s390/mm: fix incorrect ASCE after crst_table_downgrade

Martin Schwidefsky · Martin Schwidefsky · commit 691d5264158e · 2015-03-02T11:35:57.000-08:00
The switch_mm function does nothing in case the prev and next mm are the same. It can happen that a crst_table_downgrade has changed the top-level pgd in the meantime on a different CPU. Always store the new ASCE to be picked up in entry.S. [heiko.carstens@de.ibm.com]: Bug was introduced with git commit 53e857f ("s390/mm,tlb: race of lazy TLB flush vs. recreation of TLB entries") and causes random crashes due to broken page tables being used. Reported-by: Dominik Vogt <vogt@linux.vnet.ibm.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
@@ -62,6 +62,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 {
 	int cpu = smp_processor_id();
 
+	S390_lowcore.user_asce = next->context.asce_bits | __pa(next->pgd);
 	if (prev == next)
 		return;
 	if (MACHINE_HAS_TLB_LC)
@@ -73,7 +74,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 	atomic_dec(&prev->context.attach_count);
 	if (MACHINE_HAS_TLB_LC)
 		cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
-	S390_lowcore.user_asce = next->context.asce_bits | __pa(next->pgd);
 }
 
 #define finish_arch_post_lock_switch finish_arch_post_lock_switch

Original file line number	Diff line number	Diff line change
`@@ -62,6 +62,7 @@ static inline void switch_mm(struct mm_struct prev, struct mm_struct next,`
`62`	`62`	`{`
`63`	`63`	`int cpu = smp_processor_id();`
`64`	`64`
	`65`	`+ S390_lowcore.user_asce = next->context.asce_bits \| __pa(next->pgd);`
`65`	`66`	`if (prev == next)`
`66`	`67`	`return;`
`67`	`68`	`if (MACHINE_HAS_TLB_LC)`
`@@ -73,7 +74,6 @@ static inline void switch_mm(struct mm_struct prev, struct mm_struct next,`
`73`	`74`	`atomic_dec(&prev->context.attach_count);`
`74`	`75`	`if (MACHINE_HAS_TLB_LC)`
`75`	`76`	`cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);`
`76`		`- S390_lowcore.user_asce = next->context.asce_bits \| __pa(next->pgd);`
`77`	`77`	`}`
`78`	`78`
`79`	`79`	`#define finish_arch_post_lock_switch finish_arch_post_lock_switch`