Re: [RFC PATCH 2/2] zap_pte_range: fix partial TLB flushing in response to a dirty pte

Linus Torvalds
2014-10-28T15:18:43Z

On Tue, Oct 28, 2014 at 4:44 AM, Will Deacon <will.deacon@arm.com> wrote:
> @@ -1194,11 +1194,10 @@ again:
> * then update the range to be the remaining
> * TLB range.
> */
> - old_end = tlb->end;
> - tlb->end = addr;
> + tlb->end = old_end = min(tlb->end, addr);
> tlb_flush_mmu_tlbonly(tlb);
> - tlb->start = addr;
> - tlb->end = old_end;
> + tlb->start = old_end;
> + tlb->end = end;

I don't think this is right. Setting "tlb->end = end" looks very wrong
indeed, because "end" here inside zap_pte_range() is *not* the final
end of the zap range, it is just the end of the current set of pte's.

There's a reason the old code *saved* the old end value. You've now
ripped that out, and use the "old_end" for something else entirely.

Your arm64 version of tlb_add_flush() then hides the bug you just
introduced by updating the end range for each page you encounter. But
quite frankly, I think your problems are all fundamental to that very
issue. You're playing games with start/end during the TLB flush
itself, which is not how those things were designed to work.

So now you break everything that *doesn't* do your arm games.

Linus