
		tlb_pending_func()
			__flush_tlb_pending()

3) Batch only in lazy mmu sequences:

	a) Add 'active' member to struct tlb_batch
	b) Define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
	c) Set 'active' in arch_enter_lazy_mmu_mode()
	d) Run batch and clear 'active' in arch_leave_lazy_mmu_mode()
	e) Check 'active' in tlb_batch_add_one() and do a synchronous
           flush if it's clear.

4) Add infrastructure for synchronous TLB page flushes.

	a) Implement __flush_tlb_page and per-cpu variants, patch
	   as needed.
	b) Likewise for xcall_flush_tlb_page.
	c) Implement smp_flush_tlb_page() to invoke the cross-call.
	d) Wire up global_flush_tlb_page() to the right routine based
           upon CONFIG_SMP

5) It turns out that singleton batches are very common, 2 out of every
   3 batch flushes have only a single entry in them.

   The batch flush waiting is very expensive, both because of the poll
   on sibling cpu completeion, as well as because passing the tlb batch
   pointer to the sibling cpus invokes a shared memory dereference.

   Therefore, in flush_tlb_pending(), if there is only one entry in
   the batch perform a completely asynchronous global_flush_tlb_page()
   instead.

Reported-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Dave Kleikamp <dave.kleikamp@oracle.com>
---
 arch/sparc/include/asm/pgtable_64.h   |   1 +
 arch/sparc/include/asm/switch_to_64.h |   3 +-
 arch/sparc/include/asm/tlbflush_64.h  |  37 +++++++++--
 arch/sparc/kernel/smp_64.c            |  41 ++++++++++--
 arch/sparc/mm/tlb.c                   |  38 +++++++++--
 arch/sparc/mm/tsb.c                   |  57 +++++++++++-----
 arch/sparc/mm/ultra.S                 | 119 +++++++++++++++++++++++++++-------
 7 files changed, 241 insertions(+), 55 deletions(-)

Message ID	20130422.152741.652969183920758931.davem@davemloft.net
State	Not Applicable
Delegated to:	David Miller
Headers	show Return-Path: <sparclinux-owner@vger.kernel.org> X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D65FC2C014A for <patchwork-incoming@ozlabs.org>; Tue, 23 Apr 2013 05:27:45 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754773Ab3DVT1o (ORCPT <rfc822;patchwork-incoming@ozlabs.org>); Mon, 22 Apr 2013 15:27:44 -0400 Received: from shards.monkeyblade.net ([149.20.54.216]:37073 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754736Ab3DVT1n (ORCPT <rfc822; sparclinux@vger.kernel.org>); Mon, 22 Apr 2013 15:27:43 -0400 Received: from localhost (cpe-66-108-118-205.nyc.res.rr.com [66.108.118.205]) (Authenticated sender: davem-davemloft) by shards.monkeyblade.net (Postfix) with ESMTPSA id 4D9DF584B85; Mon, 22 Apr 2013 12:27:42 -0700 (PDT) Date: Mon, 22 Apr 2013 15:27:41 -0400 (EDT) Message-Id: <20130422.152741.652969183920758931.davem@davemloft.net> To: mroos@linux.ee Cc: linux-kernel@vger.kernel.org, sparclinux@vger.kernel.org Subject: Re: sparc64, mm BUG in 3.9-rc8 From: David Miller <davem@davemloft.net> In-Reply-To: <alpine.SOC.1.00.1304221601370.4328@math.ut.ee> References: <alpine.SOC.1.00.1304221601370.4328@math.ut.ee> X-Mailer: Mew version 6.5 on Emacs 24.1 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (shards.monkeyblade.net [0.0.0.0]); Mon, 22 Apr 2013 12:27:42 -0700 (PDT) Sender: sparclinux-owner@vger.kernel.org Precedence: bulk List-ID: <sparclinux.vger.kernel.org> X-Mailing-List: sparclinux@vger.kernel.org

sparc64, mm BUG in 3.9-rc8

Commit Message

Comments

Patch